mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Escape pg connection string on setup

This commit is contained in:
Brice Maron 2012-07-03 09:20:42 +02:00
parent 88cbbc86b8
commit 8a1c279183
1 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
lib/setup.php
View File

@ -155,8 +155,11 @@ class OC_Setup {
OC_CONFIG::setValue('dbhost', $dbhost); OC_CONFIG::setValue('dbhost', $dbhost);
OC_CONFIG::setValue('dbtableprefix', $dbtableprefix); OC_CONFIG::setValue('dbtableprefix', $dbtableprefix);
$e_host = addslashes($dbhost);
$e_user = addslashes($dbuser);
$e_password = addslashes($dbpass);
//check if the database user has admin right //check if the database user has admin right
$connection_string = "host=$dbhost dbname=postgres user=$dbuser password=$dbpass"; $connection_string = "host='$e_host' dbname=postgres user='$e_user' password='$e_password'";
$connection = @pg_connect($connection_string); $connection = @pg_connect($connection_string);
if(!$connection) { if(!$connection) {
$error[] = array( $error[] = array(
@ -166,8 +169,9 @@ class OC_Setup {
return $error; return $error;
} }
else { else {
$e_user = pg_escape_string($dbuser);
//check for roles creation rights in postgresql //check for roles creation rights in postgresql
$query="SELECT 1 FROM pg_roles WHERE rolcreaterole=TRUE AND rolname='$dbuser'"; $query="SELECT 1 FROM pg_roles WHERE rolcreaterole=TRUE AND rolname='$e_user'";
$result = pg_query($connection, $query); $result = pg_query($connection, $query);
if($result and pg_num_rows($result) > 0) { if($result and pg_num_rows($result) > 0) {
//use the admin login data for the new database user //use the admin login data for the new database user
@ -199,7 +203,13 @@ class OC_Setup {
// connect to the ownCloud database (dbname=$dbname) an check if it needs to be filled // connect to the ownCloud database (dbname=$dbname) an check if it needs to be filled
$dbuser = OC_CONFIG::getValue('dbuser'); $dbuser = OC_CONFIG::getValue('dbuser');
$dbpass = OC_CONFIG::getValue('dbpassword'); $dbpass = OC_CONFIG::getValue('dbpassword');
$connection_string = "host=$dbhost dbname=$dbname user=$dbuser password=$dbpass";
$e_host = addslashes($dbhost);
$e_dbname = addslashes($dbname);
$e_user = addslashes($dbuser);
$e_password = addslashes($dbpass);
$connection_string = "host='$e_host' dbname='$e_dbname' user='$e_user' password='$e_password'";
$connection = @pg_connect($connection_string); $connection = @pg_connect($connection_string);
if(!$connection) { if(!$connection) {
$error[] = array( $error[] = array(