Changeset 2483

Timestamp:

Aug 23, 2008, 3:15:33 AM (16 years ago)

Author:

rvelices

Message:

• security fix : when confquestion_mark_in_urls=true , $_SERVERPATH_INFO was not sanitized against sql injection
• mysql errors are now dumped using trigger_error instead of echo and die -> allow admins to see later on if someone tries funny stuff

Location:

branches/branch-1_7/include

Files:

• common.inc.php (modified) (2 diffs)
• functions.inc.php (modified) (2 diffs)

branches/branch-1_7/include/common.inc.php

@@ -103 +103 @@
   }
 }
+if ( !empty($_SERVER["PATH_INFO"]) )
+{
+  $_SERVER["PATH_INFO"] = addslashes($_SERVER["PATH_INFO"]);
+}
 
 //
@@ -142 +146 @@
 
 // Database connection
-mysql_connect( $cfgHote, $cfgUser, $cfgPassword )
-or die ( "Could not connect to database server" );
-mysql_select_db( $cfgBase )
-or die ( "Could not connect to database" );
+@mysql_connect( $cfgHote, $cfgUser, $cfgPassword ) or my_error( 'mysql_connect', true );
+@mysql_select_db( $cfgBase ) or my_error( 'mysql_select_db', true );
 
 //

branches/branch-1_7/include/functions.inc.php

@@ -630 +630 @@
 
   $start = get_moment();
-  $result = mysql_query($query) or my_error($query."\n");
+  ($result = mysql_query($query)) or my_error($query, $conf['die_on_sql_error']);
 
   $time = get_moment() - $start;
@@ -925 +925 @@
 // my_error returns (or send to standard output) the message concerning the
 // error occured for the last mysql query.
-function my_error($header)
-{
-  global $conf;
-
-  $error = '<pre>';
-  $error.= $header;
-  $error.= '[mysql error '.mysql_errno().'] ';
-  $error.= mysql_error();
-  $error.= '</pre>';
-
-  if ($conf['die_on_sql_error'])
-  {
-    die($error);
-  }
-  else
-  {
-    echo $error;
-  }
-}
+
+function my_error($header, $die)
+{
+  $error = $header;
+  $error.= "\n[mysql error ".mysql_errno().'] '.mysql_error()."\n";
+
+  if (function_exists('debug_backtrace'))
+  {
+    $bt = debug_backtrace();
+    for ($i=0; $i<count($bt); $i++)
+    {
+      $error .= "#$i\t".@$bt[$i]['function']." ".@$bt[$i]['file']."(".@@$bt[$i]['line'].")\n";
+    }
+  }
+
+  if ($die)
+  {
+    @set_status_header(500);
+    echo( str_repeat( ' ', 300)."\n"); //IE doesn't error output if below a size
+  }
+  echo("<pre>");
+  trigger_error($error, $die ? E_USER_ERROR : E_USER_WARNING);
+  !$die || die($error); // just in case the handler didnt die
+  echo("</pre>");
+}
+
 
 /**