On Mon, Apr 25, 2011 at 9:23 PM, Dan McGee <[email protected]> wrote: > Ensure we are not quoting these values in any of our SQL queries.
wewt! > Thanks-to: elij <[email protected]> > Signed-off-by: Dan McGee <[email protected]> > --- > > Smoke tested: > * Submitted a package update and it worked > * Updated a user's password from non-salted to salted variety > * Numerous login/logout cycles > > web/html/passreset.php | 4 ++-- > web/html/pkgsubmit.php | 2 +- > web/lib/acctfuncs.inc | 18 +++++++++--------- > web/lib/aur.inc | 6 +++--- > 4 files changed, 15 insertions(+), 15 deletions(-) > > diff --git a/web/html/passreset.php b/web/html/passreset.php > index 2c7801d..0ce6f7d 100644 > --- a/web/html/passreset.php > +++ b/web/html/passreset.php > @@ -58,8 +58,8 @@ if (isset($_GET['resetkey'], $_POST['email'], > $_POST['password'], $_POST['confir > $resetkey = new_sid(); > $dbh = db_connect(); > $q = "UPDATE Users > - SET ResetKey = '$resetkey' > - WHERE ID = '$uid'"; > + SET ResetKey = '" . $resetkey . "' > + WHERE ID = " . $uid; > db_query($q, $dbh); > # Send email with confirmation link > $body = __('A password reset request was submitted for the > account '. > diff --git a/web/html/pkgsubmit.php b/web/html/pkgsubmit.php > index 5797626..3ef5823 100644 > --- a/web/html/pkgsubmit.php > +++ b/web/html/pkgsubmit.php > @@ -320,7 +320,7 @@ if ($_COOKIE["AURSID"]): > } > > # Update package data > - $q = sprintf("UPDATE Packages SET ModifiedTS > = UNIX_TIMESTAMP(), Name = '%s', Version = '%s-%s', License = '%s', > Description = '%s', URL = '%s', OutOfDateTS = NULL, MaintainerUID = '%d' > WHERE ID = %d", > + $q = sprintf("UPDATE Packages SET ModifiedTS > = UNIX_TIMESTAMP(), Name = '%s', Version = '%s-%s', License = '%s', > Description = '%s', URL = '%s', OutOfDateTS = NULL, MaintainerUID = %d WHERE > ID = %d", > > mysql_real_escape_string($new_pkgbuild['pkgname']), > > mysql_real_escape_string($new_pkgbuild['pkgver']), > > mysql_real_escape_string($new_pkgbuild['pkgrel']), > diff --git a/web/lib/acctfuncs.inc b/web/lib/acctfuncs.inc > index 8e2ecb3..8ffa2f7 100644 > --- a/web/lib/acctfuncs.inc > +++ b/web/lib/acctfuncs.inc > @@ -619,18 +619,18 @@ function try_login() { > # last ($MAX_SESSIONS_PER_USER - 1). > $q = "DELETE s.* FROM Sessions s "; > $q.= "LEFT JOIN (SELECT SessionID FROM > Sessions "; > - $q.= "WHERE UsersId = '" . $userID . > "' "; > + $q.= "WHERE UsersId = " . $userID . " > "; > $q.= "ORDER BY LastUpdateTS DESC "; > $q.= "LIMIT " . > ($MAX_SESSIONS_PER_USER - 1) . ") q "; > $q.= "ON s.SessionID = q.SessionID "; > - $q.= "WHERE s.UsersId = '" . $userID > . "' "; > + $q.= "WHERE s.UsersId = " . $userID . > " "; > $q.= "AND q.SessionID IS NULL;"; > db_query($q, $dbh); > } > > $new_sid = new_sid(); > $q = "INSERT INTO Sessions (UsersID, > SessionID, LastUpdateTS)" > - ." VALUES ( $userID, '" . $new_sid . "', > UNIX_TIMESTAMP())"; > + ." VALUES (" . $userID . ", '" . $new_sid . > "', UNIX_TIMESTAMP())"; > $result = db_query($q, $dbh); > > # Query will fail if $new_sid is not unique > @@ -749,7 +749,7 @@ function valid_passwd( $userID, $passwd ) > if ($salt) { > # use salt > $passwd_q = "SELECT ID FROM Users" . > - " WHERE ID = '$userID' AND Passwd = '" . > + " WHERE ID = " . $userID . " AND Passwd = '" > . > salted_hash($passwd, $salt) . "'"; > $passwd_result = mysql_fetch_row(db_query($passwd_q, > $dbh)); > if ($passwd_result[0]) { > @@ -758,14 +758,14 @@ function valid_passwd( $userID, $passwd ) > } else { > # check without salt > $nosalt_q = "SELECT ID FROM Users". > - " WHERE ID = '$userID'" . > + " WHERE ID = " . $userID . > " AND Passwd = '" . md5($passwd) . "'"; > $nosalt_result = mysql_fetch_row(db_query($nosalt_q, > $dbh)); > if ($nosalt_result[0]) { > # password correct, but salt it first > if (!save_salt($userID, $passwd)) { > trigger_error("Unable to salt user's > password;" . > - " ID $userID", > E_USER_WARNING); > + " ID " . $userID, > E_USER_WARNING); > return false; > } > > @@ -782,7 +782,7 @@ function valid_passwd( $userID, $passwd ) > function user_suspended( $id ) > { > $dbh = db_connect(); > - $q = "SELECT Suspended FROM Users WHERE ID = '$id'"; > + $q = "SELECT Suspended FROM Users WHERE ID = " . $id; > $result = mysql_fetch_row(db_query($q, $dbh)); > if ($result[0] == 1 ) { > return true; > @@ -796,7 +796,7 @@ function user_suspended( $id ) > function user_delete( $id ) > { > $dbh = db_connect(); > - $q = "DELETE FROM Users WHERE ID = '$id'"; > + $q = "DELETE FROM Users WHERE ID = " . $id; > $result = mysql_fetch_row(db_query($q, $dbh)); > return; > } > @@ -808,7 +808,7 @@ function user_delete( $id ) > function user_is_privileged( $id ) > { > $dbh = db_connect(); > - $q = "SELECT AccountTypeID FROM Users WHERE ID = '$id'"; > + $q = "SELECT AccountTypeID FROM Users WHERE ID = " . $id; > $result = mysql_fetch_row(db_query($q, $dbh)); > if( $result[0] > 1) { > return $result[0]; > diff --git a/web/lib/aur.inc b/web/lib/aur.inc > index 744b31e..66ae1c2 100644 > --- a/web/lib/aur.inc > +++ b/web/lib/aur.inc > @@ -478,7 +478,7 @@ function mkurl($append) { > function get_salt($user_id) > { > $dbh = db_connect(); > - $salt_q = "SELECT Salt FROM Users WHERE ID = '$user_id'"; > + $salt_q = "SELECT Salt FROM Users WHERE ID = " . $user_id; > $salt_result = mysql_fetch_row(db_query($salt_q, $dbh)); > return $salt_result[0]; > } > @@ -488,8 +488,8 @@ function save_salt($user_id, $passwd) > $dbh = db_connect(); > $salt = generate_salt(); > $hash = salted_hash($passwd, $salt); > - $salting_q = "UPDATE Users SET Salt = '$salt'" . > - ", Passwd = '$hash' WHERE ID = '$user_id'"; > + $salting_q = "UPDATE Users SET Salt = '" . $salt . "', " . > + "Passwd = '" . $hash . "' WHERE ID = " . $user_id; > return db_query($salting_q, $dbh); > } > > -- > 1.7.5 > >
