Skip to content

Commit 5fe7013

Browse files
author
Marius Burkard
committed
- do not allow raw SQL through array[SQL] in db lib
- don't make sql request on invalid arguments in password reset form
1 parent b1adf64 commit 5fe7013

File tree

4 files changed

+43
-49
lines changed

4 files changed

+43
-49
lines changed

‎interface/lib/classes/db_mysql.inc.php‎

Lines changed: 16 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -171,14 +171,10 @@ public function _build_query_string($sQuery = '') {
171171
} elseif(is_null($sValue) || (is_string($sValue) && (strcmp($sValue, '#NULL#') == 0))) {
172172
$sTxt = 'NULL';
173173
} elseif(is_array($sValue)) {
174-
if(isset($sValue['SQL'])) {
175-
$sTxt = $sValue['SQL'];
176-
} else {
177-
$sTxt = '';
178-
foreach($sValue as $sVal) $sTxt .= ',\'' . $this->escape($sVal) . '\'';
179-
$sTxt = '(' . substr($sTxt, 1) . ')';
180-
if($sTxt == '()') $sTxt = '(0)';
181-
}
174+
$sTxt = '';
175+
foreach($sValue as $sVal) $sTxt .= ',\'' . $this->escape($sVal) . '\'';
176+
$sTxt = '(' . substr($sTxt, 1) . ')';
177+
if($sTxt == '()') $sTxt = '(0)';
182178
} else {
183179
$sTxt = '\'' . $this->escape($sValue) . '\'';
184180
}
@@ -258,7 +254,7 @@ private function securityScan($string) {
258254

259255
private function _query($sQuery = '') {
260256
global $app;
261-
257+
262258
$aArgs = func_get_args();
263259

264260
if ($sQuery == '') {
@@ -354,7 +350,7 @@ public function query($sQuery = '') {
354350
* @return array result row or NULL if none found
355351
*/
356352
public function queryOneRecord($sQuery = '') {
357-
353+
358354
$aArgs = func_get_args();
359355
if(!empty($aArgs)) {
360356
$sQuery = array_shift($aArgs);
@@ -363,7 +359,7 @@ public function queryOneRecord($sQuery = '') {
363359
}
364360
array_unshift($aArgs, $sQuery);
365361
}
366-
362+
367363
$oResult = call_user_func_array([&$this, 'query'], $aArgs);
368364
if(!$oResult) return null;
369365

@@ -750,7 +746,7 @@ public function datalogInsert($tablename, $insert_data, $index_field) {
750746
foreach($insert_data as $key => $val) {
751747
$key_str .= '??,';
752748
$params[] = $key;
753-
749+
754750
$val_str .= '?,';
755751
$v_params[] = $val;
756752
}
@@ -764,7 +760,7 @@ public function datalogInsert($tablename, $insert_data, $index_field) {
764760
$this->query("INSERT INTO ?? $insert_data_str", $tablename);
765761
$app->log("deprecated use of passing values to datalogInsert() - table " . $tablename, 1);
766762
}
767-
763+
768764
$old_rec = array();
769765
$index_value = $this->insertID();
770766
if(!$index_value && isset($insert_data[$index_field])) {
@@ -1112,7 +1108,7 @@ public function mapType($metaType, $typeValue) {
11121108
* @access public
11131109
* @return string 'mariadb' or string 'mysql'
11141110
*/
1115-
1111+
11161112
public function getDatabaseType() {
11171113
$tmp = $this->queryOneRecord('SELECT VERSION() as version');
11181114
if(stristr($tmp['version'],'mariadb')) {
@@ -1140,7 +1136,7 @@ public function getDatabaseVersion($major_version_only = false) {
11401136
return $version[0];
11411137
}
11421138
}
1143-
1139+
11441140
/**
11451141
* Get a mysql password hash
11461142
*
@@ -1150,9 +1146,9 @@ public function getDatabaseVersion($major_version_only = false) {
11501146
*/
11511147

11521148
public function getPasswordHash($password) {
1153-
1149+
11541150
$password_type = 'password';
1155-
1151+
11561152
/* Disabled until caching_sha2_password is implemented
11571153
if($this->getDatabaseType() == 'mysql' && $this->getDatabaseVersion(true) >= 8) {
11581154
// we are in MySQL 8 mode
@@ -1162,16 +1158,16 @@ public function getPasswordHash($password) {
11621158
}
11631159
}
11641160
*/
1165-
1161+
11661162
if($password_type == 'caching_sha2_password') {
11671163
/*
1168-
caching_sha2_password hashing needs to be implemented, have not
1164+
caching_sha2_password hashing needs to be implemented, have not
11691165
found valid PHP implementation for the new password hash type.
11701166
*/
11711167
} else {
11721168
$password_hash = '*'.strtoupper(sha1(sha1($password, true)));
11731169
}
1174-
1170+
11751171
return $password_hash;
11761172
}
11771173

‎interface/web/login/password_reset.php‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@
4747
$app->tpl->setVar($wb);
4848
$continue = true;
4949

50-
if(isset($_POST['username']) && $_POST['username'] != '' && $_POST['email'] != '' && $_POST['username'] != 'admin') {
50+
if(isset($_POST['username']) && is_string($_POST['username']) && $_POST['username'] != '' && isset($_POST['email']) && is_string($_POST['email']) && $_POST['email'] != '' && $_POST['username'] != 'admin') {
5151
if(!preg_match("/^[\w\.\-\_]{1,64}$/", $_POST['username'])) {
5252
$app->tpl->setVar("error", $wb['user_regex_error']);
5353
$continue = false;
@@ -60,11 +60,13 @@
6060
$username = $_POST['username'];
6161
$email = $_POST['email'];
6262

63-
$client = $app->db->queryOneRecord("SELECT client.*, sys_user.lost_password_function, sys_user.lost_password_hash, IF(sys_user.lost_password_reqtime IS NOT NULL AND DATE_SUB(NOW(), INTERVAL 15 MINUTE) < sys_user.lost_password_reqtime, 1, 0) as `lost_password_wait` FROM client,sys_user WHERE client.username = ? AND client.email = ? AND client.client_id = sys_user.client_id", $username, $email);
63+
if($continue) {
64+
$client = $app->db->queryOneRecord("SELECT client.*, sys_user.lost_password_function, sys_user.lost_password_hash, IF(sys_user.lost_password_reqtime IS NOT NULL AND DATE_SUB(NOW(), INTERVAL 15 MINUTE) < sys_user.lost_password_reqtime, 1, 0) as `lost_password_wait` FROM client,sys_user WHERE client.username = ? AND client.email = ? AND client.client_id = sys_user.client_id", $username, $email);
65+
}
6466

65-
if($client['lost_password_function'] == 0) {
67+
if($client && $client['lost_password_function'] == 0) {
6668
$app->tpl->setVar("error", $wb['lost_password_function_disabled_txt']);
67-
} elseif($client['lost_password_wait'] == 1) {
69+
} elseif($client && $client['lost_password_wait'] == 1) {
6870
$app->tpl->setVar("error", $wb['lost_password_function_wait_txt']);
6971
} elseif ($continue) {
7072
if($client['client_id'] > 0) {
@@ -111,7 +113,7 @@
111113
$app->tpl->setVar("error", $wb['user_regex_error']);
112114
$continue = false;
113115
}
114-
116+
115117
$username = $_GET['username'];
116118
$hash = $_GET['hash'];
117119

@@ -127,7 +129,7 @@
127129
if($client['client_id'] > 0) {
128130
$server_config_array = $app->getconf->get_global_config();
129131
$min_password_length = $app->auth->get_min_password_length();
130-
132+
131133
$new_password = $app->auth->get_random_password($min_password_length, true);
132134
$new_password_encrypted = $app->auth->crypt_password($new_password);
133135

‎server/lib/classes/cron.d/300-quota_notify.inc.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -250,7 +250,7 @@ public function onRunJob() {
250250

251251
//* Send quota notifications
252252
if(($web_config['overquota_notify_admin'] == 'y' || $web_config['overquota_notify_client'] == 'y') && $send_notification == true) {
253-
$app->dbmaster->datalogUpdate('web_domain', array("last_quota_notification" => array("SQL" => "CURDATE()")), 'domain_id', $rec['domain_id']);
253+
$app->dbmaster->datalogUpdate('web_domain', array("last_quota_notification" => date('Y-m-d')), 'domain_id', $rec['domain_id']);
254254

255255
$placeholders = array('{domain}' => $rec['domain'],
256256
'{admin_mail}' => ($global_config['admin_mail'] != ''? $global_config['admin_mail'] : 'root'),
@@ -379,7 +379,7 @@ public function onRunJob() {
379379
elseif($mail_config['overquota_notify_freq'] > 0 && $rec['notified_before'] >= $mail_config['overquota_notify_freq']) $send_notification = true;
380380

381381
if(($mail_config['overquota_notify_admin'] == 'y' || $mail_config['overquota_notify_client'] == 'y') && $send_notification == true) {
382-
$app->dbmaster->datalogUpdate('mail_user', array("last_quota_notification" => array("SQL" => "CURDATE()")), 'mailuser_id', $rec['mailuser_id']);
382+
$app->dbmaster->datalogUpdate('mail_user', array("last_quota_notification" => date('Y-m-d')), 'mailuser_id', $rec['mailuser_id']);
383383

384384
$placeholders = array('{email}' => $rec['email'],
385385
'{admin_mail}' => ($global_config['admin_mail'] != ''? $global_config['admin_mail'] : 'root'),
@@ -466,7 +466,7 @@ public function onRunJob() {
466466

467467
//* Send quota notifications
468468
if(($web_config['overquota_db_notify_admin'] == 'y' || $web_config['overquota_db_notify_client'] == 'y') && $send_notification == true) {
469-
$app->dbmaster->datalogUpdate('web_database', array("last_quota_notification" => array("SQL" => "CURDATE()")), 'database_id', $rec['database_id']);
469+
$app->dbmaster->datalogUpdate('web_database', array("last_quota_notification" => date('Y-m-d')), 'database_id', $rec['database_id']);
470470
$placeholders = array(
471471
'{database_name}' => $rec['database_name'],
472472
'{admin_mail}' => ($global_config['admin_mail'] != ''? $global_config['admin_mail'] : 'root'),

‎server/lib/classes/db_mysql.inc.php‎

Lines changed: 16 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -171,14 +171,10 @@ public function _build_query_string($sQuery = '') {
171171
} elseif(is_null($sValue) || (is_string($sValue) && (strcmp($sValue, '#NULL#') == 0))) {
172172
$sTxt = 'NULL';
173173
} elseif(is_array($sValue)) {
174-
if(isset($sValue['SQL'])) {
175-
$sTxt = $sValue['SQL'];
176-
} else {
177-
$sTxt = '';
178-
foreach($sValue as $sVal) $sTxt .= ',\'' . $this->escape($sVal) . '\'';
179-
$sTxt = '(' . substr($sTxt, 1) . ')';
180-
if($sTxt == '()') $sTxt = '(0)';
181-
}
174+
$sTxt = '';
175+
foreach($sValue as $sVal) $sTxt .= ',\'' . $this->escape($sVal) . '\'';
176+
$sTxt = '(' . substr($sTxt, 1) . ')';
177+
if($sTxt == '()') $sTxt = '(0)';
182178
} else {
183179
$sTxt = '\'' . $this->escape($sValue) . '\'';
184180
}
@@ -258,7 +254,7 @@ private function securityScan($string) {
258254

259255
private function _query($sQuery = '') {
260256
global $app;
261-
257+
262258
$aArgs = func_get_args();
263259

264260
if ($sQuery == '') {
@@ -354,7 +350,7 @@ public function query($sQuery = '') {
354350
* @return array result row or NULL if none found
355351
*/
356352
public function queryOneRecord($sQuery = '') {
357-
353+
358354
$aArgs = func_get_args();
359355
if(!empty($aArgs)) {
360356
$sQuery = array_shift($aArgs);
@@ -363,7 +359,7 @@ public function queryOneRecord($sQuery = '') {
363359
}
364360
array_unshift($aArgs, $sQuery);
365361
}
366-
362+
367363
$oResult = call_user_func_array([&$this, 'query'], $aArgs);
368364
if(!$oResult) return null;
369365

@@ -750,7 +746,7 @@ public function datalogInsert($tablename, $insert_data, $index_field) {
750746
foreach($insert_data as $key => $val) {
751747
$key_str .= '??,';
752748
$params[] = $key;
753-
749+
754750
$val_str .= '?,';
755751
$v_params[] = $val;
756752
}
@@ -764,7 +760,7 @@ public function datalogInsert($tablename, $insert_data, $index_field) {
764760
$this->query("INSERT INTO ?? $insert_data_str", $tablename);
765761
$app->log("deprecated use of passing values to datalogInsert() - table " . $tablename, 1);
766762
}
767-
763+
768764
$old_rec = array();
769765
$index_value = $this->insertID();
770766
if(!$index_value && isset($insert_data[$index_field])) {
@@ -1140,19 +1136,19 @@ public function getDatabaseVersion($major_version_only = false) {
11401136
return $version[0];
11411137
}
11421138
}
1143-
1139+
11441140
/**
11451141
* Get a mysql password hash
11461142
*
11471143
* @access public
11481144
* @param string cleartext password
11491145
* @return string Password hash
11501146
*/
1151-
1147+
11521148
public function getPasswordHash($password) {
1153-
1149+
11541150
$password_type = 'password';
1155-
1151+
11561152
/* Disabled until caching_sha2_password is implemented
11571153
if($this->getDatabaseType() == 'mysql' && $this->getDatabaseVersion(true) >= 8) {
11581154
// we are in MySQL 8 mode
@@ -1162,16 +1158,16 @@ public function getPasswordHash($password) {
11621158
}
11631159
}
11641160
*/
1165-
1161+
11661162
if($password_type == 'caching_sha2_password') {
11671163
/*
1168-
caching_sha2_password hashing needs to be implemented, have not
1164+
caching_sha2_password hashing needs to be implemented, have not
11691165
found valid PHP implementation for the new password hash type.
11701166
*/
11711167
} else {
11721168
$password_hash = '*'.strtoupper(sha1(sha1($password, true)));
11731169
}
1174-
1170+
11751171
return $password_hash;
11761172
}
11771173

0 commit comments

Comments
 (0)