Skip to content

Commit 8500be3

Browse files
tbrehmtbrehm
committed
- Changed addslashes to mysql_real_escape_string in several files.
- Updated Debian installation instructions.
1 parent f25b9e2 commit 8500be3

19 files changed

+471
-406
lines changed

‎INSTALL_DEBIAN.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ It is recommended to use a clean (fresh) Debian etch install where you just sele
55

66
1) Install Postfix, Courier, Saslauthd, MySQL, phpMyAdmin with the following command line (on one line!):
77

8-
apt-get install postfix postfix-mysql postfix-doc mysql-client mysql-server courier-authdaemon courier-authlib-mysql courier-pop courier-pop-ssl courier-imap courier-imap-ssl postfix-tls libsasl2 libsasl2-modules libsasl2-modules-sql sasl2-bin libpam-mysql openssl courier-maildrop getmail4
8+
apt-get install postfix postfix-mysql postfix-doc mysql-client mysql-server courier-authdaemon courier-authlib-mysql courier-pop courier-pop-ssl courier-imap courier-imap-ssl libsasl2 libsasl2-modules libsasl2-modules-sql sasl2-bin libpam-mysql openssl courier-maildrop getmail4
99

1010
Answer the questions from the package manager as follows.
1111

‎install/lib/installer_base.lib.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -177,7 +177,7 @@ public function add_database_server_record() {
177177
$this->db->dbName = $cf['database'];
178178

179179
$server_ini_content = rf("tpl/server.ini.master");
180-
$server_ini_content = addslashes($server_ini_content);
180+
$server_ini_content = mysql_real_escape_string($server_ini_content);
181181

182182
$sql = "INSERT INTO `server` (`sys_userid`, `sys_groupid`, `sys_perm_user`, `sys_perm_group`, `sys_perm_other`, `server_name`, `mail_server`, `web_server`, `dns_server`, `file_server`, `db_server`, `vserver_server`, `config`, `updated`, `active`) VALUES (1, 1, 'riud', 'riud', 'r', '".$conf['hostname']."', 1, 1, 1, 1, 1, 1, '$server_ini_content', 0, 1);";
183183
$this->db->query($sql);

‎install/lib/mysql.lib.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,7 @@ function check($formfield)
171171
// Check der variablen
172172
function quote($formfield)
173173
{
174-
return addslashes($formfield);
174+
return mysql_real_escape_string($formfield);
175175
}
176176

177177
// Check der variablen

‎install/sql/ispconfig3.sql‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -608,6 +608,50 @@ CREATE TABLE `shell_user` (
608608

609609
-- --------------------------------------------------------
610610

611+
--
612+
-- Tabellenstruktur für Tabelle `software_repo`
613+
--
614+
615+
CREATE TABLE `software_repo` (
616+
`software_repo_id` bigint(20) NOT NULL auto_increment,
617+
`sys_userid` int(11) NOT NULL default '0',
618+
`sys_groupid` int(11) NOT NULL default '0',
619+
`sys_perm_user` varchar(5) default NULL,
620+
`sys_perm_group` varchar(5) default NULL,
621+
`sys_perm_other` varchar(5) default NULL,
622+
`repo_name` varchar(40) default NULL,
623+
`repo_url` varchar(40) default NULL,
624+
`repo_username` varchar(30) default NULL,
625+
`repo_password` varchar(30) default NULL,
626+
`active` varchar(255) NOT NULL default 'y',
627+
PRIMARY KEY (`software_repo_id`)
628+
) ENGINE=MyISAM DEFAULT CHARSET=latin1 AUTO_INCREMENT=1 ;
629+
630+
-- --------------------------------------------------------
631+
632+
--
633+
-- Tabellenstruktur für Tabelle `software_update`
634+
--
635+
636+
CREATE TABLE `software_update` (
637+
`software_update_id` int(11) NOT NULL auto_increment,
638+
`software_repo_id` int(11) NOT NULL,
639+
`update_url` varchar(255) NOT NULL,
640+
`update_md5` varchar(255) NOT NULL,
641+
`install` char(1) NOT NULL,
642+
`depenencies` varchar(255) NOT NULL,
643+
`update_title` varchar(255) NOT NULL,
644+
PRIMARY KEY (`software_update_id`)
645+
) ENGINE=MyISAM DEFAULT CHARSET=latin1 AUTO_INCREMENT=1 ;
646+
647+
--
648+
-- Daten für Tabelle `software_update`
649+
--
650+
651+
652+
-- --------------------------------------------------------
653+
654+
611655
--
612656
-- Tabellenstruktur für Tabelle `spamfilter_policy`
613657
--

‎install/update.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -157,7 +157,7 @@
157157
}
158158

159159
$new_ini = array_to_ini($tpl_ini_array);
160-
$inst->db->query("UPDATE server SET config = '".addslashes($new_ini)."' WHERE server_id = ".$conf['server_id']);
160+
$inst->db->query("UPDATE server SET config = '".mysql_real_escape_string($new_ini)."' WHERE server_id = ".$conf['server_id']);
161161
unset($old_ini_array);
162162
unset($tpl_ini_array);
163163
unset($new_ini);

‎interface/lib/classes/db_mysql.inc.php‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -160,10 +160,14 @@ public function check($formfield)
160160
return $this->quote($formfield);
161161
}
162162

163-
/** Escapes quotes in variable. addslashes() */
163+
/** Escapes quotes in variable. mysql_real_escape_string() */
164164
public function quote($formfield)
165-
{
166-
return addslashes($formfield);
165+
{
166+
if(!$this->connect()){
167+
$this->updateError('WARNING: mysql_connect: Used addslashes instead of mysql_real_escape_string');
168+
return addslashes($formfield);
169+
}
170+
return mysql_real_escape_string($formfield, $this->linkId);
167171
}
168172

169173
/** Unquotes a variable, strip_slashes() */

‎interface/lib/classes/form.inc.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -293,7 +293,7 @@ function encode($record) {
293293
switch ($this->tableDef[$key]['datatype']) {
294294
case 'VARCHAR':
295295
if(!is_array($val)) {
296-
$new_record[$key] = addslashes($val);
296+
$new_record[$key] = mysql_real_escape_string($val);
297297
} else {
298298
$new_record[$key] = implode($this->tableDef[$key]['separator'],$val);
299299
}
@@ -308,7 +308,7 @@ function encode($record) {
308308
$new_record[$key] = intval($val);
309309
break;
310310
case 'DOUBLE':
311-
$new_record[$key] = addslashes($val);
311+
$new_record[$key] = mysql_real_escape_string($val);
312312
break;
313313
case 'CURRENCY':
314314
$new_record[$key] = str_replace(",",".",$val);

‎interface/lib/classes/listform.inc.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -312,7 +312,7 @@ public function encode($record)
312312
case 'VARCHAR':
313313
case 'TEXT':
314314
if(!is_array($record[$key])) {
315-
$record[$key] = addslashes($record[$key]);
315+
$record[$key] = mysql_real_escape_string($record[$key]);
316316
} else {
317317
$record[$key] = implode($this->tableDef[$key]['separator'],$record[$key]);
318318
}
@@ -330,7 +330,7 @@ public function encode($record)
330330
break;
331331

332332
case 'DOUBLE':
333-
$record[$key] = addslashes($record[$key]);
333+
$record[$key] = mysql_real_escape_string($record[$key]);
334334
break;
335335

336336
case 'CURRENCY':

‎interface/lib/classes/remoting_lib.inc.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -291,14 +291,14 @@ function encode($record) {
291291
switch ($field['datatype']) {
292292
case 'VARCHAR':
293293
if(!@is_array($record[$key])) {
294-
$new_record[$key] = (isset($record[$key]))?addslashes($record[$key]):'';
294+
$new_record[$key] = (isset($record[$key]))?mysql_real_escape_string($record[$key]):'';
295295
} else {
296296
$new_record[$key] = implode($field['separator'],$record[$key]);
297297
}
298298
break;
299299
case 'TEXT':
300300
if(!is_array($record[$key])) {
301-
$new_record[$key] = addslashes($record[$key]);
301+
$new_record[$key] = mysql_real_escape_string($record[$key]);
302302
} else {
303303
$new_record[$key] = implode($field['separator'],$record[$key]);
304304
}
@@ -317,7 +317,7 @@ function encode($record) {
317317
//if($key == 'refresh') die($record[$key]);
318318
break;
319319
case 'DOUBLE':
320-
$new_record[$key] = addslashes($record[$key]);
320+
$new_record[$key] = mysql_real_escape_string($record[$key]);
321321
break;
322322
case 'CURRENCY':
323323
$new_record[$key] = str_replace(",",".",$record[$key]);

0 commit comments

Comments
 (0)