- security fix : when conf['question_mark_in_urls']=true , $_SERVER['PATH_INFO'] was not sanitized against sql injection

- mysql errors are now dumped using trigger_error instead of echo and die -> allow admins to see later on if someone tries funny stuff

git-svn-id: http://piwigo.org/svn/branches/branch-1_7@2483 68402e56-0260-453c-a942-63ccdbb3a9ee

2 files changed, 26 insertions, 17 deletions

diff --git a/include/common.inc.php b/include/common.inc.php
index ef772747f..43dae02a6 100644
--- a/include/common.inc.php
+++ b/include/common.inc.php
@@ -102,6 +102,10 @@ if( !get_magic_quotes_gpc() )
     @reset($_COOKIE);
   }
 }
+if ( !empty($_SERVER["PATH_INFO"]) )
+{
+  $_SERVER["PATH_INFO"] = addslashes($_SERVER["PATH_INFO"]);
+}
 
 //
 // Define some basic configuration arrays this also prevents malicious
@@ -141,10 +145,8 @@ include(PHPWG_ROOT_PATH . 'include/functions.inc.php');
 include(PHPWG_ROOT_PATH . 'include/template.php');
 
 // Database connection
-mysql_connect( $cfgHote, $cfgUser, $cfgPassword )
-or die ( "Could not connect to database server" );
-mysql_select_db( $cfgBase )
-or die ( "Could not connect to database" );
+@mysql_connect( $cfgHote, $cfgUser, $cfgPassword ) or my_error( 'mysql_connect', true );
+@mysql_select_db( $cfgBase ) or my_error( 'mysql_select_db', true );
 
 //
 // Setup gallery wide options, if this fails then we output a CRITICAL_ERROR
diff --git a/include/functions.inc.php b/include/functions.inc.php
index 64aa7fa5a..4cacc0309 100644
--- a/include/functions.inc.php
+++ b/include/functions.inc.php
@@ -629,7 +629,7 @@ function pwg_query($query)
   global $conf,$page,$debug,$t2;
 
   $start = get_moment();
-  $result = mysql_query($query) or my_error($query."\n");
+  ($result = mysql_query($query)) or my_error($query, $conf['die_on_sql_error']);
 
   $time = get_moment() - $start;
 
@@ -924,26 +924,33 @@ function get_thumbnail_title($element_info)
 
 // my_error returns (or send to standard output) the message concerning the
 // error occured for the last mysql query.
-function my_error($header)
-{
-  global $conf;
 
-  $error = '<pre>';
-  $error.= $header;
-  $error.= '[mysql error '.mysql_errno().'] ';
-  $error.= mysql_error();
-  $error.= '</pre>';
+function my_error($header, $die)
+{
+  $error = $header;
+  $error.= "\n[mysql error ".mysql_errno().'] '.mysql_error()."\n";
 
-  if ($conf['die_on_sql_error'])
+  if (function_exists('debug_backtrace'))
   {
-    die($error);
+    $bt = debug_backtrace();
+    for ($i=0; $i<count($bt); $i++)
+    {
+      $error .= "#$i\t".@$bt[$i]['function']." ".@$bt[$i]['file']."(".@@$bt[$i]['line'].")\n";
+    }
   }
-  else
+
+  if ($die)
   {
-    echo $error;
+    @set_status_header(500);
+    echo( str_repeat( ' ', 300)."\n"); //IE doesn't error output if below a size
   }
+  echo("<pre>");
+  trigger_error($error, $die ? E_USER_ERROR : E_USER_WARNING);
+  !$die || die($error); // just in case the handler didnt die
+  echo("</pre>");
 }
 
+
 /**
  * creates an array based on a query, this function is a very common pattern
  * used here