aboutsummaryrefslogtreecommitdiffstats
path: root/include
diff options
context:
space:
mode:
authorrvelices <rv-github@modusoptimus.com>2008-08-23 01:15:33 +0000
committerrvelices <rv-github@modusoptimus.com>2008-08-23 01:15:33 +0000
commit7550df3915d7e9c83c430ff3067dd73264e7866d (patch)
treeb731c7d687890f48ca6c525e33b17345e9c3d0f8 /include
parentf645fc14190614fe6b86b509b8f5a3b0a68ad90e (diff)
- security fix : when conf['question_mark_in_urls']=true , $_SERVER['PATH_INFO'] was not sanitized against sql injection
- mysql errors are now dumped using trigger_error instead of echo and die -> allow admins to see later on if someone tries funny stuff git-svn-id: http://piwigo.org/svn/branches/branch-1_7@2483 68402e56-0260-453c-a942-63ccdbb3a9ee
Diffstat (limited to 'include')
-rw-r--r--include/common.inc.php10
-rw-r--r--include/functions.inc.php33
2 files changed, 26 insertions, 17 deletions
diff --git a/include/common.inc.php b/include/common.inc.php
index ef772747f..43dae02a6 100644
--- a/include/common.inc.php
+++ b/include/common.inc.php
@@ -102,6 +102,10 @@ if( !get_magic_quotes_gpc() )
@reset($_COOKIE);
}
}
+if ( !empty($_SERVER["PATH_INFO"]) )
+{
+ $_SERVER["PATH_INFO"] = addslashes($_SERVER["PATH_INFO"]);
+}
//
// Define some basic configuration arrays this also prevents malicious
@@ -141,10 +145,8 @@ include(PHPWG_ROOT_PATH . 'include/functions.inc.php');
include(PHPWG_ROOT_PATH . 'include/template.php');
// Database connection
-mysql_connect( $cfgHote, $cfgUser, $cfgPassword )
-or die ( "Could not connect to database server" );
-mysql_select_db( $cfgBase )
-or die ( "Could not connect to database" );
+@mysql_connect( $cfgHote, $cfgUser, $cfgPassword ) or my_error( 'mysql_connect', true );
+@mysql_select_db( $cfgBase ) or my_error( 'mysql_select_db', true );
//
// Setup gallery wide options, if this fails then we output a CRITICAL_ERROR
diff --git a/include/functions.inc.php b/include/functions.inc.php
index 64aa7fa5a..4cacc0309 100644
--- a/include/functions.inc.php
+++ b/include/functions.inc.php
@@ -629,7 +629,7 @@ function pwg_query($query)
global $conf,$page,$debug,$t2;
$start = get_moment();
- $result = mysql_query($query) or my_error($query."\n");
+ ($result = mysql_query($query)) or my_error($query, $conf['die_on_sql_error']);
$time = get_moment() - $start;
@@ -924,26 +924,33 @@ function get_thumbnail_title($element_info)
// my_error returns (or send to standard output) the message concerning the
// error occured for the last mysql query.
-function my_error($header)
-{
- global $conf;
- $error = '<pre>';
- $error.= $header;
- $error.= '[mysql error '.mysql_errno().'] ';
- $error.= mysql_error();
- $error.= '</pre>';
+function my_error($header, $die)
+{
+ $error = $header;
+ $error.= "\n[mysql error ".mysql_errno().'] '.mysql_error()."\n";
- if ($conf['die_on_sql_error'])
+ if (function_exists('debug_backtrace'))
{
- die($error);
+ $bt = debug_backtrace();
+ for ($i=0; $i<count($bt); $i++)
+ {
+ $error .= "#$i\t".@$bt[$i]['function']." ".@$bt[$i]['file']."(".@@$bt[$i]['line'].")\n";
+ }
}
- else
+
+ if ($die)
{
- echo $error;
+ @set_status_header(500);
+ echo( str_repeat( ' ', 300)."\n"); //IE doesn't error output if below a size
}
+ echo("<pre>");
+ trigger_error($error, $die ? E_USER_ERROR : E_USER_WARNING);
+ !$die || die($error); // just in case the handler didnt die
+ echo("</pre>");
}
+
/**
* creates an array based on a query, this function is a very common pattern
* used here