From bd0551b22076b82a6d49e9f7a2b2e0c90a1b2326 Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Fri, 05 Feb 2016 07:25:27 -0500
Subject: [PATCH] Secure also downloads of addressbook exports, managesieve script exports and Enigma keys exports
---
program/lib/Roundcube/rcube_db.php | 43 +++++++++++++++++++++++++------------------
1 files changed, 25 insertions(+), 18 deletions(-)
diff --git a/program/lib/Roundcube/rcube_db.php b/program/lib/Roundcube/rcube_db.php
index 5a76f69..ba3acf6 100644
--- a/program/lib/Roundcube/rcube_db.php
+++ b/program/lib/Roundcube/rcube_db.php
@@ -149,10 +149,6 @@
$dsn_string = $this->dsn_string($dsn);
$dsn_options = $this->dsn_options($dsn);
- if ($this->db_pconn) {
- $dsn_options[PDO::ATTR_PERSISTENT] = true;
- }
-
// Connect
try {
// with this check we skip fatal error on PDO object creation
@@ -357,7 +353,7 @@
public function get_variable($varname, $default = null)
{
// to be implemented by driver class
- return $default;
+ return rcube::get_instance()->config->get('db_' . $varname, $default);
}
/**
@@ -448,9 +444,14 @@
}
}
- // replace escaped '?' back to normal, see self::quote()
- $query = str_replace('??', '?', $query);
$query = rtrim($query, " \t\n\r\0\x0B;");
+
+ // replace escaped '?' and quotes back to normal, see self::quote()
+ $query = str_replace(
+ array('??', self::DEFAULT_QUOTE.self::DEFAULT_QUOTE),
+ array('?', self::DEFAULT_QUOTE),
+ $query
+ );
// log query
$this->debug($query);
@@ -515,9 +516,6 @@
$pos++;
}
}
-
- // replace escaped quote back to normal, see self::quote()
- $query = str_replace($quote.$quote, $quote, $query);
return $query;
}
@@ -689,14 +687,11 @@
{
// get tables if not cached
if ($this->tables === null) {
- $q = $this->query('SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES ORDER BY TABLE_NAME');
+ $q = $this->query("SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES"
+ . " WHERE TABLE_TYPE = 'BASE TABLE'"
+ . " ORDER BY TABLE_NAME");
- if ($q) {
- $this->tables = $q->fetchAll(PDO::FETCH_COLUMN, 0);
- }
- else {
- $this->tables = array();
- }
+ $this->tables = $q ? $q->fetchAll(PDO::FETCH_COLUMN, 0) : array();
}
return $this->tables;
@@ -1188,7 +1183,7 @@
}
// process the different protocol options
- $parsed['protocol'] = (!empty($proto)) ? $proto : 'tcp';
+ $parsed['protocol'] = $proto ?: 'tcp';
$proto_opts = rawurldecode($proto_opts);
if (strpos($proto_opts, ':') !== false) {
list($proto_opts, $parsed['port']) = explode(':', $proto_opts);
@@ -1272,6 +1267,18 @@
{
$result = array();
+ if ($this->db_pconn) {
+ $result[PDO::ATTR_PERSISTENT] = true;
+ }
+
+ if (!empty($dsn['prefetch'])) {
+ $result[PDO::ATTR_PREFETCH] = (int) $dsn['prefetch'];
+ }
+
+ if (!empty($dsn['timeout'])) {
+ $result[PDO::ATTR_TIMEOUT] = (int) $dsn['timeout'];
+ }
+
return $result;
}
--
Gitblit v1.9.1