webinterface.git

@@ -16,8 +16,7 @@ Nevertheless, in case you use a significant part of this code, we ask (but not r

 function get_mysql_accounts($UID)

 {

-  $UID = (int) $UID;

-  $result = db_query("SELECT id, username, description, created FROM misc.mysql_accounts WHERE useraccount=$UID ORDER BY username");

+  $result = db_query("SELECT id, username, description, created FROM misc.mysql_accounts WHERE useraccount=? ORDER BY username", array($UID));

   if ($result->rowCount() == 0)

     return array();

   $list = array();

@@ -30,8 +29,7 @@ function get_mysql_accounts($UID)

 function get_mysql_databases($UID)

 {

-  $UID = (int) $UID;

-  $result = db_query("SELECT id, name, description, created FROM misc.mysql_database WHERE useraccount=$UID ORDER BY name");

+  $result = db_query("SELECT id, name, description, created FROM misc.mysql_database WHERE useraccount=? ORDER BY name", array($UID));

   if ($result->rowCount() == 0)

     return array();

   $list = array();

@@ -54,8 +52,9 @@ function set_database_description($dbname, $description)

   if ($thisdb == NULL) {

     system_failure('Ungültige Datenbank');

   }

-  $description = maybe_null(filter_input_general($description));

-  db_query("UPDATE misc.mysql_database SET description={$description} WHERE id={$thisdb['id']}");

+  $args = array(":id" => $thisdb['id'],

+                ":desc" => filter_input_general($description));

+  db_query("UPDATE misc.mysql_database SET description=:desc WHERE id=:id", $args);

 }

 function set_dbuser_description($username, $description) 

@@ -70,15 +69,15 @@ function set_dbuser_description($username, $description)

   if ($thisuser == NULL) {

     system_failure('Ungültiger Benutzer');

   }

-  $description = maybe_null(filter_input_general($description));

-  db_query("UPDATE misc.mysql_accounts SET description={$description} WHERE id={$thisuser['id']}");

+  $args = array(":id" => $thisuser['id'],

+                ":desc" => filter_input_general($description));

+  db_query("UPDATE misc.mysql_accounts SET description=:desc WHERE id=:id", $args);

 }

 function servers_for_databases()

 {

   $uid = (int) $_SESSION['userinfo']['uid'];

-  

-  $result = db_query("SELECT db.name AS db, hostname FROM misc.mysql_database AS db LEFT JOIN system.useraccounts AS u ON (db.useraccount=u.uid) LEFT JOIN system.servers ON (COALESCE(db.server, u.server) = servers.id) WHERE db.useraccount={$uid}");

+  $result = db_query("SELECT db.name AS db, hostname FROM misc.mysql_database AS db LEFT JOIN system.useraccounts AS u ON (db.useraccount=u.uid) LEFT JOIN system.servers ON (COALESCE(db.server, u.server) = servers.id) WHERE db.useraccount=?", array($uid));

   $ret = array();

   while ($line = $result->fetch()) {

     $ret[$line['db']] = $line['hostname'];

@@ -95,7 +94,7 @@ function get_mysql_access($db, $account)

   if (!is_array($mysql_access))

   {

     $mysql_access = array();

-    $result = db_query("SELECT db.name AS db, acc.username AS user FROM misc.mysql_access AS access LEFT JOIN misc.mysql_database AS db ON (db.id=access.database) LEFT JOIN misc.mysql_accounts AS acc ON (acc.id = access.user) WHERE acc.useraccount={$uid} OR db.useraccount={$uid};");

+    $result = db_query("SELECT db.name AS db, acc.username AS user FROM misc.mysql_access AS access LEFT JOIN misc.mysql_database AS db ON (db.id=access.database) LEFT JOIN misc.mysql_accounts AS acc ON (acc.id = access.user) WHERE acc.useraccount=:uid OR db.useraccount=:uid", array(":uid" => $uid));

     if ($result->rowCount() == 0)

       return false;

     while ($line = $result->fetch(PDO::FETCH_OBJ))

@@ -108,37 +107,38 @@ function get_mysql_access($db, $account)

 function set_mysql_access($db, $account, $status)

 {

   $uid = $_SESSION['userinfo']['uid'];

-  $db = db_escape_string($db);

-  $account = db_escape_string($account);

   DEBUG("User »{$account}« soll ".($status ? "" : "NICHT ")."auf die Datenbank »{$db}« zugreifen");

   $query = '';

   if ($status)

   {

     if (get_mysql_access($db, $account))

       return NULL;

-    $result = db_query("SELECT id FROM misc.mysql_database WHERE name='{$db}' AND useraccount={$uid} LIMIT 1");

+    $args = array(":db" => $db, ":uid" => $uid);

+    $result = db_query("SELECT id FROM misc.mysql_database WHERE name=:db AND useraccount=:uid", $args);

     if ($result->rowCount() != 1)

     {

       logger(LOG_ERR, "modules/mysql/include/mysql", "mysql", "cannot find database {$db}");

       system_failure("cannot find database »{$db}«");

     }

-    $result = db_query("SELECT id FROM misc.mysql_accounts WHERE username='{$account}' AND useraccount={$uid} LIMIT 1");

+    $args = array(":account" => $account, ":uid" => $uid);

+    $result = db_query("SELECT id FROM misc.mysql_accounts WHERE username=:account AND useraccount=:uid", $args);

     if ($result->rowCount() != 1)

     {

       logger(LOG_ERR, "modules/mysql/include/mysql", "mysql", "cannot find user {$account}");

       system_failure("cannot find database user »{$account}«");

     }

-    $query = "INSERT INTO misc.mysql_access (`database`,user) VALUES ((SELECT id FROM misc.mysql_database WHERE name='{$db}' AND useraccount={$uid} LIMIT 1), (SELECT id FROM misc.mysql_accounts WHERE username='{$account}' AND useraccount={$uid}));";

+    $args = array(":db" => $db, ":uid" => $uid, ":account" => $account);

+    db_query("INSERT INTO misc.mysql_access (`database`,user) VALUES ((SELECT id FROM misc.mysql_database WHERE name=:db AND useraccount=:uid LIMIT 1), (SELECT id FROM misc.mysql_accounts WHERE username=:account AND useraccount=:uid))", $args);

     logger(LOG_INFO, "modules/mysql/include/mysql", "mysql", "granting access on »{$db}« to »{$account}«");

   }

   else

   {

     if (! get_mysql_access($db, $account))

       return NULL;

-    $query = "DELETE FROM misc.mysql_access WHERE `database`=(SELECT id FROM misc.mysql_database WHERE name='{$db}' AND useraccount={$uid} LIMIT 1) AND user=(SELECT id FROM misc.mysql_accounts WHERE username='{$account}' AND useraccount={$uid});";

+    $args = array(":db" => $db, ":account" => $account, ":uid" => $uid);

+    db_query("DELETE FROM misc.mysql_access WHERE `database`=(SELECT id FROM misc.mysql_database WHERE name=:db AND useraccount=:uid LIMIT 1) AND user=(SELECT id FROM misc.mysql_accounts WHERE username=:account AND useraccount=:uid)", $args);

     logger(LOG_INFO, "modules/mysql/include/mysql", "mysql", "revoking access on »{$db}« from »{$account}«");

   }

-  db_query($query);

 }

@@ -150,20 +150,20 @@ function create_mysql_account($username, $description = '')

     input_error("Der eingegebene Benutzername entspricht leider nicht der Konvention. Bitte tragen Sie einen passenden Namen ein.");

     return NULL;

   }

-  $uid = $_SESSION['userinfo']['uid'];

-  $username = db_escape_string($username);

-  $description = maybe_null($description);

+  $args = array(":uid" => $_SESSION['userinfo']['uid'],

+                ":username" => $username,

+                ":desc" => $description);

   logger(LOG_INFO, "modules/mysql/include/mysql", "mysql", "creating user »{$username}«");

-  db_query("INSERT INTO misc.mysql_accounts (username, password, useraccount, description) VALUES ('$username', '!', $uid, $description);");

+  db_query("INSERT INTO misc.mysql_accounts (username, password, useraccount, description) VALUES (:username, '!', :uid, :desc)", $args);

 }

 function delete_mysql_account($username)

 {

-  $username = db_escape_string($username);

-  $uid = $_SESSION['userinfo']['uid'];

+  $args = array(":uid" => $_SESSION['userinfo']['uid'],

+                ":username" => $username);

   logger(LOG_INFO, "modules/mysql/include/mysql", "mysql", "deleting user »{$username}«");

-  db_query("DELETE FROM misc.mysql_accounts WHERE username='{$username}' AND useraccount='{$uid}' LIMIT 1;");

+  db_query("DELETE FROM misc.mysql_accounts WHERE username=:username AND useraccount=:uid", $args);

 }

@@ -175,24 +175,24 @@ function create_mysql_database($dbname, $description = '', $server = NULL)

     input_error("Der eingegebene Datenbankname entspricht leider nicht der Konvention. Bitte tragen Sie einen passenden Namen ein.");

     return NULL;

   }

-  $dbname = db_escape_string($dbname);

-  $uid = $_SESSION['userinfo']['uid'];

-  $description = maybe_null($description); 

-  $server = (int) $server;

   if (! in_array($server, additional_servers()) || ($server == my_server_id())) {

     $server = 'NULL';

   }

+  $args = array(":dbname" => $dbname,

+                ":uid" => $_SESSION['userinfo']['uid'],

+                ":desc" => $description,

+                ":server" => $server);

   logger(LOG_INFO, "modules/mysql/include/mysql", "mysql", "creating database »{$dbname}«");

-  db_query("INSERT INTO misc.mysql_database (name, useraccount, server, description) VALUES ('$dbname', $uid, $server, $description);");

+  db_query("INSERT INTO misc.mysql_database (name, useraccount, server, description) VALUES (:dbname, :uid, :server, :desc)", $args);

 }

 function delete_mysql_database($dbname)

 {

-  $dbname = db_escape_string($dbname);

-  $uid = $_SESSION['userinfo']['uid'];

+  $args = array(":dbname" => $dbname,

+                ":uid" => $_SESSION['userinfo']['uid']);

   logger(LOG_INFO, "modules/mysql/include/mysql", "mysql", "removing database »{$dbname}«");

-  db_query("DELETE FROM misc.mysql_database WHERE name='{$dbname}' AND useraccount='{$uid}' LIMIT 1;");

+  db_query("DELETE FROM misc.mysql_database WHERE name=:dbname AND useraccount=:uid", $args);

 }

@@ -212,28 +212,28 @@ function validate_mysql_username($username)

 function set_mysql_password($username, $password)

 {

-  $username = db_escape_string($username);

-  $password = db_escape_string($password);

-  $uid = $_SESSION['userinfo']['uid'];

+  $args = array(":uid" => $_SESSION['userinfo']['uid'],

+                ":username" => $username,

+                ":password" => $password);

   logger(LOG_INFO, "modules/mysql/include/mysql", "mysql", "updating password for »{$username}«");

-  db_query("UPDATE misc.mysql_accounts SET password=PASSWORD('$password') WHERE username='$username' AND useraccount=$uid;");

+  db_query("UPDATE misc.mysql_accounts SET password=PASSWORD(:password) WHERE username=:username AND useraccount=:uid", $args);

 }

 function has_mysql_database($dbname)

 {

-  $uid = $_SESSION['userinfo']['uid'];

-  $dbname = db_escape_string($dbname);

-  $result = db_query("SELECT NULL FROM misc.mysql_database WHERE name='{$dbname}' AND useraccount='{$uid}' LIMIT 1;");

+  $args = array(":uid" => $_SESSION['userinfo']['uid'],

+                ":dbname" => $dbname);

+  $result = db_query("SELECT NULL FROM misc.mysql_database WHERE name=:dbname AND useraccount=:uid", $args);

   return ($result->rowCount() == 1);

 }

 function has_mysql_user($username)

 {

-  $uid = $_SESSION['userinfo']['uid'];

-  $userame = db_escape_string($username);

-  $result = db_query("SELECT NULL FROM misc.mysql_accounts WHERE username='{$username}' AND useraccount='{$uid}' LIMIT 1;");

+  $args = array(":uid" => $_SESSION['userinfo']['uid'],

+                ":username" => $username);

+  $result = db_query("SELECT NULL FROM misc.mysql_accounts WHERE username=:username AND useraccount=:uid", $args);

   return ($result->rowCount() == 1);

 }

@@ -137,7 +137,7 @@ function check_totp($username, $code) {

   $checkResult = $ga->verifyCode($secret, $code, 2);    // 2 = 2*30sec clock tolerance

   if ($checkResult) {

-    db_query("UPDATE mail.webmail_totp SET failures = 0, unlock_timestamp=NULL WHERE email='{$username}'");

+    db_query("UPDATE mail.webmail_totp SET failures = 0, unlock_timestamp=NULL WHERE email=?", array($username));

     blacklist_token($username, $code);

     DEBUG('OK');

   } else {