Attachment #181876 for bug #258838




 * Internal define used for debug and logging.  All backends are encouraged
 * to use the same format.
 */
#define MOD_SQL_MYSQL_VERSION		"mod_sql_mysql/4.0.8"

#define _MYSQL_PORT "3306"


    return _build_error(cmd, conn);
  }

#ifdef PR_USE_NLS
  if (pr_utf8_get_encoding() != NULL) {

# if MYSQL_VERSION_ID >= 50007
    /* Configure the connection for the current local character set.
     *
     * Note: the mysql_set_character_set() function appeared in MySQL 5.0.7,
     * as per:
     *
     *  http://dev.mysql.com/doc/refman/5.0/en/mysql-set-character-set.html
     */
    if (!mysql_set_character_set(conn->mysql, pr_utf8_get_charset())) {
      sql_log(DEBUG_FUNC, "%s", "exiting \tmysql cmd_open");
      return _build_error(cmd, conn);
    }

    sql_log(DEBUG_FUNC, "MySQL connection character set now '%s' (from '%s')",
      mysql_character_set_name(conn->mysql), pr_utf8_get_charset());

# else
    /* No mysql_set_character_set() API available.  But
     * mysql_character_set_name() has been around for a while; we can use it
     * to at least see whether there might be a character set discrepancy.
     */

    const char *local_charset = pr_utf8_get_charset();
    const char *mysql_charset = mysql_character_set_name(conn->mysql);

    if (local_charset &&
        mysql_charset &&
        strcasecmp(local_charset, mysql_charset) != 0) {
      pr_log_pri(PR_LOG_ERR, MOD_SQL_MYSQL_VERSION
        ": local character set '%s' does not match MySQL character set '%s', "
        "SQL injection possible, shutting down", local_charset, mysql_charset);
      sql_log(DEBUG_WARN, "local character set '%s' does not match MySQL "
        "character set '%s', SQL injection possible, shutting down",
        local_charset, mysql_charset);
      end_login(1);
    }
# endif /* older MySQL */
  }
#endif /* !PR_USE_NLS */

  /* bump connections */
  entry->connections++;





 * Internal define used for debug and logging.  All backends are encouraged
 * to use the same format.
 */
#define MOD_SQL_POSTGRES_VERSION	"mod_sql_postgres/4.0.4"

#define _POSTGRES_PORT "5432"



#include <libpq-fe.h>

/* For the pg_encoding_to_char() function, used for NLS support, we need
 * to include the <mb/pg_wchar.h> file.  It's OK; the function has been
 * declared in that file for a while, according to:
 *
 *  http://archives.postgresql.org/pgsql-bugs/2006-07/msg00125.php
 *
 * But it's a pain to quell all of the compiler warnings about redefined
 * this, undefined that.  The linker finds the symbol without issue, so
 * punt on including <mb/pg_wchar.h> file.  Instead, we'll copy the
 * function declaration here.
 */
#ifdef PR_USE_NLS
extern const char *pg_encoding_to_char(int encoding);
#endif

/* 
 * timer-handling code adds the need for a couple of forward declarations
 */

    return _build_error( cmd, conn );
  }

#ifdef PR_USE_NLS
  if (pr_utf8_get_encoding() != NULL) {
    const char *encoding = pr_utf8_get_encoding();

    /* XXX Hack to deal with Postgres' incredibly broken behavior when
     * handling the 'ASCII' encoding.  Specifically, Postgres chokes on
     * 'ASCII', and instead insists on calling it 'SQL_ASCII' (which, of
     * course, is not even close to being a valid encoding name according
     * to libiconv.)
     *
     * Treat 'ANSI_X3.4-1968' (another common name/alias for ASCII) the
     * same; rename it to 'SQL_ASCII' for Postgres' benefit.  And same for
     * 'US-ASCII'.
     */
    if (strcmp(encoding, "ANSI_X3.4-1968") == 0 ||
        strcmp(encoding, "ASCII") == 0 ||
        strcmp(encoding, "US-ASCII") == 0) {
      encoding = "SQL_ASCII";
    }

    /* Configure the connection for the current local character set. */
    if (PQsetClientEncoding(conn->postgres, encoding) < 0) {
      /* if it didn't work, return an error */
      sql_log(DEBUG_FUNC, "%s", "exiting \tpostgres cmd_open");
      return _build_error(cmd, conn);
    }

    sql_log(DEBUG_FUNC, "Postgres connection character set now '%s' "
      "(from '%s')", pg_encoding_to_char(PQclientEncoding(conn->postgres)),
      pr_utf8_get_charset());
  }
#endif /* !PR_USE_NLS */

  /* bump connections */
  entry->connections++;


Lines 37-42 Link Here

(-)../proftpd-1.3.1-orig/include/utf8.h (+3 lines)
37	*/	37	*/
38	char pr_utf8_encode(pool p, const char in, size_t inlen, size_t outlen);	38	char pr_utf8_encode(pool p, const char in, size_t inlen, size_t outlen);
39		39
		40	const char *pr_utf8_get_charset(void);
		41	const char *pr_utf8_get_encoding(void);
		42
40	/* Internal use only. */	43	/* Internal use only. */
41	int utf8_init(void);	44	int utf8_init(void);
42	int utf8_free(void);	45	int utf8_free(void);

Lines 42-47 Link Here

(-)../proftpd-1.3.1-orig/src/utf8.c (-19 / +47 lines)
42	static iconv_t decode_conv = (iconv_t) -1;	42	static iconv_t decode_conv = (iconv_t) -1;
43	static iconv_t encode_conv = (iconv_t) -1;	43	static iconv_t encode_conv = (iconv_t) -1;
44		44
		45	static const char *local_charset = NULL;
		46	static const char *encoding = "UTF-8";
		47
45	static int utf8_convert(iconv_t conv, char inbuf, size_t inbuflen,	48	static int utf8_convert(iconv_t conv, char inbuf, size_t inbuflen,
46	char outbuf, size_t outbuflen) {	49	char outbuf, size_t outbuflen) {
47	# ifdef HAVE_ICONV	50	# ifdef HAVE_ICONV
Lines 78-87 Link Here
78	if (res < 0)	81	if (res < 0)
79	return -1;	82	return -1;
80		83
		84	encode_conv = (iconv_t) -1;
		85
81	res = iconv_close(decode_conv);	86	res = iconv_close(decode_conv);
82	if (res < 0)	87	if (res < 0)
83	return -1;	88	return -1;
84		89
		90	decode_conv = (iconv_t) -1;
		91
85	return 0;	92	return 0;
86	# else	93	# else
87	errno = ENOSYS;	94	errno = ENOSYS;
Lines 90-125 Link Here
90	}	97	}
91		98
92	int utf8_init(void) {	99	int utf8_init(void) {
93	const char *local_charset;
94		100
		101	if (local_charset == NULL) {
95	#ifdef HAVE_NL_LANGINFO	102	#ifdef HAVE_NL_LANGINFO
96	/* Look up the current charset. If there's a problem, default to	103	/* Look up the current charset. If there's a problem, default to
97	* UCS-2.	104	* UCS-2.
98	*/	105	*/
99	local_charset = nl_langinfo(CODESET);	106	local_charset = nl_langinfo(CODESET);
100	if (!local_charset) {	107	if (!local_charset) {
		108	local_charset = "C";
		109	pr_trace_msg("utf8", 1,
		110	"unable to determine locale, defaulting to 'C' for UTF8 conversion");
		111
		112	} else {
		113	pr_trace_msg("utf8", 1, "converting UTF8 to local character set '%s'",
		114	local_charset);
		115	}
		116	#else
101	local_charset = "C";	117	local_charset = "C";
102	pr_trace_msg("utf8", 1,	118	pr_trace_msg("utf8", 1,
103	"unable to determine locale, defaulting to 'C' for UTF8 conversion");	119	"nl_langinfo(3) not supported, defaulting to using 'C' for UTF8 "
104		120	"conversion");
105	} else {
106	pr_trace_msg("utf8", 1, "converting UTF8 to local character set '%s'",
107	local_charset);
108	}
109	#else
110	local_charset = "C";
111	pr_trace_msg("utf8", 1,
112	"nl_langinfo(3) not supported, defaulting to using 'C' for UTF8 "
113	"conversion");
114	#endif /* HAVE_NL_LANGINFO */	121	#endif /* HAVE_NL_LANGINFO */
		122	}
115		123
116	# ifdef HAVE_ICONV	124	# ifdef HAVE_ICONV
117	/* Get the iconv handles. */	125	/* Get the iconv handles. */
118	encode_conv = iconv_open(local_charset, "UTF-8");	126	encode_conv = iconv_open(encoding, local_charset);
119	if (encode_conv == (iconv_t) -1)	127	if (encode_conv == (iconv_t) -1)
120	return -1;	128	return -1;
121		129
122	decode_conv = iconv_open("UTF-8", local_charset);	130	decode_conv = iconv_open(local_charset, encoding);
123	if (decode_conv == (iconv_t) -1)	131	if (decode_conv == (iconv_t) -1)
124	return -1;	132	return -1;
125		133
Lines 200-203 Link Here
200	#endif /* !HAVE_ICONV_H */	208	#endif /* !HAVE_ICONV_H */
201	}	209	}
202		210
		211	const char *pr_utf8_get_charset(void) {
		212	#ifdef HAVE_ICONV_H
		213	return local_charset;
		214
		215	#else
		216	errno = ENOSYS;
		217	return NULL;
		218	#endif /* !HAVE_ICONV_H */
		219	}
		220
		221	const char *pr_utf8_get_encoding(void) {
		222	#ifdef HAVE_ICONV_H
		223	return encoding;
		224
		225	#else
		226	errno = ENOSYS;
		227	return NULL;
		228	#endif /* !HAVE_ICONV_H */
		229	}
		230
203	#endif /* PR_USE_NLS */	231	#endif /* PR_USE_NLS */

Return to bug 258838

Lines 128-134 Link Here

(-)../proftpd-1.3.1-orig/contrib/mod_sql_mysql.c (-1 / +44 lines)
128	* Internal define used for debug and logging. All backends are encouraged	128	* Internal define used for debug and logging. All backends are encouraged
129	* to use the same format.	129	* to use the same format.
130	*/	130	*/
131	#define MOD_SQL_MYSQL_VERSION "mod_sql_mysql/4.0.7"	131	#define MOD_SQL_MYSQL_VERSION "mod_sql_mysql/4.0.8"
132		132
133	#define _MYSQL_PORT "3306"	133	#define _MYSQL_PORT "3306"
134		134
Lines 441-446 Link Here
441	return _build_error(cmd, conn);	441	return _build_error(cmd, conn);
442	}	442	}
443		443
		444	#ifdef PR_USE_NLS
		445	if (pr_utf8_get_encoding() != NULL) {
		446
		447	# if MYSQL_VERSION_ID >= 50007
		448	/* Configure the connection for the current local character set.
		449	*
		450	* Note: the mysql_set_character_set() function appeared in MySQL 5.0.7,
		451	* as per:
		452	*
		453	* http://dev.mysql.com/doc/refman/5.0/en/mysql-set-character-set.html
		454	*/
		455	if (!mysql_set_character_set(conn->mysql, pr_utf8_get_charset())) {
		456	sql_log(DEBUG_FUNC, "%s", "exiting \tmysql cmd_open");
		457	return _build_error(cmd, conn);
		458	}
		459
		460	sql_log(DEBUG_FUNC, "MySQL connection character set now '%s' (from '%s')",
		461	mysql_character_set_name(conn->mysql), pr_utf8_get_charset());
		462
		463	# else
		464	/* No mysql_set_character_set() API available. But
		465	* mysql_character_set_name() has been around for a while; we can use it
		466	* to at least see whether there might be a character set discrepancy.
		467	*/
		468
		469	const char *local_charset = pr_utf8_get_charset();
		470	const char *mysql_charset = mysql_character_set_name(conn->mysql);
		471
		472	if (local_charset &&
		473	mysql_charset &&
		474	strcasecmp(local_charset, mysql_charset) != 0) {
		475	pr_log_pri(PR_LOG_ERR, MOD_SQL_MYSQL_VERSION
		476	": local character set '%s' does not match MySQL character set '%s', "
		477	"SQL injection possible, shutting down", local_charset, mysql_charset);
		478	sql_log(DEBUG_WARN, "local character set '%s' does not match MySQL "
		479	"character set '%s', SQL injection possible, shutting down",
		480	local_charset, mysql_charset);
		481	end_login(1);
		482	}
		483	# endif /* older MySQL */
		484	}
		485	#endif /* !PR_USE_NLS */
		486
444	/* bump connections */	487	/* bump connections */
445	entry->connections++;	488	entry->connections++;
446		489