chalec
/
ctrlv-privatebin
6
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

use quoted identifiers, tell MySQL to expect ANSI SQL

This commit is contained in:
El RIDO 2022-01-23 20:59:02 +01:00
parent b133c2e233
commit 0be55e05bf
No known key found for this signature in database
GPG Key ID: 0F5C940A6BD81F92
1 changed files with 98 additions and 105 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

203
lib/Data/Database.php
View File

@ -97,6 +97,11 @@ class Database extends AbstractData
self::$_type = strtolower( self::$_type = strtolower(
substr($options['dsn'], 0, strpos($options['dsn'], ':')) substr($options['dsn'], 0, strpos($options['dsn'], ':'))
); );
// MySQL uses backticks to quote identifiers by default,
// tell it to expect ANSI SQL double quotes
if (self::$_type === 'mysql' && defined('PDO::MYSQL_ATTR_INIT_COMMAND')) {
$options['opt'][PDO::MYSQL_ATTR_INIT_COMMAND] = "SET sql_mode='ANSI_QUOTES'";
}
$tableQuery = self::_getTableQuery(self::$_type); $tableQuery = self::_getTableQuery(self::$_type);
self::$_db = new PDO( self::$_db = new PDO(
$options['dsn'], $options['dsn'],
@ -200,8 +205,8 @@ class Database extends AbstractData
} }
try { try {
return self::_exec( return self::_exec(
'INSERT INTO ' . self::_sanitizeIdentifier('paste') . 'INSERT INTO "' . self::_sanitizeIdentifier('paste') .
' VALUES(?,?,?,?,?,?,?,?,?)', '" VALUES(?,?,?,?,?,?,?,?,?)',
array( array(
$pasteid, $pasteid,
$isVersion1 ? $paste['data'] : Json::encode($paste), $isVersion1 ? $paste['data'] : Json::encode($paste),
@ -235,8 +240,8 @@ class Database extends AbstractData
self::$_cache[$pasteid] = false; self::$_cache[$pasteid] = false;
try { try {
$paste = self::_select( $paste = self::_select(
'SELECT * FROM ' . self::_sanitizeIdentifier('paste') . 'SELECT * FROM "' . self::_sanitizeIdentifier('paste') .
' WHERE dataid = ?', array($pasteid), true '" WHERE "dataid" = ?', array($pasteid), true
); );
} catch (Exception $e) { } catch (Exception $e) {
$paste = false; $paste = false;
@ -297,12 +302,12 @@ class Database extends AbstractData
public function delete($pasteid) public function delete($pasteid)
{ {
self::_exec( self::_exec(
'DELETE FROM ' . self::_sanitizeIdentifier('paste') . 'DELETE FROM "' . self::_sanitizeIdentifier('paste') .
' WHERE dataid = ?', array($pasteid) '" WHERE "dataid" = ?', array($pasteid)
); );
self::_exec( self::_exec(
'DELETE FROM ' . self::_sanitizeIdentifier('comment') . 'DELETE FROM "' . self::_sanitizeIdentifier('comment') .
' WHERE pasteid = ?', array($pasteid) '" WHERE "pasteid" = ?', array($pasteid)
); );
if ( if (
array_key_exists($pasteid, self::$_cache) array_key_exists($pasteid, self::$_cache)
@ -357,8 +362,8 @@ class Database extends AbstractData
} }
try { try {
return self::_exec( return self::_exec(
'INSERT INTO ' . self::_sanitizeIdentifier('comment') . 'INSERT INTO "' . self::_sanitizeIdentifier('comment') .
' VALUES(?,?,?,?,?,?,?)', '" VALUES(?,?,?,?,?,?,?)',
array( array(
$commentid, $commentid,
$pasteid, $pasteid,
@ -384,8 +389,8 @@ class Database extends AbstractData
public function readComments($pasteid) public function readComments($pasteid)
{ {
$rows = self::_select( $rows = self::_select(
'SELECT * FROM ' . self::_sanitizeIdentifier('comment') . 'SELECT * FROM "' . self::_sanitizeIdentifier('comment') .
' WHERE pasteid = ?', array($pasteid) '" WHERE "pasteid" = ?', array($pasteid)
); );
// create comment list // create comment list
@ -429,8 +434,8 @@ class Database extends AbstractData
{ {
try { try {
return (bool) self::_select( return (bool) self::_select(
'SELECT dataid FROM ' . self::_sanitizeIdentifier('comment') . 'SELECT "dataid" FROM "' . self::_sanitizeIdentifier('comment') .
' WHERE pasteid = ? AND parentid = ? AND dataid = ?', '" WHERE "pasteid" = ? AND "parentid" = ? AND "dataid" = ?',
array($pasteid, $parentid, $commentid), true array($pasteid, $parentid, $commentid), true
); );
} catch (Exception $e) { } catch (Exception $e) {
@ -458,8 +463,8 @@ class Database extends AbstractData
} }
} }
return self::_exec( return self::_exec(
'UPDATE ' . self::_sanitizeIdentifier('config') . 'UPDATE "' . self::_sanitizeIdentifier('config') .
' SET value = ? WHERE id = ?', '" SET "value" = ? WHERE "id" = ?',
array($value, strtoupper($namespace)) array($value, strtoupper($namespace))
); );
} }
@ -479,8 +484,8 @@ class Database extends AbstractData
if ($value === '') { if ($value === '') {
// initialize the row, so that setValue can rely on UPDATE queries // initialize the row, so that setValue can rely on UPDATE queries
self::_exec( self::_exec(
'INSERT INTO ' . self::_sanitizeIdentifier('config') . 'INSERT INTO "' . self::_sanitizeIdentifier('config') .
' VALUES(?,?)', '" VALUES(?,?)',
array($configKey, '') array($configKey, '')
); );
@ -517,8 +522,8 @@ class Database extends AbstractData
{ {
$pastes = array(); $pastes = array();
$rows = self::_select( $rows = self::_select(
'SELECT dataid FROM ' . self::_sanitizeIdentifier('paste') . 'SELECT "dataid" FROM "' . self::_sanitizeIdentifier('paste') .
' WHERE expiredate < ? AND expiredate != ? ' . '" WHERE "expiredate" < ? AND "expiredate" != ? ' .
(self::$_type === 'oci' ? 'FETCH NEXT ? ROWS ONLY' : 'LIMIT ?'), (self::$_type === 'oci' ? 'FETCH NEXT ? ROWS ONLY' : 'LIMIT ?'),
array(time(), 0, $batchsize) array(time(), 0, $batchsize)
); );
@ -586,8 +591,12 @@ class Database extends AbstractData
// returned column names are all upper case, convert these back // returned column names are all upper case, convert these back
// returned CLOB values are streams, convert these into strings // returned CLOB values are streams, convert these into strings
$result = $firstOnly ? $result = $firstOnly ?
self::_sanitizeOciRow($result) : array_map('self::_sanitizeClob', $result) :
array_map('self::_sanitizeOciRow', $result); array_map(
function ($row) {
return array_map('self::_sanitizeClob', $row);
}, $result
);
} }
return $result; return $result;
} }
@ -621,39 +630,39 @@ class Database extends AbstractData
{ {
switch ($type) { switch ($type) {
case 'ibm': case 'ibm':
$sql = 'SELECT tabname FROM SYSCAT.TABLES '; $sql = 'SELECT "tabname" FROM "SYSCAT"."TABLES"';
break; break;
case 'informix': case 'informix':
$sql = 'SELECT tabname FROM systables '; $sql = 'SELECT "tabname" FROM "systables"';
break; break;
case 'mssql': case 'mssql':
$sql = 'SELECT name FROM sysobjects ' $sql = 'SELECT "name" FROM "sysobjects" '
. "WHERE type = 'U' ORDER BY name"; . 'WHERE "type" = \'U\' ORDER BY "name"';
break; break;
case 'mysql': case 'mysql':
$sql = 'SHOW TABLES'; $sql = 'SHOW TABLES';
break; break;
case 'oci': case 'oci':
$sql = 'SELECT table_name FROM all_tables'; $sql = 'SELECT "table_name" FROM "all_tables"';
break; break;
case 'pgsql': case 'pgsql':
$sql = 'SELECT c.relname AS table_name ' $sql = 'SELECT c."relname" AS "table_name" '
. 'FROM pg_class c, pg_user u ' . 'FROM "pg_class" c, "pg_user" u '
. "WHERE c.relowner = u.usesysid AND c.relkind = 'r' " . "WHERE c.\"relowner\" = u.\"usesysid\" AND c.\"relkind\" = 'r' "
. 'AND NOT EXISTS (SELECT 1 FROM pg_views WHERE viewname = c.relname) ' . 'AND NOT EXISTS (SELECT 1 FROM "pg_views" WHERE "viewname" = c."relname") '
. "AND c.relname !~ '^(pg_|sql_)' " . "AND c.\"relname\" !~ '^(pg_|sql_)' "
. 'UNION ' . 'UNION '
. 'SELECT c.relname AS table_name ' . 'SELECT c."relname" AS "table_name" '
. 'FROM pg_class c ' . 'FROM "pg_class" c '
. "WHERE c.relkind = 'r' " . "WHERE c.\"relkind\" = 'r' "
. 'AND NOT EXISTS (SELECT 1 FROM pg_views WHERE viewname = c.relname) ' . 'AND NOT EXISTS (SELECT 1 FROM "pg_views" WHERE "viewname" = c."relname") '
. 'AND NOT EXISTS (SELECT 1 FROM pg_user WHERE usesysid = c.relowner) ' . 'AND NOT EXISTS (SELECT 1 FROM "pg_user" WHERE "usesysid" = c."relowner") '
. "AND c.relname !~ '^pg_'"; . "AND c.\"relname\" !~ '^pg_'";
break; break;
case 'sqlite': case 'sqlite':
$sql = "SELECT name FROM sqlite_master WHERE type='table' " $sql = 'SELECT "name" FROM "sqlite_master" WHERE "type"=\'table\' '
. 'UNION ALL SELECT name FROM sqlite_temp_master ' . 'UNION ALL SELECT "name" FROM "sqlite_temp_master" '
. "WHERE type='table' ORDER BY name"; . 'WHERE "type"=\'table\' ORDER BY "name"';
break; break;
default: default:
throw new Exception( throw new Exception(
@ -675,8 +684,8 @@ class Database extends AbstractData
{ {
try { try {
$row = self::_select( $row = self::_select(
'SELECT value FROM ' . self::_sanitizeIdentifier('config') . 'SELECT "value" FROM "' . self::_sanitizeIdentifier('config') .
' WHERE id = ?', array($key), true '" WHERE "id" = ?', array($key), true
); );
} catch (PDOException $e) { } catch (PDOException $e) {
return ''; return '';
@ -696,7 +705,7 @@ class Database extends AbstractData
{ {
$main_key = $after_key = ''; $main_key = $after_key = '';
if (self::$_type === 'mysql' || self::$_type === 'oci') { if (self::$_type === 'mysql' || self::$_type === 'oci') {
$after_key = ", PRIMARY KEY ($key)"; $after_key = ", PRIMARY KEY (\"$key\")";
} else { } else {
$main_key = ' PRIMARY KEY'; $main_key = ' PRIMARY KEY';
} }
@ -758,16 +767,16 @@ class Database extends AbstractData
$attachmentType = self::_getAttachmentType(); $attachmentType = self::_getAttachmentType();
$metaType = self::_getMetaType(); $metaType = self::_getMetaType();
self::$_db->exec( self::$_db->exec(
'CREATE TABLE ' . self::_sanitizeIdentifier('paste') . ' ( ' . 'CREATE TABLE "' . self::_sanitizeIdentifier('paste') . '" ( ' .
"dataid CHAR(16) NOT NULL$main_key, " . "\"dataid\" CHAR(16) NOT NULL$main_key, " .
"data $dataType, " . "\"data\" $dataType, " .
'postdate INT, ' . '"postdate" INT, ' .
'expiredate INT, ' . '"expiredate" INT, ' .
'opendiscussion INT, ' . '"opendiscussion" INT, ' .
'burnafterreading INT, ' . '"burnafterreading" INT, ' .
"meta $metaType, " . "\"meta\" $metaType, " .
"attachment $attachmentType, " . "\"attachment\" $attachmentType, " .
"attachmentname $dataType$after_key )" "\"attachmentname\" $dataType$after_key )"
); );
} }
@ -782,14 +791,14 @@ class Database extends AbstractData
list($main_key, $after_key) = self::_getPrimaryKeyClauses(); list($main_key, $after_key) = self::_getPrimaryKeyClauses();
$dataType = self::_getDataType(); $dataType = self::_getDataType();
self::$_db->exec( self::$_db->exec(
'CREATE TABLE ' . self::_sanitizeIdentifier('comment') . ' ( ' . 'CREATE TABLE "' . self::_sanitizeIdentifier('comment') . '" ( ' .
"dataid CHAR(16) NOT NULL$main_key, " . "\"dataid\" CHAR(16) NOT NULL$main_key, " .
'pasteid CHAR(16), ' . '"pasteid" CHAR(16), ' .
'parentid CHAR(16), ' . '"parentid" CHAR(16), ' .
"data $dataType, " . "\"data\" $dataType, " .
"nickname $dataType, " . "\"nickname\" $dataType, " .
"vizhash $dataType, " . "\"vizhash\" $dataType, " .
"postdate INT$after_key )" "\"postdate\" INT$after_key )"
); );
if (self::$_type === 'oci') { if (self::$_type === 'oci') {
self::$_db->exec( self::$_db->exec(
@ -799,14 +808,14 @@ class Database extends AbstractData
pragma exception_init( already_exists, -955 ); pragma exception_init( already_exists, -955 );
pragma exception_init(columns_indexed, -1408); pragma exception_init(columns_indexed, -1408);
begin begin
execute immediate \'create index comment_parent on ' . self::_sanitizeIdentifier('comment') . ' (pasteid)\'; execute immediate \'create index "comment_parent" on "' . self::_sanitizeIdentifier('comment') . '" ("pasteid")\';
exception exception
end' end'
); );
} else { } else {
self::$_db->exec( self::$_db->exec(
'CREATE INDEX IF NOT EXISTS comment_parent ON ' . 'CREATE INDEX IF NOT EXISTS "comment_parent" ON "' .
self::_sanitizeIdentifier('comment') . '(pasteid)' self::_sanitizeIdentifier('comment') . '" ("pasteid")'
); );
} }
} }
@ -823,12 +832,12 @@ class Database extends AbstractData
$charType = self::$_type === 'oci' ? 'VARCHAR2(16)' : 'CHAR(16)'; $charType = self::$_type === 'oci' ? 'VARCHAR2(16)' : 'CHAR(16)';
$textType = self::_getMetaType(); $textType = self::_getMetaType();
self::$_db->exec( self::$_db->exec(
'CREATE TABLE ' . self::_sanitizeIdentifier('config') . 'CREATE TABLE "' . self::_sanitizeIdentifier('config') .
" ( id $charType NOT NULL$main_key, value $textType$after_key )" "\" ( \"id\" $charType NOT NULL$main_key, \"value\" $textType$after_key )"
); );
self::_exec( self::_exec(
'INSERT INTO ' . self::_sanitizeIdentifier('config') . 'INSERT INTO "' . self::_sanitizeIdentifier('config') .
' VALUES(?,?)', '" VALUES(?,?)',
array('VERSION', Controller::VERSION) array('VERSION', Controller::VERSION)
); );
} }
@ -864,22 +873,6 @@ class Database extends AbstractData
return preg_replace('/[^A-Za-z0-9_]+/', '', self::$_prefix . $identifier); return preg_replace('/[^A-Za-z0-9_]+/', '', self::$_prefix . $identifier);
} }
/**
* sanitizes row returned by OCI
*
* @access private
* @static
* @param array $row
* @return array
*/
private static function _sanitizeOciRow($row)
{
return array_combine(
array_map('strtolower', array_keys($row)),
array_map('self::_sanitizeClob', array_values($row))
);
}
/** /**
* upgrade the database schema from an old version * upgrade the database schema from an old version
* *
@ -895,43 +888,43 @@ class Database extends AbstractData
case '0.21': case '0.21':
// create the meta column if necessary (pre 0.21 change) // create the meta column if necessary (pre 0.21 change)
try { try {
self::$_db->exec('SELECT meta FROM ' . self::_sanitizeIdentifier('paste') . ' LIMIT 1'); self::$_db->exec('SELECT "meta" FROM "' . self::_sanitizeIdentifier('paste') . '" LIMIT 1');
} catch (PDOException $e) { } catch (PDOException $e) {
self::$_db->exec('ALTER TABLE ' . self::_sanitizeIdentifier('paste') . ' ADD COLUMN meta TEXT'); self::$_db->exec('ALTER TABLE "' . self::_sanitizeIdentifier('paste') . '" ADD COLUMN "meta" TEXT');
} }
// SQLite only allows one ALTER statement at a time... // SQLite only allows one ALTER statement at a time...
self::$_db->exec( self::$_db->exec(
'ALTER TABLE ' . self::_sanitizeIdentifier('paste') . 'ALTER TABLE "' . self::_sanitizeIdentifier('paste') .
" ADD COLUMN attachment $attachmentType" "\" ADD COLUMN \"attachment\" $attachmentType"
); );
self::$_db->exec( self::$_db->exec(
'ALTER TABLE ' . self::_sanitizeIdentifier('paste') . " ADD COLUMN attachmentname $dataType" 'ALTER TABLE "' . self::_sanitizeIdentifier('paste') . "\" ADD COLUMN \"attachmentname\" $dataType"
); );
// SQLite doesn't support MODIFY, but it allows TEXT of similar // SQLite doesn't support MODIFY, but it allows TEXT of similar
// size as BLOB, so there is no need to change it there // size as BLOB, so there is no need to change it there
if (self::$_type !== 'sqlite') { if (self::$_type !== 'sqlite') {
self::$_db->exec( self::$_db->exec(
'ALTER TABLE ' . self::_sanitizeIdentifier('paste') . 'ALTER TABLE "' . self::_sanitizeIdentifier('paste') .
" ADD PRIMARY KEY (dataid), MODIFY COLUMN data $dataType" "\" ADD PRIMARY KEY (\"dataid\"), MODIFY COLUMN \"data\" $dataType"
); );
self::$_db->exec( self::$_db->exec(
'ALTER TABLE ' . self::_sanitizeIdentifier('comment') . 'ALTER TABLE "' . self::_sanitizeIdentifier('comment') .
" ADD PRIMARY KEY (dataid), MODIFY COLUMN data $dataType, " . "\" ADD PRIMARY KEY (\"dataid\"), MODIFY COLUMN \"data\" $dataType, " .
"MODIFY COLUMN nickname $dataType, MODIFY COLUMN vizhash $dataType" "MODIFY COLUMN \"nickname\" $dataType, MODIFY COLUMN \"vizhash\" $dataType"
); );
} else { } else {
self::$_db->exec( self::$_db->exec(
'CREATE UNIQUE INDEX IF NOT EXISTS paste_dataid ON ' . 'CREATE UNIQUE INDEX IF NOT EXISTS "paste_dataid" ON "' .
self::_sanitizeIdentifier('paste') . '(dataid)' self::_sanitizeIdentifier('paste') . '" ("dataid")'
); );
self::$_db->exec( self::$_db->exec(
'CREATE UNIQUE INDEX IF NOT EXISTS comment_dataid ON ' . 'CREATE UNIQUE INDEX IF NOT EXISTS "comment_dataid" ON "' .
self::_sanitizeIdentifier('comment') . '(dataid)' self::_sanitizeIdentifier('comment') . '" ("dataid")'
); );
} }
self::$_db->exec( self::$_db->exec(
'CREATE INDEX IF NOT EXISTS comment_parent ON ' . 'CREATE INDEX IF NOT EXISTS "comment_parent" ON "' .
self::_sanitizeIdentifier('comment') . '(pasteid)' self::_sanitizeIdentifier('comment') . '" ("pasteid")'
); );
// no break, continue with updates for 0.22 and later // no break, continue with updates for 0.22 and later
case '1.3': case '1.3':
@ -940,15 +933,15 @@ class Database extends AbstractData
// to change it there // to change it there
if (self::$_type !== 'sqlite' && self::$_type !== 'pgsql') { if (self::$_type !== 'sqlite' && self::$_type !== 'pgsql') {
self::$_db->exec( self::$_db->exec(
'ALTER TABLE ' . self::_sanitizeIdentifier('paste') . 'ALTER TABLE "' . self::_sanitizeIdentifier('paste') .
" MODIFY COLUMN data $attachmentType" "\" MODIFY COLUMN \"data\" $attachmentType"
); );
} }
// no break, continue with updates for all newer versions // no break, continue with updates for all newer versions
default: default:
self::_exec( self::_exec(
'UPDATE ' . self::_sanitizeIdentifier('config') . 'UPDATE "' . self::_sanitizeIdentifier('config') .
' SET value = ? WHERE id = ?', '" SET "value" = ? WHERE "id" = ?',
array(Controller::VERSION, 'VERSION') array(Controller::VERSION, 'VERSION')
); );
} }