Fossil SCM

Check that the date provided will actually come back out of the database before allowing it in. Also, allow altering a date that may be wrong.

andybradford 2015-07-31 07:22 UTC check-in-edit
Commit 44fda3228b18d6f6e080ab9875bd37c24bf49f68
Parent 161f4348cafddc1…
1 file changed +13 -3
~ src/info.c
M src/info.c
+13 -3
--- src/info.c
+++ src/info.c
@@ -2391,10 +2391,18 @@
23912391
 manifest_crosslink(nrid, ctrl, MC_PERMIT_HOOKS);
23922392
 assert( blob_is_reset(ctrl) );
23932393
 db_end_transaction(0);
23942394
 }
23952395
 }
2396
+
2397
+/*
2398
+** This method checks that the date can be parsed.
2399
+** Returns 1 if datetime() can validate, 0 otherwise.
2400
+*/
2401
+int is_datetime(const char* zDate){
2402
+ return db_int(0, "SELECT datetime(%Q) NOT NULL", zDate);
2403
+}
23962404
23972405
 /*
23982406
 ** WEBPAGE: ci_edit
23992407
 ** URL: /ci_edit?r=RID&c=NEWCOMMENT&u=NEWUSER
24002408
 **
@@ -2817,14 +2825,12 @@
28172825
 zUuid = db_text(0, "SELECT uuid FROM blob WHERE rid=%d", rid);
28182826
 zComment = db_text(0, "SELECT coalesce(ecomment,comment)"
28192827
 " FROM event WHERE objid=%d", rid);
28202828
 zUser = db_text(0, "SELECT coalesce(euser,user)"
28212829
 " FROM event WHERE objid=%d", rid);
2822
- if( zUser==0 || zUser[0]==0 ) fossil_fatal("No user on rid %d", rid);
28232830
 zDate = db_text(0, "SELECT datetime(mtime)"
28242831
 " FROM event WHERE objid=%d", rid);
2825
- if( zDate==0 || zDate[0]==0 ) fossil_fatal("No date on rid %d", rid);
28262832
 zColor = db_text("", "SELECT bgcolor"
28272833
 " FROM event WHERE objid=%d", rid);
28282834
 fPropagateColor = db_int(0, "SELECT tagtype FROM tagxref"
28292835
 " WHERE rid=%d AND tagid=%d",
28302836
 rid, TAG_BGCOLOR)==2;
@@ -2860,11 +2866,15 @@
28602866
 zNewComment = blob_str(&comment);
28612867
 }
28622868
 if( zNewComment && zNewComment[0]
28632869
 && comment_compare(zComment,zNewComment)==0 ) add_comment(zNewComment);
28642870
 if( zNewDate && zNewDate[0] && fossil_strcmp(zDate,zNewDate)!=0 ){
2865
- add_date(zNewDate);
2871
+ if( is_datetime(zNewDate) ){
2872
+ add_date(zNewDate);
2873
+ }else{
2874
+ fossil_fatal("Unsupported date format, use YYYY-MM-DD HH:MM:SS");
2875
+ }
28662876
 }
28672877
 if( zNewUser && zNewUser[0] && fossil_strcmp(zUser,zNewUser)!=0 ){
28682878
 add_user(zNewUser);
28692879
 }
28702880
 if( pzNewTags!=0 ){
28712881
--- src/info.c
+++ src/info.c
@@ -2391,10 +2391,18 @@
2391 manifest_crosslink(nrid, ctrl, MC_PERMIT_HOOKS);
2392 assert( blob_is_reset(ctrl) );
2393 db_end_transaction(0);
2394 }
2395 }
 
 
 
 
 
 
 
 
2396
2397 /*
2398 ** WEBPAGE: ci_edit
2399 ** URL: /ci_edit?r=RID&c=NEWCOMMENT&u=NEWUSER
2400 **
@@ -2817,14 +2825,12 @@
2817 zUuid = db_text(0, "SELECT uuid FROM blob WHERE rid=%d", rid);
2818 zComment = db_text(0, "SELECT coalesce(ecomment,comment)"
2819 " FROM event WHERE objid=%d", rid);
2820 zUser = db_text(0, "SELECT coalesce(euser,user)"
2821 " FROM event WHERE objid=%d", rid);
2822 if( zUser==0 || zUser[0]==0 ) fossil_fatal("No user on rid %d", rid);
2823 zDate = db_text(0, "SELECT datetime(mtime)"
2824 " FROM event WHERE objid=%d", rid);
2825 if( zDate==0 || zDate[0]==0 ) fossil_fatal("No date on rid %d", rid);
2826 zColor = db_text("", "SELECT bgcolor"
2827 " FROM event WHERE objid=%d", rid);
2828 fPropagateColor = db_int(0, "SELECT tagtype FROM tagxref"
2829 " WHERE rid=%d AND tagid=%d",
2830 rid, TAG_BGCOLOR)==2;
@@ -2860,11 +2866,15 @@
2860 zNewComment = blob_str(&comment);
2861 }
2862 if( zNewComment && zNewComment[0]
2863 && comment_compare(zComment,zNewComment)==0 ) add_comment(zNewComment);
2864 if( zNewDate && zNewDate[0] && fossil_strcmp(zDate,zNewDate)!=0 ){
2865 add_date(zNewDate);
 
 
 
 
2866 }
2867 if( zNewUser && zNewUser[0] && fossil_strcmp(zUser,zNewUser)!=0 ){
2868 add_user(zNewUser);
2869 }
2870 if( pzNewTags!=0 ){
2871
--- src/info.c
+++ src/info.c
@@ -2391,10 +2391,18 @@
2391 manifest_crosslink(nrid, ctrl, MC_PERMIT_HOOKS);
2392 assert( blob_is_reset(ctrl) );
2393 db_end_transaction(0);
2394 }
2395 }
2396
2397 /*
2398 ** This method checks that the date can be parsed.
2399 ** Returns 1 if datetime() can validate, 0 otherwise.
2400 */
2401 int is_datetime(const char* zDate){
2402 return db_int(0, "SELECT datetime(%Q) NOT NULL", zDate);
2403 }
2404
2405 /*
2406 ** WEBPAGE: ci_edit
2407 ** URL: /ci_edit?r=RID&c=NEWCOMMENT&u=NEWUSER
2408 **
@@ -2817,14 +2825,12 @@
2825 zUuid = db_text(0, "SELECT uuid FROM blob WHERE rid=%d", rid);
2826 zComment = db_text(0, "SELECT coalesce(ecomment,comment)"
2827 " FROM event WHERE objid=%d", rid);
2828 zUser = db_text(0, "SELECT coalesce(euser,user)"
2829 " FROM event WHERE objid=%d", rid);
 
2830 zDate = db_text(0, "SELECT datetime(mtime)"
2831 " FROM event WHERE objid=%d", rid);
 
2832 zColor = db_text("", "SELECT bgcolor"
2833 " FROM event WHERE objid=%d", rid);
2834 fPropagateColor = db_int(0, "SELECT tagtype FROM tagxref"
2835 " WHERE rid=%d AND tagid=%d",
2836 rid, TAG_BGCOLOR)==2;
@@ -2860,11 +2866,15 @@
2866 zNewComment = blob_str(&comment);
2867 }
2868 if( zNewComment && zNewComment[0]
2869 && comment_compare(zComment,zNewComment)==0 ) add_comment(zNewComment);
2870 if( zNewDate && zNewDate[0] && fossil_strcmp(zDate,zNewDate)!=0 ){
2871 if( is_datetime(zNewDate) ){
2872 add_date(zNewDate);
2873 }else{
2874 fossil_fatal("Unsupported date format, use YYYY-MM-DD HH:MM:SS");
2875 }
2876 }
2877 if( zNewUser && zNewUser[0] && fossil_strcmp(zUser,zNewUser)!=0 ){
2878 add_user(zNewUser);
2879 }
2880 if( pzNewTags!=0 ){
2881

Keyboard Shortcuts

Open search /
Next entry (timeline) j
Previous entry (timeline) k
Open focused entry Enter
Show this help ?
Toggle theme Top nav button