Fossil SCM

Make sure the perferred timezone format has been queried prior to running user SQL, since while running user SQL access to the CONFIG table is restricted.

drh 2011-09-01 11:33 trunk
Commit 7922e56655ccdc37e62dff70eeb5df047f8a71d5
Parent 49402fc72296cc5…
1 file changed +20 -9
~ src/report.c
M src/report.c
+20 -9
--- src/report.c
+++ src/report.c
@@ -198,10 +198,22 @@
198198
 }
199199
 }
200200
 return rc;
201201
 }
202202
203
+/*
204
+** Activate the query authorizer
205
+*/
206
+static void report_restrict_sql(char **pzErr){
207
+ char *zErr;
208
+ (void)fossil_localtime(0);
209
+ sqlite3_set_authorizer(g.db, report_query_authorizer, (void*)pzErr);
210
+}
211
+static void report_unrestrict_sql(void){
212
+ sqlite3_set_authorizer(g.db, 0, 0);
213
+}
214
+
203215
204216
 /*
205217
 ** Check the given SQL to see if is a valid query that does not
206218
 ** attempt to do anything dangerous. Return 0 on success and a
207219
 ** pointer to an error message string (obtained from malloc) if
@@ -237,11 +249,11 @@
237249
 }
238250
 }
239251
 }
240252
241253
 /* Compile the statement and check for illegal accesses or syntax errors. */
242
- sqlite3_set_authorizer(g.db, report_query_authorizer, (void*)&zErr);
254
+ report_restrict_sql(&zErr);
243255
 rc = sqlite3_prepare(g.db, zSql, -1, &pStmt, &zTail);
244256
 if( rc!=SQLITE_OK ){
245257
 zErr = mprintf("Syntax error: %s", sqlite3_errmsg(g.db));
246258
 }
247259
 if( !sqlite3_stmt_readonly(pStmt) ){
@@ -248,11 +260,11 @@
248260
 zErr = mprintf("SQL must not modify the database");
249261
 }
250262
 if( pStmt ){
251263
 sqlite3_finalize(pStmt);
252264
 }
253
- sqlite3_set_authorizer(g.db, 0, 0);
265
+ report_unrestrict_sql();
254266
 return zErr;
255267
 }
256268
257269
 /*
258270
 ** WEBPAGE: /rptsql
@@ -963,25 +975,24 @@
963975
 output_color_key(zClrKey, 1,
964976
 "border=\"0\" cellpadding=\"3\" cellspacing=\"0\" class=\"report\"");
965977
 @ <table border="1" cellpadding="2" cellspacing="0" class="report">
966978
 sState.rn = rn;
967979
 sState.nCount = 0;
968
- (void)fossil_localtime(0); /* initialize the g.fTimeFormat variable */
969
- sqlite3_set_authorizer(g.db, report_query_authorizer, (void*)&zErr1);
980
+ report_restrict_sql(&zErr1);
970981
 sqlite3_exec_readonly(g.db, zSql, generate_html, &sState, &zErr2);
971
- sqlite3_set_authorizer(g.db, 0, 0);
982
+ report_unrestrict_sql();
972983
 @ </table>
973984
 if( zErr1 ){
974985
 @ <p class="reportError">Error: %h(zErr1)</p>
975986
 }else if( zErr2 ){
976987
 @ <p class="reportError">Error: %h(zErr2)</p>
977988
 }
978989
 style_footer();
979990
 }else{
980
- sqlite3_set_authorizer(g.db, report_query_authorizer, (void*)&zErr1);
991
+ report_restrict_sql(&zErr1);
981992
 sqlite3_exec_readonly(g.db, zSql, output_tab_separated, &count, &zErr2);
982
- sqlite3_set_authorizer(g.db, 0, 0);
993
+ report_unrestrict_sql();
983994
 cgi_set_content_type("text/plain");
984995
 }
985996
 }
986997
987998
 /*
@@ -1137,12 +1148,12 @@
11371148
 zSql = mprintf("SELECT * FROM (%s) WHERE %s",zSql,zFilter);
11381149
 }
11391150
 count = 0;
11401151
 tktEncode = enc;
11411152
 zSep = zSepIn;
1142
- sqlite3_set_authorizer(g.db, report_query_authorizer, (void*)&zErr1);
1153
+ report_restrict_sql(&zErr1);
11431154
 sqlite3_exec_readonly(g.db, zSql, output_separated_file, &count, &zErr2);
1144
- sqlite3_set_authorizer(g.db, 0, 0);
1155
+ report_unrestrict_sql();
11451156
 if( zFilter ){
11461157
 free(zSql);
11471158
 }
11481159
 }
11491160
--- src/report.c
+++ src/report.c
@@ -198,10 +198,22 @@
198 }
199 }
200 return rc;
201 }
202
 
 
 
 
 
 
 
 
 
 
 
 
203
204 /*
205 ** Check the given SQL to see if is a valid query that does not
206 ** attempt to do anything dangerous. Return 0 on success and a
207 ** pointer to an error message string (obtained from malloc) if
@@ -237,11 +249,11 @@
237 }
238 }
239 }
240
241 /* Compile the statement and check for illegal accesses or syntax errors. */
242 sqlite3_set_authorizer(g.db, report_query_authorizer, (void*)&zErr);
243 rc = sqlite3_prepare(g.db, zSql, -1, &pStmt, &zTail);
244 if( rc!=SQLITE_OK ){
245 zErr = mprintf("Syntax error: %s", sqlite3_errmsg(g.db));
246 }
247 if( !sqlite3_stmt_readonly(pStmt) ){
@@ -248,11 +260,11 @@
248 zErr = mprintf("SQL must not modify the database");
249 }
250 if( pStmt ){
251 sqlite3_finalize(pStmt);
252 }
253 sqlite3_set_authorizer(g.db, 0, 0);
254 return zErr;
255 }
256
257 /*
258 ** WEBPAGE: /rptsql
@@ -963,25 +975,24 @@
963 output_color_key(zClrKey, 1,
964 "border=\"0\" cellpadding=\"3\" cellspacing=\"0\" class=\"report\"");
965 @ <table border="1" cellpadding="2" cellspacing="0" class="report">
966 sState.rn = rn;
967 sState.nCount = 0;
968 (void)fossil_localtime(0); /* initialize the g.fTimeFormat variable */
969 sqlite3_set_authorizer(g.db, report_query_authorizer, (void*)&zErr1);
970 sqlite3_exec_readonly(g.db, zSql, generate_html, &sState, &zErr2);
971 sqlite3_set_authorizer(g.db, 0, 0);
972 @ </table>
973 if( zErr1 ){
974 @ <p class="reportError">Error: %h(zErr1)</p>
975 }else if( zErr2 ){
976 @ <p class="reportError">Error: %h(zErr2)</p>
977 }
978 style_footer();
979 }else{
980 sqlite3_set_authorizer(g.db, report_query_authorizer, (void*)&zErr1);
981 sqlite3_exec_readonly(g.db, zSql, output_tab_separated, &count, &zErr2);
982 sqlite3_set_authorizer(g.db, 0, 0);
983 cgi_set_content_type("text/plain");
984 }
985 }
986
987 /*
@@ -1137,12 +1148,12 @@
1137 zSql = mprintf("SELECT * FROM (%s) WHERE %s",zSql,zFilter);
1138 }
1139 count = 0;
1140 tktEncode = enc;
1141 zSep = zSepIn;
1142 sqlite3_set_authorizer(g.db, report_query_authorizer, (void*)&zErr1);
1143 sqlite3_exec_readonly(g.db, zSql, output_separated_file, &count, &zErr2);
1144 sqlite3_set_authorizer(g.db, 0, 0);
1145 if( zFilter ){
1146 free(zSql);
1147 }
1148 }
1149
--- src/report.c
+++ src/report.c
@@ -198,10 +198,22 @@
198 }
199 }
200 return rc;
201 }
202
203 /*
204 ** Activate the query authorizer
205 */
206 static void report_restrict_sql(char **pzErr){
207 char *zErr;
208 (void)fossil_localtime(0);
209 sqlite3_set_authorizer(g.db, report_query_authorizer, (void*)pzErr);
210 }
211 static void report_unrestrict_sql(void){
212 sqlite3_set_authorizer(g.db, 0, 0);
213 }
214
215
216 /*
217 ** Check the given SQL to see if is a valid query that does not
218 ** attempt to do anything dangerous. Return 0 on success and a
219 ** pointer to an error message string (obtained from malloc) if
@@ -237,11 +249,11 @@
249 }
250 }
251 }
252
253 /* Compile the statement and check for illegal accesses or syntax errors. */
254 report_restrict_sql(&zErr);
255 rc = sqlite3_prepare(g.db, zSql, -1, &pStmt, &zTail);
256 if( rc!=SQLITE_OK ){
257 zErr = mprintf("Syntax error: %s", sqlite3_errmsg(g.db));
258 }
259 if( !sqlite3_stmt_readonly(pStmt) ){
@@ -248,11 +260,11 @@
260 zErr = mprintf("SQL must not modify the database");
261 }
262 if( pStmt ){
263 sqlite3_finalize(pStmt);
264 }
265 report_unrestrict_sql();
266 return zErr;
267 }
268
269 /*
270 ** WEBPAGE: /rptsql
@@ -963,25 +975,24 @@
975 output_color_key(zClrKey, 1,
976 "border=\"0\" cellpadding=\"3\" cellspacing=\"0\" class=\"report\"");
977 @ <table border="1" cellpadding="2" cellspacing="0" class="report">
978 sState.rn = rn;
979 sState.nCount = 0;
980 report_restrict_sql(&zErr1);
 
981 sqlite3_exec_readonly(g.db, zSql, generate_html, &sState, &zErr2);
982 report_unrestrict_sql();
983 @ </table>
984 if( zErr1 ){
985 @ <p class="reportError">Error: %h(zErr1)</p>
986 }else if( zErr2 ){
987 @ <p class="reportError">Error: %h(zErr2)</p>
988 }
989 style_footer();
990 }else{
991 report_restrict_sql(&zErr1);
992 sqlite3_exec_readonly(g.db, zSql, output_tab_separated, &count, &zErr2);
993 report_unrestrict_sql();
994 cgi_set_content_type("text/plain");
995 }
996 }
997
998 /*
@@ -1137,12 +1148,12 @@
1148 zSql = mprintf("SELECT * FROM (%s) WHERE %s",zSql,zFilter);
1149 }
1150 count = 0;
1151 tktEncode = enc;
1152 zSep = zSepIn;
1153 report_restrict_sql(&zErr1);
1154 sqlite3_exec_readonly(g.db, zSql, output_separated_file, &count, &zErr2);
1155 report_unrestrict_sql();
1156 if( zFilter ){
1157 free(zSql);
1158 }
1159 }
1160

Keyboard Shortcuts

Open search /
Next entry (timeline) j
Previous entry (timeline) k
Open focused entry Enter
Show this help ?
Toggle theme Top nav button