Fossil SCM
Merge from trunk
Commit
7b9ca24cd2e5617570196af7b08471f590fc30bd0d1a45d8c4a6ce62eae74a45
Parent
959699bfb6f1399…
1 file changed
+20
-11
+20
-11
| --- src/report.c | ||
| +++ src/report.c | ||
| @@ -183,37 +183,46 @@ | ||
| 183 | 183 | case SQLITE_FUNCTION: { |
| 184 | 184 | break; |
| 185 | 185 | } |
| 186 | 186 | case SQLITE_READ: { |
| 187 | 187 | static const char *const azAllowed[] = { |
| 188 | - "ticket", | |
| 189 | - "ticketchng", | |
| 188 | + "backlink", | |
| 190 | 189 | "blob", |
| 190 | + "event", | |
| 191 | 191 | "filename", |
| 192 | + "json_each", | |
| 193 | + "json_tree", | |
| 192 | 194 | "mlink", |
| 193 | 195 | "plink", |
| 194 | - "event", | |
| 195 | 196 | "tag", |
| 196 | 197 | "tagxref", |
| 198 | + "ticket", | |
| 199 | + "ticketchng", | |
| 197 | 200 | "unversioned", |
| 198 | - "backlink", | |
| 199 | 201 | }; |
| 200 | - int i; | |
| 202 | + int lwr = 0; | |
| 203 | + int upr = count(azAllowed) - 1; | |
| 204 | + int rc = 0; | |
| 201 | 205 | if( zArg1==0 ){ |
| 202 | 206 | /* Some legacy versions of SQLite will sometimes send spurious |
| 203 | 207 | ** READ authorizations that have no table name. These can be |
| 204 | 208 | ** ignored. */ |
| 205 | 209 | rc = SQLITE_IGNORE; |
| 206 | 210 | break; |
| 207 | 211 | } |
| 208 | - if( fossil_strncmp(zArg1, "fx_", 3)==0 ){ | |
| 209 | - break; | |
| 210 | - } | |
| 211 | - for(i=0; i<count(azAllowed); i++){ | |
| 212 | - if( fossil_stricmp(zArg1, azAllowed[i])==0 ) break; | |
| 212 | + while( lwr<upr ){ | |
| 213 | + int i = (lwr+upr)/2; | |
| 214 | + int rc = fossil_stricmp(zArg1, azAllowed[i]); | |
| 215 | + if( rc<0 ){ | |
| 216 | + upr = i - 1; | |
| 217 | + }else if( rc>0 ){ | |
| 218 | + lwr = i + 1; | |
| 219 | + }else{ | |
| 220 | + break; | |
| 221 | + } | |
| 213 | 222 | } |
| 214 | - if( i>=count(azAllowed) ){ | |
| 223 | + if( rc ){ | |
| 215 | 224 | *(char**)pError = mprintf("access to table \"%s\" is restricted",zArg1); |
| 216 | 225 | rc = SQLITE_DENY; |
| 217 | 226 | }else if( !g.perm.RdAddr && strncmp(zArg2, "private_", 8)==0 ){ |
| 218 | 227 | rc = SQLITE_IGNORE; |
| 219 | 228 | } |
| 220 | 229 |
| --- src/report.c | |
| +++ src/report.c | |
| @@ -183,37 +183,46 @@ | |
| 183 | case SQLITE_FUNCTION: { |
| 184 | break; |
| 185 | } |
| 186 | case SQLITE_READ: { |
| 187 | static const char *const azAllowed[] = { |
| 188 | "ticket", |
| 189 | "ticketchng", |
| 190 | "blob", |
| 191 | "filename", |
| 192 | "mlink", |
| 193 | "plink", |
| 194 | "event", |
| 195 | "tag", |
| 196 | "tagxref", |
| 197 | "unversioned", |
| 198 | "backlink", |
| 199 | }; |
| 200 | int i; |
| 201 | if( zArg1==0 ){ |
| 202 | /* Some legacy versions of SQLite will sometimes send spurious |
| 203 | ** READ authorizations that have no table name. These can be |
| 204 | ** ignored. */ |
| 205 | rc = SQLITE_IGNORE; |
| 206 | break; |
| 207 | } |
| 208 | if( fossil_strncmp(zArg1, "fx_", 3)==0 ){ |
| 209 | break; |
| 210 | } |
| 211 | for(i=0; i<count(azAllowed); i++){ |
| 212 | if( fossil_stricmp(zArg1, azAllowed[i])==0 ) break; |
| 213 | } |
| 214 | if( i>=count(azAllowed) ){ |
| 215 | *(char**)pError = mprintf("access to table \"%s\" is restricted",zArg1); |
| 216 | rc = SQLITE_DENY; |
| 217 | }else if( !g.perm.RdAddr && strncmp(zArg2, "private_", 8)==0 ){ |
| 218 | rc = SQLITE_IGNORE; |
| 219 | } |
| 220 |
| --- src/report.c | |
| +++ src/report.c | |
| @@ -183,37 +183,46 @@ | |
| 183 | case SQLITE_FUNCTION: { |
| 184 | break; |
| 185 | } |
| 186 | case SQLITE_READ: { |
| 187 | static const char *const azAllowed[] = { |
| 188 | "backlink", |
| 189 | "blob", |
| 190 | "event", |
| 191 | "filename", |
| 192 | "json_each", |
| 193 | "json_tree", |
| 194 | "mlink", |
| 195 | "plink", |
| 196 | "tag", |
| 197 | "tagxref", |
| 198 | "ticket", |
| 199 | "ticketchng", |
| 200 | "unversioned", |
| 201 | }; |
| 202 | int lwr = 0; |
| 203 | int upr = count(azAllowed) - 1; |
| 204 | int rc = 0; |
| 205 | if( zArg1==0 ){ |
| 206 | /* Some legacy versions of SQLite will sometimes send spurious |
| 207 | ** READ authorizations that have no table name. These can be |
| 208 | ** ignored. */ |
| 209 | rc = SQLITE_IGNORE; |
| 210 | break; |
| 211 | } |
| 212 | while( lwr<upr ){ |
| 213 | int i = (lwr+upr)/2; |
| 214 | int rc = fossil_stricmp(zArg1, azAllowed[i]); |
| 215 | if( rc<0 ){ |
| 216 | upr = i - 1; |
| 217 | }else if( rc>0 ){ |
| 218 | lwr = i + 1; |
| 219 | }else{ |
| 220 | break; |
| 221 | } |
| 222 | } |
| 223 | if( rc ){ |
| 224 | *(char**)pError = mprintf("access to table \"%s\" is restricted",zArg1); |
| 225 | rc = SQLITE_DENY; |
| 226 | }else if( !g.perm.RdAddr && strncmp(zArg2, "private_", 8)==0 ){ |
| 227 | rc = SQLITE_IGNORE; |
| 228 | } |
| 229 |