Projects/mysql-admutils
13
0
Fork 0
Code Issues Pull Requests Activity

- Safely escape user input with mysql_real_escape_string

Browse Source 
- fixed some memory leaks
This commit is contained in:
Geir Hauge
2012-12-03 12:20:20 +00:00
parent 59e7d4782e
commit dc6b93166b
4 changed files with 79 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files

114
mysql-useradm.c
View File

@@ -37,32 +37,50 @@ usage()
int
is_password_set(MYSQL *pmysql, const char *user)
{
char query[1024];
char query[1024], *end;
MYSQL_RES *res;
int rows;
MYSQL_ROW row;
int check = 0;
end = strmov(query, "SELECT password FROM user WHERE user='");
end += mysql_real_escape_string(pmysql, end, user, strlen(user));
*end++ = '\'';
*end = '\0';
sprintf(query, "select password from user where user = '%s'", user);
if (mysql_query(pmysql, query))
dberror(pmysql, "Failed to look up password for user '%s'.", user);
res = mysql_store_result(pmysql);
rows = mysql_num_rows(res);
if (rows == 0)
return -1;
if (rows > 1)
{
mysql_free_result(res);
return dberror(NULL, "Query for password for user '%s' gave %d results!",
user, rows);
}
else if (rows < 1) {
mysql_free_result(res);
return -1;
}
row = mysql_fetch_row(res);
return (row[0] && (strlen(row[0]) > 0));
check = (row[0] && (strlen(row[0]) > 0));
mysql_free_result(res);
return check;
}
int
create(MYSQL *pmysql, const char *user)
{
char query[1024];
char query[1024], *end;
end = strmov(query, "INSERT INTO user (host, user) VALUES ('%', '");
end += mysql_real_escape_string(pmysql, end, user, strlen(user));
end = strmov(end, "')");
sprintf(query, "insert into user (host, user) values ('%%', '%s')", user);
if (mysql_query(pmysql, query))
return dberror(pmysql, "Failed to create user '%s'.", user);
@@ -73,9 +91,13 @@ create(MYSQL *pmysql, const char *user)
int
delete(MYSQL *pmysql, const char *user)
{
char query[1024];
char query[1024], *end;
end = strmov(query, "DELETE FROM user WHERE user='");
end += mysql_real_escape_string(pmysql, end, user, strlen(user));
*end++ = '\'';
*end = '\0';
sprintf(query, "delete from user where user = '%s'", user);
if (mysql_query(pmysql, query))
return dberror(pmysql, "Failed to delete user '%s'.", user);
@@ -87,40 +109,13 @@ int
passwd(MYSQL *pmysql, const char *user)
{
char prompt[1024];
char query[1024];
char query[1024], *end;
char *password, *confirm_password;
MYSQL_RES *res;
int rows;
MYSQL_ROW row;
/*
if (is_password_set(pmysql, user))
{
sprintf(prompt, "(current) MySQL password for user '%s': ", user);
password = getpass(prompt);
sprintf(query, "select password = password('%s') from user "
"where user = '%s'", password, user);
if (mysql_query(pmysql, query))
return dberror(pmysql, "Failed to check old password for user '%s'.",
user);
res = mysql_store_result(pmysql);
rows = mysql_num_rows(res);
if (rows == 0)
return dberror(NULL, "Check for old password for user '%s' "
"returned empty.", user);
if (rows > 1)
return dberror(NULL, "Check for old password for user '%s' "
"returned more than one row!", user);
row = mysql_fetch_row(res);
if (strcmp(row[0], "1") != 0)
{
fprintf(stderr, "%s: Wrong password entered for user '%s'.\n",
program_name, user);
return 1;
}
}
*/
if (is_password_set(pmysql, user) == -1) /* no such mysql user */
return dberror(NULL, "User '%s' does not exist."
" You must create it first.\n", user);
sprintf(prompt, "New MySQL password for user '%s': ", user);
password = getpass(prompt);
confirm_password = strdup(password);
@@ -133,11 +128,16 @@ passwd(MYSQL *pmysql, const char *user)
}
free(confirm_password);
sprintf(query, "update user set password = password('%s') "
"where user = '%s'", password, user);
end = strmov(query, "UPDATE user SET password = PASSWORD('");
end += mysql_real_escape_string(pmysql, end, password, strlen(password));
end = strmov(end, "') WHERE user='");
end += mysql_real_escape_string(pmysql, end, user, strlen(user));
*end++ = '\'';
*end = '\0';
if (mysql_query(pmysql, query))
return dberror(pmysql, "Failed to set new password for user '%s'.", user);
if (mysql_affected_rows(pmysql) > 1)
if (mysql_affected_rows(pmysql) != 1)
dberror(NULL, "%d rows affected by password update for user '%s'!",
mysql_affected_rows(pmysql), user);
@@ -170,7 +170,7 @@ show(MYSQL *pmysql, const char *user)
char **
list(MYSQL *pmysql)
{
char query[4096];
char query[4096], *end;
char **usrgroups, **cp;
MYSQL_RES *res;
int rows, numgroups;
@@ -180,18 +180,27 @@ list(MYSQL *pmysql)
struct passwd *p;
p = getpwuid(getuid());
sprintf(query, "select user from user where user='%s' or user like '%s\\_%%'",
p->pw_name, p->pw_name);
// sprintf(query, "select user from user where user='myhr' or user like 'myhr\\_%%'");
end = strmov(query, "SELECT user FROM user WHERE user='");
end += mysql_real_escape_string(pmysql, end, p->pw_name, strlen(p->pw_name));
end = strmov(end, "' OR user LIKE '");
end += mysql_real_escape_string(pmysql, end, p->pw_name, strlen(p->pw_name));
end = strmov(end, "\\_%'");
numgroups = 0;
usrgroups = get_group_names(&numgroups);
cp = usrgroups;
while (*cp) {
sprintf(&query[strlen(query)], " or user='%s' or user like '%s\\_%%'", *cp, *cp);
end = strmov(end, " OR user='");
end += mysql_real_escape_string(pmysql, end, *cp, strlen(*cp));
end = strmov(end, "' OR user LIKE '");
end += mysql_real_escape_string(pmysql, end, *cp, strlen(*cp));
end = strmov(end, "\\_%'");
free(*cp);
cp++;
}
free(usrgroups);
#ifdef DEBUG
printf("about to run query: %s\n", query);
@@ -218,6 +227,8 @@ list(MYSQL *pmysql)
userlist[i] = NULL;
mysql_free_result(res);
return userlist;
}
@@ -229,7 +240,7 @@ main(int argc, char *argv[])
MYSQL mysql;
mysql_init(&mysql);
char **dblist, **p;
char *user;
char user[65];
program_name = argv[0];
@@ -262,7 +273,7 @@ main(int argc, char *argv[])
else
return wrong_use("unrecognized command '%s'.", argv[1]); /* XXX */
/* all other than show requires at lease one USER argument. */
/* all other than show requires at least one USER argument. */
if ((command != c_show) && (argc < 3))
return wrong_use(NULL);
@@ -288,7 +299,6 @@ main(int argc, char *argv[])
free(dblist);
}
else {
user = malloc(64);
/* for each supplied database name, perform the requested action */
for (i = 2; i < argc; i++) {