Author: miguel
Date: 2006-07-22 23:47:46 -0400 (Sat, 22 Jul 2006)
New Revision: 62898
Modified:
trunk/monodoc/engine/server.cs
Log:
Apply patch from Pablo Ordu?\195?\177a 2006-07-23 Pablo Orduna <[EMAIL
PROTECTED]>
* server.cs: Fix various uses of sql injection in the server code,
this code has already been deployed in the server.
Modified: trunk/monodoc/engine/server.cs
===================================================================
--- trunk/monodoc/engine/server.cs 2006-07-22 15:07:06 UTC (rev 62897)
+++ trunk/monodoc/engine/server.cs 2006-07-23 03:47:46 UTC (rev 62898)
@@ -19,13 +19,15 @@
[WebServiceAttribute (Description="Web service for the MonoDoc
contribution system")]
public class Contributions : System.Web.Services.WebService
{
- const string basedir = "/home/miguel/contributions/";
+ const string basedir = "/home/contributions/";
//const string basedir = "/tmp/contributions/";
private IDbConnection GetConnection()
{
- return new
MySqlConnection("Server=erandi.boston.ximian.com; database=monodoc;user
id=admin; Password=clave;");
+ return new
MySqlConnection("Server=erandi.boston.ximian.com; database=monodoc;user
id=admin; Password=clave;");
+
+
// return new MySqlConnection("Server=localhost;
database=test; user id=gonz; password=");
}
@@ -79,7 +81,8 @@
try
{
IDbCommand cmd = conn.CreateCommand();
- cmd.CommandText = String.Format ("select
password from person where name='{0}'", login);
+ cmd.CommandText = "select password from person
where [EMAIL PROTECTED]";
+ cmd.Parameters.Add( CreateParameter("@login",
login));
IDataReader reader = cmd.ExecuteReader ();
if (reader.Read ()){
@@ -91,16 +94,17 @@
reader.Close ();
Random rnd = new Random ();
int pass = rnd.Next ();
- string values = String.Format ("('{0}', '{1}',
0)", login, pass);
cmd.CommandText = "INSERT INTO person (name,
password, last_serial) VALUES " +
- values;
+ "(@name, @password, 0)";
+ cmd.Parameters.Add(
CreateParameter("@name",login));
+ cmd.Parameters.Add(
CreateParameter("@password",pass));
- object o = cmd.ExecuteNonQuery ();
+ cmd.ExecuteNonQuery ();
mail (login, pass.ToString ());
return 0;
} catch (Exception e) {
- Console.WriteLine (e);
+ Console.Error.WriteLine (e);
} finally {
conn.Close ();
}
@@ -115,16 +119,18 @@
try
{
IDbCommand cmd = conn.CreateCommand();
- cmd.CommandText =
- String.Format ("select last_serial
from person where name='{0}' and password='{1}'", login, password);
+ cmd.CommandText = "select last_serial from
person where [EMAIL PROTECTED] and [EMAIL PROTECTED]";
+ cmd.Parameters.Add( CreateParameter("@login",
login));
+ cmd.Parameters.Add(
CreateParameter("@password", password));
+
object r = cmd.ExecuteScalar();
if (r != null){
- Console.WriteLine (r);
+ Console.Error.WriteLine (r);
return (int) r;
}
return -1;
} catch (Exception e){
- Console.WriteLine ("Exception" + e);
+ Console.Error.WriteLine ("Exception" + e);
} finally {
conn.Close();
}
@@ -141,8 +147,10 @@
conn.Open();
try {
IDbCommand cmd = conn.CreateCommand();
- cmd.CommandText =
- String.Format ("select * from person
where name='{0}' and password='{1}'", login, password);
+ cmd.CommandText = "select * from person where
[EMAIL PROTECTED] and [EMAIL PROTECTED]";
+ cmd.Parameters.Add( CreateParameter("@login",
login));
+ cmd.Parameters.Add(
CreateParameter("@password", password));
+
IDataReader reader = cmd.ExecuteReader ();
int ret_val = -1;
@@ -177,23 +185,23 @@
cmd.ExecuteNonQuery ();
- cmd.CommandText = String.Format
(
- "INSERT INTO status
(person_id, serial, status) VALUES ('{0}', '{1}', 0)",
- id, serial);
+ cmd.CommandText = "INSERT INTO
status (person_id, serial, status) VALUES (@id, @serial, 0)";
+ cmd.Parameters.Add(
CreateParameter("@id",id));
+ cmd.Parameters.Add(
CreateParameter("@serial",serial));
cmd.ExecuteNonQuery ();
txn.Commit();
} catch (Exception e) {
- Console.WriteLine ("E: " + e);
+ Console.Error.WriteLine ("E: "
+ e);
}
ret_val = serial+1;
return ret_val;
}
- Console.WriteLine (4);
+ Console.Error.WriteLine ("Error, going: 4");
return -4;
} catch (Exception e) {
- Console.WriteLine ("Failure in Submit: " + e);
+ Console.Error.WriteLine ("Failure in Submit: "
+ e);
return -3;
} finally {
conn.Close ();
@@ -203,8 +211,10 @@
bool IsAdmin (IDbConnection conn, string login, string password)
{
IDbCommand cmd = conn.CreateCommand();
- cmd.CommandText =
- String.Format ("select person_id,is_admin from
person where name='{0}' and password='{1}'", login, password);
+ cmd.CommandText = "select person_id,is_admin from
person where [EMAIL PROTECTED] and [EMAIL PROTECTED]";
+ cmd.Parameters.Add( CreateParameter("@name",login));
+ cmd.Parameters.Add( CreateParameter("@pass",password));
+
int person_id = -1;
bool is_admin = false;
using (IDataReader reader = cmd.ExecuteReader ()){
@@ -244,7 +254,7 @@
results.CopyTo (ret);
return ret;
} catch (Exception e){
- Console.WriteLine (e);
+ Console.Error.WriteLine (e);
return null;
} finally {
conn.Close ();
@@ -276,8 +286,10 @@
conn.Open ();
try {
IDbCommand cmd = conn.CreateCommand();
- cmd.CommandText =
- String.Format ("select * from person
where name='{0}' and password='{1}'", login, password);
+ cmd.CommandText = "select * from person where
[EMAIL PROTECTED] and [EMAIL PROTECTED]";
+ cmd.Parameters.Add(
CreateParameter("@name",login));
+ cmd.Parameters.Add(
CreateParameter("@pass",password));
+
IDataReader reader = cmd.ExecuteReader ();
int id = -1;
_______________________________________________
Mono-patches maillist - [email protected]
http://lists.ximian.com/mailman/listinfo/mono-patches
