Bug#556507: does not escape database name

2014-10-13 Thread Michal Čihař
Hi Dne Fri, 10 Oct 2014 12:27:42 +0200 Paul Gevers elb...@debian.org napsal(a): I am trying to fix some issues with dbconfig-common before the freeze... (Hope I can get it to work). On Mon, 16 Nov 2009 14:36:38 +0100 Michal Čihař ni...@debian.org wrote: it looks like dbconfig-common does

Bug#556507: does not escape database name

2014-10-13 Thread Paul Gevers
On 13-10-14 15:04, Michal Čihař wrote: It's rather there are missing quotes around database name in dbc_mysql_createdb. You are talking about this line? _dbc_nodb=yes dbc_mysql_exec_command CREATE DATABASE $dbc_dbname${extrasql:-} Should it be the following: _dbc_nodb=yes

Bug#556507: does not escape database name

2014-10-13 Thread Michal Čihař
Hi Dne Mon, 13 Oct 2014 20:23:28 +0200 Paul Gevers elb...@debian.org napsal(a): On 13-10-14 15:04, Michal Čihař wrote: It's rather there are missing quotes around database name in dbc_mysql_createdb. You are talking about this line? _dbc_nodb=yes dbc_mysql_exec_command CREATE DATABASE

Bug#556507: does not escape database name

2014-10-13 Thread Paul Gevers
On 13-10-14 20:28, Michal Čihař wrote: You are talking about this line? _dbc_nodb=yes dbc_mysql_exec_command CREATE DATABASE $dbc_dbname${extrasql:-} Should it be the following: _dbc_nodb=yes dbc_mysql_exec_command CREATE DATABASE `$dbc_dbname${extrasql:-}` I don't know what extrasql is,

Bug#556507: does not escape database name

2014-10-13 Thread Paul Gevers
Control: tags -1 pending Control: owner -1 ! On 13-10-14 20:28, Michal Čihař wrote: I don't know what extrasql is, but to me it sounds more like it should be: _dbc_nodb=yes dbc_mysql_exec_command CREATE DATABASE `$dbc_dbname`${extrasql:-} And of course you need to test this, as in the file

Bug#556507: does not escape database name

2014-10-10 Thread Paul Gevers
Hi Michal, I am trying to fix some issues with dbconfig-common before the freeze... (Hope I can get it to work). On Mon, 16 Nov 2009 14:36:38 +0100 Michal Čihař ni...@debian.org wrote: it looks like dbconfig-common does not escape database name. When user enters something like foo-bar as

Bug#556507: does not escape database name

2009-11-16 Thread Michal Čihař
Package: dbconfig-common Version: 1.8.41 Severity: normal -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi it looks like dbconfig-common does not escape database name. When user enters something like foo-bar as database name, it is passed to MySQL without escaping and it fails: mysql said: