-
Notifications
You must be signed in to change notification settings - Fork 172
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Various fixes to the installation wizard #68
Changes from 10 commits
c2b7643
ae074dc
dadca2e
5715e82
4f55f10
3319688
4b33e20
822b89a
0f63335
33705d0
1a44c4b
56cbad6
4806431
e79c65a
6b6c487
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -419,7 +419,8 @@ function create_and_switch_db($db_host, $db_port, $db_login, $db_pwd, $tb_prefix | |
} else { | ||
$msg->addError('UNABLE_CONNECT_DB'); | ||
} | ||
} | ||
return false; | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Any further tests are just going to fail because we don’t have a connection to the SQL server. So instead of presenting a whole bunch of misleading error messages to the user, we should just stop here. |
||
} | ||
|
||
$tb_prefix = $addslashes($tb_prefix); | ||
$db_name = $addslashes($db_name); | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -13,10 +13,11 @@ | |
if (!defined('AT_INSTALLER_INCLUDE_PATH') || !defined('AT_INCLUDE_PATH')) { exit; } | ||
|
||
include(AT_INCLUDE_PATH . 'install/install.inc.php'); | ||
global $addslashes, $stripslashes; | ||
|
||
if(isset($_POST['submit'])) { | ||
//check DB & table connection | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Passwords with U+0027 were escaped with backslashes. Eventually these backslashes make it to mysql_connect(), which causes a failure to connect. |
||
$db = create_and_switch_db($_POST['db_host'], $_POST['db_port'], $_POST['db_login'], $_POST['db_password'], $_POST['tb_prefix'], $_POST['db_name'], true); | ||
$db = create_and_switch_db($_POST['db_host'], $_POST['db_port'], $_POST['db_login'], $stripslashes($_POST['db_password']), $_POST['tb_prefix'], $_POST['db_name'], true); | ||
|
||
if (!isset($errors)) { | ||
|
||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If the password has single quotes (U+0027), the added backslashes would have been taken out by the fix in step2.php (to make mysql_connect() work). Unfortunately this means when the password is written to config.inc.php, they would be unescaped. The result is a config.inc.php with syntax errors.
This was not a problem before step2.php was fixed because in an unpatched system passwords with U+0027 just do not work.