SQL error when user tries to change password

[svenseeberg]

On Postfixadmin 3.3.7, a user trying to change the mailbox password causes the following error message:

Invalid query: SQLSTATE[42000]: Syntax error or access violation: 1103 Incorrect table name '' caused by UPDATE ``mailbox`` SET  password = :password  WHERE username = :where, referer: https://example.com/postfixadmin/users/password.php

It seems that $this->key_table in

postfixadmin/model/Login.php

Line 113 in 1a9d984

$result = db_update($this->key_table, 'username', $username, $set);

contains the string "`mailbox`", including backticks. I have not yet evaluated where the wrong string comes from. Replacing the parameter value with a literal mailbox string fixes the issue (which is currently my workaround in place).

I can see that the Login.php changed heavily since the 3.3.7 tag, but the line causing the error seems to be the same.

[svenseeberg]

I found the cause: the db_update() function calls the table_by_key() function for the table name. However, in the Login.php the $this->table_key attribute is used as parameter for the db_update() function. And $this->table_key already is the table name that was already modified by the table_by_key() function.

[DavidGoodwin]

thanks for finding the bug @svenseeberg