From: Roland Hieber <devnull@localhost>
Date: Thu, 18 Feb 2010 17:23:42 +0000 (+0100)
Subject: migration to db_user to prevent sql injections
X-Git-Tag: REL_10.02.18~2
X-Git-Url: https://git.rohieb.name/iserv-mod-error-reporter.git/commitdiff_plain/a17a8d5e2641a8d5b6e0a87dcc5d99f56648a295?hp=780f1faa9343bce3ca944f0c16246b269a88b1fd

migration to db_user to prevent sql injections
---

diff --git a/sql/mod_error-reporter.sql b/sql/mod_error-reporter.sql
index 00ebb91..5551a14 100644
--- a/sql/mod_error-reporter.sql
+++ b/sql/mod_error-reporter.sql
@@ -25,6 +25,8 @@
 -- THE SOFTWARE.
 --
 
+CREATE USER errorreporter;
+
 CREATE TABLE mod_errorreporter (
   er_uid          SERIAL                      NOT NULL PRIMARY KEY,
   er_date         TIMESTAMP WITHOUT TIME ZONE NOT NULL,
@@ -40,6 +42,9 @@ CREATE TABLE mod_errorreporter (
   er_hidden       BOOL
 );
 
-GRANT SELECT, INSERT, UPDATE, DELETE ON mod_errorreporter TO webusr, webadm;
-GRANT SELECT, UPDATE ON mod_errorreporter_er_uid_seq TO webusr, webadm;
+GRANT SELECT, INSERT, UPDATE, DELETE ON mod_errorreporter TO errorreporter;
+GRANT SELECT, UPDATE ON mod_errorreporter_er_uid_seq TO errorreporter;
+GRANT SELECT ON users TO errorreporter;
+GRANT SELECT, INSERT ON log_module TO errorreporter;
+GRANT INSERT ON log TO errorreporter;
 
diff --git a/src/config.php b/src/config.php
index 52ba154..dfc09c1 100644
--- a/src/config.php
+++ b/src/config.php
@@ -33,6 +33,8 @@ require_once("ctrl.inc");
 require_once("db.inc");
 require_once("sec/admsecure.inc");
 
+db_user("errorreporter");
+
 html_header("<style type='text/css'>
 td.errors-cfg-field {
   padding: 1em;
diff --git a/src/detail.php b/src/detail.php
index b091f8f..a0af8ac 100644
--- a/src/detail.php
+++ b/src/detail.php
@@ -30,6 +30,8 @@ require_once("mod_error-reporter/init.inc");
 require_once("sec/secure.inc");
 require_once("js.inc");
 
+db_user("errorreporter");
+
 PageBlue(_c("error-reporter:Change an error report"), "mod_error-reporter");
 
 if(!$cfgErrors->userHasAccess()) {
@@ -65,7 +67,6 @@ $er = $doc->getErrorReportByID($getUid);
 $strOldComment = $er->getComment();
 
 // Probably we have to update an error report
-echo "PostSubmit: $postSubmit";
 if($getAction == "update" and $postSubmit == _("Change"))
 {
   if($cfgErrors->userIsAdmin()) {
diff --git a/src/index.php b/src/index.php
index 559fb42..9a9f7d7 100644
--- a/src/index.php
+++ b/src/index.php
@@ -31,6 +31,8 @@
 require_once("mod_error-reporter/init.inc");
 require_once("sec/secure.inc");
 
+db_user("errorreporter");
+
 html_header("<style type='text/css'>
 td.errors-form-description {
   width: 12em;