From a17a8d5e2641a8d5b6e0a87dcc5d99f56648a295 Mon Sep 17 00:00:00 2001
From: Roland Hieber <devnull@localhost>
Date: Thu, 18 Feb 2010 18:23:42 +0100
Subject: [PATCH 1/1] migration to db_user to prevent sql injections

---
 sql/mod_error-reporter.sql | 9 +++++++--
 src/config.php             | 2 ++
 src/detail.php             | 3 ++-
 src/index.php              | 2 ++
 4 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/sql/mod_error-reporter.sql b/sql/mod_error-reporter.sql
index 00ebb91..5551a14 100644
--- a/sql/mod_error-reporter.sql
+++ b/sql/mod_error-reporter.sql
@@ -25,6 +25,8 @@
 -- THE SOFTWARE.
 --
 
+CREATE USER errorreporter;
+
 CREATE TABLE mod_errorreporter (
   er_uid          SERIAL                      NOT NULL PRIMARY KEY,
   er_date         TIMESTAMP WITHOUT TIME ZONE NOT NULL,
@@ -40,6 +42,9 @@ CREATE TABLE mod_errorreporter (
   er_hidden       BOOL
 );
 
-GRANT SELECT, INSERT, UPDATE, DELETE ON mod_errorreporter TO webusr, webadm;
-GRANT SELECT, UPDATE ON mod_errorreporter_er_uid_seq TO webusr, webadm;
+GRANT SELECT, INSERT, UPDATE, DELETE ON mod_errorreporter TO errorreporter;
+GRANT SELECT, UPDATE ON mod_errorreporter_er_uid_seq TO errorreporter;
+GRANT SELECT ON users TO errorreporter;
+GRANT SELECT, INSERT ON log_module TO errorreporter;
+GRANT INSERT ON log TO errorreporter;
 
diff --git a/src/config.php b/src/config.php
index 52ba154..dfc09c1 100644
--- a/src/config.php
+++ b/src/config.php
@@ -33,6 +33,8 @@ require_once("ctrl.inc");
 require_once("db.inc");
 require_once("sec/admsecure.inc");
 
+db_user("errorreporter");
+
 html_header("<style type='text/css'>
 td.errors-cfg-field {
   padding: 1em;
diff --git a/src/detail.php b/src/detail.php
index b091f8f..a0af8ac 100644
--- a/src/detail.php
+++ b/src/detail.php
@@ -30,6 +30,8 @@ require_once("mod_error-reporter/init.inc");
 require_once("sec/secure.inc");
 require_once("js.inc");
 
+db_user("errorreporter");
+
 PageBlue(_c("error-reporter:Change an error report"), "mod_error-reporter");
 
 if(!$cfgErrors->userHasAccess()) {
@@ -65,7 +67,6 @@ $er = $doc->getErrorReportByID($getUid);
 $strOldComment = $er->getComment();
 
 // Probably we have to update an error report
-echo "PostSubmit: $postSubmit";
 if($getAction == "update" and $postSubmit == _("Change"))
 {
   if($cfgErrors->userIsAdmin()) {
diff --git a/src/index.php b/src/index.php
index 559fb42..9a9f7d7 100644
--- a/src/index.php
+++ b/src/index.php
@@ -31,6 +31,8 @@
 require_once("mod_error-reporter/init.inc");
 require_once("sec/secure.inc");
 
+db_user("errorreporter");
+
 html_header("<style type='text/css'>
 td.errors-form-description {
   width: 12em;
-- 
2.20.1