Re: Query bugs when not logged in - PostgreSQL

On Nov 27, 2003, at 12:26, Russell Valentine wrote:

> In functions.inc.php in d_DrawQueryForm or anywhere, where there is a 
> statement like this:
>
> SELECT * FROM users WHERE (uid != '$uid') AND (deleted = '0');
>
> If I'm not logged in $uid is a blank string you get a error in 
> PostgreSQL.
> pg_atoi: zero-length string
>
> You can see this by not being logged in and going to 'Query Bug'
>
> basicly postgresql doesn't like a blank string to compare to. 
> Something like this works
>
> WHERE (uid is not null) AND (deleted = '0');
>
> or
>
> WHERE (deleted = '0');
>
> I think there should be a way to account for it if $uid = NULL and use
> binding variables with PEAR, but I'd have to look it up. I know it is
> possible in JDBC with Java, I would think it is there in PEAR.
>
> I don't know of a easy fix at the moment, unless Mysql has simular 
> syntax
> or you just check if user is logged in or not and could even take out 
> the
> (uid != ) thing if not logged in. I'll install MySQL to try to make a
> compatible statement, having MySQL will also help if I find something 
> in
> the future.

Ok... there is going to be a lot of these things.  I fixed it by doing 
this:

--- functions.inc.php.bk        Thu Nov 27 12:39:51 2003
+++ functions.inc.php   Thu Nov 27 12:41:53 2003
@@ -1604,6 +1604,11 @@
  function d_doQuery($uid, $type)
  {
      global $PHP_SELF;
+
+    if (empty($uid))
+    {
+        $uid = 0;
+    }
      if ($type == "a")
      {
          print("<p>" . gettext("Advanced bug searching and reporting 
capabilities query.") . "</p>");

But that's not going to work 100%...  I just saw the same error when 
trying to do a "find all my bugs" from the query page.

I think what I'll do is set $_USER['uid'] to 0 when I pull the user's 
info to begin with (site.inc.php I think)... then I don't need to do 
any workarounds and it should work everywhere.  (I hope).

---
MandrakeSoft Security; http://www.mandrakesecure.net/
Online Security Resource Book; http://linsec.ca/
"lynx -source http://linsec.ca/vdanen.asc | gpg --import"
{FE6F2AFD : 88D8 0D23 8D4B 3407 5BD7  66F9 2043 D0E5 FE6F 2AFD}

_______________________________________________
Anthill-workers mailing list
Anthill-workers-+mQDA36h6dWw5LPnMra/[email protected]
http://vmlinuz.ca/mailman/listinfo/anthill-workers