Re: Query bugs when not logged in - PostgreSQL

On Nov 27, 2003, at 12:44, Vincent Danen wrote:

>> I don't know of a easy fix at the moment, unless Mysql has simular 
>> syntax
>> or you just check if user is logged in or not and could even take out 
>> the
>> (uid != ) thing if not logged in. I'll install MySQL to try to make a
>> compatible statement, having MySQL will also help if I find something 
>> in
>> the future.
>
> Ok... there is going to be a lot of these things.  I fixed it by doing 
> this:
>
> --- functions.inc.php.bk        Thu Nov 27 12:39:51 2003
> +++ functions.inc.php   Thu Nov 27 12:41:53 2003
> @@ -1604,6 +1604,11 @@
>  function d_doQuery($uid, $type)
>  {
>      global $PHP_SELF;
> +
> +    if (empty($uid))
> +    {
> +        $uid = 0;
> +    }
>      if ($type == "a")
>      {
>          print("<p>" . gettext("Advanced bug searching and reporting 
> capabilities query.") . "</p>");
>
> But that's not going to work 100%...  I just saw the same error when 
> trying to do a "find all my bugs" from the query page.
>
> I think what I'll do is set $_USER['uid'] to 0 when I pull the user's 
> info to begin with (site.inc.php I think)... then I don't need to do 
> any workarounds and it should work everywhere.  (I hope).

No... this won't work.  $_USER has to be NULL otherwise a lot of other 
stuff breaks.  Ok, I also fixed this in buglist.php with this patch:

--- buglist.php~        Thu Nov 27 12:48:55 2003
+++ buglist.php Thu Nov 27 12:48:55 2003
@@ -27,7 +27,7 @@
  if (isset($_REQUEST['sort']))     { $sort     = $_REQUEST['sort']; }   
   else { $sort     = "bid"; }
  if (isset($_REQUEST['order']))    { $order    = $_REQUEST['order']; }  
   else { $order    = "ASC"; }
  if (isset($_REQUEST['sdate']))    { $sdate    = $_REQUEST['sdate']; }  
   else { $sdate    = NULL; }
-if (isset($_USER['uid']))         { $uid      = $_USER['uid']; }       
   else { $uid      = NULL; }
+if (isset($_USER['uid']))         { $uid      = $_USER['uid']; }       
   else { $uid      = 0; }
  $msg = NULL;

  if (isset($type) || isset($search))

Please let me know if you encounter more of these.  I'll do some 
looking to see if I spot more.

Gonna commit everything to CVS so you're not sitting there applying 
patch after patch... =)

---
MandrakeSoft Security; http://www.mandrakesecure.net/
Online Security Resource Book; http://linsec.ca/
"lynx -source http://linsec.ca/vdanen.asc | gpg --import"
{FE6F2AFD : 88D8 0D23 8D4B 3407 5BD7  66F9 2043 D0E5 FE6F 2AFD}

_______________________________________________
Anthill-workers mailing list
Anthill-workers-+mQDA36h6dWw5LPnMra/[email protected]
http://vmlinuz.ca/mailman/listinfo/anthill-workers