RE: [PATCH] RE: Messages with php stripslashes

I think the latter.
My previous patch applies also to other engines.
The thing is that octstr_replace does an inline replace. It doesn't return a
new string, like I expected.

== Rene


-----Original Message-----
From: Alejandro Guerrieri [mailto:[email protected]] 
Sent: zaterdag 12 juni 2010 23:21
To: Rene Kluwen
Cc: 'Tomasz'; 'Kannel Devel'
Subject: Re: [PATCH] RE: Messages with php stripslashes

Ok, standing by.

Hmm, not sure about applying the same behavior on the other engines. I mean:
nobody reported the issue on engines other than MySQL. I wonder if that
means that the problem doesn't exist, or if it's just that nobody stumbled
into it so far?

Regards,
--
Alejandro Guerrieri
[email protected]



On 12/06/2010, at 23:16, Rene Kluwen wrote:

> Even though: Looking at the sources: There might be a better option.
> I overlooked something in the function static Octstr
> *get_string_value_or_return_null(Octstr *str).
> It does a octstr_replace where it really had to had the same on a copy on
> that string.
> The copy is destroyed later in  mysql_save_msg. Let me come up with a
better
> patch later, okay?
> 
> This later patch needs to be applied to the following files:
> 
> - sqlbox_mysql.c
> - sqlbox_mssql.c
> - sqlbox_oracle.c
> - sqlbox_pgsql.c
> - sqlbox_sdb.c
> - sqlbox_sqllite.c
> - sqlbox_sqsllite3.c?
> 
> == Rene
> 
> 
> -----Original Message-----
> From: Alejandro Guerrieri [mailto:[email protected]] 
> Sent: zaterdag 12 juni 2010 19:04
> To: Rene Kluwen
> Cc: Tomasz; Kannel Devel
> Subject: Re: [PATCH] RE: Messages with php stripslashes
> 
> Ok, got it :)
> 
> Seems like it's working then. I'll make a couple of tests myself and
commit
> it to SVN then.
> 
> Regards,
> --
> Alejandro Guerrieri
> [email protected]
> 
> 
> 
> On 12/06/2010, at 16:39, Rene Kluwen wrote:
> 
>> msg_duplicate is the normal function from msg.h. No special meaning.
>> 
>> What happens is that gw_sql_save has a side effect. It escapes all text
>> strings with a backslash before the "'" sign because it displays them in
> the
>> INSERT INTO... statement in the database.
>> When I designed the function I was under the impression that it escaped
> the
>> strings in a copy... But apparently it doesn't.
>> 
>> What happens in the "old" version is that gw_sql_save_msg escapes the
>> strings inline and later it does a "send_msg(conn->smsbox_connection,
> conn,
>> msg)" with the same message... which has a backslash in front of the "'".
>> 
>> By duplicating the message before calling the gw_sql_save_msg, this
> behavior
>> is eliminated.
>> 
>> Someone on the mailinglist (Tomasz) has already confirmed that the
problem
>> has been solved with this patch.
>> 
>> == Rene
>> 
>> 
>> 
>> -----Original Message-----
>> From: Alejandro Guerrieri [mailto:[email protected]] 
>> Sent: vrijdag 11 juni 2010 23:52
>> To: Rene Kluwen
>> Cc: 'Tomasz'; 'Kannel list'; [email protected]
>> Subject: Re: [PATCH] RE: Messages with php stripslashes
>> 
>> +       msg_escaped = msg_duplicate(msg);
>>        if (msg->sms.sms_type != report_mo)
>> -            gw_sql_save_msg(msg, octstr_imm("MO"));
>> +            gw_sql_save_msg(msg_escaped, octstr_imm("MO"));
>>        else
>> -            gw_sql_save_msg(msg, octstr_imm("DLR"));
>> +            gw_sql_save_msg(msg_escaped, octstr_imm("DLR"));
>> +       msg_destroy(msg_escaped);
>> 
>> and
>> 
>> -            gw_sql_save_msg(msg, octstr_imm("MT"));
>> +           msg_escaped = msg_duplicate(msg);
>> +            gw_sql_save_msg(msg_escaped, octstr_imm("MT"));
>> +           msg_destroy(msg_escaped);
>> 
>> (and other similar lines)
>> 
>> You're duplicating the msg to msg_escaped and then running the same
>> gw_sql_save_msg function? What difference does it make?
>> 
>> Or maybe msg_duplicate does some escaping magic I'm not aware of? If
>> msg_duplicate does what the name says, I don't see what's changed.
>> 
>> Regards,
>> 
>> Alex
>> --
>> Alejandro Guerrieri
>> [email protected]
>> 
>> 
>> 
>> On 11/06/2010, at 23:25, Rene Kluwen wrote:
>> 
>>> Sorry for crossposting. But I think the users are allowed to know what
is
>>> going on, even if this is a developers matter.
>>> 
>>> I think I found the solution to the problem below, which affects all
>>> smsbox->sqlbox->bearerbox users.
>>> 
>>> I must admit: Haven't tested it yet. But it should work.
>>> 
>>> See attached patch. Votes?
>>> 
>>> 
>>> -----Original Message-----
>>> From: [email protected] [mailto:[email protected]] On
> Behalf
>>> Of Tomasz
>>> Sent: vrijdag 11 juni 2010 15:10
>>> To: Kannel list
>>> Subject: Re: Messages with php stripslashes
>>> 
>>> Hi,
>>> 
>>> I've got the same issue - when we send MT message by CGI which
>>> contains ' sign, the recipient gets \' (escaped '). When we inject MT
>>> directly to MySQL Database, recipient get only ' sing (valid!).
>>> 
>>> Our configuration is:
>>> 
>>> PHP MT PUSH  - SMSBOX - SQLBOX - BEARERBOX - SMSC
>>> 
>>> The problem is caused probably by SQLBOX - somewhere there must be
>>> some kind of addslashes function. Escaped sign is being delivered to
>>> BEARERBOX. I've tried to find this is source code but I was unable.
>>> 
>>> Have someone fixed this problem yet?
>>> 
>>> Thanks
>>> Tomasz
>>> 
>>> W Twoim liście datowanym 24 maja 2010 (02:05:22) można przeczytać:
>>> 
>>>> I have posted some weeks ago a similar issue with sqlbox but it is not
>>>> resolved for the moment, Alejandro to check on his side to reproduce
the
>>>> issue.
>>> 
>>>> Check my post in the mailling list archive to see if it the same
> problem:
>>> 
>>>> Object: *Quote and backslash issue*
>>> 
>>>> As you when using CGI interface to send a SMS I got the quote escaped
on
>>> the
>>>> mobile, BUT when using directly SQL injection on sqlbox it works
>>> correctly.
>>> 
>>>> Regards,
>>> 
>>>> Emmanuel
>>> 
>>> 
>>> 
>>> <sql-escape.patch>
>> 
>> 
>> 
> 
> 
>