Re: Is Maia Really functional

Common subdirectories: /usr/local/www/maia/admin and /var/www/metricspace.net/maia/admin
diff -u /usr/local/www/maia/adminusers.php /var/www/metricspace.net/maia/adminusers.php
--- /usr/local/www/maia/adminusers.php	2018-12-02 21:22:23.000000000 +0000
+++ /var/www/metricspace.net/maia/adminusers.php	2020-12-04 23:04:05.016481000 +0000
@@ -132,7 +132,7 @@
 
             // List only the e-mail addresses within the
             // domains administered by this admin.
-            $select = "SELECT users.email, users.id " .
+            $select = "SELECT encode(users.email, 'escape') AS email, users.id " .
                       "FROM users, maia_users " .
                       "WHERE users.email LIKE '%_" . $dname . "' " .
                       "AND users.maia_user_id = maia_users.id " .
@@ -182,7 +182,7 @@
     } else {
 
     	// The superadmin can list all e-mail addresses in all domains.
-        $select = "SELECT email, id " .
+        $select = "SELECT encode(email, 'escape') AS email, id " .
                   "FROM users " .
                   "WHERE email NOT LIKE '@%' " .
                   "ORDER BY email ASC";
@@ -232,7 +232,7 @@
 
             // List only the e-mail addresses within the
             // domains administered by this admin.
-            $select = "SELECT users.email, users.id " .
+            $select = "SELECT encode(users.email, 'escape') AS email, users.id " .
                       "FROM users, maia_users " .
                       "WHERE users.email LIKE '%_" . $dname . "' " .
                       "AND users.maia_user_id = maia_users.id " .
@@ -252,7 +252,7 @@
     } else {
 
     	// The superadmin can list all e-mail addresses in all domains.
-        $select = "SELECT email, id " .
+        $select = "SELECT encode(email, 'escape') AS email, id " .
                   "FROM users " .
                   "WHERE email NOT LIKE '@%' " .
                   "ORDER BY email ASC";
diff -u /usr/local/www/maia/cache.php /var/www/metricspace.net/maia/cache.php
--- /usr/local/www/maia/cache.php	2018-12-02 21:22:23.000000000 +0000
+++ /var/www/metricspace.net/maia/cache.php	2020-12-04 23:08:14.049653000 +0000
@@ -247,7 +247,7 @@
            $this->select_stmt .= "date_trunc('second', maia_mail.received_date + INTERVAL '" . $_SESSION["clock_offset"] . " SECOND') AS received_date, ";
 
         }
-        $this->select_stmt .= "maia_mail.score, maia_mail.sender_email, maia_mail.subject, maia_mail.envelope_to " .
+        $this->select_stmt .= "maia_mail.score, encode(maia_mail.sender_email, 'escape') AS sender_email, maia_mail.subject, encode(maia_mail.envelope_to, 'escape') AS envelope_to " .
                               "FROM maia_mail_recipients " .
                               "LEFT JOIN maia_mail " .
                               "ON maia_mail.id = maia_mail_recipients.mail_id " .
@@ -464,7 +464,7 @@
 
         if ($numRows['cnt'] > 0)
         {
-            $sth2 = $this->dbh->prepare("SELECT email FROM users WHERE maia_user_id = ?");
+            $sth2 = $this->dbh->prepare("SELECT encode(email, 'escape') AS email FROM users WHERE maia_user_id = ?");
             $res2 = $sth2->execute(array($euid));
             if (PEAR::isError($sth2)) {
                 die($sth2->getMessage());
Common subdirectories: /usr/local/www/maia/images and /var/www/metricspace.net/maia/images
Common subdirectories: /usr/local/www/maia/libs and /var/www/metricspace.net/maia/libs
Common subdirectories: /usr/local/www/maia/locale and /var/www/metricspace.net/maia/locale
Common subdirectories: /usr/local/www/maia/maia_db and /var/www/metricspace.net/maia/maia_db
Common subdirectories: /usr/local/www/maia/overlib and /var/www/metricspace.net/maia/overlib
diff -u /usr/local/www/maia/rescue.php /var/www/metricspace.net/maia/rescue.php
--- /usr/local/www/maia/rescue.php	2018-12-02 21:22:23.000000000 +0000
+++ /var/www/metricspace.net/maia/rescue.php	2020-12-04 23:13:34.055682000 +0000
@@ -117,7 +117,7 @@
     switch($type) {
       case "ham":  //Ok, this isn't really "releasing", but the logic is the same.
         $reported = 0;
-        $select = "SELECT maia_mail.id, maia_mail.sender_email " .
+        $select = "SELECT maia_mail.id, encode(maia_mail.sender_email, 'escape') as sender_email " .
                   "FROM maia_mail, maia_mail_recipients " .
                   "WHERE maia_mail.id = maia_mail_recipients.mail_id " .
                   "AND maia_mail_recipients.type = 'H' " .
@@ -151,7 +151,7 @@
         break;
       case "spam":
     	$rescued = 0;
-        $select = "SELECT maia_mail.id, maia_mail.sender_email " .
+        $select = "SELECT maia_mail.id, encode(maia_mail.sender_email, 'escape') AS sender_email " .
                   "FROM maia_mail, maia_mail_recipients " .
                   "WHERE maia_mail.id = maia_mail_recipients.mail_id " .
                   "AND maia_mail_recipients.type IN ('S','P') " .
@@ -185,7 +185,7 @@
         break;
      case "virus":
     	$rescued = 0;
-        $select = "SELECT maia_mail.id, maia_mail.sender_email " .
+        $select = "SELECT maia_mail.id, encode(maia_mail.sender_email, 'escape') AS sender_email " .
                   "FROM maia_mail, maia_mail_recipients " .
                   "WHERE maia_mail.id = maia_mail_recipients.mail_id " .
                   "AND maia_mail_recipients.type = 'V' " .
@@ -219,7 +219,7 @@
 
      case "attachment":
     	$rescued = 0;
-        $select = "SELECT maia_mail.id, maia_mail.sender_email " .
+        $select = "SELECT maia_mail.id, encode(maia_mail.sender_email, 'escape') AS sender_email " .
                   "FROM maia_mail, maia_mail_recipients " .
                   "WHERE maia_mail.id = maia_mail_recipients.mail_id " .
                   "AND maia_mail_recipients.type = 'F' " .
@@ -252,7 +252,7 @@
         break;
      case "header":
     	$rescued = 0;
-        $select = "SELECT maia_mail.id, maia_mail.sender_email " .
+        $select = "SELECT maia_mail.id, encode(maia_mail.sender_email, 'escape') AS sender_email " .
                   "FROM maia_mail, maia_mail_recipients " .
                   "WHERE maia_mail.id = maia_mail_recipients.mail_id " .
                   "AND maia_mail_recipients.type = 'B' " .
diff -u /usr/local/www/maia/settings.php /var/www/metricspace.net/maia/settings.php
--- /usr/local/www/maia/settings.php	2018-12-02 21:22:23.000000000 +0000
+++ /var/www/metricspace.net/maia/settings.php	2020-12-04 23:22:13.638663000 +0000
@@ -172,7 +172,7 @@
         $smarty->assign('address', get_email_address_by_id($primary_email_id));
 
         // get the rest of the addresses
-        $sth = $dbh->prepare("SELECT id, email FROM users WHERE maia_user_id = ? AND email NOT LIKE '@%' AND id <> ?");
+        $sth = $dbh->prepare("SELECT id, encode(email, 'escape') AS email FROM users WHERE maia_user_id = ? AND email NOT LIKE '@%' AND id <> ?");
         $res = $sth->execute(array($euid, $primary_email_id));
         $user_addr = array();
         while ($row = $res->fetchRow()) {
@@ -386,7 +386,7 @@
                          "spam_tag_level, " .
                          "spam_tag2_level, " .
                          "spam_kill_level, " .
-                         "email, " .
+                         "encode(email, 'escape') as email, " .
                          "policy_id " .
                   "FROM users, policy " .
                   "WHERE users.policy_id = policy.id " .
Common subdirectories: /usr/local/www/maia/themes and /var/www/metricspace.net/maia/themes
diff -u /usr/local/www/maia/view.php /var/www/metricspace.net/maia/view.php
--- /usr/local/www/maia/view.php	2018-12-02 21:22:23.000000000 +0000
+++ /var/www/metricspace.net/maia/view.php	2020-12-04 22:17:24.959877000 +0000
@@ -191,7 +191,8 @@
    //    7bit
    //
 
-   $sth = $dbh->prepare("SELECT maia_mail.contents, maia_mail.sender_email " .
+   $sth = $dbh->prepare("SELECT encode(maia_mail.contents, 'escape') AS contents,
+                                encode(maia_mail.sender_email, 'escape') AS sender_email " .
              "FROM maia_mail, maia_mail_recipients " .
              "WHERE maia_mail.id = maia_mail_recipients.mail_id " .
              "AND maia_mail.id = ? " .
diff -u /usr/local/www/maia/wblist.php /var/www/metricspace.net/maia/wblist.php
--- /usr/local/www/maia/wblist.php	2018-12-02 21:22:23.000000000 +0000
+++ /var/www/metricspace.net/maia/wblist.php	2020-12-04 23:01:33.078587000 +0000
@@ -162,7 +162,7 @@
     exit;
 
 function get_user_wb_rows($dbh, $user_id) {
-    $sth = $dbh->prepare("SELECT mailaddr.email, mailaddr.id, wblist.wb " .
+    $sth = $dbh->prepare("SELECT encode(mailaddr.email, 'escape') AS email, mailaddr.id, wblist.wb " .
               "FROM mailaddr, wblist " .
               "WHERE mailaddr.id = wblist.sid " .
               "AND wblist.rid = ? " .
@@ -192,22 +192,22 @@
   global $logger;
   if (substr(get_database_type($dbh),0,5) == "mysql") {
     $query =<<<EOQ
-      SELECT mailaddr.email, wb, user_name
+      SELECT encode(mailaddr.email, 'escape') AS email, wb, user_name
         FROM mailaddr LEFT JOIN wblist ON mailaddr.id = wblist.sid
              LEFT JOIN maia_users ON wblist.rid=maia_users.id
         WHERE maia_users.user_name
-          IN (SELECT DISTINCT substring(email,locate('@',email))
+          IN (SELECT DISTINCT substring(encode(email,'escape'),locate('@',encode(email,'escape')))
                  FROM maia_users left join users on users.maia_user_id = maia_users.id
                      WHERE maia_users.id=?)
         ORDER BY mailaddr.email ASC
 EOQ;
   } else {
     $query =<<<EOQ
-      SELECT mailaddr.email, wb, user_name
+      SELECT encode(mailaddr.email, 'escape') AS email, wb, user_name
         FROM mailaddr LEFT JOIN wblist ON mailaddr.id = wblist.sid
              LEFT JOIN maia_users ON wblist.rid=maia_users.id
         WHERE maia_users.user_name
-          IN (SELECT DISTINCT substr(email,strpos(email,'@'))
+          IN (SELECT DISTINCT substr(encode(email,'escape'),strpos(encode(email,'escape'),'@'))
                  FROM maia_users left join users on users.maia_user_id = maia_users.id
                      WHERE maia_users.id=?)
         ORDER BY mailaddr.email ASC
Common subdirectories: /usr/local/www/maia/web and /var/www/metricspace.net/maia/web
diff -u /usr/local/www/maia/xsettings.php /var/www/metricspace.net/maia/xsettings.php
--- /usr/local/www/maia/xsettings.php	2018-12-02 21:22:23.000000000 +0000
+++ /var/www/metricspace.net/maia/xsettings.php	2020-12-04 23:15:10.705760000 +0000
@@ -150,7 +150,7 @@
             exit;
         }
 
-        $sth = $dbh->prepare("SELECT policy_id, email, maia_user_id FROM users
+        $sth = $dbh->prepare("SELECT policy_id, encode(email, 'escape') AS email, maia_user_id FROM users
                    WHERE users.maia_user_id = ? AND users.id = ?");
         $res = $sth->execute(array($euid, $address_id));
         if (PEAR::isError($sth)) {
@@ -631,7 +631,7 @@
      */
     } elseif (isset($_POST["user_id"])) {
         $user_id = trim($_POST["user_id"]);
-        $sth = $dbh->prepare("SELECT users.id, users.email " .
+        $sth = $dbh->prepare("SELECT users.id, encode(users.email, 'escape') AS email " .
                   "FROM users, maia_users " .
                   "WHERE users.maia_user_id = maia_users.id " .
                   "AND users.id <> maia_users.primary_email_id " .