Project

General

Profile

« Previous | Next » 

Revision 721

Added by doc almost 17 years ago

restricted database name and table prefix to "a-zA-Z0-9_" (avoid problems with non quoted table/field names)

View differences:

trunk/CHANGELOG
11 11 
! = Update/Change
12 12 

  		




  13
  13
  
    
------------------------------------- 2.7.0 -------------------------------------


  		




  
  14
  
    
22-Feb-2008 Christian Sommer


  		




  
  15
  
    
#	restricted database name and table prefix to "a-zA-Z0-9_" (avoid problems with non quoted table/field names)


  		




  14
  16
  
    
20-Feb-2008 Thomas Hornik


  		




  15
  17
  
    
!	added workaround for language sorting-problem


  		




  16
  18
  
    
20-Feb-2008	Christian Sommer


  		












  

    
      trunk/wb/install/save.php
    
  





  225
  225
  
    
if(!isset($_POST['database_name']) OR $_POST['database_name'] == '') {


  		




  226
  226
  
    
	set_error('Please enter a database name', 'database_name');


  		




  227
  227
  
    
} else {


  		




  
  228
  
    
	// make sure only allowed characters are specified


  		




  
  229
  
    
	if(preg_match('/[^a-z0-9_]+/i', $_POST['database_name'])) {


  		




  
  230
  
    
		// contains invalid characters (only a-z, A-Z, 0-9 and _ allowed to avoid problems with table/field names)


  		




  
  231
  
    
		set_error('Only characters a-z, A-Z, 0-9 and _ allowed as database name.', 'database_name');


  		




  
  232
  
    
	}


  		




  228
  233
  
    
	$database_name = $_POST['database_name'];


  		




  229
  234
  
    
}


  		




  230
  235
  
    
// Get table prefix


  		




  231
  
  
    
$table_prefix = $_POST['table_prefix'];


  		




  
  236
  
    
if(preg_match('/[^a-z0-9_]+/i', $_POST['table_prefix'])) {


  		




  
  237
  
    
	// contains invalid characters (only a-z, A-Z, 0-9 and _ allowed to avoid problems with table/field names)


  		




  
  238
  
    
	set_error('Only characters a-z, A-Z, 0-9 and _ allowed as table_prefix.', 'table_prefix');


  		




  
  239
  
    
} else {


  		




  
  240
  
    
	$table_prefix = $_POST['table_prefix'];


  		




  
  241
  
    
}


  		




  
  242
  
    

  		




  232
  243
  
    
// Find out if the user wants to install tables and data


  		




  233
  244
  
    
if(isset($_POST['install_tables']) AND $_POST['install_tables'] == 'true') {


  		




  234
  245
  
    
	$install_tables = true;


  		












  

    
      trunk/wb/install/index.php
    
  





  283
  283
  
    
						World-writeable file permissions (777)


  		




  284
  284
  
    
					</label>


  		




  285
  285
  
    
					<br />


  		




  286
  
  
    
					<font class="note">(Please note: this is only recommended for testing environments)</font>


  		




  
  286
  
    
					<font class="note">(Please note: only recommended for testing environments)</font>


  		




  287
  287
  
    
				</div>


  		




  288
  288
  
    
			</td>


  		




  289
  289
  
    
		</tr>


  		




  ......




  304
  304
  
    
			</td>


  		




  305
  305
  
    
		</tr>


  		




  306
  306
  
    
		<tr>


  		




  307
  
  
    
			<td style="color: #666666;">Database Name:</td>


  		




  
  307
  
    
			<td style="color: #666666;">Database Name:<br />[a-zA-Z0-9_]</td>


  		




  308
  308
  
    
			<td>


  		




  309
  309
  
    
				<input <?php echo field_error('database_name');?> type="text" tabindex="8" name="database_name" style="width: 98%;" value="<?php if(isset($_SESSION['database_name'])) { echo $_SESSION['database_name']; } else { echo 'wb'; } ?>" />


  		




  310
  310
  
    
			</td>


  		




  ......




  315
  315
  
    
			</td>


  		




  316
  316
  
    
		</tr>


  		




  317
  317
  
    
		<tr>


  		




  318
  
  
    
			<td style="color: #666666;">Table Prefix:</td>


  		




  
  318
  
    
			<td style="color: #666666;">Table Prefix:<br />[a-zA-Z0-9_]</td>


  		




  319
  319
  
    
			<td>


  		




  320
  
  
    
				<input type="text" tabindex="11" name="table_prefix" style="width: 250px;"<?php if(isset($_SESSION['table_prefix'])) { echo ' value = "'.$_SESSION['table_prefix'].'"'; } ?> />


  		




  
  320
  
    
				<input <?php echo field_error('table_prefix');?> type="text" tabindex="11" name="table_prefix" style="width: 250px;"<?php if(isset($_SESSION['table_prefix'])) { echo ' value = "'.$_SESSION['table_prefix'].'"'; } ?> />


  		




  321
  321
  
    
			</td>


  		




  322
  322
  
    
			<td>&nbsp;</td>


  		




  323
  323
  
    
			<td colspan="2">


  		




  324
  324
  
    
				<input type="checkbox" tabindex="12" name="install_tables" id="install_tables" value="true"<?php if(!isset($_SESSION['install_tables'])) { echo ' checked'; } elseif($_SESSION['install_tables'] == 'true') { echo ' checked'; } ?> />


  		




  325
  325
  
    
				<label for="install_tables" style="color: #666666;">Install Tables</label>


  		




  326
  
  
    
				<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;


  		




  
  326
  
    
				<br />


  		




  327
  327
  
    
				<span style="font-size: 10px; color: #666666;">(Please note: May remove existing tables and data)</span></td>		


  		




  328
  328
  
    
			</td>


  		




  329
  329
  
    
		</tr>


  		












Also available in:  Unified diff