9.1.2.82 latest snapshots
Post new topic   This topic is locked: you cannot edit posts or make replies.   Printer Friendly Page     Forum IndexCVS Info
Author Message
NanoCaiordo
Developer


Joined: Jun 29, 2004
Posts: 3678
Location: Melbourne, AU

PostPost subject: 9.1.2.82 latest snapshots
Posted: Wed Dec 12, 2007 1:58 pm
Reply with quote

Due a bug in few MySQL versions and due too many possible combination of database connection charset and database/table collation, upgrades from MySQL4.x to >= 4.1, upgrades to latest DragonflyCMS ... and many more, I felt forced to hold a new release to fix all those issues in once.

DJ found the solution and its in cvs already.

More infos for developers:
as you already know $userinfo['user_ip'] holds a packed version in binary format of the visitor ip. We used to apply a right padding '/' to avoid MySQL bugs but for today standards this wasn't the proper fix.
Few of us noticed this bug a while ago when, for example, poster ip was different then what apache logged.

Solution was to send the ip in HEX format, every RDBMS using any kind of connection, collation.... will properly convert the hexadecimal ip into binary format.
$userinfo['user_ip']
does hold the hexadecimal ip (not binary ip anymore) without the trailing '/'.

So far so good.

Required changes:
1) use $db->binary_safe instead of $db->escape_binary
2) remove single quotes from within the queries

PHP:
<?php
# before
$ip = $db->escape_binary(Security::get_ip()).'/';
$db->sql_query("INSERT INTO table ip='$ip'");

# now
$ip = $db->binary_safe(Security::get_ip());
$db->sql_query("INSERT INTO table ip=$ip");

# before
$db->sql_query("INSERT INTO table ip='".$userinfo['user_ip']."'");

# now
$db->sql_query("INSERT INTO table ip=".$userinfo['user_ip']);


_________________
.:: I met php the 03 December 2003 :: Unforgettable day! ::.

NanoCaiordo's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
MySQL 5.1 / PHP 5.3 / NextGen()
Back to top
View user's profile Visit poster's website
Jeruvy
Security Team


Joined: Apr 23, 2004
Posts: 1433
Location: Canada

PostPost subject: Re: 9.1.2.82 latest snapshots
Posted: Sun Dec 16, 2007 7:00 pm
Reply with quote

Good to know! I never noticed this even though I've read a few posts on mysql about it. Embarassed
_________________
J.
j e r u v y a t y a h o o d o t c o m

Need help? Look here: www.dragonflycms.org/W...d=112.html
Need to chat? Look for me on irc.freenode.net

Jeruvy's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
Ubuntu7.10/Debian3.1 - 2.2.3/1.3.37 - 5.0.38/4.0.27 - 5.2.1/4.4.7 - CVS/9.1.2}
Back to top
View user's profile ICQ Number Yahoo Messenger
Display posts from previous:   
Post new topic   This topic is locked: you cannot edit posts or make replies.   Printer Friendly Page     Forum IndexCVS Info All times are GMT
Page 1 of 1


Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum

stopsoftwarepatents.eu petition banner
User Info [x]

Welcome Anonymous

Nickname
Password
(Register)

Last CVS commits [x]

Languages [x]

Community [x]

Support for DragonflyCMS in a other languages:

Deutsch
Español

X-links [x]
UltraEdit Browse Happy logo Firefox MySQL PostgreSQL Valid CSS! Valid XHTML 1.0! Unicode Encoded Badge NukeBiz Resources Raven DragonflyCMS Dedicated Now InsideSupport Lampe Berger

Preview theme [x]
Each user can view the site with a different theme.
Themes marked with a * also change the forum look.


You are seeing squares or questionmarks on this page?

All content of this website is copyrighted by the Creative Commons NC-SA
The logos and trademarks used on this site are the property of their respective owners
We are not responsible for comments posted by our users, as they are the property of the poster.
Our server runs on a P3 1.2GHz with 512MB RAM with no accelerators
Support GoPHP5.org
This page generated in 0.9952 seconds with 16 DB Queries in 0.1972 seconds
Memory Usage: 2.86 MB
Interactive software released under GNU GPL, Code Credits, Privacy Policy