File: bug-274291-quote-postgres-user.patch

package info (click to toggle)
wwwconfig-common 0.3.0
  • links: PTS
  • area: main
  • in suites: bullseye, buster, sid, stretch
  • size: 488 kB
  • sloc: sh: 952; makefile: 5
file content (91 lines) | stat: -rw-r--r-- 3,740 bytes parent folder | download | duplicates (6)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
Package: wwwconfig-common
Version: 0.0.40


Hope this one is not a dup.
While installing the "drupal" package which depends on wwwconfig-common
and specifying a database user name containing a '-' caracter in its name
(www-data in my case) I had the following error message and the user
creation failed:
ERROR:  syntax error at or near "-" at character 16

This error message seems to be due to the "CREATE USER" line in
/usr/share/wwwconfig-common/pgsql-createuser.sh  which gives:
CREATE USER www-data WITH SYSID <a sysid> PASSWORD '<the password>';

because of the minus in the username it should be:
CREATE USER "www-data" WITH SYSID <a sysid> PASSWORD 'the password';

This is also the case for the "alter user" statement just before.

You can reproduce this directly in psql:

postgres@slashcnam:~$ psql -d template1
Welcome to psql 7.4.5, the PostgreSQL interactive terminal.

Type:  \copyright for distribution terms
        \h for help with SQL commands
        \? for help on internal slash commands
        \g or terminate with semicolon to execute query
        \q to quit

template1=# create user www-data password 'blabla';
ERROR:  syntax error at or near "-" at character 16
template1=# create user "www-data" password 'blabla';
CREATE USER
template1=#\q


The pgsql-dropuser.sh should suffer from the same "bug".

Follows a proposal for a patch. I only tested the one concerning
pgsql-createuser.sh.

Thanks for your fine work.

Regards,
Rapha´┐Żl


Patch proposal:
::::::::::::::
pgsql-createuser.sh.diff-u
::::::::::::::
--- /usr/share/wwwconfig-common/pgsql-createuser.sh.old 2004-09-15 16:07:11.000000000 +0200
+++ /usr/share/wwwconfig-common/pgsql-createuser.sh     2004-09-30 21:55:14.000000000 +0200
@@ -53,7 +53,7 @@
        # . pgsql-userpass.get
        status=nothing
        if [ "$userpass" != "$dbpass" ] ; then
-           if eval $pgsqlcmd -d $systemdb -c "\"ALTER USER $dbuser WITH PASSWORD '$dbpass'\"" > /dev/null 2>&1 ; then
+           if eval $pgsqlcmd -d $systemdb -c "\"ALTER USER "'\"'"$dbuser"'\"'" WITH PASSWORD '$dbpass'\"" > /dev/null 2>&1 ; then
                log="${log}Password changed for pgsql user $dbuser."
                status=changepass
            else
@@ -66,7 +66,7 @@
        # . pgsql-nextsysid.get
        if [ "$status" = "error" ] ; then
            error="Unable to create user $dbuser. Something is wrong with the database."
-       elif eval $pgsqlcmd -d $systemdb -c "\"CREATE USER $dbuser WITH SYSID $nextsysid PASSWORD '$dbpass'\"" ; > /dev/null 2>&1; then
+       elif eval $pgsqlcmd -d $systemdb -c "\"CREATE USER "'\"'"$dbuser"'\"'" WITH SYSID $nextsysid PASSWORD '$dbpass'\"" ; > /dev/null 2>&1; then
            tmpuser=$(eval $pgsqlcmd -d $systemdb -q -t -A -c "\"SELECT usename FROM pg_shadow WHERE usename='$dbuser'\"")
            if [ "$tmpuser" = "$dbuser" ] ; then
                log="${log}Pgsql user $dbuser created."
::::::::::::::
pgsql-dropuser.sh.diff-u
# PLEASE NOTE THIS ONE IS FULLY UNTESTED!!!
::::::::::::::
--- /usr/share/wwwconfig-common/pgsql-dropuser.sh.old   2004-09-30 22:06:21.000000000 +0200
+++ /usr/share/wwwconfig-common/pgsql-dropuser.sh       2004-09-30 22:07:11.000000000 +0200
@@ -38,7 +38,7 @@
 else
     TMPU=$(eval $pgsqlcmd -d $systemdb -q -t -A -c "\"SELECT usename FROM pg_shadow WHERE usename='$dbuser';\"")
     if [ "$TMPU" = "$dbuser" ] ; then
-       if eval $pgsqlcmd -q -d $systemdb -c "\"DROP USER $dbuser;\"" ; then
+       if eval $pgsqlcmd -q -d $systemdb -c "\"DROP USER "'\"'"$dbuser"'\"'";\"" ; then
            TMPU=$(eval $pgsqlcmd -d $systemdb -q -t -A -c "\"SELECT usename FROM pg_shadow WHERE usename='$dbuser';\"")
            if [ -z "$TMPU" ] ; then
                log="${log}User $dbuser dropped."