fixed security issue

Florian Schaal

2013-10-21 7ed87c51103a7e988b0f0a2265805b698cf7e5b1

 server/lib/classes/db_mysql.inc.php

@@ -265,6 +265,31 @@

    }

        /**
        * Function to get the database-size
        * @param string $database_name
        * @return int - database-size in bytes
        */
        public function getDatabaseSize($database_name) {
                global $app;
                include('lib/mysql_clientdb.conf');
                /* Connect to the database */
                $link = mysql_connect($clientdb_host, $clientdb_user, $clientdb_password);
                if (!$link) {
                        $app->log('Unable to connect to the database'.mysql_error($link),LOGLEVEL_DEBUG);
                        return;
                }
                /* Get database-size from information_schema */
      $result=mysql_query("SELECT SUM(data_length+index_length) FROM information_schema.TABLES WHERE table_schema='".mysql_real_escape_string($database_name)."';",$link);
                $this->close;
                if (!$result) {
                        $app->log('Unable to get the database-size'.mysql_error($link),LOGLEVEL_DEBUG);
                        return;
                }
                $database_size = mysql_fetch_row($result);
                return $database_size[0];
        }

    //** Function to fill the datalog with a full differential record.
    public function datalogSave($db_table, $action, $primary_field, $primary_id, $record_old, $record_new, $force_update = false) {
      global $app,$conf;
@@ -370,6 +395,15 @@
      $this->query("DELETE FROM $tablename WHERE $index_field = '$index_value'");
      $new_rec = array();
      $this->datalogSave($tablename, 'DELETE', $index_field, $index_value, $old_rec, $new_rec);

      return true;
    }
	
   //** Deletes a record and saves the changes into the datalog
    public function datalogError($errormsg) {
      global $app;
	  
     if(isset($app->modules->current_datalog_id) && $app->modules->current_datalog_id > 0) $this->query("UPDATE sys_datalog set error = '".$this->quote($errormsg)."' WHERE datalog_id = ".$app->modules->current_datalog_id);

      return true;
    }
@@ -636,4 +670,4 @@

         }

         ?>
         ?>