debian-bugs-dist.lists.debian.org
[Top] [All Lists]

Bug#274291: pgsql-createuser.sh should quote $dbuser in certain conditio

Subject: Bug#274291: pgsql-createuser.sh should quote $dbuser in certain condition.
From: Raphaël Enrici
Date: Thu, 30 Sep 2004 23:03:32 +0200
Package: wwwconfig-common
Version: 0.0.40


Hope this one is not a dup.
While installing the "drupal" package which depends on wwwconfig-common
and specifying a database user name containing a '-' caracter in its name
(www-data in my case) I had the following error message and the user
creation failed:
ERROR:  syntax error at or near "-" at character 16

This error message seems to be due to the "CREATE USER" line in
/usr/share/wwwconfig-common/pgsql-createuser.sh  which gives:
CREATE USER www-data WITH SYSID <a sysid> PASSWORD '<the password>';

because of the minus in the username it should be:
CREATE USER "www-data" WITH SYSID <a sysid> PASSWORD 'the password';

This is also the case for the "alter user" statement just before.

You can reproduce this directly in psql:

postgres@slashcnam:~$ psql -d template1
Welcome to psql 7.4.5, the PostgreSQL interactive terminal.

Type:  \copyright for distribution terms
        \h for help with SQL commands
        \? for help on internal slash commands
        \g or terminate with semicolon to execute query
        \q to quit

template1=# create user www-data password 'blabla';
ERROR:  syntax error at or near "-" at character 16
template1=# create user "www-data" password 'blabla';
CREATE USER
template1=#\q


The pgsql-dropuser.sh should suffer from the same "bug".

Follows a proposal for a patch. I only tested the one concerning
pgsql-createuser.sh.

Thanks for your fine work.

Regards,
Raphaël


Patch proposal:
::::::::::::::
pgsql-createuser.sh.diff-u
::::::::::::::
--- /usr/share/wwwconfig-common/pgsql-createuser.sh.old 2004-09-15 
16:07:11.000000000 +0200
+++ /usr/share/wwwconfig-common/pgsql-createuser.sh     2004-09-30 
21:55:14.000000000 +0200
@@ -53,7 +53,7 @@
        # . pgsql-userpass.get
        status=nothing
        if [ "$userpass" != "$dbpass" ] ; then
-           if eval $pgsqlcmd -d $systemdb -c "\"ALTER USER $dbuser WITH 
PASSWORD '$dbpass'\"" > /dev/null 2>&1 ; then
+           if eval $pgsqlcmd -d $systemdb -c "\"ALTER USER "'\"'"$dbuser"'\"'" 
WITH PASSWORD '$dbpass'\"" > /dev/null 2>&1 ; then
                log="${log}Password changed for pgsql user $dbuser."
                status=changepass
            else
@@ -66,7 +66,7 @@
        # . pgsql-nextsysid.get
        if [ "$status" = "error" ] ; then
            error="Unable to create user $dbuser. Something is wrong with the 
database."
-       elif eval $pgsqlcmd -d $systemdb -c "\"CREATE USER $dbuser WITH SYSID 
$nextsysid PASSWORD '$dbpass'\"" ; > /dev/null 2>&1; then
+       elif eval $pgsqlcmd -d $systemdb -c "\"CREATE USER "'\"'"$dbuser"'\"'" 
WITH SYSID $nextsysid PASSWORD '$dbpass'\"" ; > /dev/null 2>&1; then
            tmpuser=$(eval $pgsqlcmd -d $systemdb -q -t -A -c "\"SELECT usename 
FROM pg_shadow WHERE usename='$dbuser'\"")
            if [ "$tmpuser" = "$dbuser" ] ; then
                log="${log}Pgsql user $dbuser created."
::::::::::::::
pgsql-dropuser.sh.diff-u
# PLEASE NOTE THIS ONE IS FULLY UNTESTED!!!
::::::::::::::
--- /usr/share/wwwconfig-common/pgsql-dropuser.sh.old   2004-09-30 
22:06:21.000000000 +0200
+++ /usr/share/wwwconfig-common/pgsql-dropuser.sh       2004-09-30 
22:07:11.000000000 +0200
@@ -38,7 +38,7 @@
 else
     TMPU=$(eval $pgsqlcmd -d $systemdb -q -t -A -c "\"SELECT usename FROM 
pg_shadow WHERE usename='$dbuser';\"")
     if [ "$TMPU" = "$dbuser" ] ; then
-       if eval $pgsqlcmd -q -d $systemdb -c "\"DROP USER $dbuser;\"" ; then
+       if eval $pgsqlcmd -q -d $systemdb -c "\"DROP USER 
"'\"'"$dbuser"'\"'";\"" ; then
            TMPU=$(eval $pgsqlcmd -d $systemdb -q -t -A -c "\"SELECT usename 
FROM pg_shadow WHERE usename='$dbuser';\"")
            if [ -z "$TMPU" ] ; then
                log="${log}User $dbuser dropped."


<Prev in Thread] Current Thread [Next in Thread>
  • Bug#274291: pgsql-createuser.sh should quote $dbuser in certain condition., Raphaël Enrici <=
Privacy Policy