Browse Source

[svn r21142] Do not show SQL error message when in production (part of security improvements FS#4261)
Changed a few mysql_* references to Database::* references

Yannick Warnier 16 years ago
parent
commit
1d5ea061c4
1 changed files with 16 additions and 16 deletions
  1. 16 16
      main/inc/lib/main_api.lib.php

+ 16 - 16
main/inc/lib/main_api.lib.php

@@ -498,7 +498,7 @@ function api_get_user_info($user_id = '') {
 		$sql = "SELECT * FROM ".Database :: get_main_table(TABLE_MAIN_USER)." WHERE user_id='".Database::escape_string($user_id)."'";
 		$result = api_sql_query($sql, __FILE__, __LINE__);
 		if(Database::num_rows($result) > 0) {
-			$result_array = mysql_fetch_array($result);
+			$result_array = Database::fetch_array($result);
 			// this is done so that it returns the same array-index-names
 			// ideally the names of the fields of the user table are renamed so that they match $_user (or vice versa)
 			// $_user should also contain every field of the user table (except password maybe). This would make the
@@ -530,7 +530,7 @@ function api_get_user_info_from_username($username = '') {
     $sql = "SELECT * FROM ".Database :: get_main_table(TABLE_MAIN_USER)." WHERE username='".Database::escape_string($username)."'";
     $result = api_sql_query($sql, __FILE__, __LINE__);
     if (Database::num_rows($result) > 0) {
-        $result_array = mysql_fetch_array($result);
+        $result_array = Database::fetch_array($result);
         // this is done so that it returns the same array-index-names
         // ideally the names of the fields of the user table are renamed so that they match $_user (or vice versa)
         // $_user should also contain every field of the user table (except password maybe). This would make the
@@ -584,7 +584,7 @@ function api_get_course_setting($setting_name, $course_code = null) {
 	} else {
 		$table = Database::get_course_table(TABLE_COURSE_SETTING);
 	}
-	$setting_name = mysql_real_escape_string($setting_name);
+	$setting_name = Database::escape_string($setting_name);
 	$sql = "SELECT * FROM $table WHERE variable = '$setting_name'";
 	$res = api_sql_query($sql,__FILE__,__LINE__);
 	if (Database::num_rows($res)>0) {
@@ -702,18 +702,18 @@ function api_get_course_info($course_code=null) {
 function api_sql_query($query, $file = '', $line = 0) {
 	$result = @mysql_query($query);
 
-	if ($line && !$result) {
+	if ($line && !$result && api_get_setting('server_type')!='production') {
 			$info = '<pre>';
-			$info .= '<b>MYSQL ERROR :</b><br/> ';
-			$info .= mysql_error();
+			$info .= '<b>DATABASE ERROR :</b><br /> ';
+			$info .= Security::remove_XSS(Database::error());
 			$info .= '<br/>';
-			$info .= '<b>QUERY       :</b><br/> ';
-			$info .= $query;
+			$info .= '<b>QUERY       :</b><br /> ';
+			$info .= Security::remove_XSS($query);
 			$info .= '<br/>';
-			$info .= '<b>FILE        :</b><br/> ';
+			$info .= '<b>FILE        :</b><br /> ';
 			$info .= ($file == '' ? ' unknown ' : $file);
 			$info .= '<br/>';
-			$info .= '<b>LINE        :</b><br/> ';
+			$info .= '<b>LINE        :</b><br /> ';
 			$info .= ($line == 0 ? ' unknown ' : $line);
 			$info .= '</pre>';
 			//@ mysql_close();
@@ -731,7 +731,7 @@ function api_sql_query($query, $file = '', $line = 0) {
  */
 function api_store_result($result) {
 	$tab = array ();
-	while ($row = mysql_fetch_array($result)) {
+	while ($row = Database::fetch_array($result)) {
 		$tab[] = $row;
 	}
 	return $tab;
@@ -1440,14 +1440,14 @@ function api_is_coach() {
 	 $sql = "SELECT DISTINCT id, name, date_start, date_end
 							FROM session
 							INNER JOIN session_rel_course
-								ON session_rel_course.id_coach = '".mysql_real_escape_string($_user['user_id'])."'
+								ON session_rel_course.id_coach = '".Database::escape_string($_user['user_id'])."'
 							ORDER BY date_start, date_end, name";
 	$result = api_sql_query($sql,__FILE__,__LINE__);
 	$sessionIsCoach = api_store_result($result);
 
 	$sql = "SELECT DISTINCT id, name, date_start, date_end
 							FROM session
-							WHERE session.id_coach =  '".mysql_real_escape_string($_user['user_id'])."'
+							WHERE session.id_coach =  '".Database::escape_string($_user['user_id'])."'
 							ORDER BY date_start, date_end, name";
 	$result = api_sql_query($sql,__FILE__,__LINE__);
 	$sessionIsCoach = array_merge($sessionIsCoach , api_store_result($result));
@@ -2119,7 +2119,7 @@ function api_get_languages() {
 	$tbl_language = Database::get_main_table(TABLE_MAIN_LANGUAGE);
 	$sql = "SELECT * FROM $tbl_language WHERE available='1' ORDER BY original_name ASC";
 	$result = api_sql_query($sql, __FILE__, __LINE__);
-	while ($row = mysql_fetch_array($result)) {
+	while ($row = Database::fetch_array($result)) {
 		$language_list['name'][] = $row['original_name'];
 		$language_list['folder'][] = $row['dokeos_folder'];
 	}
@@ -2138,8 +2138,8 @@ function api_get_language_isocode() {
 	$tbl_language = Database::get_main_table(TABLE_MAIN_LANGUAGE);
 	$sql = "SELECT isocode FROM $tbl_language WHERE dokeos_folder = '".api_get_interface_language()."'";
 	$res = api_sql_query($sql,__FILE__,__LINE__);
-	if(mysql_num_rows($res)) {
-		$row = mysql_fetch_array($res);
+	if(Database::num_rows($res)) {
+		$row = Database::fetch_array($res);
 		return $row['isocode'];
 	}
 	return null;