152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
|
void *pError,
int code,
const char *zArg1,
const char *zArg2,
const char *zArg3,
const char *zArg4
){
char *zError = *(char**)pError;
if( zError ){
/* We've already seen an error. No need to continue. */
return SQLITE_OK;
}
switch( code ){
case SQLITE_SELECT:
case SQLITE_FUNCTION: {
break;
|
>
|
<
|
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
|
void *pError,
int code,
const char *zArg1,
const char *zArg2,
const char *zArg3,
const char *zArg4
){
int rc = SQLITE_OK;
if( *(char**)pError ){
/* We've already seen an error. No need to continue. */
return SQLITE_OK;
}
switch( code ){
case SQLITE_SELECT:
case SQLITE_FUNCTION: {
break;
|
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
|
"tagxref",
};
int i;
for(i=0; i<sizeof(azAllowed)/sizeof(azAllowed[0]); i++){
if( strcasecmp(zArg1, azAllowed[i])==0 ) break;
}
if( i>=sizeof(azAllowed)/sizeof(azAllowed[0]) ){
zError = mprintf("cannot access table %s", zArg1);
}
break;
}
default: {
zError = mprintf("only SELECT statements are allowed");
break;
}
}
return SQLITE_OK;
}
/*
** Check the given SQL to see if is a valid query that does not
** attempt to do anything dangerous. Return 0 on success and a
** pointer to an error message string (obtained from malloc) if
|
|
>
>
>
|
>
|
|
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
|
"tagxref",
};
int i;
for(i=0; i<sizeof(azAllowed)/sizeof(azAllowed[0]); i++){
if( strcasecmp(zArg1, azAllowed[i])==0 ) break;
}
if( i>=sizeof(azAllowed)/sizeof(azAllowed[0]) ){
*(char**)pError = mprintf("access to table \"%s\" is restricted",zArg1);
rc = SQLITE_DENY;
}else if( !g.okRdAddr && strncmp(zArg2, "private_", 8)==0 ){
rc = SQLITE_IGNORE;
}
break;
}
default: {
*(char**)pError = mprintf("only SELECT statements are allowed");
rc = SQLITE_DENY;
break;
}
}
return rc;
}
/*
** Check the given SQL to see if is a valid query that does not
** attempt to do anything dangerous. Return 0 on success and a
** pointer to an error message string (obtained from malloc) if
|
873
874
875
876
877
878
879
880
881
882
883
884
885
886
|
int rn;
char *zSql;
char *zTitle;
char *zOwner;
char *zClrKey;
int tabs;
Stmt q;
login_check_credentials();
if( !g.okRead ){ login_needed(); return; }
rn = atoi(PD("rn","0"));
if( rn==0 ){
cgi_redirect("reportlist");
return;
|
>
>
|
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
|
int rn;
char *zSql;
char *zTitle;
char *zOwner;
char *zClrKey;
int tabs;
Stmt q;
char *zErr1 = 0;
char *zErr2 = 0;
login_check_credentials();
if( !g.okRead ){ login_needed(); return; }
rn = atoi(PD("rn","0"));
if( rn==0 ){
cgi_redirect("reportlist");
return;
|
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
|
}
style_header(zTitle);
output_color_key(zClrKey, 1,
"border=0 cellpadding=3 cellspacing=0 class=\"report\"");
@ <table border=1 cellpadding=2 cellspacing=0 class="report">
sState.rn = rn;
sState.nCount = 0;
sqlite3_exec(g.db, zSql, generate_html, &sState, 0);
@ </table>
style_footer();
}else{
sqlite3_exec(g.db, zSql, output_tab_separated, &count, 0);
cgi_set_content_type("text/plain");
}
}
|
>
|
>
>
>
>
>
>
>
|
>
|
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
|
}
style_header(zTitle);
output_color_key(zClrKey, 1,
"border=0 cellpadding=3 cellspacing=0 class=\"report\"");
@ <table border=1 cellpadding=2 cellspacing=0 class="report">
sState.rn = rn;
sState.nCount = 0;
sqlite3_set_authorizer(g.db, report_query_authorizer, (void*)&zErr1);
sqlite3_exec(g.db, zSql, generate_html, &sState, &zErr2);
sqlite3_set_authorizer(g.db, 0, 0);
@ </table>
if( zErr1 ){
@ <p><font color="red"><b>Error: %h(zErr1)</b></font></p>
}else if( zErr2 ){
@ <p><font color="red"><b>Error: %h(zErr2)</b></font></p>
}
style_footer();
}else{
sqlite3_set_authorizer(g.db, report_query_authorizer, (void*)&zErr1);
sqlite3_exec(g.db, zSql, output_tab_separated, &count, &zErr2);
sqlite3_set_authorizer(g.db, 0, 0);
cgi_set_content_type("text/plain");
}
}
|