Fossil

Differences From Artifact [fb8d00c06e]:

• File src/db.c — part of check-in [8e85d6ca22] at 2022-12-30 11:53:39 on branch trunk — If there is a need to do lazy updates of the full text index during a request that is not from the same origin, then allow database writes for the duration of that update. Also, allow changes to USER and CONFIG tables when explicitly authorized by db_unprotect() even if the request that prompted the change is not from the same origin. (user: drh size: 165269)

To Artifact [cf2093b0ee]:

• File src/db.c — part of check-in [41ba6ea7db] at 2022-12-30 20:54:10 on branch trunk — Security enhancement: Do not store the passwords for remote URLs directly, but instead store the sha1_shared_secret() encoding of those passwords. It is the SHA1 encoding that gets transmitted to the server anyhow, so we might as well just store that. The SHA1 encoding cannot be used to log in. The password is still protected using obscure() even though it is now a SHA1 hash. (user: drh size: 165367)

1393
1394
1395
1396
1397
1398
1399





1400
1401
1402
1403
1404
1405
1406
1407

  int nIn = sqlite3_value_bytes(argv[0]);
  char *zOut, *zTemp;
  if( 0==zIn ) return;
  if( 0==(zOut = sqlite3_malloc64( nIn * 2 + 3 )) ){
    sqlite3_result_error_nomem(context);
    return;
  }





  strcpy(zOut, zTemp = obscure((char*)zIn));
  fossil_free(zTemp);
  sqlite3_result_text(context, zOut, strlen(zOut), sqlite3_free);
}

/*
** Return True if zName is a protected (a.k.a. "sensitive") setting.
*/

>
>
>
>
>
|

1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412

  int nIn = sqlite3_value_bytes(argv[0]);
  char *zOut, *zTemp;
  if( 0==zIn ) return;
  if( 0==(zOut = sqlite3_malloc64( nIn * 2 + 3 )) ){
    sqlite3_result_error_nomem(context);
    return;
  }
  if( sqlite3_user_data(context)==0 ){
    zTemp = obscure((char*)zIn);
  }else{
    zTemp = unobscure((char*)zIn);
  }
  strcpy(zOut, zTemp);
  fossil_free(zTemp);
  sqlite3_result_text(context, zOut, strlen(zOut), sqlite3_free);
}

/*
** Return True if zName is a protected (a.k.a. "sensitive") setting.
*/