diff options
author | 2011-07-27 20:29:49 +0100 | |
---|---|---|
committer | 2011-07-27 20:29:49 +0100 | |
commit | 5099c71493abe193f23b7f0a7381e539bc67bb33 (patch) | |
tree | 7628542c989bace2895427d34959b5f3fcbd2150 /web | |
parent | Added disk size cap (diff) | |
download | gentoaster-5099c71493abe193f23b7f0a7381e539bc67bb33.tar.gz gentoaster-5099c71493abe193f23b7f0a7381e539bc67bb33.tar.bz2 gentoaster-5099c71493abe193f23b7f0a7381e539bc67bb33.zip |
Moved to using mysqli and prepared statements
Diffstat (limited to 'web')
-rw-r--r-- | web/config.php | 2 | ||||
-rw-r--r-- | web/process.php | 60 | ||||
-rw-r--r-- | web/status.php | 61 | ||||
-rw-r--r-- | web/testdrive.php | 39 |
4 files changed, 95 insertions, 67 deletions
diff --git a/web/config.php b/web/config.php index 6d5735c..30d6aa4 100644 --- a/web/config.php +++ b/web/config.php @@ -16,6 +16,6 @@ define("MYSQL_DATABASE", "gentoaster"); // Set the RECAPTCHA keys that should be used, if enabled - define("RECAPTCHA_ENABLED", true); + define("RECAPTCHA_ENABLED", false); define("RECAPTCHA_PUBLIC_KEY","REPLACE_ME"); define("RECAPTCHA_PRIVATE_KEY", "REPLACE_ME");
\ No newline at end of file diff --git a/web/process.php b/web/process.php index 43827b9..238e843 100644 --- a/web/process.php +++ b/web/process.php @@ -8,27 +8,42 @@ if (RECAPTCHA_ENABLED) { require_once "recaptcha.php"; + $remoteAddress = filter_input(INPUT_SERVER, + "remote_addr", + FILTER_VALIDATE_IP); + $challenge = filter_input(INPUT_POST, + "recaptcha_challenge_field", + FILTER_UNSAFE_RAW); + $response = filter_input(INPUT_POST, + "recaptcha_response_field", + FILTER_UNSAFE_RAW); + $resp = recaptcha_check_answer(RECAPTCHA_PRIVATE_KEY, - $_SERVER["REMOTE_ADDR"], - $_POST["recaptcha_challenge_field"], - $_POST["recaptcha_response_field"]); + $remoteAddress, + $challenge, + $response); if (!$resp->is_valid) { die("CAPTCHA was incorrect"); } } + function sanitize_shellarg($arg) { + return escapeshellarg($arg); + } + define("FILTER_SANITIZE_SHELL", array("options" => "sanitize_shellarg")); + $buildID = uniqid(); - $bootMegabytes = intval($_POST["boot_size"]); - $swapMegabytes = intval($_POST["swap_size"]); - $rootMegabytes = intval($_POST["root_size"]); - $timezone = escapeshellarg($_POST["timezone"]); - $hostname = escapeshellarg($_POST["hostname"]); - $username = escapeshellarg($_POST["username"]); - $password = escapeshellarg($_POST["password"]); - $rootPassword = escapeshellarg($_POST["rootpassword"]); - $packagesList = escapeshellarg($_POST["packages"]); - $outputFormat = escapeshellarg($_POST["format"]); + $bootMegabytes = filter_input(INPUT_POST, "boot_size", FILTER_VALIDATE_INT); + $swapMegabytes = filter_input(INPUT_POST, "swap_size", FILTER_VALIDATE_INT); + $rootMegabytes = filter_input(INPUT_POST, "root_size", FILTER_VALIDATE_INT); + $timezone = filter_input(INPUT_POST, "timezone", FILTER_SANITIZE_SHELL); + $hostname = filter_input(INPUT_POST, "hostname", FILTER_SANITIZE_SHELL); + $username = filter_input(INPUT_POST, "username", FILTER_SANITIZE_SHELL); + $password = filter_input(INPUT_POST, "password", FILTER_SANITIZE_SHELL); + $rootPass = filter_input(INPUT_POST, "rootpassword", FILTER_SANITIZE_SHELL); + $packagesList = filter_input(INPUT_POST, "packages", FILTER_SANITIZE_SHELL); + $outputFormat = filter_input(INPUT_POST, "format", FILTER_SANITIZE_SHELL); $packagesList = str_replace("\r\n", " ", $packagesList); $packagesList = str_replace("\n", " ", $packagesList); @@ -41,7 +56,7 @@ SWAP_MEGABYTES='$swapMegabytes' ROOT_MEGABYTES='$rootMegabytes' TIMEZONE=$timezone HOSTNAME=$hostname -ROOT_PASSWORD=$rootPassword +ROOT_PASSWORD=$rootPass DEFAULT_USERNAME=$username DEFAULT_PASSWORD=$password USE_FLAGS='' @@ -55,13 +70,16 @@ OUTPUT_FORMAT=$outputFormat"; $client->addServer(); $handle = $client->doBackground("invoke_image_build", $iniString); - $db = mysql_connect(MYSQL_HOSTNAME, MYSQL_USERNAME, MYSQL_PASSWORD); - if (!$db) { - die("Could not connect to database ".mysql_error()); + $db = new mysqli(MYSQL_HOSTNAME, MYSQL_USERNAME, + MYSQL_PASSWORD, MYSQL_DATABASE); + if (mysqli_connect_errno()) { + die("Could not connect to database ".mysqli_connect_error()); } - mysql_select_db(MYSQL_DATABASE); - $query = "INSERT INTO builds (id, handle) ". - "VALUES('".$buildID."','".$handle."')"; - mysql_query($query); + + $stmt = $db->prepare("INSERT INTO builds (id, handle) VALUES(?, ?)"); + $stmt->bind_param("ss", $buildID, $handle); + $stmt->execute(); + $stmt->close(); + $db->close(); header("Location: finished.php?uuid=".$buildID);
\ No newline at end of file diff --git a/web/status.php b/web/status.php index 86e7e0e..719afe6 100644 --- a/web/status.php +++ b/web/status.php @@ -5,22 +5,24 @@ require_once "config.php"; - $buildID = $_GET["uuid"]; + $buildID = filter_input(INPUT_GET, "uuid", FILTER_UNSAFE_RAW); $buildresult = "Unknown!"; $inprogress = false; $builddone = false; - $db = mysql_connect(MYSQL_HOSTNAME, MYSQL_USERNAME, MYSQL_PASSWORD); - if (!$db) { - die("Could not connect to database ".mysql_error()."\n"); + $db = new mysqli(MYSQL_HOSTNAME, MYSQL_USERNAME, + MYSQL_PASSWORD, MYSQL_DATABASE); + if (mysqli_connect_errno()) { + die("Could not connect to database ".mysqli_connect_error()); } - mysql_select_db(MYSQL_DATABASE); - $query = "SELECT handle FROM builds ". - "WHERE id = '".mysql_real_escape_string($buildID)."'"; - $result = mysql_query($query); - if (mysql_num_rows($result) == 1) { - $handles = mysql_fetch_array($result); - $handle = $handles[0]; + + $stmt = $db->prepare("SELECT handle FROM builds WHERE id = ?"); + $stmt->bind_param("s", $buildID); + $stmt->execute(); + if ($stmt->num_rows == 1) { + $stmt->bind_result($handle); + $stmt->fetch(); + $stmt->close(); $client = new GearmanClient(); $client->addServer(); @@ -35,13 +37,14 @@ $buildresult = "Task has not yet been processed"; } } else { - $cleanBuildID = mysql_real_escape_string($buildID); - $query = "SELECT returncode, result FROM builds ". - "WHERE id = '".$cleanBuildID."'"; - $result = mysql_query($query); - $jobres = mysql_fetch_array($result); - if ($jobres[0] !== null) { - if ($jobres[0] == 0) { + $stmt = $db->prepare("SELECT returncode, result FROM builds WHERE id = ?"); + $stmt->bind_param("s", $buildID); + $stmt->execute(); + $stmt->bind_result($returncode, $result); + $stmt->fetch(); + $stmt->close(); + if ($returncode !== null) { + if ($returncode == 0) { $buildresult = "Your build is complete! ". "What would you like to do now?". "<br /><br /><center>". @@ -56,16 +59,24 @@ "</table></center>"; $builddone = true; } else { - $buildresult = "Job returned with code ".$jobres[0].": ".$jobres[1]; + $buildresult = "Job returned with code ".$returncode.": ".$result; } } else { $buildresult = "Job failed"; } } } else { + $stmt->close(); $buildresult = "Invalid handle hash"; } + $db->close(); + + if (!$builddone) { + $titleString = "How's things?"; + } else { + $titleString = "It's showtime!"; + } ?> <html> <head> @@ -90,17 +101,7 @@ <div id="content"> <div id="main"> <div id="status" class="step"> - <?php - if (!$builddone) { - ?> - <h1>How's things?</h1> - <?php - } else { - ?> - <h1>It's showtime!</h1> - <?php - } - ?> + <h1><?php echo $titleString; ?></h1> <p> <?php echo $buildresult; ?> <div id="progressbar"></div> diff --git a/web/testdrive.php b/web/testdrive.php index 066dd4c..8f3c718 100644 --- a/web/testdrive.php +++ b/web/testdrive.php @@ -5,19 +5,24 @@ require_once "config.php"; - $buildID = $_GET["uuid"]; + $buildID = filter_input(INPUT_GET, "uuid", FILTER_UNSAFE_RAW); $buildresult = "Unknown!"; $inprogress = false; - $db = mysql_connect(MYSQL_HOSTNAME, MYSQL_USERNAME, MYSQL_PASSWORD); - if (!$db) { - die("Could not connect to database ".mysql_error()."\n"); + $db = new mysqli(MYSQL_HOSTNAME, MYSQL_USERNAME, + MYSQL_PASSWORD, MYSQL_DATABASE); + if (mysqli_connect_errno()) { + die("Could not connect to database ".mysqli_connect_error()); } - mysql_select_db(MYSQL_DATABASE); - $result = mysql_query("SELECT handle FROM builds WHERE id = '".mysql_real_escape_string($buildID)."'"); - if (mysql_num_rows($result) == 1) { - $handles = mysql_fetch_array($result); - $handle = $handles[0]; + + $stmt = $db->prepare("SELECT handle FROM builds WHERE id = ?"); + $stmt->bind_param("s", $buildID); + $stmt->execute(); + + if ($stmt->num_rows == 1) { + $stmt->bind_result($handle); + $stmt->fetch(); + $stmt->close(); $client = new GearmanClient(); $client->addServer(); @@ -25,12 +30,14 @@ if ($status[0]) { header("Location: status.php?uuid=".$buildID); } else { - $cleanBuildID = mysql_real_escape_string($buildID); - $query = "SELECT returncode, result FROM builds WHERE id = '".$cleanBuildID."'"; - $result = mysql_query(); - $jobres = mysql_fetch_array($result); - if ($jobres[0] !== null) { - if ($jobres[0] == 0) { + $stmt = $db->prepare("SELECT returncode, result FROM builds WHERE id = ?"); + $stmt->bind_param("s", $buildID); + $stmt->execute(); + $stmt->bind_result($returncode, $result); + $stmt->fetch(); + $stmt->close(); + if ($returncode !== null) { + if ($returncode == 0) { // we're built, let's do this $client = new GearmanClient(); $client->addServer(); @@ -44,9 +51,11 @@ } } } else { + $stmt->close(); die("Invalid handle hash"); } + $db->close(); ?> <html> <head> |