From 81759a0075e130320d10bf2694c49a49edad4460 Mon Sep 17 00:00:00 2001 From: Leaflet Date: Wed, 30 Sep 2026 12:20:03 +0800 Subject: [PATCH 1/4] Fix typo --- src/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main.c b/src/main.c index 9e80480..34b8090 100644 --- a/src/main.c +++ b/src/main.c @@ -523,7 +523,7 @@ int main(int argc, char *argv[]) } if (unlink(VAR_USER_LIST_SHM) < 0) { - log_error("unlink(%s) error", VAR_SECTION_LIST_SHM); + log_error("unlink(%s) error", VAR_USER_LIST_SHM); } log_common("Main process exit normally"); From 8b4d86a170aa1fe4db195b9ef980703c41bffe6c Mon Sep 17 00:00:00 2001 From: Leaflet Date: Wed, 30 Sep 2026 19:35:37 +0800 Subject: [PATCH 2/4] Fix bug: do not call mysql_error(db) when db is NULL --- src/article_del.c | 2 +- src/article_op.c | 2 +- src/article_post.c | 10 +++++----- src/login.c | 2 +- src/section_list_loader.c | 8 ++++---- src/user_info_update.c | 8 ++++---- src/user_list.c | 2 +- 7 files changed, 17 insertions(+), 17 deletions(-) diff --git a/src/article_del.c b/src/article_del.c index 5fbb09d..456a1a7 100644 --- a/src/article_del.c +++ b/src/article_del.c @@ -80,7 +80,7 @@ int article_del(const SECTION_LIST *p_section, const ARTICLE *p_article) db = db_open(); if (db == NULL) { - log_error("db_open() error: %s", mysql_error(db)); + log_error("db_open() error"); ret = -1; goto cleanup; } diff --git a/src/article_op.c b/src/article_op.c index d511fae..1e1408b 100644 --- a/src/article_op.c +++ b/src/article_op.c @@ -59,7 +59,7 @@ int article_excerption_set(SECTION_LIST *p_section, int32_t aid, int8_t set) db = db_open(); if (db == NULL) { - log_error("db_open() error: %s", mysql_error(db)); + log_error("db_open() error"); ret = -1; goto cleanup; } diff --git a/src/article_post.c b/src/article_post.c index c3d8b71..c9e1e65 100644 --- a/src/article_post.c +++ b/src/article_post.c @@ -247,7 +247,7 @@ int article_post(const SECTION_LIST *p_section, ARTICLE *p_article_new) db = db_open(); if (db == NULL) { - log_error("db_open() error: %s", mysql_error(db)); + log_error("db_open() error"); ret = -1; goto cleanup; } @@ -470,7 +470,7 @@ int article_modify(const SECTION_LIST *p_section, const ARTICLE *p_article, ARTI db = db_open(); if (db == NULL) { - log_error("db_open() error: %s", mysql_error(db)); + log_error("db_open() error"); ret = -1; goto cleanup; } @@ -619,7 +619,7 @@ int article_modify(const SECTION_LIST *p_section, const ARTICLE *p_article, ARTI db = db_open(); if (db == NULL) { - log_error("db_open() error: %s", mysql_error(db)); + log_error("db_open() error"); ret = -1; goto cleanup; } @@ -801,7 +801,7 @@ int article_reply(const SECTION_LIST *p_section, const ARTICLE *p_article, ARTIC db = db_open(); if (db == NULL) { - log_error("db_open() error: %s", mysql_error(db)); + log_error("db_open() error"); ret = -1; goto cleanup; } @@ -1109,7 +1109,7 @@ int article_reply(const SECTION_LIST *p_section, const ARTICLE *p_article, ARTIC db = db_open(); if (db == NULL) { - log_error("db_open() error: %s", mysql_error(db)); + log_error("db_open() error"); ret = -1; goto cleanup; } diff --git a/src/login.c b/src/login.c index d4daba6..6397224 100644 --- a/src/login.c +++ b/src/login.c @@ -603,7 +603,7 @@ int user_online_update(const char *action) db = db_open(); if (db == NULL) { - log_error("db_open() error: %s", mysql_error(db)); + log_error("db_open() error"); return -1; } diff --git a/src/section_list_loader.c b/src/section_list_loader.c index 67acf5a..2defe18 100644 --- a/src/section_list_loader.c +++ b/src/section_list_loader.c @@ -54,7 +54,7 @@ int load_section_config_from_db(int update_gen_ex) db = db_open(); if (db == NULL) { - log_error("db_open() error: %s", mysql_error(db)); + log_error("db_open() error"); ret = -1; goto cleanup; } @@ -208,7 +208,7 @@ int append_articles_from_db(int32_t start_aid, int global_lock, int article_coun db = db_open(); if (db == NULL) { - log_error("db_open() error: %s", mysql_error(db)); + log_error("db_open() error"); ret = -1; goto cleanup; } @@ -367,7 +367,7 @@ int set_last_article_op_log_from_db(void) db = db_open(); if (db == NULL) { - log_error("db_open() error: %s", mysql_error(db)); + log_error("db_open() error"); ret = -1; goto cleanup; } @@ -418,7 +418,7 @@ int apply_article_op_log_from_db(int op_count_limit) db = db_open(); if (db == NULL) { - log_error("db_open() error: %s", mysql_error(db)); + log_error("db_open() error"); ret = -1; goto cleanup; } diff --git a/src/user_info_update.c b/src/user_info_update.c index e7e3e35..79c2649 100644 --- a/src/user_info_update.c +++ b/src/user_info_update.c @@ -53,7 +53,7 @@ int user_intro_edit(int uid) db = db_open(); if (db == NULL) { - log_error("db_open() error: %s", mysql_error(db)); + log_error("db_open() error"); ret = -1; goto cleanup; } @@ -154,7 +154,7 @@ int user_intro_edit(int uid) db = db_open(); if (db == NULL) { - log_error("db_open() error: %s", mysql_error(db)); + log_error("db_open() error"); ret = -1; goto cleanup; } @@ -222,7 +222,7 @@ int user_sign_edit(int uid) db = db_open(); if (db == NULL) { - log_error("db_open() error: %s", mysql_error(db)); + log_error("db_open() error"); ret = -1; goto cleanup; } @@ -324,7 +324,7 @@ int user_sign_edit(int uid) db = db_open(); if (db == NULL) { - log_error("db_open() error: %s", mysql_error(db)); + log_error("db_open() error"); ret = -1; goto cleanup; } diff --git a/src/user_list.c b/src/user_list.c index 9af3281..be15e85 100644 --- a/src/user_list.c +++ b/src/user_list.c @@ -608,7 +608,7 @@ int user_list_pool_reload(int online_user) db = db_open(); if (db == NULL) { - log_error("db_open() error: %s", mysql_error(db)); + log_error("db_open() error"); return -1; } From 8c9cc85b079087bcb8f14790180896593babdd2d Mon Sep 17 00:00:00 2001 From: Leaflet Date: Wed, 30 Sep 2026 19:44:26 +0800 Subject: [PATCH 3/4] Secure SQL parameters in login.c to prevent SQL injection by escaping user input for username and password before using them in SQL queries. --- src/login.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/src/login.c b/src/login.c index 6397224..3f7dbb2 100644 --- a/src/login.c +++ b/src/login.c @@ -115,6 +115,8 @@ int check_user(const char *username, const char *password) int i; int ok = 1; char user_tz_env[BBS_user_tz_max_len + 2]; + char username_f[BBS_username_max_len * 2 + 1]; + char password_f[BBS_password_max_len * 2 + 1]; db = db_open(); if (db == NULL) @@ -123,6 +125,10 @@ int check_user(const char *username, const char *password) goto cleanup; } + // Secure SQL parameters + mysql_real_escape_string(db, username_f, username, (unsigned long)strnlen(username, sizeof(username))); + mysql_real_escape_string(db, password_f, password, (unsigned long)strnlen(password, sizeof(password))); + // Verify format for (i = 0; ok && username[i] != '\0'; i++) { @@ -154,6 +160,8 @@ int check_user(const char *username, const char *password) goto cleanup; } + mysql_real_escape_string(db, username_f, username, (unsigned long)strnlen(username, sizeof(username))); + // Begin transaction if (mysql_query(db, "SET autocommit=0") != 0) { @@ -211,7 +219,7 @@ int check_user(const char *username, const char *password) "WHERE user_err_login_log.username = '%s' " "AND (user_err_login_log.login_dt >= user_pubinfo.last_login_dt " "OR user_pubinfo.last_login_dt IS NULL)", - username); + username_f); if (mysql_query(db, sql) != 0) { log_error("Query user_list error: %s", mysql_error(db)); @@ -239,7 +247,7 @@ int check_user(const char *username, const char *password) snprintf(sql, sizeof(sql), "SELECT UID, username, p_login FROM user_list " "WHERE username = '%s' AND password = SHA2('%s', 256) AND enable", - username, password); + username_f, password_f); if (mysql_query(db, sql) != 0) { log_error("Query user_list error: %s", mysql_error(db)); @@ -297,7 +305,7 @@ int check_user(const char *username, const char *password) snprintf(sql, sizeof(sql), "INSERT INTO user_err_login_log(username, password, login_dt, login_ip) " "VALUES('%s', '%s', NOW(), '%s')", - username, password, hostaddr_client); + username_f, password_f, hostaddr_client); if (mysql_query(db, sql) != 0) { log_error("Insert into user_err_login_log error: %s", mysql_error(db)); From 241c818a73839c1760f3fe206462acea1f56900f Mon Sep 17 00:00:00 2001 From: Leaflet Date: Wed, 30 Sep 2026 20:07:16 +0800 Subject: [PATCH 4/4] Remove duplicate calls --- src/login.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/src/login.c b/src/login.c index 3f7dbb2..92c732d 100644 --- a/src/login.c +++ b/src/login.c @@ -125,10 +125,6 @@ int check_user(const char *username, const char *password) goto cleanup; } - // Secure SQL parameters - mysql_real_escape_string(db, username_f, username, (unsigned long)strnlen(username, sizeof(username))); - mysql_real_escape_string(db, password_f, password, (unsigned long)strnlen(password, sizeof(password))); - // Verify format for (i = 0; ok && username[i] != '\0'; i++) { @@ -160,7 +156,9 @@ int check_user(const char *username, const char *password) goto cleanup; } + // Secure SQL parameters mysql_real_escape_string(db, username_f, username, (unsigned long)strnlen(username, sizeof(username))); + mysql_real_escape_string(db, password_f, password, (unsigned long)strnlen(password, sizeof(password))); // Begin transaction if (mysql_query(db, "SET autocommit=0") != 0)