From b4ad044044800b0e9687aeba6850c03dfbce6ff9 Mon Sep 17 00:00:00 2001 From: Dan Cech Date: Mon, 7 May 2018 04:33:33 -0400 Subject: [PATCH] better handling for special chars in db config (#11662) --- pkg/services/sqlstore/sqlstore.go | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/pkg/services/sqlstore/sqlstore.go b/pkg/services/sqlstore/sqlstore.go index b804d8b1621..cac0c54226c 100644 --- a/pkg/services/sqlstore/sqlstore.go +++ b/pkg/services/sqlstore/sqlstore.go @@ -123,7 +123,7 @@ func getEngine() (*xorm.Engine, error) { } cnnstr = fmt.Sprintf("%s:%s@%s(%s)/%s?collation=utf8mb4_unicode_ci&allowNativePasswords=true", - DbCfg.User, DbCfg.Pwd, protocol, DbCfg.Host, DbCfg.Name) + url.QueryEscape(DbCfg.User), url.QueryEscape(DbCfg.Pwd), protocol, DbCfg.Host, url.PathEscape(DbCfg.Name)) if DbCfg.SslMode == "true" || DbCfg.SslMode == "skip-verify" { tlsCert, err := makeCert("custom", DbCfg) @@ -142,13 +142,17 @@ func getEngine() (*xorm.Engine, error) { if len(fields) > 1 && len(strings.TrimSpace(fields[1])) > 0 { port = fields[1] } - if DbCfg.Pwd == "" { - DbCfg.Pwd = "''" - } - if DbCfg.User == "" { - DbCfg.User = "''" - } - cnnstr = fmt.Sprintf("user=%s password=%s host=%s port=%s dbname=%s sslmode=%s sslcert=%s sslkey=%s sslrootcert=%s", DbCfg.User, DbCfg.Pwd, host, port, DbCfg.Name, DbCfg.SslMode, DbCfg.ClientCertPath, DbCfg.ClientKeyPath, DbCfg.CaCertPath) + cnnstr = fmt.Sprintf("user='%s' password='%s' host='%s' port='%s' dbname='%s' sslmode='%s' sslcert='%s' sslkey='%s' sslrootcert='%s'", + strings.Replace(DbCfg.User, `'`, `\'`, -1), + strings.Replace(DbCfg.Pwd, `'`, `\'`, -1), + strings.Replace(host, `'`, `\'`, -1), + strings.Replace(port, `'`, `\'`, -1), + strings.Replace(DbCfg.Name, `'`, `\'`, -1), + strings.Replace(DbCfg.SslMode, `'`, `\'`, -1), + strings.Replace(DbCfg.ClientCertPath, `'`, `\'`, -1), + strings.Replace(DbCfg.ClientKeyPath, `'`, `\'`, -1), + strings.Replace(DbCfg.CaCertPath, `'`, `\'`, -1), + ) case "sqlite3": if !filepath.IsAbs(DbCfg.Path) { DbCfg.Path = filepath.Join(setting.DataPath, DbCfg.Path)