From 3619b6e9f63fd0c1352a3eeddb8339e1bc362e57 Mon Sep 17 00:00:00 2001
From: "myk%mozilla.org" <>
Date: Sat, 9 Nov 2002 09:23:06 +0000
Subject: Fix for bug 178841: removes full paths from filenames in attachments
 table and prevents them from appearing again r=gerv,bbaetz a=justdave

---
 checksetup.pl | 34 +++++++++++++++++++++++++++++++++-
 1 file changed, 33 insertions(+), 1 deletion(-)

(limited to 'checksetup.pl')

diff --git a/checksetup.pl b/checksetup.pl
index aa91c3a34..cd02538b3 100755
--- a/checksetup.pl
+++ b/checksetup.pl
@@ -1353,7 +1353,7 @@ $table{attachments} =
     description mediumtext not null,
     mimetype mediumtext not null,
     ispatch tinyint,
-    filename mediumtext not null,
+    filename varchar(100) not null,
     thedata longblob not null,
     submitter_id mediumint not null,
     isobsolete tinyint not null default 0, 
@@ -3737,6 +3737,38 @@ if ($sth->rows == 0) {
 }
 
 
+# 2002 November, myk@mozilla.org, bug 178841:
+#
+# Convert the "attachments.filename" column from a ridiculously large
+# "mediumtext" to a much more sensible "varchar(100)".  Also takes
+# the opportunity to remove paths from existing filenames, since they 
+# shouldn't be there for security.  Buggy browsers include them, 
+# and attachment.cgi now takes them out, but old ones need converting.
+#
+{
+    my $ref = GetFieldDef("attachments", "filename");
+    if ($ref->[1] ne 'varchar(100)') {
+        print "Removing paths from filenames in attachments table...\n";
+        
+        $sth = $dbh->prepare("SELECT attach_id, filename FROM attachments " . 
+                             "WHERE INSTR(filename, '/') " . 
+                             "OR INSTR(filename, '\\\\')");
+        $sth->execute;
+        
+        while (my ($attach_id, $filename) = $sth->fetchrow_array) {
+            $filename =~ s/^.*[\/\\]//;
+            my $quoted_filename = $dbh->quote($filename);
+            $dbh->do("UPDATE attachments SET filename = $quoted_filename " . 
+                     "WHERE attach_id = $attach_id");
+        }
+        
+        print "Done.\n";
+        
+        print "Resizing attachments.filename from mediumtext to varchar(100).\n";
+        ChangeFieldType("attachments", "filename", "varchar(100) not null");
+    }
+}
+
 
 #
 # Final checks...
-- 
cgit v1.2.3-24-g4f1b