php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 08:12:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix GH-12423: Changed to prioritize DSN authentication information over arguments.

Browse Source 
Added connection test

Close GH-12424
This commit is contained in:
SakiTakamachi
2023-10-12 10:35:42 +09:00
committed by David Carlier
parent 5465cea8c8
commit b5c287e4b4
4 changed files with 88 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
NEWS
View File

@@ -16,6 +16,10 @@ Intl:
Opcache:
. Added large shared segments support for FreeBSD. (David Carlier)
PDO_PGSQL:
. Fixed GH-12423, DSN credentials being prioritized over the user/password
PDO constructor arguments. (SakiTakamachi)
PGSQL:
. Added the possibility to have no conditions for pg_select. (OmarEmaraDev)

4
UPGRADING
View File

@@ -26,6 +26,10 @@ PHP 8.4 UPGRADE NOTES
Consult sections 2. New Features and 6. New Functions for a list of
newly implemented methods and constants.
- PDO_PGSQL:
. The DSN's credentials, when set, are given priority over their PDO
constructor counterparts, being closer to the documentation states.
- SimpleXML:
. Get methods called, or casting to a string on a SimpleXMLElement will no
longer implicitly reset the iterator data, unless explicitly rewound.

4
ext/pdo_pgsql/pgsql_driver.c
View File

@@ -1281,8 +1281,8 @@ static int pdo_pgsql_handle_factory(pdo_dbh_t *dbh, zval *driver_options) /* {{{
}
/* escape username and password, if provided */
tmp_user = _pdo_pgsql_escape_credentials(dbh->username);
tmp_pass = _pdo_pgsql_escape_credentials(dbh->password);
tmp_user = !strstr((char *) dbh->data_source, "user=") ? _pdo_pgsql_escape_credentials(dbh->username) : NULL;
tmp_pass = !strstr((char *) dbh->data_source, "password=") ? _pdo_pgsql_escape_credentials(dbh->password) : NULL;
/* support both full connection string & connection string + login and/or password */
if (tmp_user && tmp_pass) {

78
ext/pdo_pgsql/tests/gh12423.phpt Normal file
View File

@@ -0,0 +1,78 @@
--TEST--
GitHub #12424 (Fix GH-12423: [pdo_pgsql] Changed to prioritize DSN authentication information over arguments.)
--SKIPIF--
<?php
if (!extension_loaded('pdo') || !extension_loaded('pdo_pgsql')) die('skip not loaded');
require __DIR__ . '/../../../ext/pdo/tests/pdo_test.inc';
require __DIR__ . '/config.inc';
PDOTest::skip();
?>
--FILE--
<?php
require __DIR__ . '/config.inc';
[
'ENV' => [
'PDOTEST_DSN' => $dsnWithCredentials,
'PDOTEST_USER' => $user,
'PDOTEST_PASS' => $password,
],
] = __DIR__ . '/common.phpt';
$dsn = str_replace(" user={$user} password={$password}", '', $dsnWithCredentials);
echo "dsn without credentials / correct user / correct password\n";
try {
$db = new PDO($dsn, $user, $password, [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
echo "Connected.\n\n";
} catch (PDOException $e) {
echo $e->getMessage();
}
echo "dsn with credentials / no user / no password\n";
try {
$db = new PDO("{$dsn} user={$user} password={$password}", null, null, [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
echo "Connected.\n\n";
} catch (PDOException $e) {
echo $e->getMessage();
}
echo "dsn with correct user / incorrect user / correct password\n";
try {
$db = new PDO("{$dsn} user={$user}", 'hoge', $password, [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
echo "Connected.\n\n";
} catch (PDOException $e) {
echo $e->getMessage();
}
echo "dsn with correct password / correct user / incorrect password\n";
try {
$db = new PDO("{$dsn} password={$password}", $user, 'fuga', [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
echo "Connected.\n\n";
} catch (PDOException $e) {
echo $e->getMessage();
}
echo "dsn with correct credentials / incorrect user / incorrect password\n";
try {
$db = new PDO("{$dsn} user={$user} password={$password}", 'hoge', 'fuga', [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
echo "Connected.\n";
} catch (PDOException $e) {
echo $e->getMessage();
}
?>
--EXPECT--
dsn without credentials / correct user / correct password
Connected.
dsn with credentials / no user / no password
Connected.
dsn with correct user / incorrect user / correct password
Connected.
dsn with correct password / correct user / incorrect password
Connected.
dsn with correct credentials / incorrect user / incorrect password
Connected.