X-Git-Url: https://delta.frontaccounting.com/gitweb/?a=blobdiff_plain;f=includes%2Fdb%2Fconnect_db_mysql.inc;h=4be5a295e5481a280d2dd1d6611e18eb4c497de3;hb=2bcdab793e406bb5a44d2c4e079ec7cc2a1aa857;hp=56e36a0ae9d95650b05c7c8f7cae3ff2328067c5;hpb=95ff74b5722826544743a01daf527aa3c9efe11a;p=fa-stable.git

diff --git a/includes/db/connect_db_mysql.inc b/includes/db/connect_db_mysql.inc
index 56e36a0a..4be5a295 100644
--- a/includes/db/connect_db_mysql.inc
+++ b/includes/db/connect_db_mysql.inc
@@ -10,7 +10,7 @@
     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
 ***********************************************************************/
 define('DB_DUPLICATE_ERROR', 1062);
-define('SQL_MODE', ''); // STRICT_ALL_TABLES,NO_ZERO_IN_DATE ?
+define('SQL_MODE', 'STRICT_ALL_TABLES'); // prevents SQL injection with silent field content truncation
 
 function set_global_connection($company=-1)
 {
@@ -25,9 +25,13 @@ function set_global_connection($company=-1)
 	$_SESSION["wa_current_user"]->cur_con = $company;
 
 	$connection = $db_connections[$company];
+	
+	$server = $connection["host"];
+	if (!empty($connection["port"]))
+		$server .= ":".$connection["port"];
 
-	$db = mysql_connect($connection["host"], $connection["dbuser"], $connection["dbpassword"]);
-		mysql_select_db($connection["dbname"], $db);
+	$db = mysql_connect($server, $connection["dbuser"], $connection["dbpassword"]);
+	mysql_select_db($connection["dbname"], $db);
 	///// From MySql release 5.6.6 the sql_mode is no longer empty as it was prior to
 	///// this release. Just for safety we make it empty for all 5.6 release and higher.
 	///// This non empty sql_mode values can interphere with FA, so all is set empty during
@@ -197,8 +201,10 @@ function db_set_collation($db, $fa_collation)
 */
 function db_create_db($connection)
 {
-	$db = mysql_connect($connection["host"] ,
-		$connection["dbuser"], $connection["dbpassword"]);
+	$server = $connection["host"];
+	if (!empty($connection["port"]))
+		$server .= ":".$connection["port"];
+	$db = mysql_connect($server, $connection["dbuser"], $connection["dbpassword"]);
 
 	if (!mysql_select_db($connection["dbname"], $db))
 	{