Small cleanups in installer.

[fa-stable.git] / includes / db / connect_db_mysql.inc

diff --git a/includes/db/connect_db_mysql.inc b/includes/db/connect_db_mysql.inc
index f6417e4547fd03ea117a27893aeb0beb2543652c..8abdaa34f268e4cce6b934213abf645f6c0426ad 100644 (file)
--- a/includes/db/connect_db_mysql.inc
+++ b/includes/db/connect_db_mysql.inc
@@ -10,7 +10,7 @@
     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
 ***********************************************************************/
 define('DB_DUPLICATE_ERROR', 1062);
-define('SQL_MODE', ''); // STRICT_ALL_TABLES,NO_ZERO_IN_DATE ?
+define('SQL_MODE', 'STRICT_ALL_TABLES'); // prevents SQL injection with silent field content truncation
 
 function set_global_connection($company=-1)
 {
@@ -25,15 +25,19 @@ function set_global_connection($company=-1)
        $_SESSION["wa_current_user"]->cur_con = $company;
 
        $connection = $db_connections[$company];
+       
+       $server = $connection["host"];
+       if (!empty($connection["port"]))
+               $server .= ":".$connection["port"];
 
-       $db = mysql_connect($connection["host"], $connection["dbuser"], $connection["dbpassword"]);
-               mysql_select_db($connection["dbname"], $db);
+       $db = mysql_connect($server, $connection["dbuser"], $connection["dbpassword"]);
+       mysql_select_db($connection["dbname"], $db);
        ///// From MySql release 5.6.6 the sql_mode is no longer empty as it was prior to
        ///// this release. Just for safety we make it empty for all 5.6 release and higher.
        ///// This non empty sql_mode values can interphere with FA, so all is set empty during
        ///// our sessions.
        ///// We are, however, investigating the existing code to be compatible in the future.
-               db_query("SET sql_mode = '".SQL_MODE."'");
+       db_query("SET sql_mode = '".SQL_MODE."'");
        /////
        $SysPrefs->refresh();
        return $db;
@@ -47,7 +51,7 @@ function db_query($sql, $err_msg=null)
 
        // set current db prefix
        $comp = isset($_SESSION["wa_current_user"]->cur_con) ? $_SESSION["wa_current_user"]->cur_con : 0;
-       $cur_prefix = $db_connections[$comp]['tbpref'];
+       $cur_prefix = @$db_connections[$comp]['tbpref'];
        $sql = str_replace(TB_PREF, $cur_prefix, $sql);
 
        if ($SysPrefs->show_sql)
@@ -186,17 +190,33 @@ function db_field_name($result, $n)
        return mysql_field_name($result, $n);
 }
 
+function db_set_collation($db, $fa_collation)
+{
+       return mysql_query("ALTER DATABASE COLLATE ".get_mysql_collation($fa_collation), $db);
+}
+
+/*
+       Create database for FA company. If database already exists,
+       just set collation to be sure nothing weird will happen later.
+*/
 function db_create_db($connection)
 {
-       $db = mysql_connect($connection["host"] ,
-               $connection["dbuser"], $connection["dbpassword"]);
+       $server = $connection["host"];
+       if (!empty($connection["port"]))
+               $server .= ":".$connection["port"];
+       $db = mysql_connect($server, $connection["dbuser"], $connection["dbpassword"]);
 
        if (!mysql_select_db($connection["dbname"], $db))
        {
-               $sql = "CREATE DATABASE IF NOT EXISTS " . $connection["dbname"] . "";
+               $sql = "CREATE DATABASE IF NOT EXISTS `" . $connection["dbname"] . "`"
+                       . " DEFAULT COLLATE '" . get_mysql_collation($connection["collation"]) . "'";
+
                if (!mysql_query($sql) || !mysql_select_db($connection["dbname"], $db))
+                               return 0;
+       } else
+               if (!db_set_collation($connection["collation"], $db))
                        return 0;
-       }
+
        return $db;
 }