Re: [Dovecot] Bug in driver-mysql.c + fix

2010-03-13 Thread Timo Sirainen
On Wed, 2010-03-10 at 17:03 +, Alain Williams wrote: > > The problem with doing that is that 1) it's not normally necessary and > > more importantly 2) doing that makes any potential SQL injection > > security holes a lot easier to exploit. So I'm not all that eager in > > adding such code, esp

Re: [Dovecot] Bug in driver-mysql.c + fix

2010-03-10 Thread Alain Williams
On Wed, Mar 10, 2010 at 04:18:19PM +0200, Timo Sirainen wrote: > On Fri, 2010-03-05 at 23:44 +, Alain Williams wrote: ... > > This failed with the message: > > User query failed: PROCEDURE imap.user_info can't return a result set > > in the given context > > I thought it was possible to

Re: [Dovecot] Bug in driver-mysql.c + fix

2010-03-10 Thread Alain Williams
On Wed, Mar 10, 2010 at 04:23:23PM +0200, Timo Sirainen wrote: > On Wed, 2010-03-10 at 16:18 +0200, Timo Sirainen wrote: > > > password_query = CALL user_pass_check('%n', '%d', '%w') > > > > > > user_query = CALL user_info('%n', '%d') > > > > > > This failed with the message: > > > User que

Re: [Dovecot] Bug in driver-mysql.c + fix

2010-03-10 Thread Timo Sirainen
On Wed, 2010-03-10 at 16:18 +0200, Timo Sirainen wrote: > > password_query = CALL user_pass_check('%n', '%d', '%w') > > > > user_query = CALL user_info('%n', '%d') > > > > This failed with the message: > > User query failed: PROCEDURE imap.user_info can't return a result set > > in t

Re: [Dovecot] Bug in driver-mysql.c + fix

2010-03-10 Thread Timo Sirainen
Sorry, been busy + also this mail somehow got marked as read. On Fri, 2010-03-05 at 23:44 +, Alain Williams wrote: > I tried to use MySQL stored procedures from dovecot: > > password_query = CALL user_pass_check('%n', '%d', '%w') > > user_query = CALL user_info('%n', '%d') > > T

[Dovecot] Bug in driver-mysql.c + fix

2010-03-05 Thread Alain Williams
I tried to use MySQL stored procedures from dovecot: password_query = CALL user_pass_check('%n', '%d', '%w') user_query = CALL user_info('%n', '%d') This failed with the message: User query failed: PROCEDURE imap.user_info can't return a result set in the given context