[rpms/proftpd] epel9: Address another avenue for SQL injection, via custom SQLUserInfo queries

[rpms/proftpd] epel9: Address another avenue for SQL injection, via custom SQLUserInfo queries

[Paul Howarth]

            A new commit has been pushed.

            Repo   : rpms/proftpd
            Branch : epel9
            Commit : 44bc5cb74fc8bd72740143787cd5831fe57764e1
            Author : Paul Howarth <paul@city-fan.org>
            Date   : 2026-07-22T14:53:12+01:00
            Stats  : +36/-1 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/proftpd/c/44bc5cb74fc8bd72740143787cd5831fe57764e1?branch=epel9

            Log:
            Address another avenue for SQL injection, via custom SQLUserInfo queries

https://github.com/proftpd/proftpd/issues/2052#issuecomment-4489110598

---
diff --git a/1a5ce646.patch b/1a5ce646.patch
new file mode 100644
index 0000000..e4a7168
--- /dev/null
+++ b/1a5ce646.patch
@@ -0,0 +1,27 @@
+From 1a5ce6467756e92f42f89c53f0f370dc0f0206d7 Mon Sep 17 00:00:00 2001
+From: TJ Saunders <tj@castaglia.org>
+Date: Tue, 19 May 2026 08:01:11 -0700
+Subject: [PATCH] Issue #2052: Address another avenue for SQL injection, via
+ custom SQLUserInfo queries.
+
+---
+ contrib/mod_sql.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/contrib/mod_sql.c b/contrib/mod_sql.c
+index b90725942..d28b483d1 100644
+--- a/contrib/mod_sql.c
++++ b/contrib/mod_sql.c
+@@ -1999,8 +1999,11 @@ static struct passwd *sql_getpasswd(cmd_rec *cmd, struct passwd *p) {
+       }
+ 
+     } else {
++      /* The username has been escaped according to the backend database' rules
++       * at this point.
++       */
+       mr = sql_lookup(sql_make_cmd(cmd->tmp_pool, 3, MOD_SQL_DEF_CONN_NAME,
+-        cmap.usercustom, realname ? realname : "NULL"));
++        cmap.usercustom, username ? username : "NULL"));
+ 
+       if (check_response(mr, 0) < 0) {
+         return NULL;

diff --git a/proftpd.spec b/proftpd.spec
index 9cdf584..c2b4815 100644
--- a/proftpd.spec
+++ b/proftpd.spec
@@ -38,7 +38,7 @@
 %undefine _strict_symbol_defs_build
 
 #global prever rc4
-%global baserelease 3
+%global baserelease 4
 %global mod_proxy_version 0.9.4
 %global mod_vroot_version 0.9.11
 
@@ -72,6 +72,7 @@ Patch21:		https://github.com/proftpd/proftpd/commit/04d89957.patch
 Patch22:		https://github.com/proftpd/proftpd/commit/7e076e84.patch
 Patch23:		https://github.com/proftpd/proftpd/commit/07797aba.patch
 Patch24:		https://github.com/proftpd/proftpd/commit/5e06acc4.patch
+Patch25:		https://github.com/proftpd/proftpd/commit/1a5ce646.patch
 
 BuildRequires:		coreutils
 BuildRequires:		gcc
@@ -306,6 +307,9 @@ sed -i -e '/^[[:space:]]*TLSCipherSuite[[:space:]]*PROFILE=SYSTEM$/d' mod_tls.co
 %patch -P 23 -p1
 %patch -P 24 -p1
 
+# Address another avenue for SQL injection, via custom SQLUserInfo queries
+%patch -P 25 -p1
+
 # Tweak logrotate script for systemd compatibility (#802178)
 %if (0%{?rhel} && 0%{?rhel} <= 7) || (0%{?fedora} && 0%{?fedora} <= 23)
 sed -i -e '/killall/s/test.*/systemctl reload proftpd.service/' \
@@ -552,6 +556,10 @@ fi
 %{_mandir}/man1/ftpwho.1*
 
 %changelog
+* Wed Jul 22 2026 Paul Howarth <paul@city-fan.org> - 1.3.8d-4
+- Address another avenue for SQL injection, via custom SQLUserInfo queries
+  (https://github.com/proftpd/proftpd/issues/2052#issuecomment-4489110598)
+
 * Mon May 11 2026 Paul Howarth <paul@city-fan.org> - 1.3.8d-3
 - Additional escaping for avoidance of SQL injection issues with %%{note:...}
   and %%{env:...}; these are on top of the existing fix for CVE-2026-42167 in