[rpms/proftpd] epel8: Address another avenue for SQL injection, via custom SQLUserInfo queries

[rpms/proftpd] epel8: Address another avenue for SQL injection, via custom SQLUserInfo queries

[Paul Howarth]

            A new commit has been pushed.

            Repo   : rpms/proftpd
            Branch : epel8
            Commit : 7ed196d17f1869e55f9c2acbcd1025e96c5848a7
            Author : Paul Howarth <paul@city-fan.org>
            Date   : 2026-07-27T16:21:58+01:00
            Stats  : +41/-5 in 3 file(s)
            URL    : https://src.fedoraproject.org/rpms/proftpd/c/7ed196d17f1869e55f9c2acbcd1025e96c5848a7?branch=epel8

            Log:
            Address another avenue for SQL injection, via custom SQLUserInfo queries

https://github.com/proftpd/proftpd/issues/2052#issuecomment-4489110598

---
diff --git a/.gitignore b/.gitignore
index 697a1ba..6a03569 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,12 +1,13 @@
-# rawhide/f44/f43/f42/epel10
-# note: the v0.9.5.tar.gz is mod_proxy
-/proftpd-1.3.9a.tar.gz
+# rawhide/f44/f43/epel10
+/proftpd-1.3.9c.tar.gz
 /v0.9.12.tar.gz
-/v0.9.5.tar.gz
+/v0.9.7.tar.gz
+/v0.2.tar.gz
 # epel9
 /proftpd-1.3.8d.tar.gz
 /v0.9.11.tar.gz
 /v0.9.4.tar.gz
+/v0.2.tar.gz
 # epel8
 # note: the v0.9.5.tar.gz is mod_vroot
 /proftpd-1.3.6e.tar.gz

diff --git a/1a5ce646.patch b/1a5ce646.patch
new file mode 100644
index 0000000..e4a7168
--- /dev/null
+++ b/1a5ce646.patch
@@ -0,0 +1,27 @@
+From 1a5ce6467756e92f42f89c53f0f370dc0f0206d7 Mon Sep 17 00:00:00 2001
+From: TJ Saunders <tj@castaglia.org>
+Date: Tue, 19 May 2026 08:01:11 -0700
+Subject: [PATCH] Issue #2052: Address another avenue for SQL injection, via
+ custom SQLUserInfo queries.
+
+---
+ contrib/mod_sql.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/contrib/mod_sql.c b/contrib/mod_sql.c
+index b90725942..d28b483d1 100644
+--- a/contrib/mod_sql.c
++++ b/contrib/mod_sql.c
+@@ -1999,8 +1999,11 @@ static struct passwd *sql_getpasswd(cmd_rec *cmd, struct passwd *p) {
+       }
+ 
+     } else {
++      /* The username has been escaped according to the backend database' rules
++       * at this point.
++       */
+       mr = sql_lookup(sql_make_cmd(cmd->tmp_pool, 3, MOD_SQL_DEF_CONN_NAME,
+-        cmap.usercustom, realname ? realname : "NULL"));
++        cmap.usercustom, username ? username : "NULL"));
+ 
+       if (check_response(mr, 0) < 0) {
+         return NULL;

diff --git a/proftpd.spec b/proftpd.spec
index d2819ec..8b7a7b2 100644
--- a/proftpd.spec
+++ b/proftpd.spec
@@ -66,7 +66,7 @@
 %undefine _strict_symbol_defs_build
 
 #global prever rc3
-%global baserelease 10
+%global baserelease 11
 %global mod_vroot_version 0.9.5
 
 Summary:		Flexible, stable and highly-configurable FTP server
@@ -106,6 +106,7 @@ Patch117:		proftpd-1.3.6e-bug4307.patch
 Patch118:		proftpd-1.3.6e-issue1840.patch
 Patch119:		https://github.com/proftpd/proftpd/commit/07797aba.patch
 Patch120:		https://github.com/proftpd/proftpd/commit/5e06acc4.patch
+Patch121:		https://github.com/proftpd/proftpd/commit/1a5ce646.patch
 
 BuildRequires:		coreutils
 BuildRequires:		gcc
@@ -382,6 +383,9 @@ mv contrib/README contrib/README.contrib
 sed -i -e '/^[[:space:]]*TLSCipherSuite[[:space:]]*PROFILE=SYSTEM$/d' mod_tls.conf
 %endif
 
+# Address another avenue for SQL injection, via custom SQLUserInfo queries
+%patch -P 121 -p1
+
 %if %{use_systemd}
 # Tweak logrotate script for systemd compatibility (#802178)
 sed -i -e '/killall/s/test.*/systemctl reload proftpd.service/' \
@@ -664,6 +668,10 @@ fi
 %{_mandir}/man1/ftpwho.1*
 
 %changelog
+* Mon Jul 27 2026 Paul Howarth <paul@city-fan.org> - 1.3.6e-11
+- Address another avenue for SQL injection, via custom SQLUserInfo queries
+  (https://github.com/proftpd/proftpd/issues/2052#issuecomment-4489110598)
+
 * Mon May 11 2026 Paul Howarth <paul@city-fan.org> - 1.3.6e-10
 - Fix for SQL Injection in mod_wrap2_sql via reverse DNS hostname
   (CVE-2026-44331, rhbz#2466899, https://github.com/proftpd/proftpd/issues/2057)