public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Paul Howarth <paul@city-fan.org>
To: git-commits@fedoraproject.org
Subject: [rpms/proftpd] epel10.2: Fix regression in mod_sql's SQLNamedQuery (upstream bug 4515, GH#2293)
Date: Mon, 24 Aug 2026 18:50:14 GMT [thread overview]
Message-ID: <178759741440.1.5192625813635822530.rpms-proftpd-dea6a273f567@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : rpms/proftpd
Branch : epel10.2
Commit : dea6a273f567b7cc711dd45e83fee97008a15c0a
Author : Paul Howarth <paul@city-fan.org>
Date : 2026-08-24T19:04:04+01:00
Stats : +173/-1 in 2 file(s)
URL : https://src.fedoraproject.org/rpms/proftpd/c/dea6a273f567b7cc711dd45e83fee97008a15c0a?branch=epel10.2
Log:
Fix regression in mod_sql's SQLNamedQuery (upstream bug 4515, GH#2293)
---
diff --git a/ca9a7469.patch b/ca9a7469.patch
new file mode 100644
index 0000000..e6cb111
--- /dev/null
+++ b/ca9a7469.patch
@@ -0,0 +1,164 @@
+From ca9a7469ced3a7baf8ab9cc97f7c6b4c5ee3de75 Mon Sep 17 00:00:00 2001
+From: TJ Saunders <tj@castaglia.org>
+Date: Thu, 20 Aug 2026 10:43:43 -0700
+Subject: [PATCH] Issue #2293: Mark these internally-generated SQL lookups
+ explicitly, so that they pass the implemented restrictions for resolving
+ numeric variables in SQL statements.
+
+This restores the previously working behavior of `SQLNamedQuery` statements using numeric variables to provide custom user/group information.
+---
+ contrib/mod_sql.c | 36 ++++++++++++++++++------------------
+ 1 file changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/contrib/mod_sql.c b/contrib/mod_sql.c
+index 2d78a64b5..9a7c22be9 100644
+--- a/contrib/mod_sql.c
++++ b/contrib/mod_sql.c
+@@ -1803,7 +1803,7 @@ static int sql_getuserprimarykey(cmd_rec *cmd, const char *username) {
+ }
+
+ } else {
+- mr = sql_lookup(sql_make_cmd(cmd->tmp_pool, 3, MOD_SQL_DEF_CONN_NAME, ptr,
++ mr = sql_lookup(sql_make_cmd(cmd->tmp_pool, 3, "sql_lookup", ptr,
+ username));
+ if (check_response(mr, 0) < 0) {
+ return -1;
+@@ -1898,7 +1898,7 @@ static int sql_getgroupprimarykey(cmd_rec *cmd, const char *groupname) {
+ }
+
+ } else {
+- mr = sql_lookup(sql_make_cmd(cmd->tmp_pool, 3, MOD_SQL_DEF_CONN_NAME, ptr,
++ mr = sql_lookup(sql_make_cmd(cmd->tmp_pool, 3, "sql_lookup", ptr,
+ groupname));
+ if (check_response(mr, 0) < 0) {
+ return -1;
+@@ -2004,7 +2004,7 @@ static struct passwd *sql_getpasswd(cmd_rec *cmd, struct passwd *p) {
+
+ sql_log(DEBUG_WARN, "cache miss for user '%s'", realname);
+
+- if (!cmap.usercustom) {
++ if (cmap.usercustom == NULL) {
+ /* The following nested function calls may look a little strange, but
+ * it is deliberate. We want to handle any tags/variables within the
+ * cmap.userwhere string (i.e. the SQLUserWhereClause directive, if
+@@ -2031,7 +2031,7 @@ static struct passwd *sql_getpasswd(cmd_rec *cmd, struct passwd *p) {
+ /* The username has been escaped according to the backend database' rules
+ * at this point.
+ */
+- mr = sql_lookup(sql_make_cmd(cmd->tmp_pool, 3, MOD_SQL_DEF_CONN_NAME,
++ mr = sql_lookup(sql_make_cmd(cmd->tmp_pool, 3, "sql_lookup",
+ cmap.usercustom, username ? username : "NULL"));
+
+ if (check_response(mr, 0) < 0) {
+@@ -2066,8 +2066,8 @@ static struct passwd *sql_getpasswd(cmd_rec *cmd, struct passwd *p) {
+ uidstr = pr_uid2str(cmd->tmp_pool, p->pw_uid);
+ sql_log(DEBUG_WARN, "cache miss for UID '%s'", uidstr);
+
+- if (!cmap.usercustombyid) {
+- if (cmap.uidfield) {
++ if (cmap.usercustombyid == NULL) {
++ if (cmap.uidfield != NULL) {
+ usrwhere = pstrcat(cmd->tmp_pool, cmap.uidfield, " = ", uidstr, NULL);
+
+ where = sql_prepare_where(SQL_PREPARE_WHERE_FL_NO_TAGS, cmd, 2,
+@@ -2097,7 +2097,7 @@ static struct passwd *sql_getpasswd(cmd_rec *cmd, struct passwd *p) {
+ } else {
+ array_header *ah = NULL;
+
+- mr = sql_lookup(sql_make_cmd(cmd->tmp_pool, 3, MOD_SQL_DEF_CONN_NAME,
++ mr = sql_lookup(sql_make_cmd(cmd->tmp_pool, 3, "sql_lookup",
+ cmap.usercustombyid, uidstr));
+ if (check_response(mr, 0) < 0) {
+ return NULL;
+@@ -2337,8 +2337,8 @@ static struct group *sql_getgroup(cmd_rec *cmd, struct group *g) {
+
+ sql_log(DEBUG_WARN, "cache miss for GID '%s'", gidstr);
+
+- if (!cmap.groupcustombyid) {
+- if (cmap.grpgidfield) {
++ if (cmap.groupcustombyid == NULL) {
++ if (cmap.grpgidfield != NULL) {
+ grpwhere = pstrcat(cmd->tmp_pool, cmap.grpgidfield, " = ", gidstr,
+ NULL);
+
+@@ -2364,7 +2364,7 @@ static struct group *sql_getgroup(cmd_rec *cmd, struct group *g) {
+ sd = (sql_data_t *) mr->data;
+
+ } else {
+- mr = sql_lookup(sql_make_cmd(cmd->tmp_pool, 3, MOD_SQL_DEF_CONN_NAME,
++ mr = sql_lookup(sql_make_cmd(cmd->tmp_pool, 3, "sql_lookup",
+ cmap.groupcustombyid, gidstr));
+ if (check_response(mr, 0) < 0) {
+ return NULL;
+@@ -2397,7 +2397,7 @@ static struct group *sql_getgroup(cmd_rec *cmd, struct group *g) {
+ * at this point.
+ */
+
+- if (!cmap.groupcustombyname) {
++ if (cmap.groupcustombyname == NULL) {
+ grpwhere = pstrcat(cmd->tmp_pool, cmap.grpfield, " = '", groupname, "'",
+ NULL);
+
+@@ -2413,7 +2413,7 @@ static struct group *sql_getgroup(cmd_rec *cmd, struct group *g) {
+ sd = (sql_data_t *) mr->data;
+
+ } else {
+- mr = sql_lookup(sql_make_cmd(cmd->tmp_pool, 3, MOD_SQL_DEF_CONN_NAME,
++ mr = sql_lookup(sql_make_cmd(cmd->tmp_pool, 3, "sql_lookup",
+ cmap.groupcustombyname, groupname ? groupname : "NULL"));
+ if (check_response(mr, 0) < 0) {
+ return NULL;
+@@ -2574,7 +2574,7 @@ static int sql_getgroups(cmd_rec *cmd) {
+
+ username = (char *) mr->data;
+
+- if (!cmap.groupcustommembers) {
++ if (cmap.groupcustommembers == NULL) {
+ if (!(pr_sql_opts & SQL_OPT_USE_NORMALIZED_GROUP_SCHEMA)) {
+
+ /* Use a SELECT with a LIKE clause:
+@@ -2616,7 +2616,7 @@ static int sql_getgroups(cmd_rec *cmd) {
+ /* The username has been escaped according to the backend database' rules
+ * at this point.
+ */
+- mr = sql_lookup(sql_make_cmd(cmd->tmp_pool, 3, MOD_SQL_DEF_CONN_NAME,
++ mr = sql_lookup(sql_make_cmd(cmd->tmp_pool, 3, "sql_lookup",
+ cmap.groupcustommembers, username));
+ if (check_response(mr, 0) < 0) {
+ cmd->argc = argc;
+@@ -3771,7 +3771,7 @@ MODRET sql_auth_setpwent(cmd_rec *cmd) {
+ sd = (sql_data_t *) mr->data;
+
+ } else {
+- mr = sql_lookup(sql_make_cmd(cmd->tmp_pool, 2, MOD_SQL_DEF_CONN_NAME,
++ mr = sql_lookup(sql_make_cmd(cmd->tmp_pool, 2, "sql_lookup",
+ cmap.usercustomusersetfast));
+ if (check_response(mr, 0) < 0) {
+ return mr;
+@@ -3881,7 +3881,7 @@ MODRET sql_auth_setpwent(cmd_rec *cmd) {
+ sd = (sql_data_t *) mr->data;
+
+ } else {
+- mr = sql_lookup(sql_make_cmd(cmd->tmp_pool, 2, MOD_SQL_DEF_CONN_NAME,
++ mr = sql_lookup(sql_make_cmd(cmd->tmp_pool, 2, "sql_lookup",
+ cmap.usercustomuserset));
+ if (check_response(mr, 0) < 0) {
+ return mr;
+@@ -4017,7 +4017,7 @@ MODRET sql_auth_setgrent(cmd_rec *cmd) {
+ sd = (sql_data_t *) mr->data;
+
+ } else {
+- mr = sql_lookup(sql_make_cmd(cmd->tmp_pool, 2, MOD_SQL_DEF_CONN_NAME,
++ mr = sql_lookup(sql_make_cmd(cmd->tmp_pool, 2, "sql_lookup",
+ cmap.groupcustomgroupsetfast));
+ if (check_response(mr, 0) < 0) {
+ return mr;
+@@ -4079,7 +4079,7 @@ MODRET sql_auth_setgrent(cmd_rec *cmd) {
+ sd = (sql_data_t *) mr->data;
+
+ } else {
+- mr = sql_lookup(sql_make_cmd(cmd->tmp_pool, 2, MOD_SQL_DEF_CONN_NAME,
++ mr = sql_lookup(sql_make_cmd(cmd->tmp_pool, 2, "sql_lookup",
+ cmap.groupcustomgroupset));
+ if (check_response(mr, 0) < 0) {
+ return mr;
diff --git a/proftpd.spec b/proftpd.spec
index bc7a81f..24c03c3 100644
--- a/proftpd.spec
+++ b/proftpd.spec
@@ -17,7 +17,7 @@
%undefine _strict_symbol_defs_build
#global prever rc4
-%global baserelease 1
+%global baserelease 2
%global mod_procfs_version 0.3
%global mod_proxy_version 0.9.7
%global mod_vroot_version 0.9.12
@@ -45,6 +45,7 @@ Source12: http://github.com/Castaglia/proftpd-mod_procfs/archive/v%{mod_procfs_
Patch1: proftpd-1.3.8-shellbang.patch
Patch2: mod_proxy-certificate.patch
Patch3: proftpd-1.3.4rc1-mod_vroot-test.patch
+Patch6: https://github.com/proftpd/proftpd/commit/ca9a7469.patch
BuildRequires: coreutils
BuildRequires: gcc
@@ -229,6 +230,10 @@ mv contrib/README contrib/README.contrib
# If we're running the full test suite, include the mod_vroot test
%patch -P 3 -p1 -b .test_vroot
+# Fix regression in mod_sql's SQLNamedQuery (upstream bug 4515)
+# https://github.com/proftpd/proftpd/issues/2293
+%patch -P 6 -p1
+
# Tweak logrotate script for systemd compatibility (#802178)
sed -i -e '/killall/s/test.*/systemctl try-reload-or-restart proftpd.service/' \
contrib/dist/rpm/proftpd.logrotate
@@ -468,6 +473,9 @@ fi
%{_mandir}/man1/ftpwho.1*
%changelog
+* Mon Aug 24 2026 Paul Howarth <paul@city-fan.org> - 1.3.9d-2
+- Fix regression in mod_sql's SQLNamedQuery (upstream bug 4515, GH#2293)
+
* Tue Aug 18 2026 Paul Howarth <paul@city-fan.org> - 1.3.9d-1
- Update to 1.3.9d
- SSH channel open request from authenticated client with max packet size of
reply other threads:[~2026-08-24 18:50 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178759741440.1.5192625813635822530.rpms-proftpd-dea6a273f567@fedoraproject.org \
--to=paul@city-fan.org \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox