quote/escape PG connection parameters

diff --git a/docs/upgrading.rst b/docs/upgrading.rst
index a6c5a53de998864c8fa6bc7d8e7e701914ddd6f2..f68edf305432b0a6e6e9bc948c17816b5abf1d51 100644 (file)
--- a/docs/upgrading.rst
+++ b/docs/upgrading.rst
@@ -17,6 +17,12 @@ upgrade notes if your version is older than 3.4.2.
 The in-database format of the ``IPSECKEY`` has changed from 'generic' format to its specialized format.
 It is recommended to re-transfer, using ``pdns_control retrieve ZONE``, all zones that have ``IPSECKEY`` or ``TYPE45`` records.
 
+PostgreSQL configuration escaping
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+We now correctly quote/escape Postgres connection parameters.
+If you used single quotes around your Postgres password because it contained spaces, you now need to remove those quotes.
+
 4.3.0 to 4.3.1
 --------------
 

diff --git a/modules/gpgsqlbackend/spgsql.cc b/modules/gpgsqlbackend/spgsql.cc
index fe6e06517aeb54b0dcb372b8e35f941eafc47146..26aa3b9fbd25147d8bf04ffe2a3b4f7fa6460ad2 100644 (file)
--- a/modules/gpgsqlbackend/spgsql.cc
+++ b/modules/gpgsqlbackend/spgsql.cc
@@ -277,6 +277,15 @@ private:
 
 bool SPgSQL::s_dolog;
 
+static string escapeForPQparam(const string &v)
+{
+  string ret = v;
+  boost::replace_all(ret, "\\", "\\\\");
+  boost::replace_all(ret, "'", "\\'");
+
+  return string("'")+ret+string("'");
+}
+
 SPgSQL::SPgSQL(const string &database, const string &host, const string& port, const string &user,
                const string &password, const string &extra_connection_parameters, const bool use_prepared)
 {
@@ -286,16 +295,16 @@ SPgSQL::SPgSQL(const string &database, const string &host, const string& port, c
   d_nstatements = 0;
 
   if (!database.empty())
-    d_connectstr+="dbname="+database;
+    d_connectstr+="dbname="+escapeForPQparam(database);
 
   if (!user.empty())
-    d_connectstr+=" user="+user;
+    d_connectstr+=" user="+escapeForPQparam(user);
 
   if(!host.empty())
-    d_connectstr+=" host="+host;
+    d_connectstr+=" host="+escapeForPQparam(host);
 
   if(!port.empty())
-    d_connectstr+=" port="+port;
+    d_connectstr+=" port="+escapeForPQparam(port);
 
   if(!extra_connection_parameters.empty())
     d_connectstr+=" " + extra_connection_parameters;
@@ -304,7 +313,7 @@ SPgSQL::SPgSQL(const string &database, const string &host, const string& port, c
 
   if(!password.empty()) {
     d_connectlogstr+=" password=<HIDDEN>";
-    d_connectstr+=" password="+password;
+    d_connectstr+=" password="+escapeForPQparam(password);
   }
 
   d_use_prepared = use_prepared;