FS-6220 fix sql quoting of queries from mod_skinny

diff --git a/src/mod/endpoints/mod_skinny/mod_skinny.c b/src/mod/endpoints/mod_skinny/mod_skinny.c
index cc94f1129ffec3e72eeb65a74f9c29ad319df4c7..f31be6ae96ba823848786b70ebe1a5ead18f6176 100644 (file)
--- a/src/mod/endpoints/mod_skinny/mod_skinny.c
+++ b/src/mod/endpoints/mod_skinny/mod_skinny.c
@@ -954,7 +954,7 @@ switch_status_t channel_on_hangup(switch_core_session_t *session)
 
        skinny_session_walk_lines(tech_pvt->profile, switch_core_session_get_uuid(session), channel_on_hangup_callback, &helper);
        if ((sql = switch_mprintf(
-                                       "DELETE FROM skinny_active_lines WHERE channel_uuid='%s'",
+                                       "DELETE FROM skinny_active_lines WHERE channel_uuid='%q'",
                                        switch_core_session_get_uuid(session)
                                 ))) {
                skinny_execute_sql(tech_pvt->profile, sql, tech_pvt->profile->sql_mutex);
@@ -1404,7 +1404,7 @@ void skinny_clean_device_from_db(listener_t *listener, char *device_name)
 
                if ((sql = switch_mprintf(
                                                "DELETE FROM skinny_devices "
-                                               "WHERE name='%s'",
+                                               "WHERE name='%q'",
                                                device_name))) {
                        skinny_execute_sql(profile, sql, profile->sql_mutex);
                        switch_safe_free(sql);
@@ -1412,7 +1412,7 @@ void skinny_clean_device_from_db(listener_t *listener, char *device_name)
 
                if ((sql = switch_mprintf(
                                                "DELETE FROM skinny_lines "
-                                               "WHERE device_name='%s'",
+                                               "WHERE device_name='%q'",
                                                device_name))) {
                        skinny_execute_sql(profile, sql, profile->sql_mutex);
                        switch_safe_free(sql);
@@ -1420,7 +1420,7 @@ void skinny_clean_device_from_db(listener_t *listener, char *device_name)
 
                if ((sql = switch_mprintf(
                                                "DELETE FROM skinny_buttons "
-                                               "WHERE device_name='%s'",
+                                               "WHERE device_name='%q'",
                                                device_name))) {
                        skinny_execute_sql(profile, sql, profile->sql_mutex);
                        switch_safe_free(sql);
@@ -1428,7 +1428,7 @@ void skinny_clean_device_from_db(listener_t *listener, char *device_name)
 
                if ((sql = switch_mprintf(
                                                "DELETE FROM skinny_active_lines "
-                                               "WHERE device_name='%s'",
+                                               "WHERE device_name='%q'",
                                                device_name))) {
                        skinny_execute_sql(profile, sql, profile->sql_mutex);
                        switch_safe_free(sql);
@@ -1452,7 +1452,7 @@ void skinny_clean_listener_from_db(listener_t *listener)
 
                if ((sql = switch_mprintf(
                                                "DELETE FROM skinny_devices "
-                                               "WHERE name='%s' and instance=%d",
+                                               "WHERE name='%q' and instance=%d",
                                                listener->device_name, listener->device_instance))) {
                        skinny_execute_sql(profile, sql, profile->sql_mutex);
                        switch_safe_free(sql);
@@ -1460,7 +1460,7 @@ void skinny_clean_listener_from_db(listener_t *listener)
 
                if ((sql = switch_mprintf(
                                                "DELETE FROM skinny_lines "
-                                               "WHERE device_name='%s' and device_instance=%d",
+                                               "WHERE device_name='%q' and device_instance=%d",
                                                listener->device_name, listener->device_instance))) {
                        skinny_execute_sql(profile, sql, profile->sql_mutex);
                        switch_safe_free(sql);
@@ -1468,7 +1468,7 @@ void skinny_clean_listener_from_db(listener_t *listener)
 
                if ((sql = switch_mprintf(
                                                "DELETE FROM skinny_buttons "
-                                               "WHERE device_name='%s' and device_instance=%d",
+                                               "WHERE device_name='%q' and device_instance=%d",
                                                listener->device_name, listener->device_instance))) {
                        skinny_execute_sql(profile, sql, profile->sql_mutex);
                        switch_safe_free(sql);
@@ -1476,7 +1476,7 @@ void skinny_clean_listener_from_db(listener_t *listener)
 
                if ((sql = switch_mprintf(
                                                "DELETE FROM skinny_active_lines "
-                                               "WHERE device_name='%s' and device_instance=%d",
+                                               "WHERE device_name='%q' and device_instance=%d",
                                                listener->device_name, listener->device_instance))) {
                        skinny_execute_sql(profile, sql, profile->sql_mutex);
                        switch_safe_free(sql);
@@ -2266,8 +2266,8 @@ static void skinny_call_state_event_handler(switch_event_t *event)
                                if ((sql = switch_mprintf(
                                                                "UPDATE skinny_active_lines "
                                                                "SET call_state=%d "
-                                                               "WHERE device_name='%s' AND device_instance=%d "
-                                                               "AND %s AND %s",
+                                                               "WHERE device_name='%q' AND device_instance=%d "
+                                                               "AND %q AND %q",
                                                                call_state,
                                                                listener->device_name, listener->device_instance,
                                                                line_instance_condition, call_id_condition

diff --git a/src/mod/endpoints/mod_skinny/skinny_server.c b/src/mod/endpoints/mod_skinny/skinny_server.c
index 9baaa197a60c430eff247e25a73b1e0cb4917b26..13ffaac7fcd8dfd9558a7abaecd83747ac762d9c 100644 (file)
--- a/src/mod/endpoints/mod_skinny/skinny_server.c
+++ b/src/mod/endpoints/mod_skinny/skinny_server.c
@@ -163,9 +163,9 @@ switch_status_t skinny_create_incoming_session(listener_t *listener, uint32_t *l
        if ((sql = switch_mprintf(
                                        "INSERT INTO skinny_active_lines "
                                        "(device_name, device_instance, line_instance, channel_uuid, call_id, call_state) "
-                                       "SELECT device_name, device_instance, line_instance, '%s', %d, %d "
+                                       "SELECT device_name, device_instance, line_instance, '%q', %d, %d "
                                        "FROM skinny_lines "
-                                       "WHERE value='%s'",
+                                       "WHERE value='%q'",
                                        switch_core_session_get_uuid(nsession), tech_pvt->call_id, SKINNY_ON_HOOK, button->shortname
                                 ))) {
                skinny_execute_sql(listener->profile, sql, listener->profile->sql_mutex);
@@ -1070,7 +1070,7 @@ switch_status_t skinny_handle_register(listener_t *listener, skinny_message_t *r
        if ((sql = switch_mprintf(
                                        "INSERT INTO skinny_devices "
                                        "(name, user_id, instance, ip, type, max_streams, codec_string) "
-                                       "VALUES ('%s','%d','%d', '%s', '%d', '%d', '%s')",
+                                       "VALUES ('%q','%d','%d', '%q', '%d', '%d', '%q')",
                                        request->data.reg.device_name,
                                        request->data.reg.user_id,
                                        request->data.reg.instance,
@@ -1148,7 +1148,7 @@ switch_status_t skinny_handle_register(listener_t *listener, skinny_message_t *r
                                                                        "label, value, caller_name, "
                                                                        "ring_on_idle, ring_on_active, busy_trigger, "
                                                                        "forward_all, forward_busy, forward_noanswer, noanswer_duration) "
-                                                                       "VALUES('%s', %d, %d, %d, '%s', '%s', '%s', %d, %d, %d, '%s', '%s', '%s', %d)",
+                                                                       "VALUES('%q', %d, %d, %d, '%q', '%q', '%q', %d, %d, %d, '%q', '%q', '%q', %d)",
                                                                        request->data.reg.device_name, request->data.reg.instance, position, line_instance,
                                                                        label, value, caller_name,
                                                                        ring_on_idle, ring_on_active, busy_trigger,
@@ -1176,7 +1176,7 @@ switch_status_t skinny_handle_register(listener_t *listener, skinny_message_t *r
                                        if ((sql = switch_mprintf(
                                                                        "INSERT INTO skinny_buttons "
                                                                        "(device_name, device_instance, position, type, label, value, settings) "
-                                                                       "VALUES('%s', %d, %d, %d, '%s', '%s', '%s')",
+                                                                       "VALUES('%q', %d, %d, %d, '%q', '%q', '%q')",
                                                                        request->data.reg.device_name,
                                                                        request->data.reg.instance,
                                                                        position,
@@ -1230,7 +1230,7 @@ switch_status_t skinny_handle_port_message(listener_t *listener, skinny_message_
        skinny_check_data_length(request, sizeof(request->data.as_uint16));
 
        if ((sql = switch_mprintf(
-                                       "UPDATE skinny_devices SET port=%d WHERE name='%s' and instance=%d",
+                                       "UPDATE skinny_devices SET port=%d WHERE name='%q' and instance=%d",
                                        request->data.port.port,
                                        listener->device_name,
                                        listener->device_instance
@@ -1775,7 +1775,7 @@ switch_status_t skinny_handle_capabilities_response(listener_t *listener, skinny
        }
        codec_string[string_len] = '\0';
        if ((sql = switch_mprintf(
-                                       "UPDATE skinny_devices SET codec_string='%s' WHERE name='%s'",
+                                       "UPDATE skinny_devices SET codec_string='%q' WHERE name='%s'",
                                        codec_string,
                                        listener->device_name
                                 ))) {
@@ -2100,7 +2100,7 @@ switch_status_t skinny_headset_status_message(listener_t *listener, skinny_messa
        skinny_check_data_length(request, sizeof(request->data.headset_status));
 
        if ((sql = switch_mprintf(
-                                       "UPDATE skinny_devices SET headset=%d WHERE name='%s' and instance=%d",
+                                       "UPDATE skinny_devices SET headset=%d WHERE name='%q' and instance=%d",
                                        (request->data.headset_status.mode==1) ? SKINNY_ACCESSORY_STATE_OFFHOOK : SKINNY_ACCESSORY_STATE_ONHOOK,
                                        listener->device_name,
                                        listener->device_instance
@@ -2262,7 +2262,7 @@ switch_status_t skinny_handle_accessory_status_message(listener_t *listener, ski
        switch(request->data.accessory_status.accessory_id) {
                case SKINNY_ACCESSORY_HEADSET:
                        if ((sql = switch_mprintf(
-                                                       "UPDATE skinny_devices SET headset=%d WHERE name='%s' and instance=%d",
+                                                       "UPDATE skinny_devices SET headset=%d WHERE name='%q' and instance=%d",
                                                        request->data.accessory_status.accessory_status,
                                                        listener->device_name,
                                                        listener->device_instance
@@ -2273,7 +2273,7 @@ switch_status_t skinny_handle_accessory_status_message(listener_t *listener, ski
                        break;
                case SKINNY_ACCESSORY_HANDSET:
                        if ((sql = switch_mprintf(
-                                                       "UPDATE skinny_devices SET handset=%d WHERE name='%s' and instance=%d",
+                                                       "UPDATE skinny_devices SET handset=%d WHERE name='%q' and instance=%d",
                                                        request->data.accessory_status.accessory_status,
                                                        listener->device_name,
                                                        listener->device_instance
@@ -2284,7 +2284,7 @@ switch_status_t skinny_handle_accessory_status_message(listener_t *listener, ski
                        break;
                case SKINNY_ACCESSORY_SPEAKER:
                        if ((sql = switch_mprintf(
-                                                       "UPDATE skinny_devices SET speaker=%d WHERE name='%s' and instance=%d",
+                                                       "UPDATE skinny_devices SET speaker=%d WHERE name='%q' and instance=%d",
                                                        request->data.accessory_status.accessory_status,
                                                        listener->device_name,
                                                        listener->device_instance
@@ -2346,7 +2346,7 @@ switch_status_t skinny_handle_updatecapabilities(listener_t *listener, skinny_me
        }
        codec_string[string_len] = '\0';
        if ((sql = switch_mprintf(
-                                       "UPDATE skinny_devices SET codec_string='%s' WHERE name='%s'",
+                                       "UPDATE skinny_devices SET codec_string='%q' WHERE name='%q'",
                                        codec_string,
                                        listener->device_name
                                 ))) {