Dependency Graph

Dependency Graph
related to related to child of child of duplicate of duplicate of

View Issue Details

IDProjectCategoryView StatusLast Update
0012955mantisbtattachmentspublic2015-07-10 15:01
Reporterpingo Assigned Todregad  
PrioritynormalSeveritymajorReproducibilityalways
Status closedResolutionfixed 
Product Version1.2.5 
Target Version1.2.16Fixed in Version1.2.16 
Summary0012955: After updating a project documentation the file is damaged
Description

After updating a project documentation the file is damaged

Steps To Reproduce
  1. Add a new file in the "Docs" section of your project (proj_doc_add_page.php)
  2. Download the file, it's OK
  3. Update the file (proj_doc_edit_page.php, proj_doc_update.php)
  4. Download the file, it's damaged. It contains a "'" at the beginning and 0x0a is replaced by "\n". Examples are attached.
Additional Information

My setup:
opensuse 11.4, MySQL 5.1.53, PHP 5.3.5

TagsNo tags attached.
Attached Files
testfiles.zip (268 bytes)

Relationships

related to 0013247 closeddregad mantisbt Bug in file "proj_doc_update.php" 
related to 0014541 closeddregad mantisbt Remove calls to deprecated functions db_prepare* in "Docs" update page 
has duplicate 0009578 closeddregad mantisbt Binary data corrupted in MySQL 
has duplicate 0016639 closeddregad mantisbt Project Documentation - pdf file corrupt after upload 
related to 0014563 closeddregad mantisbt Use of literal SQL statement causes ORA-01704 error when uploading attachments 
related to 0019926 closedSL-Gundam Plugin - EmailReporting Error when submitting a bug by email (via EmailReporting) due to the change in the "core/database_api" line 761 

Activities

davidnewcomb

davidnewcomb

2012-06-27 13:29

reporter   ~0032202

I know that this bug report came before 0013247, but that bug report has a solution whereas this doesn't.

davidnewcomb

davidnewcomb

2012-06-28 05:36

reporter   ~0032209

Sorry, not a duplicate. Repoening.

davidnewcomb

davidnewcomb

2012-06-28 05:38

reporter   ~0032210

File proj_doc_update.php line 105

Change:-

case DATABASE:
$c_content = db_prepare_binary_string( fread ( fopen( $v_tmp_name, 'rb' ), $v_size ) );
break;

to:-

case DATABASE:
$c_content = fread ( fopen( $v_tmp_name, 'rb' ), $v_size );
break;

pingo

pingo

2012-07-12 04:32

reporter   ~0032308

I changed line 105 and line 54 (0013247). This works for me.

dregad

dregad

2012-08-08 10:17

developer   ~0032506

David, I'm afraid that your proposed fix would only work for MySQL - other DB engines rely on BLOB fields to be escaped/encoded properly (look at db_prepare_binary_string).

dregad

dregad

2012-08-10 10:45

developer   ~0032538

I think I figured it out. See https://github.com/dregad/mantisbt/commits/file-attach-fixes - testing and feedback welcome :-)

pingo

pingo

2012-10-28 05:03

reporter   ~0033317

How to download a tarball with the "file-attach-fixes"? Please provide a link or a git-command.

dregad

dregad

2012-10-28 06:13

developer   ~0033323

You can download it from the link is in my previous post 0012955:0032538
Also https://github.com/dregad/mantisbt/tarball/file-attach-fixes

pingo

pingo

2013-01-11 09:17

reporter   ~0034776

I tested the software from https://github.com/dregad/mantisbt/tarball/file-attach-fixes, problem is solved, no damaged files anymore.

dregad

dregad

2013-01-11 09:24

developer   ~0034778

Thanks for your feedback, I'll include that in the next release then.

davidnewcomb

davidnewcomb

2013-07-18 08:08

reporter   ~0037491

Just upgraded to 1.2.15 and this is still broken.
Surely fixing it for MySQL is better than leaving it broken. The non-MySQL users will be in just the same position as they are now.

dregad

dregad

2013-07-18 10:55

developer   ~0037493

David

This is targeted at 1.2.x which means it would be included in 1.2.16 -- assuming I get around to merging the changes ;-)

Until then, feel free to apply the patch from my github branch on top of your 1.2.15 instance, and please report here if you experience any issues.

Related Changesets

MantisBT: master-1.2.x 3008c7f7

2012-08-09 08:36

Damien Regad


Details Diff
Fix encoding of BLOB columns

The db_prepare_binary_string() function was designed for use with
db_query(), and therefore used to surround the binary string to
encode with single quotes.

Use of db_query_bound() with the function's return value would result in
a corrupted attachment because the quotes would be treated as integral
part of the binary data.

MySQL does not require any special encoding (except regular string
processing which is already done by db_query_bound()).

For PostgreSQL, instead of calling pg_escape_bytea() directly, we now
use ADOdb connection's BlobEncode() method.

MSSQL encoding was left as is was (no test platform available).

Based on documentation, Oracle (oci8) should not require any encoding
either, but was not tested either.

Fixes 0012955
Affected Issues
0012955
mod - core/database_api.php Diff File