Add validation of numeric query arguments

[moira.git] / server / qvalidate.pc

diff --git a/server/qvalidate.pc b/server/qvalidate.pc
index 91f1f12c53f37c3414ff049d5d402ca4932d4bee..dfd8e05f11b2d713109b67985ae5ba08b61cd55c 100644 (file)
--- a/server/qvalidate.pc
+++ b/server/qvalidate.pc
@@ -37,6 +37,7 @@ int validate_rename(char *argv[], struct valobj *vo);
 int validate_type(char *argv[], struct valobj *vo);
 int validate_typedata(struct query *, char *argv[], struct valobj *vo);
 int validate_len(char *argv[], struct valobj *vo);
+int validate_num(char *argv[], struct valobj *vo);
 int lock_table(struct valobj *vo);
 int readlock_table(struct valobj *vo);
 int convert_wildcards_uppercase(char *arg);
@@ -141,8 +142,10 @@ int validate_fields(q, argv, vo, n)
            status = validate_len(argv, vo);
            break;
 
-       case V_SORT:
-           status = MR_EXISTS;
+       case V_NUM:
+           if (log_flags & LOG_VALID)
+             com_err(whoami, 0, "validating number: %s", argv[vo->index]);
+           status = validate_num(argv, vo);
            break;
 
        case V_LOCK:
@@ -533,10 +536,39 @@ int readlock_table(vo)
                            */
 }
 
-/* Check the database at startup time. NOT! */
+/* Make sure the data is numeric */
+int validate_num(argv, vo)
+    register char *argv[];
+    register struct valobj *vo;
+{
+    char *p = argv[vo->index];
+    
+    if (*p == '-') p++;
+    for (;*p;p++)
+        if (*p < '0' || *p > '9') return MR_INTEGER;
+    
+    return MR_EXISTS;
+}
+
+/* Check the database at startup time. */
 
 void sanity_check_database(void)
 {
+    EXEC SQL BEGIN DECLARE SECTION;
+    int oid, id;
+    EXEC SQL END DECLARE SECTION;
+
+    /* Sometimes a crash can leave strings_id in numvalues in an
+       incorrect state. Check for that and fix it. */
+
+    EXEC SQL SELECT value INTO :oid FROM numvalues WHERE name='strings_id';
+
+    for (id=oid+1; sqlca.sqlcode==0; id++)
+       EXEC SQL SELECT string_id INTO :id FROM strings
+           WHERE string_id=:id;
+
+    if (id!=oid+1)
+       EXEC SQL UPDATE numvalues SET value=:id-1 WHERE name='strings_id';
 }