mahara-contributors team mailing list archive

[Mahara Bot <1417364@xxxxxxxxxxxxxxxxxx>]

Reviewed:  https://reviews.mahara.org/4246
Committed: http://gitorious.org/mahara/mahara/commit/756e3345d94196068370ca21ca8bb5ab0dfd073a
Submitter: Aaron Wells (aaronw@xxxxxxxxxxxxxxx)
Branch:    1.8_STABLE

commit 756e3345d94196068370ca21ca8bb5ab0dfd073a
Author: Aaron Wells <aaronw@xxxxxxxxxxxxxxx>
Date:   Tue Feb 3 16:45:39 2015 +1300

Removing the from/join check in minaccept

Bug 1417364: This check causes too many false positives and doesn't catch
actual problems often enough.

Change-Id: I659cafd3dcdbcf254d66a72bcb4f2f6a1ba2ddba

-- 
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
Matching subscriptions: Subscription for all Mahara Contributors -- please ask on #mahara-dev or mahara.org forum before editing or unsubscribing it!
https://bugs.launchpad.net/bugs/1417364

Title:
  Remove the check for SQL "from" and "join" from minaccept script

Status in Mahara ePortfolio:
  In Progress

Bug description:
  When you use Mahara's makefile to push a patch to reviews.mahara.org,
  it runs a minaccept script which checks for various simple errors. One
  of the things it includes is a check for the word "from" or "join" not
  followed by a curly bracket. The idea is that this is supposed to be a
  check for SQL queries that haven't properly escaped table names. In
  order to support the $cfg->dbprefix setting, raw SQL is supposed to
  surround table names with curly brackets, e.g. "select * from {view}".

  The problem is, this check throws a LOT of false positives, because
  the word "from" is a common English word, often used in comments,
  function names, and variables. It also throws a false positive if you
  format a multi-line query so that "from" is on a line by itself (which
  I like to do). These false positives then lead people to ignore the
  rest of the output from the minaccept script.

  Robert suggested that we should do this:

  1. Drop the from/join check in minaccept

  2. Update the Behat test so that it runs with a $cfg->dbprefix
  setting, so that running the Behat tests will help check for problems
  with this.

To manage notifications about this bug go to:
https://bugs.launchpad.net/mahara/+bug/1417364/+subscriptions