Failed Queries During Install Don't Generate an Error

system · December 3, 2013, 9:57pm

yehster wrote on Tuesday, December 03, 2013:

openemr/openemr/blob/master/library/classes/Installer.class.php#L195


    }


    return $this->execute_sql($sql);
}


public function drop_database()
{
    $sql = "drop database if exists " . $this->escapeDatabaseName($this->dbname);
    return $this->execute_sql($sql);
}


public function grant_privileges()
{
    return $this->execute_sql("GRANT ALL PRIVILEGES ON " . $this->escapeDatabaseName($this->dbname) . ".* TO '" . $this->escapeSql($this->login) . "'@'" . $this->escapeSql($this->loginhost) . "' IDENTIFIED BY '" . $this->escapeSql($this->pass) . "'");
}


public function disconnect()
{
    return mysqli_close($this->dbh);
}

When the installer class runs the queries to setup the database, if any of the queries fails, it doesn’t report an error and simply continues silently.

The return value from execute_sql is not checked

github.com

openemr/openemr/blob/master/library/classes/Installer.class.php#L440


        foreach ($grparr as $fldid => $fldarr) {
            list($fldname, $fldtype, $flddef, $flddesc) = $fldarr;
            if (is_array($fldtype) || substr($fldtype, 0, 2) !== 'm_') {
                $res = $this->execute_sql("SELECT count(*) AS count FROM globals WHERE gl_name = '" . $this->escapeSql($fldid) . "'");
                $row = mysqli_fetch_array($res, MYSQLI_ASSOC);
                if (empty($row['count'])) {
                    $this->execute_sql("INSERT INTO globals ( gl_name, gl_index, gl_value ) " .
                       "VALUES ( '" . $this->escapeSql($fldid) . "', '0', '" . $this->escapeSql($flddef) . "' )");
                }
            }
        }
    }


    return true;
}


public function install_gacl()
{
    $install_results_1 = $this->get_require_contents($this->gaclSetupScript1);
    if (! $install_results_1) {
        $this->error_message = "install_gacl failed: unable to require gacl script 1";

This masks any potential syntax bugs in the database.sql file.