Subject: [Pkg-cacti-maint] Bug#710331: cacti: Mishandling of double-quotes in password

From: Francois Gouget <[email-masked]>
Date: Thu, 30 May 2013 01:57:00 +0200

Package: cacti
Version: 0.8.8a+dfsg-6
Severity: normal

Dear Maintainer,

While installing the cacti package I got asked for a password for the cacti database. I had the misfortune of typing a password containing a double-quote. This resulted in cacti not starting due to an obvious syntax error in '/etc/cacti/debian.php':

$database_password = "prickly"cacti";

Escaping the double-quote at least got the Cacti website to come up. I did not test further with that password however.

-- System Information:
Debian Release: jessie/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.2.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages cacti depends on:
ii  dbconfig-common                          1.8.47+nmu1
ii  debconf [debconf-2.0]                    1.5.50
ii  libapache2-mod-php5                      5.4.4-15
ii  libphp-adodb                             5.15-1
ii  mysql-client-5.5 [virtual-mysql-client]  5.5.31+dfsg-1
ii  perl                                     5.14.2-21
ii  php5-cli                                 5.4.4-15
ii  php5-mysql                               5.4.4-15
ii  php5-snmp                                5.4.4-15
ii  rrdtool                                  1.4.7-2
ii  snmp                                     5.4.3~dfsg-3
ii  ucf                                      3.0025+nmu3

Versions of packages cacti recommends:
ii  apache2                      2.2.22-13
ii  apache2-mpm-prefork [httpd]  2.2.22-13
ii  iputils-ping                 3:20101006-3
ii  libjs-jquery                 1.7.2+dfsg-2
ii  libjs-jquery-cookie          8-2
ii  logrotate                    3.8.1-4
ii  mysql-server                 5.5.31+dfsg-1

Versions of packages cacti suggests:
pn  moreutils  <none>
pn  php5-ldap  <none>

-- debconf information:
  cacti/db/app-user: cacti
  cacti/mysql/admin-user: root
* cacti/webserver: apache2
  cacti/mysql/method: unix socket
  cacti/remote/host:
  cacti/upgrade-error: abort
  cacti/dbconfig-upgrade: true
  cacti/internal/skip-preseed: false
  cacti/remote/newhost:
  cacti/purge: false
  cacti/missing-db-package-error: abort
  cacti/database-type: mysql
  cacti/remove-error: abort
  cacti/db/dbname: cacti
  cacti/upgrade-backup: true
  cacti/install-error: abort
  cacti/internal/reconfiguring: false
  cacti/passwords-do-not-match:
  cacti/dbconfig-remove:
* cacti/dbconfig-install: true
  cacti/remote/port:
  cacti/dbconfig-reinstall: false

---

From: Paul Gevers <[email-masked]>
Date: Sat, 13 Jul 2013 15:22:01 +0200

clone 710331 -1
reassign -1 dbconfig-common
retitle -1 special characters should be escaped when used in templates
block 710331 by -1
retitle 710331 cacti: no special character handling in configuration
thanks

Cacti uses dbconfig-common to configure the cacti database connection.
However, as far as I can tell dbconfig-common doesn't do anything to
ensure proper handling of special characters in strings. If I have a
password for my database containing special characters, I get them all
as they were, making the procedure impossible to use with templates.

E.g. the following line ends up exactly like it is:
x" '\
making either " or ' as string delimiters (or no delimiters) in php or
sh not doing the right thing. Of course the proper escaping depends on
the language of the template, e.g. for sh the above line could be
escaped as:
'x" '\''\' or with a lot more care to take all variations into account:
"x\" '\\"
for php, it needs to be something like
'x" \'\\' or "x\" '\\"
and probably for other languages even something different.

Of course, the template in cacti should not contain the quotes anymore
when dbconfig-common escapes the strings properly. So I clone the bug
accordingly.

---

From: [email-masked] (Debian Bug Tracking System)
Date: Sat, 13 Jul 2013 13:27:21 +0000

> clone 710331 -1
Bug #710331 [cacti] cacti: Mishandling of double-quotes in password
Bug 710331 cloned as bug 716841
> reassign -1 dbconfig-common
Bug #716841 [cacti] cacti: Mishandling of double-quotes in password
Bug reassigned from package 'cacti' to 'dbconfig-common'.
No longer marked as found in versions cacti/0.8.8a+dfsg-6.
Ignoring request to alter fixed versions of bug #716841 to the same values previously set
> retitle -1 special characters should be escaped when used in templates
Bug #716841 [dbconfig-common] cacti: Mishandling of double-quotes in password
Changed Bug title to 'special characters should be escaped when used in templates' from 'cacti: Mishandling of double-quotes in password'
> block 710331 by -1
Bug #710331 [cacti] cacti: Mishandling of double-quotes in password
710331 was not blocked by any bugs.
710331 was not blocking any bugs.
Added blocking bug(s) of 710331: 716841
> retitle 710331 cacti: no special character handling in configuration
Bug #710331 [cacti] cacti: Mishandling of double-quotes in password
Changed Bug title to 'cacti: no special character handling in configuration' from 'cacti: Mishandling of double-quotes in password'
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
710331: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=710331
716841: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=716841
Debian Bug Tracking System
Contact [email-masked] with problems