Drupal
/
drupal
mirror of https://git.drupalcode.org/project/drupal.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

#175117 follow up patch by moshe weitzman: sanitize user name, remove t() because it might not be availabla and comment what is happening

6.x
Gábor Hojtsy 2007-10-12 14:51:23 +00:00
parent 47095ffb3c
commit 7d8c8d72f1
2 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
includes/database.mysql.inc
View File

@ -133,8 +133,14 @@ function _db_query($query, $debug = 0) {
if (variable_get('dev_query', 0)) {
list($usec, $sec) = explode(' ', microtime());
$timer = (float)$usec + (float)$sec;
// If devel.module query logging is enabled, prepend a comment with the username and calling function
// to the SQL string. This is useful when running mysql's SHOW PROCESSLIST to learn what exact
// code is issueing the slow query.
$bt = debug_backtrace();
$name = ($user->uid) ? $user->name : variable_get('anonymous', t('Anonymous'));;
// t() may not be available yet so we don't wrap 'Anonymous'.
$name = $user->uid ? $user->name : variable_get('anonymous', 'Anonymous');
// str_replace() to prevent SQL injection via username or anonymous name.
$name = str_replace(array('*', '/'), '', $name);
$query = '/* '. $name .' : '. $bt[2]['function'] .' */ '. $query;
}

8
includes/database.mysqli.inc
View File

@ -130,8 +130,14 @@ function _db_query($query, $debug = 0) {
if (variable_get('dev_query', 0)) {
list($usec, $sec) = explode(' ', microtime());
$timer = (float)$usec + (float)$sec;
// If devel.module query logging is enabled, prepend a comment with the username and calling function
// to the SQL string. This is useful when running mysql's SHOW PROCESSLIST to learn what exact
// code is issueing the slow query.
$bt = debug_backtrace();
$name = ($user->uid) ? $user->name : variable_get('anonymous', t('Anonymous'));
// t() may not be available yet so we don't wrap 'Anonymous'
$name = $user->uid ? $user->name : variable_get('anonymous', 'Anonymous');
// str_replace() to prevent SQL injection via username or anonymous name.
$name = str_replace(array('*', '/'), '', $name);
$query = '/* '. $name .' : '. $bt[2]['function'] .' */ '. $query;
}