--- www-sql-0.5.7.orig/Makefile.in
+++ www-sql-0.5.7/Makefile.in
@@ -3,7 +3,7 @@
VER = @VERSION@
# Set the default username and password for www-sql to use
-SQL_USER = nobody
+SQL_USER = www-data
SQL_PASS =
SQL_DEFS = -DSQL_USER=\"$(SQL_USER)\" -DSQL_PASS=\"$(SQL_PASS)\"
--- www-sql-0.5.7.orig/www-sql.c
+++ www-sql-0.5.7/www-sql.c
@@ -64,7 +64,7 @@
* an action handler, you open up secured areas to those who know how to
* exploit a certain bug in previous versions of www-sql.
*/
- tmp = getenv("SERVER_NAME");
+ tmp = getenv("SERVER_SOFTWARE");
if (tmp && !strncmp(tmp, "Apache", 6) &&
(tmp = getenv("REDIRECT_STATUS")) == NULL) {
printf("
WWW-Sql\n");
--- www-sql-0.5.7.orig/debian/www-mysql.dirs
+++ www-sql-0.5.7/debian/www-mysql.dirs
@@ -0,0 +1,2 @@
+usr/lib/cgi-bin
+usr/share/doc/www-mysql/examples
--- www-sql-0.5.7.orig/debian/compat
+++ www-sql-0.5.7/debian/compat
@@ -0,0 +1 @@
+4
--- www-sql-0.5.7.orig/debian/changelog
+++ www-sql-0.5.7/debian/changelog
@@ -0,0 +1,244 @@
+www-sql (0.5.7-17) unstable; urgency=low
+
+ * Changed build-dep to libmysqlclient10-dev (closes: #198837)
+ * Upgrade to debhelper 4
+
+ -- Hamish Moffatt Sat, 23 Aug 2003 17:08:43 +1000
+
+www-sql (0.5.7-16) unstable; urgency=low
+
+ * Recompile for new postgresql (closes: #176821)
+
+ -- Hamish Moffatt Fri, 21 Feb 2003 00:17:14 +1100
+
+www-sql (0.5.7-15) unstable; urgency=low
+
+ * Move to main from non-US, since postgresql has also moved
+
+ -- Hamish Moffatt Tue, 22 Oct 2002 23:34:46 +1000
+
+www-sql (0.5.7-14) unstable; urgency=low
+
+ * Added Apache2 to allowed web server list (closes: #162597)
+
+ -- Hamish Moffatt Tue, 22 Oct 2002 23:30:17 +1000
+
+www-sql (0.5.7-13) unstable; urgency=low
+
+ * Recompiled with libpgsql2 rather than libpgsql2.1
+
+ -- Hamish Moffatt Sat, 9 Mar 2002 00:41:11 +1100
+
+www-sql (0.5.7-12) unstable; urgency=low
+
+ * Added support for the WN web server: changed dependencies,
+ and added note to README.Debian (closes: #92750)
+
+ -- Hamish Moffatt Sun, 25 Nov 2001 13:29:24 +1100
+
+www-sql (0.5.7-11) unstable; urgency=low
+
+ * Recompiled with libpgsql2.1 in non-US (closes: #97128)
+
+ -- Hamish Moffatt Tue, 22 May 2001 00:01:53 +1000
+
+www-sql (0.5.7-10) unstable; urgency=low
+
+ * Changed build-dep from libmysqlclient9-dev to libmysqlclient-dev
+ (closes: #83898)
+ * Depends on Apache as it is currently insecure with other web servers
+
+ -- Hamish Moffatt Mon, 29 Jan 2001 08:07:49 +1100
+
+www-sql (0.5.7-9) unstable; urgency=low
+
+ * Fixed incorrect environment variable check for Apache (closes: #82529)
+
+ -- Hamish Moffatt Thu, 18 Jan 2001 21:29:32 +1100
+
+www-sql (0.5.7-8) unstable; urgency=low
+
+ * Recompiled with libmysqlclient10
+
+ -- Hamish Moffatt Tue, 7 Nov 2000 15:28:15 +1100
+
+www-sql (0.5.7-7) unstable; urgency=low
+
+ * Added missing build-dependencies (closes: #68455, #68752)
+
+ -- Hamish Moffatt Sat, 26 Aug 2000 12:43:11 +1000
+
+www-sql (0.5.7-6) unstable; urgency=low
+
+ * Recompiled for libmysqlclient9
+
+ -- Hamish Moffatt Mon, 7 Aug 2000 19:44:02 +1000
+
+www-sql (0.5.7-5) unstable; urgency=low
+
+ * Added note to README.Debian about "www-data" username and Postgres
+ * Updated GPL location
+ * Added build-deps
+
+ -- Hamish Moffatt Tue, 1 Aug 2000 22:27:48 +1000
+
+www-sql (0.5.7-4) unstable; urgency=low
+
+ * FHS compliant
+ * Recompile against latest mysql and pgsql packages
+
+ -- Hamish Moffatt Tue, 5 Oct 1999 19:54:15 +1000
+
+www-sql (0.5.7-3) unstable; urgency=low
+
+ * Recompile against latest mysql and pgsql packages
+
+ -- Hamish Moffatt Sat, 14 Aug 1999 14:59:00 +1000
+
+www-sql (0.5.7-2) unstable; urgency=low
+
+ * Changed section to "web" instead of "contrib/web" for www-mysql
+
+ -- Hamish Moffatt Sun, 13 Dec 1998 14:24:00 +1100
+
+www-sql (0.5.7-1) unstable; urgency=low
+
+ * New upstream version
+
+ -- Hamish Moffatt Sat, 21 Nov 1998 16:47:00 +1100
+
+www-sql (0.5.5-1) unstable; urgency=low
+
+ * New upstream version
+
+ -- Hamish Moffatt Fri, 04 Sep 1998 19:44:00 +1000
+
+www-sql (0.5.1-1) unstable; urgency=low
+
+ * New upstream version
+
+ -- Hamish Moffatt Tue, 19 May 1998 19:23:00 +1000
+
+www-sql (0.5.0-5) frozen unstable; urgency=medium
+
+ * Rebuilt for mysql 3.21.25gamma-4; previous versions would segfault.
+ Built with libpgsql 6.3-2. Built with --enable-recursive set too.
+
+ -- Hamish Moffatt Fri, 01 May 1998 01:01:00 +1000
+
+www-sql (0.5.0-4) frozen unstable; urgency=low
+
+ * Re-included missing www-sql.html in /usr/doc (bug #21242)
+
+ -- Hamish Moffatt Fri, 17 Apr 1998 15:10:00 +1000
+
+www-sql (0.5.0-3) frozen unstable; urgency=low
+
+ * Changed the default database username to www-data from nobody
+ (fixes #20788)
+
+ -- Hamish Moffatt Tue, 07 Apr 1998 22:42:00 +1000
+
+www-sql (0.5.0-2) frozen unstable; urgency=low
+
+ * Recompiled with postgresql 6.3
+
+ -- Hamish Moffatt Sun, 05 Apr 1998 12:21:00 +1000
+
+www-sql (0.5.0-1) frozen unstable; urgency=medium
+
+ * New upstream release, with PostgreSQL support
+
+ * New binary package: www-pgsql for PostgreSQL, in Debian's main section
+ * Source package moved to main for www-pgsql, www-mysql remains in contrib
+ * Important note: the www-sql binary in previous versions of www-mysql
+ is now known /usr/lib/cgi-bin/www-mysql, not ..../www-sql, to allow
+ co-existence with www-pgsql
+
+ * Important Note: previous versions of www-sql could allow access
+ to files protected by .htaccess and other mechanisms. If you are using
+ Apache, you MUST use the action handling if using Apache
+ (see /usr/doc/www-{my,pg}sql/examples/srm.conf) to prevent this.
+
+ -- Hamish Moffatt Sat, 14 Mar 1998 12:48:28 +1100
+
+www-sql (0.4.4-3) unstable; urgency=low
+
+ * Fixed missing copyright file and cleaned up some mistakes
+ from the package name change
+
+ -- Hamish Moffatt Wed, 11 Mar 1998 01:41:00 +1100
+
+www-sql (0.4.4-2) unstable; urgency=low
+
+ * Renamed binary package www-sql to www-mysql to prevent confusion
+ about which SQL server it is for
+
+ -- Hamish Moffatt Fri, 20 Jan 1998 01:27:00 +1100
+
+www-sql (0.4.4-1) unstable; urgency=low
+
+ * New upstream version
+
+ -- Hamish Moffatt Thu, 19 Jan 1998 14:42:00 +1100
+
+www-sql (0.4.1-5) unstable; urgency=low
+
+ * Applied upstream patch to correct some parser problems;
+ in particular, the unary not (!) operator was missing
+ and some string comparisons did not work
+
+ -- Hamish Moffatt Sat, 10 Jan 1998 17:23:00 +1100
+
+www-sql (0.4.1-4) unstable; urgency=low
+
+ * Removed postinst and postrm commands to configure Apache
+ to use www-sql automatically, as www-sql should not edit
+ Apache's configuration files directly under policy
+ Updated README.Debian to suit.
+
+ -- Hamish Moffatt Wed, 7 Jan 1998 12:25:35 +1100
+
+www-sql (0.4.1-3) unstable; urgency=low
+
+ * Fixed bug in postinst; Apache would never be configured for www-sql
+ * Recompiled with mysql 3.21.17a.beta-2
+ * Compiled with the old expression handler for now
+
+ -- Hamish Moffatt Sat, 3 Jan 1998 14:05:35 +1100
+
+www-sql (0.4.1-2) unstable; urgency=low
+
+ * Fixed bug in postinst where it would fail unless apache was installed
+ (fixes #16313)
+
+ -- Hamish Moffatt Sun, 28 Dec 1997 12:15:35 +1100
+
+www-sql (0.4.1-1) unstable; urgency=medium
+
+ * New upstream release; fixes some omissions in the new
+ expression parser introduced in 0.4.0
+ * Corrected duplicated Password field in example SQL commands
+ given in README and README.debian (fixes #16018)
+
+ -- Hamish Moffatt Sat, 27 Dec 1997 23:32:35 +1100
+
+www-sql (0.4.0-1) unstable; urgency=low
+
+ * New upstream release
+
+ -- Hamish Moffatt Tue, 16 Dec 1997 20:23:25 +1100
+
+www-sql (0.3.4-2) unstable; urgency=low
+
+ * Changed postinst/postrm to inform user about Apache configuration
+ changes if made.
+
+ -- Hamish Moffatt Wed, 12 Nov 1997 01:25:48 +1100
+
+www-sql (0.3.4-1) unstable; urgency=low
+
+ * Initial Release.
+
+ -- Hamish Moffatt Wed, 12 Nov 1997 01:00:48 +1100
+
--- www-sql-0.5.7.orig/debian/control
+++ www-sql-0.5.7/debian/control
@@ -0,0 +1,33 @@
+Source: www-sql
+Section: web
+Priority: extra
+Maintainer: Hamish Moffatt
+Standards-Version: 3.5.8
+Build-Depends: postgresql-dev, libmysqlclient10-dev, debhelper (>= 4)
+
+Package: www-mysql
+Architecture: any
+Depends: ${shlibs:Depends}, apache | apache-ssl | wn | apache2-common
+Conflicts: www-sql
+Replaces: www-sql
+Section: web
+Description: a WWW interface for the TCX mySQL database
+ www-mysql is a web interface for the mySQL database.
+ SQL commands can be embedded into web pages; these are executed
+ on the server by www-mysql and the resulting web page sent to
+ the browser. All SQL commands and queries supported by
+ mySQL can be used via www-mysql.
+
+Package: www-pgsql
+Architecture: any
+Depends: ${shlibs:Depends}, apache | apache-ssl | wn | apache2-common
+Conflicts: www-sql
+Replaces: www-sql
+Section: web
+Description: a WWW interface for the PostgreSQL database
+ www-pgsql is a web interface for the PostgreSQL database.
+ SQL commands can be embedded into web pages; these are executed
+ on the server by www-pgsql and the resulting web page sent to
+ the browser. All SQL commands and queries supported by
+ PostgreSQL can be used via www-pgsql.
+
--- www-sql-0.5.7.orig/debian/rules
+++ www-sql-0.5.7/debian/rules
@@ -0,0 +1,63 @@
+#!/usr/bin/make -f
+# Made with the aid of debmake, by Christoph Lameter,
+# based on the sample debian/rules file for GNU hello by Ian Jackson.
+
+package=www-sql
+
+build:
+ dh_testdir
+ ./configure --prefix=/usr --with-pgsql-libs=/usr/lib/postgresql/lib --with-pgsql-headers=/usr/include/postgresql --enable-apache-action-check --enable-recursive
+ make CFLAGS="-O2 -g -Wall" www-mysql
+ make CFLAGS="-O2 -g -Wall" www-pgsql
+ touch build
+
+clean:
+ dh_testdir
+ -rm -f config.h
+ -rm -f build
+ -make distclean
+ -rm -f `find . -name "*~"`
+ dh_clean
+
+binary-indep: checkroot build
+ $(checkdir)
+# There are no architecture-independent files to be uploaded
+# generated by this package. If there were any they would be
+# made here.
+
+binary-arch: binary
+
+binary: build
+ dh_clean
+ dh_installdirs
+
+ # set up www-mysql package
+ install www-mysql `pwd`/debian/www-mysql/usr/lib/cgi-bin
+ cp example.sql `pwd`/debian/www-mysql/usr/share/doc/www-mysql/examples
+ cp debian/examples/srm.conf `pwd`/debian/www-mysql/usr/share/doc/www-mysql/examples
+
+ # set up www-pgsql package
+ install www-pgsql `pwd`/debian/www-pgsql/usr/lib/cgi-bin
+ cp example.pgsql `pwd`/debian/www-pgsql/usr/share/doc/www-pgsql/examples
+ cp debian/examples/srm.conf `pwd`/debian/www-pgsql/usr/share/doc/www-pgsql/examples
+
+ dh_installdocs -A www-sql.html README debian/README.Debian
+ dh_installchangelogs Changelog
+ dh_strip
+ dh_compress
+ dh_fixperms
+ dh_installdeb
+ dh_shlibdeps
+ dh_gencontrol
+ dh_md5sums
+ dh_builddeb
+
+# Below here is fairly generic really
+
+binary: binary-indep binary-arch
+
+checkroot:
+ dh_testdir
+ dh_testroot
+
+.PHONY: binary binary-arch binary-indep clean checkroot
--- www-sql-0.5.7.orig/debian/copyright
+++ www-sql-0.5.7/debian/copyright
@@ -0,0 +1,21 @@
+This is the Debian GNU/Linux package of www-sql.
+This package was put together from sources obtained at:
+ ftp.daa.com.au:/pub/james/www-sql
+by Hamish Moffatt
+
+This program is free software; you may redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 2, or (at your option)
+any later version.
+
+This is distributed in the hope that it will be useful, but without
+any warranty; without even the implied warranty of merchantability or
+fitness for a particular purpose. See the GNU General Public License
+for more details.
+
+A copy of the GNU General Public License is available as
+/usr/share/common-licenses/GPL in the Debian GNU/Linux distribution or on the
+World Wide Web at http://www.gnu.org/copyleft/gpl.html. You can also
+obtain it by writing to the Free Software Foundation, Inc., 59 Temple
+Place - Suite 330, Boston, MA 02111-1307, USA.
+
--- www-sql-0.5.7.orig/debian/examples/srm.conf
+++ www-sql-0.5.7/debian/examples/srm.conf
@@ -0,0 +1,11 @@
+#-- www-sql begin
+# The following configures Apache to treat .sql files as
+# to be interpreted by www-sql. This means that you can retrieve
+# these directly as http://server/file.sql, instead of as
+# http://server/cgi-bin/www-sql/file.sql.
+# Change www-mysql to www-pgsql as appropriate.
+
+AddHandler www-sql sql
+Action www-sql /cgi-bin/www-mysql
+
+#-- www-sql end
--- www-sql-0.5.7.orig/debian/README.Debian
+++ www-sql-0.5.7/debian/README.Debian
@@ -0,0 +1,84 @@
+README for the Debian package of www-sql (www-mysql & www-pgsql)
+Hamish Moffatt
+
+The /usr/doc/www-sql/README contains the full README for www-sql.
+Most of the README is concerned with compilation and installation,
+which is not relevant for the packaged version of www-sql. However
+some useful extracts are included below.
+
+Sections in this document:
+
+1. Securing www-sql
+
+2. Creating the www-sql database user
+2.1 With MySQL
+2.2 With PostgreSQL
+2.3 Problems with the user 'www-data' and Postgres
+
+=========================================================================
+1. Securing www-sql
+
+You can access scripts written for www-sql as
+ http://server/cgi-bin/www-sql/pathname/filename.sql
+
+However, www-sql will serve any file it can read and interpret it,
+so users can read any file in your WWW document root. eg
+ http://server/cgi-bin/www-sql/cgi-bin/my-shell-script
+
+You must use www-sql as an action handler (in Apache) or
+filter (in WN) and not directly as a CGI program.
+
+See /usr/share/doc/www-sql/examples/srm.conf for the necessary commands
+to add for Apache, or /usr/share/doc/wn/filter.html for WN.
+
+=========================================================================
+2. Create the www-sql database user
+
+www-sql needs to connect to your database server. By default, it
+uses the username 'www-sql'. You can override this in your www-sql
+pages.
+
+
+2.1 Creating the www-sql user in MySQL:
+
+ mysql -uroot -ppass mysql << EOF
+ insert into user (Host, User, Password, Select_priv)
+ values ("localhost", "www-data", "", "Y");
+ EOF
+ mysqladmin -uroot -ppass reload
+
+(substituting the correct root password). This will give www-sql access to
+all your databases. If you want to be more secure, change the "Y" to a
+"N" and add records to the db table, to grant access to individual
+databases.
+
+
+2.2 Creating the www-sql user in Postgresql:
+
+createuser "www-data"
+
+Now grant permissions to www-data with commands like this:
+
+psql dbname << EOF
+grant SELECT -- or INSERT, UPDATE, DELETE, RULE, or ALL
+ on tablename
+ to "www-data";
+EOF
+
+2.3 Problems with the user 'www-data' and Postgres:
+
+In Postgres 6.5.3 and later there is no restriction on using "www-data".
+However, a name which is not an SQL identifier (i.e. "[a-z][a-z0-9_]*")
+must be enclosed in double quotes wherever it is used. Not doing this
+may be the cause of your problems.
+
+So you have to say:
+
+ CREATE USER "www-data"
+
+not
+
+ CREATE USER www-data
+
+
+For extra information, see the file www-sql.html.
--- www-sql-0.5.7.orig/debian/www-pgsql.dirs
+++ www-sql-0.5.7/debian/www-pgsql.dirs
@@ -0,0 +1,2 @@
+usr/lib/cgi-bin
+usr/share/doc/www-pgsql/examples