*Bumped PORTREVISION

*Added combined patch-contrib-mod_sql.c
 Addresses distributor bugs #2828 & #2869 -
 mod_sql botches WHERE clauses and Support variables in SQL WHERE directives.
*Added include/proftpd/mod_sql.h to pkg-plist

PR:		107416
Submitted by:	"Beech Rintoul" <beech@alaskaparadise.com> (maintainer)

3 files changed, 277 insertions, 5 deletions

diff --git a/ftp/proftpd/Makefile b/ftp/proftpd/Makefile
index 3f2a7d55f11a..fd14f11ff2c1 100644
--- a/ftp/proftpd/Makefile
+++ b/ftp/proftpd/Makefile
@@ -7,7 +7,7 @@
 
 PORTNAME=	proftpd
 DISTVERSION=	1.3.1rc1
-PORTREVISION=	2
+PORTREVISION=	3
 CATEGORIES=	ftp
 MASTER_SITES=	ftp://ftp.proftpd.org/distrib/source/ \
 		ftp://ftp.fastorama.com/mirrors/ftp.proftpd.org/distrib/source/ \
@@ -58,7 +58,7 @@ OPTIONS=	IPV6 "Use IPv6" off \
 		RADIUS "Include mod_radius" off \
 		QUOTATAB_RADIUS "include mod_quotatab_radius" off \
 		BAN "include mod_ban (Requires CTRLS)" off \
-		NLS "Use nls-builds mod_lang" off
+		NLS "Use nls (builds mod_lang)" off
 
 MODULES?=
 LIBDIRS?=
@@ -156,6 +156,9 @@ USE_MYSQL=	yes
 MODULES:=${MODULES}:mod_sql:mod_sql_mysql
 INCLUDEDIRS:=${INCLUDEDIRS}:${LOCALBASE}/include
 LIBDIRS:=${LIBDIRS}:${LOCALBASE}/lib/mysql
+PLIST_SUB+=	MYSQL=""
+.else
+PLIST_SUB+=	MYSQL="@comment "
 .endif
 
 .if defined(WITH_POSTGRESQL)
@@ -227,8 +230,9 @@ post-configure:
 		${WRKSRC}/utils/ftpcount.1
 
 post-install:
-	[ -f ${PREFIX}/etc/proftpd.conf ] || \
-		${CP} ${EXAMPLESDIR}/etc/proftpd.conf ${PREFIX}/etc/proftpd.conf.sample
+	@if [ ! -f ${PREFIX}/etc/proftpd.conf ]; then \
+	${CP} -p ${EXAMPLESDIR}/etc/proftpd.conf ${PREFIX}/etc/proftpd.conf ; \
+    fi
 
 .if !defined(NOPORTDOCS)
 	@${MKDIR} ${PREFIX}/share/doc/proftpd
diff --git a/ftp/proftpd/files/patch-contrib-mod_sql.c b/ftp/proftpd/files/patch-contrib-mod_sql.c
new file mode 100644
index 000000000000..4d6f8352ec0d
--- /dev/null
+++ b/ftp/proftpd/files/patch-contrib-mod_sql.c
@@ -0,0 +1,268 @@
+--- contrib/mod_sql.c.orig	Mon Dec 11 13:40:18 2006
++++ contrib/mod_sql.c	Thu Jan  4 14:31:13 2007
+@@ -23,7 +23,7 @@
+  * the resulting executable, without including the source code for OpenSSL in
+  * the source distribution.
+  *
+- * $Id: mod_sql.c,v 1.117 2006/12/11 22:40:18 castaglia Exp $
++ * $Id: mod_sql.c,v 1.121 2007/01/03 18:24:35 castaglia Exp $
+  */
+ 
+ #include "conf.h"
+@@ -104,8 +104,11 @@
+ 
+ module sql_module;
+ 
+-static char *_sql_where(cmd_rec *, int, ...);
+ #define SQL_MAX_STMT_LEN	4096
++
++static char *sql_prepare_where(int, cmd_rec *, int, ...);
++#define SQL_PREPARE_WHERE_FL_NO_TAGS	0x00001
++
+ static char *resolve_long_tag(cmd_rec *, char *);
+ static int resolve_numeric_tag(cmd_rec *, char *);
+ static char *resolve_short_tag(cmd_rec *, char);
+@@ -752,10 +755,10 @@
+   return mr ? (char *) mr->data : NULL;
+ }
+ 
+-static char *_sql_where(cmd_rec *cmd, int cnt, ...) {
++static char *sql_prepare_where(int flags, cmd_rec *cmd, int cnt, ...) {
+   int i, flag;
+   int curr_avail;
+-  char *buf = "", *res, *tchar, *curr, *tmp;
++  char *buf = "", *res, *tchar;
+   va_list dummy;
+ 
+   res = pcalloc(cmd->tmp_pool, SQL_MAX_STMT_LEN);
+@@ -774,31 +777,53 @@
+   }
+   va_end(dummy);
+ 
+-  /* Process variables in WHERE clauses, except any "%{num}" references. */
+-  curr = res;
+-  curr_avail = SQL_MAX_STMT_LEN;
+-  for (tmp = buf; *tmp; ) {
+-    char *str;
+-    modret_t *mr;
++  if (!(flags & SQL_PREPARE_WHERE_FL_NO_TAGS)) {
++    char *curr, *tmp;
+ 
+-    if (*tmp == '%') {
+-      char *tag = NULL;
++    /* Process variables in WHERE clauses, except any "%{num}" references. */
++    curr = res;
++    curr_avail = SQL_MAX_STMT_LEN;
++
++    for (tmp = buf; *tmp; ) {
++      char *str;
++      modret_t *mr;
+ 
+-      if (*(++tmp) == '{') {
+-        char *query;
++      if (*tmp == '%') {
++        char *tag = NULL;
+ 
+-        if (*tmp != '\0')
+-          query = ++tmp;
++        if (*(++tmp) == '{') {
++          char *query;
+ 
+-        while (*tmp && *tmp != '}')
+-          tmp++;
++          if (*tmp != '\0')
++            query = ++tmp;
++
++          while (*tmp && *tmp != '}')
++            tmp++;
++
++          tag = pstrndup(cmd->tmp_pool, query, (tmp - query));
++          if (tag) {
++            str = resolve_long_tag(cmd, tag);
++            if (!str)
++              str = pstrdup(cmd->tmp_pool, "");
++
++            mr = _sql_dispatch(_sql_make_cmd(cmd->tmp_pool, 2, "default",
++              str), "sql_escapestring");
++            if (check_response(mr) < 0)
++              return NULL;
+ 
+-        tag = pstrndup(cmd->tmp_pool, query, (tmp - query));
+-        if (tag) {
+-          str = resolve_long_tag(cmd, tag);
+-          if (!str)
+-            str = pstrdup(cmd->tmp_pool, "");
++            sstrcat(curr, mr->data, curr_avail);
++            curr += strlen(mr->data);
++            curr_avail -= strlen(mr->data);
++
++            if (*tmp != '\0')
++              tmp++;
++
++          } else {
++            return NULL;
++          }
+ 
++        } else {
++          str = resolve_short_tag(cmd, *tmp);
+           mr = _sql_dispatch(_sql_make_cmd(cmd->tmp_pool, 2, "default",
+             str), "sql_escapestring");
+           if (check_response(mr) < 0)
+@@ -810,32 +835,18 @@
+ 
+           if (*tmp != '\0')
+             tmp++;
+-
+-        } else {
+-          return NULL;
+         }
+ 
+       } else {
+-        str = resolve_short_tag(cmd, *tmp);
+-        mr = _sql_dispatch(_sql_make_cmd(cmd->tmp_pool, 2, "default",
+-          str), "sql_escapestring");
+-        if (check_response(mr) < 0)
+-          return NULL;
+-
+-        sstrcat(curr, mr->data, curr_avail);
+-        curr += strlen(mr->data);
+-        curr_avail -= strlen(mr->data);
+-
+-        if (*tmp != '\0')
+-          tmp++;
++        *curr++ = *tmp++;
++        curr_avail--;
+       }
+-
+-    } else {
+-      *curr++ = *tmp++;
+-      curr_avail--;
+     }
++    *curr++ = '\0';
++
++  } else {
++    res = buf;
+   }
+-  *curr++ = '\0';
+ 
+   return res;
+ }
+@@ -1212,7 +1223,7 @@
+   }
+ 
+   if (!cmap.usercustom) { 
+-    where = _sql_where(cmd, 2, usrwhere, cmap.userwhere);
++    where = sql_prepare_where(0, cmd, 2, usrwhere, cmap.userwhere, NULL);
+ 
+     mr = _sql_dispatch(_sql_make_cmd(cmd->tmp_pool, 5, "default",
+       cmap.usrtable, cmap.usrfields, where, "1"), "sql_select");
+@@ -1438,7 +1449,7 @@
+       return NULL;
+     }
+ 
+-    where = _sql_where(cmd, 2, grpwhere, cmap.groupwhere);
++    where = sql_prepare_where(0, cmd, 2, grpwhere, cmap.groupwhere, NULL);
+ 
+     mr = _sql_dispatch(_sql_make_cmd(cmd->tmp_pool, 5, "default",
+       cmap.grptable, cmap.grpfield, where, "1"), "sql_select");
+@@ -1456,7 +1467,7 @@
+ 
+   grpwhere = pstrcat(cmd->tmp_pool, cmap.grpfield, " = '", groupname, "'",
+     NULL);
+-  where = _sql_where(cmd, 2, grpwhere, cmap.groupwhere);
++  where = sql_prepare_where(0, cmd, 2, grpwhere, cmap.groupwhere, NULL);
+   
+   mr = _sql_dispatch(_sql_make_cmd(cmd->tmp_pool, 4, "default",
+     cmap.grptable, cmap.grpfields, where), "sql_select");
+@@ -1530,7 +1541,7 @@
+ 
+   usrwhere = pstrcat(cmd->tmp_pool, cmap.usrfield, " = '", _sql_realuser(cmd),
+     "'", NULL);
+-  where = _sql_where(cmd, 2, usrwhere, cmap.userwhere);
++  where = sql_prepare_where(0, cmd, 2, usrwhere, cmap.userwhere, NULL);
+ 
+   mr = _sql_dispatch(_sql_make_cmd(cmd->tmp_pool, 4, "default", cmap.usrtable,
+     query, where), "sql_update");
+@@ -1606,7 +1617,8 @@
+       cmap.grpmembersfield, " = '", username, "'", NULL);
+   }
+ 
+-  where = _sql_where(cmd, 2, grpwhere, cmap.groupwhere);
++  where = sql_prepare_where(SQL_PREPARE_WHERE_FL_NO_TAGS, cmd, 2, grpwhere,
++    sql_prepare_where(0, cmd, 1, cmap.groupwhere, NULL), NULL);
+   
+   mr = _sql_dispatch(_sql_make_cmd(cmd->tmp_pool, 4, "default",
+     cmap.grptable, cmap.grpfields, where), "sql_select");
+@@ -1746,7 +1758,7 @@
+ static char *resolve_short_tag(cmd_rec *cmd, char tag) {
+   char arg[256] = {'\0'}, *argp;
+ 
+-  switch(tag) {
++  switch (tag) {
+   case 'A': {
+       char *pass;
+ 
+@@ -2915,7 +2927,7 @@
+   /* single select or not? */
+   if (SQL_FASTUSERS) {
+     /* retrieve our list of passwds */
+-    where = _sql_where(cmd, 1, cmap.userwhere);
++    where = sql_prepare_where(0, cmd, 1, cmap.userwhere, NULL);
+ 
+     mr = _sql_dispatch(_sql_make_cmd(cmd->tmp_pool, 4, "default",
+       cmap.usrtable, cmap.usrfields, where), "sql_select");
+@@ -2978,7 +2990,7 @@
+     } 
+   } else {
+     /* retrieve our list of passwds */
+-    where = _sql_where(cmd, 1, cmap.userwhere);
++    where = sql_prepare_where(0, cmd, 1, cmap.userwhere, NULL);
+     
+     mr = _sql_dispatch(_sql_make_cmd(cmd->tmp_pool, 4, "default",
+       cmap.usrtable, cmap.usrfield, where), "sql_select");
+@@ -3086,7 +3098,7 @@
+ 
+   if (SQL_FASTGROUPS) {
+     /* retrieve our list of groups */
+-    where = _sql_where(cmd, 1, cmap.groupwhere);
++    where = sql_prepare_where(0, cmd, 1, cmap.groupwhere, NULL);
+     
+     mr = _sql_dispatch(_sql_make_cmd(cmd->tmp_pool, 6, "default",
+       cmap.grptable, cmap.grpfields, where, NULL), "sql_select");
+@@ -3119,9 +3131,15 @@
+     }
+ 
+   } else {
+-    /* retrieve our list of groups */
+-    where = _sql_where(cmd, 1, cmap.groupwhere);
+-    
++    /* Retrieve our list of groups. */
++    if (cmap.groupwhere &&
++        strlen(cmap.groupwhere) > 0) {
++      where = sql_prepare_where(0, cmd, 1, cmap.groupwhere, NULL);
++
++    } else {
++      where = NULL;
++    }
++ 
+     mr = _sql_dispatch(_sql_make_cmd(cmd->tmp_pool, 6, "default",
+       cmap.grptable, cmap.grpfield, where, NULL, "DISTINCT"), "sql_select");
+     if (check_response(mr) < 0)
+@@ -3593,7 +3611,7 @@
+ 
+   usrwhere = pstrcat(cmd->tmp_pool, cmap.usrfield, " = '", _sql_realuser(cmd),
+     "'", NULL);
+-  where = _sql_where(cmd, 2, usrwhere, cmap.userwhere);
++  where = sql_prepare_where(0, cmd, 2, usrwhere, cmap.userwhere, NULL);
+   
+   query = pstrcat(cmd->tmp_pool, cmap.sql_fstor, ", ",
+ 		  cmap.sql_fretr, ", ", cmap.sql_bstor, ", ",
+@@ -3627,7 +3645,7 @@
+ 
+   usrwhere = pstrcat(cmd->tmp_pool, cmap.usrfield, " = '", _sql_realuser(cmd),
+     "'", NULL);
+-  where = _sql_where(cmd, 2, usrwhere, cmap.userwhere);
++  where = sql_prepare_where(0, cmd, 2, usrwhere, cmap.userwhere, NULL);
+   
+   query = pstrcat(cmd->tmp_pool, cmap.sql_frate, ", ",
+ 		  cmap.sql_fcred, ", ", cmap.sql_brate, ", ",
diff --git a/ftp/proftpd/pkg-plist b/ftp/proftpd/pkg-plist
index 8ec6ec41f8d6..ad8ff27b895a 100644
--- a/ftp/proftpd/pkg-plist
+++ b/ftp/proftpd/pkg-plist
@@ -2,7 +2,6 @@ bin/ftpcount
 bin/ftpdctl
 bin/ftptop
 bin/ftpwho
-etc/proftpd.conf.sample
 include/proftpd/auth.h
 include/proftpd/bindings.h
 include/proftpd/buildstamp.h
@@ -55,6 +54,7 @@ include/proftpd/xferlog.h
 sbin/ftpshut
 sbin/in.proftpd
 sbin/proftpd
+%%MYSQL%%include/proftpd/mod_sql.h
 @unexec if cmp -s %D/etc/proftpd.conf %D/%%EXAMPLESDIR%%/etc/proftpd.conf; then rm -f %D/etc/proftpd.conf; fi
 %%EXAMPLESDIR%%/etc/proftpd.conf
 @exec if [ ! -f %D/etc/proftpd.conf ] ; then cp -p %D/%F %B/proftpd.conf; fi