From b84acd86c519ffba94be7cd575a12bfe05ba75da Mon Sep 17 00:00:00 2001 From: Justin Maurer Date: Wed, 16 Nov 2022 09:42:52 -0600 Subject: [PATCH 1/7] added 'FOR UPDATE' check to is_write_query() to accommodate Wordfence's 2FA implementation --- db.php | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/db.php b/db.php index 4ecf553..e9ec37a 100644 --- a/db.php +++ b/db.php @@ -341,7 +341,10 @@ public function get_table_from_query( $q ) { public function is_write_query( $q ) { // Quick and dirty: only SELECT statements are considered read-only. $q = ltrim( $q, "\r\n\t (" ); - return ! preg_match( '/^(?:SELECT|SHOW|DESCRIBE|DESC|EXPLAIN)\s/i', $q ); + return ( + ! preg_match( '/^(?:SELECT|SHOW|DESCRIBE|DESC|EXPLAIN)\s/i', $q ) + || preg_match( '/(\sFOR UPDATE)/i', $q ) + ); } /** From 6a2ff3bd3428372044e749b3a33f3cc5cb32b12a Mon Sep 17 00:00:00 2001 From: Justin Maurer Date: Wed, 16 Nov 2022 09:42:52 -0600 Subject: [PATCH 2/7] added 'FOR UPDATE' check to is_write_query() to accommodate Wordfence's 2FA implementation --- db.php | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/db.php b/db.php index f1a7e01..2a15c54 100644 --- a/db.php +++ b/db.php @@ -341,7 +341,10 @@ public function get_table_from_query( $q ) { public function is_write_query( $q ) { // Quick and dirty: only SELECT statements are considered read-only. $q = ltrim( $q, "\r\n\t (" ); - return ! preg_match( '/^(?:SELECT|SHOW|DESCRIBE|DESC|EXPLAIN)\s/i', $q ); + return ( + ! preg_match( '/^(?:SELECT|SHOW|DESCRIBE|DESC|EXPLAIN)\s/i', $q ) + || preg_match( '/(\sFOR UPDATE)/i', $q ) + ); } /** From ada8e8bdae94b835b4c216555d7dae641897f230 Mon Sep 17 00:00:00 2001 From: Justin Maurer Date: Thu, 18 Jul 2024 15:20:41 -0500 Subject: [PATCH 3/7] Fixes https://github.com/Automattic/HyperDB/issues/155. Allows error suppression, to accommodate logic that expects `wpdb->query()` to return false on db errors. --- db.php | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/db.php b/db.php index e9ec37a..49f51a6 100644 --- a/db.php +++ b/db.php @@ -1440,7 +1440,13 @@ public function ex_mysql_query( $query, $dbh ) { if ( ! $this->use_mysqli ) { return mysql_query( $query, $dbh ); } - + $driver = new mysqli_driver(); + $this->suppress_errors(); + if ($this->suppress_errors) { + $driver->report_mode = MYSQLI_REPORT_OFF; + } else { + $driver->report_mode = MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT; + } return mysqli_query( $dbh, $query ); } From 46685bba997b2fee7ff8a1bf16dd514abeb3f5ab Mon Sep 17 00:00:00 2001 From: Justin Maurer Date: Thu, 18 Jul 2024 15:20:41 -0500 Subject: [PATCH 4/7] Fixes https://github.com/Automattic/HyperDB/issues/155. Allows error suppression, to accommodate logic that expects `wpdb->query()` to return false on db errors. --- db.php | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/db.php b/db.php index 5281f48..d3e7910 100644 --- a/db.php +++ b/db.php @@ -1447,7 +1447,13 @@ public function ex_mysql_query( $query, $dbh ) { if ( ! $this->use_mysqli ) { return mysql_query( $query, $dbh ); } - + $driver = new mysqli_driver(); + $this->suppress_errors(); + if ($this->suppress_errors) { + $driver->report_mode = MYSQLI_REPORT_OFF; + } else { + $driver->report_mode = MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT; + } return mysqli_query( $dbh, $query ); } From 195389ee9acd800c9e29fb4d5a251945d801eb28 Mon Sep 17 00:00:00 2001 From: Justin Maurer Date: Thu, 18 Jul 2024 15:25:47 -0500 Subject: [PATCH 5/7] version 1.10: Fix `FOR UPDATE` write query detection. Support `wpdb->suppress_errors`. --- db.php | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/db.php b/db.php index d3e7910..cdcadae 100644 --- a/db.php +++ b/db.php @@ -1,12 +1,12 @@ Date: Thu, 18 Jul 2024 16:21:06 -0500 Subject: [PATCH 6/7] Whoops! Removed the forced error suppression I was using for testing. --- db.php | 1 - 1 file changed, 1 deletion(-) diff --git a/db.php b/db.php index 49f51a6..57e988f 100644 --- a/db.php +++ b/db.php @@ -1441,7 +1441,6 @@ public function ex_mysql_query( $query, $dbh ) { return mysql_query( $query, $dbh ); } $driver = new mysqli_driver(); - $this->suppress_errors(); if ($this->suppress_errors) { $driver->report_mode = MYSQLI_REPORT_OFF; } else { From e530700383192aafe3eae8b765f9ac2a04abc323 Mon Sep 17 00:00:00 2001 From: Justin Maurer Date: Thu, 18 Jul 2024 16:21:06 -0500 Subject: [PATCH 7/7] Whoops! Removed the forced error suppression I was using for testing. --- db.php | 1 - 1 file changed, 1 deletion(-) diff --git a/db.php b/db.php index cdcadae..9b564ad 100644 --- a/db.php +++ b/db.php @@ -1448,7 +1448,6 @@ public function ex_mysql_query( $query, $dbh ) { return mysql_query( $query, $dbh ); } $driver = new mysqli_driver(); - $this->suppress_errors(); if ($this->suppress_errors) { $driver->report_mode = MYSQLI_REPORT_OFF; } else {