granicus.if.org Git

1 --TEST--

2 SQLite3 user authorizer callback

3 --SKIPIF--

4 <?php require_once(__DIR__ . '/skipif.inc'); ?>

5 --FILE--

6 <?php

8 $db = new SQLite3(':memory:');

9 $db->enableExceptions(true);

11 $db->setAuthorizer(function (int $action) {

12 if ($action == SQLite3::SELECT) {

13 return SQLite3::OK;

14 }

16 return SQLite3::DENY;

17 });

19 // This query should be accepted

20 var_dump($db->querySingle('SELECT 1;'));

22 try {

23 // This one should fail

24 var_dump($db->querySingle('CREATE TABLE test (a, b);'));

25 } catch (\Exception $e) {

26 echo $e->getMessage() . "\n";

27 }

29 // Test disabling the authorizer

30 $db->setAuthorizer(null);

32 // This should now succeed

33 var_dump($db->exec('CREATE TABLE test (a); INSERT INTO test VALUES (42);'));

34 var_dump($db->querySingle('SELECT a FROM test;'));

36 // Test if we are getting the correct arguments

37 $db->setAuthorizer(function (int $action) {

38 $constants = (new ReflectionClass('SQLite3'))->getConstants();

39 $constants = array_flip($constants);

41 var_dump($constants[$action], implode(',', array_slice(func_get_args(), 1)));

42 return SQLITE3::OK;

43 });

45 var_dump($db->exec('SELECT * FROM test WHERE a = 42;'));

46 var_dump($db->exec('DROP TABLE test;'));

48 // Try to return something invalid from the authorizer

49 $db->setAuthorizer(function () {

50 return 'FAIL';

51 });

53 try {

54 var_dump($db->querySingle('SELECT 1;'));

55 } catch (\Exception $e) {

56 echo $e->getMessage() . "\n";

57 echo $e->getPrevious()->getMessage() . "\n";

58 }

60 $db->setAuthorizer(function () {

61 return 4200;

62 });

64 try {

65 var_dump($db->querySingle('SELECT 1;'));

66 } catch (\Exception $e) {

67 echo $e->getMessage() . "\n";

68 echo $e->getPrevious()->getMessage() . "\n";

69 }

71 ?>

72 --EXPECTF--

73 int(1)

74 Unable to prepare statement: 23, not authorized

75 bool(true)

76 int(42)

77 string(6) "SELECT"

78 string(3) ",,,"

79 string(4) "READ"

80 string(12) "test,a,main,"

81 string(4) "READ"

82 string(12) "test,a,main,"

83 bool(true)

84 string(6) "DELETE"

85 string(20) "sqlite_master,,main,"

86 string(10) "DROP_TABLE"

87 string(11) "test,,main,"

88 string(6) "DELETE"

89 string(11) "test,,main,"

90 string(6) "DELETE"

91 string(20) "sqlite_master,,main,"

92 string(4) "READ"

93 string(28) "sqlite_master,tbl_name,main,"

94 string(4) "READ"

95 string(24) "sqlite_master,type,main,"

96 string(6) "UPDATE"

97 string(28) "sqlite_master,rootpage,main,"

98 string(4) "READ"

99 string(28) "sqlite_master,rootpage,main,"

100 bool(true)

101 Unable to prepare statement: 23, not authorized

102 The authorizer callback returned an invalid type: expected int

103 Unable to prepare statement: 23, not authorized

104 The authorizer callback returned an invalid value