Backport #49603 Fix unreported credentials exposure on connection lost

qgis · Sep 9, 2022 · a7a9831 · a7a9831
1 parent 925020c
commit a7a9831
Show file tree

Hide file tree

Showing 4 changed files with 30 additions and 1 deletion.
diff --git a/src/providers/postgres/qgspostgresconn.cpp b/src/providers/postgres/qgspostgresconn.cpp
@@ -595,6 +595,12 @@ bool QgsPostgresConn::getTableInfo( bool searchGeometryColumnsOnly, bool searchP
   result = PQexec( query, true );
   // NOTE: we intentionally continue if the query fails
   //       (for example because PostGIS is not installed)
+
+  if ( ! result.result() )
+  {
+    return false;
+  }
+
   for ( int idx = 0; idx < result.PQntuples(); idx++ )
   {
     QString tableName = result.PQgetvalue( idx, 0 );

diff --git a/src/providers/postgres/qgspostgresprojectstorage.cpp b/src/providers/postgres/qgspostgresprojectstorage.cpp
@@ -53,6 +53,12 @@ static bool _projectsTableExists( QgsPostgresConn &conn, const QString &schemaNa
                .arg( QgsPostgresConn::quotedValue( tableName ), QgsPostgresConn::quotedValue( schemaName ) )
              );
   QgsPostgresResult res( conn.PQexec( sql ) );
+
+  if ( ! res.result() )
+  {
+    return false;
+  }
+
   return res.PQgetvalue( 0, 0 ).toInt() > 0;
 }
 

diff --git a/src/providers/postgres/qgspostgresprovider.cpp b/src/providers/postgres/qgspostgresprovider.cpp
@@ -810,6 +810,12 @@ bool QgsPostgresProvider::loadFields()
     // Get the table description
     sql = QStringLiteral( "SELECT description FROM pg_description WHERE objoid=regclass(%1)::oid AND objsubid=0" ).arg( quotedValue( mQuery ) );
     QgsPostgresResult tresult( connectionRO()->PQexec( sql ) );
+
+    if ( ! tresult.result() )
+    {
+      throw PGException( tresult );
+    }
+
     if ( tresult.PQntuples() > 0 )
     {
       mDataComment = tresult.PQgetvalue( 0, 0 );
@@ -873,6 +879,12 @@ bool QgsPostgresProvider::loadFields()
                    tableoidsFilter );
 
       QgsPostgresResult fmtFieldTypeResult( connectionRO()->PQexec( sql ) );
+
+      if ( ! fmtFieldTypeResult.result() )
+      {
+        throw PGException( fmtFieldTypeResult );
+      }
+
       for ( int i = 0; i < fmtFieldTypeResult.PQntuples(); ++i )
       {
         Oid attrelid = fmtFieldTypeResult.PQgetvalue( i, 0 ).toUInt();

diff --git a/src/providers/postgres/qgspostgresproviderconnection.cpp b/src/providers/postgres/qgspostgresproviderconnection.cpp
@@ -38,7 +38,7 @@ QgsPostgresProviderConnection::QgsPostgresProviderConnection( const QString &nam
   mProviderKey = QStringLiteral( "postgres" );
   // Remove the sql and table empty parts
   const QRegularExpression removePartsRe { R"raw(\s*sql=\s*|\s*table=""\s*)raw" };
-  setUri( QgsPostgresConn::connUri( name ).uri().replace( removePartsRe, QString() ) );
+  setUri( QgsPostgresConn::connUri( name ).uri( false ).replace( removePartsRe, QString() ) );
   setDefaultCapabilities();
 }
 
@@ -285,6 +285,11 @@ QgsAbstractDatabaseProviderConnection::QueryResult QgsPostgresProviderConnection
       }
     }
 
+    if ( ! errCause.isEmpty() )
+    {
+      throw QgsProviderConnectionException( errCause );
+    }
+
     const qlonglong numRows { res->PQntuples() };
 
     if ( numRows > 0 )