From 7bf2ba3ba534204d6cece6f9c6b5ab7ef5e78202 Mon Sep 17 00:00:00 2001
From: Greg Roach <fisharebest@webtrees.net>
Date: Wed, 28 Aug 2019 14:49:44 +0100
Subject: Fix: #2560 - Validation of database names

---
 resources/views/setup/step-4-database-mysql.phtml  | 6 +-----
 resources/views/setup/step-4-database-pgsql.phtml  | 6 +-----
 resources/views/setup/step-4-database-sqlite.phtml | 2 +-
 resources/views/setup/step-4-database-sqlsvr.phtml | 5 +----
 4 files changed, 4 insertions(+), 15 deletions(-)

(limited to 'resources/views')

diff --git a/resources/views/setup/step-4-database-mysql.phtml b/resources/views/setup/step-4-database-mysql.phtml
index 064bb6e8b8..3534248cf2 100644
--- a/resources/views/setup/step-4-database-mysql.phtml
+++ b/resources/views/setup/step-4-database-mysql.phtml
@@ -87,11 +87,7 @@
         </label>
 
         <div class="col-sm-9">
-            <input class="form-control" dir="ltr" id="dbname" name="dbname" pattern="[a-zA-Z0-9_]+" type="text" value="<?= e($dbname) ?>">
-
-            <p class="small text-muted">
-                <?= I18N::translate('Use letters A-Z, a-z, digits 0-9, or underscores') ?>
-            </p>
+            <input class="form-control" dir="ltr" id="dbname" name="dbname" pattern="[^`'&quot;]{1,64}" type="text" value="<?= e($dbname) ?>">
         </div>
     </div>
 
diff --git a/resources/views/setup/step-4-database-pgsql.phtml b/resources/views/setup/step-4-database-pgsql.phtml
index 8637821d45..8bccf30665 100644
--- a/resources/views/setup/step-4-database-pgsql.phtml
+++ b/resources/views/setup/step-4-database-pgsql.phtml
@@ -74,11 +74,7 @@
             <?= I18N::translate('Database name') ?>
         </label>
         <div class="col-sm-9">
-            <input class="form-control" dir="ltr" id="dbname" name="dbname" pattern="^[^`]+$" type="text" value="<?= e($dbname) ?>">
-
-            <p class="small text-muted">
-                <?= I18N::translate('Use letters A-Z, a-z, digits 0-9, or underscores') ?>
-            </p>
+            <input class="form-control" dir="ltr" id="dbname" name="dbname" pattern="[^`'&quot;]{1,63}" type="text" value="<?= e($dbname) ?>">
         </div>
     </div>
 
diff --git a/resources/views/setup/step-4-database-sqlite.phtml b/resources/views/setup/step-4-database-sqlite.phtml
index 99051e87e1..31a6b63172 100644
--- a/resources/views/setup/step-4-database-sqlite.phtml
+++ b/resources/views/setup/step-4-database-sqlite.phtml
@@ -37,7 +37,7 @@ use Fisharebest\Webtrees\Webtrees; ?>
                     <span class="input-group-text"><?=e( realpath(Webtrees::ROOT_DIR)) ?>data/</span>
                 </div>
 
-                <input class="form-control" id="dbname" name="dbname" pattern="[a-zA-Z0-9_]+" type="text" value="<?= e($dbname) ?>">
+                <input class="form-control" id="dbname" name="dbname" pattern="[a-zA-Z0-9_]{1,63}" type="text" value="<?= e($dbname) ?>">
 
                 <div class="input-group-append">
                     <span class="input-group-text">.sqlite</span>
diff --git a/resources/views/setup/step-4-database-sqlsvr.phtml b/resources/views/setup/step-4-database-sqlsvr.phtml
index 6ba0a0fc31..bcee817061 100644
--- a/resources/views/setup/step-4-database-sqlsvr.phtml
+++ b/resources/views/setup/step-4-database-sqlsvr.phtml
@@ -74,10 +74,7 @@
             <?= I18N::translate('Database name') ?>
         </label>
         <div class="col-sm-9">
-            <input class="form-control" dir="ltr" id="dbname" name="dbname" pattern="^[^`]+$" type="text" value="<?= e($dbname) ?>">
-            <p class="small text-muted">
-                <?= I18N::translate('Use letters A-Z, a-z, digits 0-9, or underscores') ?>
-            </p>
+            <input class="form-control" dir="ltr" id="dbname" name="dbname" pattern="[^`'&quot;]{1,128}" type="text" value="<?= e($dbname) ?>">
         </div>
     </div>
 
-- 
cgit v1.3