From 0c848c31b9b95514db78e1b565a5e1d6892ec1a2 Mon Sep 17 00:00:00 2001 From: Timo Sirainen Date: Mon, 23 Feb 2026 13:37:09 +0200 Subject: [PATCH] [PATCH 06/24] lib-settings: settings_get_params() - Fix using provided escape_func This fixes auth-sql and auth-ldap to actually do escaping. Gbp-Pq: Name CVE-2026-24031-27860-3.patch --- src/lib-settings/settings.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/src/lib-settings/settings.c b/src/lib-settings/settings.c index 8e4ac6a..01a5379 100644 --- a/src/lib-settings/settings.c +++ b/src/lib-settings/settings.c @@ -1540,8 +1540,14 @@ settings_var_expand_init(struct settings_apply_ctx *ctx) ctx->var_params.tables_arr = array_front(&init_ctx.tables); ctx->var_params.providers_arr = array_front(&init_ctx.providers); ctx->var_params.contexts = array_front(&init_ctx.contexts); - ctx->var_params.escape_func = init_ctx.escape_func; - ctx->var_params.escape_context = init_ctx.escape_context; + if (ctx->escape_func != NULL) { + /* settings_get_params()'s escape_func overrides all others */ + ctx->var_params.escape_func = ctx->escape_func; + ctx->var_params.escape_context = ctx->escape_context; + } else { + ctx->var_params.escape_func = init_ctx.escape_func; + ctx->var_params.escape_context = init_ctx.escape_context; + } ctx->var_params.event = ctx->event; } -- 2.30.2