[PATCH 06/24] lib-settings: settings_get_params() - Fix using provided escape_func

This fixes auth-sql and auth-ldap to actually do escaping.

Gbp-Pq: Name CVE-2026-24031-27860-3.patch

diff --git a/src/lib-settings/settings.c b/src/lib-settings/settings.c
index 8e4ac6aef94780a32de7350de81d98961b911bea..01a5379ec428552948db372b45f8d5ebed025e86 100644 (file)
--- a/src/lib-settings/settings.c
+++ b/src/lib-settings/settings.c
@@ -1540,8 +1540,14 @@ settings_var_expand_init(struct settings_apply_ctx *ctx)
        ctx->var_params.tables_arr = array_front(&init_ctx.tables);
        ctx->var_params.providers_arr = array_front(&init_ctx.providers);
        ctx->var_params.contexts = array_front(&init_ctx.contexts);
-       ctx->var_params.escape_func = init_ctx.escape_func;
-       ctx->var_params.escape_context = init_ctx.escape_context;
+       if (ctx->escape_func != NULL) {
+               /* settings_get_params()'s escape_func overrides all others */
+               ctx->var_params.escape_func = ctx->escape_func;
+               ctx->var_params.escape_context = ctx->escape_context;
+       } else {
+               ctx->var_params.escape_func = init_ctx.escape_func;
+               ctx->var_params.escape_context = init_ctx.escape_context;
+       }
        ctx->var_params.event = ctx->event;
 }