Bug where configuration file was escaped incorrectly

Bug where a timeout of 0 was incorrectly recognized

2 files changed, 17 insertions, 9 deletions

diff --git a/lib/debug.lib.php b/lib/debug.lib.php
index e6636976..928b4f8d 100644
--- a/lib/debug.lib.php
+++ b/lib/debug.lib.php
@@ -225,12 +225,8 @@ function check_php_memory() {
  */
 function check_php_timelimit() {
 
-	$current = ini_get('max_execution_time');
-	if (intval($current) < 60) {
-		return false;
-	}
-
-	return true;
+	$current = intval(ini_get('max_execution_time'));
+	return ($current > 60 || $current == 0);
 
 } // check_php_timelimit
 
@@ -352,10 +348,10 @@ function generate_config($current) {
 
 			/* Put in the current value */
 			if ($key == 'config_version') {
-				$line = $key . ' = ' . addslashes($value);
+				$line = $key . ' = ' . escape_ini($value);
 			}
 			elseif (isset($current[$key])) {
-				$line = $key . ' = "' . addslashes($current[$key]) . '"';
+				$line = $key . ' = "' . escape_ini($current[$key]) . '"';
 				unset($current[$key]);
 			} // if set
 
@@ -370,6 +366,18 @@ function generate_config($current) {
 } // generate_config
 
 /**
+ * escape_ini
+ * Escape a value used for inserting into an ini file. 
+ * Won't quote ', like addslashes does.
+ */
+function escape_ini($str) {
+
+	return str_replace('"', '\"', $str);
+
+}
+
+
+/**
  * debug_ok
  * Return an "OK" with the specified string
  */
diff --git a/lib/install.php b/lib/install.php
index 0513f5b7..16ce2b18 100644
--- a/lib/install.php
+++ b/lib/install.php
@@ -177,7 +177,7 @@ function install_insert_db($username,$password,$hostname,$database,$dbuser=false
 	if ($_POST['db_user'] == 'create_db_user' || (strlen($dbuser) AND strlen($dbpass))) {
 
 		$db_user = $_POST['db_username'] ? scrub_in($_POST['db_username']) : $dbuser;
-		$db_pass = $_POST['db_password'] ? scrub_in($_POST['db_password']) : $dbpass;
+		$db_pass = $_POST['db_password'] ? $_POST['db_password'] : $dbpass;
 
 		if (!strlen($db_user) || !strlen($db_pass)) {
 			Error::add('general',_('Error: Ampache SQL Username or Password missing'));