From 4a439e1c69c708887ca2542ab932a71ea8134871 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@users.sourceforge.net>
Date: Thu, 17 Apr 2008 10:56:49 +0000
Subject: [PATCH] Security: Backup and restore works even with root empty
 password

---
 htdocs/admin/tools/dolibarr_import.php | 19 +++++++++++--------
 htdocs/admin/tools/export.php          | 11 ++++++++---
 2 files changed, 19 insertions(+), 11 deletions(-)

diff --git a/htdocs/admin/tools/dolibarr_import.php b/htdocs/admin/tools/dolibarr_import.php
index c0fc649c31e..fa82e7d9bee 100644
--- a/htdocs/admin/tools/dolibarr_import.php
+++ b/htdocs/admin/tools/dolibarr_import.php
@@ -14,19 +14,15 @@
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
- *
- * $Id$
- * $Source$
  */
 
 /**
 		\file 		htdocs/admin/tools/dolibarr_import.php
 		\brief      Page import de la base
-		\version    $Revision$
+		\version    $Id$
 */
 
 require("./pre.inc.php");
-include_once $dolibarr_main_document_root."/lib/databases/".$conf->db->type.".lib.php";
 
 $langs->load("admin");
 $langs->load("other");
@@ -115,11 +111,18 @@ function show_checked_option() {
 	<?php
 	// Parameteres execution	
 	$command=escapeshellarg('mysql');
-	//$param=escapeshellarg($dolibarr_main_db_name)." -h ".escapeshellarg($dolibarr_main_db_host)." -u ".escapeshellarg($dolibarr_main_db_user)." -p".escapeshellarg($dolibarr_main_db_pass);
-	$param=$dolibarr_main_db_name." -h ".$dolibarr_main_db_host." -u ".$dolibarr_main_db_user." -p".$dolibarr_main_db_pass;
 
+	$param=$dolibarr_main_db_name." -h ".$dolibarr_main_db_host." -u ".$dolibarr_main_db_user;
+	$paramcrypted=$param;
+	$paramclear=$param;
+	if (! empty($dolibarr_main_db_pass))
+	{
+		$paramcrypted.=" -p".eregi_replace('.','*',$dolibarr_main_db_pass);
+		$paramclear.=" -p".$dolibarr_main_db_pass;
+	}
+	
 	echo $langs->trans("ImportMySqlDesc"); ?><br>
-	<textarea rows="1" cols="120"><?php echo $langs->trans("ImportMySqlCommand",$command,$param); ?></textarea><br>
+	<textarea rows="1" cols="120"><?php echo $langs->trans("ImportMySqlCommand",$command,$paramcrypted); ?></textarea><br>
     </div>
 	
 	<script type="text/javascript" language="javascript">
diff --git a/htdocs/admin/tools/export.php b/htdocs/admin/tools/export.php
index cf8c0bb90b3..81ac714ce54 100644
--- a/htdocs/admin/tools/export.php
+++ b/htdocs/admin/tools/export.php
@@ -115,9 +115,14 @@ if ($what == 'mysql')
 	{
 		$param.=" -d";
 	}
-	$paramcrypted=$param." -p".eregi_replace('.','*',$dolibarr_main_db_pass);
-	$paramclear=$param." -p".$dolibarr_main_db_pass;
-
+	$paramcrypted=$param;
+	$paramclear=$param;
+	if (! empty($dolibarr_main_db_pass))
+	{
+		$paramcrypted.=" -p".eregi_replace('.','*',$dolibarr_main_db_pass);
+		$paramclear.=" -p".$dolibarr_main_db_pass;
+	}
+	
 	$relativepathdir='/admin/temp';
 	$relativepathfile=$relativepathdir.'/'.$file;
 	// for compression format, we add extension