gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge #17377 - Fix incorrect usage of escapeMysqlWildcards

Browse Source 
Pull-request: #17377

Signed-off-by: William Desportes <williamdes@wdes.fr>
This commit is contained in:
William Desportes 2022-03-05 18:47:32 +01:00
commit 049c6f8771
No known key found for this signature in database
GPG Key ID: 90A0EF1B8251A889
5 changed files with 35 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
libraries/classes/DatabaseInterface.php
View File

@ -55,6 +55,7 @@ use function strncmp;
use function strpos;
use function strtolower;
use function strtoupper;
use function strtr;
use function substr;
use function syslog;
use function trigger_error;
@ -490,9 +491,7 @@ class DatabaseInterface implements DbalInterface
) . '\')';
} else {
$sql .= " `Name` LIKE '"
. Util::escapeMysqlWildcards(
$this->escapeString($table, $link)
)
. $this->escapeMysqlLikeString($table, $link)
. "%'";
}
$needAnd = true;
@ -904,7 +903,7 @@ class DatabaseInterface implements DbalInterface
$sql = QueryGenerator::getColumnsSql(
$database,
$table,
$column === null ? null : Util::escapeMysqlWildcards($this->escapeString($column)),
$column === null ? null : $this->escapeMysqlLikeString($column),
$full
);
$fields = $this->fetchResult($sql, 'Field', null, $link);
@ -2322,6 +2321,19 @@ class DatabaseInterface implements DbalInterface
return $this->extension->escapeString($this->links[$link], $str);
}
/**
* returns properly escaped string for use in MySQL LIKE clauses
*
* @param string $str string to be escaped
* @param int $link optional database link to use
*
* @return string a MySQL escaped LIKE string
*/
public function escapeMysqlLikeString(string $str, int $link = self::CONNECT_USER)
{
return $this->escapeString(strtr($str, ['\\' => '\\\\', '_' => '\\_', '%' => '\\%']), $link);
}
/**
* Checks if this database server is running on Amazon RDS.
*/

10
libraries/classes/Dbal/DbalInterface.php
View File

@ -721,6 +721,16 @@ interface DbalInterface
*/
public function escapeString(string $str, $link = DatabaseInterface::CONNECT_USER);
/**
* returns properly escaped string for use in MySQL LIKE clauses
*
* @param string $str string to be escaped
* @param int $link optional database link to use
*
* @return string a MySQL escaped LIKE string
*/
public function escapeMysqlLikeString(string $str, int $link = DatabaseInterface::CONNECT_USER);
/**
* Checks if this database server is running on Amazon RDS.
*/

12
libraries/classes/Server/Privileges.php
View File

@ -3530,9 +3530,7 @@ class Privileges
if (isset($_POST['createdb-1'])) {
// Create database with same name and grant all privileges
$q = 'CREATE DATABASE IF NOT EXISTS '
. Util::backquote(
$this->dbi->escapeString($username)
) . ';';
. Util::backquote($username) . ';';
$sql_query .= $q;
if (! $this->dbi->tryQuery($q)) {
$message = Message::rawError((string) $this->dbi->getError());
@ -3546,9 +3544,7 @@ class Privileges
$q = 'GRANT ALL PRIVILEGES ON '
. Util::backquote(
Util::escapeMysqlWildcards(
$this->dbi->escapeString($username)
)
Util::escapeMysqlWildcards($username)
) . '.* TO \''
. $this->dbi->escapeString($username)
. '\'@\'' . $this->dbi->escapeString($hostname) . '\';';
@ -3562,9 +3558,7 @@ class Privileges
// Grant all privileges on wildcard name (username\_%)
$q = 'GRANT ALL PRIVILEGES ON '
. Util::backquote(
Util::escapeMysqlWildcards(
$this->dbi->escapeString($username)
) . '\_%'
Util::escapeMysqlWildcards($username) . '\_%'
) . '.* TO \''
. $this->dbi->escapeString($username)
. '\'@\'' . $this->dbi->escapeString($hostname) . '\';';

4
libraries/classes/Util.php
View File

@ -2885,8 +2885,8 @@ class Util
$tblGroupSql = '';
$whereAdded = false;
if (Core::isValid($_REQUEST['tbl_group'])) {
$group = self::escapeMysqlWildcards($_REQUEST['tbl_group']);
$groupWithSeparator = self::escapeMysqlWildcards(
$group = $dbi->escapeMysqlLikeString($_REQUEST['tbl_group']);
$groupWithSeparator = $dbi->escapeMysqlLikeString(
$_REQUEST['tbl_group']
. $GLOBALS['cfg']['NavigationTreeTableSeparator']
);

8
test/classes/Stubs/DbiDummy.php
View File

@ -1714,7 +1714,7 @@ class DbiDummy implements DbiExtension
'result' => [],
],
[
'query' => "SHOW TABLE STATUS FROM `my_dataset` WHERE `Name` LIKE 'company\_users%'",
'query' => "SHOW TABLE STATUS FROM `my_dataset` WHERE `Name` LIKE 'company\\\\_users%'",
'result' => [],
],
[
@ -2328,7 +2328,7 @@ class DbiDummy implements DbiExtension
'result' => [['1']],
],
[
'query' => 'SHOW TABLE STATUS FROM `PMA_db` WHERE `Name` LIKE \'PMA\_table%\'',
'query' => 'SHOW TABLE STATUS FROM `PMA_db` WHERE `Name` LIKE \'PMA\\\\_table%\'',
'columns' => ['Name'],
'result' => [['PMA_table']],
],
@ -2382,7 +2382,7 @@ class DbiDummy implements DbiExtension
],
],
[
'query' => 'SHOW FULL COLUMNS FROM `testdb`.`mytable` LIKE \'\_id\'',
'query' => 'SHOW FULL COLUMNS FROM `testdb`.`mytable` LIKE \'\\\\_id\'',
'columns' => ['Field', 'Type', 'Collation', 'Null', 'Key', 'Default', 'Extra', 'Privileges', 'Comment'],
'result' => [
[
@ -2514,7 +2514,7 @@ class DbiDummy implements DbiExtension
'result' => [],
],
[
'query' => 'SHOW TABLE STATUS FROM `my_db` WHERE `Name` LIKE \'test\_tbl%\'',
'query' => 'SHOW TABLE STATUS FROM `my_db` WHERE `Name` LIKE \'test\\\\_tbl%\'',
'result' => [],
],
[