From ff3bbe0f9942b2808d6b33aaedda72ecb7a47a17 Mon Sep 17 00:00:00 2001 From: Hugues Peccatte Date: Sun, 28 Jun 2020 16:21:28 +0200 Subject: [PATCH 1/2] Fix #16222 Secure parameters before giving them to DI Signed-off-by: Hugues Peccatte --- libraries/classes/Di/Migration.php | 2 +- tbl_chart.php | 5 +++-- tbl_find_replace.php | 5 +++-- tbl_gis_visualization.php | 5 +++-- tbl_relation.php | 5 +++-- tbl_select.php | 5 +++-- tbl_structure.php | 5 +++-- tbl_zoom_select.php | 5 +++-- 8 files changed, 22 insertions(+), 15 deletions(-) diff --git a/libraries/classes/Di/Migration.php b/libraries/classes/Di/Migration.php index 299061065f..cef1fc46cf 100644 --- a/libraries/classes/Di/Migration.php +++ b/libraries/classes/Di/Migration.php @@ -66,6 +66,6 @@ class Migration public function setGlobal(string $key, $value) { $GLOBALS[$key] = $value; - $this->containerBuilder->setParameter($key, $value); + $this->containerBuilder->setParameter($key, $this->containerBuilder->getParameterBag()->escapeValue($value)); } } diff --git a/tbl_chart.php b/tbl_chart.php index e7964461aa..a40904c088 100644 --- a/tbl_chart.php +++ b/tbl_chart.php @@ -25,9 +25,10 @@ $dependency_definitions = [ /** @var Definition $definition */ $definition = $containerBuilder->getDefinition(ChartController::class); +$parameterBag = $containerBuilder->getParameterBag(); array_map( - static function (string $parameterName, $value) use ($definition) { - $definition->replaceArgument($parameterName, $value); + static function (string $parameterName, $value) use ($definition, $parameterBag) { + $definition->replaceArgument($parameterName, $parameterBag->escapeValue($value)); }, array_keys($dependency_definitions), $dependency_definitions diff --git a/tbl_find_replace.php b/tbl_find_replace.php index f6747470ca..5dd964781f 100644 --- a/tbl_find_replace.php +++ b/tbl_find_replace.php @@ -30,9 +30,10 @@ $dependency_definitions = [ /** @var Definition $definition */ $definition = $containerBuilder->getDefinition(SearchController::class); +$parameterBag = $containerBuilder->getParameterBag(); array_map( - static function (string $parameterName, $value) use ($definition) { - $definition->replaceArgument($parameterName, $value); + static function (string $parameterName, $value) use ($definition, $parameterBag) { + $definition->replaceArgument($parameterName, $parameterBag->escapeValue($value)); }, array_keys($dependency_definitions), $dependency_definitions diff --git a/tbl_gis_visualization.php b/tbl_gis_visualization.php index bb96bbb915..ca3a3506b7 100644 --- a/tbl_gis_visualization.php +++ b/tbl_gis_visualization.php @@ -42,9 +42,10 @@ $dependency_definitions = [ /** @var Definition $definition */ $definition = $containerBuilder->getDefinition(GisVisualizationController::class); +$parameterBag = $containerBuilder->getParameterBag(); array_map( - static function (string $parameterName, $value) use ($definition) { - $definition->replaceArgument($parameterName, $value); + static function (string $parameterName, $value) use ($definition, $parameterBag) { + $definition->replaceArgument($parameterName, $parameterBag->escapeValue($value)); }, array_keys($dependency_definitions), $dependency_definitions diff --git a/tbl_relation.php b/tbl_relation.php index 398818e381..1d4cd8d4e3 100644 --- a/tbl_relation.php +++ b/tbl_relation.php @@ -77,9 +77,10 @@ if (Util::isForeignKeySupported($tbl_storage_engine)) { /** @var Definition $definition */ $definition = $containerBuilder->getDefinition(RelationController::class); +$parameterBag = $containerBuilder->getParameterBag(); array_map( - static function (string $parameterName, $value) use ($definition) { - $definition->replaceArgument($parameterName, $value); + static function (string $parameterName, $value) use ($definition, $parameterBag) { + $definition->replaceArgument($parameterName, $parameterBag->escapeValue($value)); }, array_keys($dependency_definitions), $dependency_definitions diff --git a/tbl_select.php b/tbl_select.php index 23b2ad295a..4abd676436 100644 --- a/tbl_select.php +++ b/tbl_select.php @@ -30,9 +30,10 @@ $dependency_definitions = [ /** @var Definition $definition */ $definition = $containerBuilder->getDefinition(SearchController::class); +$parameterBag = $containerBuilder->getParameterBag(); array_map( - static function (string $parameterName, $value) use ($definition) { - $definition->replaceArgument($parameterName, $value); + static function (string $parameterName, $value) use ($definition, $parameterBag) { + $definition->replaceArgument($parameterName, $parameterBag->escapeValue($value)); }, array_keys($dependency_definitions), $dependency_definitions diff --git a/tbl_structure.php b/tbl_structure.php index 294a390c1b..0cda2b63e6 100644 --- a/tbl_structure.php +++ b/tbl_structure.php @@ -55,9 +55,10 @@ $dependency_definitions = [ /** @var Definition $definition */ $definition = $containerBuilder->getDefinition(StructureController::class); +$parameterBag = $containerBuilder->getParameterBag(); array_map( - static function (string $parameterName, $value) use ($definition) { - $definition->replaceArgument($parameterName, $value); + static function (string $parameterName, $value) use ($definition, $parameterBag) { + $definition->replaceArgument($parameterName, $parameterBag->escapeValue($value)); }, array_keys($dependency_definitions), $dependency_definitions diff --git a/tbl_zoom_select.php b/tbl_zoom_select.php index fc458ca458..2cea5cb0a1 100644 --- a/tbl_zoom_select.php +++ b/tbl_zoom_select.php @@ -29,9 +29,10 @@ $dependency_definitions = [ /** @var Definition $definition */ $definition = $containerBuilder->getDefinition(SearchController::class); +$parameterBag = $containerBuilder->getParameterBag(); array_map( - static function (string $parameterName, $value) use ($definition) { - $definition->replaceArgument($parameterName, $value); + static function (string $parameterName, $value) use ($definition, $parameterBag) { + $definition->replaceArgument($parameterName, $parameterBag->escapeValue($value)); }, array_keys($dependency_definitions), $dependency_definitions From 68d6e264536e292f3f3730c6cbfeae90a0cee137 Mon Sep 17 00:00:00 2001 From: William Desportes Date: Wed, 1 Jul 2020 17:59:01 +0200 Subject: [PATCH 2/2] Add a ChangeLog entry for #16222 Signed-off-by: William Desportes --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 7e1c5ea8b5..d10013ba9b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -38,6 +38,7 @@ phpMyAdmin - ChangeLog - issue #16201 Trim spaces for integer values in table search - issue #16076 Fixed cannot edit or export TIMESTAMP column with default CURRENT_TIMESTAMP in MySQL >= 8.0.13 - issue #16226 Fix error 500 after copying a table +- issue #16222 Fixed can't use the search page when the table name has special characters 5.0.2 (2020-03-20) - issue Fixed deprecation warning "implode(): Passing glue string after array is deprecated." function on export page