gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'security/QA_4_9-security' into QA_4_9

Browse Source
This commit is contained in:
Isaac Bennetch 2020-10-09 21:32:47 -04:00
commit 1100bb6a4c
5 changed files with 22 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
js/tbl_zoom_plot_jqplot.js
View File

@ -558,7 +558,8 @@ AJAX.registerOnload('tbl_zoom_plot_jqplot.js', function () {
value[dataLabel], // for highlighter
// (may set an undefined value)
value.where_clause, // for click on point
key // key from searchedData
key, // key from searchedData
value.where_clause_sign
]);
});
@ -591,7 +592,8 @@ AJAX.registerOnload('tbl_zoom_plot_jqplot.js', function () {
'server' : PMA_commonParams.get('server'),
'db' : PMA_commonParams.get('db'),
'table' : PMA_commonParams.get('table'),
'where_clause' : data[3]
'where_clause' : data[3],
'where_clause_sign' : data[5]
};
$.post('tbl_zoom_select.php', post_params, function (data) {

9
libraries/classes/Controllers/Table/TableSearchController.php
View File

@ -8,6 +8,7 @@
namespace PhpMyAdmin\Controllers\Table;
use PhpMyAdmin\Controllers\TableController;
use PhpMyAdmin\Core;
use PhpMyAdmin\DatabaseInterface;
use PhpMyAdmin\Relation;
use PhpMyAdmin\Sql;
@ -345,13 +346,15 @@ class TableSearchController extends TableController
);
//Append it to row array as where_clause
$row['where_clause'] = $uniqueCondition[0];
$row['where_clause_sign'] = Core::signSqlQuery($uniqueCondition[0]);
$tmpData = array(
$_POST['criteriaColumnNames'][0] =>
$row[$_POST['criteriaColumnNames'][0]],
$_POST['criteriaColumnNames'][1] =>
$row[$_POST['criteriaColumnNames'][1]],
'where_clause' => $uniqueCondition[0]
'where_clause' => $uniqueCondition[0],
'where_clause_sign' => Core::signSqlQuery($uniqueCondition[0])
);
$tmpData[$dataLabel] = ($dataLabel) ? $row[$dataLabel] : '';
$data[] = $tmpData;
@ -419,6 +422,10 @@ class TableSearchController extends TableController
*/
public function getDataRowAction()
{
if (! Core::checkSqlQuerySignature($_POST['where_clause'], $_POST['where_clause_sign'])) {
return;
}
$extra_data = array();
$row_info_query = 'SELECT * FROM ' . Util::backquote($_POST['db']) . '.'
. Util::backquote($_POST['table']) . ' WHERE ' . $_POST['where_clause'];

1
libraries/classes/Display/Results.php
View File

@ -3001,6 +3001,7 @@ class Results
$_url_params = array(
'db' => $this->__get('db'),
'table' => $meta->orgtable,
'where_clause_sign' => Core::signSqlQuery($whereClauseMap[$row_no][$meta->orgtable]),
'where_clause' => $whereClauseMap[$row_no][$meta->orgtable],
'transform_key' => $meta->orgname
);

3
libraries/classes/InsertEdit.php
View File

@ -18,6 +18,7 @@ use PhpMyAdmin\Template;
use PhpMyAdmin\Transformations;
use PhpMyAdmin\Url;
use PhpMyAdmin\Util;
use PhpMyAdmin\Core;
/**
* PhpMyAdmin\InsertEdit class
@ -2480,6 +2481,7 @@ class InsertEdit
$_url_params = array(
'db' => $db,
'table' => $table,
'where_clause_sign' => Core::signSqlQuery($_POST['where_clause']),
'where_clause' => $_POST['where_clause'],
'transform_key' => $column_name
);
@ -3275,6 +3277,7 @@ class InsertEdit
'db' => $db,
'table' => $table,
'transform_key' => $column['Field'],
'where_clause_sign' => Core::signSqlQuery($where_clause),
'where_clause' => $where_clause
);
$transformation_options['wrapper_link']

6
transformation_wrapper.php
View File

@ -63,6 +63,12 @@ foreach ($request_params as $one_request_param) {
*/
$GLOBALS['dbi']->selectDb($db);
if (isset($where_clause)) {
if (! Core::checkSqlQuerySignature($where_clause, isset($_GET['where_clause_sign']) ? $_GET['where_clause_sign'] : '')) {
/* l10n: In case a SQL query did not pass a security check */
Core::fatalError(__('There is an issue with your request.'));
exit;
}
$result = $GLOBALS['dbi']->query(
'SELECT * FROM ' . PhpMyAdmin\Util::backquote($table)
. ' WHERE ' . $where_clause . ';',