gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix #314 - make sure where_clause is not modified

Browse Source 
Signed-off-by: William Desportes <williamdes@wdes.fr>
This commit is contained in:
William Desportes 2020-05-17 12:26:47 +02:00
parent 5364df21c6
commit 19df63b036
No known key found for this signature in database
GPG Key ID: 90A0EF1B8251A889
3 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
libraries/classes/Display/Results.php
View File

@ -3001,6 +3001,7 @@ class Results
$_url_params = array(
'db' => $this->__get('db'),
'table' => $meta->orgtable,
'where_clause_sign' => Core::signSqlQuery($whereClauseMap[$row_no][$meta->orgtable]),
'where_clause' => $whereClauseMap[$row_no][$meta->orgtable],
'transform_key' => $meta->orgname
);

3
libraries/classes/InsertEdit.php
View File

@ -18,6 +18,7 @@ use PhpMyAdmin\Template;
use PhpMyAdmin\Transformations;
use PhpMyAdmin\Url;
use PhpMyAdmin\Util;
use PhpMyAdmin\Core;
/**
* PhpMyAdmin\InsertEdit class
@ -2480,6 +2481,7 @@ class InsertEdit
$_url_params = array(
'db' => $db,
'table' => $table,
'where_clause_sign' => Core::signSqlQuery($_POST['where_clause']),
'where_clause' => $_POST['where_clause'],
'transform_key' => $column_name
);
@ -3275,6 +3277,7 @@ class InsertEdit
'db' => $db,
'table' => $table,
'transform_key' => $column['Field'],
'where_clause_sign' => Core::signSqlQuery($where_clause),
'where_clause' => $where_clause
);
$transformation_options['wrapper_link']

6
transformation_wrapper.php
View File

@ -63,6 +63,12 @@ foreach ($request_params as $one_request_param) {
*/
$GLOBALS['dbi']->selectDb($db);
if (isset($where_clause)) {
if (! Core::checkSqlQuerySignature($where_clause, isset($_GET['where_clause_sign']) ? $_GET['where_clause_sign'] : '')) {
/* l10n: In case a SQL query did not pass a security check */
Core::fatalError(__('There is an issue with your request.'));
exit;
}
$result = $GLOBALS['dbi']->query(
'SELECT * FROM ' . PhpMyAdmin\Util::backquote($table)
. ' WHERE ' . $where_clause . ';',