gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Ensure that database names with '.' are handled properly when DisableIS is true

Browse Source 
Closes: #13267

Signed-off-by: Rishwanth Yeddula <rish@cpanel.net>
This commit is contained in:
Rishwanth Yeddula 2018-07-05 12:46:51 -05:00 committed by Maurício Meneghini Fauth
parent 402f46a83c
commit 1aed791258
2 changed files with 50 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
libraries/classes/CheckUserPrivileges.php
View File

@ -44,10 +44,24 @@ class CheckUserPrivileges
public function getItemsFromShowGrantsRow(string $row): array
{
$db_name_offset = mb_strpos($row, ' ON ') + 4;
$tblname_end_offset = mb_strpos($row, ' TO ');
$tblname_start_offset = false;
if ($__tblname_start_offset = mb_strpos($row, '`.', $db_name_offset)) {
if ($__tblname_start_offset < $tblname_end_offset) {
$tblname_start_offset = $__tblname_start_offset + 1;
}
}
if (!$tblname_start_offset) {
$tblname_start_offset = mb_strpos($row, '.', $db_name_offset);
}
$show_grants_dbname = mb_substr(
$row,
$db_name_offset,
mb_strpos($row, '.', $db_name_offset) - $db_name_offset
$tblname_start_offset - $db_name_offset
);
$show_grants_dbname = Util::unQuote($show_grants_dbname, '`');
@ -58,14 +72,10 @@ class CheckUserPrivileges
(mb_strpos($row, ' ON ') - 6)
);
// extrac table from GRANT sytax
$tblname_start_offset = mb_strpos($row, '.') + 1;
$tblname_end_offset = mb_strpos($row, ' TO ');
$show_grants_tblname = mb_substr(
$row,
$tblname_start_offset,
$tblname_end_offset - $tblname_start_offset
$tblname_start_offset + 1,
$tblname_end_offset - $tblname_start_offset - 1
);
$show_grants_tblname = Util::unQuote($show_grants_tblname, '`');

33
test/classes/CheckUserPrivilegesTest.php
View File

@ -129,6 +129,39 @@ class CheckUserPrivilegesTest extends TestCase
"columns_priv",
$show_grants_tblname
);
// TEST CASE 4
$show_grants_full_row = "GRANT ALL PRIVILEGES ON `cptest\_.`.* TO "
. "'cptest'@'localhost'";
list(
$show_grants_str,
$show_grants_dbname,
$show_grants_tblname
) = $this->checkUserPrivileges->getItemsFromShowGrantsRow(
$show_grants_full_row
);
$this->assertEquals(
"cptest\_.",
$show_grants_dbname
);
$show_grants_full_row = "GRANT ALL PRIVILEGES ON `cptest\_.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z`.* TO "
. "'cptest'@'localhost'";
list(
$show_grants_str,
$show_grants_dbname,
$show_grants_tblname
) = $this->checkUserPrivileges->getItemsFromShowGrantsRow(
$show_grants_full_row
);
$this->assertEquals(
"cptest\_.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z",
$show_grants_dbname
);
}
/**