From 41e3db158f15abfcc44840071a9e20beb00753ae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@cihar.com>
Date: Fri, 22 Jul 2016 11:59:49 +0200
Subject: [PATCH] Properly escape NavigationTreeDbSeparator in queries
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michal Čihař <michal@cihar.com>
---
 libraries/navigation/NavigationTree.php | 2 +-
 libraries/navigation/nodes/Node.php     | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/libraries/navigation/NavigationTree.php b/libraries/navigation/NavigationTree.php
index fc9748d088..5bc830a34b 100644
--- a/libraries/navigation/NavigationTree.php
+++ b/libraries/navigation/NavigationTree.php
@@ -174,7 +174,7 @@ class NavigationTree
             $query = "SELECT (COUNT(DB_first_level) DIV %d) * %d ";
             $query .= "from ( ";
             $query .= " SELECT distinct SUBSTRING_INDEX(SCHEMA_NAME, ";
-            $query .= " '{$GLOBALS['cfg']['NavigationTreeDbSeparator']}', 1) ";
+            $query .= " '" . Util::sqlAddSlashes($GLOBALS['cfg']['NavigationTreeDbSeparator']) . "', 1) ";
             $query .= " DB_first_level ";
             $query .= " FROM INFORMATION_SCHEMA.SCHEMATA ";
             $query .= " WHERE `SCHEMA_NAME` < '%s' ";
diff --git a/libraries/navigation/nodes/Node.php b/libraries/navigation/nodes/Node.php
index 0acc23540e..0e186c6498 100644
--- a/libraries/navigation/nodes/Node.php
+++ b/libraries/navigation/nodes/Node.php
@@ -434,7 +434,7 @@ class Node
             $query .= "SELECT DB_first_level ";
             $query .= "FROM ( ";
             $query .= "SELECT DISTINCT SUBSTRING_INDEX(SCHEMA_NAME, ";
-            $query .= "'$dbSeparator', 1) ";
+            $query .= "'" . Util::sqlAddSlashes($dbSeparator) . "', 1) ";
             $query .= "DB_first_level ";
             $query .= "FROM INFORMATION_SCHEMA.SCHEMATA ";
             $query .= $this->_getWhereClause('SCHEMA_NAME', $searchClause);
@@ -444,9 +444,9 @@ class Node
             $query .= ") t2 ";
             $query .= $this->_getWhereClause('SCHEMA_NAME', $searchClause);
             $query .= "AND 1 = LOCATE(CONCAT(DB_first_level, ";
-            $query .= "'$dbSeparator'), ";
+            $query .= "'" . Util::sqlAddSlashes($dbSeparator) . "'), ";
             $query .= "CONCAT(SCHEMA_NAME, ";
-            $query .= "'$dbSeparator')) ";
+            $query .= "'" . Util::sqlAddSlashes($dbSeparator) . "')) ";
             $query .= "ORDER BY SCHEMA_NAME ASC";
             $retval = $GLOBALS['dbi']->fetchResult($query);