From ef6c66dca1b0cb0a1a482477938cfc859d2baee3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@cihar.com>
Date: Wed, 15 Jun 2016 11:29:31 +0200
Subject: [PATCH] Properly escape database name in central column queries
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michal Čihař <michal@cihar.com>
---
 libraries/central_columns.lib.php | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/libraries/central_columns.lib.php b/libraries/central_columns.lib.php
index 13de8d70e6..6306e3f403 100644
--- a/libraries/central_columns.lib.php
+++ b/libraries/central_columns.lib.php
@@ -60,10 +60,10 @@ function PMA_getColumnsList($db, $from=0, $num=25)
     //get current values of $db from central column list
     if ($num == 0) {
         $query = 'SELECT * FROM ' . Util::backquote($central_list_table) . ' '
-            . 'WHERE db_name = \'' . $db . '\';';
+            . 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\';';
     } else {
         $query = 'SELECT * FROM ' . Util::backquote($central_list_table) . ' '
-            . 'WHERE db_name = \'' . $db . '\' '
+            . 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\' '
             . 'LIMIT ' . $from . ', ' . $num . ';';
     }
     $has_list = (array) $GLOBALS['dbi']->fetchResult(
@@ -91,7 +91,7 @@ function PMA_getCentralColumnsCount($db)
     $central_list_table = $cfgCentralColumns['table'];
     $query = 'SELECT count(db_name) FROM ' .
         Util::backquote($central_list_table) . ' '
-        . 'WHERE db_name = \'' . $db . '\';';
+        . 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\';';
     $res = $GLOBALS['dbi']->fetchResult(
         $query, null, null, $GLOBALS['controllink']
     );
@@ -122,7 +122,7 @@ function PMA_findExistingColNames($db, $cols, $allFields=false)
     $central_list_table = $cfgCentralColumns['table'];
     if ($allFields) {
         $query = 'SELECT * FROM ' . Util::backquote($central_list_table) . ' '
-            . 'WHERE db_name = \'' . $db . '\' AND col_name IN (' . $cols . ');';
+            . 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\' AND col_name IN (' . $cols . ');';
         $has_list = (array) $GLOBALS['dbi']->fetchResult(
             $query, null, null, $GLOBALS['controllink']
         );
@@ -130,7 +130,7 @@ function PMA_findExistingColNames($db, $cols, $allFields=false)
     } else {
         $query = 'SELECT col_name FROM '
             . Util::backquote($central_list_table) . ' '
-            . 'WHERE db_name = \'' . $db . '\' AND col_name IN (' . $cols . ');';
+            . 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\' AND col_name IN (' . $cols . ');';
         $has_list = (array) $GLOBALS['dbi']->fetchResult(
             $query, null, null, $GLOBALS['controllink']
         );
@@ -376,7 +376,7 @@ function PMA_deleteColumnsFromList($field_select, $isTable=true)
     $GLOBALS['dbi']->selectDb($pmadb, $GLOBALS['controllink']);
 
     $query = 'DELETE FROM ' . Util::backquote($central_list_table) . ' '
-        . 'WHERE db_name = \'' . $db . '\' AND col_name IN (' . $cols . ');';
+        . 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\' AND col_name IN (' . $cols . ');';
 
     if (!$GLOBALS['dbi']->tryQuery($query, $GLOBALS['controllink'])) {
         $message = Message::error(__('Could not remove columns!'));
@@ -1147,7 +1147,7 @@ function PMA_getCentralColumnsListRaw($db, $table)
     $centralTable = $cfgCentralColumns['table'];
     if (empty($table) || $table == '') {
         $query = 'SELECT * FROM ' . Util::backquote($centralTable) . ' '
-            . 'WHERE db_name = \'' . $db . '\';';
+            . 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\';';
     } else {
         $GLOBALS['dbi']->selectDb($db, $GLOBALS['userlink']);
         $columns = (array) $GLOBALS['dbi']->getColumnNames(
@@ -1159,7 +1159,7 @@ function PMA_getCentralColumnsListRaw($db, $table)
         }
         $cols = trim($cols, ',');
         $query = 'SELECT * FROM ' . Util::backquote($centralTable) . ' '
-            . 'WHERE db_name = \'' . $db . '\'';
+            . 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\'';
         if ($cols) {
             $query .= ' AND col_name NOT IN (' . $cols . ')';
         }