gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix broken foreign key links

Browse Source 
Fixes: #15225 - Using Command+Click to open in new tab does not work (Firefox/Safari)
Fixes: #14270 - Middle-click on foreign key link broken
Fixes: #14363 - Broken relational links in tables

Signed-off-by: William Desportes <williamdes@wdes.fr>
This commit is contained in:
William Desportes 2019-06-12 10:43:15 +02:00
parent ec74b34010
commit 4bf8bfcaa1
No known key found for this signature in database
GPG Key ID: 90A0EF1B8251A889
4 changed files with 40 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
libraries/classes/Core.php
View File

@ -1289,4 +1289,28 @@ class Core
self::fatalError(__('possible exploit'));
}
}
/**
* Sign the sql query using hmac using the session token
*
* @param string $sqlQuery The sql query
* @return void
*/
public static function signSqlQuery(string $sqlQuery)
{
return hash_hmac('sha256', $sqlQuery, $_SESSION[' PMA_token ']);
}
/**
* Check that the sql query has a valid hmac signature
*
* @param string $sqlQuery The sql query
* @return void
*/
public static function checkSqlQuerySignature(string $sqlQuery, string $signature)
{
$hmac = hash_hmac('sha256', $sqlQuery, $_SESSION[' PMA_token ']);
return hash_equals($hmac, $signature);
}
}

15
libraries/classes/Display/Results.php
View File

@ -5313,16 +5313,19 @@ class Results
$title = htmlspecialchars($data);
}
$sqlQuery = 'SELECT * FROM '
. Util::backquote($map[$meta->name][3]) . '.'
. Util::backquote($map[$meta->name][0])
. ' WHERE '
. Util::backquote($map[$meta->name][1])
. $where_comparison;
$_url_params = array(
'db' => $map[$meta->name][3],
'table' => $map[$meta->name][0],
'pos' => '0',
'sql_query' => 'SELECT * FROM '
. Util::backquote($map[$meta->name][3]) . '.'
. Util::backquote($map[$meta->name][0])
. ' WHERE '
. Util::backquote($map[$meta->name][1])
. $where_comparison,
'sql_signature' => Core::signSqlQuery($sqlQuery),
'sql_query' => $sqlQuery,
);
if ($transformation_plugin != $default_function) {

3
libraries/classes/Util.php
View File

@ -1760,7 +1760,8 @@ class Util
$tag_params_strings = array();
if (($url_length > $GLOBALS['cfg']['LinkLengthLimit'])
|| ! $in_suhosin_limits
|| strpos($url, 'sql_query=') !== false
// Has as sql_query without a signature
|| ( strpos($url, 'sql_query=') !== false && strpos($url, 'sql_signature=') === false)
|| strpos($url, 'view[as]=') !== false
) {
$parts = explode('?', $url, 2);

5
sql.php
View File

@ -13,6 +13,7 @@ use PhpMyAdmin\Response;
use PhpMyAdmin\Sql;
use PhpMyAdmin\Url;
use PhpMyAdmin\Util;
use PhpMyAdmin\Core;
/**
* Gets some core libraries
@ -71,6 +72,10 @@ if (isset($_POST['bkm_fields']['bkm_sql_query'])) {
$sql_query = $_POST['bkm_fields']['bkm_sql_query'];
} elseif (isset($_POST['sql_query'])) {
$sql_query = $_POST['sql_query'];
} elseif (isset($_GET['sql_query']) && isset($_GET['sql_signature'])) {
if (Core::checkSqlQuerySignature($_GET['sql_query'], $_GET['sql_signature'])) {
$sql_query = $_GET['sql_query'];
}
}
// This one is just to fill $db