From 54f14eaa6c709d8d9a71249d46d37b37cd11b543 Mon Sep 17 00:00:00 2001 From: Robert Johnson Nallori Date: Fri, 23 Feb 2024 21:49:37 +0530 Subject: [PATCH] Fix Error When adding a user on MariaDB (#19002) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Fix Error When adding a user on MariaDB Signed-off-by: Robert Johnson Nallori * Fix coding standard and static analysis issues Signed-off-by: Maurício Meneghini Fauth * Add unit tests Signed-off-by: Maurício Meneghini Fauth Fixes #18989 --------- Signed-off-by: Robert Johnson Nallori Signed-off-by: Maurício Meneghini Fauth Co-authored-by: Maurício Meneghini Fauth --- phpstan-baseline.neon | 7 +--- psalm-baseline.xml | 1 + src/Server/Privileges.php | 9 ++++- tests/classes/Server/PrivilegesTest.php | 54 +++++++++++++++++++++++++ 4 files changed, 63 insertions(+), 8 deletions(-) diff --git a/phpstan-baseline.neon b/phpstan-baseline.neon index 3df2ec6e38..2329fce629 100644 --- a/phpstan-baseline.neon +++ b/phpstan-baseline.neon @@ -13182,7 +13182,7 @@ parameters: - message: "#^Parameter \\#1 \\$str of method PhpMyAdmin\\\\DatabaseInterface\\:\\:quoteString\\(\\) expects string, mixed given\\.$#" - count: 4 + count: 5 path: src/Server/Privileges.php - @@ -13235,11 +13235,6 @@ parameters: count: 2 path: src/Server/Privileges.php - - - message: "#^Parameter \\#2 \\.\\.\\.\\$values of function sprintf expects bool\\|float\\|int\\|string\\|null, mixed given\\.$#" - count: 1 - path: src/Server/Privileges.php - - message: "#^Parameter \\#3 \\$subject of function preg_replace expects array\\|string, mixed given\\.$#" count: 2 diff --git a/psalm-baseline.xml b/psalm-baseline.xml index d3019fbb70..9e2e95179a 100644 --- a/psalm-baseline.xml +++ b/psalm-baseline.xml @@ -10350,6 +10350,7 @@ $dbname[0] + $hashedPassword $oldUserGroup diff --git a/src/Server/Privileges.php b/src/Server/Privileges.php index 17cd275d46..e6751cda48 100644 --- a/src/Server/Privileges.php +++ b/src/Server/Privileges.php @@ -3111,7 +3111,7 @@ class Privileges $hashedPassword = $_POST['pma_pw']; } - $createUserReal = sprintf($createUserStmt, $hashedPassword); + $createUserReal = sprintf($createUserStmt, $this->dbi->quoteString($hashedPassword)); } $createUserShow = sprintf($createUserStmt, '\'***\''); @@ -3123,7 +3123,12 @@ class Privileges $passwordSetReal = sprintf($passwordSetStmt, $slashedUsername, $slashedHostname, "''"); } else { $hashedPassword = $this->getHashedPassword($_POST['pma_pw']); - $passwordSetReal = sprintf($passwordSetStmt, $slashedUsername, $slashedHostname, $hashedPassword); + $passwordSetReal = sprintf( + $passwordSetStmt, + $slashedUsername, + $slashedHostname, + $this->dbi->quoteString($hashedPassword), + ); } $alterRealSqlQuery = ''; diff --git a/tests/classes/Server/PrivilegesTest.php b/tests/classes/Server/PrivilegesTest.php index 448b1af60d..2c61ad0c3b 100644 --- a/tests/classes/Server/PrivilegesTest.php +++ b/tests/classes/Server/PrivilegesTest.php @@ -707,6 +707,60 @@ class PrivilegesTest extends AbstractTestCase self::assertSame('CREATE USER \'PMA_username\'@\'PMA_hostname\' IDENTIFIED BY \'***\';', $createUserShow); } + public function testGetSqlQueriesForDisplayAndAddUserMySql50500AndUserDefinedPassword(): void + { + $dbiDummy = $this->createDbiDummy(); + $dbi = $this->createDatabaseInterface($dbiDummy); + $dbi->setVersion(['@@version' => '5.5.0']); + + $dbiDummy->addResult('SELECT PASSWORD(\'pma_password\');', [['*ABCDEF']], ['PASSWORD(\'pma_password\')']); + + $serverPrivileges = $this->getPrivileges($dbi); + + $username = 'PMA_username'; + $hostname = 'PMA_hostname'; + $password = 'pma_password'; + $_POST['pred_password'] = 'userdefined'; + $_POST['pma_pw'] = 'pma_password'; + + [, , , , $passwordSetReal, $passwordSetShow] = $serverPrivileges->getSqlQueriesForDisplayAndAddUser( + $username, + $hostname, + $password, + ); + + self::assertSame('SET PASSWORD FOR \'PMA_username\'@\'PMA_hostname\' = \'*ABCDEF\';', $passwordSetReal); + self::assertSame('SET PASSWORD FOR \'PMA_username\'@\'PMA_hostname\' = \'***\';', $passwordSetShow); + + $dbiDummy->assertAllQueriesConsumed(); + } + + public function testGetSqlQueriesForDisplayAndAddUserWithUserDefinedPassword(): void + { + $dbi = $this->createDatabaseInterface(); + $dbi->setVersion(['@@version' => '10.4.3-MariaDB']); + + $serverPrivileges = $this->getPrivileges($dbi); + + $username = 'PMA_username'; + $hostname = 'PMA_hostname'; + $password = 'pma_password'; + $_POST['pred_password'] = 'userdefined'; + $_POST['pma_pw'] = 'pma_password'; + + [$createUserReal, $createUserShow] = $serverPrivileges->getSqlQueriesForDisplayAndAddUser( + $username, + $hostname, + $password, + ); + + self::assertSame( + 'CREATE USER \'PMA_username\'@\'PMA_hostname\' IDENTIFIED BY \'pma_password\';', + $createUserReal, + ); + self::assertSame('CREATE USER \'PMA_username\'@\'PMA_hostname\' IDENTIFIED BY \'***\';', $createUserShow); + } + public function testGetSqlQueriesForDisplayAndAddUser(): void { Config::getInstance()->selectedServer['DisableIS'] = false;