diff --git a/libraries/designer.lib.php b/libraries/designer.lib.php index c1cb67fda8..c2668e99f3 100644 --- a/libraries/designer.lib.php +++ b/libraries/designer.lib.php @@ -19,9 +19,10 @@ if (! defined('PHPMYADMIN')) { function PMA_getHtmlForEditOrDeletePages($operation) { $cfgRelation = PMA_getRelationsParam(); - $page_query = "SELECT * FROM " . PMA_Util::backquote($cfgRelation['db']) - . "." . PMA_Util::backquote($cfgRelation['pdf_pages']) - . " WHERE db_name = '" . $GLOBALS['db'] . "'" + $page_query = "SELECT `page_nr`, `page_descr` FROM " + . PMA_Util::backquote($cfgRelation['db']) . "." + . PMA_Util::backquote($cfgRelation['pdf_pages']) + . " WHERE db_name = '" . PMA_Util::sqlAddSlashes($GLOBALS['db']) . "'" . " ORDER BY `page_nr`"; $page_rs = PMA_queryAsControlUser( $page_query, false, PMA_DatabaseInterface::QUERY_STORE @@ -59,9 +60,10 @@ function PMA_getHtmlForEditOrDeletePages($operation) function PMA_getHtmlForPageSaveAs() { $cfgRelation = PMA_getRelationsParam(); - $page_query = "SELECT * FROM " . PMA_Util::backquote($cfgRelation['db']) - . "." . PMA_Util::backquote($cfgRelation['pdf_pages']) - . " WHERE db_name = '" . $GLOBALS['db'] . "'" + $page_query = "SELECT `page_nr`, `page_descr` FROM " + . PMA_Util::backquote($cfgRelation['db']) . "." + . PMA_Util::backquote($cfgRelation['pdf_pages']) + . " WHERE db_name = '" . PMA_Util::sqlAddSlashes($GLOBALS['db']) . "'" . " ORDER BY `page_nr`"; $page_rs = PMA_queryAsControlUser( $page_query, false, PMA_DatabaseInterface::QUERY_STORE @@ -82,7 +84,7 @@ function PMA_getHtmlForPageSaveAs() $html .= '