gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'security/pull/218' into QA_4_6-security

Browse Source
This commit is contained in:
Michal Čihař 2016-12-08 10:13:43 +01:00
commit 62517b08e2
2 changed files with 20 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libraries/navigation/NavigationTree.php
View File

@ -171,10 +171,13 @@ class NavigationTree
* @todo describe a scenario where this code is executed
*/
if (!$GLOBALS['cfg']['Server']['DisableIS']) {
$dbSeparator = $GLOBALS['dbi']->escapeString((
$GLOBALS['cfg']['NavigationTreeDbSeparator']
);
$query = "SELECT (COUNT(DB_first_level) DIV %d) * %d ";
$query .= "from ( ";
$query .= " SELECT distinct SUBSTRING_INDEX(SCHEMA_NAME, ";
$query .= " '" . $GLOBALS['dbi']->escapeString($GLOBALS['cfg']['NavigationTreeDbSeparator']) . "', 1) ";
$query .= " '%s', 1) ";
$query .= " DB_first_level ";
$query .= " FROM INFORMATION_SCHEMA.SCHEMATA ";
$query .= " WHERE `SCHEMA_NAME` < '%s' ";
@ -185,6 +188,7 @@ class NavigationTree
$query,
(int)$GLOBALS['cfg']['FirstLevelNavigationItems'],
(int)$GLOBALS['cfg']['FirstLevelNavigationItems'],
$dbSeparator,
$GLOBALS['dbi']->escapeString($GLOBALS['db'])
)
);

20
libraries/navigation/nodes/Node.php
View File

@ -424,7 +424,9 @@ class Node
return $retval;
}
$dbSeparator = $GLOBALS['cfg']['NavigationTreeDbSeparator'];
$dbSeparator = $GLOBALS['dbi']->escapeString(
$GLOBALS['cfg']['NavigationTreeDbSeparator']
);
if (isset($GLOBALS['cfg']['Server']['DisableIS'])
&& !$GLOBALS['cfg']['Server']['DisableIS']
) {
@ -434,7 +436,7 @@ class Node
$query .= "SELECT DB_first_level ";
$query .= "FROM ( ";
$query .= "SELECT DISTINCT SUBSTRING_INDEX(SCHEMA_NAME, ";
$query .= "'" . $GLOBALS['dbi']->escapeString($dbSeparator) . "', 1) ";
$query .= "'%s', 1) ";
$query .= "DB_first_level ";
$query .= "FROM INFORMATION_SCHEMA.SCHEMATA ";
$query .= $this->_getWhereClause('SCHEMA_NAME', $searchClause);
@ -444,11 +446,19 @@ class Node
$query .= ") t2 ";
$query .= $this->_getWhereClause('SCHEMA_NAME', $searchClause);
$query .= "AND 1 = LOCATE(CONCAT(DB_first_level, ";
$query .= "'" . $GLOBALS['dbi']->escapeString($dbSeparator) . "'), ";
$query .= "'%s'), ";
$query .= "CONCAT(SCHEMA_NAME, ";
$query .= "'" . $GLOBALS['dbi']->escapeString($dbSeparator) . "')) ";
$query .= "'%s')) ";
$query .= "ORDER BY SCHEMA_NAME ASC";
$retval = $GLOBALS['dbi']->fetchResult($query);
$retval = $GLOBALS['dbi']->fetchResult(
sprintf(
$query,
$dbSeparator,
$dbSeparator,
$dbSeparator
)
);
return $retval;
}