From bdb52e808a063dec000004d1c578bfa4282d0871 Mon Sep 17 00:00:00 2001
From: William Desportes <williamdes@wdes.fr>
Date: Mon, 11 Jun 2018 00:02:38 +0200
Subject: [PATCH 1/2] Closes #14374 - Structure broken

Security issue fix.

Closes: #14374
Signed-off-by: William Desportes <williamdes@wdes.fr>
---
 .../Table/TableStructureController.php        | 23 +++++++------------
 .../table/structure/display_structure.twig    |  3 +--
 .../table/structure/table_structure_row.twig  |  7 +++++-
 3 files changed, 15 insertions(+), 18 deletions(-)

diff --git a/libraries/classes/Controllers/Table/TableStructureController.php b/libraries/classes/Controllers/Table/TableStructureController.php
index c16cf02a0c..748a4404f2 100644
--- a/libraries/classes/Controllers/Table/TableStructureController.php
+++ b/libraries/classes/Controllers/Table/TableStructureController.php
@@ -1334,8 +1334,7 @@ class TableStructureController extends TableController
         $rownum = 0;
         $columns_list = [];
         $attributes = [];
-        $displayed_field_names = [];
-        $displayed_field_names_replaced = [];
+        $displayed_fields = [];
         $row_comments = [];
         $extracted_columnspecs = [];
         foreach ($fields as $field) {
@@ -1356,30 +1355,25 @@ class TableStructureController extends TableController
                 $field = array_merge($field, ['Default' => $field['Default']]);
             }
 
-            $displayed_field_names[$rownum] = $field['Field'];
+            $displayed_fields[$rownum] = new \stdClass();
+            $displayed_fields[$rownum]->text = $field['Field'];
+            $displayed_fields[$rownum]->icon = "";
             $row_comments[$rownum] = '';
 
             if (isset($comments_map[$field['Field']])) {
-                $displayed_field_names[$rownum] = '<span ' .
-                'class="commented_column" title="' . $comments_map[$field['Field']] .
-                '">' . htmlspecialchars($field['Field']) . "</span>";
+                $displayed_fields[$rownum]->comment = $comments_map[$field['Field']];
                 $row_comments[$rownum] = $comments_map[$field['Field']];
             }
 
             if ($primary_index && $primary_index->hasColumn($field['Field'])) {
-                $displayed_field_names[$rownum] = $displayed_field_names[$rownum] .
+                $displayed_fields[$rownum]->icon .=
                 Util::getImage('b_primary', __('Primary'));
             }
 
             if (in_array($field['Field'], $columns_with_index)) {
-                $displayed_field_names[$rownum] = $displayed_field_names[$rownum] .
+                $displayed_fields[$rownum]->icon .=
                 Util::getImage('b_key', __('Index'));
             }
-            $displayed_field_names_replaced[$rownum] = preg_replace(
-                '/[\\x00-\\x1F]/',
-                '&#x2051;',
-                $displayed_field_names[$rownum]
-            );
         }
 
         return Template::get('table/structure/display_structure')->render(
@@ -1417,8 +1411,7 @@ class TableStructureController extends TableController
                 'partition_names' => Partition::getPartitionNames($this->db, $this->table),
                 'columns_list' => $columns_list,
                 'attributes' => $attributes,
-                'displayed_field_names' => $displayed_field_names,
-                'displayed_field_names_replaced' => $displayed_field_names_replaced,
+                'displayed_fields' => $displayed_fields,
                 'row_comments' => $row_comments,
             ]
         );
diff --git a/templates/table/structure/display_structure.twig b/templates/table/structure/display_structure.twig
index 1d8cb99f4a..e1f3b9ee07 100644
--- a/templates/table/structure/display_structure.twig
+++ b/templates/table/structure/display_structure.twig
@@ -25,7 +25,6 @@
 
             {% set extracted_columnspec = extracted_columnspecs[rownum] %}
             {% set field_name = row['Field']|e %}
-            {% set displayed_field_name = displayed_field_names[rownum] %}
             {# For column comments #}
             {% set comments = row_comments[rownum] %}
             {# Underline commented fields and display a hover-title (CSS only) #}
@@ -34,7 +33,7 @@
             {% include 'table/structure/table_structure_row.twig' with {
                 'row': row,
                 'rownum': rownum,
-                'displayed_field_name': displayed_field_names_replaced[rownum],
+                'displayed_field': displayed_fields[rownum],
                 'type_nowrap': Util_getClassForType(extracted_columnspec['type']),
                 'extracted_columnspec': extracted_columnspec,
                 'attribute': attributes[rownum],
diff --git a/templates/table/structure/table_structure_row.twig b/templates/table/structure/table_structure_row.twig
index e6942d7c87..dd48b3dcb8 100644
--- a/templates/table/structure/table_structure_row.twig
+++ b/templates/table/structure/table_structure_row.twig
@@ -4,7 +4,12 @@
 <td class="right">{{ rownum }}</td>
 <th class="nowrap">
     <label for="checkbox_row_{{ rownum }}">
-        {{ displayed_field_name|raw }}
+        {% if displayed_field.comment is defined %}
+            <span class="commented_column" title="{{ displayed_field.comment }}">{{ displayed_field.text }}</span>
+        {% else %}
+            {{ displayed_field.text }}
+        {% endif %}
+        {{ displayed_field.icon|raw }}
     </label>
 </th>
 <td {{ type_nowrap }}>

From 5815c1570e32506595040d955f4eed9dbc520f92 Mon Sep 17 00:00:00 2001
From: William Desportes <williamdes@wdes.fr>
Date: Mon, 11 Jun 2018 00:03:58 +0200
Subject: [PATCH 2/2] Closes #14225 - missing index icon

Closes: #14225
Signed-off-by: William Desportes <williamdes@wdes.fr>
---
 .../classes/Controllers/Table/TableStructureController.php      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libraries/classes/Controllers/Table/TableStructureController.php b/libraries/classes/Controllers/Table/TableStructureController.php
index 748a4404f2..d7d2087eaf 100644
--- a/libraries/classes/Controllers/Table/TableStructureController.php
+++ b/libraries/classes/Controllers/Table/TableStructureController.php
@@ -1372,7 +1372,7 @@ class TableStructureController extends TableController
 
             if (in_array($field['Field'], $columns_with_index)) {
                 $displayed_fields[$rownum]->icon .=
-                Util::getImage('b_key', __('Index'));
+                Util::getImage('bd_primary', __('Index'));
             }
         }