gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #270 from phpmyadmin/bug267

Browse Source 
Issue #267 SQL injection in Designer feature
This commit is contained in:
Madhura Jayaratne 2018-12-31 15:26:53 +11:00 committed by GitHub
commit a56016374a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
libraries/classes/Database/Designer.php
View File

@ -200,7 +200,8 @@ class Designer
. Util::backquote($cfgRelation['db']) . '.'
. Util::backquote($cfgRelation['designer_settings'])
. ' WHERE ' . Util::backquote('username') . ' = "'
. $GLOBALS['cfg']['Server']['user'] . '";';
. $GLOBALS['dbi']->escapeString($GLOBALS['cfg']['Server']['user'])
. '";';
$result = $GLOBALS['dbi']->fetchSingleRow($query);

4
libraries/classes/Database/Designer/Common.php
View File

@ -787,8 +787,8 @@ class Common
. Util::backquote($cfgDesigner['db'])
. "." . Util::backquote($cfgDesigner['table'])
. " (username, settings_data)"
. " VALUES('" . $cfgDesigner['user'] . "',"
. " '" . json_encode($save_data) . "');";
. " VALUES('" . $GLOBALS['dbi']->escapeString($cfgDesigner['user'])
. "', '" . json_encode($save_data) . "');";
$success = $this->relation->queryAsControlUser($query);
}