From be3905944fee4339db8cec6510ac241f66ad5f83 Mon Sep 17 00:00:00 2001
From: Saksham Gupta <shucon01@gmail.com>
Date: Sun, 15 Nov 2020 13:42:22 +0530
Subject: [PATCH] Fixes: https://github.com/phpmyadmin/phpmyadmin/issues/16477

Signed-off-by: Saksham Gupta <shucon01@gmail.com>

Fix db Edit privileges

Signed-off-by: Saksham Gupta <shucon01@gmail.com>

Fix conflict

Signed-off-by: Saksham Gupta <shucon01@gmail.com>

Add missing bracket

Signed-off-by: Saksham Gupta <shucon01@gmail.com>

Fix Lint

Signed-off-by: Saksham Gupta <shucon01@gmail.com>
---
 libraries/classes/Server/Privileges.php       | 13 ++++++---
 .../server/privileges/privileges_summary.twig |  2 +-
 test/classes/Server/PrivilegesTest.php        | 27 +++++++++++++++++++
 3 files changed, 37 insertions(+), 5 deletions(-)

diff --git a/libraries/classes/Server/Privileges.php b/libraries/classes/Server/Privileges.php
index 1b9c0d9eab..31734f1eef 100644
--- a/libraries/classes/Server/Privileges.php
+++ b/libraries/classes/Server/Privileges.php
@@ -1582,12 +1582,12 @@ class Privileges
         ];
         switch ($linktype) {
             case 'edit':
-                $params['dbname'] = $dbname;
+                $params['dbname'] = Util::escapeMysqlWildcards($dbname);
                 $params['tablename'] = $tablename;
                 $params['routinename'] = $routinename;
                 break;
             case 'revoke':
-                $params['dbname'] = $dbname;
+                $params['dbname'] = Util::escapeMysqlWildcards($dbname);
                 $params['tablename'] = $tablename;
                 $params['routinename'] = $routinename;
                 $params['revokeall'] = 1;
@@ -2054,6 +2054,7 @@ class Privileges
             ];
 
             $databases = [];
+            $escaped_databases = [];
             if (! empty($pred_db_array)) {
                 foreach ($pred_db_array as $current_db) {
                     if (in_array($current_db, $databases_to_skip)) {
@@ -2067,11 +2068,12 @@ class Privileges
                     if (in_array($current_db_escaped, $foundRows)) {
                         continue;
                     }
-
                     $databases[] = $current_db;
+                    $escaped_databases[] = $current_db_escaped;
                 }
             }
             $data['databases'] = $databases;
+            $data['escaped_databases'] = $escaped_databases;
         } elseif ($type === 'table') {
             $result = @$this->dbi->tryQuery(
                 'SHOW TABLES FROM ' . Util::backquote($dbname),
@@ -2840,6 +2842,7 @@ class Privileges
         $dbname = null;
         $tablename = null;
         $routinename = null;
+        $return_db = null;
 
         if (isset($_REQUEST['username'])) {
             $username = (string) $_REQUEST['username'];
@@ -2907,12 +2910,14 @@ class Privileges
         if (isset($dbname)) {
             if (is_array($dbname)) {
                 $db_and_table = $dbname;
+                $return_db = $dbname;
                 foreach ($db_and_table as $key => $db_name) {
                     $db_and_table[$key] .= '.';
                 }
             } else {
                 $unescaped_db = Util::unescapeMysqlWildcards($dbname);
                 $db_and_table = Util::backquote($unescaped_db) . '.';
+                $return_db = $unescaped_db;
             }
             if (isset($tablename)) {
                 $db_and_table .= Util::backquote($tablename);
@@ -2938,7 +2943,7 @@ class Privileges
         return [
             $username,
             $hostname,
-            $dbname ?? null,
+            $return_db,
             $tablename ?? null,
             $routinename ?? null,
             $db_and_table,
diff --git a/templates/server/privileges/privileges_summary.twig b/templates/server/privileges/privileges_summary.twig
index 99a5c3b0a1..de180cccf0 100644
--- a/templates/server/privileges/privileges_summary.twig
+++ b/templates/server/privileges/privileges_summary.twig
@@ -56,7 +56,7 @@
             {%- if databases is not empty %}
                 <select name="pred_dbname[]" multiple="multiple">
                     {% for database in databases %}
-                        <option value="{{ database|escape_mysql_wildcards }}">
+                        <option value="{{ escaped_databases[loop.index0]|escape_mysql_wildcards }}">
                             {{ database }}
                         </option>
                     {% endfor %}
diff --git a/test/classes/Server/PrivilegesTest.php b/test/classes/Server/PrivilegesTest.php
index 48aa11c04f..ace58878ff 100644
--- a/test/classes/Server/PrivilegesTest.php
+++ b/test/classes/Server/PrivilegesTest.php
@@ -190,6 +190,33 @@ class PrivilegesTest extends AbstractTestCase
         $this->assertTrue(
             $dbname_is_wildcard
         );
+
+        // Escaped database
+        $_POST['pred_tablename'] = 'PMA_pred__tablename';
+        $_POST['pred_dbname'] = ['PMA\_pred\_dbname'];
+        [,,
+            $dbname,
+            $tablename,
+            $routinename,
+            $db_and_table,
+            $dbname_is_wildcard,
+        ] = $this->serverPrivileges->getDataForDBInfo();
+        $this->assertEquals(
+            'PMA_pred_dbname',
+            $dbname
+        );
+        $this->assertEquals(
+            'PMA_pred__tablename',
+            $tablename
+        );
+        $this->assertEquals(
+            '`PMA_pred_dbname`.`PMA_pred__tablename`',
+            $db_and_table
+        );
+        $this->assertEquals(
+            false,
+            $dbname_is_wildcard
+        );
     }
 
     /**