gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Check where clause signature in TableSearchController

Browse Source 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
This commit is contained in:
Maurício Meneghini Fauth 2020-07-03 17:45:58 -03:00
parent cf678a04fc
commit d09ab9bc9d
2 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
js/tbl_zoom_plot_jqplot.js
View File

@ -558,7 +558,8 @@ AJAX.registerOnload('tbl_zoom_plot_jqplot.js', function () {
value[dataLabel], // for highlighter
// (may set an undefined value)
value.where_clause, // for click on point
key // key from searchedData
key, // key from searchedData
value.where_clause_sign
]);
});
@ -591,7 +592,8 @@ AJAX.registerOnload('tbl_zoom_plot_jqplot.js', function () {
'server' : PMA_commonParams.get('server'),
'db' : PMA_commonParams.get('db'),
'table' : PMA_commonParams.get('table'),
'where_clause' : data[3]
'where_clause' : data[3],
'where_clause_sign' : data[5]
};
$.post('tbl_zoom_select.php', post_params, function (data) {

9
libraries/classes/Controllers/Table/TableSearchController.php
View File

@ -8,6 +8,7 @@
namespace PhpMyAdmin\Controllers\Table;
use PhpMyAdmin\Controllers\TableController;
use PhpMyAdmin\Core;
use PhpMyAdmin\DatabaseInterface;
use PhpMyAdmin\Relation;
use PhpMyAdmin\Sql;
@ -345,13 +346,15 @@ class TableSearchController extends TableController
);
//Append it to row array as where_clause
$row['where_clause'] = $uniqueCondition[0];
$row['where_clause_sign'] = Core::signSqlQuery($uniqueCondition[0]);
$tmpData = array(
$_POST['criteriaColumnNames'][0] =>
$row[$_POST['criteriaColumnNames'][0]],
$_POST['criteriaColumnNames'][1] =>
$row[$_POST['criteriaColumnNames'][1]],
'where_clause' => $uniqueCondition[0]
'where_clause' => $uniqueCondition[0],
'where_clause_sign' => Core::signSqlQuery($uniqueCondition[0])
);
$tmpData[$dataLabel] = ($dataLabel) ? $row[$dataLabel] : '';
$data[] = $tmpData;
@ -419,6 +422,10 @@ class TableSearchController extends TableController
*/
public function getDataRowAction()
{
if (! Core::checkSqlQuerySignature($_POST['where_clause'], $_POST['where_clause_sign'])) {
return;
}
$extra_data = array();
$row_info_query = 'SELECT * FROM ' . Util::backquote($_POST['db']) . '.'
. Util::backquote($_POST['table']) . ' WHERE ' . $_POST['where_clause'];