From 48b97ecd064402134531af15124cb7d79c1f2e27 Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Tue, 7 Oct 2014 08:03:39 +0530 Subject: [PATCH] bug #4252 Database-level permission bug for db names containing underscores Signed-off-by: Madhura Jayaratne --- ChangeLog | 1 + libraries/Util.class.php | 14 +------------- 2 files changed, 2 insertions(+), 13 deletions(-) diff --git a/ChangeLog b/ChangeLog index a3a2a593c7..e501a8c39a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -8,6 +8,7 @@ phpMyAdmin - ChangeLog - bug #4543 Changing column name can break saved "order by" clause - bug #4545 trying to favorite table while browser localStorage is disabled throws JS error - bug #4259 reCaptcha sound session expired problem +- bug #4252 Database-level permission bug for db names containing underscores 4.2.9.0 (2014-09-20) - bug ajax.js responseHandler: cannot read property of null diff --git a/libraries/Util.class.php b/libraries/Util.class.php index 047232a3b9..8f96cc19c4 100644 --- a/libraries/Util.class.php +++ b/libraries/Util.class.php @@ -3833,19 +3833,7 @@ class PMA_Util // If a database name was provided and user does not have the // required global privilege, try database-wise permissions. if ($db !== null) { - // need to escape wildcards in db and table names, see bug #3566 - // (wildcard characters appear as being quoted with a backslash - // when querying TABLE_SCHEMA.SCHEMA_PRIVILEGES) - $db = str_replace(array('%', '_'), array('\%', '\_'), $db); - /* - * This is to take into account a wildcard db privilege - * so we replace % by .* and _ by . to be able to compare - * with REGEXP. - * - * Also, we need to double the inner % to please sprintf(). - */ - $query .= " AND '%s' REGEXP" - . " REPLACE(REPLACE(TABLE_SCHEMA, '_', '.'), '%%', '.*')"; + $query .= " AND '%s' LIKE `TABLE_SCHEMA`"; $schema_privileges = $GLOBALS['dbi']->fetchValue( sprintf( $query,