gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'QA_4_6'

Browse Source
This commit is contained in:
Michal Čihař 2016-06-22 11:35:42 +02:00
commit d338a61d32
2 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libraries/server_privileges.lib.php
View File

@ -499,14 +499,14 @@ function PMA_getSqlQueryForDisplayPrivTable($db, $table, $username, $hostname)
return "SELECT * FROM `mysql`.`db`"
. " WHERE `User` = '" . Util::sqlAddSlashes($username) . "'"
. " AND `Host` = '" . Util::sqlAddSlashes($hostname) . "'"
. " AND '" . Util::unescapeMysqlWildcards($db) . "'"
. " AND '" . Util::sqlAddSlashes(Util::unescapeMysqlWildcards($db)) . "'"
. " LIKE `Db`;";
}
return "SELECT `Table_priv`"
. " FROM `mysql`.`tables_priv`"
. " WHERE `User` = '" . Util::sqlAddSlashes($username) . "'"
. " AND `Host` = '" . Util::sqlAddSlashes($hostname) . "'"
. " AND `Db` = '" . Util::unescapeMysqlWildcards($db) . "'"
. " AND `Db` = '" . Util::sqlAddSlashes(Util::unescapeMysqlWildcards($db)) . "'"
. " AND `Table_name` = '" . Util::sqlAddSlashes($table) . "';";
}

14
test/libraries/PMA_server_privileges_test.php
View File

@ -539,6 +539,20 @@ class PMA_ServerPrivileges_Test extends PHPUnit_Framework_TestCase
$sql,
$ret
);
// SQL escaping
$db = "db' AND";
$table = "pma_table";
$ret = PMA_getSqlQueryForDisplayPrivTable(
$db, $table, $username, $hostname
);
$this->assertEquals(
"SELECT `Table_priv` FROM `mysql`.`tables_priv` "
. "WHERE `User` = 'pma_username' AND "
. "`Host` = 'pma_hostname' AND `Db` = 'db\' AND' AND "
. "`Table_name` = 'pma_table';",
$ret
);
}
/**