From e50e37b51db956bcb34258491548bd7d04423711 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Wed, 22 Jun 2016 11:35:04 +0200 Subject: [PATCH] Properly escape database name when listing privileges MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- libraries/server_privileges.lib.php | 4 ++-- test/libraries/PMA_server_privileges_test.php | 14 ++++++++++++++ 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/libraries/server_privileges.lib.php b/libraries/server_privileges.lib.php index 2ea6a84185..eda53bdb34 100644 --- a/libraries/server_privileges.lib.php +++ b/libraries/server_privileges.lib.php @@ -498,14 +498,14 @@ function PMA_getSqlQueryForDisplayPrivTable($db, $table, $username, $hostname) return "SELECT * FROM `mysql`.`db`" . " WHERE `User` = '" . Util::sqlAddSlashes($username) . "'" . " AND `Host` = '" . Util::sqlAddSlashes($hostname) . "'" - . " AND '" . Util::unescapeMysqlWildcards($db) . "'" + . " AND '" . Util::sqlAddSlashes(Util::unescapeMysqlWildcards($db)) . "'" . " LIKE `Db`;"; } return "SELECT `Table_priv`" . " FROM `mysql`.`tables_priv`" . " WHERE `User` = '" . Util::sqlAddSlashes($username) . "'" . " AND `Host` = '" . Util::sqlAddSlashes($hostname) . "'" - . " AND `Db` = '" . Util::unescapeMysqlWildcards($db) . "'" + . " AND `Db` = '" . Util::sqlAddSlashes(Util::unescapeMysqlWildcards($db)) . "'" . " AND `Table_name` = '" . Util::sqlAddSlashes($table) . "';"; } diff --git a/test/libraries/PMA_server_privileges_test.php b/test/libraries/PMA_server_privileges_test.php index 9b1254cf41..62c9030cd1 100644 --- a/test/libraries/PMA_server_privileges_test.php +++ b/test/libraries/PMA_server_privileges_test.php @@ -546,6 +546,20 @@ class PMA_ServerPrivileges_Test extends PHPUnit_Framework_TestCase $sql, $ret ); + + // SQL escaping + $db = "db' AND"; + $table = "pma_table"; + $ret = PMA_getSqlQueryForDisplayPrivTable( + $db, $table, $username, $hostname + ); + $this->assertEquals( + "SELECT `Table_priv` FROM `mysql`.`tables_priv` " + . "WHERE `User` = 'pma_username' AND " + . "`Host` = 'pma_hostname' AND `Db` = 'db\' AND' AND " + . "`Table_name` = 'pma_table';", + $ret + ); } /**