gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge #17044 - Fix #13614 - escaping the database names when granting privileges on tables

Browse Source 
Pull-request: #17044
Fixes: #13614

Signed-off-by: William Desportes <williamdes@wdes.fr>
This commit is contained in:
William Desportes 2021-07-28 22:27:22 +02:00
commit dcdfeb5768
No known key found for this signature in database
GPG Key ID: 90A0EF1B8251A889
3 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libraries/classes/Controllers/Server/PrivilegesController.php
View File

@ -452,7 +452,7 @@ class PrivilegesController extends AbstractController
$hostname ?? '',
$dbname,
$routinename,
$url_dbname ?? ''
Util::escapeMysqlWildcards($url_dbname ?? '')
)
);
} else {
@ -465,7 +465,7 @@ class PrivilegesController extends AbstractController
$this->response->addHTML(
$serverPrivileges->getHtmlForUserProperties(
$dbname_is_wildcard,
$url_dbname ?? '',
Util::escapeMysqlWildcards($url_dbname ?? ''),
$username,
$hostname ?? '',
$dbname ?? '',

4
libraries/classes/Server/Privileges.php
View File

@ -1994,7 +1994,7 @@ class Privileges
$onePrivilege['column_privs'] = ! empty($row['Column_priv']);
$onePrivilege['privileges'] = implode(',', $this->extractPrivInfo($row, true));
$paramDbName = $dbname;
$paramDbName = Util::escapeMysqlWildcards($dbname);
$paramTableName = $row['Table_name'];
} else { // routine
$name = $row['Routine_name'];
@ -2009,7 +2009,7 @@ class Privileges
$this->extractPrivInfo($privs, true)
);
$paramDbName = $dbname;
$paramDbName = Util::escapeMysqlWildcards($dbname);
$paramRoutineName = $row['Routine_name'];
}

4
templates/server/privileges/privileges_summary.twig
View File

@ -66,7 +66,7 @@
<input type="text" id="text_dbname" name="dbname">
{{ show_hint("Wildcards % and _ should be escaped with a \\ to use them literally."|trans) }}
{% elseif type == 'table' %}
<input type="hidden" name="dbname" value="{{ database }}">
<input type="hidden" name="dbname" value="{{ database|escape_mysql_wildcards }}">
<label for="text_tablename">{% trans 'Add privileges on the following table:' %}</label>
@ -81,7 +81,7 @@
<input type="text" id="text_tablename" name="tablename">
{% else %}
<input type="hidden" name="dbname" value="{{ database }}">
<input type="hidden" name="dbname" value="{{ database|escape_mysql_wildcards }}">
<label for="text_routinename">{% trans 'Add privileges on the following routine:' %}</label>