From 53c2eadf460fe1c2803b9e7cd7e0a190cb08a504 Mon Sep 17 00:00:00 2001
From: "Fawzi E. Abdulfattah" <iifawzie@gmail.com>
Date: Wed, 28 Jul 2021 02:43:24 +0200
Subject: [PATCH 1/2] escaping the database names when granting privileges on
 tables

Signed-off-by: Fawzi E. Abdulfattah <iifawzie@gmail.com>
---
 templates/server/privileges/privileges_summary.twig | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/templates/server/privileges/privileges_summary.twig b/templates/server/privileges/privileges_summary.twig
index 9ac56a4b79..5fad46b895 100644
--- a/templates/server/privileges/privileges_summary.twig
+++ b/templates/server/privileges/privileges_summary.twig
@@ -66,7 +66,7 @@
             <input type="text" id="text_dbname" name="dbname">
             {{ show_hint("Wildcards % and _ should be escaped with a \\ to use them literally."|trans) }}
         {% elseif type == 'table' %}
-            <input type="hidden" name="dbname" value="{{ database }}">
+            <input type="hidden" name="dbname" value="{{ database|escape_mysql_wildcards }}">
 
             <label for="text_tablename">{% trans 'Add privileges on the following table:' %}</label>
 
@@ -81,7 +81,7 @@
 
             <input type="text" id="text_tablename" name="tablename">
         {% else %}
-            <input type="hidden" name="dbname" value="{{ database }}">
+            <input type="hidden" name="dbname" value="{{ database|escape_mysql_wildcards }}">
 
             <label for="text_routinename">{% trans 'Add privileges on the following routine:' %}</label>
 

From 84e9b611a6831806a0d5efe588d16e6a2352df05 Mon Sep 17 00:00:00 2001
From: "Fawzi E. Abdulfattah" <iifawzie@gmail.com>
Date: Wed, 28 Jul 2021 03:42:02 +0200
Subject: [PATCH 2/2] fixing the links when granting privileges on tables or
 routines

Signed-off-by: Fawzi E. Abdulfattah <iifawzie@gmail.com>
---
 libraries/classes/Controllers/Server/PrivilegesController.php | 4 ++--
 libraries/classes/Server/Privileges.php                       | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/libraries/classes/Controllers/Server/PrivilegesController.php b/libraries/classes/Controllers/Server/PrivilegesController.php
index 28d9e73f8b..ae1c2a4dbf 100644
--- a/libraries/classes/Controllers/Server/PrivilegesController.php
+++ b/libraries/classes/Controllers/Server/PrivilegesController.php
@@ -452,7 +452,7 @@ class PrivilegesController extends AbstractController
                         $hostname ?? '',
                         $dbname,
                         $routinename,
-                        $url_dbname ?? ''
+                        Util::escapeMysqlWildcards($url_dbname ?? '')
                     )
                 );
             } else {
@@ -465,7 +465,7 @@ class PrivilegesController extends AbstractController
                 $this->response->addHTML(
                     $serverPrivileges->getHtmlForUserProperties(
                         $dbname_is_wildcard,
-                        $url_dbname ?? '',
+                        Util::escapeMysqlWildcards($url_dbname ?? ''),
                         $username,
                         $hostname ?? '',
                         $dbname ?? '',
diff --git a/libraries/classes/Server/Privileges.php b/libraries/classes/Server/Privileges.php
index 0e3d3305d9..dc1c8b6909 100644
--- a/libraries/classes/Server/Privileges.php
+++ b/libraries/classes/Server/Privileges.php
@@ -1994,7 +1994,7 @@ class Privileges
                 $onePrivilege['column_privs']  = ! empty($row['Column_priv']);
                 $onePrivilege['privileges'] = implode(',', $this->extractPrivInfo($row, true));
 
-                $paramDbName = $dbname;
+                $paramDbName = Util::escapeMysqlWildcards($dbname);
                 $paramTableName = $row['Table_name'];
             } else { // routine
                 $name = $row['Routine_name'];
@@ -2009,7 +2009,7 @@ class Privileges
                     $this->extractPrivInfo($privs, true)
                 );
 
-                $paramDbName = $dbname;
+                $paramDbName = Util::escapeMysqlWildcards($dbname);
                 $paramRoutineName = $row['Routine_name'];
             }