From d09ab9bc9d634ad08b866d42bb8c4109869d38d2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maur=C3=ADcio=20Meneghini=20Fauth?= <mauricio@fauth.dev>
Date: Fri, 3 Jul 2020 17:45:58 -0300
Subject: [PATCH] Check where clause signature in TableSearchController
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
---
 js/tbl_zoom_plot_jqplot.js                               | 6 ++++--
 .../classes/Controllers/Table/TableSearchController.php  | 9 ++++++++-
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/js/tbl_zoom_plot_jqplot.js b/js/tbl_zoom_plot_jqplot.js
index 897caed666..469c4828e7 100644
--- a/js/tbl_zoom_plot_jqplot.js
+++ b/js/tbl_zoom_plot_jqplot.js
@@ -558,7 +558,8 @@ AJAX.registerOnload('tbl_zoom_plot_jqplot.js', function () {
                 value[dataLabel], // for highlighter
                 // (may set an undefined value)
                 value.where_clause, // for click on point
-                key               // key from searchedData
+                key,               // key from searchedData
+                value.where_clause_sign
             ]);
         });
 
@@ -591,7 +592,8 @@ AJAX.registerOnload('tbl_zoom_plot_jqplot.js', function () {
                     'server' : PMA_commonParams.get('server'),
                     'db' : PMA_commonParams.get('db'),
                     'table' : PMA_commonParams.get('table'),
-                    'where_clause' : data[3]
+                    'where_clause' : data[3],
+                    'where_clause_sign' : data[5]
                 };
 
                 $.post('tbl_zoom_select.php', post_params, function (data) {
diff --git a/libraries/classes/Controllers/Table/TableSearchController.php b/libraries/classes/Controllers/Table/TableSearchController.php
index 16ed3fe1fd..e9f1e48e05 100644
--- a/libraries/classes/Controllers/Table/TableSearchController.php
+++ b/libraries/classes/Controllers/Table/TableSearchController.php
@@ -8,6 +8,7 @@
 namespace PhpMyAdmin\Controllers\Table;
 
 use PhpMyAdmin\Controllers\TableController;
+use PhpMyAdmin\Core;
 use PhpMyAdmin\DatabaseInterface;
 use PhpMyAdmin\Relation;
 use PhpMyAdmin\Sql;
@@ -345,13 +346,15 @@ class TableSearchController extends TableController
             );
             //Append it to row array as where_clause
             $row['where_clause'] = $uniqueCondition[0];
+            $row['where_clause_sign'] = Core::signSqlQuery($uniqueCondition[0]);
 
             $tmpData = array(
                 $_POST['criteriaColumnNames'][0] =>
                     $row[$_POST['criteriaColumnNames'][0]],
                 $_POST['criteriaColumnNames'][1] =>
                     $row[$_POST['criteriaColumnNames'][1]],
-                'where_clause' => $uniqueCondition[0]
+                'where_clause' => $uniqueCondition[0],
+                'where_clause_sign' => Core::signSqlQuery($uniqueCondition[0])
             );
             $tmpData[$dataLabel] = ($dataLabel) ? $row[$dataLabel] : '';
             $data[] = $tmpData;
@@ -419,6 +422,10 @@ class TableSearchController extends TableController
      */
     public function getDataRowAction()
     {
+        if (! Core::checkSqlQuerySignature($_POST['where_clause'], $_POST['where_clause_sign'])) {
+            return;
+        }
+
         $extra_data = array();
         $row_info_query = 'SELECT * FROM ' . Util::backquote($_POST['db']) . '.'
             . Util::backquote($_POST['table']) . ' WHERE ' .  $_POST['where_clause'];