gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Dropped unsafe usage of preg_replace

Browse Source 
It could be tricked by apending /e\x00 to execute arbitrary php code.
The new code does simple string replace, we don't really need any of
regex stuff here.
This commit is contained in:
Michal Čihař 2013-04-16 15:15:05 +02:00 committed by Marc Delisle
parent 8dbce7e4a0
commit dedd542cda
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
libraries/mult_submits.inc.php
View File

@ -425,14 +425,23 @@ if (!empty($submit_mult) && !empty($what)) {
case 'replace_prefix_tbl':
$current = $selected[$i];
$newtablename = preg_replace("/^" . $from_prefix . "/", $to_prefix, $current);
if (substr($current, 0, strlen($from_prefix)) == $from_prefix) {
$newtablename = $to_prefix . substr($current, strlen($from_prefix));
} else {
$newtablename = $current;
}
$a_query = 'ALTER TABLE ' . PMA_backquote($selected[$i]) . ' RENAME ' . PMA_backquote($newtablename) ; // CHANGE PREFIX PATTERN
$run_parts = true;
break;
case 'copy_tbl_change_prefix':
$current = $selected[$i];
$newtablename = preg_replace("/^" . $from_prefix . "/", $to_prefix, $current);
if (substr($current, 0, strlen($from_prefix)) == $from_prefix) {
$newtablename = $to_prefix . substr($current, strlen($from_prefix));
} else {
$newtablename = $current;
}
$newtablename = $to_prefix . substr($current, strlen($from_prefix));
$a_query = 'CREATE TABLE ' . PMA_backquote($newtablename) . ' SELECT * FROM ' . PMA_backquote($selected[$i]) ; // COPY TABLE AND CHANGE PREFIX PATTERN
$run_parts = true;
break;