From deeb3e62dfb3a2a03928164a3fc0fd2f283b3ff5 Mon Sep 17 00:00:00 2001
From: Deven Bansod <devenbansod.bits@gmail.com>
Date: Fri, 25 Nov 2016 17:56:31 +0530
Subject: [PATCH] Avoid use of improper parameters in escapeString

Fix #12735

Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
---
 libraries/navigation/nodes/Node.php         |  4 +--
 libraries/navigation/nodes/NodeDatabase.php | 30 +++++----------------
 2 files changed, 9 insertions(+), 25 deletions(-)

diff --git a/libraries/navigation/nodes/Node.php b/libraries/navigation/nodes/Node.php
index c25d5da348..8265f63192 100644
--- a/libraries/navigation/nodes/Node.php
+++ b/libraries/navigation/nodes/Node.php
@@ -722,7 +722,7 @@ class Node
         if (!empty($GLOBALS['cfg']['Server']['hide_db'])) {
             $whereClause .= "AND " . Util::backquote($columnName)
                 . " NOT REGEXP '"
-                . $GLOBALS['dbi']->escapeString($GLOBALS['cfg']['Server']['hide_db'], true)
+                . $GLOBALS['dbi']->escapeString($GLOBALS['cfg']['Server']['hide_db'])
                 . "' ";
         }
 
@@ -737,7 +737,7 @@ class Node
             foreach ($GLOBALS['cfg']['Server']['only_db'] as $each_only_db) {
                 $subClauses[] = " " . Util::backquote($columnName)
                     . " LIKE '"
-                    . $GLOBALS['dbi']->escapeString($each_only_db, true) . "' ";
+                    . $GLOBALS['dbi']->escapeString($each_only_db) . "' ";
             }
             $whereClause .= implode("OR", $subClauses) . ") ";
         }
diff --git a/libraries/navigation/nodes/NodeDatabase.php b/libraries/navigation/nodes/NodeDatabase.php
index 54efb6a498..27915fb26f 100644
--- a/libraries/navigation/nodes/NodeDatabase.php
+++ b/libraries/navigation/nodes/NodeDatabase.php
@@ -342,7 +342,7 @@ class NodeDatabase extends Node
             $query .= "'" . $GLOBALS['dbi']->escapeString($searchClause) . "'";
         } else {
             $query .= Util::backquote($columnName) . " LIKE ";
-            $query .= "'%" . $GLOBALS['dbi']->escapeString($searchClause, true)
+            $query .= "'%" . $GLOBALS['dbi']->escapeString($searchClause)
                 . "%'";
         }
 
@@ -459,10 +459,7 @@ class NodeDatabase extends Node
             $query .= "AND `TABLE_TYPE`" . $condition . "'BASE TABLE' ";
             if (! empty($searchClause)) {
                 $query .= "AND `TABLE_NAME` LIKE '%";
-                $query .= $GLOBALS['dbi']->escapeString(
-                    $searchClause,
-                    true
-                );
+                $query .= $GLOBALS['dbi']->escapeString($searchClause);
                 $query .= "%'";
             }
             $query .= "ORDER BY `TABLE_NAME` ASC ";
@@ -477,8 +474,7 @@ class NodeDatabase extends Node
                     "Tables_in_" . $db
                 );
                 $query .= " LIKE '%" . $GLOBALS['dbi']->escapeString(
-                    $searchClause,
-                    true
+                    $searchClause
                 );
                 $query .= "%'";
             }
@@ -550,10 +546,7 @@ class NodeDatabase extends Node
             $query .= "AND `ROUTINE_TYPE`='" . $routineType . "' ";
             if (!empty($searchClause)) {
                 $query .= "AND `ROUTINE_NAME` LIKE '%";
-                $query .= $GLOBALS['dbi']->escapeString(
-                    $searchClause,
-                    true
-                );
+                $query .= $GLOBALS['dbi']->escapeString($searchClause);
                 $query .= "%'";
             }
             $query .= "ORDER BY `ROUTINE_NAME` ASC ";
@@ -564,10 +557,7 @@ class NodeDatabase extends Node
             $query = "SHOW " . $routineType . " STATUS WHERE `Db`='$escdDb' ";
             if (!empty($searchClause)) {
                 $query .= "AND `Name` LIKE '%";
-                $query .= $GLOBALS['dbi']->escapeString(
-                    $searchClause,
-                    true
-                );
+                $query .= $GLOBALS['dbi']->escapeString($searchClause);
                 $query .= "%'";
             }
             $handle = $GLOBALS['dbi']->tryQuery($query);
@@ -636,10 +626,7 @@ class NodeDatabase extends Node
                 . Util::getCollateForIS() . "='$escdDb' ";
             if (!empty($searchClause)) {
                 $query .= "AND `EVENT_NAME` LIKE '%";
-                $query .= $GLOBALS['dbi']->escapeString(
-                    $searchClause,
-                    true
-                );
+                $query .= $GLOBALS['dbi']->escapeString($searchClause);
                 $query .= "%'";
             }
             $query .= "ORDER BY `EVENT_NAME` ASC ";
@@ -650,10 +637,7 @@ class NodeDatabase extends Node
             $query = "SHOW EVENTS FROM $escdDb ";
             if (!empty($searchClause)) {
                 $query .= "WHERE `Name` LIKE '%";
-                $query .= $GLOBALS['dbi']->escapeString(
-                    $searchClause,
-                    true
-                );
+                $query .= $GLOBALS['dbi']->escapeString($searchClause);
                 $query .= "%'";
             }
             $handle = $GLOBALS['dbi']->tryQuery($query);