From e070256fe49260dddd0e0b30be4db6d954806136 Mon Sep 17 00:00:00 2001 From: William Desportes Date: Mon, 11 Nov 2019 11:44:24 +0100 Subject: [PATCH] Fix #13912 and #15123 - Tables of phpMyAdmin storage are not accessible Fixes: #13912 Fixes: #15123 Signed-off-by: William Desportes --- libraries/classes/Database/Designer.php | 8 +- .../classes/Database/Designer/Common.php | 10 +- .../classes/Navigation/Nodes/NodeDatabase.php | 2 +- libraries/classes/RecentFavoriteTable.php | 8 +- libraries/classes/Relation.php | 93 +++++++++++++++---- server_privileges.php | 2 +- server_user_groups.php | 4 +- 7 files changed, 94 insertions(+), 33 deletions(-) diff --git a/libraries/classes/Database/Designer.php b/libraries/classes/Database/Designer.php index 95e0701937..fe656d09e5 100644 --- a/libraries/classes/Database/Designer.php +++ b/libraries/classes/Database/Designer.php @@ -80,7 +80,12 @@ class Designer */ private function getPageIdsAndNames($db) { + $result = []; $cfgRelation = $this->relation->getRelationsParam(); + if (! $cfgRelation['pdfwork']) { + return $result; + } + $page_query = "SELECT `page_nr`, `page_descr` FROM " . Util::backquote($cfgRelation['db']) . "." . Util::backquote($cfgRelation['pdf_pages']) @@ -92,7 +97,6 @@ class Designer DatabaseInterface::QUERY_STORE ); - $result = []; while ($curr_page = $GLOBALS['dbi']->fetchAssoc($page_rs)) { $result[intval($curr_page['page_nr'])] = $curr_page['page_descr']; } @@ -195,7 +199,7 @@ class Designer $cfgRelation = $this->relation->getRelationsParam(); - if ($GLOBALS['cfgRelation']['designersettingswork']) { + if ($cfgRelation['designersettingswork']) { $query = 'SELECT `settings_data` FROM ' . Util::backquote($cfgRelation['db']) . '.' . Util::backquote($cfgRelation['designer_settings']) diff --git a/libraries/classes/Database/Designer/Common.php b/libraries/classes/Database/Designer/Common.php index 29157c7974..47b558bc64 100644 --- a/libraries/classes/Database/Designer/Common.php +++ b/libraries/classes/Database/Designer/Common.php @@ -456,9 +456,9 @@ class Common } $query = "DELETE FROM " - . Util::backquote($GLOBALS['cfgRelation']['db']) + . Util::backquote($cfgRelation['db']) . "." . Util::backquote( - $GLOBALS['cfgRelation']['table_coords'] + $cfgRelation['table_coords'] ) . " WHERE `pdf_page_number` = '" . $pageId . "'"; @@ -480,8 +480,8 @@ class Common } $query = "INSERT INTO " - . Util::backquote($GLOBALS['cfgRelation']['db']) . "." - . Util::backquote($GLOBALS['cfgRelation']['table_coords']) + . Util::backquote($cfgRelation['db']) . "." + . Util::backquote($cfgRelation['table_coords']) . " (`db_name`, `table_name`, `pdf_page_number`, `x`, `y`)" . " VALUES (" . "'" . $GLOBALS['dbi']->escapeString($DB) . "', " @@ -733,7 +733,7 @@ class Common { $cfgRelation = $this->relation->getRelationsParam(); $success = true; - if ($GLOBALS['cfgRelation']['designersettingswork']) { + if ($cfgRelation['designersettingswork']) { $cfgDesigner = array( 'user' => $GLOBALS['cfg']['Server']['user'], diff --git a/libraries/classes/Navigation/Nodes/NodeDatabase.php b/libraries/classes/Navigation/Nodes/NodeDatabase.php index 246000c49c..d9828a02f6 100644 --- a/libraries/classes/Navigation/Nodes/NodeDatabase.php +++ b/libraries/classes/Navigation/Nodes/NodeDatabase.php @@ -412,7 +412,7 @@ class NodeDatabase extends Node { $db = $this->real_name; $cfgRelation = $this->relation->getRelationsParam(); - if (empty($cfgRelation['navigationhiding'])) { + if (! $cfgRelation['navwork']) { return array(); } $navTable = Util::backquote($cfgRelation['db']) diff --git a/libraries/classes/RecentFavoriteTable.php b/libraries/classes/RecentFavoriteTable.php index 8f65dbe4e4..458d468a8b 100644 --- a/libraries/classes/RecentFavoriteTable.php +++ b/libraries/classes/RecentFavoriteTable.php @@ -383,13 +383,17 @@ class RecentFavoriteTable } /** - * Reutrn the name of the configuration storage table + * Return the name of the configuration storage table * - * @return string pma table name + * @return string|null pma table name */ private function _getPmaTable() { $cfgRelation = $this->relation->getRelationsParam(); + if (! $cfgRelation['recentwork']) { + return null; + } + if (! empty($cfgRelation['db']) && ! empty($cfgRelation[$this->_tableType]) ) { diff --git a/libraries/classes/Relation.php b/libraries/classes/Relation.php index 6209457e61..ff622b19a9 100644 --- a/libraries/classes/Relation.php +++ b/libraries/classes/Relation.php @@ -574,74 +574,112 @@ class Relation $GLOBALS['dbi']->freeResult($tab_rs); if (isset($cfgRelation['relation'])) { - $cfgRelation['relwork'] = true; + if ($this->canAccessStorageTable($cfgRelation['relation'])) { + $cfgRelation['relwork'] = true; + } } if (isset($cfgRelation['relation']) && isset($cfgRelation['table_info'])) { - $cfgRelation['displaywork'] = true; + if ($this->canAccessStorageTable($cfgRelation['table_info'])) { + $cfgRelation['displaywork'] = true; + } } if (isset($cfgRelation['table_coords']) && isset($cfgRelation['pdf_pages'])) { - $cfgRelation['pdfwork'] = true; + if ($this->canAccessStorageTable($cfgRelation['table_coords'])) { + if ($this->canAccessStorageTable($cfgRelation['pdf_pages'])) { + $cfgRelation['pdfwork'] = true; + } + } } if (isset($cfgRelation['column_info'])) { - $cfgRelation['commwork'] = true; - // phpMyAdmin 4.3+ - // Check for input transformations upgrade. - $cfgRelation['mimework'] = $this->tryUpgradeTransformations(); + if ($this->canAccessStorageTable($cfgRelation['column_info'])) { + $cfgRelation['commwork'] = true; + // phpMyAdmin 4.3+ + // Check for input transformations upgrade. + $cfgRelation['mimework'] = $this->tryUpgradeTransformations(); + } } if (isset($cfgRelation['history'])) { - $cfgRelation['historywork'] = true; + if ($this->canAccessStorageTable($cfgRelation['history'])) { + $cfgRelation['historywork'] = true; + } } if (isset($cfgRelation['recent'])) { - $cfgRelation['recentwork'] = true; + if ($this->canAccessStorageTable($cfgRelation['recent'])) { + $cfgRelation['recentwork'] = true; + } } if (isset($cfgRelation['favorite'])) { - $cfgRelation['favoritework'] = true; + if ($this->canAccessStorageTable($cfgRelation['favorite'])) { + $cfgRelation['favoritework'] = true; + } } if (isset($cfgRelation['table_uiprefs'])) { - $cfgRelation['uiprefswork'] = true; + if ($this->canAccessStorageTable($cfgRelation['table_uiprefs'])) { + $cfgRelation['uiprefswork'] = true; + } } if (isset($cfgRelation['tracking'])) { - $cfgRelation['trackingwork'] = true; + if ($this->canAccessStorageTable($cfgRelation['tracking'])) { + $cfgRelation['trackingwork'] = true; + } } if (isset($cfgRelation['userconfig'])) { - $cfgRelation['userconfigwork'] = true; + if ($this->canAccessStorageTable($cfgRelation['userconfig'])) { + $cfgRelation['userconfigwork'] = true; + } } if (isset($cfgRelation['bookmark'])) { - $cfgRelation['bookmarkwork'] = true; + if ($this->canAccessStorageTable($cfgRelation['bookmark'])) { + $cfgRelation['bookmarkwork'] = true; + } } if (isset($cfgRelation['users']) && isset($cfgRelation['usergroups'])) { - $cfgRelation['menuswork'] = true; + if ($this->canAccessStorageTable($cfgRelation['users'])) { + if ($this->canAccessStorageTable($cfgRelation['usergroups'])) { + $cfgRelation['menuswork'] = true; + } + } } if (isset($cfgRelation['navigationhiding'])) { - $cfgRelation['navwork'] = true; + if ($this->canAccessStorageTable($cfgRelation['navigationhiding'])) { + $cfgRelation['navwork'] = true; + } } if (isset($cfgRelation['savedsearches'])) { - $cfgRelation['savedsearcheswork'] = true; + if ($this->canAccessStorageTable($cfgRelation['savedsearches'])) { + $cfgRelation['savedsearcheswork'] = true; + } } if (isset($cfgRelation['central_columns'])) { - $cfgRelation['centralcolumnswork'] = true; + if ($this->canAccessStorageTable($cfgRelation['central_columns'])) { + $cfgRelation['centralcolumnswork'] = true; + } } if (isset($cfgRelation['designer_settings'])) { - $cfgRelation['designersettingswork'] = true; + if ($this->canAccessStorageTable($cfgRelation['designer_settings'])) { + $cfgRelation['designersettingswork'] = true; + } } if (isset($cfgRelation['export_templates'])) { - $cfgRelation['exporttemplateswork'] = true; + if ($this->canAccessStorageTable($cfgRelation['export_templates'])) { + $cfgRelation['exporttemplateswork'] = true; + } } $allWorks = true; @@ -676,6 +714,21 @@ class Relation return $cfgRelation; } + /** + * Check if the table is accessible + * + * @param string $tableDbName The table or table.db + * @return boolean The table is accessible + */ + public function canAccessStorageTable($tableDbName) { + $result = $this->queryAsControlUser( + 'SELECT NULL FROM ' . $tableDbName . ' LIMIT 0', + false, + DatabaseInterface::QUERY_STORE + ); + return $result !== false; + } + /** * Check whether column_info table input transformation * upgrade is required and try to upgrade silently diff --git a/server_privileges.php b/server_privileges.php index a0fcc00dc9..fda9a5b134 100644 --- a/server_privileges.php +++ b/server_privileges.php @@ -39,7 +39,7 @@ $scripts->addFile('vendor/zxcvbn.js'); if ((isset($_GET['viewing_mode']) && $_GET['viewing_mode'] == 'server') - && $GLOBALS['cfgRelation']['menuswork'] + && $cfgRelation['menuswork'] ) { $response->addHTML('
'); $response->addHTML(Users::getHtmlForSubMenusOnUsersPage('server_privileges.php')); diff --git a/server_user_groups.php b/server_user_groups.php index 2cd8feff62..bf5e92d787 100644 --- a/server_user_groups.php +++ b/server_user_groups.php @@ -13,8 +13,8 @@ use PhpMyAdmin\Server\Users; require_once 'libraries/common.inc.php'; $relation = new Relation(); -$relation->getRelationsParam(); -if (! $GLOBALS['cfgRelation']['menuswork']) { +$cfgRelation = $relation->getRelationsParam(); +if (! $cfgRelation['menuswork']) { exit; }