webapp/phpmyadmin
1
0
Fork 0
mirror of https://github.com/phpmyadmin/phpmyadmin.git synced 2026-10-23 18:29:15 +03:00
Code Activity

Escape the username in the user group lookup

Browse Source 
Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
Signed-off-by: Maurício Meneghini Fauth <mauricio@mfauth.com.br>
This commit is contained in:
Arpit Jain
2026-09-29 09:52:47 -04:00
committed by Maurício Meneghini Fauth
parent b8a20e6164
commit 67cf87d345
4 changed files with 35 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
libraries/classes/Server/Privileges.php
View File

@@ -1551,7 +1551,7 @@ class Privileges
$userTable = Util::backquote($configurableMenusFeature->database)
. '.' . Util::backquote($configurableMenusFeature->users);
$sqlQuery = 'SELECT `usergroup` FROM ' . $userTable
. ' WHERE `username` = \'' . $username . '\''
. ' WHERE `username` = \'' . $this->dbi->escapeString($username) . '\''
. ' LIMIT 1';
$usergroup = $this->dbi->fetchValue($sqlQuery, 0, DatabaseInterface::CONNECT_CONTROL);

7
phpstan-baseline.neon
View File

@@ -47141,9 +47141,14 @@ parameters:
count: 7
path: test/classes/Server/PrivilegesTest.php
-
message: "#^Parameter \\#3 \\$subject of function str_replace expects array\\|string, mixed given\\.$#"
count: 1
path: test/classes/Server/PrivilegesTest.php
-
message: "#^Property PhpMyAdmin\\\\Server\\\\Privileges\\:\\:\\$dbi \\(PhpMyAdmin\\\\DatabaseInterface\\) does not accept mixed\\.$#"
count: 10
count: 11
path: test/classes/Server/PrivilegesTest.php
-

6
psalm-baseline.xml
View File

@@ -15981,11 +15981,15 @@
</RedundantCondition>
</file>
<file src="test/classes/Server/PrivilegesTest.php">
<MixedArgument occurrences="5">
<MissingClosureParamType occurrences="1">
<code>$string</code>
</MissingClosureParamType>
<MixedArgument occurrences="6">
<code>$export</code>
<code>$extra_data['new_privileges']</code>
<code>$extra_data['new_user_string']</code>
<code>$extra_data['new_user_string']</code>
<code>$string</code>
<code>$title</code>
</MixedArgument>
<MixedArgumentTypeCoercion occurrences="1">

23
test/classes/Server/PrivilegesTest.php
View File

@@ -1156,6 +1156,29 @@ class PrivilegesTest extends AbstractTestCase
$this->serverPrivileges->dbi = $dbi_old;
}
public function testGetUserGroupForUserEscapesTheUsername(): void
{
$username = 'pma\' UNION SELECT \'injected';
$dbi_old = $GLOBALS['dbi'];
$dbi = $this->createMock(DatabaseInterface::class);
$dbi->method('escapeString')->willReturnCallback(static function ($string) {
return str_replace("'", "\\'", $string);
});
$dbi->expects(self::once())->method('fetchValue')
->with(self::stringContains('WHERE `username` = \'pma\\\' UNION SELECT \\\'injected\''))
->willReturn('pma_usergroup');
$GLOBALS['dbi'] = $dbi;
$this->serverPrivileges->dbi = $dbi;
self::assertSame('pma_usergroup', $this->serverPrivileges->getUserGroupForUser($username));
$GLOBALS['dbi'] = $dbi_old;
$this->serverPrivileges->dbi = $dbi_old;
}
/**
* Test for getUsersOverview
*/