webapp/phpmyadmin
1
0
Fork 0
mirror of https://github.com/phpmyadmin/phpmyadmin.git synced 2026-10-31 10:54:46 +03:00
Code Activity

Fix self-injection in Table specific privileges

Browse Source 
Don't manually add backticks (`) rather use the Util function,
since escaping of backticks inside the column_name has to be handled too.

Fix #12361

Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
This commit is contained in:
Deven Bansod
2016-11-16 11:06:29 +05:30
parent 0c36e5fd85
commit b69311e460
1 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
libraries/server_privileges.lib.php
View File

@@ -187,8 +187,16 @@ function PMA_extractPrivInfo($row = null, $enableHTML = false, $tablePrivs = fal
&& is_array($GLOBALS[$current_grant[0]])
&& empty($GLOBALS[$current_grant[0] . '_none'])
) {
// Required for proper escaping of ` (backtick) in a column name
$grant_cols = array_map(
function($val) {
return Util::backquote($val);
},
$GLOBALS[$current_grant[0]]
);
$privs[] = PMA_formatPrivilege($current_grant, $enableHTML)
. ' (`' . join('`, `', $GLOBALS[$current_grant[0]]) . '`)';
. ' (' . join(', ', $grant_cols) . ')';
} else {
$allPrivileges = false;
}