webapp/phpmyadmin
1
0
Fork 0
mirror of https://github.com/phpmyadmin/phpmyadmin.git synced 2026-10-28 07:41:55 +03:00
Code Activity

Add appr. escaping for $cfg options 'hide_db' and 'only_db'

Browse Source 
These can lead to SQL injection.

Fix #12497

Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
This commit is contained in:
Deven Bansod
2016-08-25 19:36:35 +05:30
parent 26cc80324e
commit df29d8ae41
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
libraries/navigation/nodes/Node.php
View File

@@ -721,7 +721,9 @@ class Node
if (!empty($GLOBALS['cfg']['Server']['hide_db'])) {
$whereClause .= "AND " . Util::backquote($columnName)
. " NOT REGEXP '" . $GLOBALS['cfg']['Server']['hide_db'] . "' ";
. " NOT REGEXP '"
. Util::sqlAddSlashes($GLOBALS['cfg']['Server']['hide_db'], true)
. "' ";
}
if (!empty($GLOBALS['cfg']['Server']['only_db'])) {
@@ -735,7 +737,7 @@ class Node
foreach ($GLOBALS['cfg']['Server']['only_db'] as $each_only_db) {
$subClauses[] = " " . Util::backquote($columnName)
. " LIKE '"
. $each_only_db . "' ";
. Util::sqlAddSlashes($each_only_db, true) . "' ";
}
$whereClause .= implode("OR", $subClauses) . ") ";
}