webapp/phpmyadmin
1
0
Fork 0
mirror of https://github.com/phpmyadmin/phpmyadmin.git synced 2026-10-29 21:24:44 +03:00
Code Activity

Fixed bug #3518484 - PMA_sqlAddSlashes() does not quote the table names correctly

Browse Source
This commit is contained in:
Rouslan Placella
2012-04-16 23:58:03 +01:00
parent 5339365217
commit eca291ce82
2 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
ChangeLog
View File

@@ -16,6 +16,7 @@ phpMyAdmin - ChangeLog
- bug #3516405 [display] Chart title is getting wrong within chart export
- bug #3517021 [interface] Header links except 'More' hide after closing dialog
- bug #3516817 [interface] "More" actions in table structure
- bug #3518484 [privileges] PMA_sqlAddSlashes() does not quote the table names correctly
3.5.0.0 (2012-04-07)
+ rfe #2021981 [interface] Add support for mass prefix change.

8
libraries/common.lib.php
View File

@@ -3709,8 +3709,8 @@ function PMA_getFunctionsForField($field, $insert_mode)
* @param string $priv The privilege to check
* @param mixed $db null, to only check global privileges
* string, db name where to also check for privileges
* @param mixed $tbl null, to only check global privileges
* string, db name where to also check for privileges
* @param mixed $tbl null, to only check global/db privileges
* string, table name where to also check for privileges
*
* @return bool
*/
@@ -3746,6 +3746,8 @@ function PMA_currentUserHasPrivilege($priv, $db = null, $tbl = null)
// If a database name was provided and user does not have the
// required global privilege, try database-wise permissions.
if ($db !== null) {
// need to escape wildcards in db and table names, see bug #3518484
$db = str_replace(array('%', '_'), array('\%', '\_'), $db);
$query .= " AND TABLE_SCHEMA='%s'";
if (PMA_DBI_fetch_value(
sprintf(
@@ -3767,6 +3769,8 @@ function PMA_currentUserHasPrivilege($priv, $db = null, $tbl = null)
// If a table name was also provided and we still didn't
// find any valid privileges, try table-wise privileges.
if ($tbl !== null) {
// need to escape wildcards in db and table names, see bug #3518484
$tbl = str_replace(array('%', '_'), array('\%', '\_'), $tbl);
$query .= " AND TABLE_NAME='%s'";
if ($retval = PMA_DBI_fetch_value(
sprintf(