Visitar URL original
Merge branch 'QA_5_2' · phpmyadmin/phpmyadmin@c094140 · GitHub
Skip to content

Commit c094140

Browse files
MauricioFauthMauricioFauth
committed
Merge branch 'QA_5_2'
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
2 parents bc4397f + 2653b29 commit c094140

17 files changed

Lines changed: 284 additions & 87 deletions

‎ChangeLog‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,9 @@ phpMyAdmin - ChangeLog
3838
- issue #16769 Fix create index form accepting too many columns
3939
- issue #16816 Disable editing to system schemas
4040
- issue #16853 Add better error handling when IndexedDB is not working
41+
- issue Fixed incorrect escaping of special MySQL characters on some pages
42+
- issue #17188 Fix GIS visualization with an edited query
43+
- issue #17418 Remove the use of the deprecated `strftime` function in OpenDocument exports
4144

4245
5.1.3 (2022-02-10)
4346
- issue #17308 Fix broken pagination links in the navigation sidebar

‎composer.json‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@
9393
"php-webdriver/webdriver": "^1.11",
9494
"phpmyadmin/coding-standard": "^3.0.0",
9595
"phpstan/extension-installer": "^1.1",
96-
"phpstan/phpstan": "^1.4.5",
96+
"phpstan/phpstan": "^1.4.8",
9797
"phpstan/phpstan-phpunit": "^1.0",
9898
"phpstan/phpstan-webmozart-assert": "^1.0",
9999
"phpunit/phpunit": "^8.5 || ^9.5",
@@ -102,27 +102,30 @@
102102
"roave/security-advisories": "dev-latest",
103103
"symfony/console": "^5.2.3",
104104
"tecnickcom/tcpdf": "^6.4.4",
105-
"vimeo/psalm": "^4.19"
105+
"vimeo/psalm": "^4.22"
106106
},
107107
"extra": {
108108
"branch-alias": {
109109
"dev-master": "5.2.x-dev"
110110
}
111111
},
112112
"scripts": {
113-
"phpcbf": "phpcbf",
114-
"phpcs": "phpcs",
115-
"phpstan": "phpstan analyse",
116-
"psalm": "psalm --no-diff",
117-
"phpunit": "phpunit --color=always",
113+
"phpcbf": "@php phpcbf",
114+
"phpcs": "@php phpcs",
115+
"phpstan": "@php phpstan analyse",
116+
"psalm": "@php psalm --no-diff",
117+
"phpunit": "@php phpunit --color=always",
118118
"test": [
119119
"@phpcs",
120120
"@phpstan",
121121
"@psalm",
122122
"@phpunit"
123123
],
124-
"update:baselines": "phpstan analyse --generate-baseline && psalm --set-baseline=psalm-baseline.xml",
125-
"twig-lint": "php scripts/console lint:twig --ansi --show-deprecations"
124+
"update:baselines": [
125+
"@php phpstan analyse --generate-baseline",
126+
"@php psalm --set-baseline=psalm-baseline.xml"
127+
],
128+
"twig-lint": "@php scripts/console lint:twig --ansi --show-deprecations"
126129
},
127130
"config":{
128131
"sort-packages": true,

‎libraries/classes/Config/Descriptions.php‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@
1010
use PhpMyAdmin\Sanitize;
1111

1212
use function __;
13-
use function htmlspecialchars;
1413
use function sprintf;
1514
use function str_replace;
1615

@@ -653,10 +652,7 @@ private static function getNames(): array
653652
'DisplayServersList_name' => __('Display servers as a list'),
654653
'DisableMultiTableMaintenance_name' => __('Disable multi table maintenance'),
655654
'ExecTimeLimit_name' => __('Maximum execution time'),
656-
'Export_lock_tables_name' => sprintf(
657-
__('Use %s statement'),
658-
htmlspecialchars('<code>LOCK TABLES</code>')
659-
),
655+
'Export_lock_tables_name' => __('Use [code]LOCK TABLES[/code] statement'),
660656
'Export_asfile_name' => __('Save as file'),
661657
'Export_charset_name' => __('Character set of the file'),
662658
'Export_codegen_format_name' => __('Format'),

‎libraries/classes/DatabaseInterface.php‎

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@
5454
use function strlen;
5555
use function strtolower;
5656
use function strtoupper;
57+
use function strtr;
5758
use function substr;
5859
use function syslog;
5960
use function trigger_error;
@@ -505,9 +506,7 @@ static function ($a, $b) {
505506
) . '\')';
506507
} else {
507508
$sql .= " `Name` LIKE '"
508-
. Util::escapeMysqlWildcards(
509-
$this->escapeString($table, $link)
510-
)
509+
. $this->escapeMysqlLikeString($table, $link)
511510
. "%'";
512511
}
513512

@@ -904,7 +903,7 @@ public function getColumn(
904903
$sql = QueryGenerator::getColumnsSql(
905904
$database,
906905
$table,
907-
Util::escapeMysqlWildcards($this->escapeString($column)),
906+
$this->escapeMysqlLikeString($column),
908907
$full
909908
);
910909
/** @var array<string, array> $fields */
@@ -2132,6 +2131,19 @@ public function escapeString(string $str, $link = self::CONNECT_USER)
21322131
return $this->extension->escapeString($this->links[$link], $str);
21332132
}
21342133

2134+
/**
2135+
* returns properly escaped string for use in MySQL LIKE clauses
2136+
*
2137+
* @param string $str string to be escaped
2138+
* @param int $link optional database link to use
2139+
*
2140+
* @return string a MySQL escaped LIKE string
2141+
*/
2142+
public function escapeMysqlLikeString(string $str, int $link = self::CONNECT_USER)
2143+
{
2144+
return $this->escapeString(strtr($str, ['\\' => '\\\\', '_' => '\\_', '%' => '\\%']), $link);
2145+
}
2146+
21352147
/**
21362148
* Checks if this database server is running on Amazon RDS.
21372149
*/

‎libraries/classes/Dbal/DbalInterface.php‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -634,6 +634,16 @@ public function getFieldsMeta(ResultInterface $result): array;
634634
*/
635635
public function escapeString(string $str, $link = DatabaseInterface::CONNECT_USER);
636636

637+
/**
638+
* returns properly escaped string for use in MySQL LIKE clauses
639+
*
640+
* @param string $str string to be escaped
641+
* @param int $link optional database link to use
642+
*
643+
* @return string a MySQL escaped LIKE string
644+
*/
645+
public function escapeMysqlLikeString(string $str, int $link = DatabaseInterface::CONNECT_USER);
646+
637647
/**
638648
* Checks if this database server is running on Amazon RDS.
639649
*/

‎libraries/classes/Gis/GisVisualization.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
use function mb_substr;
2626
use function ob_get_clean;
2727
use function ob_start;
28+
use function rtrim;
2829

2930
use const PNG_ALL_FILTERS;
3031

@@ -220,7 +221,7 @@ private function modifySqlQuery($sql_query, $rows, $pos)
220221
. ') AS ' . Util::backquote('srid') . ' ';
221222

222223
// Append the original query as the inner query
223-
$modified_query .= 'FROM (' . $sql_query . ') AS '
224+
$modified_query .= 'FROM (' . rtrim($sql_query, ';') . ') AS '
224225
. Util::backquote('temp_gis');
225226

226227
// LIMIT clause

‎libraries/classes/OpenDocument.php‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,12 @@
77

88
namespace PhpMyAdmin;
99

10-
use function date;
10+
use DateTime;
11+
12+
use const DATE_W3C;
1113

1214
/**
13-
* Simplfied OpenDocument creator class
15+
* Simplified OpenDocument creator class
1416
*/
1517
class OpenDocument
1618
{
@@ -33,6 +35,9 @@ class OpenDocument
3335
*/
3436
public static function create($mime, $data)
3537
{
38+
// Use the same date method as other PHP libs
39+
// https://github.com/PHPOffice/PhpSpreadsheet/blob/1.22.0/src/PhpSpreadsheet/Writer/Ods/Meta.php#L49
40+
$dateTimeCreation = (new DateTime())->format(DATE_W3C);
3641
$data = [
3742
$mime,
3843
$data,
@@ -45,7 +50,7 @@ public static function create($mime, $data)
4550
. '<meta:generator>phpMyAdmin ' . Version::VERSION . '</meta:generator>'
4651
. '<meta:initial-creator>phpMyAdmin ' . Version::VERSION
4752
. '</meta:initial-creator>'
48-
. '<meta:creation-date>' . date('Y-m-d\TH:i:s')
53+
. '<meta:creation-date>' . $dateTimeCreation
4954
. '</meta:creation-date>'
5055
. '</office:meta>'
5156
. '</office:document-meta>',

‎libraries/classes/Server/Privileges.php‎

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3348,9 +3348,7 @@ public function addUserAndCreateDatabase(
33483348
if ($createDb1) {
33493349
// Create database with same name and grant all privileges
33503350
$query = 'CREATE DATABASE IF NOT EXISTS '
3351-
. Util::backquote(
3352-
$this->dbi->escapeString($username)
3353-
) . ';';
3351+
. Util::backquote($username) . ';';
33543352
$sqlQuery .= $query;
33553353
if (! $this->dbi->tryQuery($query)) {
33563354
$message = Message::rawError($this->dbi->getError());
@@ -3364,9 +3362,7 @@ public function addUserAndCreateDatabase(
33643362

33653363
$query = 'GRANT ALL PRIVILEGES ON '
33663364
. Util::backquote(
3367-
Util::escapeMysqlWildcards(
3368-
$this->dbi->escapeString($username)
3369-
)
3365+
Util::escapeMysqlWildcards($username)
33703366
) . '.* TO \''
33713367
. $this->dbi->escapeString($username)
33723368
. '\'@\'' . $this->dbi->escapeString($hostname) . '\';';
@@ -3380,9 +3376,7 @@ public function addUserAndCreateDatabase(
33803376
// Grant all privileges on wildcard name (username\_%)
33813377
$query = 'GRANT ALL PRIVILEGES ON '
33823378
. Util::backquote(
3383-
Util::escapeMysqlWildcards(
3384-
$this->dbi->escapeString($username)
3385-
) . '\_%'
3379+
Util::escapeMysqlWildcards($username) . '\_%'
33863380
) . '.* TO \''
33873381
. $this->dbi->escapeString($username)
33883382
. '\'@\'' . $this->dbi->escapeString($hostname) . '\';';

‎libraries/classes/Util.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2274,8 +2274,8 @@ public static function getTablesWhenOpen($db, ResultInterface $dbInfoResult): ar
22742274
&& is_scalar($_REQUEST['tbl_group'])
22752275
&& strlen((string) $_REQUEST['tbl_group']) > 0
22762276
) {
2277-
$group = self::escapeMysqlWildcards((string) $_REQUEST['tbl_group']);
2278-
$groupWithSeparator = self::escapeMysqlWildcards(
2277+
$group = $GLOBALS['dbi']->escapeMysqlLikeString((string) $_REQUEST['tbl_group']);
2278+
$groupWithSeparator = $GLOBALS['dbi']->escapeMysqlLikeString(
22792279
$_REQUEST['tbl_group']
22802280
. $GLOBALS['cfg']['NavigationTreeTableSeparator']
22812281
);

‎phpcs.xml.dist‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
<exclude-pattern>*/tmp/*</exclude-pattern>
1919
<exclude-pattern>*/twig-templates/*</exclude-pattern>
2020
<exclude-pattern>*/vendor/*</exclude-pattern>
21+
<exclude-pattern>*/.git/*</exclude-pattern>
2122

2223
<rule ref="PhpMyAdmin"/>
2324

0 commit comments

Comments
 (0)