tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-22 12:05:37 +00:00
Code Issues Projects Releases Wiki Activity

BUG Fix permission checking code not correctly handling escaped SQL identifiers

Browse Source 
Fixes https://github.com/silverstripe/silverstripe-installer/issues/96
This commit is contained in:
Damian Mooyman 2016-08-01 18:15:17 +12:00
parent 6c37532a7a
commit 7d0b8e6520
2 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
dev/install/MySQLDatabaseConfigurationHelper.php
View File

@ -172,8 +172,10 @@ class MySQLDatabaseConfigurationHelper implements DatabaseConfigurationHelper {
if(!$this->checkValidDatabaseName($database)) return false; if(!$this->checkValidDatabaseName($database)) return false;
// Escape all valid database patterns (permission must exist on all tables) // Escape all valid database patterns (permission must exist on all tables)
$sqlDatabase = addcslashes($database, '_%'); // See http://dev.mysql.com/doc/refman/5.7/en/string-literals.html
$dbPattern = sprintf( $dbPattern = sprintf(
'((%s)|(%s)|(%s))', '((%s)|(%s)|(%s)|(%s))',
preg_quote("\"$sqlDatabase\".*"), // Regexp escape sql-escaped db identifier
preg_quote("\"$database\".*"), preg_quote("\"$database\".*"),
preg_quote('"%".*'), preg_quote('"%".*'),
preg_quote('*.*') preg_quote('*.*')

8
tests/dev/MySQLDatabaseConfigurationHelperTest.php
View File

@ -74,6 +74,14 @@ class MySQLDatabaseConfigurationHelperTest extends SapphireTest {
. " WITH GRANT OPTION" . " WITH GRANT OPTION"
)); ));
// Accept create on this database only
$this->assertNotEmpty($helper->checkDatabasePermissionGrant(
'database_name',
'create',
"GRANT ALL PRIVILEGES, CREATE ON \"database\\_name\".* TO 'root'@'localhost' IDENTIFIED BY PASSWORD 'XXXX'"
. " WITH GRANT OPTION"
));
// Accept create on any database (alternate wildcard syntax) // Accept create on any database (alternate wildcard syntax)
$this->assertNotEmpty($helper->checkDatabasePermissionGrant( $this->assertNotEmpty($helper->checkDatabasePermissionGrant(
'database_name', 'database_name',