tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-02 06:09:00 +02:00
Code Issues Projects Releases Wiki Activity

Merge pull request #5855 from tractorcow/pulls/3.4/fix-mysql-privileges

Browse Source 
BUG Fix permission checking code not correctly handling escaped SQL identifiers
This commit is contained in:
Daniel Hensby 2016-08-01 09:48:17 +01:00 committed by GitHub
commit 992413ef59
2 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
dev/install/MySQLDatabaseConfigurationHelper.php
View File

@ -172,8 +172,10 @@ class MySQLDatabaseConfigurationHelper implements DatabaseConfigurationHelper {
if(!$this->checkValidDatabaseName($database)) return false;
// Escape all valid database patterns (permission must exist on all tables)
$sqlDatabase = addcslashes($database, '_%'); // See http://dev.mysql.com/doc/refman/5.7/en/string-literals.html
$dbPattern = sprintf(
'((%s)|(%s)|(%s))',
'((%s)|(%s)|(%s)|(%s))',
preg_quote("\"$sqlDatabase\".*"), // Regexp escape sql-escaped db identifier
preg_quote("\"$database\".*"),
preg_quote('"%".*'),
preg_quote('*.*')

8
tests/dev/MySQLDatabaseConfigurationHelperTest.php
View File

@ -74,6 +74,14 @@ class MySQLDatabaseConfigurationHelperTest extends SapphireTest {
. " WITH GRANT OPTION"
));
// Accept create on this database only
$this->assertNotEmpty($helper->checkDatabasePermissionGrant(
'database_name',
'create',
"GRANT ALL PRIVILEGES, CREATE ON \"database\\_name\".* TO 'root'@'localhost' IDENTIFIED BY PASSWORD 'XXXX'"
. " WITH GRANT OPTION"
));
// Accept create on any database (alternate wildcard syntax)
$this->assertNotEmpty($helper->checkDatabasePermissionGrant(
'database_name',