Merge remote-tracking branch 'origin/QA_4_2' into QA_4_2

phpmyadmin · Oct 7, 2014 · 465d672 · 465d672
2 parents c1b4895 + d2b9979
commit 465d672
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 13 deletions.
diff --git a/ChangeLog b/ChangeLog
@@ -9,6 +9,7 @@ phpMyAdmin - ChangeLog
 - bug #4545 trying to favorite table while browser localStorage is disabled throws JS error
 - bug #4259 reCaptcha sound session expired problem
 - bug #4548 Inline editing a field converts tab to spaces
+- bug #4252 Database-level permission bug for db names containing underscores
 
 4.2.9.0 (2014-09-20)
 - bug       ajax.js responseHandler: cannot read property of null

diff --git a/libraries/Util.class.php b/libraries/Util.class.php
@@ -3833,19 +3833,7 @@ public static function currentUserHasPrivilege($priv, $db = null, $tbl = null)
         // If a database name was provided and user does not have the
         // required global privilege, try database-wise permissions.
         if ($db !== null) {
-            // need to escape wildcards in db and table names, see bug #3566
-            // (wildcard characters appear as being quoted with a backslash
-            //  when querying TABLE_SCHEMA.SCHEMA_PRIVILEGES)
-            $db = str_replace(array('%', '_'), array('\%', '\_'), $db);
-            /*
-             * This is to take into account a wildcard db privilege
-             * so we replace % by .* and _ by . to be able to compare
-             * with REGEXP.
-             *
-             * Also, we need to double the inner % to please sprintf().
-             */
-            $query .= " AND '%s' REGEXP"
-                . " REPLACE(REPLACE(TABLE_SCHEMA, '_', '.'), '%%', '.*')";
+            $query .= " AND '%s' LIKE `TABLE_SCHEMA`";
             $schema_privileges = $GLOBALS['dbi']->fetchValue(
                 sprintf(
                     $query,