Fix bug#3922, user privileges-database name unescaped

phpmyadmin · Jun 12, 2013 · 63b9137 · 63b9137 · lem9 · Jun 12, 2013
1 parent f794663
commit 63b9137
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 3 deletions.
diff --git a/libraries/server_privileges.lib.php b/libraries/server_privileges.lib.php
@@ -2297,7 +2297,7 @@ function PMA_getHtmlForDisplaySelectDbInEditPrivs($found_rows)
             // because the list of databases has special characters
             // already escaped in $found_rows,
             // contrary to the output of SHOW DATABASES
-            if (empty($found_rows) || ! in_array($current_db_show, $found_rows)) {
+            if (empty($found_rows) || ! in_array($current_db, $found_rows)) {
                 $html_output .= '<option value="' . htmlspecialchars($current_db) . '">'
                     . htmlspecialchars($current_db_show) . '</option>' . "\n";
             }
@@ -3070,9 +3070,11 @@ function PMA_getHtmlForDisplayUserProperties($dbname_is_wildcard,$url_dbname,
         $html_output .= '<form action="server_privileges.php" '
             . 'id="db_or_table_specific_priv" method="post">' . "\n";
 
+        // unescape wildcards in dbname at table level
+        $unescaped_db = PMA_Util::unescapeMysqlWildcards($dbname);
         list($html_rightsTable, $found_rows)
             = PMA_getTableForDisplayAllTableSpecificRights(
-                $username, $hostname, $link_edit, $link_revoke, $dbname
+                $username, $hostname, $link_edit, $link_revoke, $unescaped_db
             );
         $html_output .= $html_rightsTable;
 

diff --git a/server_privileges.php b/server_privileges.php
@@ -474,7 +474,7 @@
             PMA_getHtmlForDisplayUserProperties(
                 ((isset ($dbname_is_wildcard)) ? $dbname_is_wildcard : ''),
                 $url_dbname, $username, $hostname, $link_edit, $link_revoke,
-                (isset($unescaped_db) ? $unescaped_db : ''),
+                (isset($dbname) ? $dbname : ''),
                 (isset($tablename) ? $tablename : '')
             )
         );