Skip to content

Commit 0525243

Browse files
MauricioFauthMauricioFauth
authored
Merge pull request #18659 from kamil-tekiela/quoteString-privileges
Replace remaining escapeString in Privileges
2 parents 82eb383 + 6328f6f commit 0525243

2 files changed

Lines changed: 16 additions & 25 deletions

File tree

‎libraries/classes/Server/Privileges.php‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -3055,12 +3055,12 @@ private function checkIfMariaDBPwdCheckPluginActive(): bool
30553055
*/
30563056
public function getSqlQueriesForDisplayAndAddUser(string $username, string $hostname, string $password): array
30573057
{
3058-
$slashedUsername = $this->dbi->escapeString($username);
3059-
$slashedHostname = $this->dbi->escapeString($hostname);
3060-
$slashedPassword = $this->dbi->escapeString($password);
3058+
$slashedUsername = $this->dbi->quoteString($username);
3059+
$slashedHostname = $this->dbi->quoteString($hostname);
3060+
$slashedPassword = $this->dbi->quoteString($password);
30613061
$serverVersion = $this->dbi->getVersion();
30623062

3063-
$createUserStmt = sprintf('CREATE USER \'%s\'@\'%s\'', $slashedUsername, $slashedHostname);
3063+
$createUserStmt = sprintf('CREATE USER %s@%s', $slashedUsername, $slashedHostname);
30643064
$isMariaDBPwdPluginActive = $this->checkIfMariaDBPwdCheckPluginActive();
30653065

30663066
// See https://github.com/phpmyadmin/phpmyadmin/pull/11560#issuecomment-147158219
@@ -3088,11 +3088,11 @@ public function getSqlQueriesForDisplayAndAddUser(string $username, string $host
30883088
$createUserReal = $createUserStmt;
30893089
$createUserShow = $createUserStmt;
30903090

3091-
$passwordSetStmt = 'SET PASSWORD FOR \'%s\'@\'%s\' = \'%s\'';
3092-
$passwordSetShow = sprintf($passwordSetStmt, $slashedUsername, $slashedHostname, '***');
3091+
$passwordSetStmt = 'SET PASSWORD FOR %s@%s = %s';
3092+
$passwordSetShow = sprintf($passwordSetStmt, $slashedUsername, $slashedHostname, '\'***\'');
30933093

30943094
$sqlQueryStmt = sprintf(
3095-
'GRANT %s ON *.* TO \'%s\'@\'%s\'',
3095+
'GRANT %s ON *.* TO %s@%s',
30963096
implode(', ', $this->extractPrivInfo()),
30973097
$slashedUsername,
30983098
$slashedHostname,
@@ -3120,24 +3120,24 @@ public function getSqlQueriesForDisplayAndAddUser(string $username, string $host
31203120
// MariaDB uses 'USING' whereas MySQL uses 'AS'
31213121
// but MariaDB with validation plugin needs cleartext password
31223122
if (Compatibility::isMariaDb() && ! $isMariaDBPwdPluginActive) {
3123-
$createUserStmt .= ' USING \'%s\'';
3123+
$createUserStmt .= ' USING %s';
31243124
} elseif (Compatibility::isMariaDb()) {
3125-
$createUserStmt .= ' IDENTIFIED BY \'%s\'';
3125+
$createUserStmt .= ' IDENTIFIED BY %s';
31263126
} elseif (Compatibility::isMySqlOrPerconaDb() && $serverVersion >= 80011) {
31273127
if (! str_contains($createUserStmt, 'IDENTIFIED')) {
31283128
// Maybe the authentication_plugin was not posted and then a part is missing
3129-
$createUserStmt .= ' IDENTIFIED BY \'%s\'';
3129+
$createUserStmt .= ' IDENTIFIED BY %s';
31303130
} else {
3131-
$createUserStmt .= ' BY \'%s\'';
3131+
$createUserStmt .= ' BY %s';
31323132
}
31333133
} else {
3134-
$createUserStmt .= ' AS \'%s\'';
3134+
$createUserStmt .= ' AS %s';
31353135
}
31363136

31373137
if ($_POST['pred_password'] === 'keep') {
31383138
$createUserReal = sprintf($createUserStmt, $slashedPassword);
31393139
} elseif ($_POST['pred_password'] === 'none') {
3140-
$createUserReal = sprintf($createUserStmt, null);
3140+
$createUserReal = sprintf($createUserStmt, '');
31413141
} else {
31423142
if (
31433143
! ((Compatibility::isMariaDb() && $isMariaDBPwdPluginActive)
@@ -3152,13 +3152,13 @@ public function getSqlQueriesForDisplayAndAddUser(string $username, string $host
31523152
$createUserReal = sprintf($createUserStmt, $hashedPassword);
31533153
}
31543154

3155-
$createUserShow = sprintf($createUserStmt, '***');
3155+
$createUserShow = sprintf($createUserStmt, '\'***\'');
31563156
} elseif ($_POST['pred_password'] === 'keep') {
31573157
// Use 'SET PASSWORD' syntax for pre-5.7.6 MySQL versions
31583158
// and pre-5.2.0 MariaDB versions
31593159
$passwordSetReal = sprintf($passwordSetStmt, $slashedUsername, $slashedHostname, $slashedPassword);
31603160
} elseif ($_POST['pred_password'] === 'none') {
3161-
$passwordSetReal = sprintf($passwordSetStmt, $slashedUsername, $slashedHostname, null);
3161+
$passwordSetReal = sprintf($passwordSetStmt, $slashedUsername, $slashedHostname, '');
31623162
} else {
31633163
$hashedPassword = $this->getHashedPassword($_POST['pma_pw']);
31643164
$passwordSetReal = sprintf($passwordSetStmt, $slashedUsername, $slashedHostname, $hashedPassword);
@@ -3178,7 +3178,7 @@ public function getSqlQueriesForDisplayAndAddUser(string $username, string $host
31783178
$realSqlQuery .= $sqlQueryStmt;
31793179
$sqlQuery .= $sqlQueryStmt;
31803180

3181-
$alterSqlQueryStmt = sprintf('ALTER USER \'%s\'@\'%s\'', $slashedUsername, $slashedHostname);
3181+
$alterSqlQueryStmt = sprintf('ALTER USER %s@%s', $slashedUsername, $slashedHostname);
31823182
$alterRealSqlQuery = $alterSqlQueryStmt;
31833183
$alterSqlQuery = $alterSqlQueryStmt;
31843184
}

‎psalm-baseline.xml‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -10914,11 +10914,6 @@
1091410914
</PossiblyNullArrayOffset>
1091510915
</file>
1091610916
<file src="libraries/classes/Server/Privileges.php">
10917-
<DeprecatedMethod>
10918-
<code>escapeString</code>
10919-
<code>escapeString</code>
10920-
<code>escapeString</code>
10921-
</DeprecatedMethod>
1092210917
<InvalidArrayOffset>
1092310918
<code><![CDATA[$GLOBALS['Grant_priv']]]></code>
1092410919
<code><![CDATA[$GLOBALS['Grant_priv']]]></code>
@@ -11076,10 +11071,6 @@
1107611071
<code>$extraData</code>
1107711072
<code>(string|bool)[]</code>
1107811073
</MixedReturnTypeCoercion>
11079-
<NullArgument>
11080-
<code>null</code>
11081-
<code>null</code>
11082-
</NullArgument>
1108311074
<PossiblyFalseOperand>
1108411075
<code><![CDATA[mb_strpos($row1['Type'], '(')]]></code>
1108511076
<code><![CDATA[mb_strpos($row1['Type'], '(')]]></code>

0 commit comments

Comments
 (0)