Changeset 32402

Timestamp:

05/06/2015 08:01:59 PM (8 years ago)

Author:

ocean90

Message:

WPDB: When sanity checking query character sets, there's no need to check queries that don't return user data.

Merges [32374] to the 4.1 branch.

props pento.
see #32104.

Location:

branches/4.1

Files:

• src/wp-includes/wp-db.php (modified) (2 diffs)
• tests/phpunit/tests/db/charset.php (modified) (1 diff)

branches/4.1/src/wp-includes/wp-db.php

@@ -2503 +2503 @@
         // We don't need to check the collation for queries that don't read data.
         $query = ltrim( $query, "\r\n\t (" );
-        if ( preg_match( '/^(?:SHOW|DESCRIBE|DESC|EXPLAIN)\s/i', $query ) ) {
+        if ( preg_match( '/^(?:SHOW|DESCRIBE|DESC|EXPLAIN|CREATE)\s/i', $query ) ) {
             return true;
         }
@@ -2714 +2714 @@
      */
     protected function strip_invalid_text_from_query( $query ) {
+        // We don't need to check the collation for queries that don't read data.
+        $trimmed_query = ltrim( $query, "\r\n\t (" );
+        if ( preg_match( '/^(?:SHOW|DESCRIBE|DESC|EXPLAIN|CREATE)\s/i', $trimmed_query ) ) {
+            return $query;
+        }
+
         $table = $this->get_table_from_query( $query );
         if ( $table ) {

branches/4.1/tests/phpunit/tests/db/charset.php

@@ -640 +640 @@
 
     /**
+     * @ticket 32104
+     */
+    function data_dont_strip_text_from_schema_queries() {
+        // An obviously invalid and fake table name.
+        $table_name = "\xff\xff\xff\xff";
+
+        $queries = array(
+            "SHOW CREATE TABLE $table_name",
+            "DESCRIBE $table_name",
+            "DESC $table_name",
+            "EXPLAIN SELECT * FROM $table_name",
+            "CREATE $table_name( a VARCHAR(100))",
+        );
+
+        foreach ( $queries as &$query ) {
+            $query = array( $query );
+        }
+        unset( $query );
+
+        return $queries;
+    }
+
+    /**
+     * @dataProvider data_dont_strip_text_from_schema_queries
+     * @ticket 32104
+     */
+    function test_dont_strip_text_from_schema_queries( $query ) {
+        $return = self::$_wpdb->strip_invalid_text_from_query( $query );
+        $this->assertEquals( $query, $return );
+    }
+
+    /**
      * @ticket 21212
      */