Changeset 32405

Timestamp:

05/06/2015 08:04:48 PM (11 years ago)

Author:

ocean90

Message:

WPDB: When sanity checking query character sets, there's no need to check queries that don't return user data.

Merges [32374] to the 3.9 branch.

props pento.
see #32104.

Location:

branches/3.9

Files:

• src/wp-includes/wp-db.php (modified) (2 diffs)
• tests/phpunit/tests/db/charset.php (modified) (1 diff)

branches/3.9/src/wp-includes/wp-db.php

@@ -2466 +2466 @@
                 // We don't need to check the collation for queries that don't read data.
                 $query = ltrim( $query, "\r\n\t (" );
-                if ( preg_match( '/^(?:SHOW|DESCRIBE|DESC|EXPLAIN)\s/i', $query ) ) {
+                if ( preg_match( '/^(?:SHOW|DESCRIBE|DESC|EXPLAIN|CREATE)\s/i', $query ) ) {
                         return true;
                 }
@@ -2677 +2677 @@
          */
         protected function strip_invalid_text_from_query( $query ) {
+                // We don't need to check the collation for queries that don't read data.
+                $trimmed_query = ltrim( $query, "\r\n\t (" );
+                if ( preg_match( '/^(?:SHOW|DESCRIBE|DESC|EXPLAIN|CREATE)\s/i', $trimmed_query ) ) {
+                        return $query;
+                }
+
                 $table = $this->get_table_from_query( $query );
                 if ( $table ) {

branches/3.9/tests/phpunit/tests/db/charset.php

@@ -640 +640 @@
 
         /**
+         * @ticket 32104
+         */
+        function data_dont_strip_text_from_schema_queries() {
+                // An obviously invalid and fake table name.
+                $table_name = "\xff\xff\xff\xff";
+
+                $queries = array(
+                        "SHOW CREATE TABLE $table_name",
+                        "DESCRIBE $table_name",
+                        "DESC $table_name",
+                        "EXPLAIN SELECT * FROM $table_name",
+                        "CREATE $table_name( a VARCHAR(100))",
+                );
+
+                foreach ( $queries as &$query ) {
+                        $query = array( $query );
+                }
+                unset( $query );
+
+                return $queries;
+        }
+
+        /**
+         * @dataProvider data_dont_strip_text_from_schema_queries
+         * @ticket 32104
+         */
+        function test_dont_strip_text_from_schema_queries( $query ) {
+                $return = self::$_wpdb->strip_invalid_text_from_query( $query );
+                $this->assertEquals( $query, $return );
+        }
+
+        /**
          * @ticket 21212
          */