Changeset 33311

Timestamp:

07/17/2015 07:09:32 AM (9 years ago)

Author:

pento

Message:

WPDB: ::strip_text_from_query() doesn't pass a length to ::strip_invalid_text(), which was causing queries to fail when they contained characters that needed to be sanity checked by MySQL.

Props dd32, mdawaffe, pento.

Merges [33310] to the 4.2 branch.

Fixes #32279.

Location:

branches/4.2

Files:

• src/wp-includes/wp-db.php (modified) (3 diffs)
• tests/phpunit/tests/db/charset.php (modified) (2 diffs)

branches/4.2/src/wp-includes/wp-db.php

@@ -2595 +2595 @@
             if ( is_array( $value['length'] ) ) {
                 $length = $value['length']['length'];
+                $truncate_by_byte_length = 'byte' === $value['length']['type'];
             } else {
                 $length = false;
+                // Since we have no length, we'll never truncate.
+                // Initialize the variable to false. true would take us
+                // through an unnecessary (for this case) codepath below.
+                $truncate_by_byte_length = false;
             }
 
@@ -2608 +2613 @@
                 continue;
             }
-
-            $truncate_by_byte_length = 'byte' === $value['length']['type'];
 
             $needs_validation = true;
@@ -2684 +2687 @@
                     }
 
-                    $queries[ $col ] = $this->prepare( "CONVERT( LEFT( CONVERT( %s USING $charset ), %.0f ) USING {$this->charset} )", $value['value'], $value['length']['length'] );
+                    if ( is_array( $value['length'] ) ) {
+                        $queries[ $col ] = $this->prepare( "CONVERT( LEFT( CONVERT( %s USING $charset ), %.0f ) USING {$this->charset} )", $value['value'], $value['length']['length'] );
+                    } else if ( 'binary' !== $charset ) {
+                        // If we don't have a length, there's no need to convert binary - it will always return the same result.
+                        $queries[ $col ] = $this->prepare( "CONVERT( CONVERT( %s USING $charset ) USING {$this->charset} )", $value['value'] );
+                    }
 
                     unset( $data[ $col ]['db'] );

branches/4.2/tests/phpunit/tests/db/charset.php

@@ -214 +214 @@
                 'expected' => "\xd8ord\xd0ress",
                 'length'   => array( 'type' => 'char', 'length' => 100 ),
+            ),
+            'cp1251_no_length' => array(
+                'charset'  => 'cp1251',
+                'value'    => "\xd8ord\xd0ress",
+                'expected' => "\xd8ord\xd0ress",
+                'length'   => false,
+            ),
+            'cp1251_no_length_ascii' => array(
+                'charset'  => 'cp1251',
+                'value'    => "WordPress",
+                'expected' => "WordPress",
+                'length'   => false,
+                // Don't set 'ascii' => true/false.
+                // That's a different codepath than it being unset even if
+                // three's only only ASCII in the value.
             ),
             'cp1251_char_length' => array(
@@ -808 +823 @@
         $this->assertEquals( 255, strlen( $stripped ) );
     }
+
+    /**
+     * @ticket 32279
+     */
+    function test_strip_invalid_text_from_query_cp1251_is_safe() {
+        $tablename = 'test_cp1251_query_' . rand_str( 5 );
+        if ( ! self::$_wpdb->query( "CREATE TABLE $tablename ( a VARCHAR(50) ) DEFAULT CHARSET 'cp1251'" ) ) {
+            $this->markTestSkipped( "Test requires the 'cp1251' charset" );
+        }
+
+        $safe_query = "INSERT INTO $tablename( `a` ) VALUES( 'safe data' )";
+        $stripped_query = self::$_wpdb->strip_invalid_text_from_query( $safe_query );
+
+        self::$_wpdb->query( "DROP TABLE $tablename" );
+
+        $this->assertEquals( $safe_query, $stripped_query );
+    }
 }