From ca9293b3ee13390349521c83e9bb175d4c95009a Mon Sep 17 00:00:00 2001
From: Steven Wittens <steven@10.no-reply.drupal.org>
Date: Thu, 27 Apr 2006 20:38:49 +0000
Subject: [PATCH] #54981: calls to db_lock_table in bootstrap.inc do not use
db_prefix
---
includes/database.inc | 9 +++++++++
includes/database.mysql.inc | 2 +-
includes/database.mysqli.inc | 2 +-
includes/database.pgsql.inc | 2 +-
4 files changed, 12 insertions(+), 3 deletions(-)
diff --git a/includes/database.inc b/includes/database.inc
index 548e310e528d..987adbc28979 100644
--- a/includes/database.inc
+++ b/includes/database.inc
@@ -315,6 +315,15 @@ function db_rewrite_sql($query, $primary_table = 'n', $primary_field = 'nid', $
return $query;
}
+/**
+ * Restrict a dynamic tablename to safe characters.
+ *
+ * Only keeps alphanumeric and underscores.
+ */
+function db_escape_table($string) {
+ return preg_replace('/[^A-Za-z0-9_]+/', '', $string);
+}
+
/**
* @} End of "defgroup database".
*/
diff --git a/includes/database.mysql.inc b/includes/database.mysql.inc
index 03e9eb21dc3c..037106b0a8d8 100644
--- a/includes/database.mysql.inc
+++ b/includes/database.mysql.inc
@@ -353,7 +353,7 @@ function db_escape_string($text) {
* Lock a table.
*/
function db_lock_table($table) {
- db_query('LOCK TABLES {%s} WRITE', $table);
+ db_query('LOCK TABLES {'. db_escape_table($table) .'} WRITE');
}
/**
diff --git a/includes/database.mysqli.inc b/includes/database.mysqli.inc
index 9d5cf71d1df7..97a4daf2ae1f 100644
--- a/includes/database.mysqli.inc
+++ b/includes/database.mysqli.inc
@@ -355,7 +355,7 @@ function db_escape_string($text) {
* Lock a table.
*/
function db_lock_table($table) {
- db_query('LOCK TABLES {%s} WRITE', $table);
+ db_query('LOCK TABLES {'. db_escape_table($table) .'} WRITE');
}
/**
diff --git a/includes/database.pgsql.inc b/includes/database.pgsql.inc
index 007d825a0694..dc8d081db69b 100644
--- a/includes/database.pgsql.inc
+++ b/includes/database.pgsql.inc
@@ -331,7 +331,7 @@ function db_escape_string($text) {
* This function automatically starts a transaction.
*/
function db_lock_table($table) {
- db_query('BEGIN; LOCK TABLE {%s} IN EXCLUSIVE MODE', $table);
+ db_query('BEGIN; LOCK TABLE {'. db_escape_table($table) .'} IN EXCLUSIVE MODE');
}
/**
--
GitLab