← All changes | classes/Visualizer/Source/Query.php +37 -1 3.10.11 → 3.10.15 View file →

		@@ -79,9 +79,45 @@
79	79	return false;
80	80	}
81	81
82	82	// only select queries allowed.
83		- if ( preg_match( '/^\s*(insert|delete|update|replace|create|alter|drop|truncate)\s/i', $this->_query ) ) {
	83	+ if ( ! preg_match( '/\s*(\bselect\b)\s/i', $this->_query ) ) {
	84	+ $this->_error = __( 'Only SELECT queries are allowed', 'visualizer' );
	85	+ return false;
	86	+ }
	87	+
	88	+ // if previous check passed, check for disallowed query parts to prevent subqueries and other harmful queries.
	89	+ $disallow_query_parts = array(
	90	+ 'INSERT',
	91	+ 'UPDATE',
	92	+ 'DELETE',
	93	+ 'RENAME',
	94	+ 'DROP',
	95	+ 'CREATE',
	96	+ 'TRUNCATE',
	97	+ 'ALTER',
	98	+ 'COMMIT',
	99	+ 'ROLLBACK',
	100	+ 'MERGE',
	101	+ 'CALL',
	102	+ 'EXPLAIN',
	103	+ 'LOCK',
	104	+ 'GRANT',
	105	+ 'REVOKE',
	106	+ 'SAVEPOINT',
	107	+ 'TRANSACTION',
	108	+ 'SET',
	109	+ );
	110	+ $disallow_regex = implode(
	111	+ '|',
	112	+ array_map(
	113	+ function ( $value ) {
	114	+ return '\b' . $value . '\b';
	115	+ }, $disallow_query_parts
	116	+ )
	117	+ );
	118	+
	119	+ if ( preg_match( '/(' . $disallow_regex . ')/i', $this->_query) !== 0 ) {
84	120	$this->_error = __( 'Only SELECT queries are allowed', 'visualizer' );
85	121	return false;
86	122	}
87	123