Author: frederic.virot

Description:

When selecting 'my watchlist', the following message is shown:

A database query syntax error has occurred. This may indicate a bug in the
software. The last attempted database query was:

(SQL query hidden)

from within function "wfSpecialWatchlist". MySQL returned error "1146: Table

'wikimedia.watchlist' doesn't exist (localhost)".

The problem is in the function wfSpecialWatchlist, in file SpecialWatchlist.php,
around line 165, in the following query:

		$sql = "SELECT 
			rc_namespace cur_namespace, rc_title cur_title, rc_comment cur_comment, 
			rc_cur_id cur_id, rc_user cur_user, 
			rc_user_text cur_user_text, rc_timestamp cur_timestamp, 
			rc_minor cur_minor_edit, rc_new cur_is_new

-------> FROM watchlist,recentchanges

			WHERE wl_user=$uid AND wl_namespace=rc_namespace AND wl_title=rc_title AND

rc_this_oldid=0

			$docutoff
		UNION SELECT 
			rc_namespace cur_namespace, rc_title cur_title, rc_comment cur_comment, 
			rc_cur_id cur_id, rc_user cur_user, 
			rc_user_text cur_user_text, rc_timestamp cur_timestamp, 
			rc_minor cur_minor_edit, rc_new cur_is_new

-------> FROM watchlist,recentchanges

			WHERE wl_user=$uid AND wl_namespace+1=rc_namespace AND wl_title=rc_title AND

rc_this_oldid=0

			$docutoff
		ORDER BY cur_timestamp DESC
		";

As may be seen, the names of both the watchlist and the recent changes tables
are hardcoded (see arrows), thus disregarding the table prefix... To fix this,
replace the statements FROM watchlist,recentchanges by FROM
$watchlist,$recentchanges, and everything works fine.

Version: 1.4.x
Severity: major