Simplify and cleanup transformation plugins

Remove PMA_transformation_global_html_replace which makes the code only more confusing. Also add escaping to browse transformations. Signed-off-by: Michal Čihař <michal@cihar.com>
2016-06-17 15:38:48 +02:00 · 2016-06-17 15:38:48 +02:00 · 288efea5b4
commit 288efea5b4
parent f662d591c5
10 changed files with 40 additions and 116 deletions
--- a/libraries/plugins/transformations/abstract/AppendTransformationsPlugin.class.php
+++ b/libraries/plugins/transformations/abstract/AppendTransformationsPlugin.class.php
@ -49,7 +49,7 @@ abstract class AppendTransformationsPlugin extends TransformationsPlugin
            $options[0] = '';
        }
        //just append the option to the original text
-        $newtext = $buffer . htmlspecialchars($options[0]);
+        $newtext = htmlspecialchars($buffer) . htmlspecialchars($options[0]);

        return $newtext;
    }
@ -83,4 +83,4 @@ abstract class AppendTransformationsPlugin extends TransformationsPlugin
        return "Append";
    }
 }
-?>
+?>
--- a/libraries/plugins/transformations/abstract/DateFormatTransformationsPlugin.class.php
+++ b/libraries/plugins/transformations/abstract/DateFormatTransformationsPlugin.class.php
@ -12,6 +12,7 @@ if (! defined('PHPMYADMIN')) {

 /* Get the transformations interface */
 require_once 'libraries/plugins/TransformationsPlugin.class.php';
+require_once 'libraries/js_escape.lib.php';

 /**
 * Provides common methods for all of the date format transformations plugins.
@ -139,11 +140,11 @@ abstract class DateFormatTransformationsPlugin extends TransformationsPlugin
            } else {
                $text = 'INVALID DATE TYPE';
            }
-            $buffer = '<dfn onclick="alert(\'' . $source . '\');" title="'
-                . $source . '">' . $text . '</dfn>';
+            return '<dfn onclick="alert(\'' . PMA_jsFormat($source, false) . '\');" title="'
+                . htmlspecialchars($source) . '">' . htmlspecialchars($text) . '</dfn>';
+        } else {
+            return htmlspecialchars($buffer);
        }
-
-        return $buffer;
    }

    /**
@ -175,4 +176,4 @@ abstract class DateFormatTransformationsPlugin extends TransformationsPlugin
        return "Date Format";
    }
 }
-?>
+?>
--- a/libraries/plugins/transformations/abstract/DownloadTransformationsPlugin.class.php
+++ b/libraries/plugins/transformations/abstract/DownloadTransformationsPlugin.class.php
@ -72,7 +72,7 @@ abstract class DownloadTransformationsPlugin extends TransformationsPlugin
            '<a href="transformation_wrapper.php%s&amp;ct=application'
            . '/octet-stream&amp;cn=%s" title="%s">%s</a>',
            $options['wrapper_link'],
-            urlencode($cn),
+            htmlspecialchars(urlencode($cn)),
            htmlspecialchars($cn),
            htmlspecialchars($cn)
        );
@ -107,4 +107,4 @@ abstract class DownloadTransformationsPlugin extends TransformationsPlugin
        return "Download";
    }
 }
-?>
+?>
--- a/libraries/plugins/transformations/abstract/ImageLinkTransformationsPlugin.class.php
+++ b/libraries/plugins/transformations/abstract/ImageLinkTransformationsPlugin.class.php
@ -45,16 +45,8 @@ abstract class ImageLinkTransformationsPlugin extends TransformationsPlugin
     */
    public function applyTransformation($buffer, $options = array(), $meta = '')
    {
-        $transform_options = array (
-            'string' => '<a href="transformation_wrapper.php'
-                . $options['wrapper_link'] . '" alt="[__BUFFER__]">[BLOB]</a>'
-        );
-        $buffer = PMA_transformation_global_html_replace(
-            $buffer,
-            $transform_options
-        );
-
-        return $buffer;
+        return '<a href="transformation_wrapper.php'
+            . $options['wrapper_link'] . '" alt="' . htmlspecialchars($buffer) . '">[BLOB]</a>';
    }

    /**
--- a/libraries/plugins/transformations/abstract/InlineTransformationsPlugin.class.php
+++ b/libraries/plugins/transformations/abstract/InlineTransformationsPlugin.class.php
@ -47,28 +47,18 @@ abstract class InlineTransformationsPlugin extends TransformationsPlugin
    public function applyTransformation($buffer, $options = array(), $meta = '')
    {
        if (PMA_IS_GD2) {
-            $transform_options = array (
-                'string' => '<a href="transformation_wrapper.php'
-                    . $options['wrapper_link']
-                    . '" target="_blank"><img src="transformation_wrapper.php'
-                    . $options['wrapper_link'] . '&amp;resize=jpeg&amp;newWidth='
-                    . (isset($options[0]) ? $options[0] : '100') . '&amp;newHeight='
-                    . (isset($options[1]) ? $options[1] : 100)
-                    . '" alt="[__BUFFER__]" border="0" /></a>'
-            );
-        } else {
-            $transform_options = array (
-                'string' => '<img src="transformation_wrapper.php'
+            return '<a href="transformation_wrapper.php'
                . $options['wrapper_link']
-                . '" alt="[__BUFFER__]" width="320" height="240" />'
-            );
+                . '" target="_blank"><img src="transformation_wrapper.php'
+                . $options['wrapper_link'] . '&amp;resize=jpeg&amp;newWidth='
+                . (isset($options[0]) ? $options[0] : '100') . '&amp;newHeight='
+                . (isset($options[1]) ? $options[1] : 100)
+                . '" alt="' . htmlspecialchars($buffer) . '" border="0" /></a>';
+        } else {
+            return '<img src="transformation_wrapper.php'
+                . $options['wrapper_link']
+                . '" alt="' . htmlspecialchars($buffer) . '" width="320" height="240" />';
        }
-        $buffer = PMA_transformation_global_html_replace(
-            $buffer,
-            $transform_options
-        );
-
-        return $buffer;
    }

    /**
--- a/libraries/plugins/transformations/abstract/LongToIPv4TransformationsPlugin.class.php
+++ b/libraries/plugins/transformations/abstract/LongToIPv4TransformationsPlugin.class.php
@ -45,7 +45,7 @@ abstract class LongToIPv4TransformationsPlugin extends TransformationsPlugin
    public function applyTransformation($buffer, $options = array(), $meta = '')
    {
        if ($buffer < 0 || $buffer > 4294967295) {
-            return $buffer;
+            return htmlspecialchars($buffer);
        }

        return long2ip($buffer);
@ -80,4 +80,4 @@ abstract class LongToIPv4TransformationsPlugin extends TransformationsPlugin
        return "Long To IPv4";
    }
 }
-?>
+?>
--- a/libraries/plugins/transformations/abstract/SubstringTransformationsPlugin.class.php
+++ b/libraries/plugins/transformations/abstract/SubstringTransformationsPlugin.class.php
@ -81,7 +81,7 @@ abstract class SubstringTransformationsPlugin extends TransformationsPlugin
            }
        }

-        return $newtext;
+        return htmlspecialchars($newtext);
    }

    /**
@ -113,4 +113,4 @@ abstract class SubstringTransformationsPlugin extends TransformationsPlugin
        return "Substring";
    }
 }
-?>
+?>
--- a/libraries/plugins/transformations/abstract/TextImageLinkTransformationsPlugin.class.php
+++ b/libraries/plugins/transformations/abstract/TextImageLinkTransformationsPlugin.class.php
@ -12,8 +12,6 @@ if (! defined('PHPMYADMIN')) {

 /* Get the transformations interface */
 require_once 'libraries/plugins/TransformationsPlugin.class.php';
-/* For PMA_transformation_global_html_replace */
-require_once 'libraries/transformations.lib.php';

 /**
 * Provides common methods for all of the image link transformations plugins.
@ -47,21 +45,12 @@ abstract class TextImageLinkTransformationsPlugin extends TransformationsPlugin
     */
    public function applyTransformation($buffer, $options = array(), $meta = '')
    {
-        $transform_options = array (
-            'string' => '<a href="' . (isset($options[0]) ? $options[0] : '')
-                . $buffer . '" target="_blank"><img src="'
-                . (isset($options[0]) ? $options[0] : '') . $buffer
-                . '" border="0" width="' . (isset($options[1]) ? $options[1] : 100)
-                . '" height="' . (isset($options[2]) ? $options[2] : 50) . '" />'
-                . $buffer . '</a>'
-        );
-
-        $buffer = PMA_transformation_global_html_replace(
-            $buffer,
-            $transform_options
-        );
-
-        return $buffer;
+        return '<a href="' . htmlspecialchars(isset($options[0]) ? $options[0] : '')
+            . htmlspecialchars($buffer) . '" target="_blank"><img src="'
+            . htmlspecialchars(isset($options[0]) ? $options[0] : '') . htmlspecialchars($buffer)
+            . '" border="0" width="' . (isset($options[1]) ? $options[1] : 100)
+            . '" height="' . (isset($options[2]) ? $options[2] : 50) . '" />'
+            . htmlspecialchars($buffer) . '</a>';
    }

    /**
--- a/libraries/plugins/transformations/abstract/TextLinkTransformationsPlugin.class.php
+++ b/libraries/plugins/transformations/abstract/TextLinkTransformationsPlugin.class.php
@ -12,8 +12,6 @@ if (! defined('PHPMYADMIN')) {

 /* Get the transformations interface */
 require_once 'libraries/plugins/TransformationsPlugin.class.php';
-/* For PMA_transformation_global_html_replace */
-require_once 'libraries/transformations.lib.php';

 /**
 * Provides common methods for all of the link transformations plugins.
@ -50,22 +48,14 @@ abstract class TextLinkTransformationsPlugin extends TransformationsPlugin

        $append_part = (isset($options[2]) && $options[2]) ? '' : $buffer;

-        $transform_options = array (
-            'string' => '<a href="'
-                . PMA_linkURL((isset($options[0]) ? $options[0] : '') . $append_part)
-                . '" title="'
-                . htmlspecialchars(isset($options[1]) ? $options[1] : '')
-                . '" target="_new">'
-                . htmlspecialchars(isset($options[1]) ? $options[1] : $buffer)
-                . '</a>'
-        );
-
-        $buffer = PMA_transformation_global_html_replace(
-            $buffer,
-            $transform_options
-        );
-
-        return $buffer;
+        return '<a href="'
+            . PMA_linkURL(htmlspecialchars(isset($options[0]) ? $options[0] : '')
+            . htmlspecialchars($append_part))
+            . '" title="'
+            . htmlspecialchars(isset($options[1]) ? $options[1] : '')
+            . '" target="_new">'
+            . htmlspecialchars(isset($options[1]) ? $options[1] : $buffer)
+            . '</a>';
    }

    /**
--- a/libraries/transformations.lib.php
+++ b/libraries/transformations.lib.php
@ -329,44 +329,6 @@ function PMA_setMIME($db, $table, $key, $mimetype, $transformation,
 * GLOBAL Plugin functions
 */

-
-/**
- * Replaces "[__BUFFER__]" occurences found in $options['string'] with the text
- * in $buffer, after performing a regular expression search and replace on
- * $buffer using $options['regex'] and $options['regex_replace'].
- *
- * @param string $buffer  text that will be replaced in $options['string'],
- *                        after being formatted
- * @param array  $options the options required to format $buffer
- *     = array (
- *         'string'        => 'string', // text containing "[__BUFFER__]"
- *         'regex'         => 'mixed',  // the pattern to search for
- *         'regex_replace' => 'mixed',  // string or array of strings to replace
- *                                      // with
- *     );
- *
- * @return string containing the text with all the replacements
- */
-function PMA_transformation_global_html_replace($buffer, $options = array())
-{
-    if ( ! isset($options['string']) ) {
-        $options['string'] = '';
-    }
-
-    if (isset($options['regex']) && isset($options['regex_replace'])) {
-        $buffer = preg_replace(
-            '@' . str_replace('@', '\@', $options['regex']) . '@si',
-            $options['regex_replace'],
-            $buffer
-        );
-    }
-
-    // Replace occurences of [__BUFFER__] with actual text
-    $return = str_replace("[__BUFFER__]", $buffer, $options['string']);
-    return $return;
-}
-
-
 /**
 * Delete related transformation details
 * after deleting database. table or column