From 288efea5b42b1514ada0f22c84049067281b3eca Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Fri, 17 Jun 2016 15:38:48 +0200 Subject: [PATCH] Simplify and cleanup transformation plugins MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Remove PMA_transformation_global_html_replace which makes the code only more confusing. Also add escaping to browse transformations. Signed-off-by: Michal Čihař --- .../AppendTransformationsPlugin.class.php | 4 +- .../DateFormatTransformationsPlugin.class.php | 11 +++--- .../DownloadTransformationsPlugin.class.php | 4 +- .../ImageLinkTransformationsPlugin.class.php | 12 +----- .../InlineTransformationsPlugin.class.php | 30 +++++---------- .../LongToIPv4TransformationsPlugin.class.php | 4 +- .../SubstringTransformationsPlugin.class.php | 4 +- ...xtImageLinkTransformationsPlugin.class.php | 23 +++-------- .../TextLinkTransformationsPlugin.class.php | 26 ++++--------- libraries/transformations.lib.php | 38 ------------------- 10 files changed, 40 insertions(+), 116 deletions(-) diff --git a/libraries/plugins/transformations/abstract/AppendTransformationsPlugin.class.php b/libraries/plugins/transformations/abstract/AppendTransformationsPlugin.class.php index 0fc3b4de77..caca999168 100644 --- a/libraries/plugins/transformations/abstract/AppendTransformationsPlugin.class.php +++ b/libraries/plugins/transformations/abstract/AppendTransformationsPlugin.class.php @@ -49,7 +49,7 @@ abstract class AppendTransformationsPlugin extends TransformationsPlugin $options[0] = ''; } //just append the option to the original text - $newtext = $buffer . htmlspecialchars($options[0]); + $newtext = htmlspecialchars($buffer) . htmlspecialchars($options[0]); return $newtext; } @@ -83,4 +83,4 @@ abstract class AppendTransformationsPlugin extends TransformationsPlugin return "Append"; } } -?> \ No newline at end of file +?> diff --git a/libraries/plugins/transformations/abstract/DateFormatTransformationsPlugin.class.php b/libraries/plugins/transformations/abstract/DateFormatTransformationsPlugin.class.php index 530379f10d..c2cbecba4d 100644 --- a/libraries/plugins/transformations/abstract/DateFormatTransformationsPlugin.class.php +++ b/libraries/plugins/transformations/abstract/DateFormatTransformationsPlugin.class.php @@ -12,6 +12,7 @@ if (! defined('PHPMYADMIN')) { /* Get the transformations interface */ require_once 'libraries/plugins/TransformationsPlugin.class.php'; +require_once 'libraries/js_escape.lib.php'; /** * Provides common methods for all of the date format transformations plugins. @@ -139,11 +140,11 @@ abstract class DateFormatTransformationsPlugin extends TransformationsPlugin } else { $text = 'INVALID DATE TYPE'; } - $buffer = '' . $text . ''; + return '' . htmlspecialchars($text) . ''; + } else { + return htmlspecialchars($buffer); } - - return $buffer; } /** @@ -175,4 +176,4 @@ abstract class DateFormatTransformationsPlugin extends TransformationsPlugin return "Date Format"; } } -?> \ No newline at end of file +?> diff --git a/libraries/plugins/transformations/abstract/DownloadTransformationsPlugin.class.php b/libraries/plugins/transformations/abstract/DownloadTransformationsPlugin.class.php index 82eda40f72..e375c4ab77 100644 --- a/libraries/plugins/transformations/abstract/DownloadTransformationsPlugin.class.php +++ b/libraries/plugins/transformations/abstract/DownloadTransformationsPlugin.class.php @@ -72,7 +72,7 @@ abstract class DownloadTransformationsPlugin extends TransformationsPlugin '%s', $options['wrapper_link'], - urlencode($cn), + htmlspecialchars(urlencode($cn)), htmlspecialchars($cn), htmlspecialchars($cn) ); @@ -107,4 +107,4 @@ abstract class DownloadTransformationsPlugin extends TransformationsPlugin return "Download"; } } -?> \ No newline at end of file +?> diff --git a/libraries/plugins/transformations/abstract/ImageLinkTransformationsPlugin.class.php b/libraries/plugins/transformations/abstract/ImageLinkTransformationsPlugin.class.php index 456f102bd1..f31fed6d12 100644 --- a/libraries/plugins/transformations/abstract/ImageLinkTransformationsPlugin.class.php +++ b/libraries/plugins/transformations/abstract/ImageLinkTransformationsPlugin.class.php @@ -45,16 +45,8 @@ abstract class ImageLinkTransformationsPlugin extends TransformationsPlugin */ public function applyTransformation($buffer, $options = array(), $meta = '') { - $transform_options = array ( - 'string' => '[BLOB]' - ); - $buffer = PMA_transformation_global_html_replace( - $buffer, - $transform_options - ); - - return $buffer; + return '[BLOB]'; } /** diff --git a/libraries/plugins/transformations/abstract/InlineTransformationsPlugin.class.php b/libraries/plugins/transformations/abstract/InlineTransformationsPlugin.class.php index b1ef0ae457..33603a66ff 100644 --- a/libraries/plugins/transformations/abstract/InlineTransformationsPlugin.class.php +++ b/libraries/plugins/transformations/abstract/InlineTransformationsPlugin.class.php @@ -47,28 +47,18 @@ abstract class InlineTransformationsPlugin extends TransformationsPlugin public function applyTransformation($buffer, $options = array(), $meta = '') { if (PMA_IS_GD2) { - $transform_options = array ( - 'string' => '[__BUFFER__]' - ); - } else { - $transform_options = array ( - 'string' => '[__BUFFER__]' - ); + . '" target="_blank">' . htmlspecialchars($buffer) . ''; + } else { + return '' . htmlspecialchars($buffer) . ''; } - $buffer = PMA_transformation_global_html_replace( - $buffer, - $transform_options - ); - - return $buffer; } /** diff --git a/libraries/plugins/transformations/abstract/LongToIPv4TransformationsPlugin.class.php b/libraries/plugins/transformations/abstract/LongToIPv4TransformationsPlugin.class.php index 58dda957e8..40775642d1 100644 --- a/libraries/plugins/transformations/abstract/LongToIPv4TransformationsPlugin.class.php +++ b/libraries/plugins/transformations/abstract/LongToIPv4TransformationsPlugin.class.php @@ -45,7 +45,7 @@ abstract class LongToIPv4TransformationsPlugin extends TransformationsPlugin public function applyTransformation($buffer, $options = array(), $meta = '') { if ($buffer < 0 || $buffer > 4294967295) { - return $buffer; + return htmlspecialchars($buffer); } return long2ip($buffer); @@ -80,4 +80,4 @@ abstract class LongToIPv4TransformationsPlugin extends TransformationsPlugin return "Long To IPv4"; } } -?> \ No newline at end of file +?> diff --git a/libraries/plugins/transformations/abstract/SubstringTransformationsPlugin.class.php b/libraries/plugins/transformations/abstract/SubstringTransformationsPlugin.class.php index 2de48e6bb0..b246e36bf0 100644 --- a/libraries/plugins/transformations/abstract/SubstringTransformationsPlugin.class.php +++ b/libraries/plugins/transformations/abstract/SubstringTransformationsPlugin.class.php @@ -81,7 +81,7 @@ abstract class SubstringTransformationsPlugin extends TransformationsPlugin } } - return $newtext; + return htmlspecialchars($newtext); } /** @@ -113,4 +113,4 @@ abstract class SubstringTransformationsPlugin extends TransformationsPlugin return "Substring"; } } -?> \ No newline at end of file +?> diff --git a/libraries/plugins/transformations/abstract/TextImageLinkTransformationsPlugin.class.php b/libraries/plugins/transformations/abstract/TextImageLinkTransformationsPlugin.class.php index 054b2f9b8d..7524b8cd58 100644 --- a/libraries/plugins/transformations/abstract/TextImageLinkTransformationsPlugin.class.php +++ b/libraries/plugins/transformations/abstract/TextImageLinkTransformationsPlugin.class.php @@ -12,8 +12,6 @@ if (! defined('PHPMYADMIN')) { /* Get the transformations interface */ require_once 'libraries/plugins/TransformationsPlugin.class.php'; -/* For PMA_transformation_global_html_replace */ -require_once 'libraries/transformations.lib.php'; /** * Provides common methods for all of the image link transformations plugins. @@ -47,21 +45,12 @@ abstract class TextImageLinkTransformationsPlugin extends TransformationsPlugin */ public function applyTransformation($buffer, $options = array(), $meta = '') { - $transform_options = array ( - 'string' => '' - . $buffer . '' - ); - - $buffer = PMA_transformation_global_html_replace( - $buffer, - $transform_options - ); - - return $buffer; + return '' + . htmlspecialchars($buffer) . ''; } /** diff --git a/libraries/plugins/transformations/abstract/TextLinkTransformationsPlugin.class.php b/libraries/plugins/transformations/abstract/TextLinkTransformationsPlugin.class.php index f61e9a9282..b015dadd1b 100644 --- a/libraries/plugins/transformations/abstract/TextLinkTransformationsPlugin.class.php +++ b/libraries/plugins/transformations/abstract/TextLinkTransformationsPlugin.class.php @@ -12,8 +12,6 @@ if (! defined('PHPMYADMIN')) { /* Get the transformations interface */ require_once 'libraries/plugins/TransformationsPlugin.class.php'; -/* For PMA_transformation_global_html_replace */ -require_once 'libraries/transformations.lib.php'; /** * Provides common methods for all of the link transformations plugins. @@ -50,22 +48,14 @@ abstract class TextLinkTransformationsPlugin extends TransformationsPlugin $append_part = (isset($options[2]) && $options[2]) ? '' : $buffer; - $transform_options = array ( - 'string' => '' - . htmlspecialchars(isset($options[1]) ? $options[1] : $buffer) - . '' - ); - - $buffer = PMA_transformation_global_html_replace( - $buffer, - $transform_options - ); - - return $buffer; + return '' + . htmlspecialchars(isset($options[1]) ? $options[1] : $buffer) + . ''; } /** diff --git a/libraries/transformations.lib.php b/libraries/transformations.lib.php index c653a9ae32..8723282489 100644 --- a/libraries/transformations.lib.php +++ b/libraries/transformations.lib.php @@ -329,44 +329,6 @@ function PMA_setMIME($db, $table, $key, $mimetype, $transformation, * GLOBAL Plugin functions */ - -/** - * Replaces "[__BUFFER__]" occurences found in $options['string'] with the text - * in $buffer, after performing a regular expression search and replace on - * $buffer using $options['regex'] and $options['regex_replace']. - * - * @param string $buffer text that will be replaced in $options['string'], - * after being formatted - * @param array $options the options required to format $buffer - * = array ( - * 'string' => 'string', // text containing "[__BUFFER__]" - * 'regex' => 'mixed', // the pattern to search for - * 'regex_replace' => 'mixed', // string or array of strings to replace - * // with - * ); - * - * @return string containing the text with all the replacements - */ -function PMA_transformation_global_html_replace($buffer, $options = array()) -{ - if ( ! isset($options['string']) ) { - $options['string'] = ''; - } - - if (isset($options['regex']) && isset($options['regex_replace'])) { - $buffer = preg_replace( - '@' . str_replace('@', '\@', $options['regex']) . '@si', - $options['regex_replace'], - $buffer - ); - } - - // Replace occurences of [__BUFFER__] with actual text - $return = str_replace("[__BUFFER__]", $buffer, $options['string']); - return $return; -} - - /** * Delete related transformation details * after deleting database. table or column