diff --git a/libraries/classes/Controllers/Table/TrackingController.php b/libraries/classes/Controllers/Table/TrackingController.php index 06d574d4b9..db5dbdc2ad 100644 --- a/libraries/classes/Controllers/Table/TrackingController.php +++ b/libraries/classes/Controllers/Table/TrackingController.php @@ -4,6 +4,7 @@ declare(strict_types=1); namespace PhpMyAdmin\Controllers\Table; +use DateTimeImmutable; use PhpMyAdmin\Controllers\AbstractController; use PhpMyAdmin\DbTableExists; use PhpMyAdmin\Http\ServerRequest; @@ -14,6 +15,8 @@ use PhpMyAdmin\Tracker; use PhpMyAdmin\Tracking; use PhpMyAdmin\Url; use PhpMyAdmin\Util; +use Throwable; +use Webmozart\Assert\Assert; use function __; use function array_map; @@ -93,8 +96,8 @@ final class TrackingController extends AbstractController $logType = $this->validateLogTypeParam($request->getParsedBodyParam('log_type')); - $dateFrom = ''; - $dateTo = ''; + $dateFrom = null; + $dateTo = null; $users = ''; // Init vars for tracking report @@ -105,16 +108,20 @@ final class TrackingController extends AbstractController $versionParam ); - /** @var string $dateFrom */ - $dateFrom = $request->getParsedBodyParam('date_from', $trackedData['date_from']); - /** @var string $dateTo */ - $dateTo = $request->getParsedBodyParam('date_to', $trackedData['date_to']); + $dateFrom = $this->validateDateTimeParam( + $request->getParsedBodyParam('date_from', $trackedData['date_from']) + ); + $dateTo = $this->validateDateTimeParam($request->getParsedBodyParam('date_to', $trackedData['date_to'])); + /** @var string $users */ $users = $request->getParsedBodyParam('users', '*'); $GLOBALS['filter_users'] = array_map('trim', explode(',', $users)); } + $dateFrom = $dateFrom ?? new DateTimeImmutable(); + $dateTo = $dateTo ?? new DateTimeImmutable(); + // Prepare export if ($reportExport !== null) { $GLOBALS['entries'] = $this->tracking->getEntries( @@ -272,4 +279,18 @@ final class TrackingController extends AbstractController { return in_array($param, ['schema', 'data'], true) ? $param : 'schema_and_data'; } + + /** + * @param mixed $param + */ + private function validateDateTimeParam($param): DateTimeImmutable + { + try { + Assert::stringNotEmpty($param); + + return new DateTimeImmutable($param); + } catch (Throwable $exception) { + return new DateTimeImmutable(); + } + } } diff --git a/libraries/classes/Tracking.php b/libraries/classes/Tracking.php index 9dcbb96669..3507cefa9f 100644 --- a/libraries/classes/Tracking.php +++ b/libraries/classes/Tracking.php @@ -7,6 +7,7 @@ declare(strict_types=1); namespace PhpMyAdmin; +use DateTimeImmutable; use PhpMyAdmin\ConfigStorage\Relation; use PhpMyAdmin\Dbal\ResultInterface; use PhpMyAdmin\Html\Generator; @@ -68,18 +69,20 @@ class Tracking * * @return array filtered entries */ - public function filter(array $data, array $filter_users, string $dateFrom, string $dateTo): array - { - $dateFromTimestamp = strtotime($dateFrom); - $dateToTimestamp = strtotime($dateTo); + public function filter( + array $data, + array $filter_users, + DateTimeImmutable $dateFrom, + DateTimeImmutable $dateTo + ): array { $tmp_entries = []; $id = 0; foreach ($data as $entry) { $timestamp = strtotime($entry['date']); $filtered_user = in_array($entry['username'], $filter_users); if ( - $timestamp >= $dateFromTimestamp - && $timestamp <= $dateToTimestamp + $timestamp >= $dateFrom->getTimestamp() + && $timestamp <= $dateTo->getTimestamp() && (in_array('*', $filter_users) || $filtered_user) ) { $tmp_entries[] = [ @@ -218,8 +221,8 @@ class Tracking string $logType, array $filter_users, string $version, - string $dateFrom, - string $dateTo, + DateTimeImmutable $dateFrom, + DateTimeImmutable $dateTo, string $users ) { $html = '

' . __('Tracking report') @@ -300,8 +303,8 @@ class Tracking */ public function getHtmlForElementsOfTrackingReport( string $logType, - string $dateFrom, - string $dateTo, + DateTimeImmutable $dateFrom, + DateTimeImmutable $dateTo, string $users ): array { $str1 = ''; $str2 = ''; + . htmlspecialchars($dateFrom->format('Y-m-d H:i:s')) . '" size="19">'; $str3 = ''; + . htmlspecialchars($dateTo->format('Y-m-d H:i:s')) . '" size="19">'; $str4 = ''; $str5 = '' @@ -361,8 +364,8 @@ class Tracking $str5, $drop_image_or_text, string $version, - string $dateFrom, - string $dateTo + DateTimeImmutable $dateFrom, + DateTimeImmutable $dateTo ) { $ddlog_count = 0; @@ -436,8 +439,8 @@ class Tracking $str5, string $logType, string $version, - string $dateFrom, - string $dateTo, + DateTimeImmutable $dateFrom, + DateTimeImmutable $dateTo, string $users ) { $html = '
'; @@ -461,8 +464,8 @@ class Tracking 'report' => 'true', 'version' => $version, 'log_type' => $logType, - 'date_from' => $dateFrom, - 'date_to' => $dateTo, + 'date_from' => $dateFrom->format('Y-m-d H:i:s'), + 'date_to' => $dateTo->format('Y-m-d H:i:s'), 'users' => $users, 'report_export' => 'true', ]); @@ -504,8 +507,8 @@ class Tracking $ddlog_count, $drop_image_or_text, string $version, - string $dateFrom, - string $dateTo + DateTimeImmutable $dateFrom, + DateTimeImmutable $dateTo ) { // no need for the second returned parameter [$html] = $this->getHtmlForDataStatements( @@ -541,8 +544,8 @@ class Tracking array $url_params, $drop_image_or_text, string $version, - string $dateFrom, - string $dateTo + DateTimeImmutable $dateFrom, + DateTimeImmutable $dateTo ) { [$html, $line_number] = $this->getHtmlForDataStatements( $data, @@ -588,18 +591,16 @@ class Tracking $lineNumber, $tableId, string $version, - string $dateFrom, - string $dateTo + DateTimeImmutable $dateFrom, + DateTimeImmutable $dateTo ) { - $dateFromTimestamp = strtotime($dateFrom); - $dateToTimestamp = strtotime($dateTo); $offset = $lineNumber; $entries = []; foreach ($data[$whichLog] as $entry) { $timestamp = strtotime($entry['date']); if ( - $timestamp >= $dateFromTimestamp - && $timestamp <= $dateToTimestamp + $timestamp >= $dateFrom->getTimestamp() + && $timestamp <= $dateTo->getTimestamp() && (in_array('*', $filterUsers) || in_array($entry['username'], $filterUsers)) ) { @@ -1062,8 +1063,13 @@ class Tracking * * @return array */ - public function getEntries(array $data, array $filter_users, string $logType, string $dateFrom, string $dateTo) - { + public function getEntries( + array $data, + array $filter_users, + string $logType, + DateTimeImmutable $dateFrom, + DateTimeImmutable $dateTo + ) { $entries = []; // Filtering data definition statements if ($logType === 'schema' || $logType === 'schema_and_data') { diff --git a/test/classes/TrackingTest.php b/test/classes/TrackingTest.php index ab350834ec..3238241344 100644 --- a/test/classes/TrackingTest.php +++ b/test/classes/TrackingTest.php @@ -4,6 +4,7 @@ declare(strict_types=1); namespace PhpMyAdmin\Tests; +use DateTimeImmutable; use PhpMyAdmin\ConfigStorage\Relation; use PhpMyAdmin\ConfigStorage\RelationParameters; use PhpMyAdmin\SqlQueryForm; @@ -77,7 +78,12 @@ class TrackingTest extends AbstractTestCase ]; $filter_users = ['username1']; - $ret = $this->tracking->filter($data, $filter_users, '2010-01-01 12:34:56', '2020-01-01 12:34:56'); + $ret = $this->tracking->filter( + $data, + $filter_users, + new DateTimeImmutable('2010-01-01 12:34:56'), + new DateTimeImmutable('2020-01-01 12:34:56') + ); $this->assertEquals('username1', $ret[0]['username']); $this->assertEquals('statement1', $ret[0]['statement']); @@ -280,8 +286,8 @@ class TrackingTest extends AbstractTestCase 'schema_and_data', $filter_users, '10', - '2022-11-03 22:15:24', - '2022-11-04 22:15:24', + new DateTimeImmutable('2022-11-03 22:15:24'), + new DateTimeImmutable('2022-11-04 22:15:24'), 'users' ); @@ -354,8 +360,8 @@ class TrackingTest extends AbstractTestCase $ddlog_count, $drop_image_or_text, '10', - '2010-01-01 12:34:56', - '2020-01-01 12:34:56' + new DateTimeImmutable('2010-01-01 12:34:56'), + new DateTimeImmutable('2020-01-01 12:34:56') ); $this->assertStringContainsString( @@ -404,8 +410,8 @@ class TrackingTest extends AbstractTestCase $url_params, $drop_image_or_text, '10', - '2010-01-01 12:34:56', - '2020-01-01 12:34:56' + new DateTimeImmutable('2010-01-01 12:34:56'), + new DateTimeImmutable('2020-01-01 12:34:56') ); $this->assertStringContainsString( @@ -572,8 +578,8 @@ class TrackingTest extends AbstractTestCase $data, $filter_users, 'schema', - '2010-01-01 12:34:56', - '2020-01-01 12:34:56' + new DateTimeImmutable('2010-01-01 12:34:56'), + new DateTimeImmutable('2020-01-01 12:34:56') ); $this->assertEquals('username3', $entries[0]['username']); $this->assertEquals('statement1', $entries[0]['statement']);