gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #17429 from mauriciofauth/check-parameters-method

Browse Source 
Move `Util::checkParameters` method to the `AbstractController`
This commit is contained in:
Maurício Meneghini Fauth 2022-03-08 13:28:11 -03:00 committed by GitHub
commit 5954af9ab0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
49 changed files with 188 additions and 154 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
libraries/classes/Controllers/AbstractController.php
View File

@ -5,12 +5,14 @@ declare(strict_types=1);
namespace PhpMyAdmin\Controllers;
use PhpMyAdmin\Core;
use PhpMyAdmin\Html\MySQLDocumentation;
use PhpMyAdmin\Message;
use PhpMyAdmin\ResponseRenderer;
use PhpMyAdmin\Template;
use PhpMyAdmin\Url;
use function __;
use function basename;
use function defined;
use function strlen;
@ -101,4 +103,44 @@ abstract class AbstractController
$uri = './index.php?route=' . $route . Url::getCommonRaw($params, '&');
Core::sendHeaderLocation($uri);
}
/**
* Function added to avoid path disclosures.
* Called by each script that needs parameters, it displays
* an error message and, by default, stops the execution.
*
* @param bool $request Check parameters in request
* @psalm-param non-empty-list<non-empty-string> $params The names of the parameters needed by the calling script
*/
protected function checkParameters(array $params, bool $request = false): void
{
$reportedScriptName = basename($GLOBALS['PMA_PHP_SELF']);
$foundError = false;
$errorMessage = '';
if ($request) {
$array = $_REQUEST;
} else {
$array = $GLOBALS;
}
foreach ($params as $param) {
if (isset($array[$param]) && $array[$param] !== '') {
continue;
}
$errorMessage .= $reportedScriptName
. ': ' . __('Missing parameter:') . ' '
. $param
. MySQLDocumentation::showDocumentation('faq', 'faqmissingparameters', true)
. '[br]';
$foundError = true;
}
if (! $foundError) {
return;
}
$this->response->setHttpResponseCode(400);
Core::fatalError($errorMessage);
}
}

2
libraries/classes/Controllers/Database/DataDictionaryController.php
View File

@ -42,7 +42,7 @@ class DataDictionaryController extends AbstractController
public function __invoke(): void
{
Util::checkParameters(['db'], true);
$this->checkParameters(['db'], true);
$relationParameters = $this->relation->getRelationParameters();

2
libraries/classes/Controllers/Database/DesignerController.php
View File

@ -140,7 +140,7 @@ class DesignerController extends AbstractController
return;
}
Util::checkParameters(['db']);
$this->checkParameters(['db']);
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabDatabase'], 'database');
$GLOBALS['errorUrl'] .= Url::getCommon(['db' => $GLOBALS['db']], '&');

2
libraries/classes/Controllers/Database/EventsController.php
View File

@ -38,7 +38,7 @@ final class EventsController extends AbstractController
$this->addScriptFiles(['database/events.js']);
if (! $this->response->isAjax()) {
Util::checkParameters(['db']);
$this->checkParameters(['db']);
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabDatabase'], 'database');
$GLOBALS['errorUrl'] .= Url::getCommon(['db' => $GLOBALS['db']], '&');

2
libraries/classes/Controllers/Database/ExportController.php
View File

@ -50,7 +50,7 @@ final class ExportController extends AbstractController
// /database/export, in which case we don't obey $cfg['MaxTableList']
$GLOBALS['sub_part'] = '_export';
Util::checkParameters(['db']);
$this->checkParameters(['db']);
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabDatabase'], 'database');
$GLOBALS['errorUrl'] .= Url::getCommon(['db' => $GLOBALS['db']], '&');

2
libraries/classes/Controllers/Database/ImportController.php
View File

@ -42,7 +42,7 @@ final class ImportController extends AbstractController
$this->addScriptFiles(['import.js']);
Util::checkParameters(['db']);
$this->checkParameters(['db']);
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabDatabase'], 'database');
$GLOBALS['errorUrl'] .= Url::getCommon(['db' => $GLOBALS['db']], '&');

2
libraries/classes/Controllers/Database/Operations/CollationController.php
View File

@ -47,7 +47,7 @@ final class CollationController extends AbstractController
return;
}
Util::checkParameters(['db']);
$this->checkParameters(['db']);
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabDatabase'], 'database');
$GLOBALS['errorUrl'] .= Url::getCommon(['db' => $GLOBALS['db']], '&');

2
libraries/classes/Controllers/Database/OperationsController.php
View File

@ -237,7 +237,7 @@ class OperationsController extends AbstractController
$this->relation->setDbComment($GLOBALS['db'], $_POST['comment']);
}
Util::checkParameters(['db']);
$this->checkParameters(['db']);
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabDatabase'], 'database');
$GLOBALS['errorUrl'] .= Url::getCommon(['db' => $GLOBALS['db']], '&');

2
libraries/classes/Controllers/Database/QueryByExampleController.php
View File

@ -132,7 +132,7 @@ class QueryByExampleController extends AbstractController
$GLOBALS['sub_part'] = '_qbe';
Util::checkParameters(['db']);
$this->checkParameters(['db']);
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabDatabase'], 'database');
$GLOBALS['errorUrl'] .= Url::getCommon(['db' => $GLOBALS['db']], '&');

4
libraries/classes/Controllers/Database/RoutinesController.php
View File

@ -52,7 +52,7 @@ class RoutinesController extends AbstractController
* Displays the header and tabs
*/
if (! empty($GLOBALS['table']) && in_array($GLOBALS['table'], $this->dbi->getTables($GLOBALS['db']))) {
Util::checkParameters(['db', 'table']);
$this->checkParameters(['db', 'table']);
$GLOBALS['urlParams'] = ['db' => $GLOBALS['db'], 'table' => $GLOBALS['table']];
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabTable'], 'table');
@ -62,7 +62,7 @@ class RoutinesController extends AbstractController
} else {
$GLOBALS['table'] = '';
Util::checkParameters(['db']);
$this->checkParameters(['db']);
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabDatabase'], 'database');
$GLOBALS['errorUrl'] .= Url::getCommon(['db' => $GLOBALS['db']], '&');

2
libraries/classes/Controllers/Database/SearchController.php
View File

@ -35,7 +35,7 @@ class SearchController extends AbstractController
'makegrid.js',
]);
Util::checkParameters(['db']);
$this->checkParameters(['db']);
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabDatabase'], 'database');
$GLOBALS['errorUrl'] .= Url::getCommon(['db' => $GLOBALS['db']], '&');

2
libraries/classes/Controllers/Database/SqlController.php
View File

@ -41,7 +41,7 @@ class SqlController extends AbstractController
$this->response->addHTML($pageSettings->getErrorHTML());
$this->response->addHTML($pageSettings->getHTML());
Util::checkParameters(['db']);
$this->checkParameters(['db']);
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabDatabase'], 'database');
$GLOBALS['errorUrl'] .= Url::getCommon(['db' => $GLOBALS['db']], '&');

2
libraries/classes/Controllers/Database/Structure/FavoriteTableController.php
View File

@ -38,7 +38,7 @@ final class FavoriteTableController extends AbstractController
'sync_favorite_tables' => $_REQUEST['sync_favorite_tables'] ?? null,
];
Util::checkParameters(['db']);
$this->checkParameters(['db']);
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabDatabase'], 'database');
$GLOBALS['errorUrl'] .= Url::getCommon(['db' => $GLOBALS['db']], '&');

2
libraries/classes/Controllers/Database/Structure/RealRowCountController.php
View File

@ -34,7 +34,7 @@ final class RealRowCountController extends AbstractController
'table' => $_REQUEST['table'] ?? null,
];
Util::checkParameters(['db']);
$this->checkParameters(['db']);
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabDatabase'], 'database');
$GLOBALS['errorUrl'] .= Url::getCommon(['db' => $GLOBALS['db']], '&');

2
libraries/classes/Controllers/Database/StructureController.php
View File

@ -140,7 +140,7 @@ class StructureController extends AbstractController
'sort_order' => $_REQUEST['sort_order'] ?? null,
];
Util::checkParameters(['db']);
$this->checkParameters(['db']);
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabDatabase'], 'database');
$GLOBALS['errorUrl'] .= Url::getCommon(['db' => $GLOBALS['db']], '&');

2
libraries/classes/Controllers/Database/TrackingController.php
View File

@ -47,7 +47,7 @@ class TrackingController extends AbstractController
{
$this->addScriptFiles(['vendor/jquery/jquery.tablesorter.js', 'database/tracking.js']);
Util::checkParameters(['db']);
$this->checkParameters(['db']);
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabDatabase'], 'database');
$GLOBALS['errorUrl'] .= Url::getCommon(['db' => $GLOBALS['db']], '&');

4
libraries/classes/Controllers/Database/TriggersController.php
View File

@ -39,7 +39,7 @@ class TriggersController extends AbstractController
* Displays the header and tabs
*/
if (! empty($GLOBALS['table']) && in_array($GLOBALS['table'], $this->dbi->getTables($GLOBALS['db']))) {
Util::checkParameters(['db', 'table']);
$this->checkParameters(['db', 'table']);
$GLOBALS['urlParams'] = ['db' => $GLOBALS['db'], 'table' => $GLOBALS['table']];
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabTable'], 'table');
@ -49,7 +49,7 @@ class TriggersController extends AbstractController
} else {
$GLOBALS['table'] = '';
Util::checkParameters(['db']);
$this->checkParameters(['db']);
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabDatabase'], 'database');
$GLOBALS['errorUrl'] .= Url::getCommon(['db' => $GLOBALS['db']], '&');

2
libraries/classes/Controllers/Export/ExportController.php
View File

@ -212,7 +212,7 @@ final class ExportController extends AbstractController
$GLOBALS[$param] = $postParams[$param];
}
Util::checkParameters(['what', 'export_type']);
$this->checkParameters(['what', 'export_type']);
// sanitize this parameter which will be used below in a file inclusion
$GLOBALS['what'] = Core::securePath($whatParam);

3
libraries/classes/Controllers/Import/ImportController.php
View File

@ -255,8 +255,7 @@ final class ImportController extends AbstractController
Core::setPostAsGlobal($post_patterns);
// Check needed parameters
Util::checkParameters(['import_type', 'format']);
$this->checkParameters(['import_type', 'format']);
// We don't want anything special in format
$GLOBALS['format'] = Core::securePath($GLOBALS['format']);

12
libraries/classes/Controllers/SchemaExportController.php
View File

@ -4,8 +4,11 @@ declare(strict_types=1);
namespace PhpMyAdmin\Controllers;
use PhpMyAdmin\Core;
use PhpMyAdmin\Export;
use PhpMyAdmin\Util;
use PhpMyAdmin\Html\MySQLDocumentation;
use function __;
/**
* Schema export handler
@ -23,7 +26,12 @@ class SchemaExportController
public function __invoke(): void
{
if (! isset($_POST['export_type'])) {
Util::checkParameters(['export_type']);
$errorMessage = __('Missing parameter:') . ' export_type'
. MySQLDocumentation::showDocumentation('faq', 'faqmissingparameters', true)
. '[br]';
Core::fatalError($errorMessage);
return;
}
/**

3
libraries/classes/Controllers/Sql/SqlController.php
View File

@ -124,8 +124,7 @@ class SqlController extends AbstractController
// set $goto to what will be displayed if query returns 0 rows
$GLOBALS['goto'] = '';
} else {
// Now we can check the parameters
Util::checkParameters(['sql_query']);
$this->checkParameters(['sql_query']);
}
/**

5
libraries/classes/Controllers/Table/AddFieldController.php
View File

@ -61,8 +61,7 @@ class AddFieldController extends AbstractController
{
$this->addScriptFiles(['table/structure.js']);
// Check parameters
Util::checkParameters(['db', 'table']);
$this->checkParameters(['db', 'table']);
$cfg = $this->config->settings;
@ -178,6 +177,8 @@ class AddFieldController extends AbstractController
$this->addScriptFiles(['vendor/jquery/jquery.uitablefilter.js', 'indexes.js']);
$this->checkParameters(['server', 'db', 'table', 'num_fields']);
$templateData = $this->columnsDefinition->displayForm(
'/table/add-field',
$GLOBALS['num_fields'],

6
libraries/classes/Controllers/Table/ChartController.php
View File

@ -81,7 +81,7 @@ class ChartController extends AbstractController
* Runs common work
*/
if (strlen($GLOBALS['table']) > 0) {
Util::checkParameters(['db', 'table']);
$this->checkParameters(['db', 'table']);
$url_params = ['db' => $GLOBALS['db'], 'table' => $GLOBALS['table']];
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabTable'], 'table');
@ -96,7 +96,7 @@ class ChartController extends AbstractController
$url_params['goto'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabDatabase'], 'database');
$url_params['back'] = Url::getFromRoute('/sql');
Util::checkParameters(['db']);
$this->checkParameters(['db']);
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabDatabase'], 'database');
$GLOBALS['errorUrl'] .= Url::getCommon(['db' => $GLOBALS['db']], '&');
@ -168,7 +168,7 @@ class ChartController extends AbstractController
public function ajax(): void
{
if (strlen($GLOBALS['table']) > 0 && strlen($GLOBALS['db']) > 0) {
Util::checkParameters(['db', 'table']);
$this->checkParameters(['db', 'table']);
$GLOBALS['urlParams'] = ['db' => $GLOBALS['db'], 'table' => $GLOBALS['table']];
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabTable'], 'table');

5
libraries/classes/Controllers/Table/CreateController.php
View File

@ -15,7 +15,6 @@ use PhpMyAdmin\Table\ColumnsDefinition;
use PhpMyAdmin\Template;
use PhpMyAdmin\Transformations;
use PhpMyAdmin\Url;
use PhpMyAdmin\Util;
use function __;
use function htmlspecialchars;
@ -58,7 +57,7 @@ class CreateController extends AbstractController
public function __invoke(): void
{
Util::checkParameters(['db']);
$this->checkParameters(['db']);
$cfg = $this->config->settings;
@ -156,6 +155,8 @@ class CreateController extends AbstractController
$this->addScriptFiles(['vendor/jquery/jquery.uitablefilter.js', 'indexes.js']);
$this->checkParameters(['server', 'db', 'table', 'num_fields']);
$templateData = $this->columnsDefinition->displayForm('/table/create', $GLOBALS['num_fields']);
$this->render('columns_definitions/column_definitions_form', $templateData);

2
libraries/classes/Controllers/Table/DeleteConfirmController.php
View File

@ -26,7 +26,7 @@ final class DeleteConfirmController extends AbstractController
return;
}
Util::checkParameters(['db', 'table']);
$this->checkParameters(['db', 'table']);
$GLOBALS['urlParams'] = ['db' => $GLOBALS['db'], 'table' => $GLOBALS['table']];
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabTable'], 'table');

2
libraries/classes/Controllers/Table/DropColumnConfirmationController.php
View File

@ -24,7 +24,7 @@ final class DropColumnConfirmationController extends AbstractController
return;
}
Util::checkParameters(['db', 'table']);
$this->checkParameters(['db', 'table']);
$GLOBALS['urlParams'] = ['db' => $GLOBALS['db'], 'table' => $GLOBALS['table']];
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabTable'], 'table');

2
libraries/classes/Controllers/Table/ExportController.php
View File

@ -44,7 +44,7 @@ class ExportController extends AbstractController
$this->addScriptFiles(['export.js']);
Util::checkParameters(['db', 'table']);
$this->checkParameters(['db', 'table']);
$GLOBALS['urlParams'] = ['db' => $GLOBALS['db'], 'table' => $GLOBALS['table']];
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabTable'], 'table');

2
libraries/classes/Controllers/Table/FindReplaceController.php
View File

@ -60,7 +60,7 @@ class FindReplaceController extends AbstractController
public function __invoke(): void
{
Util::checkParameters(['db', 'table']);
$this->checkParameters(['db', 'table']);
$GLOBALS['urlParams'] = ['db' => $GLOBALS['db'], 'table' => $GLOBALS['table']];
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabTable'], 'table');

6
libraries/classes/Controllers/Table/GetFieldController.php
View File

@ -40,11 +40,7 @@ class GetFieldController extends AbstractController
{
$this->response->disable();
/* Check parameters */
Util::checkParameters([
'db',
'table',
]);
$this->checkParameters(['db', 'table']);
/* Select database */
if (! $this->dbi->selectDb($GLOBALS['db'])) {

2
libraries/classes/Controllers/Table/GisVisualizationController.php
View File

@ -41,7 +41,7 @@ final class GisVisualizationController extends AbstractController
public function __invoke(): void
{
Util::checkParameters(['db']);
$this->checkParameters(['db']);
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabDatabase'], 'database');
$GLOBALS['errorUrl'] .= Url::getCommon(['db' => $GLOBALS['db']], '&');

2
libraries/classes/Controllers/Table/ImportController.php
View File

@ -46,7 +46,7 @@ final class ImportController extends AbstractController
$this->addScriptFiles(['import.js']);
Util::checkParameters(['db', 'table']);
$this->checkParameters(['db', 'table']);
$GLOBALS['urlParams'] = ['db' => $GLOBALS['db'], 'table' => $GLOBALS['table']];
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabTable'], 'table');

2
libraries/classes/Controllers/Table/IndexRenameController.php
View File

@ -38,7 +38,7 @@ final class IndexRenameController extends AbstractController
public function __invoke(): void
{
if (! isset($_POST['create_edit_table'])) {
Util::checkParameters(['db', 'table']);
$this->checkParameters(['db', 'table']);
$GLOBALS['urlParams'] = ['db' => $GLOBALS['db'], 'table' => $GLOBALS['table']];
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabTable'], 'table');

2
libraries/classes/Controllers/Table/IndexesController.php
View File

@ -45,7 +45,7 @@ class IndexesController extends AbstractController
public function __invoke(): void
{
if (! isset($_POST['create_edit_table'])) {
Util::checkParameters(['db', 'table']);
$this->checkParameters(['db', 'table']);
$GLOBALS['urlParams'] = ['db' => $GLOBALS['db'], 'table' => $GLOBALS['table']];
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabTable'], 'table');

2
libraries/classes/Controllers/Table/OperationsController.php
View File

@ -77,7 +77,7 @@ class OperationsController extends AbstractController
$this->addScriptFiles(['table/operations.js']);
Util::checkParameters(['db', 'table']);
$this->checkParameters(['db', 'table']);
$isSystemSchema = Utilities::isSystemSchema($GLOBALS['db']);
$GLOBALS['urlParams'] = ['db' => $GLOBALS['db'], 'table' => $GLOBALS['table']];

2
libraries/classes/Controllers/Table/ReplaceController.php
View File

@ -69,7 +69,7 @@ final class ReplaceController extends AbstractController
public function __invoke(): void
{
Util::checkParameters(['db', 'table', 'goto']);
$this->checkParameters(['db', 'table', 'goto']);
$this->dbi->selectDb($GLOBALS['db']);

2
libraries/classes/Controllers/Table/SearchController.php
View File

@ -171,7 +171,7 @@ class SearchController extends AbstractController
*/
public function __invoke(): void
{
Util::checkParameters(['db', 'table']);
$this->checkParameters(['db', 'table']);
$GLOBALS['urlParams'] = ['db' => $GLOBALS['db'], 'table' => $GLOBALS['table']];
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabTable'], 'table');

2
libraries/classes/Controllers/Table/SqlController.php
View File

@ -45,7 +45,7 @@ final class SqlController extends AbstractController
$this->response->addHTML($pageSettings->getErrorHTML());
$this->response->addHTML($pageSettings->getHTML());
Util::checkParameters(['db', 'table']);
$this->checkParameters(['db', 'table']);
$url_params = ['db' => $GLOBALS['db'], 'table' => $GLOBALS['table']];
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabTable'], 'table');

2
libraries/classes/Controllers/Table/Structure/ChangeController.php
View File

@ -95,6 +95,8 @@ final class ChangeController extends AbstractController
$this->addScriptFiles(['vendor/jquery/jquery.uitablefilter.js', 'indexes.js']);
$this->checkParameters(['server', 'db', 'table', 'num_fields']);
$templateData = $this->columnsDefinition->displayForm(
'/table/structure/save',
$GLOBALS['num_fields'],

2
libraries/classes/Controllers/Table/Structure/PrimaryController.php
View File

@ -58,7 +58,7 @@ final class PrimaryController extends AbstractController
$mult_btn = $_POST['mult_btn'] ?? $mult_btn ?? '';
if (! empty($selected_fld) && ! empty($primary)) {
Util::checkParameters(['db', 'table']);
$this->checkParameters(['db', 'table']);
$GLOBALS['urlParams'] = ['db' => $GLOBALS['db'], 'table' => $GLOBALS['table']];
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabTable'], 'table');

2
libraries/classes/Controllers/Table/StructureController.php
View File

@ -117,7 +117,7 @@ class StructureController extends AbstractController
$relationParameters = $this->relation->getRelationParameters();
Util::checkParameters(['db', 'table']);
$this->checkParameters(['db', 'table']);
$isSystemSchema = Utilities::isSystemSchema($GLOBALS['db']);
$url_params = ['db' => $GLOBALS['db'], 'table' => $GLOBALS['table']];

2
libraries/classes/Controllers/Table/TrackingController.php
View File

@ -42,7 +42,7 @@ final class TrackingController extends AbstractController
define('TABLE_MAY_BE_ABSENT', true);
Util::checkParameters(['db', 'table']);
$this->checkParameters(['db', 'table']);
$GLOBALS['urlParams'] = ['db' => $GLOBALS['db'], 'table' => $GLOBALS['table']];
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabTable'], 'table');

4
libraries/classes/Controllers/Table/TriggersController.php
View File

@ -42,7 +42,7 @@ class TriggersController extends AbstractController
* Displays the header and tabs
*/
if (! empty($GLOBALS['table']) && in_array($GLOBALS['table'], $this->dbi->getTables($GLOBALS['db']))) {
Util::checkParameters(['db', 'table']);
$this->checkParameters(['db', 'table']);
$GLOBALS['urlParams'] = ['db' => $GLOBALS['db'], 'table' => $GLOBALS['table']];
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabTable'], 'table');
@ -52,7 +52,7 @@ class TriggersController extends AbstractController
} else {
$GLOBALS['table'] = '';
Util::checkParameters(['db']);
$this->checkParameters(['db']);
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabDatabase'], 'database');
$GLOBALS['errorUrl'] .= Url::getCommon(['db' => $GLOBALS['db']], '&');

2
libraries/classes/Controllers/Table/ZoomSearchController.php
View File

@ -94,7 +94,7 @@ class ZoomSearchController extends AbstractController
public function __invoke(): void
{
Util::checkParameters(['db', 'table']);
$this->checkParameters(['db', 'table']);
$GLOBALS['urlParams'] = ['db' => $GLOBALS['db'], 'table' => $GLOBALS['table']];
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabTable'], 'table');

2
libraries/classes/Controllers/View/CreateController.php
View File

@ -44,7 +44,7 @@ class CreateController extends AbstractController
public function __invoke(): void
{
Util::checkParameters(['db']);
$this->checkParameters(['db']);
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabDatabase'], 'database');
$GLOBALS['errorUrl'] .= Url::getCommon(['db' => $GLOBALS['db']], '&');

2
libraries/classes/Controllers/View/OperationsController.php
View File

@ -45,7 +45,7 @@ class OperationsController extends AbstractController
$this->addScriptFiles(['table/operations.js']);
Util::checkParameters(['db', 'table']);
$this->checkParameters(['db', 'table']);
$GLOBALS['urlParams'] = ['db' => $GLOBALS['db'], 'table' => $GLOBALS['table']];
$GLOBALS['errorUrl'] = Util::getScriptNameForOption($GLOBALS['cfg']['DefaultTabTable'], 'table');

7
libraries/classes/Table/ColumnsDefinition.php
View File

@ -68,13 +68,6 @@ final class ColumnsDefinition
?array $selected = null,
$fields_meta = null
): array {
Util::checkParameters([
'server',
'db',
'table',
'num_fields',
]);
$length_values_input_size = 8;
$content_cells = [];
$form_params = ['db' => $GLOBALS['db']];

42
libraries/classes/Util.php
View File

@ -6,7 +6,6 @@ namespace PhpMyAdmin;
use PhpMyAdmin\Dbal\ResultInterface;
use PhpMyAdmin\Html\Generator;
use PhpMyAdmin\Html\MySQLDocumentation;
use PhpMyAdmin\Query\Utilities;
use PhpMyAdmin\SqlParser\Components\Expression;
use PhpMyAdmin\SqlParser\Context;
@ -22,7 +21,6 @@ use function array_map;
use function array_merge;
use function array_shift;
use function array_unique;
use function basename;
use function bin2hex;
use function chr;
use function count;
@ -800,46 +798,6 @@ class Util
);
}
/**
* Function added to avoid path disclosures.
* Called by each script that needs parameters, it displays
* an error message and, by default, stops the execution.
*
* @param string[] $params The names of the parameters needed by the calling
* script
* @param bool $request Check parameters in request
*/
public static function checkParameters($params, $request = false): void
{
$reportedScriptName = basename($GLOBALS['PMA_PHP_SELF']);
$foundError = false;
$errorMessage = '';
if ($request) {
$array = $_REQUEST;
} else {
$array = $GLOBALS;
}
foreach ($params as $param) {
if (isset($array[$param])) {
continue;
}
$errorMessage .= $reportedScriptName
. ': ' . __('Missing parameter:') . ' '
. $param
. MySQLDocumentation::showDocumentation('faq', 'faqmissingparameters', true)
. '[br]';
$foundError = true;
}
if (! $foundError) {
return;
}
Core::fatalError($errorMessage);
}
/**
* Build a condition and with a value
*

83
test/classes/Controllers/AbstractControllerTest.php Normal file
View File

@ -0,0 +1,83 @@
<?php
declare(strict_types=1);
namespace PhpMyAdmin\Tests\Controllers;
use PhpMyAdmin\Controllers\AbstractController;
use PhpMyAdmin\Html\MySQLDocumentation;
use PhpMyAdmin\Sanitize;
use PhpMyAdmin\Template;
use PhpMyAdmin\Tests\AbstractTestCase;
use PhpMyAdmin\Tests\Stubs\ResponseRenderer;
/**
* @covers \PhpMyAdmin\Controllers\AbstractController
*/
class AbstractControllerTest extends AbstractTestCase
{
public function testCheckParametersWithMissingParameters(): void
{
$_REQUEST = [];
$response = new ResponseRenderer();
$template = new Template();
$controller = new class ($response, $template) extends AbstractController {
/**
* @psalm-param non-empty-list<non-empty-string> $params
*/
public function testCheckParameters(array $params): void
{
parent::checkParameters($params);
}
};
\PhpMyAdmin\ResponseRenderer::getInstance()->setAjax(false);
$GLOBALS['param1'] = 'param1';
$GLOBALS['param2'] = null;
$message = 'index.php: Missing parameter: param2';
$message .= MySQLDocumentation::showDocumentation('faq', 'faqmissingparameters', true);
$message .= '[br]';
$expected = $template->render('error/generic', [
'lang' => 'en',
'dir' => 'ltr',
'error_message' => Sanitize::sanitizeMessage($message),
]);
$this->expectOutputString($expected);
$controller->testCheckParameters(['param1', 'param2']);
$this->assertSame(400, $response->getHttpResponseCode());
}
public function testCheckParametersWithAllParameters(): void
{
$_REQUEST = [];
$response = new ResponseRenderer();
$template = new Template();
$controller = new class ($response, $template) extends AbstractController {
/**
* @psalm-param non-empty-list<non-empty-string> $params
*/
public function testCheckParameters(array $params): void
{
parent::checkParameters($params);
}
};
\PhpMyAdmin\ResponseRenderer::getInstance()->setAjax(false);
$GLOBALS['param1'] = 'param1';
$GLOBALS['param2'] = 'param2';
$this->expectOutputString('');
$controller->testCheckParameters(['param1', 'param2']);
$this->assertSame(200, $response->getHttpResponseCode());
}
}

48
test/classes/UtilTest.php
View File

@ -4,11 +4,9 @@ declare(strict_types=1);
namespace PhpMyAdmin\Tests;
use PhpMyAdmin\Core;
use PhpMyAdmin\DatabaseInterface;
use PhpMyAdmin\FieldMetadata;
use PhpMyAdmin\MoTranslator\Loader;
use PhpMyAdmin\ResponseRenderer;
use PhpMyAdmin\SqlParser\Context;
use PhpMyAdmin\SqlParser\Token;
use PhpMyAdmin\Util;
@ -334,52 +332,6 @@ class UtilTest extends AbstractTestCase
$this->assertArrayNotHasKey('is_superuser', $_SESSION['cache']['server_server']);
}
public function testCheckParameterMissing(): void
{
parent::setGlobalConfig();
$_REQUEST = [];
$GLOBALS['text_dir'] = 'ltr';
$GLOBALS['PMA_PHP_SELF'] = Core::getenv('PHP_SELF');
$GLOBALS['db'] = 'db';
$GLOBALS['table'] = 'table';
$GLOBALS['server'] = 1;
$GLOBALS['cfg']['ServerDefault'] = 1;
$GLOBALS['cfg']['AllowThirdPartyFraming'] = false;
ResponseRenderer::getInstance()->setAjax(false);
$this->expectOutputRegex('/Missing parameter: field/');
Util::checkParameters(
[
'db',
'table',
'field',
]
);
}
public function testCheckParameter(): void
{
parent::setGlobalConfig();
$GLOBALS['cfg'] = ['ServerDefault' => 1];
$GLOBALS['text_dir'] = 'ltr';
$GLOBALS['PMA_PHP_SELF'] = Core::getenv('PHP_SELF');
$GLOBALS['db'] = 'dbDatabase';
$GLOBALS['table'] = 'tblTable';
$GLOBALS['field'] = 'test_field';
$GLOBALS['sql_query'] = 'SELECT * FROM tblTable;';
$this->expectOutputString('');
Util::checkParameters(
[
'db',
'table',
'field',
'sql_query',
]
);
}
/**
* Test for Util::convertBitDefaultValue
*