From 59036e15622243f7b68577233d0c1012a4b15f51 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Wed, 6 Jan 2016 11:58:43 +0100 Subject: [PATCH 01/11] Simplify test to avoid need fo multiline regexp MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cherry picked from master to avoid test suite failures on PHP 7. Signed-off-by: Michal Čihař --- test/libraries/PMA_operations_test.php | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/test/libraries/PMA_operations_test.php b/test/libraries/PMA_operations_test.php index f8f122cdbe..55e15093e2 100644 --- a/test/libraries/PMA_operations_test.php +++ b/test/libraries/PMA_operations_test.php @@ -69,9 +69,11 @@ class PMA_Operations_Test extends PHPUnit_Framework_TestCase { $_REQUEST['db_collation'] = 'db1'; + $html = PMA_getHtmlForRenameDatabase("pma"); + $this->assertContains('db_operations.php', $html); $this->assertRegExp( - '/.*db_operations.php(.|[\n])*db_rename([\n]|.)*Rename database to.*/m', - PMA_getHtmlForRenameDatabase("pma") + '/.*db_rename.*Rename database to.*/', + $html ); } From dcdeee28eb6a251ad2fcb70d81fe55f1569b4580 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Tue, 19 Jan 2016 10:41:28 +0100 Subject: [PATCH 02/11] Gracefully handle errors in regex based javascript search MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit User can write any invalid regex and we should handle this gracefully. Signed-off-by: Michal Čihař --- ChangeLog | 1 + js/server_status_monitor.js | 10 +++++++++- js/server_status_variables.js | 10 +++++++++- js/server_variables.js | 10 +++++++++- 4 files changed, 28 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 69c85c0ff8..544d1f9038 100644 --- a/ChangeLog +++ b/ChangeLog @@ -28,6 +28,7 @@ phpMyAdmin - ChangeLog - issue #11752 Improve detection of privileges for privilege adjusting - issue #11854 Undefined property: stdClass::$releases at version check when disabled in config - issue #11814 SQL comment and variable stripped from bookmark on save +- issue Gracefully handle errors in regex based javascript search 4.5.3.1 (2015-12-25) - issue #11774 Undefined offset 2 diff --git a/js/server_status_monitor.js b/js/server_status_monitor.js index 14328a5975..55bc3b90ec 100644 --- a/js/server_status_monitor.js +++ b/js/server_status_monitor.js @@ -1695,7 +1695,15 @@ AJAX.registerOnload('server_status_monitor.js', function () { if (val.length === 0) { textFilter = null; } else { - textFilter = new RegExp(val, 'i'); + try { + textFilter = new RegExp(val, 'i'); + $('#filterQueryText').removeClass('error'); + } catch(e) { + if (e instanceof SyntaxError) { + $('#filterQueryText').addClass('error'); + textFilter = null; + } + } } var rowSum = 0, totalSum = 0, i = 0, q; diff --git a/js/server_status_variables.js b/js/server_status_variables.js index fa46f1fda9..47956f8464 100644 --- a/js/server_status_variables.js +++ b/js/server_status_variables.js @@ -48,7 +48,15 @@ AJAX.registerOnload('server_status_variables.js', function () { if (word.length === 0) { textFilter = null; } else { - textFilter = new RegExp("(^| )" + word, 'i'); + try { + textFilter = new RegExp("(^| )" + word, 'i'); + $(this).removeClass('error'); + } catch(e) { + if (e instanceof SyntaxError) { + $(this).addClass('error'); + textFilter = null; + } + } } text = word; filterVariables(); diff --git a/js/server_variables.js b/js/server_variables.js index 3b4dc11244..62f5ed7cf4 100644 --- a/js/server_variables.js +++ b/js/server_variables.js @@ -30,7 +30,15 @@ AJAX.registerOnload('server_variables.js', function () { $filterField.keyup(function () { var textFilter = null, val = $(this).val(); if (val.length !== 0) { - textFilter = new RegExp("(^| )" + val.replace(/_/g, ' '), 'i'); + try { + textFilter = new RegExp("(^| )" + val.replace(/_/g, ' '), 'i'); + $(this).removeClass('error'); + } catch(e) { + if (e instanceof SyntaxError) { + $(this).addClass('error'); + textFilter = null; + } + } } filterVariables(textFilter); }); From 0490d204087560298e2df7fd2cc5831cf538c936 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Tue, 19 Jan 2016 10:48:32 +0100 Subject: [PATCH 03/11] Check for parameter before using it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- export.php | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/export.php b/export.php index b7942a34ac..b781eaa18d 100644 --- a/export.php +++ b/export.php @@ -163,11 +163,12 @@ if (!defined('TESTSUITE')) { } $table = $GLOBALS['table']; - // sanitize this parameter which will be used below in a file inclusion - $what = PMA_securePath($_POST['what']); PMA_Util::checkParameters(array('what', 'export_type')); + // sanitize this parameter which will be used below in a file inclusion + $what = PMA_securePath($_POST['what']); + // export class instance, not array of properties, as before /* @var $export_plugin ExportPlugin */ $export_plugin = PMA_getPlugin( From 1523c4b364ed0aa9951910ec87d9908f307fbd69 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Tue, 19 Jan 2016 11:10:10 +0100 Subject: [PATCH 04/11] Gracefully handle calling sql.php without SQL query MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- libraries/sql.lib.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libraries/sql.lib.php b/libraries/sql.lib.php index 352800985b..20b0fe6fd7 100644 --- a/libraries/sql.lib.php +++ b/libraries/sql.lib.php @@ -2029,7 +2029,8 @@ function PMA_executeQueryAndGetQueryResponse($analyzed_sql_results, // (the parser never sets the 'union' key to 0). // Handling is also not required if we came from the "Sort by key" // drop-down. - if (PMA_isRememberSortingOrder($analyzed_sql_results) + if (! empty($analyzed_sql_results) + && PMA_isRememberSortingOrder($analyzed_sql_results) && empty($analyzed_sql_results['union']) && ! isset($_REQUEST['sort_by_key']) ) { From 897a844581761619d43f4e759bfe5ef117d400e1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Tue, 19 Jan 2016 11:19:03 +0100 Subject: [PATCH 05/11] Check for parameter before using it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- db_create.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/db_create.php b/db_create.php index 54440b62dd..76e9cb5737 100644 --- a/db_create.php +++ b/db_create.php @@ -17,6 +17,10 @@ if (! PMA_DRIZZLE) { } require 'libraries/build_html_for_db.lib.php'; +if (! isset($_POST['new_db'])) { + PMA_Util::checkParameters(array('new_db')); +} + /** * Defines the url to return to in case of error in a sql statement */ From a6ae24741e01bdbd4e3b7165183b800646fc8d73 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Tue, 19 Jan 2016 11:23:15 +0100 Subject: [PATCH 06/11] Validate parameters before use MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- gis_data_editor.php | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/gis_data_editor.php b/gis_data_editor.php index ac876da4d9..be13aeeb0e 100644 --- a/gis_data_editor.php +++ b/gis_data_editor.php @@ -23,6 +23,10 @@ require_once 'libraries/common.inc.php'; require_once 'libraries/gis/GIS_Factory.class.php'; require_once 'libraries/gis/GIS_Visualization.class.php'; +if (! isset($_REQUEST['field'])) { + PMA_Util::checkParameters(array('field')); +} + // Get data if any posted $gis_data = array(); if (PMA_isValid($_REQUEST['gis_data'], 'array')) { @@ -185,6 +189,9 @@ if ($geom_type == 'GEOMETRYCOLLECTION') { } for ($a = 0; $a < $geom_count; $a++) { + if (! isset($gis_data[$a])) { + continue; + } if ($geom_type == 'GEOMETRYCOLLECTION') { echo '

'; From 5359d9a968101a78c08a41cb4a77c9189595f7bb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Tue, 19 Jan 2016 11:26:59 +0100 Subject: [PATCH 07/11] Check for parameter before using it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- schema_export.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/schema_export.php b/schema_export.php index ec1c4e0b54..b28ae6758f 100644 --- a/schema_export.php +++ b/schema_export.php @@ -22,6 +22,10 @@ require_once 'libraries/Index.class.php'; require_once 'libraries/pmd_common.php'; require_once 'libraries/plugin_interface.lib.php'; +if (! isset($_REQUEST['export_type'])) { + PMA_Util::checkParameters(array('export_type')); +} + /** * Include the appropriate Schema Class depending on $export_type * default is PDF From a5affed07a3107f83addd67a07965229a9b18c83 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Tue, 19 Jan 2016 11:38:50 +0100 Subject: [PATCH 08/11] Validate database before starting designer MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- db_designer.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/db_designer.php b/db_designer.php index 8acc99e69c..5d732e62f4 100644 --- a/db_designer.php +++ b/db_designer.php @@ -10,6 +10,8 @@ require_once 'libraries/common.inc.php'; require_once 'libraries/pmd_common.php'; require_once 'libraries/db_designer.lib.php'; +require 'libraries/db_common.inc.php'; + $response = PMA_Response::getInstance(); if (isset($_REQUEST['dialog'])) { @@ -126,8 +128,6 @@ $scripts->addFile('pmd/move.js'); $scripts->addFile('pmd/iecanvas.js', true); $scripts->addFile('pmd/init.js'); -require 'libraries/db_common.inc.php'; - list( $tables, $num_tables, From 1431625d68f103b8d80173af214a5bc4e39b92c4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Tue, 19 Jan 2016 11:45:52 +0100 Subject: [PATCH 09/11] Fixes possible error when query is empty/not analyzed MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes #11873 Signed-off-by: Michal Čihař --- libraries/sql.lib.php | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libraries/sql.lib.php b/libraries/sql.lib.php index 20b0fe6fd7..ba054d3674 100644 --- a/libraries/sql.lib.php +++ b/libraries/sql.lib.php @@ -1093,6 +1093,11 @@ function PMA_countQueryResults( $num_rows, $justBrowsing, $db, $table, $analyzed_sql_results ) { + /* Shortcut for not analyzed/empty query */ + if (empty($analyzed_sql_results)) { + return 0; + } + if (!PMA_isAppendLimitClause($analyzed_sql_results)) { // if we did not append a limit, set this to get a correct // "Showing rows..." message From da62e19833eaf5d757afda22b1f9a8dddbf0653c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Fri, 22 Jan 2016 15:27:15 +0100 Subject: [PATCH 10/11] Correctly handle what parameter on export MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- export.php | 1 + 1 file changed, 1 insertion(+) diff --git a/export.php b/export.php index b781eaa18d..e50f4fdd4c 100644 --- a/export.php +++ b/export.php @@ -43,6 +43,7 @@ if (!defined('TESTSUITE')) { $post_params = array( 'db', 'table', + 'what', 'single_table', 'export_type', 'export_method', From 316792bf4a9afd0e76770470f7702c1504be4f36 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Mon, 25 Jan 2016 12:18:37 +0100 Subject: [PATCH 11/11] Move databse check to correct location MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- db_designer.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/db_designer.php b/db_designer.php index 5d732e62f4..b1d63ec4ef 100644 --- a/db_designer.php +++ b/db_designer.php @@ -10,8 +10,6 @@ require_once 'libraries/common.inc.php'; require_once 'libraries/pmd_common.php'; require_once 'libraries/db_designer.lib.php'; -require 'libraries/db_common.inc.php'; - $response = PMA_Response::getInstance(); if (isset($_REQUEST['dialog'])) { @@ -83,6 +81,8 @@ if (isset($_REQUEST['operation'])) { return; } +require 'libraries/db_common.inc.php'; + $script_display_field = PMA_getTablesInfo(); $tab_column = PMA_getColumnsInfo(); $script_tables = PMA_getScriptTabs();