Do not encrypt params if used in data-post attribute

Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
2021-10-17 16:23:30 -03:00 · 2021-10-17 16:23:30 -03:00 · 6f0d19f394
commit 6f0d19f394
parent d057b68aa1
20 changed files with 56 additions and 50 deletions
--- a/libraries/classes/Controllers/Server/ServerBinlogController.php
+++ b/libraries/classes/Controllers/Server/ServerBinlogController.php
@ -193,7 +193,7 @@ class ServerBinlogController extends Controller
            }

            $html .= '<a href="server_binlog.php" data-post="'
-                . Url::getCommon($this_url_params, '') . '"';
+                . Url::getCommon($this_url_params, '', false) . '"';
            if (Util::showIcons('TableNavigationLinksMode')) {
                $html .= ' title="' . _pgettext('Previous page', 'Previous') . '">';
            } else {
@ -215,7 +215,7 @@ class ServerBinlogController extends Controller
            $tempTitle = __('Show Full Queries');
            $tempImgMode = 'full';
        }
-        $html .= '<a href="server_binlog.php" data-post="' . Url::getCommon($this_url_params, '')
+        $html .= '<a href="server_binlog.php" data-post="' . Url::getCommon($this_url_params, '', false)
            . '" title="' . $tempTitle . '">'
            . '<img src="' . $GLOBALS['pmaThemeImage'] . 's_' . $tempImgMode
            . 'text.png" alt="' . $tempTitle . '" /></a>';
@ -226,7 +226,7 @@ class ServerBinlogController extends Controller
            $this_url_params = $url_params;
            $this_url_params['pos'] = $pos + $GLOBALS['cfg']['MaxRows'];
            $html .= ' - <a href="server_binlog.php" data-post="'
-                . Url::getCommon($this_url_params, '')
+                . Url::getCommon($this_url_params, '', false)
                . '"';
            if (Util::showIcons('TableNavigationLinksMode')) {
                $html .= ' title="' . _pgettext('Next page', 'Next') . '">';
--- a/libraries/classes/Export.php
+++ b/libraries/classes/Export.php
@ -479,14 +479,14 @@ class Export
         */
        $back_button = '<p id="export_back_button">[ <a href="';
        if ($export_type == 'server') {
-            $back_button .= 'server_export.php" data-post="' . Url::getCommon([], '');
+            $back_button .= 'server_export.php" data-post="' . Url::getCommon([], '', false);
        } elseif ($export_type == 'database') {
-            $back_button .= 'db_export.php" data-post="' . Url::getCommon(array('db' => $db), '');
+            $back_button .= 'db_export.php" data-post="' . Url::getCommon(array('db' => $db), '', false);
        } else {
            $back_button .= 'tbl_export.php" data-post="' . Url::getCommon(
                array(
                    'db' => $db, 'table' => $table
-                ), ''
+                ), '', false
            );
        }

--- a/libraries/classes/Index.php
+++ b/libraries/classes/Index.php
@ -741,7 +741,7 @@ class Index
                $r .= '" ' . $row_span . '>'
                   . '    <a class="';
                $r .= 'ajax';
-                $r .= '" href="tbl_indexes.php" data-post="' . Url::getCommon($this_params, '')
+                $r .= '" href="tbl_indexes.php" data-post="' . Url::getCommon($this_params, '', false)
                   . '">' . Util::getIcon('b_edit', __('Edit')) . '</a>'
                   . '</td>' . "\n";
                $this_params = $GLOBALS['url_params'];
--- a/libraries/classes/InsertEdit.php
+++ b/libraries/classes/InsertEdit.php
@ -280,12 +280,12 @@ class InsertEdit

        if (! $is_show) {
            return ' : <a href="tbl_change.php" data-post="'
-                . Url::getCommon($this_url_params, '') . '">'
+                . Url::getCommon($this_url_params, '', false) . '">'
                . $this->showTypeOrFunctionLabel($which)
                . '</a>';
        }
        return '<th><a href="tbl_change.php" data-post="'
-            . Url::getCommon($this_url_params, '')
+            . Url::getCommon($this_url_params, '', false)
            . '" title="' . __('Hide') . '">'
            . $this->showTypeOrFunctionLabel($which)
            . '</a></th>';
@ -857,7 +857,7 @@ class InsertEdit
                    'rownumber' => $rownumber,
                    'data'      => $data
                ),
-                ''
+                '', false
            ) . '">'
            . str_replace("'", "\'", $titles['Browse']) . '</a>';
        return $html_output;
--- a/libraries/classes/Navigation/Navigation.php
+++ b/libraries/classes/Navigation/Navigation.php
@ -231,7 +231,7 @@ class Navigation
                        $html .= '<tr>';
                        $html .= '<td>' . htmlspecialchars($hiddenItem) . '</td>';
                        $html .= '<td style="width:80px"><a href="navigation.php" data-post="'
-                            . Url::getCommon($params, '') . '"'
+                            . Url::getCommon($params, '', false) . '"'
                            . ' class="unhideNavItem ajax">'
                            . Util::getIcon('show', __('Show'))
                            . '</a></td>';
--- a/libraries/classes/Navigation/Nodes/NodeDatabase.php
+++ b/libraries/classes/Navigation/Nodes/NodeDatabase.php
@ -678,7 +678,7 @@ class NodeDatabase extends Node
                );
                $ret = '<span class="dbItemControls">'
                    . '<a href="navigation.php" data-post="'
-                    . Url::getCommon($params, '') . '"'
+                    . Url::getCommon($params, '', false) . '"'
                    . ' class="showUnhide ajax">'
                    . Util::getImage(
                        'show',
--- a/libraries/classes/Navigation/Nodes/NodeDatabaseChild.php
+++ b/libraries/classes/Navigation/Nodes/NodeDatabaseChild.php
@ -49,7 +49,7 @@ abstract class NodeDatabaseChild extends Node

            $ret = '<span class="navItemControls">'
                . '<a href="navigation.php" data-post="'
-                . Url::getCommon($params, '') . '"'
+                . Url::getCommon($params, '', false) . '"'
                . ' class="hideNavItem ajax">'
                . Util::getImage('hide', __('Hide'))
                . '</a></span>';
--- a/libraries/classes/ReplicationGui.php
+++ b/libraries/classes/ReplicationGui.php
@ -73,7 +73,7 @@ class ReplicationGui
            $_url_params['repl_clear_scr'] = true;

            $html .= '  <li><a href="server_replication.php" data-post="';
-            $html .= Url::getCommon($_url_params, '')
+            $html .= Url::getCommon($_url_params, '', false)
                . '" id="master_addslaveuser_href">';
            $html .= __('Add slave replication user') . '</a></li>';
        }
@ -188,7 +188,7 @@ class ReplicationGui
            }

            $_url_params['sr_slave_control_parm'] = 'IO_THREAD';
-            $slave_control_io_link = Url::getCommon($_url_params, '');
+            $slave_control_io_link = Url::getCommon($_url_params, '', false);

            if ($server_slave_replication[0]['Slave_SQL_Running'] == 'No') {
                $_url_params['sr_slave_action'] = 'start';
@ -197,7 +197,7 @@ class ReplicationGui
            }

            $_url_params['sr_slave_control_parm'] = 'SQL_THREAD';
-            $slave_control_sql_link = Url::getCommon($_url_params, '');
+            $slave_control_sql_link = Url::getCommon($_url_params, '', false);

            if ($server_slave_replication[0]['Slave_IO_Running'] == 'No'
                || $server_slave_replication[0]['Slave_SQL_Running'] == 'No'
@ -208,15 +208,15 @@ class ReplicationGui
            }

            $_url_params['sr_slave_control_parm'] = null;
-            $slave_control_full_link = Url::getCommon($_url_params, '');
+            $slave_control_full_link = Url::getCommon($_url_params, '', false);

            $_url_params['sr_slave_action'] = 'reset';
-            $slave_control_reset_link = Url::getCommon($_url_params, '');
+            $slave_control_reset_link = Url::getCommon($_url_params, '', false);

            $_url_params = $GLOBALS['url_params'];
            $_url_params['sr_take_action'] = true;
            $_url_params['sr_slave_skip_error'] = true;
-            $slave_skip_error_link = Url::getCommon($_url_params, '');
+            $slave_skip_error_link = Url::getCommon($_url_params, '', false);

            if ($server_slave_replication[0]['Slave_SQL_Running'] == 'No') {
                $html .= Message::error(
@ -233,7 +233,7 @@ class ReplicationGui
            $_url_params['sl_configure'] = true;
            $_url_params['repl_clear_scr'] = true;

-            $reconfiguremaster_link =  Url::getCommon($_url_params, '');
+            $reconfiguremaster_link =  Url::getCommon($_url_params, '', false);

            $html .= __(
                'Server is configured as slave in a replication process. Would you ' .
@ -293,7 +293,7 @@ class ReplicationGui
                    'This server is not configured as slave in a replication process. '
                    . 'Would you like to %sconfigure%s it?'
                ),
-                '<a href="server_replication.php" data-post="' . Url::getCommon($_url_params, '') . '">',
+                '<a href="server_replication.php" data-post="' . Url::getCommon($_url_params, '', false) . '">',
                '</a>'
            );
        }
@ -355,7 +355,7 @@ class ReplicationGui
                'This server is not configured as master in a replication process. '
                . 'Would you like to %sconfigure%s it?'
            ),
-            '<a href="server_replication.php" data-post="' . Url::getCommon($_url_params, '') . '">',
+            '<a href="server_replication.php" data-post="' . Url::getCommon($_url_params, '', false) . '">',
            '</a>'
        );
        $html .= '</fieldset>';
--- a/libraries/classes/Server/Privileges.php
+++ b/libraries/classes/Server/Privileges.php
@ -2844,7 +2844,7 @@ class Privileges

        $html .= ' href="server_privileges.php';
        if ($linktype == 'revoke') {
-            $html .= '" data-post="' . Url::getCommon($params, '');
+            $html .= '" data-post="' . Url::getCommon($params, '', false);
        } else {
            $html .= Url::getCommon($params);
        }
--- a/libraries/classes/Server/Status/Processes.php
+++ b/libraries/classes/Server/Status/Processes.php
@ -141,7 +141,7 @@ class Processes
            }

            $retval .= '<th>';
-            $columnUrl = Url::getCommon($column);
+            $columnUrl = Url::getCommon($column, '', false);
            $retval .= '<a href="server_status_processes.php" data-post="' . $columnUrl . '" class="sortlink">';

            $retval .= $column['column_name'];
@ -179,7 +179,7 @@ class Processes
                if (isset($_POST['sort_order'])) {
                    $url_params['sort_order'] = $_POST['sort_order'];
                }
-                $retval .= '<a href="server_status_processes.php" data-post="' . Url::getCommon($url_params, '') . '" >';
+                $retval .= '<a href="server_status_processes.php" data-post="' . Url::getCommon($url_params, '', false) . '" >';
                if ($show_full_sql) {
                    $retval .= Util::getImage('s_partialtext',
                        __('Truncate Shown Queries'), ['class' => 'icon_fulltext']);
@ -275,7 +275,7 @@ class Processes

        $retval  = '<tr>';
        $retval .= '<td><a class="ajax kill_process" href="server_status_processes.php"'
-            . ' data-post="' . Url::getCommon(['kill' => $process['Id']], '') . '">'
+            . ' data-post="' . Url::getCommon(['kill' => $process['Id']], '', false) . '">'
            . __('Kill') . '</a></td>';
        $retval .= '<td class="value">' . $process['Id'] . '</td>';
        $retval .= '<td>' . htmlspecialchars($process['User']) . '</td>';
--- a/libraries/classes/Server/UserGroups.php
+++ b/libraries/classes/Server/UserGroups.php
@ -115,7 +115,7 @@ class UserGroups
                        array(
                            'viewUsers' => 1, 'userGroup' => $groupName
                        ),
-                        ''
+                        '', false
                    )
                    . '">'
                    . Util::getIcon('b_usrlist', __('View users'))
@ -126,7 +126,7 @@ class UserGroups
                        array(
                            'editUserGroup' => 1, 'userGroup' => $groupName
                        ),
-                        ''
+                        '', false
                    )
                    . '">'
                    . Util::getIcon('b_edit', __('Edit')) . '</a>';
@ -137,7 +137,7 @@ class UserGroups
                        array(
                            'deleteUserGroup' => 1, 'userGroup' => $groupName
                        ),
-                        ''
+                        '', false
                    )
                    . '">'
                    . Util::getIcon('b_drop', __('Delete')) . '</a>';
--- a/libraries/classes/Sql.php
+++ b/libraries/classes/Sql.php
@ -227,7 +227,7 @@ class Sql
                . htmlspecialchars($_POST['curr_value'])
                . '</span>'
                . '<a href="browse_foreigners.php" data-post="'
-                . Url::getCommon($_url_params, '') . '"'
+                . Url::getCommon($_url_params, '', false) . '"'
                . 'class="ajax browse_foreign" ' . '>'
                . __('Browse foreign values')
                . '</a>';
--- a/libraries/classes/Tracking.php
+++ b/libraries/classes/Tracking.php
@ -199,20 +199,20 @@ class Tracking
            $html .= Url::getCommon($url_params + [
                'version' => $version['version'],
                'submit_delete_version' => true,
-            ], '');
+            ], '', false);
            $html .= '">' . $delete . '</a></td>';
            $html .= '<td><a href="tbl_tracking.php" data-post="';
            $html .= Url::getCommon($url_params + [
                'report' => 'true',
                'version' => $version['version'],
-            ], '');
+            ], '', false);
            $html .= '">' . $report . '</a>';
            $html .= '&nbsp;&nbsp;';
            $html .= '<a href="tbl_tracking.php" data-post="';
            $html .= Url::getCommon($url_params + [
                'snapshot' => 'true',
                'version' => $version['version'],
-            ], '');
+            ], '', false);
            $html .= '">' . $structure . '</a>';
            $html .= '</td>';
            $html .= '</tr>';
--- a/libraries/classes/Url.php
+++ b/libraries/classes/Url.php
@ -161,14 +161,15 @@ class Url
     *
     * @param mixed  $params  optional, Contains an associative array with url params
     * @param string $divider optional character to use instead of '?'
+     * @param bool   $encrypt whether to encrypt URL params
     *
     * @return string   string with URL parameters
     * @access  public
     */
-    public static function getCommon($params = array(), $divider = '?')
+    public static function getCommon($params = array(), $divider = '?', $encrypt = true)
    {
        return htmlspecialchars(
-            Url::getCommonRaw($params, $divider)
+            Url::getCommonRaw($params, $divider, $encrypt)
        );
    }

@ -197,11 +198,12 @@ class Url
     *
     * @param mixed  $params  optional, Contains an associative array with url params
     * @param string $divider optional character to use instead of '?'
+     * @param bool   $encrypt whether to encrypt URL params
     *
     * @return string   string with URL parameters
     * @access  public
     */
-    public static function getCommonRaw($params = array(), $divider = '?')
+    public static function getCommonRaw($params = array(), $divider = '?', $encrypt = true)
    {
        /** @var Config $PMA_Config */
        global $PMA_Config;
@ -219,7 +221,7 @@ class Url
            $params['lang'] = $GLOBALS['lang'];
        }

-        $query = self::buildHttpQuery($params);
+        $query = self::buildHttpQuery($params, $encrypt);

        if ($divider != '?' || strlen($query) > 0) {
            return $divider . $query;
@ -230,15 +232,17 @@ class Url

    /**
     * @param array<string, mixed> $params
+     * @param bool                 $encrypt whether to encrypt URL params
+     *
     * @return string
     */
-    public static function buildHttpQuery($params)
+    public static function buildHttpQuery($params, $encrypt = true)
    {
        global $PMA_Config;

        $separator = self::getArgSeparator();

-        if (! $PMA_Config->get('URLQueryEncryption')) {
+        if (! $encrypt || ! $PMA_Config->get('URLQueryEncryption')) {
            return http_build_query($params, null, $separator);
        }

@ -279,6 +283,7 @@ class Url

    /**
     * @param string $query
+     *
     * @return string
     */
    public static function encryptQuery($query)
@ -290,6 +295,7 @@ class Url

    /**
     * @param string $query
+     *
     * @return string|null
     */
    public static function decryptQuery($query)
--- a/setup/frames/index.inc.php
+++ b/setup/frames/index.inc.php
@ -157,7 +157,7 @@ if ($cf->getServerCount() > 0) {
            , __('Edit') , '</a>';
        echo ' | ';
        echo '<a class="delete-server" href="' . Url::getCommon(array('page' => 'servers', 'mode' => 'remove', 'id' => $id));
-        echo '" data-post="' . Url::getCommon(array('token' => $_SESSION[' PMA_token ']), '') . '">';
+        echo '" data-post="' . Url::getCommon(array('token' => $_SESSION[' PMA_token ']), '', false) . '">';
        echo __('Delete') . '</a>';
        echo '</small>';
        echo '</td>';
--- a/templates/database/tracking/tracked_tables.twig
+++ b/templates/database/tracking/tracked_tables.twig
@ -50,7 +50,7 @@
                                    'back': 'db_tracking.php',
                                    'table': version.table_name,
                                    'delete_tracking': true
-                                }, '') }}">
+                                }, '', false) }}">
                                {{ Util_getIcon('b_drop', 'Delete tracking'|trans) }}
                            </a>
                        </td>
@ -61,7 +61,7 @@
                                    'goto': 'tbl_tracking.php',
                                    'back': 'db_tracking.php',
                                    'table': version.table_name
-                                }, '') }}">
+                                }, '', false) }}">
                                {{ Util_getIcon('b_versions', 'Versions'|trans) }}
                            </a>
                            <a href="tbl_tracking.php" data-post="
@ -72,7 +72,7 @@
                                    'table': version.table_name,
                                    'report': true,
                                    'version': version.version
-                                }, '') }}">
+                                }, '', false) }}">
                                {{ Util_getIcon('b_report', 'Tracking report'|trans) }}
                            </a>
                            <a href="tbl_tracking.php" data-post="
@ -83,7 +83,7 @@
                                    'table': version.table_name,
                                    'snapshot': true,
                                    'version': version.version
-                                }, '') }}">
+                                }, '', false) }}">
                                {{ Util_getIcon('b_props', 'Structure snapshot'|trans) }}
                            </a>
                        </td>
--- a/templates/server/databases/databases_footer.twig
+++ b/templates/server/databases/databases_footer.twig
@ -67,7 +67,7 @@
    {{ Message_notice('Note: Enabling the database statistics here might cause heavy traffic between the web server and the MySQL server.'|trans) }}
    <ul>
        <li class="li_switch_dbstats">
-            <a href="server_databases.php" data-post="{{ Url_getCommon({'dbstats': '1'}, '') }}" title="{% trans 'Enable statistics' %}">
+            <a href="server_databases.php" data-post="{{ Url_getCommon({'dbstats': '1'}, '', false) }}" title="{% trans 'Enable statistics' %}">
                <strong>{% trans 'Enable statistics' %}</strong>
            </a>
        </li>
--- a/templates/table/search/input_box.twig
+++ b/templates/table/search/input_box.twig
@ -21,7 +21,7 @@
                value="{{ criteria_values[column_index] }}"
            {% endif %} />
        <a class="ajax browse_foreign" href="browse_foreigners.php" data-post="
-            {{- Url_getCommon({'db': db, 'table': table}, '') -}}
+            {{- Url_getCommon({'db': db, 'table': table}, '', false) -}}
            &amp;field={{ column_name|url_encode }}&amp;fieldkey=
            {{- column_index }}&amp;fromsearch=1">
            {{ titles['Browse']|replace({"'": "\\'"})|raw }}
--- a/test/classes/Server/Status/ProcessesTest.php
+++ b/test/classes/Server/Status/ProcessesTest.php
@ -196,7 +196,7 @@ class ProcessesTest extends TestCase

        //validate 1: $kill_process
        $kill_process = 'href="server_status_processes.php" data-post="'
-            . Url::getCommon(['kill' => $process['id']], '') . '"';
+            . Url::getCommon(['kill' => $process['id']], '', false) . '"';
        $this->assertContains(
            $kill_process,
            $html
--- a/test/classes/Server/UserGroupsTest.php
+++ b/test/classes/Server/UserGroupsTest.php
@ -129,7 +129,7 @@ class UserGroupsTest extends TestCase
                array(
                    'viewUsers'=>1, 'userGroup'=>htmlspecialchars('usergroup')
                ),
-                ''
+                '', false
            );
        $this->assertContains(
            $url_tag,
@ -141,7 +141,7 @@ class UserGroupsTest extends TestCase
                    'editUserGroup'=>1,
                    'userGroup'=>htmlspecialchars('usergroup')
                ),
-                ''
+                '', false
            );
        $this->assertContains(
            $url_tag,
@ -153,7 +153,7 @@ class UserGroupsTest extends TestCase
                    'deleteUserGroup'=> 1,
                    'userGroup'=>htmlspecialchars('usergroup')
                ),
-                ""
+                "", false
            );
        $this->assertContains(
            $url_tag,