From c75166c3a9776bc035c0291f284ef59270b7a60e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maur=C3=ADcio=20Meneghini=20Fauth?= Date: Thu, 22 Feb 2018 11:44:06 -0300 Subject: [PATCH 01/17] Revert "Force using POST for SQL query in Util::linkOrButton" MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This reverts commit 44df4a309475479af404506dbd77588acc424637. Signed-off-by: Maurício Meneghini Fauth --- libraries/Util.php | 1 - test/classes/DisplayResultsTest.php | 123 ++++++++++++++++++++++------ 2 files changed, 98 insertions(+), 26 deletions(-) diff --git a/libraries/Util.php b/libraries/Util.php index fbc944a59c..bd6c051ed6 100644 --- a/libraries/Util.php +++ b/libraries/Util.php @@ -1822,7 +1822,6 @@ class Util if (($url_length <= $GLOBALS['cfg']['LinkLengthLimit']) && $in_suhosin_limits && ! $force_button - && strpos($url, 'sql_query=') === false ) { $tag_params_strings = array(); foreach ($tag_params as $par_name => $par_value) { diff --git a/test/classes/DisplayResultsTest.php b/test/classes/DisplayResultsTest.php index ce6b6a7bd4..065081831f 100644 --- a/test/classes/DisplayResultsTest.php +++ b/test/classes/DisplayResultsTest.php @@ -372,7 +372,6 @@ class DisplayResultsTest extends PMATestCase array('`new`.`id`' => '= 1'), '[%_PMA_CHECKBOX_DIR_%]', 'klass', - ' Edit', '`customer`.`id` = 1', '%60customer%60.%60id%60+%3D+1', - ' -Edit Edit -' + '' + . '' + . ' Edit' + . '' ) ); } @@ -490,9 +496,16 @@ class DisplayResultsTest extends PMATestCase '`customer`.`id` = 1', '%60customer%60.%60id%60+%3D+1', 'klass', - ' -Copy Copy -' + '' + . ' Copy' + . '' ) ); } @@ -547,9 +560,18 @@ class DisplayResultsTest extends PMATestCase . 'alt="Delete" class="icon ic_b_drop" /> Delete', 'DELETE FROM `Data`.`customer` WHERE `customer`.`id` = 1', 'klass', - ' -Delete Delete -
DELETE FROM `Data`.`customer` WHERE `customer`.`id` = 1
' + '' + . 'Delete ' + . 'Delete' + . '
DELETE FROM `Data`.`customer` WHERE ' + . '`customer`.`id` = 1
' ) ); } @@ -629,14 +651,40 @@ class DisplayResultsTest extends PMATestCase ' Delete', 'DELETE FROM `data`.`new` WHERE `new`.`id` = 1', - ' -Edit Edit - -Copy Copy - -Delete Delete -
DELETE FROM `data`.`new` WHERE `new`.`id` = 1
' - + ' ' + . '' + . ' Edit' + . '' + . 'Copy Copy' + . '' + . 'Delete ' + . 'Delete' + . '
DELETE FROM `data`.`new` WHERE `new`.`id` = 1' + . '
' ), array( PMA\libraries\DisplayResults::POSITION_RIGHT, @@ -675,13 +723,38 @@ class DisplayResultsTest extends PMATestCase ' Delete', 'DELETE FROM `data`.`new` WHERE `new`.`id` = 1', - ' -Delete Delete -
DELETE FROM `data`.`new` WHERE `new`.`id` = 1
-Copy Copy - -Edit Edit - ' + '' + . 'Delete Delete' + . '
DELETE FROM `data`.`new` WHERE `new`.' + . '`id` = 1
' + . 'Copy Copy' + . '' + . '' + . 'Edit Edit' + . ' ' ), array( PMA\libraries\DisplayResults::POSITION_NONE, From be7d5ee738ff70a3fb6cab44b9be8010e68625e9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Thu, 16 Nov 2017 13:04:46 +0100 Subject: [PATCH 02/17] Simplify handling of long URLs in Util::linkOrButton MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit We no longer create form, but rather rather tag the link to be handled as POST on the client side. This way the code is way simpler without need on any special case handling on server side. Fixes #13649 Signed-off-by: Michal Čihař (cherry picked from commit 3b9fb2b664632557866feb083b59743ed60d1e22) Signed-off-by: Maurício Meneghini Fauth --- js/ajax.js | 3 ++ js/functions.js | 24 +--------- js/gis_data_editor.js | 4 -- js/sql.js | 27 +++++------ libraries/Util.php | 99 ++++++++-------------------------------- libraries/common.inc.php | 67 --------------------------- 6 files changed, 34 insertions(+), 190 deletions(-) diff --git a/js/ajax.js b/js/ajax.js index 7f4ab70678..e59d8152f2 100644 --- a/js/ajax.js +++ b/js/ajax.js @@ -283,6 +283,9 @@ var AJAX = { var params = 'ajax_request=true&ajax_page_request=true'; if (! isLink) { params += '&' + $(this).serialize(); + } else if (AJAX.source.attr('data-post')) { + params += '&' + AJAX.source.attr('data-post'); + isLink = false; } if (! (history && history.pushState)) { // Add a list of menu hashes that we have in the cache to the request diff --git a/js/functions.js b/js/functions.js index 5f43f5bdff..7dd822b4e9 100644 --- a/js/functions.js +++ b/js/functions.js @@ -662,18 +662,7 @@ function confirmLink(theLink, theSqlQuery) var is_confirmed = confirm(PMA_sprintf(PMA_messages.strDoYouReally, theSqlQuery)); if (is_confirmed) { - if ($(theLink).hasClass('formLinkSubmit')) { - var name = 'is_js_confirmed'; - - if ($(theLink).attr('href').indexOf('usesubform') != -1) { - var matches = $(theLink).attr('href').substr('#').match(/usesubform\[(\d+)\]/i); - if (matches != null) { - name = 'subform[' + matches[1] + '][is_js_confirmed]'; - } - } - - $(theLink).parents('form').append(''); - } else if (typeof(theLink.href) != 'undefined') { + if (typeof(theLink.href) !== 'undefined') { theLink.href += '&is_js_confirmed=1'; } else if (typeof(theLink.form) != 'undefined') { theLink.form.action += '?is_js_confirmed=1'; @@ -4159,7 +4148,6 @@ AJAX.registerOnload('functions.js', function () { */ AJAX.registerTeardown('functions.js', function () { $(document).off('change', 'select.pageselector'); - $(document).off('click', 'a.formLinkSubmit'); $('#update_recent_tables').unbind('ready'); $('#sync_favorite_tables').unbind('ready'); }); @@ -4206,16 +4194,6 @@ AJAX.registerOnload('functions.js', function () { */ PMA_init_slider(); - /** - * Enables the text generated by PMA\libraries\Util::linkOrButton() to be clickable - */ - $(document).on('click', 'a.formLinkSubmit', function (e) { - if (! $(this).hasClass('requireConfirm')) { - submitFormLink($(this)); - return false; - } - }); - var $updateRecentTables = $('#update_recent_tables'); if ($updateRecentTables.length) { $.get( diff --git a/js/gis_data_editor.js b/js/gis_data_editor.js index 35238db7ed..5591e124ce 100644 --- a/js/gis_data_editor.js +++ b/js/gis_data_editor.js @@ -225,10 +225,6 @@ AJAX.registerTeardown('gis_data_editor.js', function () { }); AJAX.registerOnload('gis_data_editor.js', function () { - - // Remove the class that is added due to the URL being too long. - $('span.open_gis_editor a').removeClass('formLinkSubmit'); - /** * Prepares and insert the GIS data to the input field on clicking 'copy'. */ diff --git a/js/sql.js b/js/sql.js index 376f8a090e..a6473710db 100644 --- a/js/sql.js +++ b/js/sql.js @@ -168,23 +168,18 @@ AJAX.registerOnload('sql.js', function () { var $link = $(this); $link.PMA_confirm(question, $link.attr('href'), function (url) { $msgbox = PMA_ajaxShowMessage(); - if ($link.hasClass('formLinkSubmit')) { - submitFormLink($link); - } else { - var params = { - 'ajax_request': true, - 'is_js_confirmed': true, - 'token': PMA_commonParams.get('token') - }; - $.post(url, params, function (data) { - if (data.success) { - PMA_ajaxShowMessage(data.message); - $link.closest('tr').remove(); - } else { - PMA_ajaxShowMessage(data.error, false); - } - }); + var params = 'ajax_request=1&is_js_confirmed=1'; + if ($link.attr('data-post')) { + params += '&' + $link.attr('data-post'); } + $.post(url, params, function (data) { + if (data.success) { + PMA_ajaxShowMessage(data.message); + $link.closest('tr').remove(); + } else { + PMA_ajaxShowMessage(data.error, false); + } + }); }); }); diff --git a/libraries/Util.php b/libraries/Util.php index bd6c051ed6..0a8e028d8b 100644 --- a/libraries/Util.php +++ b/libraries/Util.php @@ -1819,89 +1819,28 @@ class Util } } - if (($url_length <= $GLOBALS['cfg']['LinkLengthLimit']) - && $in_suhosin_limits - && ! $force_button + $tag_params_strings = array(); + if (($url_length > $GLOBALS['cfg']['LinkLengthLimit']) + || ! $in_suhosin_limits + || $force_button ) { - $tag_params_strings = array(); - foreach ($tag_params as $par_name => $par_value) { - // htmlspecialchars() only on non javascript - $par_value = mb_substr($par_name, 0, 2) == 'on' - ? $par_value - : htmlspecialchars($par_value); - $tag_params_strings[] = $par_name . '="' . $par_value . '"'; - } + $parts = explode('?', $url, 2); + /* + * The data-post indicates that client should do POST + * this is handled in js/ajax.js + */ + $tag_params_strings[] = 'data-post="' . (isset($parts[1]) ? $parts[1] : '') . '"'; + $url = $parts[0]; + } - // no whitespace within an else Safari will make it part of the link - $ret = '' - . $message . $displayed_message . ''; - } else { - // no spaces (line breaks) at all - // or after the hidden fields - // IE will display them all + foreach ($tag_params as $par_name => $par_value) { + $tag_params_strings[] = $par_name . '="' . htmlspecialchars($par_value) . '"'; + } - if (! isset($query_parts)) { - $query_parts = self::splitURLQuery($url); - } - $url_parts = parse_url($url); - - if ($new_form) { - if ($target) { - $target = ' target="' . $target . '"'; - } - $ret = '
'; - $ret .= URL::getHiddenInputs(); - $subname_open = ''; - $subname_close = ''; - $submit_link = '#'; - } else { - $query_parts[] = 'redirect=' . $url_parts['path']; - $query_parts[] = 'token=' . $_SESSION[' PMA_token ']; - if (empty($GLOBALS['subform_counter'])) { - $GLOBALS['subform_counter'] = 0; - } - $GLOBALS['subform_counter']++; - $ret = ''; - $subname_open = 'subform[' . $GLOBALS['subform_counter'] . ']['; - $subname_close = ']'; - $submit_link = '#usesubform[' . $GLOBALS['subform_counter'] - . ']=1'; - } - - foreach ($query_parts as $query_pair) { - list($eachvar, $eachval) = explode('=', $query_pair); - $ret .= ''; - } // end while - - if (empty($tag_params['class'])) { - $tag_params['class'] = 'formLinkSubmit'; - } else { - $tag_params['class'] .= ' formLinkSubmit'; - } - - $tag_params_strings = array(); - foreach ($tag_params as $par_name => $par_value) { - // htmlspecialchars() only on non javascript - $par_value = mb_substr($par_name, 0, 2) == 'on' - ? $par_value - : htmlspecialchars($par_value); - $tag_params_strings[] = $par_name . '="' . $par_value . '"'; - } - - $ret .= "\n" . '' - . $message . ' ' . $displayed_message . '' . "\n"; - - if ($new_form) { - $ret .= '
'; - } - } // end if... else... - - return $ret; + // no whitespace within an else Safari will make it part of the link + return '' + . $message . $displayed_message . ''; } // end of the 'linkOrButton()' function /** diff --git a/libraries/common.inc.php b/libraries/common.inc.php index a6dbc60516..eceb2af18e 100644 --- a/libraries/common.inc.php +++ b/libraries/common.inc.php @@ -156,58 +156,6 @@ foreach (get_defined_vars() as $key => $value) { } unset($key, $value, $variables_whitelist); -/** - * Subforms - some functions need to be called by form, cause of the limited URL - * length, but if this functions inside another form you cannot just open a new - * form - so phpMyAdmin uses 'arrays' inside this form - * - * - *
- * ... main form elements ... - * - * ... other subform data ... - * - * ... other subforms ... - * - * ... other subform data ... - * - * ... main form elements ... - * - *
- * - * - * so we now check if a subform is submitted - */ -$__redirect = null; -if (isset($_POST['usesubform']) && ! defined('PMA_MINIMUM_COMMON')) { - // if a subform is present and should be used - // the rest of the form is deprecated - $subform_id = key($_POST['usesubform']); - $subform = $_POST['subform'][$subform_id]; - $_POST = $subform; - $_REQUEST = $subform; - /** - * some subforms need another page than the main form, so we will just - * include this page at the end of this script - we use $__redirect to - * track this - */ - if (isset($_POST['redirect']) - && $_POST['redirect'] != basename($PMA_PHP_SELF) - ) { - $__redirect = $_POST['redirect']; - unset($_POST['redirect']); - } - unset($subform_id, $subform); -} else { - // Note: here we overwrite $_REQUEST so that it does not contain cookies, - // because another application for the same domain could have set - // a cookie (with a compatible path) that overrides a variable - // we expect from GET or POST. - // We'll refer to cookies explicitly with the $_COOKIE syntax. - $_REQUEST = array_merge($_GET, $_POST); -} -// end check if a subform is submitted - /** * check timezone setting * this could produce an E_WARNING - but only once, @@ -323,13 +271,6 @@ $goto_whitelist = array( 'user_password.php', ); -/** - * check $__redirect against whitelist - */ -if (! PMA_checkPageValidity($__redirect, $goto_whitelist)) { - $__redirect = null; -} - /** * holds page that should be displayed * @global string $GLOBALS['goto'] @@ -941,14 +882,6 @@ if (count($_REQUEST) > 1000) { $GLOBALS['is_superuser'] = isset($GLOBALS['dbi']) && $GLOBALS['dbi']->isSuperuser(); -if (!empty($__redirect) && in_array($__redirect, $goto_whitelist)) { - /** - * include subform target page - */ - include $__redirect; - exit(); -} - // If Zero configuration mode enabled, check PMA tables in current db. if (! defined('PMA_MINIMUM_COMMON') && ! empty($GLOBALS['server']) From f31dfc530b49c9c04f73949545106f328f31c3ce Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Thu, 16 Nov 2017 13:17:42 +0100 Subject: [PATCH 03/17] Add tests for Util::linkOrButton MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař (cherry picked from commit 816c42665af83d8f2652c6c0e9c0d92c63526ae6) Signed-off-by: Maurício Meneghini Fauth --- test/classes/UtilTest.php | 53 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) diff --git a/test/classes/UtilTest.php b/test/classes/UtilTest.php index c02dc365e3..865a29ab9c 100644 --- a/test/classes/UtilTest.php +++ b/test/classes/UtilTest.php @@ -306,4 +306,57 @@ class UtilTest extends PMATestCase array("https://www.phpmyadmin.net/test/nothing","GET", true, false), ); } + + /** + * Test for Util::linkOrButton + * + * @return void + * + * @dataProvider linksOrButtons + */ + public function testLinkOrButton(array $params, $limit, $match) + { + $restore = isset($GLOBALS['cfg']['LinkLengthLimit']) ? $GLOBALS['cfg']['LinkLengthLimit'] : 1000; + $GLOBALS['cfg']['LinkLengthLimit'] = $limit; + try { + $result = call_user_func_array( + array('PMA\libraries\Util', 'linkOrButton'), + $params + ); + $this->assertEquals($match, $result); + } finally { + $GLOBALS['cfg']['LinkLengthLimit'] = $restore; + } + } + + /** + * Data provider for Util::linkOrButton test + * + * @return array + */ + public function linksOrButtons() + { + return [ + [ + ['index.php', 'text'], + 1000, + 'text' + ], + [ + ['index.php?some=parameter', 'text'], + 20, + 'text', + ], + [ + ['index.php', 'text', [], true, false, 'target'], + 1000, + 'text', + ], + [ + ['url.php?url=http://phpmyadmin.net/', 'text', [], true, false, '_blank'], + 1000, + 'text', + ], + ]; + } } From 6f4740e17c07b8cb4b0ec1961460ae036d27ad00 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Thu, 16 Nov 2017 14:41:26 +0100 Subject: [PATCH 04/17] Always use POST for links containing SQL query MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This way the SQL queries will not apper in the web server logs. Signed-off-by: Michal Čihař (cherry picked from commit 99e9854473155a5337fc9361d9eba4bae3d30792) Signed-off-by: Maurício Meneghini Fauth --- libraries/Util.php | 1 + test/classes/DisplayResultsTest.php | 32 ++++++++++++++--------------- 2 files changed, 17 insertions(+), 16 deletions(-) diff --git a/libraries/Util.php b/libraries/Util.php index 0a8e028d8b..1425cc2eef 100644 --- a/libraries/Util.php +++ b/libraries/Util.php @@ -1823,6 +1823,7 @@ class Util if (($url_length > $GLOBALS['cfg']['LinkLengthLimit']) || ! $in_suhosin_limits || $force_button + || strpos($url, 'sql_query=') !== false ) { $parts = explode('?', $url, 2); /* diff --git a/test/classes/DisplayResultsTest.php b/test/classes/DisplayResultsTest.php index 065081831f..e9b768589c 100644 --- a/test/classes/DisplayResultsTest.php +++ b/test/classes/DisplayResultsTest.php @@ -435,11 +435,11 @@ class DisplayResultsTest extends PMATestCase '%60customer%60.%60id%60+%3D+1', '' . '' - . ' Edit' . '' @@ -498,11 +498,11 @@ class DisplayResultsTest extends PMATestCase 'klass', '' - . ' Copy' . '' @@ -561,7 +561,7 @@ class DisplayResultsTest extends PMATestCase 'DELETE FROM `Data`.`customer` WHERE `customer`.`id` = 1', 'klass', '' - . ' ' - . '' + . '_action=update">' . ' Edit' . '' - . 'Copy Copy' . '' - . ' Delete', 'DELETE FROM `data`.`new` WHERE `new`.`id` = 1', '' - . ' Delete' . '
DELETE FROM `data`.`new` WHERE `new`.' . '`id` = 1
' - . 'Copy Copy' . '' . '' - . 'Edit Edit' . ' + \ No newline at end of file From a20b287f4036916e61d49ae70558c1922ee80666 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Fri, 15 Dec 2017 11:52:38 +0100 Subject: [PATCH 07/17] Adjust table drop operation to use POST MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Issue #13866 Signed-off-by: Michal Čihař (cherry picked from commit 8332861d62dbe130e3d4bf195707f884d89d0cb2) Signed-off-by: Maurício Meneghini Fauth --- js/db_structure.js | 2 +- templates/database/structure/structure_table_row.phtml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/js/db_structure.js b/js/db_structure.js index e10e3f1dfa..cec3ab89c1 100644 --- a/js/db_structure.js +++ b/js/db_structure.js @@ -392,7 +392,7 @@ AJAX.registerOnload('db_structure.js', function () { var $msg = PMA_ajaxShowMessage(PMA_messages.strProcessingRequest); - var params = getJSConfirmCommonParam(this); + var params = getJSConfirmCommonParam(this, $this_anchor.attr('data-post')); params.token = PMA_commonParams.get('token'); $.post(url, params, function (data) { diff --git a/templates/database/structure/structure_table_row.phtml b/templates/database/structure/structure_table_row.phtml index d8af414b84..195a408a5f 100644 --- a/templates/database/structure/structure_table_row.phtml +++ b/templates/database/structure/structure_table_row.phtml @@ -52,7 +52,7 @@ + href="sql.php" data-post="&reload=1&purge=1&sql_query=&message_to_show=" > From 9af081a4b96c6a87af50fcb42e9c42e1847d863f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Fri, 15 Dec 2017 12:13:46 +0100 Subject: [PATCH 08/17] Adjust adding table key operations to use POST MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Issue #13866 Signed-off-by: Michal Čihař (cherry picked from commit 6ee2f1284100b6aa98a3a08dc1f520c48b49ed25) Signed-off-by: Maurício Meneghini Fauth --- js/tbl_structure.js | 12 ++++++------ .../structure/action_row_in_structure_table.phtml | 2 +- .../table/structure/actions_in_table_structure.phtml | 2 +- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/js/tbl_structure.js b/js/tbl_structure.js index 8999aea700..77744fd796 100644 --- a/js/tbl_structure.js +++ b/js/tbl_structure.js @@ -297,14 +297,14 @@ AJAX.registerOnload('tbl_structure.js', function () { var question = PMA_sprintf(PMA_messages.strDoYouReally, 'ALTER TABLE `' + escapeHtml(curr_table_name) + '` ' + add_clause + '(`' + escapeHtml(curr_column_name) + '`);'); - $(this).PMA_confirm(question, $(this).attr('href'), function (url) { + var $this_anchor = $(this); + + $this_anchor.PMA_confirm(question, $this_anchor.attr('href'), function (url) { PMA_ajaxShowMessage(); AJAX.source = $this; - var params = { - 'ajax_request' : true, - 'ajax_page_request' : true, - 'token': PMA_commonParams.get('token') - }; + + var params = getJSConfirmCommonParam(this, $this_anchor.attr('data-post')); + params += '&ajax_page_request=1'; $.post(url, params, AJAX.responseHandler); }); // end $.PMA_confirm() }); //end Add key diff --git a/templates/table/structure/action_row_in_structure_table.phtml b/templates/table/structure/action_row_in_structure_table.phtml index d5dc69bfb4..1421861044 100644 --- a/templates/table/structure/action_row_in_structure_table.phtml +++ b/templates/table/structure/action_row_in_structure_table.phtml @@ -17,7 +17,7 @@ add_spatial_anchor" " - href="tbl_structure.php&add_key=1&sql_query= href="tbl_structure.php" data-post="&add_key=1&sql_query= - - &partition_maintenance=1&sql_query=&partition_maintenance=1&sql_query=getName() ) ?>" id="partition_action_" From f6bb1901f6eef097a5b827927171eb43cc5fc173 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Fri, 15 Dec 2017 12:17:49 +0100 Subject: [PATCH 11/17] Adjust optimize table to use POST MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Issue #13866 Signed-off-by: Michal Čihař (cherry picked from commit 750820519124488c6f2cb546a397de4715c7fa8b) Signed-off-by: Maurício Meneghini Fauth --- templates/table/structure/display_table_stats.phtml | 2 +- templates/table/structure/optional_action_links.phtml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/templates/table/structure/display_table_stats.phtml b/templates/table/structure/display_table_stats.phtml index e8e8710999..1a3a4f8bf6 100644 --- a/templates/table/structure/display_table_stats.phtml +++ b/templates/table/structure/display_table_stats.phtml @@ -55,7 +55,7 @@ || $tbl_storage_engine == 'BDB')): ?> - diff --git a/templates/table/structure/optional_action_links.phtml b/templates/table/structure/optional_action_links.phtml index b88dbb741a..fb0b687b1a 100644 --- a/templates/table/structure/optional_action_links.phtml +++ b/templates/table/structure/optional_action_links.phtml @@ -5,7 +5,7 @@ use PMA\libraries\Util; ?> - From 19484adb03bfc831b247d75b13d0986eb421a332 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Fri, 15 Dec 2017 12:20:57 +0100 Subject: [PATCH 12/17] Adjust field drop to use POST MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Issue #13866 Signed-off-by: Michal Čihař (cherry picked from commit 613a146e97e34e6b05d7c8c6de15afdb39d8da2b) Signed-off-by: Maurício Meneghini Fauth --- js/tbl_structure.js | 11 ++++------- templates/table/structure/table_structure_row.phtml | 2 +- 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/js/tbl_structure.js b/js/tbl_structure.js index 77744fd796..45c5e0695b 100644 --- a/js/tbl_structure.js +++ b/js/tbl_structure.js @@ -211,14 +211,11 @@ AJAX.registerOnload('tbl_structure.js', function () { * @var question String containing the question to be asked for confirmation */ var question = PMA_sprintf(PMA_messages.strDoYouReally, 'ALTER TABLE `' + escapeHtml(curr_table_name) + '` DROP `' + escapeHtml(curr_column_name) + '`;'); - $(this).PMA_confirm(question, $(this).attr('href'), function (url) { + var $this_anchor = $(this); + $this_anchor.PMA_confirm(question, $this_anchor.attr('href'), function (url) { var $msg = PMA_ajaxShowMessage(PMA_messages.strDroppingColumn, false); - var params = { - 'is_js_confirmed' : 1, - 'ajax_request' : true, - 'ajax_page_request' : true, - 'token': PMA_commonParams.get('token') - }; + var params = getJSConfirmCommonParam(this, $this_anchor.attr('data-post')); + params += '&ajax_page_request=1'; $.post(url, params, function (data) { if (typeof data !== 'undefined' && data.success === true) { PMA_ajaxRemoveMessage($msg); diff --git a/templates/table/structure/table_structure_row.phtml b/templates/table/structure/table_structure_row.phtml index c7306c9366..175bd46181 100644 --- a/templates/table/structure/table_structure_row.phtml +++ b/templates/table/structure/table_structure_row.phtml @@ -46,7 +46,7 @@ - From 8f9f8aa3b5dba8df743f3dffea3fb5731acb2e38 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Fri, 15 Dec 2017 12:35:00 +0100 Subject: [PATCH 13/17] Adjust RTE oprations to use POST MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Issue #13866 Signed-off-by: Michal Čihař (cherry picked from commit 2bc87216f0c39e11ea8efd6bedd903aa8ffb51f9) Signed-off-by: Maurício Meneghini Fauth --- js/rte.js | 12 ++--------- libraries/rte/rte_list.lib.php | 38 ++++++++++++++-------------------- 2 files changed, 18 insertions(+), 32 deletions(-) diff --git a/js/rte.js b/js/rte.js index 572f385ddd..c599439d06 100644 --- a/js/rte.js +++ b/js/rte.js @@ -402,11 +402,7 @@ RTE.COMMON = { * the AJAX message shown to the user */ var $msg = PMA_ajaxShowMessage(PMA_messages.strProcessingRequest); - var params = { - 'is_js_confirmed': 1, - 'ajax_request': true, - 'token': PMA_commonParams.get('token') - }; + var params = getJSConfirmCommonParam(this, $this.attr('data-post')); $.post(url, params, function (data) { if (data.success === true) { /** @@ -481,11 +477,7 @@ RTE.COMMON = { * @var $curr_row Object containing reference to the current row */ var $curr_row = $anchor.parents('tr'); - var params = { - 'is_js_confirmed': 1, - 'ajax_request': true, - 'token': PMA_commonParams.get('token') - }; + var params = getJSConfirmCommonParam(this, $anchor.attr('data-post')); $.post($anchor.attr('href'), params, function (data) { returnCount++; if (data.success === true) { diff --git a/libraries/rte/rte_list.lib.php b/libraries/rte/rte_list.lib.php index 8d95cf2340..be7184ec75 100644 --- a/libraries/rte/rte_list.lib.php +++ b/libraries/rte/rte_list.lib.php @@ -8,6 +8,7 @@ use PMA\libraries\Response; use PMA\libraries\URL; use PMA\libraries\Template; +use PMA\libraries\Util; use PhpMyAdmin\SqlParser\Statements\CreateStatement; if (! defined('PHPMYADMIN')) { @@ -305,13 +306,11 @@ function PMA_RTN_getRowForList($routine, $rowclass = '') } $retval .= " \n"; $retval .= " \n"; - $retval .= ' ' . $titles['Drop'] . "\n"; + $retval .= Util::linkOrButton( + 'sql.php' . $url_query . '&sql_query=' . urlencode($sql_drop) . '&goto=db_routines.php' . urlencode("?db={$db}"), + $titles['Drop'], + ['class' => 'ajax drop_anchor'] + ); $retval .= " \n"; $retval .= " \n"; $retval .= " {$routine['type']}\n"; @@ -381,14 +380,11 @@ function PMA_TRI_getRowForList($trigger, $rowclass = '') $retval .= " \n"; $retval .= " \n"; if (PMA\libraries\Util::currentUserHasPrivilege('TRIGGER', $db)) { - $retval .= ' ' . $titles['Drop'] . "\n"; + $retval .= Util::linkOrButton( + 'sql.php' . $url_query . '&sql_query=' . urlencode($trigger['drop']) . '&goto=db_triggers.php' . urlencode("?db={$db}"), + $titles['Drop'], + ['class' => 'ajax drop_anchor'] + ); } else { $retval .= " {$titles['NoDrop']}\n"; } @@ -462,13 +458,11 @@ function PMA_EVN_getRowForList($event, $rowclass = '') $retval .= " \n"; $retval .= " \n"; if (PMA\libraries\Util::currentUserHasPrivilege('EVENT', $db)) { - $retval .= ' ' . $titles['Drop'] . "\n"; + $retval .= Util::linkOrButton( + 'sql.php' . $url_query . '&sql_query=' . urlencode($sql_drop) . '&goto=db_events.php' . urlencode("?db={$db}"), + $titles['Drop'], + ['class' => 'ajax drop_anchor'] + ); } else { $retval .= " {$titles['NoDrop']}\n"; } From fc378b0bd3c034515fac6436713e24f24c4b792d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Fri, 15 Dec 2017 12:37:02 +0100 Subject: [PATCH 14/17] Adjust table operations to use POST MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Issue #13866 Signed-off-by: Michal Čihař (cherry picked from commit 6b5d535da547600b46b8077d8f69f663374d6e3e) Signed-off-by: Maurício Meneghini Fauth --- libraries/operations.lib.php | 10 +++++----- test/libraries/PMA_operations_test.php | 1 + 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/libraries/operations.lib.php b/libraries/operations.lib.php index fa64146ea6..8955b38934 100644 --- a/libraries/operations.lib.php +++ b/libraries/operations.lib.php @@ -1471,11 +1471,11 @@ function PMA_getListofMaintainActionLink($pma_table, $url_params) function PMA_getMaintainActionlink($action_message, $params, $url_params, $link) { return '
  • ' - . '' - . $action_message - . '' + . Util::linkOrButton( + 'sql.php' . URL::getCommon(array_merge($url_params, $params)), + $action_message, + ['class' => 'maintain_action ajax'] + ) . Util::showMySQLDocu($link) . '
    • '; } diff --git a/test/libraries/PMA_operations_test.php b/test/libraries/PMA_operations_test.php index 8a88a58011..cb13818b2d 100644 --- a/test/libraries/PMA_operations_test.php +++ b/test/libraries/PMA_operations_test.php @@ -37,6 +37,7 @@ class PMA_Operations_Test extends PHPUnit_Framework_TestCase $GLOBALS['cfg'] = array( 'ServerDefault' => 1, 'ActionLinksMode' => 'icons', + 'LinkLengthLimit' => 1000, ); $GLOBALS['cfg']['DBG']['sql'] = false; $GLOBALS['server'] = 1; From 1f00c99be950a2173fe5dc1c51410c88c83fe6ff Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Mon, 8 Jan 2018 17:35:32 +0100 Subject: [PATCH 15/17] Share code for parsing data-post attribute MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It can include leading question mark and we should deal with it in all locations. Fixes #13913 Signed-off-by: Michal Čihař (cherry picked from commit 1fc566fd90d838d35dfa5251f26deb48d15780a7) Signed-off-by: Maurício Meneghini Fauth --- js/ajax.js | 8 ++------ js/db_structure.js | 6 ++---- js/functions.js | 12 ++++++++++++ js/rte.js | 4 ++-- js/sql.js | 5 +++-- js/tbl_structure.js | 4 ++-- 6 files changed, 23 insertions(+), 16 deletions(-) diff --git a/js/ajax.js b/js/ajax.js index f5a1553586..ab62c27a9a 100644 --- a/js/ajax.js +++ b/js/ajax.js @@ -281,15 +281,11 @@ var AJAX = { var url = isLink ? href : $(this).attr('action'); var params = 'ajax_request=true&ajax_page_request=true'; - var dataPost = AJAX.source.attr('data-post'); + var dataPost = AJAX.source.getPostData(); if (! isLink) { params += '&' + $(this).serialize(); } else if (dataPost) { - // Strip possible leading ? - if (dataPost.startsWith('?')) { - dataPost = dataPost.substr(1); - } - params += '&' + AJAX.source.attr('data-post'); + params += '&' + dataPost; isLink = false; } if (! (history && history.pushState)) { diff --git a/js/db_structure.js b/js/db_structure.js index cec3ab89c1..f36cb2d023 100644 --- a/js/db_structure.js +++ b/js/db_structure.js @@ -328,8 +328,7 @@ AJAX.registerOnload('db_structure.js', function () { PMA_ajaxShowMessage(PMA_messages.strProcessingRequest); - var params = getJSConfirmCommonParam(this, $this_anchor.attr('data-post')); - params.token = PMA_commonParams.get('token'); + var params = getJSConfirmCommonParam(this, $this_anchor.getPostData()); $.post(url, params, function (data) { if (typeof data !== 'undefined' && data.success === true) { @@ -392,8 +391,7 @@ AJAX.registerOnload('db_structure.js', function () { var $msg = PMA_ajaxShowMessage(PMA_messages.strProcessingRequest); - var params = getJSConfirmCommonParam(this, $this_anchor.attr('data-post')); - params.token = PMA_commonParams.get('token'); + var params = getJSConfirmCommonParam(this, $this_anchor.getPostData()); $.post(url, params, function (data) { if (typeof data !== 'undefined' && data.success === true) { diff --git a/js/functions.js b/js/functions.js index 46f4faf49b..e94b0a262e 100644 --- a/js/functions.js +++ b/js/functions.js @@ -4973,3 +4973,15 @@ AJAX.registerOnload('functions.js', function(){ } }); }); + +/** + * Return POST data as stored by Util::linkOrButton + */ +jQuery.fn.getPostData = function() { + var dataPost = this.attr('data-post'); + // Strip possible leading ? + if (dataPost.startsWith('?')) { + dataPost = dataPost.substr(1); + } + return dataPost; +}; diff --git a/js/rte.js b/js/rte.js index c599439d06..c31ccad143 100644 --- a/js/rte.js +++ b/js/rte.js @@ -402,7 +402,7 @@ RTE.COMMON = { * the AJAX message shown to the user */ var $msg = PMA_ajaxShowMessage(PMA_messages.strProcessingRequest); - var params = getJSConfirmCommonParam(this, $this.attr('data-post')); + var params = getJSConfirmCommonParam(this, $this.getPostData()); $.post(url, params, function (data) { if (data.success === true) { /** @@ -477,7 +477,7 @@ RTE.COMMON = { * @var $curr_row Object containing reference to the current row */ var $curr_row = $anchor.parents('tr'); - var params = getJSConfirmCommonParam(this, $anchor.attr('data-post')); + var params = getJSConfirmCommonParam(this, $anchor.getPostData()); $.post($anchor.attr('href'), params, function (data) { returnCount++; if (data.success === true) { diff --git a/js/sql.js b/js/sql.js index a6473710db..57b0c185fa 100644 --- a/js/sql.js +++ b/js/sql.js @@ -169,8 +169,9 @@ AJAX.registerOnload('sql.js', function () { $link.PMA_confirm(question, $link.attr('href'), function (url) { $msgbox = PMA_ajaxShowMessage(); var params = 'ajax_request=1&is_js_confirmed=1'; - if ($link.attr('data-post')) { - params += '&' + $link.attr('data-post'); + var postData = $link.getPostData(); + if (postData) { + params += '&' + postData; } $.post(url, params, function (data) { if (data.success) { diff --git a/js/tbl_structure.js b/js/tbl_structure.js index 45c5e0695b..d66c1141ff 100644 --- a/js/tbl_structure.js +++ b/js/tbl_structure.js @@ -214,7 +214,7 @@ AJAX.registerOnload('tbl_structure.js', function () { var $this_anchor = $(this); $this_anchor.PMA_confirm(question, $this_anchor.attr('href'), function (url) { var $msg = PMA_ajaxShowMessage(PMA_messages.strDroppingColumn, false); - var params = getJSConfirmCommonParam(this, $this_anchor.attr('data-post')); + var params = getJSConfirmCommonParam(this, $this_anchor.getPostData()); params += '&ajax_page_request=1'; $.post(url, params, function (data) { if (typeof data !== 'undefined' && data.success === true) { @@ -300,7 +300,7 @@ AJAX.registerOnload('tbl_structure.js', function () { PMA_ajaxShowMessage(); AJAX.source = $this; - var params = getJSConfirmCommonParam(this, $this_anchor.attr('data-post')); + var params = getJSConfirmCommonParam(this, $this_anchor.getPostData()); params += '&ajax_page_request=1'; $.post(url, params, AJAX.responseHandler); }); // end $.PMA_confirm() From 60032ce9de24fe2a329e77b36c20a810f881bace Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maur=C3=ADcio=20Meneghini=20Fauth?= Date: Mon, 8 Jan 2018 17:12:44 -0200 Subject: [PATCH 16/17] Fix getPostData function MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit dataPost can be undefined Signed-off-by: Maurício Meneghini Fauth (cherry picked from commit 367f49b12bb15f7891abeac22c7f5be538e39af1) Signed-off-by: Maurício Meneghini Fauth --- js/functions.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/js/functions.js b/js/functions.js index e94b0a262e..07dd31d54f 100644 --- a/js/functions.js +++ b/js/functions.js @@ -4980,7 +4980,7 @@ AJAX.registerOnload('functions.js', function(){ jQuery.fn.getPostData = function() { var dataPost = this.attr('data-post'); // Strip possible leading ? - if (dataPost.startsWith('?')) { + if (dataPost !== undefined && dataPost.startsWith('?')) { dataPost = dataPost.substr(1); } return dataPost; From 031c832fd7ee3a3dc06169e0d4371def34b5a016 Mon Sep 17 00:00:00 2001 From: Gemorroj Date: Sat, 17 Feb 2018 16:14:49 +0300 Subject: [PATCH 17/17] Update tbl_operations.js MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit fix maintenance operations Signed-off-by: Gemorroj (cherry picked from commit b3c9a0c115d6d24f5f94ed2e0a8c2276f4aab8c2) Signed-off-by: Maurício Meneghini Fauth --- js/tbl_operations.js | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-) diff --git a/js/tbl_operations.js b/js/tbl_operations.js index f5a02a5999..3783058e40 100644 --- a/js/tbl_operations.js +++ b/js/tbl_operations.js @@ -128,6 +128,8 @@ AJAX.registerOnload('tbl_operations.js', function () { **/ $(document).on('click', "#tbl_maintenance li a.maintain_action.ajax", function (event) { event.preventDefault(); + var $link = $(this); + if ($(".sqlqueryresults").length !== 0) { $(".sqlqueryresults").remove(); } @@ -135,12 +137,16 @@ AJAX.registerOnload('tbl_operations.js', function () { $(".result_query").remove(); } //variables which stores the common attributes - var params = { + var params = $.param({ ajax_request: 1, - server: PMA_commonParams.get('server'), - token: PMA_commonParams.get('token') - }; - $.post($(this).attr('href'), params, function (data) { + server: PMA_commonParams.get('server') + }); + var postData = $link.getPostData(); + if (postData) { + params += '&' + postData; + } + + $.post($link.attr('href'), params, function (data) { function scrollToTop() { $('html, body').animate({ scrollTop: 0 }); } @@ -152,7 +158,7 @@ AJAX.registerOnload('tbl_operations.js', function () { PMA_highlightSQL($('#page_content')); scrollToTop(); } else if (typeof data !== 'undefined' && data.success === true) { - var $temp_div = $("
    "); + $temp_div = $('
    '); $temp_div.html(data.message); var $success = $temp_div.find(".result_query .success"); PMA_ajaxShowMessage($success); @@ -165,7 +171,14 @@ AJAX.registerOnload('tbl_operations.js', function () { } else { $temp_div = $("
    "); $temp_div.html(data.error); - var $error = $temp_div.find("code").addClass("error"); + + var $error; + if ($temp_div.find('.error code').length !== 0) { + $error = $temp_div.find('.error code').addClass('error'); + } else { + $error = $temp_div; + } + PMA_ajaxShowMessage($error, false); } }); // end $.post()