diff --git a/ajax.php b/ajax.php index 5f4fc8c22f..7f615a018c 100644 --- a/ajax.php +++ b/ajax.php @@ -27,19 +27,19 @@ switch ($_POST['type']) { break; case 'list-tables': Util::checkParameters(array('db'), true); - $response->addJSON('tables', $GLOBALS['dbi']->getTables($_REQUEST['db'])); + $response->addJSON('tables', $GLOBALS['dbi']->getTables($_POST['db'])); break; case 'list-columns': Util::checkParameters(array('db', 'table'), true); - $response->addJSON('columns', $GLOBALS['dbi']->getColumnNames($_REQUEST['db'], $_REQUEST['table'])); + $response->addJSON('columns', $GLOBALS['dbi']->getColumnNames($_POST['db'], $_POST['table'])); break; case 'config-get': Util::checkParameters(array('key'), true); - $response->addJSON('value', $GLOBALS['PMA_Config']->get($_REQUEST['key'])); + $response->addJSON('value', $GLOBALS['PMA_Config']->get($_POST['key'])); break; case 'config-set': Util::checkParameters(array('key', 'value'), true); - $result = $GLOBALS['PMA_Config']->setUserValue(null, $_REQUEST['key'], json_decode($_REQUEST['value'])); + $result = $GLOBALS['PMA_Config']->setUserValue(null, $_POST['key'], json_decode($_POST['value'])); if ($result !== true) { $response = Response::getInstance(); $response->setRequestStatus(false); diff --git a/browse_foreigners.php b/browse_foreigners.php index 0ae36334d1..f3c3fab41b 100644 --- a/browse_foreigners.php +++ b/browse_foreigners.php @@ -14,7 +14,7 @@ use PhpMyAdmin\Util; require_once 'libraries/common.inc.php'; /** - * Sets globals from $_REQUEST + * Sets globals from $_POST */ $request_params = array( 'data', @@ -22,8 +22,8 @@ $request_params = array( ); foreach ($request_params as $one_request_param) { - if (isset($_REQUEST[$one_request_param])) { - $GLOBALS[$one_request_param] = $_REQUEST[$one_request_param]; + if (isset($_POST[$one_request_param])) { + $GLOBALS[$one_request_param] = $_POST[$one_request_param]; } } @@ -49,13 +49,13 @@ $browseForeigners = new BrowseForeigners( $GLOBALS['pmaThemeImage'] ); $foreign_limit = $browseForeigners->getForeignLimit( - isset($_REQUEST['foreign_showAll']) ? $_REQUEST['foreign_showAll'] : null + isset($_POST['foreign_showAll']) ? $_POST['foreign_showAll'] : null ); $foreignData = $relation->getForeignData( - $foreigners, $_REQUEST['field'], true, - isset($_REQUEST['foreign_filter']) - ? $_REQUEST['foreign_filter'] + $foreigners, $_POST['field'], true, + isset($_POST['foreign_filter']) + ? $_POST['foreign_filter'] : '', isset($foreign_limit) ? $foreign_limit : null, true // for getting value in $foreignData['the_total'] @@ -65,7 +65,7 @@ $foreignData = $relation->getForeignData( $html = $browseForeigners->getHtmlForRelationalFieldSelection( $db, $table, - $_REQUEST['field'], + $_POST['field'], $foreignData, isset($fieldkey) ? $fieldkey : null, isset($data) ? $data : null diff --git a/chk_rel.php b/chk_rel.php index f34e8300d5..fe639537f9 100644 --- a/chk_rel.php +++ b/chk_rel.php @@ -13,20 +13,20 @@ require_once 'libraries/common.inc.php'; $relation = new Relation(); // If request for creating the pmadb -if (isset($_REQUEST['create_pmadb'])) { +if (isset($_POST['create_pmadb'])) { if ($relation->createPmaDatabase()) { $relation->fixPmaTables('phpmyadmin'); } } // If request for creating all PMA tables. -if (isset($_REQUEST['fixall_pmadb'])) { +if (isset($_POST['fixall_pmadb'])) { $relation->fixPmaTables($GLOBALS['db']); } $cfgRelation = $relation->getRelationsParam(); // If request for creating missing PMA tables. -if (isset($_REQUEST['fix_pmadb'])) { +if (isset($_POST['fix_pmadb'])) { $relation->fixPmaTables($cfgRelation['db']); } diff --git a/db_central_columns.php b/db_central_columns.php index 0f92d3ab0c..6eebb40a0a 100644 --- a/db_central_columns.php +++ b/db_central_columns.php @@ -84,9 +84,9 @@ $pmadb = $cfgCentralColumns['db']; $pmatable = $cfgCentralColumns['table']; $max_rows = intval($GLOBALS['cfg']['MaxRows']); -if (isset($_REQUEST['edit_central_columns_page'])) { - $selected_fld = $_REQUEST['selected_fld']; - $selected_db = $_REQUEST['db']; +if (isset($_POST['edit_central_columns_page'])) { + $selected_fld = $_POST['selected_fld']; + $selected_db = $_POST['db']; $edit_central_column_page = $centralColumns->getHtmlForEditingPage( $selected_fld, $selected_db @@ -109,15 +109,15 @@ if (isset($_POST['delete_save'])) { false ); } -if (!empty($_REQUEST['total_rows']) - && Core::isValid($_REQUEST['total_rows'], 'integer') +if (!empty($_POST['total_rows']) + && Core::isValid($_POST['total_rows'], 'integer') ) { - $total_rows = $_REQUEST['total_rows']; + $total_rows = $_POST['total_rows']; } else { $total_rows = $centralColumns->getCount($db); } -if (Core::isValid($_REQUEST['pos'], 'integer')) { - $pos = intval($_REQUEST['pos']); +if (Core::isValid($_POST['pos'], 'integer')) { + $pos = intval($_POST['pos']); } else { $pos = 0; } diff --git a/db_designer.php b/db_designer.php index da9ea0a6d0..df9a866a23 100644 --- a/db_designer.php +++ b/db_designer.php @@ -18,17 +18,17 @@ $designerCommon = new Common(); if (isset($_REQUEST['dialog'])) { - if ($_REQUEST['dialog'] == 'edit') { + if ($_GET['dialog'] == 'edit') { $html = $databaseDesigner->getHtmlForEditOrDeletePages($GLOBALS['db'], 'editPage'); - } elseif ($_REQUEST['dialog'] == 'delete') { + } elseif ($_GET['dialog'] == 'delete') { $html = $databaseDesigner->getHtmlForEditOrDeletePages($GLOBALS['db'], 'deletePage'); - } elseif ($_REQUEST['dialog'] == 'save_as') { + } elseif ($_GET['dialog'] == 'save_as') { $html = $databaseDesigner->getHtmlForPageSaveAs($GLOBALS['db']); - } elseif ($_REQUEST['dialog'] == 'export') { + } elseif ($_GET['dialog'] == 'export') { $html = $databaseDesigner->getHtmlForSchemaExport( - $GLOBALS['db'], $_REQUEST['selected_page'] + $GLOBALS['db'], $_GET['selected_page'] ); - } elseif ($_REQUEST['dialog'] == 'add_table') { + } elseif ($_POST['dialog'] == 'add_table') { $script_display_field = $designerCommon->getTablesInfo(); $required = $GLOBALS['db'] . '.' . $GLOBALS['table']; $tab_column = $designerCommon->getColumnsInfo(); @@ -56,50 +56,50 @@ if (isset($_REQUEST['dialog'])) { return; } -if (isset($_REQUEST['operation'])) { +if (isset($_POST['operation'])) { - if ($_REQUEST['operation'] == 'deletePage') { - $success = $designerCommon->deletePage($_REQUEST['selected_page']); + if ($_POST['operation'] == 'deletePage') { + $success = $designerCommon->deletePage($_POST['selected_page']); $response->setRequestStatus($success); - } elseif ($_REQUEST['operation'] == 'savePage') { - if ($_REQUEST['save_page'] == 'same') { - $page = $_REQUEST['selected_page']; + } elseif ($_POST['operation'] == 'savePage') { + if ($_POST['save_page'] == 'same') { + $page = $_POST['selected_page']; } else { // new - $page = $designerCommon->createNewPage($_REQUEST['selected_value'], $GLOBALS['db']); + $page = $designerCommon->createNewPage($_POST['selected_value'], $GLOBALS['db']); $response->addJSON('id', $page); } $success = $designerCommon->saveTablePositions($page); $response->setRequestStatus($success); - } elseif ($_REQUEST['operation'] == 'setDisplayField') { + } elseif ($_POST['operation'] == 'setDisplayField') { $designerCommon->saveDisplayField( - $_REQUEST['db'], $_REQUEST['table'], $_REQUEST['field'] + $_POST['db'], $_POST['table'], $_POST['field'] ); $response->setRequestStatus(true); - } elseif ($_REQUEST['operation'] == 'addNewRelation') { + } elseif ($_POST['operation'] == 'addNewRelation') { list($success, $message) = $designerCommon->addNewRelation( - $_REQUEST['db'], - $_REQUEST['T1'], - $_REQUEST['F1'], - $_REQUEST['T2'], - $_REQUEST['F2'], - $_REQUEST['on_delete'], - $_REQUEST['on_update'], - $_REQUEST['DB1'], - $_REQUEST['DB2'] + $_POST['db'], + $_POST['T1'], + $_POST['F1'], + $_POST['T2'], + $_POST['F2'], + $_POST['on_delete'], + $_POST['on_update'], + $_POST['DB1'], + $_POST['DB2'] ); $response->setRequestStatus($success); $response->addJSON('message', $message); - } elseif ($_REQUEST['operation'] == 'removeRelation') { + } elseif ($_POST['operation'] == 'removeRelation') { list($success, $message) = $designerCommon->removeRelation( - $_REQUEST['T1'], - $_REQUEST['F1'], - $_REQUEST['T2'], - $_REQUEST['F2'] + $_POST['T1'], + $_POST['F1'], + $_POST['T2'], + $_POST['F2'] ); $response->setRequestStatus($success); $response->addJSON('message', $message); - } elseif ($_REQUEST['operation'] == 'save_setting_value') { - $success = $designerCommon->saveSetting($_REQUEST['index'], $_REQUEST['value']); + } elseif ($_POST['operation'] == 'save_setting_value') { + $success = $designerCommon->saveSetting($_POST['index'], $_POST['value']); $response->setRequestStatus($success); } @@ -118,13 +118,13 @@ $classes_side_menu = $databaseDesigner->returnClassNamesFromMenuButtons(); $display_page = -1; $selected_page = null; -if (isset($_REQUEST['query'])) { - $display_page = $designerCommon->getDefaultPage($_REQUEST['db']); +if (isset($_GET['query'])) { + $display_page = $designerCommon->getDefaultPage($_GET['db']); } else { - if (! empty($_REQUEST['page'])) { - $display_page = $_REQUEST['page']; + if (! empty($_GET['page'])) { + $display_page = $_GET['page']; } else { - $display_page = $designerCommon->getLoadingPage($_REQUEST['db']); + $display_page = $designerCommon->getLoadingPage($_GET['db']); } } if ($display_page != -1) { @@ -173,7 +173,7 @@ $response->addHTML( ); $response->addHTML( $databaseDesigner->getPageMenu( - isset($_REQUEST['query']), + isset($_GET['query']), $selected_page, $classes_side_menu ) @@ -203,7 +203,7 @@ $response->addHTML('
'); $response->addHTML($databaseDesigner->getNewRelationPanel()); $response->addHTML($databaseDesigner->getDeleteRelationPanel()); -if (isset($_REQUEST['query'])) { +if (isset($_GET['query'])) { $response->addHTML($databaseDesigner->getOptionsPanel()); $response->addHTML($databaseDesigner->getRenameToPanel()); $response->addHTML($databaseDesigner->getHavingQueryPanel()); diff --git a/db_export.php b/db_export.php index b04a8b0193..74010befbd 100644 --- a/db_export.php +++ b/db_export.php @@ -56,8 +56,8 @@ if ($num_tables < 1) { } // end if $multi_values = '
'; -if (isset($_GET['structure_or_data_forced'])) { - $force_val = htmlspecialchars($_GET['structure_or_data_forced']); +if (isset($_POST['structure_or_data_forced'])) { + $force_val = htmlspecialchars($_POST['structure_or_data_forced']); } else { $force_val = 0; } @@ -84,19 +84,19 @@ if (!empty($_POST['selected_tbl']) && empty($table_select)) { $table_select = $_POST['selected_tbl']; } -// Check if the selected tables are defined in $_GET +// Check if the selected tables are defined in $_POST // (from clicking Back button on export.php) foreach (array('table_select', 'table_structure', 'table_data') as $one_key) { - if (isset($_GET[$one_key])) { - $_GET[$one_key] = urldecode($_GET[$one_key]); - $_GET[$one_key] = explode(",", $_GET[$one_key]); + if (isset($_POST[$one_key])) { + $_POST[$one_key] = urldecode($_POST[$one_key]); + $_POST[$one_key] = explode(",", $_POST[$one_key]); } } foreach ($tables as $each_table) { - if (isset($_GET['table_select']) && is_array($_GET['table_select'])) { + if (isset($_POST['table_select']) && is_array($_POST['table_select'])) { $is_checked = Export::getCheckedClause( - $each_table['Name'], $_GET['table_select'] + $each_table['Name'], $_POST['table_select'] ); } elseif (isset($table_select)) { $is_checked = Export::getCheckedClause( @@ -105,16 +105,16 @@ foreach ($tables as $each_table) { } else { $is_checked = ' checked="checked"'; } - if (isset($_GET['table_structure']) && is_array($_GET['table_structure'])) { + if (isset($_POST['table_structure']) && is_array($_POST['table_structure'])) { $structure_checked = Export::getCheckedClause( - $each_table['Name'], $_GET['table_structure'] + $each_table['Name'], $_POST['table_structure'] ); } else { $structure_checked = $is_checked; } - if (isset($_GET['table_data']) && is_array($_GET['table_data'])) { + if (isset($_POST['table_data']) && is_array($_POST['table_data'])) { $data_checked = Export::getCheckedClause( - $each_table['Name'], $_GET['table_data'] + $each_table['Name'], $_POST['table_data'] ); } else { $data_checked = $is_checked; diff --git a/db_operations.php b/db_operations.php index 70c0d53877..c5e99783b5 100644 --- a/db_operations.php +++ b/db_operations.php @@ -46,31 +46,31 @@ $operations = new Operations(); * Rename/move or copy database */ if (strlen($GLOBALS['db']) > 0 - && (! empty($_REQUEST['db_rename']) || ! empty($_REQUEST['db_copy'])) + && (! empty($_POST['db_rename']) || ! empty($_POST['db_copy'])) ) { - if (! empty($_REQUEST['db_rename'])) { + if (! empty($_POST['db_rename'])) { $move = true; } else { $move = false; } - if (! isset($_REQUEST['newname']) || strlen($_REQUEST['newname']) === 0) { + if (! isset($_POST['newname']) || strlen($_POST['newname']) === 0) { $message = Message::error(__('The database name is empty!')); } else { // lower_case_table_names=1 `DB` becomes `db` if ($GLOBALS['dbi']->getLowerCaseNames() === '1') { - $_REQUEST['newname'] = mb_strtolower( - $_REQUEST['newname'] + $_POST['newname'] = mb_strtolower( + $_POST['newname'] ); } - if ($_REQUEST['newname'] === $_REQUEST['db']) { + if ($_POST['newname'] === $_REQUEST['db']) { $message = Message::error( __('Cannot copy database to the same name. Change the name and try again.') ); } else { $_error = false; - if ($move || ! empty($_REQUEST['create_database_before_copying'])) { + if ($move || ! empty($_POST['create_database_before_copying'])) { $operations->createDbBeforeCopy(); } @@ -135,10 +135,10 @@ if (strlen($GLOBALS['db']) > 0 $operations->duplicateBookmarks($_error, $GLOBALS['db']); if (! $_error && $move) { - if (isset($_REQUEST['adjust_privileges']) - && ! empty($_REQUEST['adjust_privileges']) + if (isset($_POST['adjust_privileges']) + && ! empty($_POST['adjust_privileges']) ) { - $operations->adjustPrivilegesMoveDb($GLOBALS['db'], $_REQUEST['newname']); + $operations->adjustPrivilegesMoveDb($GLOBALS['db'], $_POST['newname']); } /** @@ -156,19 +156,19 @@ if (strlen($GLOBALS['db']) > 0 __('Database %1$s has been renamed to %2$s.') ); $message->addParam($GLOBALS['db']); - $message->addParam($_REQUEST['newname']); + $message->addParam($_POST['newname']); } elseif (! $_error) { - if (isset($_REQUEST['adjust_privileges']) - && ! empty($_REQUEST['adjust_privileges']) + if (isset($_POST['adjust_privileges']) + && ! empty($_POST['adjust_privileges']) ) { - $operations->adjustPrivilegesCopyDb($GLOBALS['db'], $_REQUEST['newname']); + $operations->adjustPrivilegesCopyDb($GLOBALS['db'], $_POST['newname']); } $message = Message::success( __('Database %1$s has been copied to %2$s.') ); $message->addParam($GLOBALS['db']); - $message->addParam($_REQUEST['newname']); + $message->addParam($_POST['newname']); } else { $message = Message::error(); } @@ -176,13 +176,13 @@ if (strlen($GLOBALS['db']) > 0 /* Change database to be used */ if (! $_error && $move) { - $GLOBALS['db'] = $_REQUEST['newname']; + $GLOBALS['db'] = $_POST['newname']; } elseif (! $_error) { - if (isset($_REQUEST['switch_to_new']) - && $_REQUEST['switch_to_new'] == 'true' + if (isset($_POST['switch_to_new']) + && $_POST['switch_to_new'] == 'true' ) { $_SESSION['pma_switch_to_new'] = true; - $GLOBALS['db'] = $_REQUEST['newname']; + $GLOBALS['db'] = $_POST['newname']; } else { $_SESSION['pma_switch_to_new'] = false; } @@ -197,7 +197,7 @@ if (strlen($GLOBALS['db']) > 0 if ($response->isAjax()) { $response->setRequestStatus($message->isSuccess()); $response->addJSON('message', $message); - $response->addJSON('newname', $_REQUEST['newname']); + $response->addJSON('newname', $_POST['newname']); $response->addJSON( 'sql_query', Util::getMessage(null, $sql_query) @@ -218,8 +218,8 @@ $cfgRelation = $relation->getRelationsParam(); * Check if comments were updated * (must be done before displaying the menu tabs) */ -if (isset($_REQUEST['comment'])) { - $relation->setDbComment($GLOBALS['db'], $_REQUEST['comment']); +if (isset($_POST['comment'])) { + $relation->setDbComment($GLOBALS['db'], $_POST['comment']); } require 'libraries/db_common.inc.php'; @@ -247,7 +247,7 @@ if (isset($message)) { unset($message); } -$_REQUEST['db_collation'] = $GLOBALS['dbi']->getDbCollation($GLOBALS['db']); +$db_collation = $GLOBALS['dbi']->getDbCollation($GLOBALS['db']); $is_information_schema = $GLOBALS['dbi']->isSystemSchema($GLOBALS['db']); if (!$is_information_schema) { @@ -266,7 +266,7 @@ if (!$is_information_schema) { * rename database */ if ($GLOBALS['db'] != 'mysql') { - $response->addHTML($operations->getHtmlForRenameDatabase($GLOBALS['db'])); + $response->addHTML($operations->getHtmlForRenameDatabase($GLOBALS['db'], $db_collation)); } // Drop link if allowed @@ -282,12 +282,12 @@ if (!$is_information_schema) { /** * Copy database */ - $response->addHTML($operations->getHtmlForCopyDatabase($GLOBALS['db'])); + $response->addHTML($operations->getHtmlForCopyDatabase($GLOBALS['db'], $db_collation)); /** * Change database charset */ - $response->addHTML($operations->getHtmlForChangeDatabaseCharset($GLOBALS['db'], $table)); + $response->addHTML($operations->getHtmlForChangeDatabaseCharset($GLOBALS['db'], $db_collation)); if (! $cfgRelation['allworks'] && $cfg['PmaNoRelation_DisableWarning'] == false @@ -298,7 +298,7 @@ if (!$is_information_schema) { '%sFind out why%s.' ) ); - $message->addParamHtml(''); + $message->addParamHtml(''); $message->addParamHtml(''); /* Show error if user has configured something, notice elsewhere */ if (!empty($cfg['Servers'][$server]['pmadb'])) { diff --git a/db_qbe.php b/db_qbe.php index 12403b6972..e25268766e 100644 --- a/db_qbe.php +++ b/db_qbe.php @@ -37,36 +37,36 @@ if ($cfgRelation['savedsearcheswork']) { //Get saved search list. $savedSearch = new SavedSearches($GLOBALS); $savedSearch->setUsername($GLOBALS['cfg']['Server']['user']) - ->setDbname($_REQUEST['db']); + ->setDbname($GLOBALS['db']); - if (!empty($_REQUEST['searchId'])) { - $savedSearch->setId($_REQUEST['searchId']); + if (!empty($_POST['searchId'])) { + $savedSearch->setId($_POST['searchId']); } //Action field is sent. - if (isset($_REQUEST['action'])) { - $savedSearch->setSearchName($_REQUEST['searchName']); - if ('create' === $_REQUEST['action']) { + if (isset($_POST['action'])) { + $savedSearch->setSearchName($_POST['searchName']); + if ('create' === $_POST['action']) { $saveResult = $savedSearch->setId(null) - ->setCriterias($_REQUEST) + ->setCriterias($_POST) ->save(); - } elseif ('update' === $_REQUEST['action']) { - $saveResult = $savedSearch->setCriterias($_REQUEST) + } elseif ('update' === $_POST['action']) { + $saveResult = $savedSearch->setCriterias($_POST) ->save(); - } elseif ('delete' === $_REQUEST['action']) { + } elseif ('delete' === $_POST['action']) { $deleteResult = $savedSearch->delete(); //After deletion, reset search. $savedSearch = new SavedSearches($GLOBALS); $savedSearch->setUsername($GLOBALS['cfg']['Server']['user']) - ->setDbname($_REQUEST['db']); - $_REQUEST = array(); - } elseif ('load' === $_REQUEST['action']) { - if (empty($_REQUEST['searchId'])) { + ->setDbname($GLOBALS['db']); + $_POST = array(); + } elseif ('load' === $_POST['action']) { + if (empty($_POST['searchId'])) { //when not loading a search, reset the object. $savedSearch = new SavedSearches($GLOBALS); $savedSearch->setUsername($GLOBALS['cfg']['Server']['user']) - ->setDbname($_REQUEST['db']); - $_REQUEST = array(); + ->setDbname($GLOBALS['db']); + $_POST = array(); } else { $loadResult = $savedSearch->load(); } @@ -82,7 +82,7 @@ if ($cfgRelation['savedsearcheswork']) { * A query has been submitted -> (maybe) execute it */ $message_to_display = false; -if (isset($_REQUEST['submit_sql']) && ! empty($sql_query)) { +if (isset($_POST['submit_sql']) && ! empty($sql_query)) { if (! preg_match('@^SELECT@i', $sql_query)) { $message_to_display = true; } else { @@ -91,7 +91,7 @@ if (isset($_REQUEST['submit_sql']) && ! empty($sql_query)) { $sql->executeQueryAndSendQueryResponse( null, // analyzed_sql_results false, // is_gotofile - $_REQUEST['db'], // db + $_POST['db'], // db null, // table false, // find_real_end null, // sql_query_for_bookmark diff --git a/db_search.php b/db_search.php index 4f8a6648e2..8efff1718a 100644 --- a/db_search.php +++ b/db_search.php @@ -54,7 +54,7 @@ if (! $response->isAjax()) { } // Main search form has been submitted, get results -if (isset($_REQUEST['submit_search'])) { +if (isset($_POST['submit_search'])) { $response->addHTML($db_search->getSearchResults()); } diff --git a/db_sql.php b/db_sql.php index 9dfd3e7397..aa4d0b37c3 100644 --- a/db_sql.php +++ b/db_sql.php @@ -39,8 +39,8 @@ $back = 'db_sql.php'; $response->addHTML( SqlQueryForm::getHtml( true, false, - isset($_REQUEST['delimiter']) - ? htmlspecialchars($_REQUEST['delimiter']) + isset($_POST['delimiter']) + ? htmlspecialchars($_POST['delimiter']) : ';' ) ); diff --git a/db_tracking.php b/db_tracking.php index 0c8724d60a..49e4048025 100644 --- a/db_tracking.php +++ b/db_tracking.php @@ -30,6 +30,8 @@ $scripts->addFile('db_tracking.js'); */ require 'libraries/db_common.inc.php'; $url_query .= '&goto=tbl_tracking.php&back=db_tracking.php'; +$url_params['goto'] = 'tbl_tracking.php'; +$url_params['back'] = 'db_tracking.php'; // Get the database structure $sub_part = '_structure'; @@ -46,47 +48,45 @@ list( $pos ) = Util::getDbInfo($db, isset($sub_part) ? $sub_part : ''); -// Work to do? -// (here, do not use $_REQUEST['db] as it can be crafted) -if (isset($_REQUEST['delete_tracking']) && isset($_REQUEST['table'])) { +if (isset($_POST['delete_tracking']) && isset($_POST['table'])) { - Tracker::deleteTracking($GLOBALS['db'], $_REQUEST['table']); + Tracker::deleteTracking($GLOBALS['db'], $_POST['table']); Message::success( __('Tracking data deleted successfully.') )->display(); -} elseif (isset($_REQUEST['submit_create_version'])) { +} elseif (isset($_POST['submit_create_version'])) { - Tracking::createTrackingForMultipleTables($_REQUEST['selected']); + Tracking::createTrackingForMultipleTables($_POST['selected']); Message::success( sprintf( __( 'Version %1$s was created for selected tables,' . ' tracking is active for them.' ), - htmlspecialchars($_REQUEST['version']) + htmlspecialchars($_POST['version']) ) )->display(); -} elseif (isset($_REQUEST['submit_mult'])) { +} elseif (isset($_POST['submit_mult'])) { - if (! empty($_REQUEST['selected_tbl'])) { - if ($_REQUEST['submit_mult'] == 'delete_tracking') { + if (! empty($_POST['selected_tbl'])) { + if ($_POST['submit_mult'] == 'delete_tracking') { - foreach ($_REQUEST['selected_tbl'] as $table) { + foreach ($_POST['selected_tbl'] as $table) { Tracker::deleteTracking($GLOBALS['db'], $table); } Message::success( __('Tracking data deleted successfully.') )->display(); - } elseif ($_REQUEST['submit_mult'] == 'track') { + } elseif ($_POST['submit_mult'] == 'track') { echo Tracking::getHtmlForDataDefinitionAndManipulationStatements( 'db_tracking.php' . $url_query, 0, $GLOBALS['db'], - $_REQUEST['selected_tbl'] + $_POST['selected_tbl'] ); exit; } @@ -98,7 +98,7 @@ if (isset($_REQUEST['delete_tracking']) && isset($_REQUEST['table'])) { } // Get tracked data about the database -$data = Tracker::getTrackedData($_REQUEST['db'], '', '1'); +$data = Tracker::getTrackedData($GLOBALS['db'], '', '1'); // No tables present and no log exist if ($num_tables == 0 && count($data['ddlog']) == 0) { @@ -118,7 +118,7 @@ $cfgRelation = $relation->getRelationsParam(); $all_tables_query = ' SELECT table_name, MAX(version) as version FROM ' . Util::backquote($cfgRelation['db']) . '.' . Util::backquote($cfgRelation['tracking']) . - ' WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($_REQUEST['db']) . + ' WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($GLOBALS['db']) . '\' ' . ' GROUP BY table_name' . ' ORDER BY table_name ASC'; diff --git a/error_report.php b/error_report.php index 408a4eb201..54de4584e1 100644 --- a/error_report.php +++ b/error_report.php @@ -13,8 +13,8 @@ use PhpMyAdmin\Utils\HttpRequest; require_once 'libraries/common.inc.php'; -if (!isset($_REQUEST['exception_type']) - ||!in_array($_REQUEST['exception_type'], array('js', 'php')) +if (!isset($_POST['exception_type']) + ||!in_array($_POST['exception_type'], array('js', 'php')) ) { die('Oops, something went wrong!!'); } @@ -23,11 +23,11 @@ $response = Response::getInstance(); $errorReport = new ErrorReport(new HttpRequest()); -if (isset($_REQUEST['send_error_report']) - && ($_REQUEST['send_error_report'] == true - || $_REQUEST['send_error_report'] == '1') +if (isset($_POST['send_error_report']) + && ($_POST['send_error_report'] == true + || $_POST['send_error_report'] == '1') ) { - if ($_REQUEST['exception_type'] == 'php') { + if ($_POST['exception_type'] == 'php') { /** * Prevent infinite error submission. * Happens in case error submissions fails. @@ -51,7 +51,7 @@ if (isset($_REQUEST['send_error_report']) ); } } - $reportData = $errorReport->getData($_REQUEST['exception_type']); + $reportData = $errorReport->getData($_POST['exception_type']); // report if and only if there were 'actual' errors. if (count($reportData) > 0) { $server_response = $errorReport->send($reportData); @@ -65,8 +65,8 @@ if (isset($_REQUEST['send_error_report']) /* Message to show to the user */ if ($success) { - if ((isset($_REQUEST['automatic']) - && $_REQUEST['automatic'] === "true") + if ((isset($_POST['automatic']) + && $_POST['automatic'] === "true") || $GLOBALS['cfg']['SendErrorReports'] == 'always' ) { $msg = __( @@ -98,35 +98,35 @@ if (isset($_REQUEST['send_error_report']) /* Add message to response */ if ($response->isAjax()) { - if ($_REQUEST['exception_type'] == 'js') { + if ($_POST['exception_type'] == 'js') { $response->addJSON('message', $msg); } else { $response->addJSON('_errSubmitMsg', $msg); } - } elseif ($_REQUEST['exception_type'] == 'php') { + } elseif ($_POST['exception_type'] == 'php') { $jsCode = 'PMA_ajaxShowMessage("
' . $msg . '
", false);'; $response->getFooter()->getScripts()->addCode($jsCode); } - if ($_REQUEST['exception_type'] == 'php') { + if ($_POST['exception_type'] == 'php') { // clear previous errors & save new ones. $GLOBALS['error_handler']->savePreviousErrors(); } /* Persist always send settings */ - if (isset($_REQUEST['always_send']) - && $_REQUEST['always_send'] === "true" + if (isset($_POST['always_send']) + && $_POST['always_send'] === "true" ) { $userPreferences = new UserPreferences(); $userPreferences->persistOption("SendErrorReports", "always", "ask"); } } -} elseif (! empty($_REQUEST['get_settings'])) { +} elseif (! empty($_POST['get_settings'])) { $response->addJSON('report_setting', $GLOBALS['cfg']['SendErrorReports']); } else { - if ($_REQUEST['exception_type'] == 'js') { + if ($_POST['exception_type'] == 'js') { $response->addHTML($errorReport->getForm()); } else { // clear previous errors & save new ones. diff --git a/export.php b/export.php index 376bd020c2..4eaf422943 100644 --- a/export.php +++ b/export.php @@ -227,39 +227,39 @@ $filename = ''; $separate_files = ''; // Is it a quick or custom export? -if (isset($_REQUEST['quick_or_custom']) - && $_REQUEST['quick_or_custom'] == 'quick' +if (isset($_POST['quick_or_custom']) + && $_POST['quick_or_custom'] == 'quick' ) { $quick_export = true; } else { $quick_export = false; } -if ($_REQUEST['output_format'] == 'astext') { +if ($_POST['output_format'] == 'astext') { $asfile = false; } else { $asfile = true; - if (isset($_REQUEST['as_separate_files']) - && ! empty($_REQUEST['as_separate_files']) + if (isset($_POST['as_separate_files']) + && ! empty($_POST['as_separate_files']) ) { - if (isset($_REQUEST['compression']) - && ! empty($_REQUEST['compression']) - && $_REQUEST['compression'] == 'zip' + if (isset($_POST['compression']) + && ! empty($_POST['compression']) + && $_POST['compression'] == 'zip' ) { - $separate_files = $_REQUEST['as_separate_files']; + $separate_files = $_POST['as_separate_files']; } } - if (in_array($_REQUEST['compression'], $compression_methods)) { - $compression = $_REQUEST['compression']; + if (in_array($_POST['compression'], $compression_methods)) { + $compression = $_POST['compression']; $buffer_needed = true; } - if (($quick_export && ! empty($_REQUEST['quick_export_onserver'])) - || (! $quick_export && ! empty($_REQUEST['onserver'])) + if (($quick_export && ! empty($_POST['quick_export_onserver'])) + || (! $quick_export && ! empty($_POST['onserver'])) ) { if ($quick_export) { - $onserver = $_REQUEST['quick_export_onserver']; + $onserver = $_POST['quick_export_onserver']; } else { - $onserver = $_REQUEST['onserver']; + $onserver = $_POST['onserver']; } // Will we save dump on server? $save_on_server = ! empty($cfg['SaveDir']) && $onserver; @@ -297,9 +297,9 @@ if ((!empty($parser->statements[0])) ) { $aliases = \PhpMyAdmin\SqlParser\Utils\Misc::getAliases($parser->statements[0], $db); } -if (!empty($_REQUEST['aliases'])) { - $aliases = Export::mergeAliases($aliases, $_REQUEST['aliases']); - $_SESSION['tmpval']['aliases'] = $_REQUEST['aliases']; +if (!empty($_POST['aliases'])) { + $aliases = Export::mergeAliases($aliases, $_POST['aliases']); + $_SESSION['tmpval']['aliases'] = $_POST['aliases']; } /** @@ -446,7 +446,7 @@ do { if (!isset($table_data) || !is_array($table_data)) { $table_data = array(); } - if (!empty($_REQUEST['structure_or_data_forced'])) { + if (!empty($_POST['structure_or_data_forced'])) { $table_structure = $tables; $table_data = $tables; } diff --git a/gis_data_editor.php b/gis_data_editor.php index 6f438658c7..66707c83c2 100644 --- a/gis_data_editor.php +++ b/gis_data_editor.php @@ -27,14 +27,14 @@ function escape($variable) require_once 'libraries/common.inc.php'; -if (! isset($_REQUEST['field'])) { +if (! isset($_POST['field'])) { PhpMyAdmin\Util::checkParameters(array('field')); } // Get data if any posted $gis_data = array(); -if (Core::isValid($_REQUEST['gis_data'], 'array')) { - $gis_data = $_REQUEST['gis_data']; +if (Core::isValid($_POST['gis_data'], 'array')) { + $gis_data = $_POST['gis_data']; } $gis_types = array( @@ -50,15 +50,15 @@ $gis_types = array( // Extract type from the initial call and make sure that it's a valid one. // Extract from field's values if available, if not use the column type passed. if (! isset($gis_data['gis_type'])) { - if (isset($_REQUEST['type']) && $_REQUEST['type'] != '') { - $gis_data['gis_type'] = mb_strtoupper($_REQUEST['type']); + if (isset($_POST['type']) && $_POST['type'] != '') { + $gis_data['gis_type'] = mb_strtoupper($_POST['type']); } - if (isset($_REQUEST['value']) && trim($_REQUEST['value']) != '') { - $start = (substr($_REQUEST['value'], 0, 1) == "'") ? 1 : 0; + if (isset($_POST['value']) && trim($_POST['value']) != '') { + $start = (substr($_POST['value'], 0, 1) == "'") ? 1 : 0; $gis_data['gis_type'] = mb_substr( - $_REQUEST['value'], + $_POST['value'], $start, - mb_strpos($_REQUEST['value'], "(") - $start + mb_strpos($_POST['value'], "(") - $start ); } if ((! isset($gis_data['gis_type'])) @@ -71,9 +71,9 @@ $geom_type = htmlspecialchars($gis_data['gis_type']); // Generate parameters from value passed. $gis_obj = GisFactory::factory($geom_type); -if (isset($_REQUEST['value'])) { +if (isset($_POST['value'])) { $gis_data = array_merge( - $gis_data, $gis_obj->generateParams($_REQUEST['value']) + $gis_data, $gis_obj->generateParams($_POST['value']) ); } @@ -98,7 +98,7 @@ $open_layers = GisVisualization::getByData($data, $visualizationSettings) ->asOl(); // If the call is to update the WKT and visualization make an AJAX response -if (isset($_REQUEST['generate']) && $_REQUEST['generate'] == true) { +if (isset($_POST['generate']) && $_POST['generate'] == true) { $extra_data = array( 'result' => $result, 'visualization' => $visualization, @@ -119,17 +119,17 @@ echo '
'; echo '

'; printf( __('Value for the column "%s"'), - htmlspecialchars($_REQUEST['field']) + htmlspecialchars($_POST['field']) ); echo '

'; echo ''; + , htmlspecialchars($_POST['field']) , '" />'; // The input field to which the final result should be added // and corresponding null checkbox -if (isset($_REQUEST['input_name'])) { +if (isset($_POST['input_name'])) { echo ''; + , htmlspecialchars($_POST['input_name']) , '" />'; } echo Url::getHiddenInputs(); diff --git a/import.php b/import.php index 75ba6d685c..f73b6fd81f 100644 --- a/import.php +++ b/import.php @@ -29,12 +29,12 @@ if (isset($_POST['format']) && $_POST['format'] == 'ldi') { */ require_once 'libraries/common.inc.php'; -if (isset($_REQUEST['show_as_php'])) { - $GLOBALS['show_as_php'] = $_REQUEST['show_as_php']; +if (isset($_POST['show_as_php'])) { + $GLOBALS['show_as_php'] = $_POST['show_as_php']; } // If there is a request to 'Simulate DML'. -if (isset($_REQUEST['simulate_dml'])) { +if (isset($_POST['simulate_dml'])) { Import::handleSimulateDmlRequest(); exit; } @@ -44,25 +44,25 @@ $response = Response::getInstance(); $sql = new Sql(); // If it's a refresh console bookmarks request -if (isset($_REQUEST['console_bookmark_refresh'])) { +if (isset($_GET['console_bookmark_refresh'])) { $response->addJSON( 'console_message_bookmark', PhpMyAdmin\Console::getBookmarkContent() ); exit; } // If it's a console bookmark add request -if (isset($_REQUEST['console_bookmark_add'])) { - if (isset($_REQUEST['label']) && isset($_REQUEST['db']) - && isset($_REQUEST['bookmark_query']) && isset($_REQUEST['shared']) +if (isset($_POST['console_bookmark_add'])) { + if (isset($_POST['label']) && isset($_POST['db']) + && isset($_POST['bookmark_query']) && isset($_POST['shared']) ) { $cfgBookmark = Bookmark::getParams($GLOBALS['cfg']['Server']['user']); $bookmarkFields = array( - 'bkm_database' => $_REQUEST['db'], + 'bkm_database' => $_POST['db'], 'bkm_user' => $cfgBookmark['user'], - 'bkm_sql_query' => $_REQUEST['bookmark_query'], - 'bkm_label' => $_REQUEST['label'] + 'bkm_sql_query' => $_POST['bookmark_query'], + 'bkm_label' => $_POST['label'] ); - $isShared = ($_REQUEST['shared'] == 'true' ? true : false); + $isShared = ($_POST['shared'] == 'true' ? true : false); $bookmark = Bookmark::createBookmark( $GLOBALS['dbi'], $GLOBALS['cfg']['Server']['user'], @@ -124,11 +124,11 @@ $ajax_reload = array(); if (! empty($sql_query)) { // apply values for parameters - if (! empty($_REQUEST['parameterized']) - && ! empty($_REQUEST['parameters']) - && is_array($_REQUEST['parameters']) + if (! empty($_POST['parameterized']) + && ! empty($_POST['parameters']) + && is_array($_POST['parameters']) ) { - $parameters = $_REQUEST['parameters']; + $parameters = $_POST['parameters']; foreach ($parameters as $parameter => $replacement) { $quoted = preg_quote($parameter, '/'); // making sure that :param does not apply values to :param1 @@ -153,7 +153,7 @@ if (! empty($sql_query)) { $_SESSION['sql_from_query_box'] = true; // If there is a request to ROLLBACK when finished. - if (isset($_REQUEST['rollback_query'])) { + if (isset($_POST['rollback_query'])) { Import::handleRollbackRequest($import_text); } @@ -191,7 +191,7 @@ if (! empty($sql_query)) { $import_type = 'queryfile'; $format = 'sql'; unset($sql_file); -} elseif (! empty($_REQUEST['id_bookmark'])) { +} elseif (! empty($_POST['id_bookmark'])) { // run bookmark $import_type = 'query'; $format = 'sql'; @@ -305,7 +305,7 @@ if (! empty($cfg['MemoryLimit'])) { } $timestamp = time(); -if (isset($_REQUEST['allow_interrupt'])) { +if (isset($_POST['allow_interrupt'])) { $maximum_time = ini_get('max_execution_time'); } else { $maximum_time = 0; @@ -331,9 +331,9 @@ $result = false; $msg = 'Sorry an unexpected error happened!'; // Bookmark Support: get a query back from bookmark if required -if (! empty($_REQUEST['id_bookmark'])) { - $id_bookmark = (int)$_REQUEST['id_bookmark']; - switch ($_REQUEST['action_bookmark']) { +if (! empty($_POST['id_bookmark'])) { + $id_bookmark = (int)$_POST['id_bookmark']; + switch ($_POST['action_bookmark']) { case 0: // bookmarked query that have to be run $bookmark = Bookmark::get( $GLOBALS['dbi'], @@ -341,12 +341,12 @@ if (! empty($_REQUEST['id_bookmark'])) { $db, $id_bookmark, 'id', - isset($_REQUEST['action_bookmark_all']) + isset($_POST['action_bookmark_all']) ); - if (! empty($_REQUEST['bookmark_variable'])) { + if (! empty($_POST['bookmark_variable'])) { $import_text = $bookmark->applyVariables( - $_REQUEST['bookmark_variable'] + $_POST['bookmark_variable'] ); } else { $import_text = $bookmark->getQuery(); @@ -383,7 +383,7 @@ if (! empty($_REQUEST['id_bookmark'])) { $response->setRequestStatus($message->isSuccess()); $response->addJSON('message', $message); $response->addJSON('sql_query', $import_text); - $response->addJSON('action_bookmark', $_REQUEST['action_bookmark']); + $response->addJSON('action_bookmark', $_POST['action_bookmark']); exit; } else { $run_query = false; @@ -404,7 +404,7 @@ if (! empty($_REQUEST['id_bookmark'])) { ); $response->setRequestStatus($message->isSuccess()); $response->addJSON('message', $message); - $response->addJSON('action_bookmark', $_REQUEST['action_bookmark']); + $response->addJSON('action_bookmark', $_POST['action_bookmark']); $response->addJSON('id_bookmark', $id_bookmark); exit; } else { @@ -576,11 +576,11 @@ if ($reset_charset) { } // Show correct message -if (! empty($id_bookmark) && $_REQUEST['action_bookmark'] == 2) { +if (! empty($id_bookmark) && $_POST['action_bookmark'] == 2) { $message = PhpMyAdmin\Message::success(__('The bookmark has been deleted.')); $display_query = $import_text; $error = false; // unset error marker, it was used just to skip processing -} elseif (! empty($id_bookmark) && $_REQUEST['action_bookmark'] == 1) { +} elseif (! empty($id_bookmark) && $_POST['action_bookmark'] == 1) { $message = PhpMyAdmin\Message::notice(__('Showing bookmark')); } elseif ($bookmark_created) { $special_message = '[br]' . sprintf( @@ -779,6 +779,6 @@ if ($go_sql) { } // If there is request for ROLLBACK in the end. -if (isset($_REQUEST['rollback_query'])) { +if (isset($_POST['rollback_query'])) { $GLOBALS['dbi']->query('ROLLBACK'); } diff --git a/index.php b/index.php index 30ec98c32d..e80ceef4c8 100644 --- a/index.php +++ b/index.php @@ -621,7 +621,7 @@ if ($server > 0) { ); } $msg = Message::notice($msg_text); - $msg->addParamHtml(''); + $msg->addParamHtml(''); $msg->addParamHtml(''); /* Show error if user has configured something, notice elsewhere */ if (!empty($cfg['Servers'][$server]['pmadb'])) { diff --git a/js/db_central_columns.js b/js/db_central_columns.js index 88b0ce78ac..f6e4477913 100644 --- a/js/db_central_columns.js +++ b/js/db_central_columns.js @@ -65,10 +65,10 @@ AJAX.registerOnload('db_central_columns.js', function () { return false; } var argsep = PMA_commonParams.get('arg_separator'); - var editColumnData = editColumnList + '' + argsep + 'edit_central_columns_page=true' + argsep + 'ajax_request=true' + argsep + 'ajax_page_request=true' + argsep + 'db=' + PMA_commonParams.get('db'); + var editColumnData = editColumnList + '' + argsep + 'edit_central_columns_page=true' + argsep + 'ajax_request=true' + argsep + 'ajax_page_request=true' + argsep + 'db=' + encodeURIComponent(PMA_commonParams.get('db')); PMA_ajaxShowMessage(); AJAX.source = $(this); - $.get('db_central_columns.php', editColumnData, AJAX.responseHandler); + $.post('db_central_columns.php', editColumnData, AJAX.responseHandler); }); $('#multi_edit_central_columns').submit(function (event) { event.preventDefault(); diff --git a/js/db_tracking.js b/js/db_tracking.js index 36b8ae3e2e..ce2febab9c 100644 --- a/js/db_tracking.js +++ b/js/db_tracking.js @@ -84,10 +84,9 @@ AJAX.registerOnload('db_tracking.js', function () { $anchor.PMA_confirm(question, $anchor.attr('href'), function (url) { PMA_ajaxShowMessage(PMA_messages.strDeletingTrackingData); AJAX.source = $anchor; - var params = { - 'ajax_page_request': true, - 'ajax_request': true - }; + var argSep = PMA_commonParams.get('arg_separator'); + var params = getJSConfirmCommonParam(this, $anchor.getPostData()); + params += argSep + 'ajax_page_request=1'; $.post(url, params, AJAX.responseHandler); }); }); diff --git a/js/error_report.js b/js/error_report.js index c2746bb656..8be457aced 100644 --- a/js/error_report.js +++ b/js/error_report.js @@ -19,7 +19,7 @@ var ErrorReport = { exception.name = ErrorReport._extractExceptionName(exception); } ErrorReport._last_exception = exception; - $.get('error_report.php', { + $.post('error_report.php', { ajax_request: true, server: PMA_commonParams.get('server'), get_settings: true, @@ -107,7 +107,7 @@ var ErrorReport = { } }); } - }); // end $.get() + }); }, /** * Shows the small notification that asks for user permission diff --git a/js/functions.js b/js/functions.js index 0cbb39e4ec..1e8aa42912 100644 --- a/js/functions.js +++ b/js/functions.js @@ -3797,7 +3797,7 @@ function indexEditorDialog (url, title, callback_success, callback_failure) { $(this).dialog('close'); }; var $msgbox = PMA_ajaxShowMessage(); - $.get('tbl_indexes.php', url, function (data) { + $.post('tbl_indexes.php', url, function (data) { if (typeof data !== 'undefined' && data.success === false) { // in the case of an error, show the error message returned. PMA_ajaxShowMessage(data.error, false); @@ -4543,8 +4543,9 @@ function PMA_createViewDialog ($this) { var $msg = PMA_ajaxShowMessage(); var syntaxHighlighter = null; var sep = PMA_commonParams.get('arg_separator'); - params = $this.getPostData(); - $.get($this.attr('href') + sep + 'ajax_request=1' + sep + 'ajax_dialog=1' + sep + params, function (data) { + var params = getJSConfirmCommonParam(this, $this.getPostData()); + params += sep + 'ajax_dialog=1'; + $.post($this.attr('href'), params, function (data) { if (typeof data !== 'undefined' && data.success === true) { PMA_ajaxRemoveMessage($msg); var buttonOptions = {}; diff --git a/js/indexes.js b/js/indexes.js index 19744833c9..dacdc2554f 100644 --- a/js/indexes.js +++ b/js/indexes.js @@ -660,10 +660,7 @@ AJAX.registerOnload('indexes.js', function () { title = PMA_messages.strAddIndex; } else { // Edit index - url = $(this).find('a').attr('href'); - if (url.substring(0, 16) === 'tbl_indexes.php?') { - url = url.substring(16, url.length); - } + url = $(this).find('a').getPostData(); title = PMA_messages.strEditIndex; } url += PMA_commonParams.get('arg_separator') + 'ajax_request=true'; diff --git a/js/navigation.js b/js/navigation.js index 181ac848a2..23705fa709 100644 --- a/js/navigation.js +++ b/js/navigation.js @@ -519,12 +519,13 @@ $(function () { /** Hide navigation tree item */ $(document).on('click', 'a.hideNavItem.ajax', function (event) { event.preventDefault(); + var argSep = PMA_commonParams.get('arg_separator'); + var params = $(this).getPostData(); + params += argSep + 'ajax_request=true' + argSep + 'server=' + PMA_commonParams.get('server'); $.ajax({ type: 'POST', - data: { - server: PMA_commonParams.get('server'), - }, - url: $(this).attr('href') + PMA_commonParams.get('arg_separator') + 'ajax_request=true', + data: params, + url: $(this).attr('href'), success: function (data) { if (typeof data !== 'undefined' && data.success === true) { PMA_reloadNavigation(); @@ -539,7 +540,10 @@ $(function () { $(document).on('click', 'a.showUnhide.ajax', function (event) { event.preventDefault(); var $msg = PMA_ajaxShowMessage(); - $.get($(this).attr('href') + PMA_commonParams.get('arg_separator') + 'ajax_request=1', function (data) { + var argSep = PMA_commonParams.get('arg_separator'); + var params = $(this).getPostData(); + params += argSep + 'ajax_request=true'; + $.post($(this).attr('href'), params, function (data) { if (typeof data !== 'undefined' && data.success === true) { PMA_ajaxRemoveMessage($msg); var buttonOptions = {}; @@ -570,12 +574,13 @@ $(function () { event.preventDefault(); var $tr = $(this).parents('tr'); var $msg = PMA_ajaxShowMessage(); + var argSep = PMA_commonParams.get('arg_separator'); + var params = $(this).getPostData(); + params += argSep + 'ajax_request=true' + argSep + 'server=' + PMA_commonParams.get('server'); $.ajax({ type: 'POST', - data: { - server: PMA_commonParams.get('server'), - }, - url: $(this).attr('href') + PMA_commonParams.get('arg_separator') + 'ajax_request=true', + data: params, + url: $(this).attr('href'), success: function (data) { PMA_ajaxRemoveMessage($msg); if (typeof data !== 'undefined' && data.success === true) { diff --git a/js/server_databases.js b/js/server_databases.js index cb91d6b180..a892ca8bfd 100644 --- a/js/server_databases.js +++ b/js/server_databases.js @@ -60,13 +60,14 @@ AJAX.registerOnload('server_databases.js', function () { $(this).PMA_confirm( question, $form.prop('action') + '?' + $(this).serialize() + - argsep + 'drop_selected_dbs=1' + argsep + 'is_js_confirmed=1' + argsep + 'ajax_request=true', + argsep + 'drop_selected_dbs=1', function (url) { PMA_ajaxShowMessage(PMA_messages.strProcessingRequest, false); - var params = getJSConfirmCommonParam(this); + var parts = url.split('?'); + var params = getJSConfirmCommonParam(this, parts[1]); - $.post(url, params, function (data) { + $.post(parts[0], params, function (data) { if (typeof data !== 'undefined' && data.success === true) { PMA_ajaxShowMessage(data.message); diff --git a/js/server_status_monitor.js b/js/server_status_monitor.js index efc2f47ee7..7ad61eb1e3 100644 --- a/js/server_status_monitor.js +++ b/js/server_status_monitor.js @@ -686,7 +686,7 @@ AJAX.registerOnload('server_status_monitor.js', function () { $.extend(vars, getvars); } - $.get('server_status_monitor.php' + PMA_commonParams.get('common_query'), vars, + $.post('server_status_monitor.php' + PMA_commonParams.get('common_query'), vars, function (data) { var logVars; if (typeof data !== 'undefined' && data.success === true) { @@ -1591,9 +1591,10 @@ AJAX.registerOnload('server_status_monitor.js', function () { buttons: dlgBtns }); - - logRequest = $.get('server_status_monitor.php' + PMA_commonParams.get('common_query'), - { ajax_request: true, + logRequest = $.post( + 'server_status_monitor.php' + PMA_commonParams.get('common_query'), + { + ajax_request: true, log_data: 1, type: opts.src, time_start: Math.round(opts.start / 1000), diff --git a/js/server_status_processes.js b/js/server_status_processes.js index 928c10b328..2865bca9a7 100644 --- a/js/server_status_processes.js +++ b/js/server_status_processes.js @@ -47,10 +47,12 @@ var processList = { */ killProcessHandler: function (event) { event.preventDefault(); - var url = $(this).attr('href'); + var argSep = PMA_commonParams.get('arg_separator'); + var params = $(this).getPostData(); + params += argSep + 'ajax_request=1' + argSep + 'server=' + PMA_commonParams.get('server'); // Get row element of the process to be killed. var $tr = $(this).closest('tr'); - $.getJSON(url, function (data) { + $.post($(this).attr('href'), params, function (data) { // Check if process was killed or not. if (data.hasOwnProperty('success') && data.success) { // remove the row of killed process. @@ -66,7 +68,7 @@ var processList = { // Show process error message PMA_ajaxShowMessage(data.error, false); } - }); + }, 'json'); }, /** @@ -86,7 +88,7 @@ var processList = { if (processList.autoRefresh) { var interval = parseInt(processList.refreshInterval, 10) * 1000; var urlParams = processList.getUrlParams(); - processList.refreshRequest = $.get(processList.refreshUrl, + processList.refreshRequest = $.post(processList.refreshUrl, urlParams, function (data) { if (data.hasOwnProperty('success') && data.success) { diff --git a/js/sql.js b/js/sql.js index 21b7d1f714..b66ba5a3eb 100644 --- a/js/sql.js +++ b/js/sql.js @@ -792,7 +792,10 @@ function browseForeignDialog ($this_a) { var tableId = '#browse_foreign_table'; var filterId = '#input_foreign_filter'; var $dialog = null; - $.get($this_a.attr('href'), { 'ajax_request': true }, function (data) { + var argSep = PMA_commonParams.get('arg_separator'); + var params = $this_a.getPostData(); + params += argSep + 'ajax_request=true'; + $.post($this_a.attr('href'), params, function (data) { // Creates browse foreign value dialog $dialog = $('
').append(data.message).dialog({ title: PMA_messages.strBrowseForeignValues, diff --git a/js/tbl_relation.js b/js/tbl_relation.js index 6446b8b1e6..ffc0aff435 100644 --- a/js/tbl_relation.js +++ b/js/tbl_relation.js @@ -72,7 +72,7 @@ function getDropdownValues ($dropdown) { var $msgbox = PMA_ajaxShowMessage(); var $form = $dropdown.parents('form'); var argsep = PMA_commonParams.get('arg_separator'); - var url = 'tbl_relation.php?getDropdownValues=true' + argsep + 'ajax_request=true' + + var params = 'getDropdownValues=true' + argsep + 'ajax_request=true' + argsep + 'db=' + $form.find('input[name="db"]').val() + argsep + 'table=' + $form.find('input[name="table"]').val() + argsep + 'foreign=' + (foreign !== '') + @@ -82,11 +82,13 @@ function getDropdownValues ($dropdown) { ); var $server = $form.find('input[name="server"]'); if ($server.length > 0) { - url += argsep + 'server=' + $form.find('input[name="server"]').val(); + params += argsep + 'server=' + $form.find('input[name="server"]').val(); } $.ajax({ - url: url, - datatype: 'json', + type: 'POST', + url: 'tbl_relation.php', + data: params, + dataType: 'json', success: function (data) { PMA_ajaxRemoveMessage($msgbox); if (typeof data !== 'undefined' && data.success) { diff --git a/js/tbl_tracking.js b/js/tbl_tracking.js index 9415f37a66..cd08957302 100644 --- a/js/tbl_tracking.js +++ b/js/tbl_tracking.js @@ -80,10 +80,9 @@ AJAX.registerOnload('tbl_tracking.js', function () { $anchor.PMA_confirm(question, $anchor.attr('href'), function (url) { PMA_ajaxShowMessage(); AJAX.source = $anchor; - var params = { - 'ajax_page_request': true, - 'ajax_request': true - }; + var argSep = PMA_commonParams.get('arg_separator'); + var params = getJSConfirmCommonParam(this, $anchor.getPostData()); + params += argSep + 'ajax_page_request=1'; $.post(url, params, AJAX.responseHandler); }); }); @@ -98,10 +97,9 @@ AJAX.registerOnload('tbl_tracking.js', function () { $anchor.PMA_confirm(question, $anchor.attr('href'), function (url) { PMA_ajaxShowMessage(); AJAX.source = $anchor; - var params = { - 'ajax_page_request': true, - 'ajax_request': true - }; + var argSep = PMA_commonParams.get('arg_separator'); + var params = getJSConfirmCommonParam(this, $anchor.getPostData()); + params += argSep + 'ajax_page_request=1'; $.post(url, params, AJAX.responseHandler); }); }); diff --git a/libraries/classes/BrowseForeigners.php b/libraries/classes/BrowseForeigners.php index b41ed78f2a..8d799740ad 100644 --- a/libraries/classes/BrowseForeigners.php +++ b/libraries/classes/BrowseForeigners.php @@ -182,12 +182,12 @@ class BrowseForeigners . ''; - if (isset($_REQUEST['rownumber'])) { + if (isset($_POST['rownumber'])) { $output .= ''; + . htmlspecialchars($_POST['rownumber']) . '" />'; } - $filter_value = (isset($_REQUEST['foreign_filter']) - ? htmlspecialchars($_REQUEST['foreign_filter']) + $filter_value = (isset($_POST['foreign_filter']) + ? htmlspecialchars($_POST['foreign_filter']) : ''); $output .= '' . '' @@ -302,7 +302,7 @@ class BrowseForeigners private function getHtmlForGotoPage($foreignData) { $gotopage = ''; - isset($_REQUEST['pos']) ? $pos = $_REQUEST['pos'] : $pos = 0; + isset($_POST['pos']) ? $pos = $_POST['pos'] : $pos = 0; if (!is_array($foreignData['disp_row'])) { return $gotopage; } @@ -340,7 +340,7 @@ class BrowseForeigners if (isset($foreignShowAll) && $foreignShowAll == __('Show all')) { return null; } - isset($_REQUEST['pos']) ? $pos = $_REQUEST['pos'] : $pos = 0; + isset($_POST['pos']) ? $pos = $_POST['pos'] : $pos = 0; return 'LIMIT ' . $pos . ', ' . $this->maxRows . ' '; } } diff --git a/libraries/classes/CentralColumns.php b/libraries/classes/CentralColumns.php index 555195c95d..7379cee484 100644 --- a/libraries/classes/CentralColumns.php +++ b/libraries/classes/CentralColumns.php @@ -299,7 +299,7 @@ class CentralColumns if (empty($cfgCentralColumns)) { return $this->configErrorMessage(); } - $db = $_REQUEST['db']; + $db = $_POST['db']; $pmadb = $cfgCentralColumns['db']; $central_list_table = $cfgCentralColumns['table']; $this->dbi->selectDb($db); @@ -333,7 +333,7 @@ class CentralColumns } } else { if ($table === null) { - $table = $_REQUEST['table']; + $table = $_POST['table']; } foreach ($field_select as $column) { $cols .= "'" . $this->dbi->escapeString($column) . "',"; @@ -406,7 +406,7 @@ class CentralColumns if (empty($cfgCentralColumns)) { return $this->configErrorMessage(); } - $db = $_REQUEST['db']; + $db = $_POST['db']; $pmadb = $cfgCentralColumns['db']; $central_list_table = $cfgCentralColumns['table']; $this->dbi->selectDb($db); diff --git a/libraries/classes/Controllers/Server/ServerBinlogController.php b/libraries/classes/Controllers/Server/ServerBinlogController.php index e496a2ac58..57983ec3d2 100644 --- a/libraries/classes/Controllers/Server/ServerBinlogController.php +++ b/libraries/classes/Controllers/Server/ServerBinlogController.php @@ -55,15 +55,15 @@ class ServerBinlogController extends Controller include_once 'libraries/server_common.inc.php'; $url_params = array(); - if (! isset($_REQUEST['log']) - || ! array_key_exists($_REQUEST['log'], $this->binary_logs) + if (! isset($_POST['log']) + || ! array_key_exists($_POST['log'], $this->binary_logs) ) { - $_REQUEST['log'] = ''; + $_POST['log'] = ''; } else { - $url_params['log'] = $_REQUEST['log']; + $url_params['log'] = $_POST['log']; } - if (!empty($_REQUEST['dontlimitchars'])) { + if (!empty($_POST['dontlimitchars'])) { $url_params['dontlimitchars'] = 1; } @@ -89,7 +89,7 @@ class ServerBinlogController extends Controller array( 'url_params' => $url_params, 'binary_logs' => $this->binary_logs, - 'log' => $_REQUEST['log'], + 'log' => $_POST['log'], ) ); } @@ -106,16 +106,16 @@ class ServerBinlogController extends Controller /** * Need to find the real end of rows? */ - if (! isset($_REQUEST['pos'])) { + if (! isset($_POST['pos'])) { $pos = 0; } else { /* We need this to be a integer */ - $pos = (int) $_REQUEST['pos']; + $pos = (int) $_POST['pos']; } $sql_query = 'SHOW BINLOG EVENTS'; - if (! empty($_REQUEST['log'])) { - $sql_query .= ' IN \'' . $_REQUEST['log'] . '\''; + if (! empty($_POST['log'])) { + $sql_query .= ' IN \'' . $_POST['log'] . '\''; } $sql_query .= ' LIMIT ' . $pos . ', ' . intval($GLOBALS['cfg']['MaxRows']); @@ -134,7 +134,7 @@ class ServerBinlogController extends Controller $num_rows = 0; } - if (empty($_REQUEST['dontlimitchars'])) { + if (empty($_POST['dontlimitchars'])) { $dontlimitchars = false; } else { $dontlimitchars = true; @@ -192,8 +192,8 @@ class ServerBinlogController extends Controller $this_url_params['pos'] = $pos - $GLOBALS['cfg']['MaxRows']; } - $html .= ''; } else { @@ -215,7 +215,7 @@ class ServerBinlogController extends Controller $tempTitle = __('Show Full Queries'); $tempImgMode = 'full'; } - $html .= '' . '' . $tempTitle . ''; @@ -225,8 +225,8 @@ class ServerBinlogController extends Controller if ($num_rows >= $GLOBALS['cfg']['MaxRows']) { $this_url_params = $url_params; $this_url_params['pos'] = $pos + $GLOBALS['cfg']['MaxRows']; - $html .= ' - '; diff --git a/libraries/classes/Controllers/Server/ServerDatabasesController.php b/libraries/classes/Controllers/Server/ServerDatabasesController.php index 67128347a5..fea993841f 100644 --- a/libraries/classes/Controllers/Server/ServerDatabasesController.php +++ b/libraries/classes/Controllers/Server/ServerDatabasesController.php @@ -62,7 +62,7 @@ class ServerDatabasesController extends Controller $response = Response::getInstance(); - if (isset($_REQUEST['drop_selected_dbs']) + if (isset($_POST['drop_selected_dbs']) && $response->isAjax() && ($GLOBALS['dbi']->isSuperuser() || $GLOBALS['cfg']['AllowUserDropDatabase']) ) { @@ -184,7 +184,7 @@ class ServerDatabasesController extends Controller */ public function dropDatabasesAction() { - if (! isset($_REQUEST['selected_dbs'])) { + if (! isset($_POST['selected_dbs'])) { $message = Message::error(__('No databases selected.')); } else { $action = 'server_databases.php'; diff --git a/libraries/classes/Controllers/Server/ServerVariablesController.php b/libraries/classes/Controllers/Server/ServerVariablesController.php index 58f8b47d8f..dca5e322c9 100644 --- a/libraries/classes/Controllers/Server/ServerVariablesController.php +++ b/libraries/classes/Controllers/Server/ServerVariablesController.php @@ -48,16 +48,16 @@ class ServerVariablesController extends Controller { $response = Response::getInstance(); if ($response->isAjax() - && isset($_REQUEST['type']) - && $_REQUEST['type'] === 'getval' + && isset($_GET['type']) + && $_GET['type'] === 'getval' ) { $this->getValueAction(); return; } if ($response->isAjax() - && isset($_REQUEST['type']) - && $_REQUEST['type'] === 'setval' + && isset($_POST['type']) + && $_POST['type'] === 'setval' ) { $this->setValueAction(); return; @@ -140,12 +140,12 @@ class ServerVariablesController extends Controller // when server is running in ANSI_QUOTES sql_mode $varValue = $this->dbi->fetchSingleRow( 'SHOW GLOBAL VARIABLES WHERE Variable_name=\'' - . $GLOBALS['dbi']->escapeString($_REQUEST['varName']) . '\';', + . $GLOBALS['dbi']->escapeString($_GET['varName']) . '\';', 'NUM' ); - if (isset($this->variable_doc_links[$_REQUEST['varName']][3]) - && $this->variable_doc_links[$_REQUEST['varName']][3] == 'byte' + if (isset($this->variable_doc_links[$_GET['varName']][3]) + && $this->variable_doc_links[$_GET['varName']][3] == 'byte' ) { $this->response->addJSON( 'message', @@ -168,11 +168,11 @@ class ServerVariablesController extends Controller */ public function setValueAction() { - $value = $_REQUEST['varValue']; + $value = $_POST['varValue']; $matches = array(); - if (isset($this->variable_doc_links[$_REQUEST['varName']][3]) - && $this->variable_doc_links[$_REQUEST['varName']][3] == 'byte' + if (isset($this->variable_doc_links[$_POST['varName']][3]) + && $this->variable_doc_links[$_POST['varName']][3] == 'byte' && preg_match( '/^\s*(\d+(\.\d+)?)\s*(mb|kb|mib|kib|gb|gib)\s*$/i', $value, @@ -199,19 +199,19 @@ class ServerVariablesController extends Controller $value="'" . $value . "'"; } - if (! preg_match("/[^a-zA-Z0-9_]+/", $_REQUEST['varName']) + if (! preg_match("/[^a-zA-Z0-9_]+/", $_POST['varName']) && $this->dbi->query( - 'SET GLOBAL ' . $_REQUEST['varName'] . ' = ' . $value + 'SET GLOBAL ' . $_POST['varName'] . ' = ' . $value ) ) { // Some values are rounded down etc. $varValue = $this->dbi->fetchSingleRow( 'SHOW GLOBAL VARIABLES WHERE Variable_name="' - . $GLOBALS['dbi']->escapeString($_REQUEST['varName']) + . $GLOBALS['dbi']->escapeString($_POST['varName']) . '";', 'NUM' ); list($formattedValue, $isHtmlFormatted) = $this->_formatVariable( - $_REQUEST['varName'], $varValue[1] + $_POST['varName'], $varValue[1] ); if ($isHtmlFormatted == false) { diff --git a/libraries/classes/Controllers/Table/TableIndexesController.php b/libraries/classes/Controllers/Table/TableIndexesController.php index 68bddc65dd..080d292a1c 100644 --- a/libraries/classes/Controllers/Table/TableIndexesController.php +++ b/libraries/classes/Controllers/Table/TableIndexesController.php @@ -50,7 +50,7 @@ class TableIndexesController extends TableController */ public function indexAction() { - if (isset($_REQUEST['do_save_data'])) { + if (isset($_POST['do_save_data'])) { $this->doSaveDataAction(); return; } // end builds the new index @@ -67,24 +67,24 @@ class TableIndexesController extends TableController { $GLOBALS['dbi']->selectDb($GLOBALS['db']); $add_fields = 0; - if (isset($_REQUEST['index']) && is_array($_REQUEST['index'])) { + if (isset($_POST['index']) && is_array($_POST['index'])) { // coming already from form - if (isset($_REQUEST['index']['columns']['names'])) { - $add_fields = count($_REQUEST['index']['columns']['names']) + if (isset($_POST['index']['columns']['names'])) { + $add_fields = count($_POST['index']['columns']['names']) - $this->index->getColumnCount(); } - if (isset($_REQUEST['add_fields'])) { - $add_fields += $_REQUEST['added_fields']; + if (isset($_POST['add_fields'])) { + $add_fields += $_POST['added_fields']; } - } elseif (isset($_REQUEST['create_index'])) { - $add_fields = $_REQUEST['added_fields']; + } elseif (isset($_POST['create_index'])) { + $add_fields = $_POST['added_fields']; } // end preparing form values // Get fields and stores their name/type - if (isset($_REQUEST['create_edit_table'])) { - $fields = json_decode($_REQUEST['columns'], true); + if (isset($_POST['create_edit_table'])) { + $fields = json_decode($_POST['columns'], true); $index_params = array( - 'Non_unique' => ($_REQUEST['index']['Index_choice'] == 'UNIQUE') + 'Non_unique' => ($_POST['index']['Index_choice'] == 'UNIQUE') ? '0' : '1', ); $this->index->set($index_params); @@ -99,12 +99,12 @@ class TableIndexesController extends TableController 'table' => $this->table, ); - if (isset($_REQUEST['create_index'])) { + if (isset($_POST['create_index'])) { $form_params['create_index'] = 1; - } elseif (isset($_REQUEST['old_index'])) { - $form_params['old_index'] = $_REQUEST['old_index']; - } elseif (isset($_REQUEST['index'])) { - $form_params['old_index'] = $_REQUEST['index']; + } elseif (isset($_POST['old_index'])) { + $form_params['old_index'] = $_POST['old_index']; + } elseif (isset($_POST['index'])) { + $form_params['old_index'] = $_POST['index']; } $this->response->getHeader()->getScripts()->addFile('indexes.js'); @@ -116,7 +116,7 @@ class TableIndexesController extends TableController 'index' => $this->index, 'form_params' => $form_params, 'add_fields' => $add_fields, - 'create_edit_table' => isset($_REQUEST['create_edit_table']) + 'create_edit_table' => isset($_POST['create_edit_table']) ) ) ); @@ -137,7 +137,7 @@ class TableIndexesController extends TableController ->getSqlQueryForIndexCreateOrEdit($this->index, $error); // If there is a request for SQL previewing. - if (isset($_REQUEST['preview_sql'])) { + if (isset($_POST['preview_sql'])) { $this->response->addJSON( 'sql_data', diff --git a/libraries/classes/Controllers/Table/TableRelationController.php b/libraries/classes/Controllers/Table/TableRelationController.php index 9a5c6dc683..7bef023ad3 100644 --- a/libraries/classes/Controllers/Table/TableRelationController.php +++ b/libraries/classes/Controllers/Table/TableRelationController.php @@ -100,11 +100,11 @@ class TableRelationController extends TableController { // Send table of column names to populate corresponding dropdowns depending // on the current selection - if (isset($_REQUEST['getDropdownValues']) - && $_REQUEST['getDropdownValues'] === 'true' + if (isset($_POST['getDropdownValues']) + && $_POST['getDropdownValues'] === 'true' ) { // if both db and table are selected - if (isset($_REQUEST['foreignTable'])) { + if (isset($_POST['foreignTable'])) { $this->getDropdownValueForTableAction(); } else { // if only the db is selected $this->getDropdownValueForDbAction(); @@ -241,8 +241,8 @@ class TableRelationController extends TableController */ public function updateForForeignKeysAction() { - $multi_edit_columns_name = isset($_REQUEST['foreign_key_fields_name']) - ? $_REQUEST['foreign_key_fields_name'] + $multi_edit_columns_name = isset($_POST['foreign_key_fields_name']) + ? $_POST['foreign_key_fields_name'] : null; // (for now, one index name only; we keep the definitions if the @@ -260,7 +260,7 @@ class TableRelationController extends TableController $this->response->addHTML($html); // If there is a request for SQL previewing. - if (isset($_REQUEST['preview_sql'])) { + if (isset($_POST['preview_sql'])) { Core::previewSQL($preview_sql_data); } @@ -282,8 +282,8 @@ class TableRelationController extends TableController */ public function updateForInternalRelationAction() { - $multi_edit_columns_name = isset($_REQUEST['fields_name']) - ? $_REQUEST['fields_name'] + $multi_edit_columns_name = isset($_POST['fields_name']) + ? $_POST['fields_name'] : null; if ($this->upd_query->updateInternalRelations( @@ -312,8 +312,8 @@ class TableRelationController extends TableController */ public function getDropdownValueForTableAction() { - $foreignTable = $_REQUEST['foreignTable']; - $table_obj = $this->dbi->getTable($_REQUEST['foreignDb'], $foreignTable); + $foreignTable = $_POST['foreignTable']; + $table_obj = $this->dbi->getTable($_POST['foreignDb'], $foreignTable); // Since views do not have keys defined on them provide the full list of // columns if ($table_obj->isView()) { @@ -331,7 +331,7 @@ class TableRelationController extends TableController $this->response->addJSON('columns', $columns); // @todo should be: $server->db($db)->table($table)->primary() - $primary = Index::getPrimary($foreignTable, $_REQUEST['foreignDb']); + $primary = Index::getPrimary($foreignTable, $_POST['foreignDb']); if (false === $primary) { return; } @@ -348,11 +348,11 @@ class TableRelationController extends TableController public function getDropdownValueForDbAction() { $tables = array(); - $foreign = isset($_REQUEST['foreign']) && $_REQUEST['foreign'] === 'true'; + $foreign = isset($_POST['foreign']) && $_POST['foreign'] === 'true'; if ($foreign) { $query = 'SHOW TABLE STATUS FROM ' - . Util::backquote($_REQUEST['foreignDb']); + . Util::backquote($_POST['foreignDb']); $tables_rs = $this->dbi->query( $query, DatabaseInterface::CONNECT_USER, @@ -368,7 +368,7 @@ class TableRelationController extends TableController } } else { $query = 'SHOW TABLES FROM ' - . Util::backquote($_REQUEST['foreignDb']); + . Util::backquote($_POST['foreignDb']); $tables_rs = $this->dbi->query( $query, DatabaseInterface::CONNECT_USER, diff --git a/libraries/classes/Controllers/Table/TableSearchController.php b/libraries/classes/Controllers/Table/TableSearchController.php index 248bee0d66..749e4d692b 100644 --- a/libraries/classes/Controllers/Table/TableSearchController.php +++ b/libraries/classes/Controllers/Table/TableSearchController.php @@ -212,7 +212,7 @@ class TableSearchController extends TableController ) ); - if (isset($_REQUEST['range_search'])) { + if (isset($_POST['range_search'])) { $this->rangeSearchAction(); return; @@ -253,8 +253,8 @@ class TableSearchController extends TableController * * @var boolean Object containing parameters for the POST request */ - if (isset($_REQUEST['get_data_row']) - && $_REQUEST['get_data_row'] == true + if (isset($_POST['get_data_row']) + && $_POST['get_data_row'] == true ) { $this->getDataRowAction(); @@ -266,8 +266,8 @@ class TableSearchController extends TableController * * @var boolean Object containing parameters for the POST request */ - if (isset($_REQUEST['change_tbl_info']) - && $_REQUEST['change_tbl_info'] == true + if (isset($_POST['change_tbl_info']) + && $_POST['change_tbl_info'] == true ) { $this->changeTableInfoAction(); @@ -390,7 +390,7 @@ class TableSearchController extends TableController */ public function changeTableInfoAction() { - $field = $_REQUEST['field']; + $field = $_POST['field']; if ($field == 'pma_null') { $this->response->addJSON('field_type', ''); $this->response->addJSON('field_collation', ''); @@ -400,8 +400,8 @@ class TableSearchController extends TableController } $key = array_search($field, $this->_columnNames); $search_index - = ((isset($_REQUEST['it']) && is_numeric($_REQUEST['it'])) - ? intval($_REQUEST['it']) : 0); + = ((isset($_POST['it']) && is_numeric($_POST['it'])) + ? intval($_POST['it']) : 0); $properties = $this->getColumnProperties($search_index, $key); $this->response->addJSON( @@ -420,8 +420,8 @@ class TableSearchController extends TableController public function getDataRowAction() { $extra_data = array(); - $row_info_query = 'SELECT * FROM `' . $_REQUEST['db'] . '`.`' - . $_REQUEST['table'] . '` WHERE ' . $_REQUEST['where_clause']; + $row_info_query = 'SELECT * FROM `' . $_POST['db'] . '`.`' + . $_POST['table'] . '` WHERE ' . $_POST['where_clause']; $result = $this->dbi->query( $row_info_query . ";", DatabaseInterface::CONNECT_USER, @@ -542,7 +542,7 @@ class TableSearchController extends TableController */ public function rangeSearchAction() { - $min_max = $this->getColumnMinMax($_REQUEST['column']); + $min_max = $this->getColumnMinMax($_POST['column']); $this->response->addJSON('column_data', $min_max); } diff --git a/libraries/classes/Controllers/Table/TableStructureController.php b/libraries/classes/Controllers/Table/TableStructureController.php index 83bacb9903..a423bb3082 100644 --- a/libraries/classes/Controllers/Table/TableStructureController.php +++ b/libraries/classes/Controllers/Table/TableStructureController.php @@ -153,8 +153,8 @@ class TableStructureController extends TableController /** * Handle column moving */ - if (isset($_REQUEST['move_columns']) - && is_array($_REQUEST['move_columns']) + if (isset($_POST['move_columns']) + && is_array($_POST['move_columns']) && $this->response->isAjax() ) { $this->moveColumns(); @@ -164,9 +164,9 @@ class TableStructureController extends TableController /** * handle MySQL reserved words columns check */ - if (isset($_REQUEST['reserved_word_check'])) { + if (isset($_POST['reserved_word_check'])) { if ($GLOBALS['cfg']['ReservedWordDisableWarning'] === false) { - $columns_names = $_REQUEST['field_name']; + $columns_names = $_POST['field_name']; $reserved_keywords_names = array(); foreach ($columns_names as $column) { if (Context::isKeyword(trim($column), true)) { @@ -197,7 +197,7 @@ class TableStructureController extends TableController /** * A click on Change has been made for one column */ - if (isset($_REQUEST['change_column'])) { + if (isset($_GET['change_column'])) { $this->displayHtmlForColumnChange(null, 'tbl_structure.php'); return; } @@ -205,8 +205,8 @@ class TableStructureController extends TableController /** * Adding or editing partitioning of the table */ - if (isset($_REQUEST['edit_partitioning']) - && ! isset($_REQUEST['save_partitioning']) + if (isset($_POST['edit_partitioning']) + && ! isset($_POST['save_partitioning']) ) { $this->displayHtmlForPartitionChange(); return; @@ -220,7 +220,7 @@ class TableStructureController extends TableController $submit_mult = $this->getMultipleFieldCommandType(); if (! empty($submit_mult)) { - if (isset($_REQUEST['selected_fld'])) { + if (isset($_POST['selected_fld'])) { if ($submit_mult == 'browse') { // browsing the table displaying only selected columns $this->displayTableBrowseForSelectedColumns( @@ -230,13 +230,13 @@ class TableStructureController extends TableController // handle multiple field commands // handle confirmation of deleting multiple columns $action = 'tbl_structure.php'; - $GLOBALS['selected'] = $_REQUEST['selected_fld']; + $GLOBALS['selected'] = $_POST['selected_fld']; list( $what_ret, $query_type_ret, $is_unset_submit_mult, $mult_btn_ret, $centralColsError ) = $this->getDataForSubmitMult( - $submit_mult, $_REQUEST['selected_fld'], $action + $submit_mult, $_POST['selected_fld'], $action ); //update the existing variables // todo: refactor mult_submits.inc.php such as @@ -293,29 +293,29 @@ class TableStructureController extends TableController /** * Modifications have been submitted -> updates the table */ - if (isset($_REQUEST['do_save_data'])) { + if (isset($_POST['do_save_data'])) { $regenerate = $this->updateColumns(); if ($regenerate) { // This happens when updating failed // @todo: do something appropriate } else { // continue to show the table's structure - unset($_REQUEST['selected']); + unset($_POST['selected']); } } /** * Modifications to the partitioning have been submitted -> updates the table */ - if (isset($_REQUEST['save_partitioning'])) { + if (isset($_POST['save_partitioning'])) { $this->updatePartitioning(); } /** * Adding indexes */ - if (isset($_REQUEST['add_key']) - || isset($_REQUEST['partition_maintenance']) + if (isset($_POST['add_key']) + || isset($_POST['partition_maintenance']) ) { //todo: set some variables for sql.php include, to be eliminated //after refactoring sql.php @@ -399,8 +399,8 @@ class TableStructureController extends TableController $changes = array(); // move columns from first to last - for ($i = 0, $l = count($_REQUEST['move_columns']); $i < $l; $i++) { - $column = $_REQUEST['move_columns'][$i]; + for ($i = 0, $l = count($_POST['move_columns']); $i < $l; $i++) { + $column = $_POST['move_columns'][$i]; // is this column already correctly placed? if ($column_names[$i] == $column) { continue; @@ -554,7 +554,7 @@ class TableStructureController extends TableController protected function displayHtmlForPartitionChange() { $partitionDetails = null; - if (! isset($_REQUEST['partition_by'])) { + if (! isset($_POST['partition_by'])) { $partitionDetails = $this->_extractPartitionDetails(); } @@ -778,18 +778,18 @@ class TableStructureController extends TableController ); foreach ($types as $type) { - if (isset($_REQUEST['submit_mult_' . $type . '_x'])) { + if (isset($_POST['submit_mult_' . $type . '_x'])) { return $type; } } - if (isset($_REQUEST['submit_mult'])) { - return $_REQUEST['submit_mult']; - } elseif (isset($_REQUEST['mult_btn']) - && $_REQUEST['mult_btn'] == __('Yes') + if (isset($_POST['submit_mult'])) { + return $_POST['submit_mult']; + } elseif (isset($_POST['mult_btn']) + && $_POST['mult_btn'] == __('Yes') ) { - if (isset($_REQUEST['selected'])) { - $_REQUEST['selected_fld'] = $_REQUEST['selected']; + if (isset($_POST['selected'])) { + $_POST['selected_fld'] = $_POST['selected']; } return 'row_delete'; } @@ -809,7 +809,7 @@ class TableStructureController extends TableController { $GLOBALS['active_page'] = 'sql.php'; $fields = array(); - foreach ($_REQUEST['selected_fld'] as $sval) { + foreach ($_POST['selected_fld'] as $sval) { $fields[] = Util::backquote($sval); } $sql_query = sprintf( @@ -867,7 +867,7 @@ class TableStructureController extends TableController ) ); $regenerate = false; - $field_cnt = count($_REQUEST['field_name']); + $field_cnt = count($_POST['field_name']); $changes = array(); $adjust_privileges = array(); @@ -877,20 +877,20 @@ class TableStructureController extends TableController } $changes[] = 'CHANGE ' . Table::generateAlter( - Util::getValueByKey($_REQUEST, "field_orig.${i}", ''), - $_REQUEST['field_name'][$i], - $_REQUEST['field_type'][$i], - $_REQUEST['field_length'][$i], - $_REQUEST['field_attribute'][$i], - Util::getValueByKey($_REQUEST, "field_collation.${i}", ''), - Util::getValueByKey($_REQUEST, "field_null.${i}", 'NOT NULL'), - $_REQUEST['field_default_type'][$i], - $_REQUEST['field_default_value'][$i], - Util::getValueByKey($_REQUEST, "field_extra.${i}", false), - Util::getValueByKey($_REQUEST, "field_comments.${i}", ''), - Util::getValueByKey($_REQUEST, "field_virtuality.${i}", ''), - Util::getValueByKey($_REQUEST, "field_expression.${i}", ''), - Util::getValueByKey($_REQUEST, "field_move_to.${i}", '') + Util::getValueByKey($_POST, "field_orig.${i}", ''), + $_POST['field_name'][$i], + $_POST['field_type'][$i], + $_POST['field_length'][$i], + $_POST['field_attribute'][$i], + Util::getValueByKey($_POST, "field_collation.${i}", ''), + Util::getValueByKey($_POST, "field_null.${i}", 'NOT NULL'), + $_POST['field_default_type'][$i], + $_POST['field_default_value'][$i], + Util::getValueByKey($_POST, "field_extra.${i}", false), + Util::getValueByKey($_POST, "field_comments.${i}", ''), + Util::getValueByKey($_POST, "field_virtuality.${i}", ''), + Util::getValueByKey($_POST, "field_expression.${i}", ''), + Util::getValueByKey($_POST, "field_move_to.${i}", '') ); // find the remembered sort expression @@ -900,22 +900,22 @@ class TableStructureController extends TableController // if the old column name is part of the remembered sort expression if (mb_strpos( $sorted_col, - Util::backquote($_REQUEST['field_orig'][$i]) + Util::backquote($_POST['field_orig'][$i]) ) !== false) { // delete the whole remembered sort expression $this->table_obj->removeUiProp(Table::PROP_SORTED_COLUMN); } - if (isset($_REQUEST['field_adjust_privileges'][$i]) - && ! empty($_REQUEST['field_adjust_privileges'][$i]) - && $_REQUEST['field_orig'][$i] != $_REQUEST['field_name'][$i] + if (isset($_POST['field_adjust_privileges'][$i]) + && ! empty($_POST['field_adjust_privileges'][$i]) + && $_POST['field_orig'][$i] != $_POST['field_name'][$i] ) { - $adjust_privileges[$_REQUEST['field_orig'][$i]] - = $_REQUEST['field_name'][$i]; + $adjust_privileges[$_POST['field_orig'][$i]] + = $_POST['field_name'][$i]; } } // end for - if (count($changes) > 0 || isset($_REQUEST['preview_sql'])) { + if (count($changes) > 0 || isset($_POST['preview_sql'])) { // Builds the primary keys statements and updates the table $key_query = ''; /** @@ -942,7 +942,7 @@ class TableStructureController extends TableController $sql_query .= ';'; // If there is a request for SQL previewing. - if (isset($_REQUEST['preview_sql'])) { + if (isset($_POST['preview_sql'])) { Core::previewSQL(count($changes) > 0 ? $sql_query : ''); } @@ -957,18 +957,18 @@ class TableStructureController extends TableController // While changing the Column Collation // First change to BLOB for ($i = 0; $i < $field_cnt; $i++ ) { - if (isset($_REQUEST['field_collation'][$i]) - && isset($_REQUEST['field_collation_orig'][$i]) - && $_REQUEST['field_collation'][$i] !== $_REQUEST['field_collation_orig'][$i] - && ! in_array($_REQUEST['field_orig'][$i], $columns_with_index) + if (isset($_POST['field_collation'][$i]) + && isset($_POST['field_collation_orig'][$i]) + && $_POST['field_collation'][$i] !== $_POST['field_collation_orig'][$i] + && ! in_array($_POST['field_orig'][$i], $columns_with_index) ) { $secondary_query = 'ALTER TABLE ' . Util::backquote( $this->table ) . ' CHANGE ' . Util::backquote( - $_REQUEST['field_orig'][$i] + $_POST['field_orig'][$i] ) - . ' ' . Util::backquote($_REQUEST['field_orig'][$i]) + . ' ' . Util::backquote($_POST['field_orig'][$i]) . ' BLOB;'; $this->dbi->query($secondary_query); $changedToBlob[$i] = true; @@ -1013,20 +1013,20 @@ class TableStructureController extends TableController for ($i = 0; $i < $field_cnt; $i++) { if ($changedToBlob[$i]) { $changes_revert[] = 'CHANGE ' . Table::generateAlter( - Util::getValueByKey($_REQUEST, "field_orig.${i}", ''), - $_REQUEST['field_name'][$i], - $_REQUEST['field_type_orig'][$i], - $_REQUEST['field_length_orig'][$i], - $_REQUEST['field_attribute_orig'][$i], - Util::getValueByKey($_REQUEST, "field_collation_orig.${i}", ''), - Util::getValueByKey($_REQUEST, "field_null_orig.${i}", 'NOT NULL'), - $_REQUEST['field_default_type_orig'][$i], - $_REQUEST['field_default_value_orig'][$i], - Util::getValueByKey($_REQUEST, "field_extra_orig.${i}", false), - Util::getValueByKey($_REQUEST, "field_comments_orig.${i}", ''), - Util::getValueByKey($_REQUEST, "field_virtuality_orig.${i}", ''), - Util::getValueByKey($_REQUEST, "field_expression_orig.${i}", ''), - Util::getValueByKey($_REQUEST, "field_move_to_orig.${i}", '') + Util::getValueByKey($_POST, "field_orig.${i}", ''), + $_POST['field_name'][$i], + $_POST['field_type_orig'][$i], + $_POST['field_length_orig'][$i], + $_POST['field_attribute_orig'][$i], + Util::getValueByKey($_POST, "field_collation_orig.${i}", ''), + Util::getValueByKey($_POST, "field_null_orig.${i}", 'NOT NULL'), + $_POST['field_default_type_orig'][$i], + $_POST['field_default_value_orig'][$i], + Util::getValueByKey($_POST, "field_extra_orig.${i}", false), + Util::getValueByKey($_POST, "field_comments_orig.${i}", ''), + Util::getValueByKey($_POST, "field_virtuality_orig.${i}", ''), + Util::getValueByKey($_POST, "field_expression_orig.${i}", ''), + Util::getValueByKey($_POST, "field_move_to_orig.${i}", '') ); } } @@ -1051,34 +1051,34 @@ class TableStructureController extends TableController } // update field names in relation - if (isset($_REQUEST['field_orig']) && is_array($_REQUEST['field_orig'])) { - foreach ($_REQUEST['field_orig'] as $fieldindex => $fieldcontent) { - if ($_REQUEST['field_name'][$fieldindex] != $fieldcontent) { + if (isset($_POST['field_orig']) && is_array($_POST['field_orig'])) { + foreach ($_POST['field_orig'] as $fieldindex => $fieldcontent) { + if ($_POST['field_name'][$fieldindex] != $fieldcontent) { $this->relation->renameField( $this->db, $this->table, $fieldcontent, - $_REQUEST['field_name'][$fieldindex] + $_POST['field_name'][$fieldindex] ); } } } // update mime types - if (isset($_REQUEST['field_mimetype']) - && is_array($_REQUEST['field_mimetype']) + if (isset($_POST['field_mimetype']) + && is_array($_POST['field_mimetype']) && $GLOBALS['cfg']['BrowseMIME'] ) { - foreach ($_REQUEST['field_mimetype'] as $fieldindex => $mimetype) { - if (isset($_REQUEST['field_name'][$fieldindex]) - && strlen($_REQUEST['field_name'][$fieldindex]) > 0 + foreach ($_POST['field_mimetype'] as $fieldindex => $mimetype) { + if (isset($_POST['field_name'][$fieldindex]) + && strlen($_POST['field_name'][$fieldindex]) > 0 ) { Transformations::setMIME( $this->db, $this->table, - $_REQUEST['field_name'][$fieldindex], + $_POST['field_name'][$fieldindex], $mimetype, - $_REQUEST['field_transformation'][$fieldindex], - $_REQUEST['field_transformation_options'][$fieldindex], - $_REQUEST['field_input_transformation'][$fieldindex], - $_REQUEST['field_input_transformation_options'][$fieldindex] + $_POST['field_transformation'][$fieldindex], + $_POST['field_transformation_options'][$fieldindex], + $_POST['field_input_transformation'][$fieldindex], + $_POST['field_input_transformation_options'][$fieldindex] ); } } @@ -1143,15 +1143,15 @@ class TableStructureController extends TableController { // these two fields are checkboxes so might not be part of the // request; therefore we define them to avoid notices below - if (! isset($_REQUEST['field_null'][$i])) { - $_REQUEST['field_null'][$i] = 'NO'; + if (! isset($_POST['field_null'][$i])) { + $_POST['field_null'][$i] = 'NO'; } - if (! isset($_REQUEST['field_extra'][$i])) { - $_REQUEST['field_extra'][$i] = ''; + if (! isset($_POST['field_extra'][$i])) { + $_POST['field_extra'][$i] = ''; } // field_name does not follow the convention (corresponds to field_orig) - if ($_REQUEST['field_name'][$i] != $_REQUEST['field_orig'][$i]) { + if ($_POST['field_name'][$i] != $_POST['field_orig'][$i]) { return true; } @@ -1161,11 +1161,11 @@ class TableStructureController extends TableController 'field_length', 'field_null', 'field_type' ); foreach ($fields as $field) { - if ($_REQUEST[$field][$i] != $_REQUEST[$field . '_orig'][$i]) { + if ($_POST[$field][$i] != $_POST[$field . '_orig'][$i]) { return true; } } - return !empty($_REQUEST['field_move_to'][$i]); + return !empty($_POST['field_move_to'][$i]); } /** diff --git a/libraries/classes/CreateAddField.php b/libraries/classes/CreateAddField.php index a7b46eee39..3467fc8a75 100644 --- a/libraries/classes/CreateAddField.php +++ b/libraries/classes/CreateAddField.php @@ -42,12 +42,12 @@ class CreateAddField */ private function getIndexedColumns() { - $fieldCount = count($_REQUEST['field_name']); - $fieldPrimary = json_decode($_REQUEST['primary_indexes'], true); - $fieldIndex = json_decode($_REQUEST['indexes'], true); - $fieldUnique = json_decode($_REQUEST['unique_indexes'], true); - $fieldFullText = json_decode($_REQUEST['fulltext_indexes'], true); - $fieldSpatial = json_decode($_REQUEST['spatial_indexes'], true); + $fieldCount = count($_POST['field_name']); + $fieldPrimary = json_decode($_POST['primary_indexes'], true); + $fieldIndex = json_decode($_POST['indexes'], true); + $fieldUnique = json_decode($_POST['unique_indexes'], true); + $fieldFullText = json_decode($_POST['fulltext_indexes'], true); + $fieldSpatial = json_decode($_POST['spatial_indexes'], true); return [ $fieldCount, @@ -78,35 +78,35 @@ class CreateAddField $previousField = -1; for ($i = 0; $i < $fieldCount; ++$i) { // '0' is also empty for php :-( - if (strlen($_REQUEST['field_name'][$i]) === 0) { + if (strlen($_POST['field_name'][$i]) === 0) { continue; } $definition = $this->getStatementPrefix($isCreateTable) . Table::generateFieldSpec( - trim($_REQUEST['field_name'][$i]), - $_REQUEST['field_type'][$i], - $_REQUEST['field_length'][$i], - $_REQUEST['field_attribute'][$i], - isset($_REQUEST['field_collation'][$i]) - ? $_REQUEST['field_collation'][$i] + trim($_POST['field_name'][$i]), + $_POST['field_type'][$i], + $_POST['field_length'][$i], + $_POST['field_attribute'][$i], + isset($_POST['field_collation'][$i]) + ? $_POST['field_collation'][$i] : '', - isset($_REQUEST['field_null'][$i]) - ? $_REQUEST['field_null'][$i] + isset($_POST['field_null'][$i]) + ? $_POST['field_null'][$i] : 'NOT NULL', - $_REQUEST['field_default_type'][$i], - $_REQUEST['field_default_value'][$i], - isset($_REQUEST['field_extra'][$i]) - ? $_REQUEST['field_extra'][$i] + $_POST['field_default_type'][$i], + $_POST['field_default_value'][$i], + isset($_POST['field_extra'][$i]) + ? $_POST['field_extra'][$i] : false, - isset($_REQUEST['field_comments'][$i]) - ? $_REQUEST['field_comments'][$i] + isset($_POST['field_comments'][$i]) + ? $_POST['field_comments'][$i] : '', - isset($_REQUEST['field_virtuality'][$i]) - ? $_REQUEST['field_virtuality'][$i] + isset($_POST['field_virtuality'][$i]) + ? $_POST['field_virtuality'][$i] : '', - isset($_REQUEST['field_expression'][$i]) - ? $_REQUEST['field_expression'][$i] + isset($_POST['field_expression'][$i]) + ? $_POST['field_expression'][$i] : '' ); @@ -139,22 +139,22 @@ class CreateAddField return $sqlSuffix; } - if ((string) $_REQUEST['field_where'] === 'last') { + if ((string) $_POST['field_where'] === 'last') { return $sqlSuffix; } // Only the first field can be added somewhere other than at the end if ($previousField == -1) { - if ((string) $_REQUEST['field_where'] === 'first') { + if ((string) $_POST['field_where'] === 'first') { $sqlSuffix .= ' FIRST'; } else { $sqlSuffix .= ' AFTER ' - . Util::backquote($_REQUEST['after_field']); + . Util::backquote($_POST['after_field']); } } else { $sqlSuffix .= ' AFTER ' . Util::backquote( - $_REQUEST['field_name'][$previousField] + $_POST['field_name'][$previousField] ); } @@ -192,7 +192,7 @@ class CreateAddField $indexFields = []; foreach ($index['columns'] as $key => $column) { $indexFields[$key] = Util::backquote( - $_REQUEST['field_name'][$column['col_index']] + $_POST['field_name'][$column['col_index']] ); if ($column['size']) { $indexFields[$key] .= '(' . $column['size'] . ')'; @@ -358,30 +358,30 @@ class CreateAddField public function getPartitionsDefinition() { $sqlQuery = ""; - if (! empty($_REQUEST['partition_by']) - && ! empty($_REQUEST['partition_expr']) - && ! empty($_REQUEST['partition_count']) - && $_REQUEST['partition_count'] > 1 + if (! empty($_POST['partition_by']) + && ! empty($_POST['partition_expr']) + && ! empty($_POST['partition_count']) + && $_POST['partition_count'] > 1 ) { - $sqlQuery .= " PARTITION BY " . $_REQUEST['partition_by'] - . " (" . $_REQUEST['partition_expr'] . ")" - . " PARTITIONS " . $_REQUEST['partition_count']; + $sqlQuery .= " PARTITION BY " . $_POST['partition_by'] + . " (" . $_POST['partition_expr'] . ")" + . " PARTITIONS " . $_POST['partition_count']; } - if (! empty($_REQUEST['subpartition_by']) - && ! empty($_REQUEST['subpartition_expr']) - && ! empty($_REQUEST['subpartition_count']) - && $_REQUEST['subpartition_count'] > 1 + if (! empty($_POST['subpartition_by']) + && ! empty($_POST['subpartition_expr']) + && ! empty($_POST['subpartition_count']) + && $_POST['subpartition_count'] > 1 ) { - $sqlQuery .= " SUBPARTITION BY " . $_REQUEST['subpartition_by'] - . " (" . $_REQUEST['subpartition_expr'] . ")" - . " SUBPARTITIONS " . $_REQUEST['subpartition_count']; + $sqlQuery .= " SUBPARTITION BY " . $_POST['subpartition_by'] + . " (" . $_POST['subpartition_expr'] . ")" + . " SUBPARTITIONS " . $_POST['subpartition_count']; } - if (! empty($_REQUEST['partitions'])) { + if (! empty($_POST['partitions'])) { $i = 0; $partitions = []; - foreach ($_REQUEST['partitions'] as $partition) { + foreach ($_POST['partitions'] as $partition) { $partitions[] = $this->getPartitionDefinition($partition); $i++; } @@ -471,24 +471,24 @@ class CreateAddField . Util::backquote(trim($table)) . ' (' . $sqlStatement . ')'; // Adds table type, character set, comments and partition definition - if (!empty($_REQUEST['tbl_storage_engine']) - && ($_REQUEST['tbl_storage_engine'] != 'Default') + if (!empty($_POST['tbl_storage_engine']) + && ($_POST['tbl_storage_engine'] != 'Default') ) { - $sqlQuery .= ' ENGINE = ' . $_REQUEST['tbl_storage_engine']; + $sqlQuery .= ' ENGINE = ' . $_POST['tbl_storage_engine']; } - if (!empty($_REQUEST['tbl_collation'])) { - $sqlQuery .= Util::getCharsetQueryPart($_REQUEST['tbl_collation']); + if (!empty($_POST['tbl_collation'])) { + $sqlQuery .= Util::getCharsetQueryPart($_POST['tbl_collation']); } - if (! empty($_REQUEST['connection']) - && ! empty($_REQUEST['tbl_storage_engine']) - && $_REQUEST['tbl_storage_engine'] == 'FEDERATED' + if (! empty($_POST['connection']) + && ! empty($_POST['tbl_storage_engine']) + && $_POST['tbl_storage_engine'] == 'FEDERATED' ) { $sqlQuery .= " CONNECTION = '" - . $this->dbi->escapeString($_REQUEST['connection']) . "'"; + . $this->dbi->escapeString($_POST['connection']) . "'"; } - if (!empty($_REQUEST['comment'])) { + if (!empty($_POST['comment'])) { $sqlQuery .= ' COMMENT = \'' - . $this->dbi->escapeString($_REQUEST['comment']) . '\''; + . $this->dbi->escapeString($_POST['comment']) . '\''; } $sqlQuery .= $this->getPartitionsDefinition(); $sqlQuery .= ';'; @@ -506,14 +506,14 @@ class CreateAddField // Limit to 4096 fields (MySQL maximal value) $mysqlLimit = 4096; - if (isset($_REQUEST['submit_num_fields'])) { // adding new fields - $numberOfFields = intval($_REQUEST['orig_num_fields']) + intval($_REQUEST['added_fields']); - } elseif (isset($_REQUEST['orig_num_fields'])) { // retaining existing fields - $numberOfFields = intval($_REQUEST['orig_num_fields']); - } elseif (isset($_REQUEST['num_fields']) - && intval($_REQUEST['num_fields']) > 0 + if (isset($_POST['submit_num_fields'])) { // adding new fields + $numberOfFields = intval($_POST['orig_num_fields']) + intval($_POST['added_fields']); + } elseif (isset($_POST['orig_num_fields'])) { // retaining existing fields + $numberOfFields = intval($_POST['orig_num_fields']); + } elseif (isset($_POST['num_fields']) + && intval($_POST['num_fields']) > 0 ) { // new table with specified number of fields - $numberOfFields = intval($_REQUEST['num_fields']); + $numberOfFields = intval($_POST['num_fields']); } else { // new table with unspecified number of fields $numberOfFields = 4; } @@ -548,7 +548,7 @@ class CreateAddField $sqlQuery = 'ALTER TABLE ' . Util::backquote($table) . ' ' . $sqlStatement . ';'; // If there is a request for SQL previewing. - if (isset($_REQUEST['preview_sql'])) { + if (isset($_POST['preview_sql'])) { Core::previewSQL($sqlQuery); } return [$this->dbi->tryQuery($sqlQuery), $sqlQuery]; diff --git a/libraries/classes/Database/Qbe.php b/libraries/classes/Database/Qbe.php index bf16a0cf0f..9f7bd2a9ed 100644 --- a/libraries/classes/Database/Qbe.php +++ b/libraries/classes/Database/Qbe.php @@ -254,7 +254,7 @@ class Qbe } $criterias = $this->_currentSearch->getCriterias(); - $_REQUEST = $criterias + $_REQUEST; + $_POST = $criterias + $_POST; return $this; } @@ -279,34 +279,34 @@ class Qbe $criteriaColumnCount = $this->_initializeCriteriasCount(); $this->_criteriaColumnInsert = Core::ifSetOr( - $_REQUEST['criteriaColumnInsert'], + $_POST['criteriaColumnInsert'], null, 'array' ); $this->_criteriaColumnDelete = Core::ifSetOr( - $_REQUEST['criteriaColumnDelete'], + $_POST['criteriaColumnDelete'], null, 'array' ); - $this->_prev_criteria = isset($_REQUEST['prev_criteria']) - ? $_REQUEST['prev_criteria'] + $this->_prev_criteria = isset($_POST['prev_criteria']) + ? $_POST['prev_criteria'] : array(); - $this->_criteria = isset($_REQUEST['criteria']) - ? $_REQUEST['criteria'] + $this->_criteria = isset($_POST['criteria']) + ? $_POST['criteria'] : array_fill(0, $criteriaColumnCount, ''); - $this->_criteriaRowInsert = isset($_REQUEST['criteriaRowInsert']) - ? $_REQUEST['criteriaRowInsert'] + $this->_criteriaRowInsert = isset($_POST['criteriaRowInsert']) + ? $_POST['criteriaRowInsert'] : array_fill(0, $criteriaColumnCount, ''); - $this->_criteriaRowDelete = isset($_REQUEST['criteriaRowDelete']) - ? $_REQUEST['criteriaRowDelete'] + $this->_criteriaRowDelete = isset($_POST['criteriaRowDelete']) + ? $_POST['criteriaRowDelete'] : array_fill(0, $criteriaColumnCount, ''); - $this->_criteriaAndOrRow = isset($_REQUEST['criteriaAndOrRow']) - ? $_REQUEST['criteriaAndOrRow'] + $this->_criteriaAndOrRow = isset($_POST['criteriaAndOrRow']) + ? $_POST['criteriaAndOrRow'] : array_fill(0, $criteriaColumnCount, ''); - $this->_criteriaAndOrColumn = isset($_REQUEST['criteriaAndOrColumn']) - ? $_REQUEST['criteriaAndOrColumn'] + $this->_criteriaAndOrColumn = isset($_POST['criteriaAndOrColumn']) + ? $_POST['criteriaAndOrColumn'] : array_fill(0, $criteriaColumnCount, ''); // sets minimum width $this->_form_column_width = 12; @@ -326,8 +326,8 @@ class Qbe private function _setCriteriaTablesAndColumns() { // The tables list sent by a previously submitted form - if (Core::isValid($_REQUEST['TableList'], 'array')) { - foreach ($_REQUEST['TableList'] as $each_table) { + if (Core::isValid($_POST['TableList'], 'array')) { + foreach ($_POST['TableList'] as $each_table) { $this->_criteriaTables[$each_table] = ' selected="selected"'; } } // end if @@ -346,7 +346,7 @@ class Qbe $columns = $GLOBALS['dbi']->getColumns($this->_db, $table); if (empty($this->_criteriaTables[$table]) - && ! empty($_REQUEST['TableList']) + && ! empty($_POST['TableList']) ) { $this->_criteriaTables[$table] = ''; } else { @@ -475,10 +475,10 @@ class Qbe continue; } $selected = ''; - if (isset($_REQUEST['criteriaColumn'][$column_index])) { - $selected = $_REQUEST['criteriaColumn'][$column_index]; + if (isset($_POST['criteriaColumn'][$column_index])) { + $selected = $_POST['criteriaColumn'][$column_index]; $this->_formColumns[$new_column_count] - = $_REQUEST['criteriaColumn'][$column_index]; + = $_POST['criteriaColumn'][$column_index]; } $html_output .= $this->_showColumnSelectCell( $new_column_count, @@ -526,10 +526,10 @@ class Qbe } $tmp_alias = ''; - if (! empty($_REQUEST['criteriaAlias'][$colInd])) { + if (! empty($_POST['criteriaAlias'][$colInd])) { $tmp_alias = $this->_formAliases[$new_column_count] - = $_REQUEST['criteriaAlias'][$colInd]; + = $_POST['criteriaAlias'][$colInd]; }// end if $html_output .= ''; @@ -575,21 +575,21 @@ class Qbe } // If they have chosen all fields using the * selector, // then sorting is not available, Fix for Bug #570698 - if (isset($_REQUEST['criteriaSort'][$colInd]) - && isset($_REQUEST['criteriaColumn'][$colInd]) - && mb_substr($_REQUEST['criteriaColumn'][$colInd], -2) == '.*' + if (isset($_POST['criteriaSort'][$colInd]) + && isset($_POST['criteriaColumn'][$colInd]) + && mb_substr($_POST['criteriaColumn'][$colInd], -2) == '.*' ) { - $_REQUEST['criteriaSort'][$colInd] = ''; + $_POST['criteriaSort'][$colInd] = ''; } //end if $selected = ''; - if (isset($_REQUEST['criteriaSort'][$colInd])) { + if (isset($_POST['criteriaSort'][$colInd])) { $this->_formSorts[$new_column_count] - = $_REQUEST['criteriaSort'][$colInd]; + = $_POST['criteriaSort'][$colInd]; - if ($_REQUEST['criteriaSort'][$colInd] == 'ASC') { + if ($_POST['criteriaSort'][$colInd] == 'ASC') { $selected = 'ASC'; - } elseif ($_REQUEST['criteriaSort'][$colInd] == 'DESC') { + } elseif ($_POST['criteriaSort'][$colInd] == 'DESC') { $selected = 'DESC'; } } else { @@ -639,10 +639,10 @@ class Qbe } $sortOrder = null; - if (! empty($_REQUEST['criteriaSortOrder'][$colInd])) { + if (! empty($_POST['criteriaSortOrder'][$colInd])) { $sortOrder = $this->_formSortOrders[$new_column_count] - = $_REQUEST['criteriaSortOrder'][$colInd]; + = $_POST['criteriaSortOrder'][$colInd]; } $html_output .= $this->_getSortOrderSelectCell( @@ -685,10 +685,10 @@ class Qbe ) { continue; } - if (isset($_REQUEST['criteriaShow'][$column_index])) { + if (isset($_POST['criteriaShow'][$column_index])) { $checked_options = ' checked="checked"'; $this->_formShows[$new_column_count] - = $_REQUEST['criteriaShow'][$column_index]; + = $_POST['criteriaShow'][$column_index]; } else { $checked_options = ''; } @@ -1007,8 +1007,8 @@ class Qbe continue; } $or = 'Or' . $new_row_index; - if (! empty($_REQUEST[$or]) && isset($_REQUEST[$or][$column_index])) { - $tmp_or = $_REQUEST[$or][$column_index]; + if (! empty($_POST[$or]) && isset($_POST[$or][$column_index])) { + $tmp_or = $_POST[$or][$column_index]; } else { $tmp_or = ''; } @@ -1177,7 +1177,7 @@ class Qbe $column_index++ ) { if (! empty($this->_formColumns[$column_index]) - && ! empty($_REQUEST['Or' . $row_index][$column_index]) + && ! empty($_POST['Or' . $row_index][$column_index]) && $column_index ) { $qry_orwhere .= ' ' @@ -1187,11 +1187,11 @@ class Qbe . ' '; } if (! empty($this->_formColumns[$column_index]) - && ! empty($_REQUEST['Or' . $row_index][$column_index]) + && ! empty($_POST['Or' . $row_index][$column_index]) ) { $qry_orwhere .= '(' . $this->_formColumns[$column_index] . ' ' - . $_REQUEST['Or' . $row_index][$column_index] + . $_POST['Or' . $row_index][$column_index] . ')'; $last_orwhere = $column_index; $criteria_cnt++; @@ -1901,12 +1901,12 @@ class Qbe { // sets column count $criteriaColumnCount = Core::ifSetOr( - $_REQUEST['criteriaColumnCount'], + $_POST['criteriaColumnCount'], 3, 'numeric' ); $criteriaColumnAdd = Core::ifSetOr( - $_REQUEST['criteriaColumnAdd'], + $_POST['criteriaColumnAdd'], 0, 'numeric' ); @@ -1916,8 +1916,8 @@ class Qbe ); // sets row count - $rows = Core::ifSetOr($_REQUEST['rows'], 0, 'numeric'); - $criteriaRowAdd = Core::ifSetOr($_REQUEST['criteriaRowAdd'], 0, 'numeric'); + $rows = Core::ifSetOr($_POST['rows'], 0, 'numeric'); + $criteriaRowAdd = Core::ifSetOr($_POST['criteriaRowAdd'], 0, 'numeric'); $this->_criteria_row_count = min( 100, max($rows + $criteriaRowAdd, 0) diff --git a/libraries/classes/Database/Search.php b/libraries/classes/Database/Search.php index 23db54359e..f5923f9ecc 100644 --- a/libraries/classes/Database/Search.php +++ b/libraries/classes/Database/Search.php @@ -109,48 +109,48 @@ class Search { $this->tablesNamesOnly = $GLOBALS['dbi']->getTables($this->db); - if (empty($_REQUEST['criteriaSearchType']) - || ! is_string($_REQUEST['criteriaSearchType']) + if (empty($_POST['criteriaSearchType']) + || ! is_string($_POST['criteriaSearchType']) || ! array_key_exists( - $_REQUEST['criteriaSearchType'], + $_POST['criteriaSearchType'], $this->searchTypes ) ) { $this->criteriaSearchType = 1; - unset($_REQUEST['submit_search']); + unset($_POST['submit_search']); } else { - $this->criteriaSearchType = (int) $_REQUEST['criteriaSearchType']; + $this->criteriaSearchType = (int) $_POST['criteriaSearchType']; $this->searchTypeDescription - = $this->searchTypes[$_REQUEST['criteriaSearchType']]; + = $this->searchTypes[$_POST['criteriaSearchType']]; } - if (empty($_REQUEST['criteriaSearchString']) - || ! is_string($_REQUEST['criteriaSearchString']) + if (empty($_POST['criteriaSearchString']) + || ! is_string($_POST['criteriaSearchString']) ) { $this->criteriaSearchString = ''; - unset($_REQUEST['submit_search']); + unset($_POST['submit_search']); } else { - $this->criteriaSearchString = $_REQUEST['criteriaSearchString']; + $this->criteriaSearchString = $_POST['criteriaSearchString']; } $this->criteriaTables = array(); - if (empty($_REQUEST['criteriaTables']) - || ! is_array($_REQUEST['criteriaTables']) + if (empty($_POST['criteriaTables']) + || ! is_array($_POST['criteriaTables']) ) { - unset($_REQUEST['submit_search']); + unset($_POST['submit_search']); } else { $this->criteriaTables = array_intersect( - $_REQUEST['criteriaTables'], $this->tablesNamesOnly + $_POST['criteriaTables'], $this->tablesNamesOnly ); } - if (empty($_REQUEST['criteriaColumnName']) - || ! is_string($_REQUEST['criteriaColumnName']) + if (empty($_POST['criteriaColumnName']) + || ! is_string($_POST['criteriaColumnName']) ) { unset($this->criteriaColumnName); } else { $this->criteriaColumnName = $GLOBALS['dbi']->escapeString( - $_REQUEST['criteriaColumnName'] + $_POST['criteriaColumnName'] ); } } diff --git a/libraries/classes/Display/Export.php b/libraries/classes/Display/Export.php index c4b9479fb7..39af43df91 100644 --- a/libraries/classes/Display/Export.php +++ b/libraries/classes/Display/Export.php @@ -62,11 +62,11 @@ class Export */ public function getHtmlForSelectOptions($tmpSelect = '') { - // Check if the selected databases are defined in $_GET + // Check if the selected databases are defined in $_POST // (from clicking Back button on export.php) - if (isset($_GET['db_select'])) { - $_GET['db_select'] = urldecode($_GET['db_select']); - $_GET['db_select'] = explode(",", $_GET['db_select']); + if (isset($_POST['db_select'])) { + $_POST['db_select'] = urldecode($_POST['db_select']); + $_POST['db_select'] = explode(",", $_POST['db_select']); } $databases = []; @@ -75,8 +75,8 @@ class Export continue; } $isSelected = false; - if (isset($_GET['db_select'])) { - if (in_array($currentDb, $_GET['db_select'])) { + if (isset($_POST['db_select'])) { + if (in_array($currentDb, $_POST['db_select'])) { $isSelected = true; } } elseif (!empty($tmpSelect)) { @@ -121,14 +121,14 @@ class Export global $cfg; // If the export method was not set, the default is quick - if (isset($_GET['export_method'])) { - $cfg['Export']['method'] = $_GET['export_method']; + if (isset($_POST['export_method'])) { + $cfg['Export']['method'] = $_POST['export_method']; } elseif (! isset($cfg['Export']['method'])) { $cfg['Export']['method'] = 'quick'; } - if (empty($sqlQuery) && isset($_GET['sql_query'])) { - $sqlQuery = $_GET['sql_query']; + if (empty($sqlQuery) && isset($_POST['sql_query'])) { + $sqlQuery = $_POST['sql_query']; } return Template::get('display/export/hidden_inputs')->render([ @@ -138,7 +138,7 @@ class Export 'export_method' => $cfg['Export']['method'], 'single_table' => $singleTable, 'sql_query' => $sqlQuery, - 'template_id' => isset($_GET['template_id']) ? $_GET['template_id'] : '', + 'template_id' => isset($_POST['template_id']) ? $_POST['template_id'] : '', ]); } @@ -176,7 +176,7 @@ class Export return Template::get('display/export/template_options')->render([ 'templates' => $templates, - 'selected_template' => !empty($_GET['template_id']) ? $_GET['template_id'] : null, + 'selected_template' => !empty($_POST['template_id']) ? $_POST['template_id'] : null, ]); } @@ -188,8 +188,8 @@ class Export private function getHtmlForOptionsMethod() { global $cfg; - if (isset($_GET['quick_or_custom'])) { - $exportMethod = $_GET['quick_or_custom']; + if (isset($_POST['quick_or_custom'])) { + $exportMethod = $_POST['quick_or_custom']; } else { $exportMethod = $cfg['Export']['method']; } @@ -264,9 +264,9 @@ class Export $numberOfRows = $tableObject->countRecords(); return Template::get('display/export/options_rows')->render([ - 'allrows' => isset($_GET['allrows']) ? $_GET['allrows'] : null, - 'limit_to' => isset($_GET['limit_to']) ? $_GET['limit_to'] : null, - 'limit_from' => isset($_GET['limit_from']) ? $_GET['limit_from'] : null, + 'allrows' => isset($_POST['allrows']) ? $_POST['allrows'] : null, + 'limit_to' => isset($_POST['limit_to']) ? $_POST['limit_to'] : null, + 'limit_from' => isset($_POST['limit_from']) ? $_POST['limit_from'] : null, 'unlim_num_rows' => $unlimNumRows, 'number_of_rows' => $numberOfRows, ]); @@ -357,8 +357,8 @@ class Export ); $msg->addParamHtml(''); - if (isset($_GET['filename_template'])) { - $filenameTemplate = $_GET['filename_template']; + if (isset($_POST['filename_template'])) { + $filenameTemplate = $_POST['filename_template']; } else { if ($exportType == 'database') { $filenameTemplate = $GLOBALS['PMA_Config']->getUserValue( @@ -408,8 +408,8 @@ class Export private function getHtmlForOptionsOutputCompression() { global $cfg; - if (isset($_GET['compression'])) { - $selectedCompression = $_GET['compression']; + if (isset($_POST['compression'])) { + $selectedCompression = $_POST['compression']; } elseif (isset($cfg['Export']['compression'])) { $selectedCompression = $cfg['Export']['compression']; } else { @@ -442,7 +442,7 @@ class Export private function getHtmlForOptionsOutputRadio() { return Template::get('display/export/options_output_radio')->render([ - 'has_repopulate' => isset($_GET['repopulate']), + 'has_repopulate' => isset($_POST['repopulate']), 'export_asfile' => $GLOBALS['cfg']['Export']['asfile'], ]); } @@ -505,8 +505,8 @@ class Export 'export_type' => $exportType, 'is_checked_lock_tables' => $isCheckedLockTables, 'is_checked_asfile' => $isCheckedAsfile, - 'repopulate' => isset($_GET['repopulate']), - 'lock_tables' => isset($_GET['lock_tables']), + 'repopulate' => isset($_POST['repopulate']), + 'lock_tables' => isset($_POST['lock_tables']), 'save_dir' => isset($cfg['SaveDir']) ? $cfg['SaveDir'] : null, 'is_encoding_supported' => Encoding::isSupported(), 'options_output_save_dir' => $optionsOutputSaveDir, @@ -658,8 +658,8 @@ class Export ) { $cfgRelation = $this->relation->getRelationsParam(); - if (isset($_REQUEST['single_table'])) { - $GLOBALS['single_table'] = $_REQUEST['single_table']; + if (isset($_POST['single_table'])) { + $GLOBALS['single_table'] = $_POST['single_table']; } /* Scan for plugins */ @@ -731,8 +731,8 @@ class Export */ public function handleTemplateActions(array $cfgRelation) { - if (isset($_REQUEST['templateId'])) { - $id = $GLOBALS['dbi']->escapeString($_REQUEST['templateId']); + if (isset($_POST['templateId'])) { + $id = $GLOBALS['dbi']->escapeString($_POST['templateId']); } else { $id = ''; } @@ -741,16 +741,16 @@ class Export . Util::backquote($cfgRelation['export_templates']); $user = $GLOBALS['dbi']->escapeString($GLOBALS['cfg']['Server']['user']); - switch ($_REQUEST['templateAction']) { + switch ($_POST['templateAction']) { case 'create': $query = "INSERT INTO " . $templateTable . "(" . " `username`, `export_type`," . " `template_name`, `template_data`" . ") VALUES (" . "'" . $user . "', " - . "'" . $GLOBALS['dbi']->escapeString($_REQUEST['exportType']) - . "', '" . $GLOBALS['dbi']->escapeString($_REQUEST['templateName']) - . "', '" . $GLOBALS['dbi']->escapeString($_REQUEST['templateData']) + . "'" . $GLOBALS['dbi']->escapeString($_POST['exportType']) + . "', '" . $GLOBALS['dbi']->escapeString($_POST['templateName']) + . "', '" . $GLOBALS['dbi']->escapeString($_POST['templateData']) . "');"; break; case 'load': @@ -759,7 +759,7 @@ class Export break; case 'update': $query = "UPDATE " . $templateTable . " SET `template_data` = " - . "'" . $GLOBALS['dbi']->escapeString($_REQUEST['templateData']) . "'" + . "'" . $GLOBALS['dbi']->escapeString($_POST['templateData']) . "'" . " WHERE `id` = " . $id . " AND `username` = '" . $user . "'"; break; case 'delete': @@ -782,12 +782,12 @@ class Export } $response->setRequestStatus(true); - if ('create' == $_REQUEST['templateAction']) { + if ('create' == $_POST['templateAction']) { $response->addJSON( 'data', - $this->getOptionsForTemplates($_REQUEST['exportType']) + $this->getOptionsForTemplates($_POST['exportType']) ); - } elseif ('load' == $_REQUEST['templateAction']) { + } elseif ('load' == $_POST['templateAction']) { $data = null; while ($row = $GLOBALS['dbi']->fetchAssoc( $result, DatabaseInterface::CONNECT_CONTROL diff --git a/libraries/classes/Display/Results.php b/libraries/classes/Display/Results.php index 2d815eff8e..ef03d62ded 100644 --- a/libraries/classes/Display/Results.php +++ b/libraries/classes/Display/Results.php @@ -3939,13 +3939,13 @@ class Results } // as this is a form value, the type is always string so we cannot - // use Core::isValid($_REQUEST['session_max_rows'], 'integer') - if (Core::isValid($_REQUEST['session_max_rows'], 'numeric')) { - $query['max_rows'] = (int)$_REQUEST['session_max_rows']; - unset($_REQUEST['session_max_rows']); - } elseif ($_REQUEST['session_max_rows'] == self::ALL_ROWS) { + // use Core::isValid($_POST['session_max_rows'], 'integer') + if (Core::isValid($_POST['session_max_rows'], 'numeric')) { + $query['max_rows'] = (int)$_POST['session_max_rows']; + unset($_POST['session_max_rows']); + } elseif ($_POST['session_max_rows'] == self::ALL_ROWS) { $query['max_rows'] = self::ALL_ROWS; - unset($_REQUEST['session_max_rows']); + unset($_POST['session_max_rows']); } elseif (empty($query['max_rows'])) { $query['max_rows'] = intval($GLOBALS['cfg']['MaxRows']); } diff --git a/libraries/classes/ErrorReport.php b/libraries/classes/ErrorReport.php index 297bd22cb1..52fb22ec4b 100644 --- a/libraries/classes/ErrorReport.php +++ b/libraries/classes/ErrorReport.php @@ -88,10 +88,10 @@ class ErrorReport ]; if ($exceptionType == 'js') { - if (empty($_REQUEST['exception'])) { + if (empty($_POST['exception'])) { return []; } - $exception = $_REQUEST['exception']; + $exception = $_POST['exception']; $exception["stack"] = $this->translateStacktrace($exception["stack"]); list($uri, $scriptName) = $this->sanitizeUrl($exception["url"]); $exception["uri"] = $uri; @@ -100,10 +100,10 @@ class ErrorReport $report["exception_type"] = 'js'; $report["exception"] = $exception; $report["script_name"] = $scriptName; - $report["microhistory"] = $_REQUEST['microhistory']; + $report["microhistory"] = $_POST['microhistory']; - if (! empty($_REQUEST['description'])) { - $report['steps'] = $_REQUEST['description']; + if (! empty($_POST['description'])) { + $report['steps'] = $_POST['description']; } } elseif ($exceptionType == 'php') { $errors = []; diff --git a/libraries/classes/Export.php b/libraries/classes/Export.php index c250be0e73..985510e443 100644 --- a/libraries/classes/Export.php +++ b/libraries/classes/Export.php @@ -341,9 +341,9 @@ class Export . preg_replace('@[/\\\\]@', '_', $filename); if (@file_exists($save_filename) - && ((! $quick_export && empty($_REQUEST['onserver_overwrite'])) + && ((! $quick_export && empty($_POST['onserver_overwrite'])) || ($quick_export - && $_REQUEST['quick_export_onserver_overwrite'] != 'saveitover')) + && $_POST['quick_export_onserver_overwrite'] != 'saveitover')) ) { $message = Message::error( __( @@ -469,45 +469,45 @@ class Export $html = '
'; /** - * Displays a back button with all the $_REQUEST data in the URL + * Displays a back button with all the $_POST data in the URL * (store in a variable to also display after the textarea) */ $back_button = '

[ $value) { + foreach ($_POST as $name => $value) { if (!is_array($value)) { $back_button .= '&' . urlencode($name) . '=' . urlencode($value); } diff --git a/libraries/classes/Footer.php b/libraries/classes/Footer.php index a664e3b49e..7ef6a63d57 100644 --- a/libraries/classes/Footer.php +++ b/libraries/classes/Footer.php @@ -161,28 +161,28 @@ class Footer 'target' => $target ); // needed for server privileges tabs - if (isset($_REQUEST['viewing_mode']) - && in_array($_REQUEST['viewing_mode'], array('server', 'db', 'table')) + if (isset($_GET['viewing_mode']) + && in_array($_GET['viewing_mode'], array('server', 'db', 'table')) ) { - $params['viewing_mode'] = $_REQUEST['viewing_mode']; + $params['viewing_mode'] = $_GET['viewing_mode']; } /* * @todo coming from server_privileges.php, here $db is not set, * add the following condition below when that is fixed - * && $_REQUEST['checkprivsdb'] == $db + * && $_GET['checkprivsdb'] == $db */ - if (isset($_REQUEST['checkprivsdb']) + if (isset($_GET['checkprivsdb']) ) { - $params['checkprivsdb'] = $_REQUEST['checkprivsdb']; + $params['checkprivsdb'] = $_GET['checkprivsdb']; } /* * @todo coming from server_privileges.php, here $table is not set, * add the following condition below when that is fixed * && $_REQUEST['checkprivstable'] == $table */ - if (isset($_REQUEST['checkprivstable']) + if (isset($_GET['checkprivstable']) ) { - $params['checkprivstable'] = $_REQUEST['checkprivstable']; + $params['checkprivstable'] = $_GET['checkprivstable']; } if (isset($_REQUEST['single_table']) && in_array($_REQUEST['single_table'], array(true, false)) diff --git a/libraries/classes/Import.php b/libraries/classes/Import.php index c9b9702504..40a744a9f1 100644 --- a/libraries/classes/Import.php +++ b/libraries/classes/Import.php @@ -286,7 +286,7 @@ class Import $import_run_buffer = self::runQueryPost($import_run_buffer, $sql, $full); // In case of ROLLBACK, notify the user. - if (isset($_REQUEST['rollback_query'])) { + if (isset($_POST['rollback_query'])) { $msg .= __('[ROLLBACK occurred.]'); } } @@ -1343,7 +1343,7 @@ class Import $response = Response::getInstance(); $error = false; $error_msg = __('Only single-table UPDATE and DELETE queries can be simulated.'); - $sql_delimiter = $_REQUEST['sql_delimiter']; + $sql_delimiter = $_POST['sql_delimiter']; $sql_data = array(); $queries = explode($sql_delimiter, $GLOBALS['sql_query']); foreach ($queries as $sql_query) { @@ -1565,7 +1565,7 @@ class Import */ public static function handleRollbackRequest($sql_query) { - $sql_delimiter = $_REQUEST['sql_delimiter']; + $sql_delimiter = $_POST['sql_delimiter']; $queries = explode($sql_delimiter, $sql_query); $error = false; $error_msg = __( @@ -1590,7 +1590,7 @@ class Import } if ($error) { - unset($_REQUEST['rollback_query']); + unset($_POST['rollback_query']); $response = Response::getInstance(); $message = Message::rawError($error); $response->addJSON('message', $message); diff --git a/libraries/classes/Index.php b/libraries/classes/Index.php index c971e5b363..7836e1a77d 100644 --- a/libraries/classes/Index.php +++ b/libraries/classes/Index.php @@ -741,7 +741,7 @@ class Index $r .= '" ' . $row_span . '>' . ' ' . Util::getIcon('b_edit', __('Edit')) . '' . '' . "\n"; $this_params = $GLOBALS['url_params']; diff --git a/libraries/classes/InsertEdit.php b/libraries/classes/InsertEdit.php index c18e3797d6..90aa28f38e 100644 --- a/libraries/classes/InsertEdit.php +++ b/libraries/classes/InsertEdit.php @@ -79,8 +79,8 @@ class InsertEdit $_form_params['where_clause[' . $key_id . ']'] = trim($where_clause); } } - if (isset($_REQUEST['clause_is_unique'])) { - $_form_params['clause_is_unique'] = $_REQUEST['clause_is_unique']; + if (isset($_POST['clause_is_unique'])) { + $_form_params['clause_is_unique'] = $_POST['clause_is_unique']; } return $_form_params; } @@ -280,13 +280,13 @@ class InsertEdit $this_url_params = array_merge($url_params, $params); if (! $is_show) { - return ' : ' + return ' : ' . $this->showTypeOrFunctionLabel($which) . ''; } - return '' . $this->showTypeOrFunctionLabel($which) . ''; @@ -849,7 +849,7 @@ class InsertEdit . 'id="field_' . ($idindex) . '_3" ' . 'value="' . htmlspecialchars($data) . '" />'; - $html_output .= '' . str_replace("'", "\'", $titles['Browse']) . ''; return $html_output; @@ -1120,7 +1121,7 @@ class InsertEdit $html_output .= '

' . '
'; - if (isset($_REQUEST['db_collation'])) { + if (isset($db_collation)) { $html_output .= '' . "\n"; } $html_output .= '' @@ -184,11 +185,12 @@ class Operations /** * Get HTML snippet for copy database * - * @param string $db database name + * @param string $db database name + * @param string $db_collation dataset collation * * @return string $html_output */ - public function getHtmlForCopyDatabase($db) + public function getHtmlForCopyDatabase($db, $db_collation) { $drop_clause = 'DROP TABLE / DROP VIEW'; $choices = array( @@ -205,9 +207,9 @@ class Operations . 'method="post" action="db_operations.php" ' . 'onsubmit="return emptyCheckTheField(this, \'newname\')">'; - if (isset($_REQUEST['db_collation'])) { + if (isset($db_collation)) { $html_output .= '' . "\n"; + . 'value="' . $db_collation . '" />' . "\n"; } $html_output .= '' . "\n" . Url::getHiddenInputs($db); @@ -281,19 +283,19 @@ class Operations /** * Get HTML snippet for change database charset * - * @param string $db database name - * @param string $table table name + * @param string $db database name + * @param string $db_collation dataset collation * * @return string $html_output */ - public function getHtmlForChangeDatabaseCharset($db, $table) + public function getHtmlForChangeDatabaseCharset($db, $db_collation) { $html_output = '
' . ''; @@ -308,7 +310,7 @@ class Operations $GLOBALS['cfg']['Server']['DisableIS'], 'db_collation', 'select_db_collation', - isset($_REQUEST['db_collation']) ? $_REQUEST['db_collation'] : '', + isset($db_collation) ? $db_collation : '', false ) . '
' @@ -356,7 +358,7 @@ class Operations if ($tmp_query !== false) { // collect for later display $GLOBALS['sql_query'] .= "\n" . $tmp_query; - $GLOBALS['dbi']->selectDb($_REQUEST['newname']); + $GLOBALS['dbi']->selectDb($_POST['newname']); $GLOBALS['dbi']->query($tmp_query); } } @@ -372,7 +374,7 @@ class Operations if ($tmp_query !== false) { // collect for later display $GLOBALS['sql_query'] .= "\n" . $tmp_query; - $GLOBALS['dbi']->selectDb($_REQUEST['newname']); + $GLOBALS['dbi']->selectDb($_POST['newname']); $GLOBALS['dbi']->query($tmp_query); } } @@ -387,10 +389,10 @@ class Operations public function createDbBeforeCopy() { $local_query = 'CREATE DATABASE IF NOT EXISTS ' - . Util::backquote($_REQUEST['newname']); - if (isset($_REQUEST['db_collation'])) { + . Util::backquote($_POST['newname']); + if (isset($_POST['db_collation'])) { $local_query .= ' DEFAULT' - . Util::getCharsetQueryPart($_REQUEST['db_collation']); + . Util::getCharsetQueryPart($_POST['db_collation']); } $local_query .= ';'; $GLOBALS['sql_query'] .= $local_query; @@ -432,12 +434,12 @@ class Operations if ($GLOBALS['dbi']->getTable($db, $each_table)->isView()) { // If view exists, and 'add drop view' is selected: Drop it! - if ($_REQUEST['what'] != 'nocopy' - && isset($_REQUEST['drop_if_exists']) - && $_REQUEST['drop_if_exists'] == 'true' + if ($_POST['what'] != 'nocopy' + && isset($_POST['drop_if_exists']) + && $_POST['drop_if_exists'] == 'true' ) { $drop_query = 'DROP VIEW IF EXISTS ' - . Util::backquote($_REQUEST['newname']) . '.' + . Util::backquote($_POST['newname']) . '.' . Util::backquote($each_table); $GLOBALS['dbi']->query($drop_query); @@ -449,7 +451,7 @@ class Operations $sql_view_standin = $export_sql_plugin->getTableDefStandIn( $db, $each_table, "\n" ); - $GLOBALS['dbi']->selectDb($_REQUEST['newname']); + $GLOBALS['dbi']->selectDb($_POST['newname']); $GLOBALS['dbi']->query($sql_view_standin); $GLOBALS['sql_query'] .= "\n" . $sql_view_standin; } @@ -476,7 +478,7 @@ class Operations } // value of $what for this table only - $this_what = $_REQUEST['what']; + $this_what = $_POST['what']; // do not copy the data from a Merge table // note: on the calling FORM, 'data' means 'structure and data' @@ -496,7 +498,7 @@ class Operations $triggers = $GLOBALS['dbi']->getTriggers($db, $each_table, ''); if (! Table::moveCopy( - $db, $each_table, $_REQUEST['newname'], $each_table, + $db, $each_table, $_POST['newname'], $each_table, (isset($this_what) ? $this_what : 'data'), $move, 'db_copy' )) { @@ -505,7 +507,7 @@ class Operations } // apply the triggers to the destination db+table if ($triggers) { - $GLOBALS['dbi']->selectDb($_REQUEST['newname']); + $GLOBALS['dbi']->selectDb($_POST['newname']); foreach ($triggers as $trigger) { $GLOBALS['dbi']->query($trigger['create']); $GLOBALS['sql_query'] .= "\n" . $trigger['create'] . ';'; @@ -513,7 +515,7 @@ class Operations } // this does not apply to a rename operation - if (isset($_REQUEST['add_constraints']) + if (isset($_POST['add_constraints']) && ! empty($GLOBALS['sql_constraints_query']) ) { $sqlContraints[] = $GLOBALS['sql_constraints_query']; @@ -547,7 +549,7 @@ class Operations $tmp_query = $GLOBALS['dbi']->getDefinition($db, 'EVENT', $event_name); // collect for later display $GLOBALS['sql_query'] .= "\n" . $tmp_query; - $GLOBALS['dbi']->selectDb($_REQUEST['newname']); + $GLOBALS['dbi']->selectDb($_POST['newname']); $GLOBALS['dbi']->query($tmp_query); } } @@ -566,26 +568,26 @@ class Operations { // temporarily force to add DROP IF EXIST to CREATE VIEW query, // to remove stand-in VIEW that was created earlier - // ( $_REQUEST['drop_if_exists'] is used in moveCopy() ) - if (isset($_REQUEST['drop_if_exists'])) { - $temp_drop_if_exists = $_REQUEST['drop_if_exists']; + // ( $_POST['drop_if_exists'] is used in moveCopy() ) + if (isset($_POST['drop_if_exists'])) { + $temp_drop_if_exists = $_POST['drop_if_exists']; } - $_REQUEST['drop_if_exists'] = 'true'; + $_POST['drop_if_exists'] = 'true'; foreach ($views as $view) { $copying_succeeded = Table::moveCopy( - $db, $view, $_REQUEST['newname'], $view, 'structure', $move, 'db_copy' + $db, $view, $_POST['newname'], $view, 'structure', $move, 'db_copy' ); if (! $copying_succeeded) { $GLOBALS['_error'] = true; break; } } - unset($_REQUEST['drop_if_exists']); + unset($_POST['drop_if_exists']); if (isset($temp_drop_if_exists)) { // restore previous value - $_REQUEST['drop_if_exists'] = $temp_drop_if_exists; + $_POST['drop_if_exists'] = $temp_drop_if_exists; } } @@ -753,7 +755,7 @@ class Operations */ public function createAllAccumulatedConstraints(array $sqlConstratints) { - $GLOBALS['dbi']->selectDb($_REQUEST['newname']); + $GLOBALS['dbi']->selectDb($_POST['newname']); foreach ($sqlConstratints as $one_query) { $GLOBALS['dbi']->query($one_query); // and prepare to display them @@ -771,10 +773,10 @@ class Operations */ public function duplicateBookmarks($_error, $db) { - if (! $_error && $db != $_REQUEST['newname']) { + if (! $_error && $db != $_POST['newname']) { $get_fields = array('user', 'label', 'query'); $where_fields = array('dbase' => $db); - $new_fields = array('dbase' => $_REQUEST['newname']); + $new_fields = array('dbase' => $_POST['newname']); Table::duplicateInfo( 'bookmarkwork', 'bookmark', $get_fields, $where_fields, $new_fields @@ -1735,9 +1737,9 @@ class Operations $sql_query = 'ALTER TABLE ' . Util::backquote($GLOBALS['table']) . ' ORDER BY ' - . Util::backquote(urldecode($_REQUEST['order_field'])); - if (isset($_REQUEST['order_order']) - && $_REQUEST['order_order'] === 'desc' + . Util::backquote(urldecode($_POST['order_field'])); + if (isset($_POST['order_order']) + && $_POST['order_order'] === 'desc' ) { $sql_query .= ' DESC'; } else { @@ -1772,11 +1774,11 @@ class Operations $table_alters = array(); - if (isset($_REQUEST['comment']) - && urldecode($_REQUEST['prev_comment']) !== $_REQUEST['comment'] + if (isset($_POST['comment']) + && urldecode($_POST['prev_comment']) !== $_POST['comment'] ) { $table_alters[] = 'COMMENT = \'' - . $GLOBALS['dbi']->escapeString($_REQUEST['comment']) . '\''; + . $GLOBALS['dbi']->escapeString($_POST['comment']) . '\''; } if (! empty($newTblStorageEngine) @@ -1784,62 +1786,62 @@ class Operations ) { $table_alters[] = 'ENGINE = ' . $newTblStorageEngine; } - if (! empty($_REQUEST['tbl_collation']) - && $_REQUEST['tbl_collation'] !== $tbl_collation + if (! empty($_POST['tbl_collation']) + && $_POST['tbl_collation'] !== $tbl_collation ) { $table_alters[] = 'DEFAULT ' - . Util::getCharsetQueryPart($_REQUEST['tbl_collation']); + . Util::getCharsetQueryPart($_POST['tbl_collation']); } if ($pma_table->isEngine(array('MYISAM', 'ARIA', 'ISAM')) - && isset($_REQUEST['new_pack_keys']) - && $_REQUEST['new_pack_keys'] != (string)$pack_keys + && isset($_POST['new_pack_keys']) + && $_POST['new_pack_keys'] != (string)$pack_keys ) { - $table_alters[] = 'pack_keys = ' . $_REQUEST['new_pack_keys']; + $table_alters[] = 'pack_keys = ' . $_POST['new_pack_keys']; } - $_REQUEST['new_checksum'] = empty($_REQUEST['new_checksum']) ? '0' : '1'; + $_POST['new_checksum'] = empty($_POST['new_checksum']) ? '0' : '1'; if ($pma_table->isEngine(array('MYISAM', 'ARIA')) - && $_REQUEST['new_checksum'] !== $checksum + && $_POST['new_checksum'] !== $checksum ) { - $table_alters[] = 'checksum = ' . $_REQUEST['new_checksum']; + $table_alters[] = 'checksum = ' . $_POST['new_checksum']; } - $_REQUEST['new_transactional'] - = empty($_REQUEST['new_transactional']) ? '0' : '1'; + $_POST['new_transactional'] + = empty($_POST['new_transactional']) ? '0' : '1'; if ($pma_table->isEngine('ARIA') - && $_REQUEST['new_transactional'] !== $transactional + && $_POST['new_transactional'] !== $transactional ) { - $table_alters[] = 'TRANSACTIONAL = ' . $_REQUEST['new_transactional']; + $table_alters[] = 'TRANSACTIONAL = ' . $_POST['new_transactional']; } - $_REQUEST['new_page_checksum'] - = empty($_REQUEST['new_page_checksum']) ? '0' : '1'; + $_POST['new_page_checksum'] + = empty($_POST['new_page_checksum']) ? '0' : '1'; if ($pma_table->isEngine('ARIA') - && $_REQUEST['new_page_checksum'] !== $page_checksum + && $_POST['new_page_checksum'] !== $page_checksum ) { - $table_alters[] = 'PAGE_CHECKSUM = ' . $_REQUEST['new_page_checksum']; + $table_alters[] = 'PAGE_CHECKSUM = ' . $_POST['new_page_checksum']; } - $_REQUEST['new_delay_key_write'] - = empty($_REQUEST['new_delay_key_write']) ? '0' : '1'; + $_POST['new_delay_key_write'] + = empty($_POST['new_delay_key_write']) ? '0' : '1'; if ($pma_table->isEngine(array('MYISAM', 'ARIA')) - && $_REQUEST['new_delay_key_write'] !== $delay_key_write + && $_POST['new_delay_key_write'] !== $delay_key_write ) { - $table_alters[] = 'delay_key_write = ' . $_REQUEST['new_delay_key_write']; + $table_alters[] = 'delay_key_write = ' . $_POST['new_delay_key_write']; } if ($pma_table->isEngine(array('MYISAM', 'ARIA', 'INNODB', 'PBXT')) - && ! empty($_REQUEST['new_auto_increment']) + && ! empty($_POST['new_auto_increment']) && (! isset($auto_increment) - || $_REQUEST['new_auto_increment'] !== $auto_increment) + || $_POST['new_auto_increment'] !== $auto_increment) ) { $table_alters[] = 'auto_increment = ' - . $GLOBALS['dbi']->escapeString($_REQUEST['new_auto_increment']); + . $GLOBALS['dbi']->escapeString($_POST['new_auto_increment']); } - if (! empty($_REQUEST['new_row_format'])) { - $newRowFormat = $_REQUEST['new_row_format']; + if (! empty($_POST['new_row_format'])) { + $newRowFormat = $_POST['new_row_format']; $newRowFormatLower = mb_strtolower($newRowFormat); if ($pma_table->isEngine(array('MYISAM', 'ARIA', 'INNODB', 'PBXT')) && (strlen($row_format) === 0 @@ -1868,8 +1870,8 @@ class Operations // should not be reported with a Level of Error, so here // I just ignore it. But there are other 1478 messages // that it's better to show. - if (! (isset($_REQUEST['new_tbl_storage_engine']) - && $_REQUEST['new_tbl_storage_engine'] == 'MyISAM' + if (! (isset($_POST['new_tbl_storage_engine']) + && $_POST['new_tbl_storage_engine'] == 'MyISAM' && $warning['Code'] == '1478' && $warning['Level'] == 'Error') ) { @@ -1890,13 +1892,13 @@ class Operations { $sql_query = 'ALTER TABLE ' . Util::backquote($GLOBALS['table']) . ' ' - . $_REQUEST['partition_operation'] + . $_POST['partition_operation'] . ' PARTITION '; - if ($_REQUEST['partition_operation'] == 'COALESCE') { - $sql_query .= count($_REQUEST['partition_name']); + if ($_POST['partition_operation'] == 'COALESCE') { + $sql_query .= count($_POST['partition_name']); } else { - $sql_query .= implode(', ', $_REQUEST['partition_name']) . ';'; + $sql_query .= implode(', ', $_POST['partition_name']) . ';'; } $result = $GLOBALS['dbi']->query($sql_query); @@ -2045,43 +2047,43 @@ class Operations $GLOBALS['dbi']->selectDb($db); /** - * $_REQUEST['target_db'] could be empty in case we came from an input field + * $_POST['target_db'] could be empty in case we came from an input field * (when there are many databases, no drop-down) */ - if (empty($_REQUEST['target_db'])) { - $_REQUEST['target_db'] = $db; + if (empty($_POST['target_db'])) { + $_POST['target_db'] = $db; } /** * A target table name has been sent to this script -> do the work */ - if (Core::isValid($_REQUEST['new_name'])) { - if ($db == $_REQUEST['target_db'] && $table == $_REQUEST['new_name']) { - if (isset($_REQUEST['submit_move'])) { + if (Core::isValid($_POST['new_name'])) { + if ($db == $_POST['target_db'] && $table == $_POST['new_name']) { + if (isset($_POST['submit_move'])) { $message = Message::error(__('Can\'t move table to same one!')); } else { $message = Message::error(__('Can\'t copy table to same one!')); } } else { Table::moveCopy( - $db, $table, $_REQUEST['target_db'], $_REQUEST['new_name'], - $_REQUEST['what'], isset($_REQUEST['submit_move']), 'one_table' + $db, $table, $_POST['target_db'], $_POST['new_name'], + $_POST['what'], isset($_POST['submit_move']), 'one_table' ); - if (isset($_REQUEST['adjust_privileges']) - && ! empty($_REQUEST['adjust_privileges']) + if (isset($_POST['adjust_privileges']) + && ! empty($_POST['adjust_privileges']) ) { - if (isset($_REQUEST['submit_move'])) { + if (isset($_POST['submit_move'])) { $this->adjustPrivilegesRenameOrMoveTable( - $db, $table, $_REQUEST['target_db'], $_REQUEST['new_name'] + $db, $table, $_POST['target_db'], $_POST['new_name'] ); } else { $this->adjustPrivilegesCopyTable( - $db, $table, $_REQUEST['target_db'], $_REQUEST['new_name'] + $db, $table, $_POST['target_db'], $_POST['new_name'] ); } - if (isset($_REQUEST['submit_move'])) { + if (isset($_POST['submit_move'])) { $message = Message::success( __( 'Table %s has been moved to %s. Privileges have been ' @@ -2098,7 +2100,7 @@ class Operations } } else { - if (isset($_REQUEST['submit_move'])) { + if (isset($_POST['submit_move'])) { $message = Message::success( __('Table %s has been moved to %s.') ); @@ -2113,20 +2115,20 @@ class Operations . Util::backquote($table); $message->addParam($old); - $new_name = $_REQUEST['new_name']; + $new_name = $_POST['new_name']; if ($GLOBALS['dbi']->getLowerCaseNames() === '1') { $new_name = strtolower($new_name); } $GLOBALS['table'] = $new_name; - $new = Util::backquote($_REQUEST['target_db']) . '.' + $new = Util::backquote($_POST['target_db']) . '.' . Util::backquote($new_name); $message->addParam($new); /* Check: Work on new table or on old table? */ - if (isset($_REQUEST['submit_move']) - || Core::isValid($_REQUEST['switch_to_new']) + if (isset($_POST['submit_move']) + || Core::isValid($_POST['switch_to_new']) ) { } } diff --git a/libraries/classes/Relation.php b/libraries/classes/Relation.php index 513e09e96d..75ff20a81d 100644 --- a/libraries/classes/Relation.php +++ b/libraries/classes/Relation.php @@ -1994,7 +1994,7 @@ class Relation { $retval = ''; - $url_query = Url::getCommon(array('db' => $GLOBALS['db'])); + $url_query = Url::getCommon(array('db' => $GLOBALS['db']), ''); if ($allTables) { if ($createDb) { $url_query .= '&goto=db_operations.php&create_pmadb=1'; @@ -2019,7 +2019,7 @@ class Relation __('%sCreate%s missing phpMyAdmin configuration storage tables.') ); } - $message->addParamHtml(''); + $message->addParamHtml(''); $message->addParamHtml(''); $retval .= $message->getDisplay(); diff --git a/libraries/classes/ReplicationGui.php b/libraries/classes/ReplicationGui.php index 17e65dcfba..38155fbfa2 100644 --- a/libraries/classes/ReplicationGui.php +++ b/libraries/classes/ReplicationGui.php @@ -53,7 +53,7 @@ class ReplicationGui public static function getHtmlForMasterReplication() { $html = ''; - if (! isset($_REQUEST['repl_clear_scr'])) { + if (! isset($_POST['repl_clear_scr'])) { $html .= '
'; $html .= '' . __('Master replication') . ''; $html .= __('This server is configured as master in a replication process.'); @@ -72,16 +72,16 @@ class ReplicationGui $_url_params['mr_adduser'] = true; $_url_params['repl_clear_scr'] = true; - $html .= '
  • '; $html .= __('Add slave replication user') . '
    • '; } // Display 'Add replication slave user' form - if (isset($_REQUEST['mr_adduser'])) { + if (isset($_POST['mr_adduser'])) { $html .= self::getHtmlForReplicationMasterAddSlaveUser(); - } elseif (! isset($_REQUEST['repl_clear_scr'])) { + } elseif (! isset($_POST['repl_clear_scr'])) { $html .= ""; $html .= "
    "; } @@ -164,8 +164,8 @@ class ReplicationGui $html .= ' ' . '
    '; @@ -843,7 +839,7 @@ class ReplicationGui . '' . '' . Util::showHint( @@ -861,12 +857,12 @@ class ReplicationGui . ' ' . '' @@ -907,22 +903,22 @@ class ReplicationGui */ public static function handleControlRequest() { - if (isset($_REQUEST['sr_take_action'])) { + if (isset($_POST['sr_take_action'])) { $refresh = false; $result = false; $messageSuccess = null; $messageError = null; - if (isset($_REQUEST['slave_changemaster']) && ! $GLOBALS['cfg']['AllowArbitraryServer']) { + if (isset($_POST['slave_changemaster']) && ! $GLOBALS['cfg']['AllowArbitraryServer']) { $_SESSION['replication']['sr_action_status'] = 'error'; $_SESSION['replication']['sr_action_info'] = __('Connection to server is disabled, please enable $cfg[\'AllowArbitraryServer\'] in phpMyAdmin configuration.'); - } elseif (isset($_REQUEST['slave_changemaster'])) { + } elseif (isset($_POST['slave_changemaster'])) { $result = self::handleRequestForSlaveChangeMaster(); - } elseif (isset($_REQUEST['sr_slave_server_control'])) { + } elseif (isset($_POST['sr_slave_server_control'])) { $result = self::handleRequestForSlaveServerControl(); $refresh = true; - switch ($_REQUEST['sr_slave_action']) { + switch ($_POST['sr_slave_action']) { case 'start': $messageSuccess = __('Replication started successfully.'); $messageError = __('Error starting replication.'); @@ -940,7 +936,7 @@ class ReplicationGui $messageError = __('Error.'); break; } - } elseif (isset($_REQUEST['sr_slave_skip_error'])) { + } elseif (isset($_POST['sr_slave_skip_error'])) { $result = self::handleRequestForSlaveSkipError(); } @@ -974,13 +970,13 @@ class ReplicationGui { $sr = array(); $_SESSION['replication']['m_username'] = $sr['username'] - = $GLOBALS['dbi']->escapeString($_REQUEST['username']); + = $GLOBALS['dbi']->escapeString($_POST['username']); $_SESSION['replication']['m_password'] = $sr['pma_pw'] - = $GLOBALS['dbi']->escapeString($_REQUEST['pma_pw']); + = $GLOBALS['dbi']->escapeString($_POST['pma_pw']); $_SESSION['replication']['m_hostname'] = $sr['hostname'] - = $GLOBALS['dbi']->escapeString($_REQUEST['hostname']); + = $GLOBALS['dbi']->escapeString($_POST['hostname']); $_SESSION['replication']['m_port'] = $sr['port'] - = $GLOBALS['dbi']->escapeString($_REQUEST['text_port']); + = $GLOBALS['dbi']->escapeString($_POST['text_port']); $_SESSION['replication']['m_correct'] = ''; $_SESSION['replication']['sr_action_status'] = 'error'; $_SESSION['replication']['sr_action_info'] = __('Unknown error'); @@ -1043,10 +1039,10 @@ class ReplicationGui */ public static function handleRequestForSlaveServerControl() { - if (empty($_REQUEST['sr_slave_control_parm'])) { - $_REQUEST['sr_slave_control_parm'] = null; + if (empty($_POST['sr_slave_control_parm'])) { + $_POST['sr_slave_control_parm'] = null; } - if ($_REQUEST['sr_slave_action'] == 'reset') { + if ($_POST['sr_slave_action'] == 'reset') { $qStop = Replication::slaveControl("STOP"); $qReset = $GLOBALS['dbi']->tryQuery("RESET SLAVE;"); $qStart = Replication::slaveControl("START"); @@ -1056,8 +1052,8 @@ class ReplicationGui $qStart !== false && $qStart !== -1); } else { $qControl = Replication::slaveControl( - $_REQUEST['sr_slave_action'], - $_REQUEST['sr_slave_control_parm'] + $_POST['sr_slave_action'], + $_POST['sr_slave_control_parm'] ); $result = ($qControl !== false && $qControl !== -1); @@ -1074,8 +1070,8 @@ class ReplicationGui public static function handleRequestForSlaveSkipError() { $count = 1; - if (isset($_REQUEST['sr_skip_errors_count'])) { - $count = $_REQUEST['sr_skip_errors_count'] * 1; + if (isset($_POST['sr_skip_errors_count'])) { + $count = $_POST['sr_skip_errors_count'] * 1; } $qStop = Replication::slaveControl("STOP"); diff --git a/libraries/classes/Rte/Events.php b/libraries/classes/Rte/Events.php index 3f10c638c2..0306b1d35b 100644 --- a/libraries/classes/Rte/Events.php +++ b/libraries/classes/Rte/Events.php @@ -97,8 +97,8 @@ class Events { global $_REQUEST, $_POST, $errors, $db; - if (! empty($_REQUEST['editor_process_add']) - || ! empty($_REQUEST['editor_process_edit']) + if (! empty($_POST['editor_process_add']) + || ! empty($_POST['editor_process_edit']) ) { $sql_query = ''; @@ -106,15 +106,15 @@ class Events if (! count($errors)) { // set by PhpMyAdmin\Rte\Routines::getQueryFromRequest() // Execute the created query - if (! empty($_REQUEST['editor_process_edit'])) { + if (! empty($_POST['editor_process_edit'])) { // Backup the old trigger, in case something goes wrong $create_item = $GLOBALS['dbi']->getDefinition( $db, 'EVENT', - $_REQUEST['item_original_name'] + $_POST['item_original_name'] ); $drop_item = "DROP EVENT " - . Util::backquote($_REQUEST['item_original_name']) + . Util::backquote($_POST['item_original_name']) . ";\n"; $result = $GLOBALS['dbi']->tryQuery($drop_item); if (! $result) { @@ -149,7 +149,7 @@ class Events __('Event %1$s has been modified.') ); $message->addParam( - Util::backquote($_REQUEST['item_name']) + Util::backquote($_POST['item_name']) ); $sql_query = $drop_item . $item_query; } @@ -169,7 +169,7 @@ class Events __('Event %1$s has been created.') ); $message->addParam( - Util::backquote($_REQUEST['item_name']) + Util::backquote($_POST['item_name']) ); $sql_query = $item_query; } @@ -195,12 +195,12 @@ class Events $response = Response::getInstance(); if ($response->isAjax()) { if ($message->isSuccess()) { - $events = $GLOBALS['dbi']->getEvents($db, $_REQUEST['item_name']); + $events = $GLOBALS['dbi']->getEvents($db, $_POST['item_name']); $event = $events[0]; $response->addJSON( 'name', htmlspecialchars( - mb_strtoupper($_REQUEST['item_name']) + mb_strtoupper($_POST['item_name']) ) ); if (! empty($event)) { @@ -219,14 +219,14 @@ class Events * Display a form used to add/edit a trigger, if necessary */ if (count($errors) - || (empty($_REQUEST['editor_process_add']) - && empty($_REQUEST['editor_process_edit']) + || (empty($_POST['editor_process_add']) + && empty($_POST['editor_process_edit']) && (! empty($_REQUEST['add_item']) || ! empty($_REQUEST['edit_item']) - || ! empty($_REQUEST['item_changetype']))) + || ! empty($_POST['item_changetype']))) ) { // FIXME: this must be simpler than that $operation = ''; - if (! empty($_REQUEST['item_changetype'])) { + if (! empty($_POST['item_changetype'])) { $operation = 'change'; } // Get the data for the form (if any) @@ -237,8 +237,8 @@ class Events } elseif (! empty($_REQUEST['edit_item'])) { $title = __("Edit event"); if (! empty($_REQUEST['item_name']) - && empty($_REQUEST['editor_process_edit']) - && empty($_REQUEST['item_changetype']) + && empty($_POST['editor_process_edit']) + && empty($_POST['item_changetype']) ) { $item = self::getDataFromName($_REQUEST['item_name']); if ($item !== false) { @@ -274,11 +274,11 @@ class Events 'item_comment', 'item_definer'); foreach ($indices as $index) { - $retval[$index] = isset($_REQUEST[$index]) ? $_REQUEST[$index] : ''; + $retval[$index] = isset($_POST[$index]) ? $_POST[$index] : ''; } $retval['item_type'] = 'ONE TIME'; $retval['item_type_toggle'] = 'RECURRING'; - if (isset($_REQUEST['item_type']) && $_REQUEST['item_type'] == 'RECURRING') { + if (isset($_POST['item_type']) && $_POST['item_type'] == 'RECURRING') { $retval['item_type'] = 'RECURRING'; $retval['item_type_toggle'] = 'ONE TIME'; } @@ -545,10 +545,10 @@ class Events global $_REQUEST, $errors, $event_status, $event_type, $event_interval; $query = 'CREATE '; - if (! empty($_REQUEST['item_definer'])) { - if (mb_strpos($_REQUEST['item_definer'], '@') !== false + if (! empty($_POST['item_definer'])) { + if (mb_strpos($_POST['item_definer'], '@') !== false ) { - $arr = explode('@', $_REQUEST['item_definer']); + $arr = explode('@', $_POST['item_definer']); $query .= 'DEFINER=' . Util::backquote($arr[0]); $query .= '@' . Util::backquote($arr[1]) . ' '; } else { @@ -556,40 +556,40 @@ class Events } } $query .= 'EVENT '; - if (! empty($_REQUEST['item_name'])) { - $query .= Util::backquote($_REQUEST['item_name']) . ' '; + if (! empty($_POST['item_name'])) { + $query .= Util::backquote($_POST['item_name']) . ' '; } else { $errors[] = __('You must provide an event name!'); } $query .= 'ON SCHEDULE '; - if (! empty($_REQUEST['item_type']) - && in_array($_REQUEST['item_type'], $event_type) + if (! empty($_POST['item_type']) + && in_array($_POST['item_type'], $event_type) ) { - if ($_REQUEST['item_type'] == 'RECURRING') { - if (! empty($_REQUEST['item_interval_value']) - && !empty($_REQUEST['item_interval_field']) - && in_array($_REQUEST['item_interval_field'], $event_interval) + if ($_POST['item_type'] == 'RECURRING') { + if (! empty($_POST['item_interval_value']) + && !empty($_POST['item_interval_field']) + && in_array($_POST['item_interval_field'], $event_interval) ) { - $query .= 'EVERY ' . intval($_REQUEST['item_interval_value']) . ' '; - $query .= $_REQUEST['item_interval_field'] . ' '; + $query .= 'EVERY ' . intval($_POST['item_interval_value']) . ' '; + $query .= $_POST['item_interval_field'] . ' '; } else { $errors[] = __('You must provide a valid interval value for the event.'); } - if (! empty($_REQUEST['item_starts'])) { + if (! empty($_POST['item_starts'])) { $query .= "STARTS '" - . $GLOBALS['dbi']->escapeString($_REQUEST['item_starts']) + . $GLOBALS['dbi']->escapeString($_POST['item_starts']) . "' "; } - if (! empty($_REQUEST['item_ends'])) { + if (! empty($_POST['item_ends'])) { $query .= "ENDS '" - . $GLOBALS['dbi']->escapeString($_REQUEST['item_ends']) + . $GLOBALS['dbi']->escapeString($_POST['item_ends']) . "' "; } } else { - if (! empty($_REQUEST['item_execute_at'])) { + if (! empty($_POST['item_execute_at'])) { $query .= "AT '" - . $GLOBALS['dbi']->escapeString($_REQUEST['item_execute_at']) + . $GLOBALS['dbi']->escapeString($_POST['item_execute_at']) . "' "; } else { $errors[] @@ -600,26 +600,26 @@ class Events $errors[] = __('You must provide a valid type for the event.'); } $query .= 'ON COMPLETION '; - if (empty($_REQUEST['item_preserve'])) { + if (empty($_POST['item_preserve'])) { $query .= 'NOT '; } $query .= 'PRESERVE '; - if (! empty($_REQUEST['item_status'])) { + if (! empty($_POST['item_status'])) { foreach ($event_status['display'] as $key => $value) { - if ($value == $_REQUEST['item_status']) { + if ($value == $_POST['item_status']) { $query .= $event_status['query'][$key] . ' '; break; } } } - if (! empty($_REQUEST['item_comment'])) { + if (! empty($_POST['item_comment'])) { $query .= "COMMENT '" . $GLOBALS['dbi']->escapeString( - $_REQUEST['item_comment'] + $_POST['item_comment'] ) . "' "; } $query .= 'DO '; - if (! empty($_REQUEST['item_definition'])) { - $query .= $_REQUEST['item_definition']; + if (! empty($_POST['item_definition'])) { + $query .= $_POST['item_definition']; } else { $errors[] = __('You must provide an event definition.'); } diff --git a/libraries/classes/Rte/Routines.php b/libraries/classes/Rte/Routines.php index 3bfca689de..adba6f1ba8 100644 --- a/libraries/classes/Rte/Routines.php +++ b/libraries/classes/Rte/Routines.php @@ -117,21 +117,21 @@ class Routines */ // FIXME: this must be simpler than that if (count($errors) - || ( empty($_REQUEST['editor_process_add']) - && empty($_REQUEST['editor_process_edit']) + || ( empty($_POST['editor_process_add']) + && empty($_POST['editor_process_edit']) && (! empty($_REQUEST['add_item']) || ! empty($_REQUEST['edit_item']) - || ! empty($_REQUEST['routine_addparameter']) - || ! empty($_REQUEST['routine_removeparameter']) - || ! empty($_REQUEST['routine_changetype']))) + || ! empty($_POST['routine_addparameter']) + || ! empty($_POST['routine_removeparameter']) + || ! empty($_POST['routine_changetype']))) ) { // Handle requests to add/remove parameters and changing routine type // This is necessary when JS is disabled $operation = ''; - if (! empty($_REQUEST['routine_addparameter'])) { + if (! empty($_POST['routine_addparameter'])) { $operation = 'add'; - } elseif (! empty($_REQUEST['routine_removeparameter'])) { + } elseif (! empty($_POST['routine_removeparameter'])) { $operation = 'remove'; - } elseif (! empty($_REQUEST['routine_changetype'])) { + } elseif (! empty($_POST['routine_changetype'])) { $operation = 'change'; } // Get the data for the form (if any) @@ -141,11 +141,11 @@ class Routines $mode = 'add'; } elseif (! empty($_REQUEST['edit_item'])) { $title = __("Edit routine"); - if (! $operation && ! empty($_REQUEST['item_name']) - && empty($_REQUEST['editor_process_edit']) + if (! $operation && ! empty($_GET['item_name']) + && empty($_POST['editor_process_edit']) ) { $routine = self::getDataFromName( - $_REQUEST['item_name'], $_REQUEST['item_type'] + $_GET['item_name'], $_GET['item_type'] ); if ($routine !== false) { $routine['item_original_name'] = $routine['item_name']; @@ -200,8 +200,8 @@ class Routines */ public static function handleRequestCreateOrEdit(array $errors, $db) { - if (empty($_REQUEST['editor_process_add']) - && empty($_REQUEST['editor_process_edit']) + if (empty($_POST['editor_process_add']) + && empty($_POST['editor_process_edit']) ) { return $errors; } @@ -210,29 +210,29 @@ class Routines $routine_query = self::getQueryFromRequest(); if (!count($errors)) { // set by self::getQueryFromRequest() // Execute the created query - if (!empty($_REQUEST['editor_process_edit'])) { + if (!empty($_POST['editor_process_edit'])) { $isProcOrFunc = in_array( - $_REQUEST['item_original_type'], + $_POST['item_original_type'], array('PROCEDURE', 'FUNCTION') ); if (!$isProcOrFunc) { $errors[] = sprintf( __('Invalid routine type: "%s"'), - htmlspecialchars($_REQUEST['item_original_type']) + htmlspecialchars($_POST['item_original_type']) ); } else { // Backup the old routine, in case something goes wrong $create_routine = $GLOBALS['dbi']->getDefinition( $db, - $_REQUEST['item_original_type'], - $_REQUEST['item_original_name'] + $_POST['item_original_type'], + $_POST['item_original_name'] ); $privilegesBackup = self::backupPrivileges(); - $drop_routine = "DROP {$_REQUEST['item_original_type']} " - . Util::backquote($_REQUEST['item_original_name']) + $drop_routine = "DROP {$_POST['item_original_type']} " + . Util::backquote($_POST['item_original_name']) . ";\n"; $result = $GLOBALS['dbi']->tryQuery($drop_routine); if (!$result) { @@ -274,7 +274,7 @@ class Routines __('Routine %1$s has been created.') ); $message->addParam( - Util::backquote($_REQUEST['item_name']) + Util::backquote($_POST['item_name']) ); $sql_query = $routine_query; } @@ -309,14 +309,14 @@ class Routines $routines = $GLOBALS['dbi']->getRoutines( $db, - $_REQUEST['item_type'], - $_REQUEST['item_name'] + $_POST['item_type'], + $_POST['item_name'] ); $routine = $routines[0]; $response->addJSON( 'name', htmlspecialchars( - mb_strtoupper($_REQUEST['item_name']) + mb_strtoupper($_POST['item_name']) ) ); $response->addJSON('new_row', RteList::getRoutineRow($routine)); @@ -337,9 +337,9 @@ class Routines } // Backup the Old Privileges before dropping - // if $_REQUEST['item_adjust_privileges'] set - if (! isset($_REQUEST['item_adjust_privileges']) - || empty($_REQUEST['item_adjust_privileges']) + // if $_POST['item_adjust_privileges'] set + if (! isset($_POST['item_adjust_privileges']) + || empty($_POST['item_adjust_privileges']) ) { return array(); } @@ -348,8 +348,8 @@ class Routines 'mysql' ) . '.' . Util::backquote('procs_priv') - . ' where Routine_name = "' . $_REQUEST['item_original_name'] - . '" AND Routine_type = "' . $_REQUEST['item_original_type'] + . ' where Routine_name = "' . $_POST['item_original_name'] + . '" AND Routine_type = "' . $_POST['item_original_type'] . '";'; $privilegesBackup = $GLOBALS['dbi']->fetchResult( @@ -414,8 +414,8 @@ class Routines . Util::backquote('procs_priv') . ' VALUES("' . $priv[0] . '", "' . $priv[1] . '", "' . $priv[2] . '", "' - . $_REQUEST['item_name'] . '", "' - . $_REQUEST['item_type'] . '", "' + . $_POST['item_name'] . '", "' + . $_POST['item_type'] . '", "' . $priv[5] . '", "' . $priv[6] . '", "' . $priv[7] . '");'; @@ -455,7 +455,7 @@ class Routines ); } $message->addParam( - Util::backquote($_REQUEST['item_name']) + Util::backquote($_POST['item_name']) ); return $message; @@ -483,7 +483,7 @@ class Routines 'item_comment', 'item_definer'); foreach ($indices as $index) { - $retval[$index] = isset($_REQUEST[$index]) ? $_REQUEST[$index] : ''; + $retval[$index] = isset($_POST[$index]) ? $_POST[$index] : ''; } $retval['item_type'] = 'PROCEDURE'; @@ -493,8 +493,8 @@ class Routines $retval['item_type_toggle'] = 'PROCEDURE'; } $retval['item_original_type'] = 'PROCEDURE'; - if (isset($_REQUEST['item_original_type']) - && $_REQUEST['item_original_type'] == 'FUNCTION' + if (isset($_POST['item_original_type']) + && $_POST['item_original_type'] == 'FUNCTION' ) { $retval['item_original_type'] = 'FUNCTION'; } @@ -505,35 +505,35 @@ class Routines $retval['item_param_length'] = array(); $retval['item_param_opts_num'] = array(); $retval['item_param_opts_text'] = array(); - if (isset($_REQUEST['item_param_name']) - && isset($_REQUEST['item_param_type']) - && isset($_REQUEST['item_param_length']) - && isset($_REQUEST['item_param_opts_num']) - && isset($_REQUEST['item_param_opts_text']) - && is_array($_REQUEST['item_param_name']) - && is_array($_REQUEST['item_param_type']) - && is_array($_REQUEST['item_param_length']) - && is_array($_REQUEST['item_param_opts_num']) - && is_array($_REQUEST['item_param_opts_text']) + if (isset($_POST['item_param_name']) + && isset($_POST['item_param_type']) + && isset($_POST['item_param_length']) + && isset($_POST['item_param_opts_num']) + && isset($_POST['item_param_opts_text']) + && is_array($_POST['item_param_name']) + && is_array($_POST['item_param_type']) + && is_array($_POST['item_param_length']) + && is_array($_POST['item_param_opts_num']) + && is_array($_POST['item_param_opts_text']) ) { - if ($_REQUEST['item_type'] == 'PROCEDURE') { - $retval['item_param_dir'] = $_REQUEST['item_param_dir']; + if ($_POST['item_type'] == 'PROCEDURE') { + $retval['item_param_dir'] = $_POST['item_param_dir']; foreach ($retval['item_param_dir'] as $key => $value) { if (! in_array($value, $param_directions, true)) { $retval['item_param_dir'][$key] = ''; } } } - $retval['item_param_name'] = $_REQUEST['item_param_name']; - $retval['item_param_type'] = $_REQUEST['item_param_type']; + $retval['item_param_name'] = $_POST['item_param_name']; + $retval['item_param_type'] = $_POST['item_param_type']; foreach ($retval['item_param_type'] as $key => $value) { if (! in_array($value, Util::getSupportedDatatypes(), true)) { $retval['item_param_type'][$key] = ''; } } - $retval['item_param_length'] = $_REQUEST['item_param_length']; - $retval['item_param_opts_num'] = $_REQUEST['item_param_opts_num']; - $retval['item_param_opts_text'] = $_REQUEST['item_param_opts_text']; + $retval['item_param_length'] = $_POST['item_param_length']; + $retval['item_param_opts_num'] = $_POST['item_param_opts_num']; + $retval['item_param_opts_text'] = $_POST['item_param_opts_text']; $retval['item_num_params'] = max( count($retval['item_param_name']), count($retval['item_param_type']), @@ -543,32 +543,32 @@ class Routines ); } $retval['item_returntype'] = ''; - if (isset($_REQUEST['item_returntype']) - && in_array($_REQUEST['item_returntype'], Util::getSupportedDatatypes()) + if (isset($_POST['item_returntype']) + && in_array($_POST['item_returntype'], Util::getSupportedDatatypes()) ) { - $retval['item_returntype'] = $_REQUEST['item_returntype']; + $retval['item_returntype'] = $_POST['item_returntype']; } $retval['item_isdeterministic'] = ''; - if (isset($_REQUEST['item_isdeterministic']) - && mb_strtolower($_REQUEST['item_isdeterministic']) == 'on' + if (isset($_POST['item_isdeterministic']) + && mb_strtolower($_POST['item_isdeterministic']) == 'on' ) { $retval['item_isdeterministic'] = " checked='checked'"; } $retval['item_securitytype_definer'] = ''; $retval['item_securitytype_invoker'] = ''; - if (isset($_REQUEST['item_securitytype'])) { - if ($_REQUEST['item_securitytype'] === 'DEFINER') { + if (isset($_POST['item_securitytype'])) { + if ($_POST['item_securitytype'] === 'DEFINER') { $retval['item_securitytype_definer'] = " selected='selected'"; - } elseif ($_REQUEST['item_securitytype'] === 'INVOKER') { + } elseif ($_POST['item_securitytype'] === 'INVOKER') { $retval['item_securitytype_invoker'] = " selected='selected'"; } } $retval['item_sqldataaccess'] = ''; - if (isset($_REQUEST['item_sqldataaccess']) - && in_array($_REQUEST['item_sqldataaccess'], $param_sqldataaccess, true) + if (isset($_POST['item_sqldataaccess']) + && in_array($_POST['item_sqldataaccess'], $param_sqldataaccess, true) ) { - $retval['item_sqldataaccess'] = $_REQUEST['item_sqldataaccess']; + $retval['item_sqldataaccess'] = $_POST['item_sqldataaccess']; } return $retval; @@ -1099,13 +1099,13 @@ class Routines { global $_REQUEST, $errors, $param_sqldataaccess, $param_directions, $dbi; - $_REQUEST['item_type'] = isset($_REQUEST['item_type']) - ? $_REQUEST['item_type'] : ''; + $_POST['item_type'] = isset($_POST['item_type']) + ? $_POST['item_type'] : ''; $query = 'CREATE '; - if (! empty($_REQUEST['item_definer'])) { - if (mb_strpos($_REQUEST['item_definer'], '@') !== false) { - $arr = explode('@', $_REQUEST['item_definer']); + if (! empty($_POST['item_definer'])) { + if (mb_strpos($_POST['item_definer'], '@') !== false) { + $arr = explode('@', $_POST['item_definer']); $do_backquote = true; if (substr($arr[0], 0, 1) === "`" @@ -1126,18 +1126,18 @@ class Routines $errors[] = __('The definer must be in the "username@hostname" format!'); } } - if ($_REQUEST['item_type'] == 'FUNCTION' - || $_REQUEST['item_type'] == 'PROCEDURE' + if ($_POST['item_type'] == 'FUNCTION' + || $_POST['item_type'] == 'PROCEDURE' ) { - $query .= $_REQUEST['item_type'] . ' '; + $query .= $_POST['item_type'] . ' '; } else { $errors[] = sprintf( __('Invalid routine type: "%s"'), - htmlspecialchars($_REQUEST['item_type']) + htmlspecialchars($_POST['item_type']) ); } - if (! empty($_REQUEST['item_name'])) { - $query .= Util::backquote($_REQUEST['item_name']); + if (! empty($_POST['item_name'])) { + $query .= Util::backquote($_POST['item_name']); } else { $errors[] = __('You must provide a routine name!'); } @@ -1145,36 +1145,36 @@ class Routines $warned_about_dir = false; $warned_about_length = false; - if (! empty($_REQUEST['item_param_name']) - && ! empty($_REQUEST['item_param_type']) - && ! empty($_REQUEST['item_param_length']) - && is_array($_REQUEST['item_param_name']) - && is_array($_REQUEST['item_param_type']) - && is_array($_REQUEST['item_param_length']) + if (! empty($_POST['item_param_name']) + && ! empty($_POST['item_param_type']) + && ! empty($_POST['item_param_length']) + && is_array($_POST['item_param_name']) + && is_array($_POST['item_param_type']) + && is_array($_POST['item_param_length']) ) { - $item_param_name = $_REQUEST['item_param_name']; - $item_param_type = $_REQUEST['item_param_type']; - $item_param_length = $_REQUEST['item_param_length']; + $item_param_name = $_POST['item_param_name']; + $item_param_type = $_POST['item_param_type']; + $item_param_length = $_POST['item_param_length']; for ($i=0, $nb = count($item_param_name); $i < $nb; $i++) { if (! empty($item_param_name[$i]) && ! empty($item_param_type[$i]) ) { - if ($_REQUEST['item_type'] == 'PROCEDURE' - && ! empty($_REQUEST['item_param_dir'][$i]) - && in_array($_REQUEST['item_param_dir'][$i], $param_directions) + if ($_POST['item_type'] == 'PROCEDURE' + && ! empty($_POST['item_param_dir'][$i]) + && in_array($_POST['item_param_dir'][$i], $param_directions) ) { - $params .= $_REQUEST['item_param_dir'][$i] . " " + $params .= $_POST['item_param_dir'][$i] . " " . Util::backquote($item_param_name[$i]) . " " . $item_param_type[$i]; - } elseif ($_REQUEST['item_type'] == 'FUNCTION') { + } elseif ($_POST['item_type'] == 'FUNCTION') { $params .= Util::backquote($item_param_name[$i]) . " " . $item_param_type[$i]; } elseif (! $warned_about_dir) { $warned_about_dir = true; $errors[] = sprintf( __('Invalid direction "%s" given for parameter.'), - htmlspecialchars($_REQUEST['item_param_dir'][$i]) + htmlspecialchars($_POST['item_param_dir'][$i]) ); } if ($item_param_length[$i] != '' @@ -1200,21 +1200,21 @@ class Routines ); } } - if (! empty($_REQUEST['item_param_opts_text'][$i])) { + if (! empty($_POST['item_param_opts_text'][$i])) { if ($dbi->types->getTypeClass($item_param_type[$i]) == 'CHAR') { if(! in_array($item_param_type[$i], array('VARBINARY', 'BINARY'))) { $params .= ' CHARSET ' . mb_strtolower( - $_REQUEST['item_param_opts_text'][$i] + $_POST['item_param_opts_text'][$i] ); } } } - if (! empty($_REQUEST['item_param_opts_num'][$i])) { + if (! empty($_POST['item_param_opts_num'][$i])) { if ($dbi->types->getTypeClass($item_param_type[$i]) == 'NUMBER') { $params .= ' ' . mb_strtoupper( - $_REQUEST['item_param_opts_num'][$i] + $_POST['item_param_opts_num'][$i] ); } } @@ -1230,9 +1230,9 @@ class Routines } } $query .= "(" . $params . ") "; - if ($_REQUEST['item_type'] == 'FUNCTION') { - $item_returntype = isset($_REQUEST['item_returntype']) - ? $_REQUEST['item_returntype'] + if ($_POST['item_type'] == 'FUNCTION') { + $item_returntype = isset($_POST['item_returntype']) + ? $_POST['item_returntype'] : null; if (! empty($item_returntype) @@ -1244,15 +1244,15 @@ class Routines } else { $errors[] = __('You must provide a valid return type for the routine.'); } - if (! empty($_REQUEST['item_returnlength']) + if (! empty($_POST['item_returnlength']) && !preg_match( '@^(DATE|DATETIME|TIME|TINYBLOB|TINYTEXT|BLOB|TEXT|' . 'MEDIUMBLOB|MEDIUMTEXT|LONGBLOB|LONGTEXT|SERIAL|BOOLEAN)$@i', $item_returntype ) ) { - $query .= "(" . $_REQUEST['item_returnlength'] . ")"; - } elseif (empty($_REQUEST['item_returnlength']) + $query .= "(" . $_POST['item_returnlength'] . ")"; + } elseif (empty($_POST['item_returnlength']) && preg_match( '@^(ENUM|SET|VARCHAR|VARBINARY)$@i', $item_returntype ) @@ -1264,43 +1264,43 @@ class Routines ); } } - if (! empty($_REQUEST['item_returnopts_text'])) { + if (! empty($_POST['item_returnopts_text'])) { if ($dbi->types->getTypeClass($item_returntype) == 'CHAR') { $query .= ' CHARSET ' - . mb_strtolower($_REQUEST['item_returnopts_text']); + . mb_strtolower($_POST['item_returnopts_text']); } } - if (! empty($_REQUEST['item_returnopts_num'])) { + if (! empty($_POST['item_returnopts_num'])) { if ($dbi->types->getTypeClass($item_returntype) == 'NUMBER') { $query .= ' ' - . mb_strtoupper($_REQUEST['item_returnopts_num']); + . mb_strtoupper($_POST['item_returnopts_num']); } } $query .= ' '; } - if (! empty($_REQUEST['item_comment'])) { - $query .= "COMMENT '" . $GLOBALS['dbi']->escapeString($_REQUEST['item_comment']) + if (! empty($_POST['item_comment'])) { + $query .= "COMMENT '" . $GLOBALS['dbi']->escapeString($_POST['item_comment']) . "' "; } - if (isset($_REQUEST['item_isdeterministic'])) { + if (isset($_POST['item_isdeterministic'])) { $query .= 'DETERMINISTIC '; } else { $query .= 'NOT DETERMINISTIC '; } - if (! empty($_REQUEST['item_sqldataaccess']) - && in_array($_REQUEST['item_sqldataaccess'], $param_sqldataaccess) + if (! empty($_POST['item_sqldataaccess']) + && in_array($_POST['item_sqldataaccess'], $param_sqldataaccess) ) { - $query .= $_REQUEST['item_sqldataaccess'] . ' '; + $query .= $_POST['item_sqldataaccess'] . ' '; } - if (! empty($_REQUEST['item_securitytype'])) { - if ($_REQUEST['item_securitytype'] == 'DEFINER' - || $_REQUEST['item_securitytype'] == 'INVOKER' + if (! empty($_POST['item_securitytype'])) { + if ($_POST['item_securitytype'] == 'DEFINER' + || $_POST['item_securitytype'] == 'INVOKER' ) { - $query .= 'SQL SECURITY ' . $_REQUEST['item_securitytype'] . ' '; + $query .= 'SQL SECURITY ' . $_POST['item_securitytype'] . ' '; } } - if (! empty($_REQUEST['item_definition'])) { - $query .= $_REQUEST['item_definition']; + if (! empty($_POST['item_definition'])) { + $query .= $_POST['item_definition']; } else { $errors[] = __('You must provide a routine definition.'); } @@ -1322,16 +1322,16 @@ class Routines /** * Handle all user requests other than the default of listing routines */ - if (! empty($_REQUEST['execute_routine']) && ! empty($_REQUEST['item_name'])) { + if (! empty($_POST['execute_routine']) && ! empty($_POST['item_name'])) { // Build the queries $routine = self::getDataFromName( - $_REQUEST['item_name'], $_REQUEST['item_type'], false + $_POST['item_name'], $_POST['item_type'], false ); if ($routine === false) { $message = __('Error in processing request:') . ' '; $message .= sprintf( Words::get('not_found'), - htmlspecialchars(Util::backquote($_REQUEST['item_name'])), + htmlspecialchars(Util::backquote($_POST['item_name'])), htmlspecialchars(Util::backquote($db)) ); $message = Message::error($message); @@ -1350,20 +1350,20 @@ class Routines $args = array(); $all_functions = $GLOBALS['dbi']->types->getAllFunctions(); for ($i = 0; $i < $routine['item_num_params']; $i++) { - if (isset($_REQUEST['params'][$routine['item_param_name'][$i]])) { - $value = $_REQUEST['params'][$routine['item_param_name'][$i]]; + if (isset($_POST['params'][$routine['item_param_name'][$i]])) { + $value = $_POST['params'][$routine['item_param_name'][$i]]; if (is_array($value)) { // is SET type $value = implode(',', $value); } $value = $GLOBALS['dbi']->escapeString($value); - if (! empty($_REQUEST['funcs'][$routine['item_param_name'][$i]]) + if (! empty($_POST['funcs'][$routine['item_param_name'][$i]]) && in_array( - $_REQUEST['funcs'][$routine['item_param_name'][$i]], + $_POST['funcs'][$routine['item_param_name'][$i]], $all_functions ) ) { $queries[] = "SET @p$i=" - . $_REQUEST['funcs'][$routine['item_param_name'][$i]] + . $_POST['funcs'][$routine['item_param_name'][$i]] . "('$value');\n"; } else { $queries[] = "SET @p$i='$value';\n"; @@ -1541,7 +1541,7 @@ class Routines $message = __('Error in processing request:') . ' '; $message .= sprintf( Words::get('not_found'), - htmlspecialchars(Util::backquote($_REQUEST['item_name'])), + htmlspecialchars(Util::backquote($_GET['item_name'])), htmlspecialchars(Util::backquote($db)) ); $message = Message::error($message); diff --git a/libraries/classes/Rte/Triggers.php b/libraries/classes/Rte/Triggers.php index 7f025affd1..1f0d273b08 100644 --- a/libraries/classes/Rte/Triggers.php +++ b/libraries/classes/Rte/Triggers.php @@ -77,8 +77,8 @@ class Triggers { global $_REQUEST, $_POST, $errors, $db, $table; - if (! empty($_REQUEST['editor_process_add']) - || ! empty($_REQUEST['editor_process_edit']) + if (! empty($_POST['editor_process_add']) + || ! empty($_POST['editor_process_edit']) ) { $sql_query = ''; @@ -86,9 +86,9 @@ class Triggers if (! count($errors)) { // set by PhpMyAdmin\Rte\Routines::getQueryFromRequest() // Execute the created query - if (! empty($_REQUEST['editor_process_edit'])) { + if (! empty($_POST['editor_process_edit'])) { // Backup the old trigger, in case something goes wrong - $trigger = self::getDataFromName($_REQUEST['item_original_name']); + $trigger = self::getDataFromName($_POST['item_original_name']); $create_item = $trigger['create']; $drop_item = $trigger['drop'] . ';'; $result = $GLOBALS['dbi']->tryQuery($drop_item); @@ -125,7 +125,7 @@ class Triggers __('Trigger %1$s has been modified.') ); $message->addParam( - Util::backquote($_REQUEST['item_name']) + Util::backquote($_POST['item_name']) ); $sql_query = $drop_item . $item_query; } @@ -145,7 +145,7 @@ class Triggers __('Trigger %1$s has been created.') ); $message->addParam( - Util::backquote($_REQUEST['item_name']) + Util::backquote($_POST['item_name']) ); $sql_query = $item_query; } @@ -174,7 +174,7 @@ class Triggers $items = $GLOBALS['dbi']->getTriggers($db, $table, ''); $trigger = false; foreach ($items as $value) { - if ($value['name'] == $_REQUEST['item_name']) { + if ($value['name'] == $_POST['item_name']) { $trigger = $value; } } @@ -188,7 +188,7 @@ class Triggers 'name', htmlspecialchars( mb_strtoupper( - $_REQUEST['item_name'] + $_POST['item_name'] ) ) ); @@ -207,8 +207,8 @@ class Triggers * Display a form used to add/edit a trigger, if necessary */ if (count($errors) - || (empty($_REQUEST['editor_process_add']) - && empty($_REQUEST['editor_process_edit']) + || (empty($_POST['editor_process_add']) + && empty($_POST['editor_process_edit']) && (! empty($_REQUEST['add_item']) || ! empty($_REQUEST['edit_item']))) // FIXME: this must be simpler than that ) { @@ -220,7 +220,7 @@ class Triggers } elseif (! empty($_REQUEST['edit_item'])) { $title = __("Edit trigger"); if (! empty($_REQUEST['item_name']) - && empty($_REQUEST['editor_process_edit']) + && empty($_POST['editor_process_edit']) ) { $item = self::getDataFromName($_REQUEST['item_name']); if ($item !== false) { @@ -251,7 +251,7 @@ class Triggers 'item_definition', 'item_definer'); foreach ($indices as $index) { - $retval[$index] = isset($_REQUEST[$index]) ? $_REQUEST[$index] : ''; + $retval[$index] = isset($_POST[$index]) ? $_POST[$index] : ''; } return $retval; } // end self::getDataFromRequest() @@ -428,10 +428,10 @@ class Triggers global $_REQUEST, $db, $errors, $action_timings, $event_manipulations; $query = 'CREATE '; - if (! empty($_REQUEST['item_definer'])) { - if (mb_strpos($_REQUEST['item_definer'], '@') !== false + if (! empty($_POST['item_definer'])) { + if (mb_strpos($_POST['item_definer'], '@') !== false ) { - $arr = explode('@', $_REQUEST['item_definer']); + $arr = explode('@', $_POST['item_definer']); $query .= 'DEFINER=' . Util::backquote($arr[0]); $query .= '@' . Util::backquote($arr[1]) . ' '; } else { @@ -439,36 +439,36 @@ class Triggers } } $query .= 'TRIGGER '; - if (! empty($_REQUEST['item_name'])) { - $query .= Util::backquote($_REQUEST['item_name']) . ' '; + if (! empty($_POST['item_name'])) { + $query .= Util::backquote($_POST['item_name']) . ' '; } else { $errors[] = __('You must provide a trigger name!'); } - if (! empty($_REQUEST['item_timing']) - && in_array($_REQUEST['item_timing'], $action_timings) + if (! empty($_POST['item_timing']) + && in_array($_POST['item_timing'], $action_timings) ) { - $query .= $_REQUEST['item_timing'] . ' '; + $query .= $_POST['item_timing'] . ' '; } else { $errors[] = __('You must provide a valid timing for the trigger!'); } - if (! empty($_REQUEST['item_event']) - && in_array($_REQUEST['item_event'], $event_manipulations) + if (! empty($_POST['item_event']) + && in_array($_POST['item_event'], $event_manipulations) ) { - $query .= $_REQUEST['item_event'] . ' '; + $query .= $_POST['item_event'] . ' '; } else { $errors[] = __('You must provide a valid event for the trigger!'); } $query .= 'ON '; - if (! empty($_REQUEST['item_table']) - && in_array($_REQUEST['item_table'], $GLOBALS['dbi']->getTables($db)) + if (! empty($_POST['item_table']) + && in_array($_POST['item_table'], $GLOBALS['dbi']->getTables($db)) ) { - $query .= Util::backquote($_REQUEST['item_table']); + $query .= Util::backquote($_POST['item_table']); } else { $errors[] = __('You must provide a valid table name!'); } $query .= ' FOR EACH ROW '; - if (! empty($_REQUEST['item_definition'])) { - $query .= $_REQUEST['item_definition']; + if (! empty($_POST['item_definition'])) { + $query .= $_POST['item_definition']; } else { $errors[] = __('You must provide a trigger definition.'); } diff --git a/libraries/classes/Server/Privileges.php b/libraries/classes/Server/Privileges.php index 55f72f171a..705318ab67 100644 --- a/libraries/classes/Server/Privileges.php +++ b/libraries/classes/Server/Privileges.php @@ -36,7 +36,7 @@ class Privileges public static function getHtmlForUserGroupDialog($username, $is_menuswork) { $html = ''; - if (! empty($_REQUEST['edit_user_group_dialog']) && $is_menuswork) { + if (! empty($_GET['edit_user_group_dialog']) && $is_menuswork) { $dialog = self::getHtmlToChooseUserGroup($username); $response = Response::getInstance(); if ($response->isAjax()) { @@ -1868,7 +1868,7 @@ class Privileges // similar logic in user_password.php $message = ''; - if (empty($_REQUEST['nopass']) + if (empty($_POST['nopass']) && isset($_POST['pma_pw']) && isset($_POST['pma_pw2']) ) { @@ -1885,8 +1885,8 @@ class Privileges $serverType = Util::getServerType(); $serverVersion = $GLOBALS['dbi']->getVersion(); $authentication_plugin - = (isset($_REQUEST['authentication_plugin']) - ? $_REQUEST['authentication_plugin'] + = (isset($_POST['authentication_plugin']) + ? $_POST['authentication_plugin'] : self::getCurrentAuthenticationPlugin( 'change', $username, @@ -2146,7 +2146,7 @@ class Privileges } /** - * Get HTML for addUsersForm, This function call if isset($_REQUEST['adduser']) + * Get HTML for addUsersForm, This function call if isset($_GET['adduser']) * * @param string $dbname database name * @@ -2825,9 +2825,13 @@ class Privileges break; } - $html .= ' href="server_privileges.php' - . Url::getCommon($params) - . '">'; + $html .= ' href="server_privileges.php'; + if ($linktype == 'revoke') { + $html .= '" data-post="' . Url::getCommon($params, ''); + } else { + $html .= Url::getCommon($params); + } + $html .= '">'; switch($linktype) { case 'edit': @@ -2949,7 +2953,7 @@ class Privileges $extra_data['sql_query'] = Util::getMessage(null, $sql_query); } - if (isset($_REQUEST['change_copy'])) { + if (isset($_POST['change_copy'])) { /** * generate html on the fly for the new user that was just created. */ @@ -2961,7 +2965,7 @@ class Privileges . '&#27;' . htmlspecialchars($hostname) . '" />' . '' . "\n" . '' . "\n" . '' . htmlspecialchars($hostname) . '' . "\n"; @@ -3050,9 +3054,9 @@ class Privileges $extra_data['new_privileges'] = $new_privileges; } - if (isset($_REQUEST['validate_username'])) { + if (isset($_GET['validate_username'])) { $sql_query = "SELECT * FROM `mysql`.`user` WHERE `User` = '" - . $_REQUEST['username'] . "';"; + . $_GET['username'] . "';"; $res = $GLOBALS['dbi']->query($sql_query); $row = $GLOBALS['dbi']->fetchRow($res); if (empty($row)) { @@ -3362,7 +3366,7 @@ class Privileges $foundRows = array(); $privileges = array(); - foreach ($db_rights as $row) { + foreach ($db_rights as $row) {error_log(print_r($row, true)); $onePrivilege = array(); $paramTableName = ''; @@ -3776,7 +3780,7 @@ class Privileges ->render( array( 'array_initials' => $array_initials, - 'initial' => isset($_REQUEST['initial']) ? $_REQUEST['initial'] : null, + 'initial' => isset($_GET['initial']) ? $_GET['initial'] : null, ) ); @@ -3847,7 +3851,7 @@ class Privileges if (empty($queries)) { $message = Message::error(__('No users selected for deleting!')); } else { - if ($_REQUEST['mode'] == 3) { + if ($_POST['mode'] == 3) { $queries[] = '# ' . __('Reloading the privileges') . ' …'; $queries[] = 'FLUSH PRIVILEGES;'; } @@ -3958,11 +3962,11 @@ class Privileges $queries = null; $password = null; - if (isset($_REQUEST['change_copy'])) { + if (isset($_POST['change_copy'])) { $user_host_condition = ' WHERE `User` = ' - . "'" . $GLOBALS['dbi']->escapeString($_REQUEST['old_username']) . "'" + . "'" . $GLOBALS['dbi']->escapeString($_POST['old_username']) . "'" . ' AND `Host` = ' - . "'" . $GLOBALS['dbi']->escapeString($_REQUEST['old_hostname']) . "';"; + . "'" . $GLOBALS['dbi']->escapeString($_POST['old_hostname']) . "';"; $row = $GLOBALS['dbi']->fetchSingleRow( 'SELECT * FROM `mysql`.`user` ' . $user_host_condition ); @@ -3971,7 +3975,7 @@ class Privileges $response->addHTML( Message::notice(__('No user found.'))->getDisplay() ); - unset($_REQUEST['change_copy']); + unset($_POST['change_copy']); } else { extract($row, EXTR_OVERWRITE); foreach ($row as $key => $value) { @@ -4029,12 +4033,12 @@ class Privileges */ public static function getDataForDeleteUsers($queries) { - if (isset($_REQUEST['change_copy'])) { + if (isset($_POST['change_copy'])) { $selected_usr = array( - $_REQUEST['old_username'] . '&#27;' . $_REQUEST['old_hostname'] + $_POST['old_username'] . '&#27;' . $_POST['old_hostname'] ); } else { - $selected_usr = $_REQUEST['selected_usr']; + $selected_usr = $_POST['selected_usr']; $queries = array(); } @@ -4056,7 +4060,7 @@ class Privileges . '\'@\'' . $GLOBALS['dbi']->escapeString($this_host) . '\';'; RelationCleanup::user($this_user); - if (isset($_REQUEST['drop_users_db'])) { + if (isset($_POST['drop_users_db'])) { $queries[] = 'DROP DATABASE IF EXISTS ' . Util::backquote($this_user) . ';'; $GLOBALS['reload'] = true; @@ -4073,7 +4077,7 @@ class Privileges public static function updateMessageForReload() { $message = null; - if (isset($_REQUEST['flush_privileges'])) { + if (isset($_GET['flush_privileges'])) { $sql_query = 'FLUSH PRIVILEGES;'; $GLOBALS['dbi']->query($sql_query); $message = Message::success( @@ -4081,7 +4085,7 @@ class Privileges ); } - if (isset($_REQUEST['validate_username'])) { + if (isset($_GET['validate_username'])) { $message = Message::success(); } @@ -4135,7 +4139,7 @@ class Privileges $queries_for_display = null; $sql_query = null; - if (!isset($_REQUEST['adduser_submit']) && !isset($_REQUEST['change_copy'])) { + if (!isset($_POST['adduser_submit']) && !isset($_POST['change_copy'])) { return array( $message, $queries, $queries_for_display, $sql_query, $_add_user_error ); @@ -4170,7 +4174,7 @@ class Privileges if ($GLOBALS['dbi']->fetchValue($sql) == 1) { $message = Message::error(__('The user %s already exists!')); $message->addParam('[em]\'' . $username . '\'@\'' . $hostname . '\'[/em]'); - $_REQUEST['adduser'] = true; + $_GET['adduser'] = true; $_add_user_error = true; return array( @@ -4189,7 +4193,7 @@ class Privileges $username, $hostname, (isset($password) ? $password : '') ); - if (empty($_REQUEST['change_copy'])) { + if (empty($_POST['change_copy'])) { $_error = false; if (isset($create_user_real)) { @@ -4197,10 +4201,10 @@ class Privileges $_error = true; } if (isset($password_set_real) && !empty($password_set_real) - && isset($_REQUEST['authentication_plugin']) + && isset($_POST['authentication_plugin']) ) { self::setProperPasswordHashing( - $_REQUEST['authentication_plugin'] + $_POST['authentication_plugin'] ); if ($GLOBALS['dbi']->tryQuery($password_set_real)) { $sql_query .= $password_set_show; @@ -4217,8 +4221,8 @@ class Privileges $hostname, isset($dbname) ? $dbname : null ); - if (!empty($_REQUEST['userGroup']) && $is_menuwork) { - self::setUserGroup($GLOBALS['username'], $_REQUEST['userGroup']); + if (!empty($_POST['userGroup']) && $is_menuwork) { + self::setUserGroup($GLOBALS['username'], $_POST['userGroup']); } return array( @@ -4232,8 +4236,8 @@ class Privileges // Copy the user group while copying a user $old_usergroup = - isset($_REQUEST['old_usergroup']) ? $_REQUEST['old_usergroup'] : null; - self::setUserGroup($_REQUEST['username'], $old_usergroup); + isset($_POST['old_usergroup']) ? $_POST['old_usergroup'] : null; + self::setUserGroup($_POST['username'], $old_usergroup); if (isset($create_user_real)) { $queries[] = $create_user_real; @@ -4241,10 +4245,10 @@ class Privileges $queries[] = $real_sql_query; if (isset($password_set_real) && ! empty($password_set_real) - && isset($_REQUEST['authentication_plugin']) + && isset($_POST['authentication_plugin']) ) { self::setProperPasswordHashing( - $_REQUEST['authentication_plugin'] + $_POST['authentication_plugin'] ); $queries[] = $password_set_real; @@ -4313,25 +4317,25 @@ class Privileges /** * Checks if a dropdown box has been used for selecting a database / table */ - if (Core::isValid($_REQUEST['pred_tablename'])) { - $tablename = $_REQUEST['pred_tablename']; + if (Core::isValid($_POST['pred_tablename'])) { + $tablename = $_POST['pred_tablename']; } elseif (Core::isValid($_REQUEST['tablename'])) { $tablename = $_REQUEST['tablename']; } else { unset($tablename); } - if (Core::isValid($_REQUEST['pred_routinename'])) { - $routinename = $_REQUEST['pred_routinename']; + if (Core::isValid($_POST['pred_routinename'])) { + $routinename = $_POST['pred_routinename']; } elseif (Core::isValid($_REQUEST['routinename'])) { $routinename = $_REQUEST['routinename']; } else { unset($routinename); } - if (isset($_REQUEST['pred_dbname'])) { + if (isset($_POST['pred_dbname'])) { $is_valid_pred_dbname = true; - foreach ($_REQUEST['pred_dbname'] as $key => $db_name) { + foreach ($_POST['pred_dbname'] as $key => $db_name) { if (! Core::isValid($db_name)) { $is_valid_pred_dbname = false; break; @@ -4356,7 +4360,7 @@ class Privileges } if (isset($is_valid_pred_dbname) && $is_valid_pred_dbname) { - $dbname = $_REQUEST['pred_dbname']; + $dbname = $_POST['pred_dbname']; // If dbname contains only one database. if (count($dbname) == 1) { $dbname = $dbname[0]; @@ -4425,14 +4429,14 @@ class Privileges { $export = '