From f049c127ca21885ab0856a8c562ed1c74961bb5d Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Tue, 10 Jul 2018 09:11:18 +1000 Subject: [PATCH 01/49] Retrieve parameters from $_POST in database and table operation pages Signed-off-by: Madhura Jayaratne --- db_operations.php | 50 ++++---- libraries/classes/Operations.php | 192 ++++++++++++++++--------------- tbl_operations.php | 38 +++--- test/classes/OperationsTest.php | 12 +- 4 files changed, 147 insertions(+), 145 deletions(-) diff --git a/db_operations.php b/db_operations.php index 70c0d53877..78a61b6ed4 100644 --- a/db_operations.php +++ b/db_operations.php @@ -46,31 +46,31 @@ $operations = new Operations(); * Rename/move or copy database */ if (strlen($GLOBALS['db']) > 0 - && (! empty($_REQUEST['db_rename']) || ! empty($_REQUEST['db_copy'])) + && (! empty($_POST['db_rename']) || ! empty($_POST['db_copy'])) ) { - if (! empty($_REQUEST['db_rename'])) { + if (! empty($_POST['db_rename'])) { $move = true; } else { $move = false; } - if (! isset($_REQUEST['newname']) || strlen($_REQUEST['newname']) === 0) { + if (! isset($_POST['newname']) || strlen($_POST['newname']) === 0) { $message = Message::error(__('The database name is empty!')); } else { // lower_case_table_names=1 `DB` becomes `db` if ($GLOBALS['dbi']->getLowerCaseNames() === '1') { - $_REQUEST['newname'] = mb_strtolower( - $_REQUEST['newname'] + $_POST['newname'] = mb_strtolower( + $_POST['newname'] ); } - if ($_REQUEST['newname'] === $_REQUEST['db']) { + if ($_POST['newname'] === $_REQUEST['db']) { $message = Message::error( __('Cannot copy database to the same name. Change the name and try again.') ); } else { $_error = false; - if ($move || ! empty($_REQUEST['create_database_before_copying'])) { + if ($move || ! empty($_POST['create_database_before_copying'])) { $operations->createDbBeforeCopy(); } @@ -135,10 +135,10 @@ if (strlen($GLOBALS['db']) > 0 $operations->duplicateBookmarks($_error, $GLOBALS['db']); if (! $_error && $move) { - if (isset($_REQUEST['adjust_privileges']) - && ! empty($_REQUEST['adjust_privileges']) + if (isset($_POST['adjust_privileges']) + && ! empty($_POST['adjust_privileges']) ) { - $operations->adjustPrivilegesMoveDb($GLOBALS['db'], $_REQUEST['newname']); + $operations->adjustPrivilegesMoveDb($GLOBALS['db'], $_POST['newname']); } /** @@ -156,19 +156,19 @@ if (strlen($GLOBALS['db']) > 0 __('Database %1$s has been renamed to %2$s.') ); $message->addParam($GLOBALS['db']); - $message->addParam($_REQUEST['newname']); + $message->addParam($_POST['newname']); } elseif (! $_error) { - if (isset($_REQUEST['adjust_privileges']) - && ! empty($_REQUEST['adjust_privileges']) + if (isset($_POST['adjust_privileges']) + && ! empty($_POST['adjust_privileges']) ) { - $operations->adjustPrivilegesCopyDb($GLOBALS['db'], $_REQUEST['newname']); + $operations->adjustPrivilegesCopyDb($GLOBALS['db'], $_POST['newname']); } $message = Message::success( __('Database %1$s has been copied to %2$s.') ); $message->addParam($GLOBALS['db']); - $message->addParam($_REQUEST['newname']); + $message->addParam($_POST['newname']); } else { $message = Message::error(); } @@ -176,13 +176,13 @@ if (strlen($GLOBALS['db']) > 0 /* Change database to be used */ if (! $_error && $move) { - $GLOBALS['db'] = $_REQUEST['newname']; + $GLOBALS['db'] = $_POST['newname']; } elseif (! $_error) { - if (isset($_REQUEST['switch_to_new']) - && $_REQUEST['switch_to_new'] == 'true' + if (isset($_POST['switch_to_new']) + && $_POST['switch_to_new'] == 'true' ) { $_SESSION['pma_switch_to_new'] = true; - $GLOBALS['db'] = $_REQUEST['newname']; + $GLOBALS['db'] = $_POST['newname']; } else { $_SESSION['pma_switch_to_new'] = false; } @@ -197,7 +197,7 @@ if (strlen($GLOBALS['db']) > 0 if ($response->isAjax()) { $response->setRequestStatus($message->isSuccess()); $response->addJSON('message', $message); - $response->addJSON('newname', $_REQUEST['newname']); + $response->addJSON('newname', $_POST['newname']); $response->addJSON( 'sql_query', Util::getMessage(null, $sql_query) @@ -218,8 +218,8 @@ $cfgRelation = $relation->getRelationsParam(); * Check if comments were updated * (must be done before displaying the menu tabs) */ -if (isset($_REQUEST['comment'])) { - $relation->setDbComment($GLOBALS['db'], $_REQUEST['comment']); +if (isset($_POST['comment'])) { + $relation->setDbComment($GLOBALS['db'], $_POST['comment']); } require 'libraries/db_common.inc.php'; @@ -247,7 +247,7 @@ if (isset($message)) { unset($message); } -$_REQUEST['db_collation'] = $GLOBALS['dbi']->getDbCollation($GLOBALS['db']); +$db_collation = $GLOBALS['dbi']->getDbCollation($GLOBALS['db']); $is_information_schema = $GLOBALS['dbi']->isSystemSchema($GLOBALS['db']); if (!$is_information_schema) { @@ -266,7 +266,7 @@ if (!$is_information_schema) { * rename database */ if ($GLOBALS['db'] != 'mysql') { - $response->addHTML($operations->getHtmlForRenameDatabase($GLOBALS['db'])); + $response->addHTML($operations->getHtmlForRenameDatabase($GLOBALS['db']), $db_collation); } // Drop link if allowed @@ -287,7 +287,7 @@ if (!$is_information_schema) { /** * Change database charset */ - $response->addHTML($operations->getHtmlForChangeDatabaseCharset($GLOBALS['db'], $table)); + $response->addHTML($operations->getHtmlForChangeDatabaseCharset($GLOBALS['db'], $db_collation)); if (! $cfgRelation['allworks'] && $cfg['PmaNoRelation_DisableWarning'] == false diff --git a/libraries/classes/Operations.php b/libraries/classes/Operations.php index 7f707612eb..361e1758f5 100644 --- a/libraries/classes/Operations.php +++ b/libraries/classes/Operations.php @@ -75,20 +75,21 @@ class Operations /** * Get HTML output for rename database * - * @param string $db database name + * @param string $db database name + * @param string $db_collation dataset collation * * @return string $html_output */ - public function getHtmlForRenameDatabase($db) + public function getHtmlForRenameDatabase($db, $db_collation) { $html_output = '
' . '
'; - if (isset($_REQUEST['db_collation'])) { + if (isset($db_collation)) { $html_output .= '' . "\n"; } $html_output .= '' @@ -184,11 +185,12 @@ class Operations /** * Get HTML snippet for copy database * - * @param string $db database name + * @param string $db database name + * @param string $db_collation dataset collation * * @return string $html_output */ - public function getHtmlForCopyDatabase($db) + public function getHtmlForCopyDatabase($db, $db_collation) { $drop_clause = 'DROP TABLE / DROP VIEW'; $choices = array( @@ -205,9 +207,9 @@ class Operations . 'method="post" action="db_operations.php" ' . 'onsubmit="return emptyCheckTheField(this, \'newname\')">'; - if (isset($_REQUEST['db_collation'])) { + if (isset($db_collation)) { $html_output .= '' . "\n"; + . 'value="' . $db_collation . '" />' . "\n"; } $html_output .= '' . "\n" . Url::getHiddenInputs($db); @@ -281,19 +283,19 @@ class Operations /** * Get HTML snippet for change database charset * - * @param string $db database name - * @param string $table table name + * @param string $db database name + * @param string $db_collation dataset collation * * @return string $html_output */ - public function getHtmlForChangeDatabaseCharset($db, $table) + public function getHtmlForChangeDatabaseCharset($db, $db_collation) { $html_output = '
' . ''; @@ -308,7 +310,7 @@ class Operations $GLOBALS['cfg']['Server']['DisableIS'], 'db_collation', 'select_db_collation', - isset($_REQUEST['db_collation']) ? $_REQUEST['db_collation'] : '', + isset($db_collation) ? $db_collation : '', false ) . '
' @@ -356,7 +358,7 @@ class Operations if ($tmp_query !== false) { // collect for later display $GLOBALS['sql_query'] .= "\n" . $tmp_query; - $GLOBALS['dbi']->selectDb($_REQUEST['newname']); + $GLOBALS['dbi']->selectDb($_POST['newname']); $GLOBALS['dbi']->query($tmp_query); } } @@ -372,7 +374,7 @@ class Operations if ($tmp_query !== false) { // collect for later display $GLOBALS['sql_query'] .= "\n" . $tmp_query; - $GLOBALS['dbi']->selectDb($_REQUEST['newname']); + $GLOBALS['dbi']->selectDb($_POST['newname']); $GLOBALS['dbi']->query($tmp_query); } } @@ -387,10 +389,10 @@ class Operations public function createDbBeforeCopy() { $local_query = 'CREATE DATABASE IF NOT EXISTS ' - . Util::backquote($_REQUEST['newname']); - if (isset($_REQUEST['db_collation'])) { + . Util::backquote($_POST['newname']); + if (isset($_POST['db_collation'])) { $local_query .= ' DEFAULT' - . Util::getCharsetQueryPart($_REQUEST['db_collation']); + . Util::getCharsetQueryPart($_POST['db_collation']); } $local_query .= ';'; $GLOBALS['sql_query'] .= $local_query; @@ -432,12 +434,12 @@ class Operations if ($GLOBALS['dbi']->getTable($db, $each_table)->isView()) { // If view exists, and 'add drop view' is selected: Drop it! - if ($_REQUEST['what'] != 'nocopy' - && isset($_REQUEST['drop_if_exists']) - && $_REQUEST['drop_if_exists'] == 'true' + if ($_POST['what'] != 'nocopy' + && isset($_POST['drop_if_exists']) + && $_POST['drop_if_exists'] == 'true' ) { $drop_query = 'DROP VIEW IF EXISTS ' - . Util::backquote($_REQUEST['newname']) . '.' + . Util::backquote($_POST['newname']) . '.' . Util::backquote($each_table); $GLOBALS['dbi']->query($drop_query); @@ -449,7 +451,7 @@ class Operations $sql_view_standin = $export_sql_plugin->getTableDefStandIn( $db, $each_table, "\n" ); - $GLOBALS['dbi']->selectDb($_REQUEST['newname']); + $GLOBALS['dbi']->selectDb($_POST['newname']); $GLOBALS['dbi']->query($sql_view_standin); $GLOBALS['sql_query'] .= "\n" . $sql_view_standin; } @@ -476,7 +478,7 @@ class Operations } // value of $what for this table only - $this_what = $_REQUEST['what']; + $this_what = $_POST['what']; // do not copy the data from a Merge table // note: on the calling FORM, 'data' means 'structure and data' @@ -496,7 +498,7 @@ class Operations $triggers = $GLOBALS['dbi']->getTriggers($db, $each_table, ''); if (! Table::moveCopy( - $db, $each_table, $_REQUEST['newname'], $each_table, + $db, $each_table, $_POST['newname'], $each_table, (isset($this_what) ? $this_what : 'data'), $move, 'db_copy' )) { @@ -505,7 +507,7 @@ class Operations } // apply the triggers to the destination db+table if ($triggers) { - $GLOBALS['dbi']->selectDb($_REQUEST['newname']); + $GLOBALS['dbi']->selectDb($_POST['newname']); foreach ($triggers as $trigger) { $GLOBALS['dbi']->query($trigger['create']); $GLOBALS['sql_query'] .= "\n" . $trigger['create'] . ';'; @@ -513,7 +515,7 @@ class Operations } // this does not apply to a rename operation - if (isset($_REQUEST['add_constraints']) + if (isset($_POST['add_constraints']) && ! empty($GLOBALS['sql_constraints_query']) ) { $sqlContraints[] = $GLOBALS['sql_constraints_query']; @@ -547,7 +549,7 @@ class Operations $tmp_query = $GLOBALS['dbi']->getDefinition($db, 'EVENT', $event_name); // collect for later display $GLOBALS['sql_query'] .= "\n" . $tmp_query; - $GLOBALS['dbi']->selectDb($_REQUEST['newname']); + $GLOBALS['dbi']->selectDb($_POST['newname']); $GLOBALS['dbi']->query($tmp_query); } } @@ -566,26 +568,26 @@ class Operations { // temporarily force to add DROP IF EXIST to CREATE VIEW query, // to remove stand-in VIEW that was created earlier - // ( $_REQUEST['drop_if_exists'] is used in moveCopy() ) - if (isset($_REQUEST['drop_if_exists'])) { - $temp_drop_if_exists = $_REQUEST['drop_if_exists']; + // ( $_POST['drop_if_exists'] is used in moveCopy() ) + if (isset($_POST['drop_if_exists'])) { + $temp_drop_if_exists = $_POST['drop_if_exists']; } - $_REQUEST['drop_if_exists'] = 'true'; + $_POST['drop_if_exists'] = 'true'; foreach ($views as $view) { $copying_succeeded = Table::moveCopy( - $db, $view, $_REQUEST['newname'], $view, 'structure', $move, 'db_copy' + $db, $view, $_POST['newname'], $view, 'structure', $move, 'db_copy' ); if (! $copying_succeeded) { $GLOBALS['_error'] = true; break; } } - unset($_REQUEST['drop_if_exists']); + unset($_POST['drop_if_exists']); if (isset($temp_drop_if_exists)) { // restore previous value - $_REQUEST['drop_if_exists'] = $temp_drop_if_exists; + $_POST['drop_if_exists'] = $temp_drop_if_exists; } } @@ -753,7 +755,7 @@ class Operations */ public function createAllAccumulatedConstraints(array $sqlConstratints) { - $GLOBALS['dbi']->selectDb($_REQUEST['newname']); + $GLOBALS['dbi']->selectDb($_POST['newname']); foreach ($sqlConstratints as $one_query) { $GLOBALS['dbi']->query($one_query); // and prepare to display them @@ -771,10 +773,10 @@ class Operations */ public function duplicateBookmarks($_error, $db) { - if (! $_error && $db != $_REQUEST['newname']) { + if (! $_error && $db != $_POST['newname']) { $get_fields = array('user', 'label', 'query'); $where_fields = array('dbase' => $db); - $new_fields = array('dbase' => $_REQUEST['newname']); + $new_fields = array('dbase' => $_POST['newname']); Table::duplicateInfo( 'bookmarkwork', 'bookmark', $get_fields, $where_fields, $new_fields @@ -1735,9 +1737,9 @@ class Operations $sql_query = 'ALTER TABLE ' . Util::backquote($GLOBALS['table']) . ' ORDER BY ' - . Util::backquote(urldecode($_REQUEST['order_field'])); - if (isset($_REQUEST['order_order']) - && $_REQUEST['order_order'] === 'desc' + . Util::backquote(urldecode($_POST['order_field'])); + if (isset($_POST['order_order']) + && $_POST['order_order'] === 'desc' ) { $sql_query .= ' DESC'; } else { @@ -1772,11 +1774,11 @@ class Operations $table_alters = array(); - if (isset($_REQUEST['comment']) - && urldecode($_REQUEST['prev_comment']) !== $_REQUEST['comment'] + if (isset($_POST['comment']) + && urldecode($_POST['prev_comment']) !== $_POST['comment'] ) { $table_alters[] = 'COMMENT = \'' - . $GLOBALS['dbi']->escapeString($_REQUEST['comment']) . '\''; + . $GLOBALS['dbi']->escapeString($_POST['comment']) . '\''; } if (! empty($newTblStorageEngine) @@ -1784,62 +1786,62 @@ class Operations ) { $table_alters[] = 'ENGINE = ' . $newTblStorageEngine; } - if (! empty($_REQUEST['tbl_collation']) - && $_REQUEST['tbl_collation'] !== $tbl_collation + if (! empty($_POST['tbl_collation']) + && $_POST['tbl_collation'] !== $tbl_collation ) { $table_alters[] = 'DEFAULT ' - . Util::getCharsetQueryPart($_REQUEST['tbl_collation']); + . Util::getCharsetQueryPart($_POST['tbl_collation']); } if ($pma_table->isEngine(array('MYISAM', 'ARIA', 'ISAM')) - && isset($_REQUEST['new_pack_keys']) - && $_REQUEST['new_pack_keys'] != (string)$pack_keys + && isset($_POST['new_pack_keys']) + && $_POST['new_pack_keys'] != (string)$pack_keys ) { - $table_alters[] = 'pack_keys = ' . $_REQUEST['new_pack_keys']; + $table_alters[] = 'pack_keys = ' . $_POST['new_pack_keys']; } - $_REQUEST['new_checksum'] = empty($_REQUEST['new_checksum']) ? '0' : '1'; + $_POST['new_checksum'] = empty($_POST['new_checksum']) ? '0' : '1'; if ($pma_table->isEngine(array('MYISAM', 'ARIA')) - && $_REQUEST['new_checksum'] !== $checksum + && $_POST['new_checksum'] !== $checksum ) { - $table_alters[] = 'checksum = ' . $_REQUEST['new_checksum']; + $table_alters[] = 'checksum = ' . $_POST['new_checksum']; } - $_REQUEST['new_transactional'] - = empty($_REQUEST['new_transactional']) ? '0' : '1'; + $_POST['new_transactional'] + = empty($_POST['new_transactional']) ? '0' : '1'; if ($pma_table->isEngine('ARIA') - && $_REQUEST['new_transactional'] !== $transactional + && $_POST['new_transactional'] !== $transactional ) { - $table_alters[] = 'TRANSACTIONAL = ' . $_REQUEST['new_transactional']; + $table_alters[] = 'TRANSACTIONAL = ' . $_POST['new_transactional']; } - $_REQUEST['new_page_checksum'] - = empty($_REQUEST['new_page_checksum']) ? '0' : '1'; + $_POST['new_page_checksum'] + = empty($_POST['new_page_checksum']) ? '0' : '1'; if ($pma_table->isEngine('ARIA') - && $_REQUEST['new_page_checksum'] !== $page_checksum + && $_POST['new_page_checksum'] !== $page_checksum ) { - $table_alters[] = 'PAGE_CHECKSUM = ' . $_REQUEST['new_page_checksum']; + $table_alters[] = 'PAGE_CHECKSUM = ' . $_POST['new_page_checksum']; } - $_REQUEST['new_delay_key_write'] - = empty($_REQUEST['new_delay_key_write']) ? '0' : '1'; + $_POST['new_delay_key_write'] + = empty($_POST['new_delay_key_write']) ? '0' : '1'; if ($pma_table->isEngine(array('MYISAM', 'ARIA')) - && $_REQUEST['new_delay_key_write'] !== $delay_key_write + && $_POST['new_delay_key_write'] !== $delay_key_write ) { - $table_alters[] = 'delay_key_write = ' . $_REQUEST['new_delay_key_write']; + $table_alters[] = 'delay_key_write = ' . $_POST['new_delay_key_write']; } if ($pma_table->isEngine(array('MYISAM', 'ARIA', 'INNODB', 'PBXT')) - && ! empty($_REQUEST['new_auto_increment']) + && ! empty($_POST['new_auto_increment']) && (! isset($auto_increment) - || $_REQUEST['new_auto_increment'] !== $auto_increment) + || $_POST['new_auto_increment'] !== $auto_increment) ) { $table_alters[] = 'auto_increment = ' - . $GLOBALS['dbi']->escapeString($_REQUEST['new_auto_increment']); + . $GLOBALS['dbi']->escapeString($_POST['new_auto_increment']); } - if (! empty($_REQUEST['new_row_format'])) { - $newRowFormat = $_REQUEST['new_row_format']; + if (! empty($_POST['new_row_format'])) { + $newRowFormat = $_POST['new_row_format']; $newRowFormatLower = mb_strtolower($newRowFormat); if ($pma_table->isEngine(array('MYISAM', 'ARIA', 'INNODB', 'PBXT')) && (strlen($row_format) === 0 @@ -1868,8 +1870,8 @@ class Operations // should not be reported with a Level of Error, so here // I just ignore it. But there are other 1478 messages // that it's better to show. - if (! (isset($_REQUEST['new_tbl_storage_engine']) - && $_REQUEST['new_tbl_storage_engine'] == 'MyISAM' + if (! (isset($_POST['new_tbl_storage_engine']) + && $_POST['new_tbl_storage_engine'] == 'MyISAM' && $warning['Code'] == '1478' && $warning['Level'] == 'Error') ) { @@ -1890,13 +1892,13 @@ class Operations { $sql_query = 'ALTER TABLE ' . Util::backquote($GLOBALS['table']) . ' ' - . $_REQUEST['partition_operation'] + . $_POST['partition_operation'] . ' PARTITION '; - if ($_REQUEST['partition_operation'] == 'COALESCE') { - $sql_query .= count($_REQUEST['partition_name']); + if ($_POST['partition_operation'] == 'COALESCE') { + $sql_query .= count($_POST['partition_name']); } else { - $sql_query .= implode(', ', $_REQUEST['partition_name']) . ';'; + $sql_query .= implode(', ', $_POST['partition_name']) . ';'; } $result = $GLOBALS['dbi']->query($sql_query); @@ -2045,43 +2047,43 @@ class Operations $GLOBALS['dbi']->selectDb($db); /** - * $_REQUEST['target_db'] could be empty in case we came from an input field + * $_POST['target_db'] could be empty in case we came from an input field * (when there are many databases, no drop-down) */ - if (empty($_REQUEST['target_db'])) { - $_REQUEST['target_db'] = $db; + if (empty($_POST['target_db'])) { + $_POST['target_db'] = $db; } /** * A target table name has been sent to this script -> do the work */ - if (Core::isValid($_REQUEST['new_name'])) { - if ($db == $_REQUEST['target_db'] && $table == $_REQUEST['new_name']) { - if (isset($_REQUEST['submit_move'])) { + if (Core::isValid($_POST['new_name'])) { + if ($db == $_POST['target_db'] && $table == $_POST['new_name']) { + if (isset($_POST['submit_move'])) { $message = Message::error(__('Can\'t move table to same one!')); } else { $message = Message::error(__('Can\'t copy table to same one!')); } } else { Table::moveCopy( - $db, $table, $_REQUEST['target_db'], $_REQUEST['new_name'], - $_REQUEST['what'], isset($_REQUEST['submit_move']), 'one_table' + $db, $table, $_POST['target_db'], $_POST['new_name'], + $_POST['what'], isset($_POST['submit_move']), 'one_table' ); - if (isset($_REQUEST['adjust_privileges']) - && ! empty($_REQUEST['adjust_privileges']) + if (isset($_POST['adjust_privileges']) + && ! empty($_POST['adjust_privileges']) ) { - if (isset($_REQUEST['submit_move'])) { + if (isset($_POST['submit_move'])) { $this->adjustPrivilegesRenameOrMoveTable( - $db, $table, $_REQUEST['target_db'], $_REQUEST['new_name'] + $db, $table, $_POST['target_db'], $_POST['new_name'] ); } else { $this->adjustPrivilegesCopyTable( - $db, $table, $_REQUEST['target_db'], $_REQUEST['new_name'] + $db, $table, $_POST['target_db'], $_POST['new_name'] ); } - if (isset($_REQUEST['submit_move'])) { + if (isset($_POST['submit_move'])) { $message = Message::success( __( 'Table %s has been moved to %s. Privileges have been ' @@ -2098,7 +2100,7 @@ class Operations } } else { - if (isset($_REQUEST['submit_move'])) { + if (isset($_POST['submit_move'])) { $message = Message::success( __('Table %s has been moved to %s.') ); @@ -2113,20 +2115,20 @@ class Operations . Util::backquote($table); $message->addParam($old); - $new_name = $_REQUEST['new_name']; + $new_name = $_POST['new_name']; if ($GLOBALS['dbi']->getLowerCaseNames() === '1') { $new_name = strtolower($new_name); } $GLOBALS['table'] = $new_name; - $new = Util::backquote($_REQUEST['target_db']) . '.' + $new = Util::backquote($_POST['target_db']) . '.' . Util::backquote($new_name); $message->addParam($new); /* Check: Work on new table or on old table? */ - if (isset($_REQUEST['submit_move']) - || Core::isValid($_REQUEST['switch_to_new']) + if (isset($_POST['submit_move']) + || Core::isValid($_POST['switch_to_new']) ) { } } diff --git a/tbl_operations.php b/tbl_operations.php index 95189677b8..0935b9f5d6 100644 --- a/tbl_operations.php +++ b/tbl_operations.php @@ -100,7 +100,7 @@ $operations = new Operations(); /** * If the table has to be moved to some other database */ -if (isset($_REQUEST['submit_move']) || isset($_REQUEST['submit_copy'])) { +if (isset($_POST['submit_move']) || isset($_POST['submit_copy'])) { //$_message = ''; $operations->moveOrCopyTable($db, $table); // This was ended in an Ajax call @@ -109,28 +109,28 @@ if (isset($_REQUEST['submit_move']) || isset($_REQUEST['submit_copy'])) { /** * If the table has to be maintained */ -if (isset($_REQUEST['table_maintenance'])) { +if (isset($_POST['table_maintenance'])) { include_once 'sql.php'; unset($result); } /** * Updates table comment, type and options if required */ -if (isset($_REQUEST['submitoptions'])) { +if (isset($_POST['submitoptions'])) { $_message = ''; $warning_messages = array(); - if (isset($_REQUEST['new_name'])) { + if (isset($_POST['new_name'])) { // Get original names before rename operation $oldTable = $pma_table->getName(); $oldDb = $pma_table->getDbName(); - if ($pma_table->rename($_REQUEST['new_name'])) { - if (isset($_REQUEST['adjust_privileges']) - && ! empty($_REQUEST['adjust_privileges']) + if ($pma_table->rename($_POST['new_name'])) { + if (isset($_POST['adjust_privileges']) + && ! empty($_POST['adjust_privileges']) ) { $operations->adjustPrivilegesRenameOrMoveTable( - $oldDb, $oldTable, $_REQUEST['db'], $_REQUEST['new_name'] + $oldDb, $oldTable, $_POST['db'], $_POST['new_name'] ); } @@ -148,10 +148,10 @@ if (isset($_REQUEST['submitoptions'])) { } } - if (! empty($_REQUEST['new_tbl_storage_engine']) - && mb_strtoupper($_REQUEST['new_tbl_storage_engine']) !== $tbl_storage_engine + if (! empty($_POST['new_tbl_storage_engine']) + && mb_strtoupper($_POST['new_tbl_storage_engine']) !== $tbl_storage_engine ) { - $new_tbl_storage_engine = mb_strtoupper($_REQUEST['new_tbl_storage_engine']); + $new_tbl_storage_engine = mb_strtoupper($_POST['new_tbl_storage_engine']); if ($pma_table->isEngine('ARIA')) { $create_options['transactional'] = (isset($create_options['transactional']) && $create_options['transactional'] == '0') @@ -190,28 +190,28 @@ if (isset($_REQUEST['submitoptions'])) { $warning_messages = $operations->getWarningMessagesArray(); } - if (isset($_REQUEST['tbl_collation']) - && ! empty($_REQUEST['tbl_collation']) - && isset($_REQUEST['change_all_collations']) - && ! empty($_REQUEST['change_all_collations']) + if (isset($_POST['tbl_collation']) + && ! empty($_POST['tbl_collation']) + && isset($_POST['change_all_collations']) + && ! empty($_POST['change_all_collations']) ) { $operations->changeAllColumnsCollation( - $GLOBALS['db'], $GLOBALS['table'], $_REQUEST['tbl_collation'] + $GLOBALS['db'], $GLOBALS['table'], $_POST['tbl_collation'] ); } } /** * Reordering the table has been requested by the user */ -if (isset($_REQUEST['submitorderby']) && ! empty($_REQUEST['order_field'])) { +if (isset($_POST['submitorderby']) && ! empty($_POST['order_field'])) { list($sql_query, $result) = $operations->getQueryAndResultForReorderingTable(); } // end if /** * A partition operation has been requested by the user */ -if (isset($_REQUEST['submit_partition']) - && ! empty($_REQUEST['partition_operation']) +if (isset($_POST['submit_partition']) + && ! empty($_POST['partition_operation']) ) { list($sql_query, $result) = $operations->getQueryAndResultForPartition(); } // end if diff --git a/test/classes/OperationsTest.php b/test/classes/OperationsTest.php index cd425f37cd..8704b97764 100644 --- a/test/classes/OperationsTest.php +++ b/test/classes/OperationsTest.php @@ -75,8 +75,8 @@ class OperationsTest extends TestCase public function testGetHtmlForRenameDatabase() { - $_REQUEST['db_collation'] = 'db1'; - $html = $this->operations->getHtmlForRenameDatabase("pma"); + $db_collation = 'db1'; + $html = $this->operations->getHtmlForRenameDatabase("pma", $db_collation); $this->assertContains('db_operations.php', $html); $this->assertRegExp( '/.*db_rename.*Rename database to.*/', @@ -105,8 +105,8 @@ class OperationsTest extends TestCase */ public function testGetHtmlForCopyDatabase() { - $_REQUEST['db_collation'] = 'db1'; - $html = $this->operations->getHtmlForCopyDatabase("pma"); + $db_collation = 'db1'; + $html = $this->operations->getHtmlForCopyDatabase("pma", $db_collation); $this->assertRegExp('/.*db_operations.php.*/', $html); $this->assertRegExp('/.*db_copy.*/', $html); $this->assertRegExp('/.*Copy database to.*/', $html); @@ -120,8 +120,8 @@ class OperationsTest extends TestCase public function testGetHtmlForChangeDatabaseCharset() { - $_REQUEST['db_collation'] = 'db1'; - $result = $this->operations->getHtmlForChangeDatabaseCharset("pma", "bookmark"); + $db_collation = 'db1'; + $result = $this->operations->getHtmlForChangeDatabaseCharset("pma", $db_collation); $this->assertRegExp( '/.*select_db_collation.*Collation.*/m', $result ); From be0660e4c46a1f3f74d86bac41419d5804201502 Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Tue, 10 Jul 2018 16:58:45 +1000 Subject: [PATCH 02/49] Fix missing parameter Signed-off-by: Madhura Jayaratne --- db_operations.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/db_operations.php b/db_operations.php index 78a61b6ed4..f3ad40e892 100644 --- a/db_operations.php +++ b/db_operations.php @@ -266,7 +266,7 @@ if (!$is_information_schema) { * rename database */ if ($GLOBALS['db'] != 'mysql') { - $response->addHTML($operations->getHtmlForRenameDatabase($GLOBALS['db']), $db_collation); + $response->addHTML($operations->getHtmlForRenameDatabase($GLOBALS['db'], $db_collation)); } // Drop link if allowed @@ -282,7 +282,7 @@ if (!$is_information_schema) { /** * Copy database */ - $response->addHTML($operations->getHtmlForCopyDatabase($GLOBALS['db'])); + $response->addHTML($operations->getHtmlForCopyDatabase($GLOBALS['db'], $db_collation)); /** * Change database charset From 5d781422fb9f0af54e9cf9c85371b4d8c02ac56d Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Sun, 15 Jul 2018 20:16:28 +1000 Subject: [PATCH 03/49] Retrieve parameters from $_POST in server_databases page Signed-off-by: Madhura Jayaratne --- js/server_databases.js | 7 ++++--- .../Controllers/Server/ServerDatabasesController.php | 4 ++-- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/js/server_databases.js b/js/server_databases.js index cb91d6b180..a892ca8bfd 100644 --- a/js/server_databases.js +++ b/js/server_databases.js @@ -60,13 +60,14 @@ AJAX.registerOnload('server_databases.js', function () { $(this).PMA_confirm( question, $form.prop('action') + '?' + $(this).serialize() + - argsep + 'drop_selected_dbs=1' + argsep + 'is_js_confirmed=1' + argsep + 'ajax_request=true', + argsep + 'drop_selected_dbs=1', function (url) { PMA_ajaxShowMessage(PMA_messages.strProcessingRequest, false); - var params = getJSConfirmCommonParam(this); + var parts = url.split('?'); + var params = getJSConfirmCommonParam(this, parts[1]); - $.post(url, params, function (data) { + $.post(parts[0], params, function (data) { if (typeof data !== 'undefined' && data.success === true) { PMA_ajaxShowMessage(data.message); diff --git a/libraries/classes/Controllers/Server/ServerDatabasesController.php b/libraries/classes/Controllers/Server/ServerDatabasesController.php index 67128347a5..fea993841f 100644 --- a/libraries/classes/Controllers/Server/ServerDatabasesController.php +++ b/libraries/classes/Controllers/Server/ServerDatabasesController.php @@ -62,7 +62,7 @@ class ServerDatabasesController extends Controller $response = Response::getInstance(); - if (isset($_REQUEST['drop_selected_dbs']) + if (isset($_POST['drop_selected_dbs']) && $response->isAjax() && ($GLOBALS['dbi']->isSuperuser() || $GLOBALS['cfg']['AllowUserDropDatabase']) ) { @@ -184,7 +184,7 @@ class ServerDatabasesController extends Controller */ public function dropDatabasesAction() { - if (! isset($_REQUEST['selected_dbs'])) { + if (! isset($_POST['selected_dbs'])) { $message = Message::error(__('No databases selected.')); } else { $action = 'server_databases.php'; From d6e04ca09b205cbc1e00f26da9d1f3690287a4af Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Sun, 15 Jul 2018 21:02:49 +1000 Subject: [PATCH 04/49] Fix #249 CSRF to CREATE TABLE query Signed-off-by: Madhura Jayaratne --- libraries/classes/CreateAddField.php | 130 +++++++++++++-------------- tbl_create.php | 24 ++--- test/classes/CreateAddFieldTest.php | 6 +- 3 files changed, 80 insertions(+), 80 deletions(-) diff --git a/libraries/classes/CreateAddField.php b/libraries/classes/CreateAddField.php index a7b46eee39..3467fc8a75 100644 --- a/libraries/classes/CreateAddField.php +++ b/libraries/classes/CreateAddField.php @@ -42,12 +42,12 @@ class CreateAddField */ private function getIndexedColumns() { - $fieldCount = count($_REQUEST['field_name']); - $fieldPrimary = json_decode($_REQUEST['primary_indexes'], true); - $fieldIndex = json_decode($_REQUEST['indexes'], true); - $fieldUnique = json_decode($_REQUEST['unique_indexes'], true); - $fieldFullText = json_decode($_REQUEST['fulltext_indexes'], true); - $fieldSpatial = json_decode($_REQUEST['spatial_indexes'], true); + $fieldCount = count($_POST['field_name']); + $fieldPrimary = json_decode($_POST['primary_indexes'], true); + $fieldIndex = json_decode($_POST['indexes'], true); + $fieldUnique = json_decode($_POST['unique_indexes'], true); + $fieldFullText = json_decode($_POST['fulltext_indexes'], true); + $fieldSpatial = json_decode($_POST['spatial_indexes'], true); return [ $fieldCount, @@ -78,35 +78,35 @@ class CreateAddField $previousField = -1; for ($i = 0; $i < $fieldCount; ++$i) { // '0' is also empty for php :-( - if (strlen($_REQUEST['field_name'][$i]) === 0) { + if (strlen($_POST['field_name'][$i]) === 0) { continue; } $definition = $this->getStatementPrefix($isCreateTable) . Table::generateFieldSpec( - trim($_REQUEST['field_name'][$i]), - $_REQUEST['field_type'][$i], - $_REQUEST['field_length'][$i], - $_REQUEST['field_attribute'][$i], - isset($_REQUEST['field_collation'][$i]) - ? $_REQUEST['field_collation'][$i] + trim($_POST['field_name'][$i]), + $_POST['field_type'][$i], + $_POST['field_length'][$i], + $_POST['field_attribute'][$i], + isset($_POST['field_collation'][$i]) + ? $_POST['field_collation'][$i] : '', - isset($_REQUEST['field_null'][$i]) - ? $_REQUEST['field_null'][$i] + isset($_POST['field_null'][$i]) + ? $_POST['field_null'][$i] : 'NOT NULL', - $_REQUEST['field_default_type'][$i], - $_REQUEST['field_default_value'][$i], - isset($_REQUEST['field_extra'][$i]) - ? $_REQUEST['field_extra'][$i] + $_POST['field_default_type'][$i], + $_POST['field_default_value'][$i], + isset($_POST['field_extra'][$i]) + ? $_POST['field_extra'][$i] : false, - isset($_REQUEST['field_comments'][$i]) - ? $_REQUEST['field_comments'][$i] + isset($_POST['field_comments'][$i]) + ? $_POST['field_comments'][$i] : '', - isset($_REQUEST['field_virtuality'][$i]) - ? $_REQUEST['field_virtuality'][$i] + isset($_POST['field_virtuality'][$i]) + ? $_POST['field_virtuality'][$i] : '', - isset($_REQUEST['field_expression'][$i]) - ? $_REQUEST['field_expression'][$i] + isset($_POST['field_expression'][$i]) + ? $_POST['field_expression'][$i] : '' ); @@ -139,22 +139,22 @@ class CreateAddField return $sqlSuffix; } - if ((string) $_REQUEST['field_where'] === 'last') { + if ((string) $_POST['field_where'] === 'last') { return $sqlSuffix; } // Only the first field can be added somewhere other than at the end if ($previousField == -1) { - if ((string) $_REQUEST['field_where'] === 'first') { + if ((string) $_POST['field_where'] === 'first') { $sqlSuffix .= ' FIRST'; } else { $sqlSuffix .= ' AFTER ' - . Util::backquote($_REQUEST['after_field']); + . Util::backquote($_POST['after_field']); } } else { $sqlSuffix .= ' AFTER ' . Util::backquote( - $_REQUEST['field_name'][$previousField] + $_POST['field_name'][$previousField] ); } @@ -192,7 +192,7 @@ class CreateAddField $indexFields = []; foreach ($index['columns'] as $key => $column) { $indexFields[$key] = Util::backquote( - $_REQUEST['field_name'][$column['col_index']] + $_POST['field_name'][$column['col_index']] ); if ($column['size']) { $indexFields[$key] .= '(' . $column['size'] . ')'; @@ -358,30 +358,30 @@ class CreateAddField public function getPartitionsDefinition() { $sqlQuery = ""; - if (! empty($_REQUEST['partition_by']) - && ! empty($_REQUEST['partition_expr']) - && ! empty($_REQUEST['partition_count']) - && $_REQUEST['partition_count'] > 1 + if (! empty($_POST['partition_by']) + && ! empty($_POST['partition_expr']) + && ! empty($_POST['partition_count']) + && $_POST['partition_count'] > 1 ) { - $sqlQuery .= " PARTITION BY " . $_REQUEST['partition_by'] - . " (" . $_REQUEST['partition_expr'] . ")" - . " PARTITIONS " . $_REQUEST['partition_count']; + $sqlQuery .= " PARTITION BY " . $_POST['partition_by'] + . " (" . $_POST['partition_expr'] . ")" + . " PARTITIONS " . $_POST['partition_count']; } - if (! empty($_REQUEST['subpartition_by']) - && ! empty($_REQUEST['subpartition_expr']) - && ! empty($_REQUEST['subpartition_count']) - && $_REQUEST['subpartition_count'] > 1 + if (! empty($_POST['subpartition_by']) + && ! empty($_POST['subpartition_expr']) + && ! empty($_POST['subpartition_count']) + && $_POST['subpartition_count'] > 1 ) { - $sqlQuery .= " SUBPARTITION BY " . $_REQUEST['subpartition_by'] - . " (" . $_REQUEST['subpartition_expr'] . ")" - . " SUBPARTITIONS " . $_REQUEST['subpartition_count']; + $sqlQuery .= " SUBPARTITION BY " . $_POST['subpartition_by'] + . " (" . $_POST['subpartition_expr'] . ")" + . " SUBPARTITIONS " . $_POST['subpartition_count']; } - if (! empty($_REQUEST['partitions'])) { + if (! empty($_POST['partitions'])) { $i = 0; $partitions = []; - foreach ($_REQUEST['partitions'] as $partition) { + foreach ($_POST['partitions'] as $partition) { $partitions[] = $this->getPartitionDefinition($partition); $i++; } @@ -471,24 +471,24 @@ class CreateAddField . Util::backquote(trim($table)) . ' (' . $sqlStatement . ')'; // Adds table type, character set, comments and partition definition - if (!empty($_REQUEST['tbl_storage_engine']) - && ($_REQUEST['tbl_storage_engine'] != 'Default') + if (!empty($_POST['tbl_storage_engine']) + && ($_POST['tbl_storage_engine'] != 'Default') ) { - $sqlQuery .= ' ENGINE = ' . $_REQUEST['tbl_storage_engine']; + $sqlQuery .= ' ENGINE = ' . $_POST['tbl_storage_engine']; } - if (!empty($_REQUEST['tbl_collation'])) { - $sqlQuery .= Util::getCharsetQueryPart($_REQUEST['tbl_collation']); + if (!empty($_POST['tbl_collation'])) { + $sqlQuery .= Util::getCharsetQueryPart($_POST['tbl_collation']); } - if (! empty($_REQUEST['connection']) - && ! empty($_REQUEST['tbl_storage_engine']) - && $_REQUEST['tbl_storage_engine'] == 'FEDERATED' + if (! empty($_POST['connection']) + && ! empty($_POST['tbl_storage_engine']) + && $_POST['tbl_storage_engine'] == 'FEDERATED' ) { $sqlQuery .= " CONNECTION = '" - . $this->dbi->escapeString($_REQUEST['connection']) . "'"; + . $this->dbi->escapeString($_POST['connection']) . "'"; } - if (!empty($_REQUEST['comment'])) { + if (!empty($_POST['comment'])) { $sqlQuery .= ' COMMENT = \'' - . $this->dbi->escapeString($_REQUEST['comment']) . '\''; + . $this->dbi->escapeString($_POST['comment']) . '\''; } $sqlQuery .= $this->getPartitionsDefinition(); $sqlQuery .= ';'; @@ -506,14 +506,14 @@ class CreateAddField // Limit to 4096 fields (MySQL maximal value) $mysqlLimit = 4096; - if (isset($_REQUEST['submit_num_fields'])) { // adding new fields - $numberOfFields = intval($_REQUEST['orig_num_fields']) + intval($_REQUEST['added_fields']); - } elseif (isset($_REQUEST['orig_num_fields'])) { // retaining existing fields - $numberOfFields = intval($_REQUEST['orig_num_fields']); - } elseif (isset($_REQUEST['num_fields']) - && intval($_REQUEST['num_fields']) > 0 + if (isset($_POST['submit_num_fields'])) { // adding new fields + $numberOfFields = intval($_POST['orig_num_fields']) + intval($_POST['added_fields']); + } elseif (isset($_POST['orig_num_fields'])) { // retaining existing fields + $numberOfFields = intval($_POST['orig_num_fields']); + } elseif (isset($_POST['num_fields']) + && intval($_POST['num_fields']) > 0 ) { // new table with specified number of fields - $numberOfFields = intval($_REQUEST['num_fields']); + $numberOfFields = intval($_POST['num_fields']); } else { // new table with unspecified number of fields $numberOfFields = 4; } @@ -548,7 +548,7 @@ class CreateAddField $sqlQuery = 'ALTER TABLE ' . Util::backquote($table) . ' ' . $sqlStatement . ';'; // If there is a request for SQL previewing. - if (isset($_REQUEST['preview_sql'])) { + if (isset($_POST['preview_sql'])) { Core::previewSQL($sqlQuery); } return [$this->dbi->tryQuery($sqlQuery), $sqlQuery]; diff --git a/tbl_create.php b/tbl_create.php index f17707ef55..503b168a32 100644 --- a/tbl_create.php +++ b/tbl_create.php @@ -61,11 +61,11 @@ $action = 'tbl_create.php'; /** * The form used to define the structure of the table has been submitted */ -if (isset($_REQUEST['do_save_data'])) { +if (isset($_POST['do_save_data'])) { $sql_query = $createAddField->getTableCreationQuery($db, $table); // If there is a request for SQL previewing. - if (isset($_REQUEST['preview_sql'])) { + if (isset($_POST['preview_sql'])) { Core::previewSQL($sql_query); } // Executes the query @@ -73,21 +73,21 @@ if (isset($_REQUEST['do_save_data'])) { if ($result) { // Update comment table for mime types [MIME] - if (isset($_REQUEST['field_mimetype']) - && is_array($_REQUEST['field_mimetype']) + if (isset($_POST['field_mimetype']) + && is_array($_POST['field_mimetype']) && $cfg['BrowseMIME'] ) { - foreach ($_REQUEST['field_mimetype'] as $fieldindex => $mimetype) { - if (isset($_REQUEST['field_name'][$fieldindex]) - && strlen($_REQUEST['field_name'][$fieldindex]) > 0 + foreach ($_POST['field_mimetype'] as $fieldindex => $mimetype) { + if (isset($_POST['field_name'][$fieldindex]) + && strlen($_POST['field_name'][$fieldindex]) > 0 ) { Transformations::setMIME( $db, $table, - $_REQUEST['field_name'][$fieldindex], $mimetype, - $_REQUEST['field_transformation'][$fieldindex], - $_REQUEST['field_transformation_options'][$fieldindex], - $_REQUEST['field_input_transformation'][$fieldindex], - $_REQUEST['field_input_transformation_options'][$fieldindex] + $_POST['field_name'][$fieldindex], $mimetype, + $_POST['field_transformation'][$fieldindex], + $_POST['field_transformation_options'][$fieldindex], + $_POST['field_input_transformation'][$fieldindex], + $_POST['field_input_transformation_options'][$fieldindex] ); } } diff --git a/test/classes/CreateAddFieldTest.php b/test/classes/CreateAddFieldTest.php index a2916debd2..0e9884ee02 100644 --- a/test/classes/CreateAddFieldTest.php +++ b/test/classes/CreateAddFieldTest.php @@ -44,7 +44,7 @@ class CreateAddFieldTest extends TestCase */ public function testGetPartitionsDefinition($expected, $request) { - $_REQUEST = $request; + $_POST = $request; $actual = $this->createAddField->getPartitionsDefinition(); $this->assertEquals($expected, $actual); } @@ -80,7 +80,7 @@ class CreateAddFieldTest extends TestCase */ public function testGetTableCreationQuery($expected, $db, $table, $request) { - $_REQUEST = $request; + $_POST = $request; $actual = $this->createAddField->getTableCreationQuery($db, $table); $this->assertEquals($expected, $actual); } @@ -116,7 +116,7 @@ class CreateAddFieldTest extends TestCase */ public function testGetNumberOfFieldsFromRequest($expected, $request) { - $_REQUEST = $request; + $_POST = $request; $actual = $this->createAddField->getNumberOfFieldsFromRequest(); $this->assertEquals($expected, $actual); } From d9279982a9c24456c061ecc700f69610424e854e Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Sun, 15 Jul 2018 21:57:07 +1000 Subject: [PATCH 05/49] Retrieve parameters from $_POST in routines Signed-off-by: Madhura Jayaratne --- libraries/classes/Rte/Routines.php | 248 ++++++++++++++--------------- 1 file changed, 124 insertions(+), 124 deletions(-) diff --git a/libraries/classes/Rte/Routines.php b/libraries/classes/Rte/Routines.php index 3bfca689de..adba6f1ba8 100644 --- a/libraries/classes/Rte/Routines.php +++ b/libraries/classes/Rte/Routines.php @@ -117,21 +117,21 @@ class Routines */ // FIXME: this must be simpler than that if (count($errors) - || ( empty($_REQUEST['editor_process_add']) - && empty($_REQUEST['editor_process_edit']) + || ( empty($_POST['editor_process_add']) + && empty($_POST['editor_process_edit']) && (! empty($_REQUEST['add_item']) || ! empty($_REQUEST['edit_item']) - || ! empty($_REQUEST['routine_addparameter']) - || ! empty($_REQUEST['routine_removeparameter']) - || ! empty($_REQUEST['routine_changetype']))) + || ! empty($_POST['routine_addparameter']) + || ! empty($_POST['routine_removeparameter']) + || ! empty($_POST['routine_changetype']))) ) { // Handle requests to add/remove parameters and changing routine type // This is necessary when JS is disabled $operation = ''; - if (! empty($_REQUEST['routine_addparameter'])) { + if (! empty($_POST['routine_addparameter'])) { $operation = 'add'; - } elseif (! empty($_REQUEST['routine_removeparameter'])) { + } elseif (! empty($_POST['routine_removeparameter'])) { $operation = 'remove'; - } elseif (! empty($_REQUEST['routine_changetype'])) { + } elseif (! empty($_POST['routine_changetype'])) { $operation = 'change'; } // Get the data for the form (if any) @@ -141,11 +141,11 @@ class Routines $mode = 'add'; } elseif (! empty($_REQUEST['edit_item'])) { $title = __("Edit routine"); - if (! $operation && ! empty($_REQUEST['item_name']) - && empty($_REQUEST['editor_process_edit']) + if (! $operation && ! empty($_GET['item_name']) + && empty($_POST['editor_process_edit']) ) { $routine = self::getDataFromName( - $_REQUEST['item_name'], $_REQUEST['item_type'] + $_GET['item_name'], $_GET['item_type'] ); if ($routine !== false) { $routine['item_original_name'] = $routine['item_name']; @@ -200,8 +200,8 @@ class Routines */ public static function handleRequestCreateOrEdit(array $errors, $db) { - if (empty($_REQUEST['editor_process_add']) - && empty($_REQUEST['editor_process_edit']) + if (empty($_POST['editor_process_add']) + && empty($_POST['editor_process_edit']) ) { return $errors; } @@ -210,29 +210,29 @@ class Routines $routine_query = self::getQueryFromRequest(); if (!count($errors)) { // set by self::getQueryFromRequest() // Execute the created query - if (!empty($_REQUEST['editor_process_edit'])) { + if (!empty($_POST['editor_process_edit'])) { $isProcOrFunc = in_array( - $_REQUEST['item_original_type'], + $_POST['item_original_type'], array('PROCEDURE', 'FUNCTION') ); if (!$isProcOrFunc) { $errors[] = sprintf( __('Invalid routine type: "%s"'), - htmlspecialchars($_REQUEST['item_original_type']) + htmlspecialchars($_POST['item_original_type']) ); } else { // Backup the old routine, in case something goes wrong $create_routine = $GLOBALS['dbi']->getDefinition( $db, - $_REQUEST['item_original_type'], - $_REQUEST['item_original_name'] + $_POST['item_original_type'], + $_POST['item_original_name'] ); $privilegesBackup = self::backupPrivileges(); - $drop_routine = "DROP {$_REQUEST['item_original_type']} " - . Util::backquote($_REQUEST['item_original_name']) + $drop_routine = "DROP {$_POST['item_original_type']} " + . Util::backquote($_POST['item_original_name']) . ";\n"; $result = $GLOBALS['dbi']->tryQuery($drop_routine); if (!$result) { @@ -274,7 +274,7 @@ class Routines __('Routine %1$s has been created.') ); $message->addParam( - Util::backquote($_REQUEST['item_name']) + Util::backquote($_POST['item_name']) ); $sql_query = $routine_query; } @@ -309,14 +309,14 @@ class Routines $routines = $GLOBALS['dbi']->getRoutines( $db, - $_REQUEST['item_type'], - $_REQUEST['item_name'] + $_POST['item_type'], + $_POST['item_name'] ); $routine = $routines[0]; $response->addJSON( 'name', htmlspecialchars( - mb_strtoupper($_REQUEST['item_name']) + mb_strtoupper($_POST['item_name']) ) ); $response->addJSON('new_row', RteList::getRoutineRow($routine)); @@ -337,9 +337,9 @@ class Routines } // Backup the Old Privileges before dropping - // if $_REQUEST['item_adjust_privileges'] set - if (! isset($_REQUEST['item_adjust_privileges']) - || empty($_REQUEST['item_adjust_privileges']) + // if $_POST['item_adjust_privileges'] set + if (! isset($_POST['item_adjust_privileges']) + || empty($_POST['item_adjust_privileges']) ) { return array(); } @@ -348,8 +348,8 @@ class Routines 'mysql' ) . '.' . Util::backquote('procs_priv') - . ' where Routine_name = "' . $_REQUEST['item_original_name'] - . '" AND Routine_type = "' . $_REQUEST['item_original_type'] + . ' where Routine_name = "' . $_POST['item_original_name'] + . '" AND Routine_type = "' . $_POST['item_original_type'] . '";'; $privilegesBackup = $GLOBALS['dbi']->fetchResult( @@ -414,8 +414,8 @@ class Routines . Util::backquote('procs_priv') . ' VALUES("' . $priv[0] . '", "' . $priv[1] . '", "' . $priv[2] . '", "' - . $_REQUEST['item_name'] . '", "' - . $_REQUEST['item_type'] . '", "' + . $_POST['item_name'] . '", "' + . $_POST['item_type'] . '", "' . $priv[5] . '", "' . $priv[6] . '", "' . $priv[7] . '");'; @@ -455,7 +455,7 @@ class Routines ); } $message->addParam( - Util::backquote($_REQUEST['item_name']) + Util::backquote($_POST['item_name']) ); return $message; @@ -483,7 +483,7 @@ class Routines 'item_comment', 'item_definer'); foreach ($indices as $index) { - $retval[$index] = isset($_REQUEST[$index]) ? $_REQUEST[$index] : ''; + $retval[$index] = isset($_POST[$index]) ? $_POST[$index] : ''; } $retval['item_type'] = 'PROCEDURE'; @@ -493,8 +493,8 @@ class Routines $retval['item_type_toggle'] = 'PROCEDURE'; } $retval['item_original_type'] = 'PROCEDURE'; - if (isset($_REQUEST['item_original_type']) - && $_REQUEST['item_original_type'] == 'FUNCTION' + if (isset($_POST['item_original_type']) + && $_POST['item_original_type'] == 'FUNCTION' ) { $retval['item_original_type'] = 'FUNCTION'; } @@ -505,35 +505,35 @@ class Routines $retval['item_param_length'] = array(); $retval['item_param_opts_num'] = array(); $retval['item_param_opts_text'] = array(); - if (isset($_REQUEST['item_param_name']) - && isset($_REQUEST['item_param_type']) - && isset($_REQUEST['item_param_length']) - && isset($_REQUEST['item_param_opts_num']) - && isset($_REQUEST['item_param_opts_text']) - && is_array($_REQUEST['item_param_name']) - && is_array($_REQUEST['item_param_type']) - && is_array($_REQUEST['item_param_length']) - && is_array($_REQUEST['item_param_opts_num']) - && is_array($_REQUEST['item_param_opts_text']) + if (isset($_POST['item_param_name']) + && isset($_POST['item_param_type']) + && isset($_POST['item_param_length']) + && isset($_POST['item_param_opts_num']) + && isset($_POST['item_param_opts_text']) + && is_array($_POST['item_param_name']) + && is_array($_POST['item_param_type']) + && is_array($_POST['item_param_length']) + && is_array($_POST['item_param_opts_num']) + && is_array($_POST['item_param_opts_text']) ) { - if ($_REQUEST['item_type'] == 'PROCEDURE') { - $retval['item_param_dir'] = $_REQUEST['item_param_dir']; + if ($_POST['item_type'] == 'PROCEDURE') { + $retval['item_param_dir'] = $_POST['item_param_dir']; foreach ($retval['item_param_dir'] as $key => $value) { if (! in_array($value, $param_directions, true)) { $retval['item_param_dir'][$key] = ''; } } } - $retval['item_param_name'] = $_REQUEST['item_param_name']; - $retval['item_param_type'] = $_REQUEST['item_param_type']; + $retval['item_param_name'] = $_POST['item_param_name']; + $retval['item_param_type'] = $_POST['item_param_type']; foreach ($retval['item_param_type'] as $key => $value) { if (! in_array($value, Util::getSupportedDatatypes(), true)) { $retval['item_param_type'][$key] = ''; } } - $retval['item_param_length'] = $_REQUEST['item_param_length']; - $retval['item_param_opts_num'] = $_REQUEST['item_param_opts_num']; - $retval['item_param_opts_text'] = $_REQUEST['item_param_opts_text']; + $retval['item_param_length'] = $_POST['item_param_length']; + $retval['item_param_opts_num'] = $_POST['item_param_opts_num']; + $retval['item_param_opts_text'] = $_POST['item_param_opts_text']; $retval['item_num_params'] = max( count($retval['item_param_name']), count($retval['item_param_type']), @@ -543,32 +543,32 @@ class Routines ); } $retval['item_returntype'] = ''; - if (isset($_REQUEST['item_returntype']) - && in_array($_REQUEST['item_returntype'], Util::getSupportedDatatypes()) + if (isset($_POST['item_returntype']) + && in_array($_POST['item_returntype'], Util::getSupportedDatatypes()) ) { - $retval['item_returntype'] = $_REQUEST['item_returntype']; + $retval['item_returntype'] = $_POST['item_returntype']; } $retval['item_isdeterministic'] = ''; - if (isset($_REQUEST['item_isdeterministic']) - && mb_strtolower($_REQUEST['item_isdeterministic']) == 'on' + if (isset($_POST['item_isdeterministic']) + && mb_strtolower($_POST['item_isdeterministic']) == 'on' ) { $retval['item_isdeterministic'] = " checked='checked'"; } $retval['item_securitytype_definer'] = ''; $retval['item_securitytype_invoker'] = ''; - if (isset($_REQUEST['item_securitytype'])) { - if ($_REQUEST['item_securitytype'] === 'DEFINER') { + if (isset($_POST['item_securitytype'])) { + if ($_POST['item_securitytype'] === 'DEFINER') { $retval['item_securitytype_definer'] = " selected='selected'"; - } elseif ($_REQUEST['item_securitytype'] === 'INVOKER') { + } elseif ($_POST['item_securitytype'] === 'INVOKER') { $retval['item_securitytype_invoker'] = " selected='selected'"; } } $retval['item_sqldataaccess'] = ''; - if (isset($_REQUEST['item_sqldataaccess']) - && in_array($_REQUEST['item_sqldataaccess'], $param_sqldataaccess, true) + if (isset($_POST['item_sqldataaccess']) + && in_array($_POST['item_sqldataaccess'], $param_sqldataaccess, true) ) { - $retval['item_sqldataaccess'] = $_REQUEST['item_sqldataaccess']; + $retval['item_sqldataaccess'] = $_POST['item_sqldataaccess']; } return $retval; @@ -1099,13 +1099,13 @@ class Routines { global $_REQUEST, $errors, $param_sqldataaccess, $param_directions, $dbi; - $_REQUEST['item_type'] = isset($_REQUEST['item_type']) - ? $_REQUEST['item_type'] : ''; + $_POST['item_type'] = isset($_POST['item_type']) + ? $_POST['item_type'] : ''; $query = 'CREATE '; - if (! empty($_REQUEST['item_definer'])) { - if (mb_strpos($_REQUEST['item_definer'], '@') !== false) { - $arr = explode('@', $_REQUEST['item_definer']); + if (! empty($_POST['item_definer'])) { + if (mb_strpos($_POST['item_definer'], '@') !== false) { + $arr = explode('@', $_POST['item_definer']); $do_backquote = true; if (substr($arr[0], 0, 1) === "`" @@ -1126,18 +1126,18 @@ class Routines $errors[] = __('The definer must be in the "username@hostname" format!'); } } - if ($_REQUEST['item_type'] == 'FUNCTION' - || $_REQUEST['item_type'] == 'PROCEDURE' + if ($_POST['item_type'] == 'FUNCTION' + || $_POST['item_type'] == 'PROCEDURE' ) { - $query .= $_REQUEST['item_type'] . ' '; + $query .= $_POST['item_type'] . ' '; } else { $errors[] = sprintf( __('Invalid routine type: "%s"'), - htmlspecialchars($_REQUEST['item_type']) + htmlspecialchars($_POST['item_type']) ); } - if (! empty($_REQUEST['item_name'])) { - $query .= Util::backquote($_REQUEST['item_name']); + if (! empty($_POST['item_name'])) { + $query .= Util::backquote($_POST['item_name']); } else { $errors[] = __('You must provide a routine name!'); } @@ -1145,36 +1145,36 @@ class Routines $warned_about_dir = false; $warned_about_length = false; - if (! empty($_REQUEST['item_param_name']) - && ! empty($_REQUEST['item_param_type']) - && ! empty($_REQUEST['item_param_length']) - && is_array($_REQUEST['item_param_name']) - && is_array($_REQUEST['item_param_type']) - && is_array($_REQUEST['item_param_length']) + if (! empty($_POST['item_param_name']) + && ! empty($_POST['item_param_type']) + && ! empty($_POST['item_param_length']) + && is_array($_POST['item_param_name']) + && is_array($_POST['item_param_type']) + && is_array($_POST['item_param_length']) ) { - $item_param_name = $_REQUEST['item_param_name']; - $item_param_type = $_REQUEST['item_param_type']; - $item_param_length = $_REQUEST['item_param_length']; + $item_param_name = $_POST['item_param_name']; + $item_param_type = $_POST['item_param_type']; + $item_param_length = $_POST['item_param_length']; for ($i=0, $nb = count($item_param_name); $i < $nb; $i++) { if (! empty($item_param_name[$i]) && ! empty($item_param_type[$i]) ) { - if ($_REQUEST['item_type'] == 'PROCEDURE' - && ! empty($_REQUEST['item_param_dir'][$i]) - && in_array($_REQUEST['item_param_dir'][$i], $param_directions) + if ($_POST['item_type'] == 'PROCEDURE' + && ! empty($_POST['item_param_dir'][$i]) + && in_array($_POST['item_param_dir'][$i], $param_directions) ) { - $params .= $_REQUEST['item_param_dir'][$i] . " " + $params .= $_POST['item_param_dir'][$i] . " " . Util::backquote($item_param_name[$i]) . " " . $item_param_type[$i]; - } elseif ($_REQUEST['item_type'] == 'FUNCTION') { + } elseif ($_POST['item_type'] == 'FUNCTION') { $params .= Util::backquote($item_param_name[$i]) . " " . $item_param_type[$i]; } elseif (! $warned_about_dir) { $warned_about_dir = true; $errors[] = sprintf( __('Invalid direction "%s" given for parameter.'), - htmlspecialchars($_REQUEST['item_param_dir'][$i]) + htmlspecialchars($_POST['item_param_dir'][$i]) ); } if ($item_param_length[$i] != '' @@ -1200,21 +1200,21 @@ class Routines ); } } - if (! empty($_REQUEST['item_param_opts_text'][$i])) { + if (! empty($_POST['item_param_opts_text'][$i])) { if ($dbi->types->getTypeClass($item_param_type[$i]) == 'CHAR') { if(! in_array($item_param_type[$i], array('VARBINARY', 'BINARY'))) { $params .= ' CHARSET ' . mb_strtolower( - $_REQUEST['item_param_opts_text'][$i] + $_POST['item_param_opts_text'][$i] ); } } } - if (! empty($_REQUEST['item_param_opts_num'][$i])) { + if (! empty($_POST['item_param_opts_num'][$i])) { if ($dbi->types->getTypeClass($item_param_type[$i]) == 'NUMBER') { $params .= ' ' . mb_strtoupper( - $_REQUEST['item_param_opts_num'][$i] + $_POST['item_param_opts_num'][$i] ); } } @@ -1230,9 +1230,9 @@ class Routines } } $query .= "(" . $params . ") "; - if ($_REQUEST['item_type'] == 'FUNCTION') { - $item_returntype = isset($_REQUEST['item_returntype']) - ? $_REQUEST['item_returntype'] + if ($_POST['item_type'] == 'FUNCTION') { + $item_returntype = isset($_POST['item_returntype']) + ? $_POST['item_returntype'] : null; if (! empty($item_returntype) @@ -1244,15 +1244,15 @@ class Routines } else { $errors[] = __('You must provide a valid return type for the routine.'); } - if (! empty($_REQUEST['item_returnlength']) + if (! empty($_POST['item_returnlength']) && !preg_match( '@^(DATE|DATETIME|TIME|TINYBLOB|TINYTEXT|BLOB|TEXT|' . 'MEDIUMBLOB|MEDIUMTEXT|LONGBLOB|LONGTEXT|SERIAL|BOOLEAN)$@i', $item_returntype ) ) { - $query .= "(" . $_REQUEST['item_returnlength'] . ")"; - } elseif (empty($_REQUEST['item_returnlength']) + $query .= "(" . $_POST['item_returnlength'] . ")"; + } elseif (empty($_POST['item_returnlength']) && preg_match( '@^(ENUM|SET|VARCHAR|VARBINARY)$@i', $item_returntype ) @@ -1264,43 +1264,43 @@ class Routines ); } } - if (! empty($_REQUEST['item_returnopts_text'])) { + if (! empty($_POST['item_returnopts_text'])) { if ($dbi->types->getTypeClass($item_returntype) == 'CHAR') { $query .= ' CHARSET ' - . mb_strtolower($_REQUEST['item_returnopts_text']); + . mb_strtolower($_POST['item_returnopts_text']); } } - if (! empty($_REQUEST['item_returnopts_num'])) { + if (! empty($_POST['item_returnopts_num'])) { if ($dbi->types->getTypeClass($item_returntype) == 'NUMBER') { $query .= ' ' - . mb_strtoupper($_REQUEST['item_returnopts_num']); + . mb_strtoupper($_POST['item_returnopts_num']); } } $query .= ' '; } - if (! empty($_REQUEST['item_comment'])) { - $query .= "COMMENT '" . $GLOBALS['dbi']->escapeString($_REQUEST['item_comment']) + if (! empty($_POST['item_comment'])) { + $query .= "COMMENT '" . $GLOBALS['dbi']->escapeString($_POST['item_comment']) . "' "; } - if (isset($_REQUEST['item_isdeterministic'])) { + if (isset($_POST['item_isdeterministic'])) { $query .= 'DETERMINISTIC '; } else { $query .= 'NOT DETERMINISTIC '; } - if (! empty($_REQUEST['item_sqldataaccess']) - && in_array($_REQUEST['item_sqldataaccess'], $param_sqldataaccess) + if (! empty($_POST['item_sqldataaccess']) + && in_array($_POST['item_sqldataaccess'], $param_sqldataaccess) ) { - $query .= $_REQUEST['item_sqldataaccess'] . ' '; + $query .= $_POST['item_sqldataaccess'] . ' '; } - if (! empty($_REQUEST['item_securitytype'])) { - if ($_REQUEST['item_securitytype'] == 'DEFINER' - || $_REQUEST['item_securitytype'] == 'INVOKER' + if (! empty($_POST['item_securitytype'])) { + if ($_POST['item_securitytype'] == 'DEFINER' + || $_POST['item_securitytype'] == 'INVOKER' ) { - $query .= 'SQL SECURITY ' . $_REQUEST['item_securitytype'] . ' '; + $query .= 'SQL SECURITY ' . $_POST['item_securitytype'] . ' '; } } - if (! empty($_REQUEST['item_definition'])) { - $query .= $_REQUEST['item_definition']; + if (! empty($_POST['item_definition'])) { + $query .= $_POST['item_definition']; } else { $errors[] = __('You must provide a routine definition.'); } @@ -1322,16 +1322,16 @@ class Routines /** * Handle all user requests other than the default of listing routines */ - if (! empty($_REQUEST['execute_routine']) && ! empty($_REQUEST['item_name'])) { + if (! empty($_POST['execute_routine']) && ! empty($_POST['item_name'])) { // Build the queries $routine = self::getDataFromName( - $_REQUEST['item_name'], $_REQUEST['item_type'], false + $_POST['item_name'], $_POST['item_type'], false ); if ($routine === false) { $message = __('Error in processing request:') . ' '; $message .= sprintf( Words::get('not_found'), - htmlspecialchars(Util::backquote($_REQUEST['item_name'])), + htmlspecialchars(Util::backquote($_POST['item_name'])), htmlspecialchars(Util::backquote($db)) ); $message = Message::error($message); @@ -1350,20 +1350,20 @@ class Routines $args = array(); $all_functions = $GLOBALS['dbi']->types->getAllFunctions(); for ($i = 0; $i < $routine['item_num_params']; $i++) { - if (isset($_REQUEST['params'][$routine['item_param_name'][$i]])) { - $value = $_REQUEST['params'][$routine['item_param_name'][$i]]; + if (isset($_POST['params'][$routine['item_param_name'][$i]])) { + $value = $_POST['params'][$routine['item_param_name'][$i]]; if (is_array($value)) { // is SET type $value = implode(',', $value); } $value = $GLOBALS['dbi']->escapeString($value); - if (! empty($_REQUEST['funcs'][$routine['item_param_name'][$i]]) + if (! empty($_POST['funcs'][$routine['item_param_name'][$i]]) && in_array( - $_REQUEST['funcs'][$routine['item_param_name'][$i]], + $_POST['funcs'][$routine['item_param_name'][$i]], $all_functions ) ) { $queries[] = "SET @p$i=" - . $_REQUEST['funcs'][$routine['item_param_name'][$i]] + . $_POST['funcs'][$routine['item_param_name'][$i]] . "('$value');\n"; } else { $queries[] = "SET @p$i='$value';\n"; @@ -1541,7 +1541,7 @@ class Routines $message = __('Error in processing request:') . ' '; $message .= sprintf( Words::get('not_found'), - htmlspecialchars(Util::backquote($_REQUEST['item_name'])), + htmlspecialchars(Util::backquote($_GET['item_name'])), htmlspecialchars(Util::backquote($db)) ); $message = Message::error($message); From 3ac68d2edaafea38c3c45e364933456540603c09 Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Sun, 15 Jul 2018 22:20:43 +1000 Subject: [PATCH 06/49] Fix routines tests Signed-off-by: Madhura Jayaratne --- test/classes/Rte/RoutinesTest.php | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/test/classes/Rte/RoutinesTest.php b/test/classes/Rte/RoutinesTest.php index f624ef50a5..4e304746d1 100644 --- a/test/classes/Rte/RoutinesTest.php +++ b/test/classes/Rte/RoutinesTest.php @@ -62,12 +62,12 @@ class RoutinesTest extends TestCase */ public function testGetDataFromRequest($in, $out) { - global $_REQUEST; + global $_POST; - unset($_REQUEST); + unset($_POST); foreach ($in as $key => $value) { if ($value !== '') { - $_REQUEST[$key] = $value; + $_POST[$key] = $value; } } Routines::setGlobals(); @@ -1100,7 +1100,7 @@ class RoutinesTest extends TestCase */ public function testGetQueryFromRequest($request, $query, $num_err) { - global $_REQUEST, $errors, $cfg; + global $_POST, $errors, $cfg; $cfg['ShowFunctionFields'] = false; @@ -1125,8 +1125,8 @@ class RoutinesTest extends TestCase ); $GLOBALS['dbi'] = $dbi; - unset($_REQUEST); - $_REQUEST = $request; + unset($_POST); + $_POST = $request; $this->assertEquals($query, Routines::getQueryFromRequest()); $this->assertCount($num_err, $errors); From 98ef759676cfc60db56aff657d5f66f818780872 Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Mon, 16 Jul 2018 10:31:26 +1000 Subject: [PATCH 07/49] Parameter item_type should be read from $_REQUEST as it can be in both $_POST and $_GET Signed-off-by: Madhura Jayaratne --- test/classes/Rte/RoutinesTest.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/test/classes/Rte/RoutinesTest.php b/test/classes/Rte/RoutinesTest.php index 4e304746d1..27484c19ef 100644 --- a/test/classes/Rte/RoutinesTest.php +++ b/test/classes/Rte/RoutinesTest.php @@ -64,10 +64,11 @@ class RoutinesTest extends TestCase { global $_POST; - unset($_POST); + unset($_POST); unset($_REQUEST); foreach ($in as $key => $value) { if ($value !== '') { $_POST[$key] = $value; + $_REQUEST[$key] = $value; } } Routines::setGlobals(); From 77ea7024bfa75659dea20dacb225f0d48414fd02 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maur=C3=ADcio=20Meneghini=20Fauth?= Date: Sat, 14 Jul 2018 14:21:30 -0300 Subject: [PATCH 08/49] Retrieve parameters from $_POST in central columns page MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Maurício Meneghini Fauth --- db_central_columns.php | 16 ++++++++-------- js/db_central_columns.js | 4 ++-- libraries/classes/CentralColumns.php | 6 +++--- test/classes/CentralColumnsTest.php | 8 ++++---- 4 files changed, 17 insertions(+), 17 deletions(-) diff --git a/db_central_columns.php b/db_central_columns.php index 0f92d3ab0c..6eebb40a0a 100644 --- a/db_central_columns.php +++ b/db_central_columns.php @@ -84,9 +84,9 @@ $pmadb = $cfgCentralColumns['db']; $pmatable = $cfgCentralColumns['table']; $max_rows = intval($GLOBALS['cfg']['MaxRows']); -if (isset($_REQUEST['edit_central_columns_page'])) { - $selected_fld = $_REQUEST['selected_fld']; - $selected_db = $_REQUEST['db']; +if (isset($_POST['edit_central_columns_page'])) { + $selected_fld = $_POST['selected_fld']; + $selected_db = $_POST['db']; $edit_central_column_page = $centralColumns->getHtmlForEditingPage( $selected_fld, $selected_db @@ -109,15 +109,15 @@ if (isset($_POST['delete_save'])) { false ); } -if (!empty($_REQUEST['total_rows']) - && Core::isValid($_REQUEST['total_rows'], 'integer') +if (!empty($_POST['total_rows']) + && Core::isValid($_POST['total_rows'], 'integer') ) { - $total_rows = $_REQUEST['total_rows']; + $total_rows = $_POST['total_rows']; } else { $total_rows = $centralColumns->getCount($db); } -if (Core::isValid($_REQUEST['pos'], 'integer')) { - $pos = intval($_REQUEST['pos']); +if (Core::isValid($_POST['pos'], 'integer')) { + $pos = intval($_POST['pos']); } else { $pos = 0; } diff --git a/js/db_central_columns.js b/js/db_central_columns.js index 88b0ce78ac..f6e4477913 100644 --- a/js/db_central_columns.js +++ b/js/db_central_columns.js @@ -65,10 +65,10 @@ AJAX.registerOnload('db_central_columns.js', function () { return false; } var argsep = PMA_commonParams.get('arg_separator'); - var editColumnData = editColumnList + '' + argsep + 'edit_central_columns_page=true' + argsep + 'ajax_request=true' + argsep + 'ajax_page_request=true' + argsep + 'db=' + PMA_commonParams.get('db'); + var editColumnData = editColumnList + '' + argsep + 'edit_central_columns_page=true' + argsep + 'ajax_request=true' + argsep + 'ajax_page_request=true' + argsep + 'db=' + encodeURIComponent(PMA_commonParams.get('db')); PMA_ajaxShowMessage(); AJAX.source = $(this); - $.get('db_central_columns.php', editColumnData, AJAX.responseHandler); + $.post('db_central_columns.php', editColumnData, AJAX.responseHandler); }); $('#multi_edit_central_columns').submit(function (event) { event.preventDefault(); diff --git a/libraries/classes/CentralColumns.php b/libraries/classes/CentralColumns.php index 555195c95d..7379cee484 100644 --- a/libraries/classes/CentralColumns.php +++ b/libraries/classes/CentralColumns.php @@ -299,7 +299,7 @@ class CentralColumns if (empty($cfgCentralColumns)) { return $this->configErrorMessage(); } - $db = $_REQUEST['db']; + $db = $_POST['db']; $pmadb = $cfgCentralColumns['db']; $central_list_table = $cfgCentralColumns['table']; $this->dbi->selectDb($db); @@ -333,7 +333,7 @@ class CentralColumns } } else { if ($table === null) { - $table = $_REQUEST['table']; + $table = $_POST['table']; } foreach ($field_select as $column) { $cols .= "'" . $this->dbi->escapeString($column) . "',"; @@ -406,7 +406,7 @@ class CentralColumns if (empty($cfgCentralColumns)) { return $this->configErrorMessage(); } - $db = $_REQUEST['db']; + $db = $_POST['db']; $pmadb = $cfgCentralColumns['db']; $central_list_table = $cfgCentralColumns['table']; $this->dbi->selectDb($db); diff --git a/test/classes/CentralColumnsTest.php b/test/classes/CentralColumnsTest.php index 8640c2cd11..9294ea5c9c 100644 --- a/test/classes/CentralColumnsTest.php +++ b/test/classes/CentralColumnsTest.php @@ -227,8 +227,8 @@ class CentralColumnsTest extends TestCase */ public function testSyncUniqueColumns() { - $_REQUEST['db'] = 'PMA_db'; - $_REQUEST['table'] = 'PMA_table'; + $_POST['db'] = 'PMA_db'; + $_POST['table'] = 'PMA_table'; $this->assertTrue( $this->centralColumns->syncUniqueColumns( @@ -244,8 +244,8 @@ class CentralColumnsTest extends TestCase */ public function testDeleteColumnsFromList() { - $_REQUEST['db'] = 'PMA_db'; - $_REQUEST['table'] = 'PMA_table'; + $_POST['db'] = 'PMA_db'; + $_POST['table'] = 'PMA_table'; // when column exists in the central column list $GLOBALS['dbi']->expects($this->at(4)) From ad7f7fd80192bd9f7f22f4d8d9a8818dd69f3e0c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maur=C3=ADcio=20Meneghini=20Fauth?= Date: Sat, 14 Jul 2018 17:24:25 -0300 Subject: [PATCH 09/49] Retrieve parameters from $_POST in tracking pages MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Maurício Meneghini Fauth --- db_tracking.php | 30 ++-- js/db_tracking.js | 7 +- js/tbl_tracking.js | 14 +- libraries/classes/Tracking.php | 168 ++++++++---------- tbl_tracking.php | 79 ++++---- .../database/tracking/tracked_tables.twig | 44 +++-- templates/table/tracking/report_table.twig | 2 +- test/classes/TrackingTest.php | 75 ++++---- 8 files changed, 210 insertions(+), 209 deletions(-) diff --git a/db_tracking.php b/db_tracking.php index 0c8724d60a..49e4048025 100644 --- a/db_tracking.php +++ b/db_tracking.php @@ -30,6 +30,8 @@ $scripts->addFile('db_tracking.js'); */ require 'libraries/db_common.inc.php'; $url_query .= '&goto=tbl_tracking.php&back=db_tracking.php'; +$url_params['goto'] = 'tbl_tracking.php'; +$url_params['back'] = 'db_tracking.php'; // Get the database structure $sub_part = '_structure'; @@ -46,47 +48,45 @@ list( $pos ) = Util::getDbInfo($db, isset($sub_part) ? $sub_part : ''); -// Work to do? -// (here, do not use $_REQUEST['db] as it can be crafted) -if (isset($_REQUEST['delete_tracking']) && isset($_REQUEST['table'])) { +if (isset($_POST['delete_tracking']) && isset($_POST['table'])) { - Tracker::deleteTracking($GLOBALS['db'], $_REQUEST['table']); + Tracker::deleteTracking($GLOBALS['db'], $_POST['table']); Message::success( __('Tracking data deleted successfully.') )->display(); -} elseif (isset($_REQUEST['submit_create_version'])) { +} elseif (isset($_POST['submit_create_version'])) { - Tracking::createTrackingForMultipleTables($_REQUEST['selected']); + Tracking::createTrackingForMultipleTables($_POST['selected']); Message::success( sprintf( __( 'Version %1$s was created for selected tables,' . ' tracking is active for them.' ), - htmlspecialchars($_REQUEST['version']) + htmlspecialchars($_POST['version']) ) )->display(); -} elseif (isset($_REQUEST['submit_mult'])) { +} elseif (isset($_POST['submit_mult'])) { - if (! empty($_REQUEST['selected_tbl'])) { - if ($_REQUEST['submit_mult'] == 'delete_tracking') { + if (! empty($_POST['selected_tbl'])) { + if ($_POST['submit_mult'] == 'delete_tracking') { - foreach ($_REQUEST['selected_tbl'] as $table) { + foreach ($_POST['selected_tbl'] as $table) { Tracker::deleteTracking($GLOBALS['db'], $table); } Message::success( __('Tracking data deleted successfully.') )->display(); - } elseif ($_REQUEST['submit_mult'] == 'track') { + } elseif ($_POST['submit_mult'] == 'track') { echo Tracking::getHtmlForDataDefinitionAndManipulationStatements( 'db_tracking.php' . $url_query, 0, $GLOBALS['db'], - $_REQUEST['selected_tbl'] + $_POST['selected_tbl'] ); exit; } @@ -98,7 +98,7 @@ if (isset($_REQUEST['delete_tracking']) && isset($_REQUEST['table'])) { } // Get tracked data about the database -$data = Tracker::getTrackedData($_REQUEST['db'], '', '1'); +$data = Tracker::getTrackedData($GLOBALS['db'], '', '1'); // No tables present and no log exist if ($num_tables == 0 && count($data['ddlog']) == 0) { @@ -118,7 +118,7 @@ $cfgRelation = $relation->getRelationsParam(); $all_tables_query = ' SELECT table_name, MAX(version) as version FROM ' . Util::backquote($cfgRelation['db']) . '.' . Util::backquote($cfgRelation['tracking']) . - ' WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($_REQUEST['db']) . + ' WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($GLOBALS['db']) . '\' ' . ' GROUP BY table_name' . ' ORDER BY table_name ASC'; diff --git a/js/db_tracking.js b/js/db_tracking.js index 36b8ae3e2e..ce2febab9c 100644 --- a/js/db_tracking.js +++ b/js/db_tracking.js @@ -84,10 +84,9 @@ AJAX.registerOnload('db_tracking.js', function () { $anchor.PMA_confirm(question, $anchor.attr('href'), function (url) { PMA_ajaxShowMessage(PMA_messages.strDeletingTrackingData); AJAX.source = $anchor; - var params = { - 'ajax_page_request': true, - 'ajax_request': true - }; + var argSep = PMA_commonParams.get('arg_separator'); + var params = getJSConfirmCommonParam(this, $anchor.getPostData()); + params += argSep + 'ajax_page_request=1'; $.post(url, params, AJAX.responseHandler); }); }); diff --git a/js/tbl_tracking.js b/js/tbl_tracking.js index 9415f37a66..cd08957302 100644 --- a/js/tbl_tracking.js +++ b/js/tbl_tracking.js @@ -80,10 +80,9 @@ AJAX.registerOnload('tbl_tracking.js', function () { $anchor.PMA_confirm(question, $anchor.attr('href'), function (url) { PMA_ajaxShowMessage(); AJAX.source = $anchor; - var params = { - 'ajax_page_request': true, - 'ajax_request': true - }; + var argSep = PMA_commonParams.get('arg_separator'); + var params = getJSConfirmCommonParam(this, $anchor.getPostData()); + params += argSep + 'ajax_page_request=1'; $.post(url, params, AJAX.responseHandler); }); }); @@ -98,10 +97,9 @@ AJAX.registerOnload('tbl_tracking.js', function () { $anchor.PMA_confirm(question, $anchor.attr('href'), function (url) { PMA_ajaxShowMessage(); AJAX.source = $anchor; - var params = { - 'ajax_page_request': true, - 'ajax_request': true - }; + var argSep = PMA_commonParams.get('arg_separator'); + var params = getJSConfirmCommonParam(this, $anchor.getPostData()); + params += argSep + 'ajax_page_request=1'; $.post(url, params, AJAX.responseHandler); }); }); diff --git a/libraries/classes/Tracking.php b/libraries/classes/Tracking.php index f3cbced58b..d4ff875d82 100644 --- a/libraries/classes/Tracking.php +++ b/libraries/classes/Tracking.php @@ -122,10 +122,10 @@ class Tracking $sql_query = " SELECT * FROM " . Util::backquote($cfgRelation['db']) . "." . Util::backquote($cfgRelation['tracking']) . - " WHERE db_name = '" . $GLOBALS['dbi']->escapeString($_REQUEST['db']) . + " WHERE db_name = '" . $GLOBALS['dbi']->escapeString($GLOBALS['db']) . "' " . " AND table_name = '" . - $GLOBALS['dbi']->escapeString($_REQUEST['table']) . "' " . + $GLOBALS['dbi']->escapeString($GLOBALS['table']) . "' " . " ORDER BY version DESC "; return $relation->queryAsControlUser($sql_query); @@ -179,9 +179,6 @@ class Tracking $tracking_active = false; } } - $delete_link = 'tbl_tracking.php' . $url_query . '&version=' - . htmlspecialchars($version['version']) - . '&submit_delete_version=true'; $checkbox_id = 'selected_versions_' . htmlspecialchars($version['version']); $html .= ''; @@ -198,21 +195,24 @@ class Tracking $html .= '' . htmlspecialchars($version['date_updated']) . ''; $html .= '' . self::getVersionStatus($version) . ''; $html .= '' . $delete . ''; - $html .= '' . $delete . ''; + $html .= '' . $report . ''; $html .= '  '; - $html .= '' . $structure . ''; $html .= ''; $html .= ''; @@ -308,7 +308,7 @@ class Tracking 'db' => $GLOBALS['db'], 'table' => $GLOBALS['table'], 'entries' => $entries, - 'selected_table' => isset($_REQUEST['table']) ? $_REQUEST['table'] : null, + 'selected_table' => isset($_POST['table']) ? $_POST['table'] : null, ]); } @@ -401,11 +401,11 @@ class Tracking . __('Structure and data') . '' . ''; $str2 = ''; + . htmlspecialchars($_POST['date_from']) . '" size="19" />'; $str3 = ''; + . htmlspecialchars($_POST['date_to']) . '" size="19" />'; $str4 = ''; + . htmlspecialchars($_POST['users']) . '" />'; $str5 = '' . ''; return array($str1, $str2, $str3, $str4, $str5); @@ -438,14 +438,11 @@ class Tracking ) { $ddlog_count = 0; - $html = ''; - $html .= Url::getHiddenInputs(); + $html = ''; + $html .= Url::getHiddenInputs($url_params + [ + 'report' => 'true', + 'version' => $_POST['version'], + ]); $html .= sprintf( __('Show %1$s with dates from %2$s to %3$s by user %4$s %5$s'), @@ -489,35 +486,28 @@ class Tracking public static function getHtmlForTrackingReportExportForm2( array $url_params, $str1, $str2, $str3, $str4, $str5 ) { - $html = ''; - $html .= Url::getHiddenInputs(); + $html = ''; + $html .= Url::getHiddenInputs($url_params + [ + 'report' => 'true', + 'version' => $_POST['version'], + ]); + $html .= sprintf( __('Show %1$s with dates from %2$s to %3$s by user %4$s %5$s'), $str1, $str2, $str3, $str4, $str5 ); $html .= ''; - $html .= '
'; - $html .= Url::getHiddenInputs(); - $html .= ''; - $html .= ''; - $html .= ''; - $html .= ''; + $html .= ''; + $html .= Url::getHiddenInputs($url_params + [ + 'report' => 'true', + 'version' => $_POST['version'], + 'logtype' => $_POST['logtype'], + 'date_from' => $_POST['date_from'], + 'date_to' => $_POST['date_to'], + 'users' => $_POST['users'], + 'report_export' => 'true', + ]); $str_export1 = ''; - $str_export2 = '' - . ''; + $str_export2 = ''; $html .= "
" . sprintf(__('Export as %s'), $str_export1) . $str_export2 . "
"; @@ -630,9 +619,9 @@ class Tracking $deleteParam = 'delete_' . $whichLog; $entry['url_params'] = Url::getCommon($urlParams + [ 'report' => 'true', - 'version' => $_REQUEST['version'], + 'version' => $_POST['version'], $deleteParam => ($lineNumber - $offset), - ]); + ], ''); $entry['line_number'] = $lineNumber; $entries[] = $entry; } @@ -662,7 +651,7 @@ class Tracking . ' [' . __('Close') . ']'; $data = Tracker::getTrackedData( - $_REQUEST['db'], $_REQUEST['table'], $_REQUEST['version'] + $_POST['db'], $_POST['table'], $_POST['version'] ); // Get first DROP TABLE/VIEW and CREATE TABLE/VIEW statements @@ -677,7 +666,7 @@ class Tracking $html .= Util::getMessage( sprintf( __('Version %s snapshot (SQL code)'), - htmlspecialchars($_REQUEST['version']) + htmlspecialchars($_POST['version']) ), $drop_create_statements ); @@ -737,7 +726,7 @@ class Tracking public static function deleteTrackingReportRows(array &$data) { $html = ''; - if (isset($_REQUEST['delete_ddlog'])) { + if (isset($_POST['delete_ddlog'])) { // Delete ddlog row data $html .= self::deleteFromTrackingReportLog( $data, @@ -747,7 +736,7 @@ class Tracking ); } - if (isset($_REQUEST['delete_dmlog'])) { + if (isset($_POST['delete_dmlog'])) { // Delete dmlog row data $html .= self::deleteFromTrackingReportLog( $data, @@ -772,16 +761,16 @@ class Tracking public static function deleteFromTrackingReportLog(array &$data, $which_log, $type, $message) { $html = ''; - $delete_id = $_REQUEST['delete_' . $which_log]; + $delete_id = $_POST['delete_' . $which_log]; // Only in case of valid id if ($delete_id == (int)$delete_id) { unset($data[$which_log][$delete_id]); $successfullyDeleted = Tracker::changeTrackingData( - $_REQUEST['db'], - $_REQUEST['table'], - $_REQUEST['version'], + $GLOBALS['db'], + $GLOBALS['table'], + $_POST['version'], $type, $data[$which_log] ); @@ -867,7 +856,7 @@ class Tracking ini_set('url_rewriter.tags', ''); // Replace all multiple whitespaces by a single space - $table = htmlspecialchars(preg_replace('/\s+/', ' ', $_REQUEST['table'])); + $table = htmlspecialchars(preg_replace('/\s+/', ' ', $_POST['table'])); $dump = "# " . sprintf( __('Tracking report for table `%s`'), $table ) @@ -905,14 +894,14 @@ class Tracking $message = __('Tracking for %1$s was deactivated at version %2$s.'); } $status = Tracker::$method( - $GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'] + $GLOBALS['db'], $GLOBALS['table'], $_POST['version'] ); if ($status) { $msg = Message::success( sprintf( $message, htmlspecialchars($GLOBALS['db'] . '.' . $GLOBALS['table']), - htmlspecialchars($_REQUEST['version']) + htmlspecialchars($_POST['version']) ) ); $html .= $msg->getDisplay(); @@ -932,43 +921,43 @@ class Tracking // a key is absent from the request if it has been removed from // tracking_default_statements in the config - if (isset($_REQUEST['alter_table']) && $_REQUEST['alter_table'] == true) { + if (isset($_POST['alter_table']) && $_POST['alter_table'] == true) { $tracking_set .= 'ALTER TABLE,'; } - if (isset($_REQUEST['rename_table']) && $_REQUEST['rename_table'] == true) { + if (isset($_POST['rename_table']) && $_POST['rename_table'] == true) { $tracking_set .= 'RENAME TABLE,'; } - if (isset($_REQUEST['create_table']) && $_REQUEST['create_table'] == true) { + if (isset($_POST['create_table']) && $_POST['create_table'] == true) { $tracking_set .= 'CREATE TABLE,'; } - if (isset($_REQUEST['drop_table']) && $_REQUEST['drop_table'] == true) { + if (isset($_POST['drop_table']) && $_POST['drop_table'] == true) { $tracking_set .= 'DROP TABLE,'; } - if (isset($_REQUEST['alter_view']) && $_REQUEST['alter_view'] == true) { + if (isset($_POST['alter_view']) && $_POST['alter_view'] == true) { $tracking_set .= 'ALTER VIEW,'; } - if (isset($_REQUEST['create_view']) && $_REQUEST['create_view'] == true) { + if (isset($_POST['create_view']) && $_POST['create_view'] == true) { $tracking_set .= 'CREATE VIEW,'; } - if (isset($_REQUEST['drop_view']) && $_REQUEST['drop_view'] == true) { + if (isset($_POST['drop_view']) && $_POST['drop_view'] == true) { $tracking_set .= 'DROP VIEW,'; } - if (isset($_REQUEST['create_index']) && $_REQUEST['create_index'] == true) { + if (isset($_POST['create_index']) && $_POST['create_index'] == true) { $tracking_set .= 'CREATE INDEX,'; } - if (isset($_REQUEST['drop_index']) && $_REQUEST['drop_index'] == true) { + if (isset($_POST['drop_index']) && $_POST['drop_index'] == true) { $tracking_set .= 'DROP INDEX,'; } - if (isset($_REQUEST['insert']) && $_REQUEST['insert'] == true) { + if (isset($_POST['insert']) && $_POST['insert'] == true) { $tracking_set .= 'INSERT,'; } - if (isset($_REQUEST['update']) && $_REQUEST['update'] == true) { + if (isset($_POST['update']) && $_POST['update'] == true) { $tracking_set .= 'UPDATE,'; } - if (isset($_REQUEST['delete']) && $_REQUEST['delete'] == true) { + if (isset($_POST['delete']) && $_POST['delete'] == true) { $tracking_set .= 'DELETE,'; } - if (isset($_REQUEST['truncate']) && $_REQUEST['truncate'] == true) { + if (isset($_POST['truncate']) && $_POST['truncate'] == true) { $tracking_set .= 'TRUNCATE,'; } $tracking_set = rtrim($tracking_set, ','); @@ -1018,7 +1007,7 @@ class Tracking $versionCreated = Tracker::createVersion( $GLOBALS['db'], $GLOBALS['table'], - $_REQUEST['version'], + $_POST['version'], $tracking_set, $GLOBALS['dbi']->getTable($GLOBALS['db'], $GLOBALS['table'])->isView() ); @@ -1026,7 +1015,7 @@ class Tracking $msg = Message::success( sprintf( __('Version %1$s was created, tracking for %2$s is active.'), - htmlspecialchars($_REQUEST['version']), + htmlspecialchars($_POST['version']), htmlspecialchars($GLOBALS['db'] . '.' . $GLOBALS['table']) ) ); @@ -1051,7 +1040,7 @@ class Tracking Tracker::createVersion( $GLOBALS['db'], $selected_table, - $_REQUEST['version'], + $_POST['version'], $tracking_set, $GLOBALS['dbi']->getTable($GLOBALS['db'], $selected_table)->isView() ); @@ -1072,8 +1061,8 @@ class Tracking { $entries = array(); // Filtering data definition statements - if ($_REQUEST['logtype'] == 'schema' - || $_REQUEST['logtype'] == 'schema_and_data' + if ($_POST['logtype'] == 'schema' + || $_POST['logtype'] == 'schema_and_data' ) { $entries = array_merge( $entries, @@ -1084,8 +1073,8 @@ class Tracking } // Filtering data manipulation statements - if ($_REQUEST['logtype'] == 'data' - || $_REQUEST['logtype'] == 'schema_and_data' + if ($_POST['logtype'] == 'data' + || $_POST['logtype'] == 'schema_and_data' ) { $entries = array_merge( $entries, @@ -1227,7 +1216,7 @@ class Tracking Util::backquote($cfgRelation['db']) . '.' . Util::backquote($cfgRelation['tracking']) . ' WHERE `db_name` = \'' - . $GLOBALS['dbi']->escapeString($_REQUEST['db']) + . $GLOBALS['dbi']->escapeString($GLOBALS['db']) . '\' AND `table_name` = \'' . $GLOBALS['dbi']->escapeString($tableName) . '\' AND `version` = \'' . $versionNumber . '\''; @@ -1243,7 +1232,6 @@ class Tracking return Template::get('database/tracking/tracked_tables')->render([ 'db' => $db, 'versions' => $versions, - 'url_query' => $urlQuery, 'text_dir' => $textDir, 'pma_theme_image' => $pmaThemeImage, ]); diff --git a/tbl_tracking.php b/tbl_tracking.php index 190f11ad2b..c5218547fe 100644 --- a/tbl_tracking.php +++ b/tbl_tracking.php @@ -24,10 +24,10 @@ require './libraries/tbl_common.inc.php'; if (Tracker::isActive() && Tracker::isTracked($GLOBALS["db"], $GLOBALS["table"]) - && ! (isset($_REQUEST['toggle_activation']) - && $_REQUEST['toggle_activation'] == 'deactivate_now') - && ! (isset($_REQUEST['report_export']) - && $_REQUEST['export_type'] == 'sqldumpfile') + && ! (isset($_POST['toggle_activation']) + && $_POST['toggle_activation'] == 'deactivate_now') + && ! (isset($_POST['report_export']) + && $_POST['export_type'] == 'sqldumpfile') ) { $msg = Message::notice( sprintf( @@ -43,47 +43,47 @@ $url_params['goto'] = 'tbl_tracking.php'; $url_params['back'] = 'tbl_tracking.php'; // Init vars for tracking report -if (isset($_REQUEST['report']) || isset($_REQUEST['report_export'])) { +if (isset($_POST['report']) || isset($_POST['report_export'])) { $data = Tracker::getTrackedData( - $_REQUEST['db'], $_REQUEST['table'], $_REQUEST['version'] + $GLOBALS['db'], $GLOBALS['table'], $_POST['version'] ); $selection_schema = false; $selection_data = false; $selection_both = false; - if (! isset($_REQUEST['logtype'])) { - $_REQUEST['logtype'] = 'schema_and_data'; + if (! isset($_POST['logtype'])) { + $_POST['logtype'] = 'schema_and_data'; } - if ($_REQUEST['logtype'] == 'schema') { + if ($_POST['logtype'] == 'schema') { $selection_schema = true; - } elseif ($_REQUEST['logtype'] == 'data') { + } elseif ($_POST['logtype'] == 'data') { $selection_data = true; } else { $selection_both = true; } - if (! isset($_REQUEST['date_from'])) { - $_REQUEST['date_from'] = $data['date_from']; + if (! isset($_POST['date_from'])) { + $_POST['date_from'] = $data['date_from']; } - if (! isset($_REQUEST['date_to'])) { - $_REQUEST['date_to'] = $data['date_to']; + if (! isset($_POST['date_to'])) { + $_POST['date_to'] = $data['date_to']; } - if (! isset($_REQUEST['users'])) { - $_REQUEST['users'] = '*'; + if (! isset($_POST['users'])) { + $_POST['users'] = '*'; } - $filter_ts_from = strtotime($_REQUEST['date_from']); - $filter_ts_to = strtotime($_REQUEST['date_to']); - $filter_users = array_map('trim', explode(',', $_REQUEST['users'])); + $filter_ts_from = strtotime($_POST['date_from']); + $filter_ts_to = strtotime($_POST['date_to']); + $filter_users = array_map('trim', explode(',', $_POST['users'])); } // Prepare export -if (isset($_REQUEST['report_export'])) { +if (isset($_POST['report_export'])) { $entries = Tracking::getEntries($data, $filter_ts_from, $filter_ts_to, $filter_users); } // Export as file download -if (isset($_REQUEST['report_export']) - && $_REQUEST['export_type'] == 'sqldumpfile' +if (isset($_POST['report_export']) + && $_POST['export_type'] == 'sqldumpfile' ) { Tracking::exportAsFileDownload($entries); } @@ -93,10 +93,10 @@ $html = '
'; /** * Actions */ -if (isset($_REQUEST['submit_mult'])) { - if (! empty($_REQUEST['selected_versions'])) { - if ($_REQUEST['submit_mult'] == 'delete_version') { - foreach ($_REQUEST['selected_versions'] as $version) { +if (isset($_POST['submit_mult'])) { + if (! empty($_POST['selected_versions'])) { + if ($_POST['submit_mult'] == 'delete_version') { + foreach ($_POST['selected_versions'] as $version) { Tracking::deleteTrackingVersion($version); } $html .= Message::success( @@ -110,45 +110,45 @@ if (isset($_REQUEST['submit_mult'])) { } } -if (isset($_REQUEST['submit_delete_version'])) { - $html .= Tracking::deleteTrackingVersion($_REQUEST['version']); +if (isset($_POST['submit_delete_version'])) { + $html .= Tracking::deleteTrackingVersion($_POST['version']); } // Create tracking version -if (isset($_REQUEST['submit_create_version'])) { +if (isset($_POST['submit_create_version'])) { $html .= Tracking::createTrackingVersion(); } // Deactivate tracking -if (isset($_REQUEST['toggle_activation']) - && $_REQUEST['toggle_activation'] == 'deactivate_now' +if (isset($_POST['toggle_activation']) + && $_POST['toggle_activation'] == 'deactivate_now' ) { $html .= Tracking::changeTracking('deactivate'); } // Activate tracking -if (isset($_REQUEST['toggle_activation']) - && $_REQUEST['toggle_activation'] == 'activate_now' +if (isset($_POST['toggle_activation']) + && $_POST['toggle_activation'] == 'activate_now' ) { $html .= Tracking::changeTracking('activate'); } // Export as SQL execution -if (isset($_REQUEST['report_export']) && $_REQUEST['export_type'] == 'execution') { +if (isset($_POST['report_export']) && $_POST['export_type'] == 'execution') { $sql_result = Tracking::exportAsSqlExecution($entries); $msg = Message::success(__('SQL statements executed.')); $html .= $msg->getDisplay(); } // Export as SQL dump -if (isset($_REQUEST['report_export']) && $_REQUEST['export_type'] == 'sqldump') { +if (isset($_POST['report_export']) && $_POST['export_type'] == 'sqldump') { $html .= Tracking::exportAsSqlDump($entries); } /* * Schema snapshot */ -if (isset($_REQUEST['snapshot'])) { +if (isset($_POST['snapshot'])) { $html .= Tracking::getHtmlForSchemaSnapshot($url_query); } // end of snapshot report @@ -156,20 +156,19 @@ if (isset($_REQUEST['snapshot'])) { /* * Tracking report */ -if (isset($_REQUEST['report']) - && (isset($_REQUEST['delete_ddlog']) || isset($_REQUEST['delete_dmlog'])) +if (isset($_POST['report']) + && (isset($_POST['delete_ddlog']) || isset($_POST['delete_dmlog'])) ) { $html .= Tracking::deleteTrackingReportRows($data); } -if (isset($_REQUEST['report']) || isset($_REQUEST['report_export'])) { +if (isset($_POST['report']) || isset($_POST['report_export'])) { $html .= Tracking::getHtmlForTrackingReport( $url_query, $data, $url_params, $selection_schema, $selection_data, $selection_both, $filter_ts_to, $filter_ts_from, $filter_users ); } // end of report - /* * List selectable tables */ diff --git a/templates/database/tracking/tracked_tables.twig b/templates/database/tracking/tracked_tables.twig index e88dfaaa57..9f7a755fc2 100644 --- a/templates/database/tracking/tracked_tables.twig +++ b/templates/database/tracking/tracked_tables.twig @@ -43,25 +43,47 @@ {{ version.status_button|raw }} - + {{ Util_getIcon('b_drop', 'Delete tracking'|trans) }} - + {{ Util_getIcon('b_versions', 'Versions'|trans) }} - + {{ Util_getIcon('b_report', 'Tracking report'|trans) }} - + {{ Util_getIcon('b_props', 'Structure snapshot'|trans) }} diff --git a/templates/table/tracking/report_table.twig b/templates/table/tracking/report_table.twig index 525e35cc71..fe00526676 100644 --- a/templates/table/tracking/report_table.twig +++ b/templates/table/tracking/report_table.twig @@ -16,7 +16,7 @@ {{ entry.username }} {{ entry.formated_statement|raw }} - {{ drop_image_or_text|raw }} diff --git a/test/classes/TrackingTest.php b/test/classes/TrackingTest.php index 93603ced1a..557cf8b680 100644 --- a/test/classes/TrackingTest.php +++ b/test/classes/TrackingTest.php @@ -30,9 +30,6 @@ class TrackingTest extends TestCase /** * SET these to avoid undefined index error */ - $_REQUEST['db'] = "db"; - $_REQUEST['table'] = "table"; - $GLOBALS['server'] = 1; $GLOBALS['db'] = "PMA_db"; $GLOBALS['table'] = "PMA_table"; @@ -576,11 +573,11 @@ class TrackingTest extends TestCase */ public function testPMAGetHtmlForTrackingReportr() { - $_REQUEST['version'] = 10; - $_REQUEST['date_from'] = "date_from"; - $_REQUEST['date_to'] = "date_to"; - $_REQUEST['users'] = "users"; - $_REQUEST['logtype'] = 'logtype'; + $_POST['version'] = 10; + $_POST['date_from'] = "date_from"; + $_POST['date_to'] = "date_to"; + $_POST['users'] = "users"; + $_POST['logtype'] = 'logtype'; $url_query = "select * from PMA"; $data = array( 'tracking'=>'tracking', @@ -622,12 +619,10 @@ class TrackingTest extends TestCase $html ); - $version = ''tracking', 'dmlog' => array( @@ -737,7 +732,7 @@ class TrackingTest extends TestCase */ public function testPMAGetHtmlForDataDefinitionStatements() { - $_REQUEST['version'] = "10"; + $_POST['version'] = "10"; $data = array( 'tracking'=>'tracking', @@ -877,16 +872,16 @@ class TrackingTest extends TestCase */ public function testPMAGetTrackingSet() { - $_REQUEST['alter_table'] = false; - $_REQUEST['rename_table'] = true; - $_REQUEST['create_table'] = true; - $_REQUEST['drop_table'] = true; - $_REQUEST['create_index'] = false; - $_REQUEST['drop_index'] = true; - $_REQUEST['insert'] = true; - $_REQUEST['update'] = false; - $_REQUEST['delete'] = true; - $_REQUEST['truncate'] = true; + $_POST['alter_table'] = false; + $_POST['rename_table'] = true; + $_POST['create_table'] = true; + $_POST['drop_table'] = true; + $_POST['create_index'] = false; + $_POST['drop_index'] = true; + $_POST['insert'] = true; + $_POST['update'] = false; + $_POST['delete'] = true; + $_POST['truncate'] = true; $tracking_set = Tracking::getTrackingSet(); $this->assertEquals( @@ -895,16 +890,16 @@ class TrackingTest extends TestCase ); //other set to true - $_REQUEST['alter_table'] = true; - $_REQUEST['rename_table'] = false; - $_REQUEST['create_table'] = false; - $_REQUEST['drop_table'] = false; - $_REQUEST['create_index'] = true; - $_REQUEST['drop_index'] = false; - $_REQUEST['insert'] = false; - $_REQUEST['update'] = true; - $_REQUEST['delete'] = false; - $_REQUEST['truncate'] = false; + $_POST['alter_table'] = true; + $_POST['rename_table'] = false; + $_POST['create_table'] = false; + $_POST['drop_table'] = false; + $_POST['create_index'] = true; + $_POST['drop_index'] = false; + $_POST['insert'] = false; + $_POST['update'] = true; + $_POST['delete'] = false; + $_POST['truncate'] = false; $tracking_set = Tracking::getTrackingSet(); $this->assertEquals( @@ -922,7 +917,7 @@ class TrackingTest extends TestCase */ public function testPMAGetEntries() { - $_REQUEST['logtype'] = 'schema'; + $_POST['logtype'] = 'schema'; $data = array( 'tracking'=>'tracking', 'ddlog' => array( From faced0a344a3e3c2cfe645d400fcddc54dcc7f4e Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Mon, 16 Jul 2018 15:55:34 +1000 Subject: [PATCH 10/49] Retrieve parameters from $_POST in events Signed-off-by: Madhura Jayaratne --- libraries/classes/Rte/Events.php | 86 ++++++++++++++++---------------- test/classes/Rte/EventsTest.php | 12 ++--- 2 files changed, 49 insertions(+), 49 deletions(-) diff --git a/libraries/classes/Rte/Events.php b/libraries/classes/Rte/Events.php index 3f10c638c2..0306b1d35b 100644 --- a/libraries/classes/Rte/Events.php +++ b/libraries/classes/Rte/Events.php @@ -97,8 +97,8 @@ class Events { global $_REQUEST, $_POST, $errors, $db; - if (! empty($_REQUEST['editor_process_add']) - || ! empty($_REQUEST['editor_process_edit']) + if (! empty($_POST['editor_process_add']) + || ! empty($_POST['editor_process_edit']) ) { $sql_query = ''; @@ -106,15 +106,15 @@ class Events if (! count($errors)) { // set by PhpMyAdmin\Rte\Routines::getQueryFromRequest() // Execute the created query - if (! empty($_REQUEST['editor_process_edit'])) { + if (! empty($_POST['editor_process_edit'])) { // Backup the old trigger, in case something goes wrong $create_item = $GLOBALS['dbi']->getDefinition( $db, 'EVENT', - $_REQUEST['item_original_name'] + $_POST['item_original_name'] ); $drop_item = "DROP EVENT " - . Util::backquote($_REQUEST['item_original_name']) + . Util::backquote($_POST['item_original_name']) . ";\n"; $result = $GLOBALS['dbi']->tryQuery($drop_item); if (! $result) { @@ -149,7 +149,7 @@ class Events __('Event %1$s has been modified.') ); $message->addParam( - Util::backquote($_REQUEST['item_name']) + Util::backquote($_POST['item_name']) ); $sql_query = $drop_item . $item_query; } @@ -169,7 +169,7 @@ class Events __('Event %1$s has been created.') ); $message->addParam( - Util::backquote($_REQUEST['item_name']) + Util::backquote($_POST['item_name']) ); $sql_query = $item_query; } @@ -195,12 +195,12 @@ class Events $response = Response::getInstance(); if ($response->isAjax()) { if ($message->isSuccess()) { - $events = $GLOBALS['dbi']->getEvents($db, $_REQUEST['item_name']); + $events = $GLOBALS['dbi']->getEvents($db, $_POST['item_name']); $event = $events[0]; $response->addJSON( 'name', htmlspecialchars( - mb_strtoupper($_REQUEST['item_name']) + mb_strtoupper($_POST['item_name']) ) ); if (! empty($event)) { @@ -219,14 +219,14 @@ class Events * Display a form used to add/edit a trigger, if necessary */ if (count($errors) - || (empty($_REQUEST['editor_process_add']) - && empty($_REQUEST['editor_process_edit']) + || (empty($_POST['editor_process_add']) + && empty($_POST['editor_process_edit']) && (! empty($_REQUEST['add_item']) || ! empty($_REQUEST['edit_item']) - || ! empty($_REQUEST['item_changetype']))) + || ! empty($_POST['item_changetype']))) ) { // FIXME: this must be simpler than that $operation = ''; - if (! empty($_REQUEST['item_changetype'])) { + if (! empty($_POST['item_changetype'])) { $operation = 'change'; } // Get the data for the form (if any) @@ -237,8 +237,8 @@ class Events } elseif (! empty($_REQUEST['edit_item'])) { $title = __("Edit event"); if (! empty($_REQUEST['item_name']) - && empty($_REQUEST['editor_process_edit']) - && empty($_REQUEST['item_changetype']) + && empty($_POST['editor_process_edit']) + && empty($_POST['item_changetype']) ) { $item = self::getDataFromName($_REQUEST['item_name']); if ($item !== false) { @@ -274,11 +274,11 @@ class Events 'item_comment', 'item_definer'); foreach ($indices as $index) { - $retval[$index] = isset($_REQUEST[$index]) ? $_REQUEST[$index] : ''; + $retval[$index] = isset($_POST[$index]) ? $_POST[$index] : ''; } $retval['item_type'] = 'ONE TIME'; $retval['item_type_toggle'] = 'RECURRING'; - if (isset($_REQUEST['item_type']) && $_REQUEST['item_type'] == 'RECURRING') { + if (isset($_POST['item_type']) && $_POST['item_type'] == 'RECURRING') { $retval['item_type'] = 'RECURRING'; $retval['item_type_toggle'] = 'ONE TIME'; } @@ -545,10 +545,10 @@ class Events global $_REQUEST, $errors, $event_status, $event_type, $event_interval; $query = 'CREATE '; - if (! empty($_REQUEST['item_definer'])) { - if (mb_strpos($_REQUEST['item_definer'], '@') !== false + if (! empty($_POST['item_definer'])) { + if (mb_strpos($_POST['item_definer'], '@') !== false ) { - $arr = explode('@', $_REQUEST['item_definer']); + $arr = explode('@', $_POST['item_definer']); $query .= 'DEFINER=' . Util::backquote($arr[0]); $query .= '@' . Util::backquote($arr[1]) . ' '; } else { @@ -556,40 +556,40 @@ class Events } } $query .= 'EVENT '; - if (! empty($_REQUEST['item_name'])) { - $query .= Util::backquote($_REQUEST['item_name']) . ' '; + if (! empty($_POST['item_name'])) { + $query .= Util::backquote($_POST['item_name']) . ' '; } else { $errors[] = __('You must provide an event name!'); } $query .= 'ON SCHEDULE '; - if (! empty($_REQUEST['item_type']) - && in_array($_REQUEST['item_type'], $event_type) + if (! empty($_POST['item_type']) + && in_array($_POST['item_type'], $event_type) ) { - if ($_REQUEST['item_type'] == 'RECURRING') { - if (! empty($_REQUEST['item_interval_value']) - && !empty($_REQUEST['item_interval_field']) - && in_array($_REQUEST['item_interval_field'], $event_interval) + if ($_POST['item_type'] == 'RECURRING') { + if (! empty($_POST['item_interval_value']) + && !empty($_POST['item_interval_field']) + && in_array($_POST['item_interval_field'], $event_interval) ) { - $query .= 'EVERY ' . intval($_REQUEST['item_interval_value']) . ' '; - $query .= $_REQUEST['item_interval_field'] . ' '; + $query .= 'EVERY ' . intval($_POST['item_interval_value']) . ' '; + $query .= $_POST['item_interval_field'] . ' '; } else { $errors[] = __('You must provide a valid interval value for the event.'); } - if (! empty($_REQUEST['item_starts'])) { + if (! empty($_POST['item_starts'])) { $query .= "STARTS '" - . $GLOBALS['dbi']->escapeString($_REQUEST['item_starts']) + . $GLOBALS['dbi']->escapeString($_POST['item_starts']) . "' "; } - if (! empty($_REQUEST['item_ends'])) { + if (! empty($_POST['item_ends'])) { $query .= "ENDS '" - . $GLOBALS['dbi']->escapeString($_REQUEST['item_ends']) + . $GLOBALS['dbi']->escapeString($_POST['item_ends']) . "' "; } } else { - if (! empty($_REQUEST['item_execute_at'])) { + if (! empty($_POST['item_execute_at'])) { $query .= "AT '" - . $GLOBALS['dbi']->escapeString($_REQUEST['item_execute_at']) + . $GLOBALS['dbi']->escapeString($_POST['item_execute_at']) . "' "; } else { $errors[] @@ -600,26 +600,26 @@ class Events $errors[] = __('You must provide a valid type for the event.'); } $query .= 'ON COMPLETION '; - if (empty($_REQUEST['item_preserve'])) { + if (empty($_POST['item_preserve'])) { $query .= 'NOT '; } $query .= 'PRESERVE '; - if (! empty($_REQUEST['item_status'])) { + if (! empty($_POST['item_status'])) { foreach ($event_status['display'] as $key => $value) { - if ($value == $_REQUEST['item_status']) { + if ($value == $_POST['item_status']) { $query .= $event_status['query'][$key] . ' '; break; } } } - if (! empty($_REQUEST['item_comment'])) { + if (! empty($_POST['item_comment'])) { $query .= "COMMENT '" . $GLOBALS['dbi']->escapeString( - $_REQUEST['item_comment'] + $_POST['item_comment'] ) . "' "; } $query .= 'DO '; - if (! empty($_REQUEST['item_definition'])) { - $query .= $_REQUEST['item_definition']; + if (! empty($_POST['item_definition'])) { + $query .= $_POST['item_definition']; } else { $errors[] = __('You must provide an event definition.'); } diff --git a/test/classes/Rte/EventsTest.php b/test/classes/Rte/EventsTest.php index 0b9f9e5b79..c4c018c6e6 100644 --- a/test/classes/Rte/EventsTest.php +++ b/test/classes/Rte/EventsTest.php @@ -68,12 +68,12 @@ class EventsTest extends TestCase */ public function testGetDataFromRequestEmpty($in, $out) { - global $_REQUEST; + global $_POST; - unset($_REQUEST); + unset($_POST); foreach ($in as $key => $value) { if ($value !== '') { - $_REQUEST[$key] = $value; + $_POST[$key] = $value; } } $this->assertEquals($out, Events::getDataFromRequest()); @@ -404,13 +404,13 @@ class EventsTest extends TestCase */ public function testGetQueryFromRequest($request, $query, $num_err) { - global $_REQUEST, $errors; + global $_POST, $errors; $errors = array(); Events::setGlobals(); - unset($_REQUEST); - $_REQUEST = $request; + unset($_POST); + $_POST = $request; $dbi = $this->getMockBuilder('PhpMyAdmin\DatabaseInterface') ->disableOriginalConstructor() From d0eede7c566d97f92b5fda1560fa07b583ffc0a4 Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Mon, 16 Jul 2018 16:22:26 +1000 Subject: [PATCH 11/49] Retrieve parameters from $_POST in triggers Signed-off-by: Madhura Jayaratne --- libraries/classes/Rte/Triggers.php | 56 +++++++++++++++--------------- test/classes/Rte/TriggersTest.php | 20 +++++------ 2 files changed, 38 insertions(+), 38 deletions(-) diff --git a/libraries/classes/Rte/Triggers.php b/libraries/classes/Rte/Triggers.php index 7f025affd1..1f0d273b08 100644 --- a/libraries/classes/Rte/Triggers.php +++ b/libraries/classes/Rte/Triggers.php @@ -77,8 +77,8 @@ class Triggers { global $_REQUEST, $_POST, $errors, $db, $table; - if (! empty($_REQUEST['editor_process_add']) - || ! empty($_REQUEST['editor_process_edit']) + if (! empty($_POST['editor_process_add']) + || ! empty($_POST['editor_process_edit']) ) { $sql_query = ''; @@ -86,9 +86,9 @@ class Triggers if (! count($errors)) { // set by PhpMyAdmin\Rte\Routines::getQueryFromRequest() // Execute the created query - if (! empty($_REQUEST['editor_process_edit'])) { + if (! empty($_POST['editor_process_edit'])) { // Backup the old trigger, in case something goes wrong - $trigger = self::getDataFromName($_REQUEST['item_original_name']); + $trigger = self::getDataFromName($_POST['item_original_name']); $create_item = $trigger['create']; $drop_item = $trigger['drop'] . ';'; $result = $GLOBALS['dbi']->tryQuery($drop_item); @@ -125,7 +125,7 @@ class Triggers __('Trigger %1$s has been modified.') ); $message->addParam( - Util::backquote($_REQUEST['item_name']) + Util::backquote($_POST['item_name']) ); $sql_query = $drop_item . $item_query; } @@ -145,7 +145,7 @@ class Triggers __('Trigger %1$s has been created.') ); $message->addParam( - Util::backquote($_REQUEST['item_name']) + Util::backquote($_POST['item_name']) ); $sql_query = $item_query; } @@ -174,7 +174,7 @@ class Triggers $items = $GLOBALS['dbi']->getTriggers($db, $table, ''); $trigger = false; foreach ($items as $value) { - if ($value['name'] == $_REQUEST['item_name']) { + if ($value['name'] == $_POST['item_name']) { $trigger = $value; } } @@ -188,7 +188,7 @@ class Triggers 'name', htmlspecialchars( mb_strtoupper( - $_REQUEST['item_name'] + $_POST['item_name'] ) ) ); @@ -207,8 +207,8 @@ class Triggers * Display a form used to add/edit a trigger, if necessary */ if (count($errors) - || (empty($_REQUEST['editor_process_add']) - && empty($_REQUEST['editor_process_edit']) + || (empty($_POST['editor_process_add']) + && empty($_POST['editor_process_edit']) && (! empty($_REQUEST['add_item']) || ! empty($_REQUEST['edit_item']))) // FIXME: this must be simpler than that ) { @@ -220,7 +220,7 @@ class Triggers } elseif (! empty($_REQUEST['edit_item'])) { $title = __("Edit trigger"); if (! empty($_REQUEST['item_name']) - && empty($_REQUEST['editor_process_edit']) + && empty($_POST['editor_process_edit']) ) { $item = self::getDataFromName($_REQUEST['item_name']); if ($item !== false) { @@ -251,7 +251,7 @@ class Triggers 'item_definition', 'item_definer'); foreach ($indices as $index) { - $retval[$index] = isset($_REQUEST[$index]) ? $_REQUEST[$index] : ''; + $retval[$index] = isset($_POST[$index]) ? $_POST[$index] : ''; } return $retval; } // end self::getDataFromRequest() @@ -428,10 +428,10 @@ class Triggers global $_REQUEST, $db, $errors, $action_timings, $event_manipulations; $query = 'CREATE '; - if (! empty($_REQUEST['item_definer'])) { - if (mb_strpos($_REQUEST['item_definer'], '@') !== false + if (! empty($_POST['item_definer'])) { + if (mb_strpos($_POST['item_definer'], '@') !== false ) { - $arr = explode('@', $_REQUEST['item_definer']); + $arr = explode('@', $_POST['item_definer']); $query .= 'DEFINER=' . Util::backquote($arr[0]); $query .= '@' . Util::backquote($arr[1]) . ' '; } else { @@ -439,36 +439,36 @@ class Triggers } } $query .= 'TRIGGER '; - if (! empty($_REQUEST['item_name'])) { - $query .= Util::backquote($_REQUEST['item_name']) . ' '; + if (! empty($_POST['item_name'])) { + $query .= Util::backquote($_POST['item_name']) . ' '; } else { $errors[] = __('You must provide a trigger name!'); } - if (! empty($_REQUEST['item_timing']) - && in_array($_REQUEST['item_timing'], $action_timings) + if (! empty($_POST['item_timing']) + && in_array($_POST['item_timing'], $action_timings) ) { - $query .= $_REQUEST['item_timing'] . ' '; + $query .= $_POST['item_timing'] . ' '; } else { $errors[] = __('You must provide a valid timing for the trigger!'); } - if (! empty($_REQUEST['item_event']) - && in_array($_REQUEST['item_event'], $event_manipulations) + if (! empty($_POST['item_event']) + && in_array($_POST['item_event'], $event_manipulations) ) { - $query .= $_REQUEST['item_event'] . ' '; + $query .= $_POST['item_event'] . ' '; } else { $errors[] = __('You must provide a valid event for the trigger!'); } $query .= 'ON '; - if (! empty($_REQUEST['item_table']) - && in_array($_REQUEST['item_table'], $GLOBALS['dbi']->getTables($db)) + if (! empty($_POST['item_table']) + && in_array($_POST['item_table'], $GLOBALS['dbi']->getTables($db)) ) { - $query .= Util::backquote($_REQUEST['item_table']); + $query .= Util::backquote($_POST['item_table']); } else { $errors[] = __('You must provide a valid table name!'); } $query .= ' FOR EACH ROW '; - if (! empty($_REQUEST['item_definition'])) { - $query .= $_REQUEST['item_definition']; + if (! empty($_POST['item_definition'])) { + $query .= $_POST['item_definition']; } else { $errors[] = __('You must provide a trigger definition.'); } diff --git a/test/classes/Rte/TriggersTest.php b/test/classes/Rte/TriggersTest.php index 1c4b9f60c5..0bb6298ffc 100644 --- a/test/classes/Rte/TriggersTest.php +++ b/test/classes/Rte/TriggersTest.php @@ -54,12 +54,12 @@ class TriggersTest extends TestCase */ public function testGetDataFromRequestEmpty($in, $out) { - global $_REQUEST; + global $_POST; - unset($_REQUEST); + unset($_POST); foreach ($in as $key => $value) { if ($value !== '') { - $_REQUEST[$key] = $value; + $_POST[$key] = $value; } } $this->assertEquals($out, Triggers::getDataFromRequest()); @@ -334,17 +334,17 @@ class TriggersTest extends TestCase public function testGetQueryFromRequest( $definer, $name, $timing, $event, $table, $definition, $query, $num_err ) { - global $_REQUEST, $errors; + global $_POST, $errors; $errors = array(); Triggers::setGlobals(); - $_REQUEST['item_definer'] = $definer; - $_REQUEST['item_name'] = $name; - $_REQUEST['item_timing'] = $timing; - $_REQUEST['item_event'] = $event; - $_REQUEST['item_table'] = $table; - $_REQUEST['item_definition'] = $definition; + $_POST['item_definer'] = $definer; + $_POST['item_name'] = $name; + $_POST['item_timing'] = $timing; + $_POST['item_event'] = $event; + $_POST['item_table'] = $table; + $_POST['item_definition'] = $definition; $GLOBALS['server'] = 1; $this->assertEquals($query, Triggers::getQueryFromRequest()); From 42561e689613e6712920bada4e2f957a96252f97 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maur=C3=ADcio=20Meneghini=20Fauth?= Date: Mon, 16 Jul 2018 12:05:41 -0300 Subject: [PATCH 12/49] Retrieve parameters from $_POST in view create/edit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Maurício Meneghini Fauth --- view_create.php | 61 ++++++++++++++++++++++++------------------------- 1 file changed, 30 insertions(+), 31 deletions(-) diff --git a/view_create.php b/view_create.php index 0a25ced57c..d0e9b381bb 100644 --- a/view_create.php +++ b/view_create.php @@ -9,7 +9,6 @@ */ use PhpMyAdmin\Core; -use PhpMyAdmin\Url; use PhpMyAdmin\Response; use PhpMyAdmin\Template; @@ -41,8 +40,8 @@ $view_security_options = array( ); // View name is a compulsory field -if (isset($_REQUEST['view']['name']) - && empty($_REQUEST['view']['name']) +if (isset($_POST['view']['name']) + && empty($_POST['view']['name']) ) { $message = PhpMyAdmin\Message::error(__('View name can not be empty!')); $response->addJSON( @@ -53,61 +52,61 @@ if (isset($_REQUEST['view']['name']) exit; } -if (isset($_REQUEST['createview']) || isset($_REQUEST['alterview'])) { +if (isset($_POST['createview']) || isset($_POST['alterview'])) { /** * Creates the view */ $sep = "\r\n"; - if (isset($_REQUEST['createview'])) { + if (isset($_POST['createview'])) { $sql_query = 'CREATE'; - if (isset($_REQUEST['view']['or_replace'])) { + if (isset($_POST['view']['or_replace'])) { $sql_query .= ' OR REPLACE'; } } else { $sql_query = 'ALTER'; } - if (Core::isValid($_REQUEST['view']['algorithm'], $view_algorithm_options)) { - $sql_query .= $sep . ' ALGORITHM = ' . $_REQUEST['view']['algorithm']; + if (Core::isValid($_POST['view']['algorithm'], $view_algorithm_options)) { + $sql_query .= $sep . ' ALGORITHM = ' . $_POST['view']['algorithm']; } - if (! empty($_REQUEST['view']['definer'])) { - if (strpos($_REQUEST['view']['definer'], '@') === false) { + if (! empty($_POST['view']['definer'])) { + if (strpos($_POST['view']['definer'], '@') === false) { $sql_query .= $sep . 'DEFINER=' - . PhpMyAdmin\Util::backquote($_REQUEST['view']['definer']); + . PhpMyAdmin\Util::backquote($_POST['view']['definer']); } else { - $arr = explode('@', $_REQUEST['view']['definer']); + $arr = explode('@', $_POST['view']['definer']); $sql_query .= $sep . 'DEFINER=' . PhpMyAdmin\Util::backquote($arr[0]); $sql_query .= '@' . PhpMyAdmin\Util::backquote($arr[1]) . ' '; } } - if (isset($_REQUEST['view']['sql_security'])) { - if (in_array($_REQUEST['view']['sql_security'], $view_security_options)) { + if (isset($_POST['view']['sql_security'])) { + if (in_array($_POST['view']['sql_security'], $view_security_options)) { $sql_query .= $sep . ' SQL SECURITY ' - . $_REQUEST['view']['sql_security']; + . $_POST['view']['sql_security']; } } $sql_query .= $sep . ' VIEW ' - . PhpMyAdmin\Util::backquote($_REQUEST['view']['name']); + . PhpMyAdmin\Util::backquote($_POST['view']['name']); - if (! empty($_REQUEST['view']['column_names'])) { - $sql_query .= $sep . ' (' . $_REQUEST['view']['column_names'] . ')'; + if (! empty($_POST['view']['column_names'])) { + $sql_query .= $sep . ' (' . $_POST['view']['column_names'] . ')'; } - $sql_query .= $sep . ' AS ' . $_REQUEST['view']['as']; + $sql_query .= $sep . ' AS ' . $_POST['view']['as']; - if (isset($_REQUEST['view']['with'])) { - if (in_array($_REQUEST['view']['with'], $view_with_options)) { - $sql_query .= $sep . ' WITH ' . $_REQUEST['view']['with'] + if (isset($_POST['view']['with'])) { + if (in_array($_POST['view']['with'], $view_with_options)) { + $sql_query .= $sep . ' WITH ' . $_POST['view']['with'] . ' CHECK OPTION'; } } if (!$GLOBALS['dbi']->tryQuery($sql_query)) { - if (! isset($_REQUEST['ajax_dialog'])) { + if (! isset($_POST['ajax_dialog'])) { $message = PhpMyAdmin\Message::rawError($GLOBALS['dbi']->getError()); return; } @@ -125,12 +124,12 @@ if (isset($_REQUEST['createview']) || isset($_REQUEST['alterview'])) { // If different column names defined for VIEW $view_columns = array(); - if (isset($_REQUEST['view']['column_names'])) { - $view_columns = explode(',', $_REQUEST['view']['column_names']); + if (isset($_POST['view']['column_names'])) { + $view_columns = explode(',', $_POST['view']['column_names']); } $column_map = $GLOBALS['dbi']->getColumnMapFromSql( - $_REQUEST['view']['as'], $view_columns + $_POST['view']['as'], $view_columns ); $systemDb = $GLOBALS['dbi']->getSystemDatabase(); @@ -143,7 +142,7 @@ if (isset($_REQUEST['createview']) || isset($_REQUEST['alterview'])) { // SQL for store new transformation details of VIEW $new_transformations_sql = $systemDb->getNewTransformationDataSql( $pma_transformation_data, $column_map, - $_REQUEST['view']['name'], $GLOBALS['db'] + $_POST['view']['name'], $GLOBALS['db'] ); // Store new transformations @@ -154,7 +153,7 @@ if (isset($_REQUEST['createview']) || isset($_REQUEST['alterview'])) { } unset($pma_transformation_data); - if (! isset($_REQUEST['ajax_dialog'])) { + if (! isset($_POST['ajax_dialog'])) { $message = PhpMyAdmin\Message::success(); include 'tbl_structure.php'; } else { @@ -186,15 +185,15 @@ $view = array( 'with' => '', ); -if (Core::isValid($_REQUEST['view'], 'array')) { - $view = array_merge($view, $_REQUEST['view']); +if (Core::isValid($_POST['view'], 'array')) { + $view = array_merge($view, $_POST['view']); } $url_params['db'] = $GLOBALS['db']; $url_params['reload'] = 1; echo Template::get('view_create')->render([ - 'ajax_dialog' => isset($_REQUEST['ajax_dialog']), + 'ajax_dialog' => isset($_POST['ajax_dialog']), 'text_dir' => $text_dir, 'url_params' => $url_params, 'view' => $view, From ca06ecc87681e7d547271fdbd06816a2bee9be80 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maur=C3=ADcio=20Meneghini=20Fauth?= Date: Tue, 17 Jul 2018 21:39:19 -0300 Subject: [PATCH 13/49] Fix create view dialog not sending parameters as POST MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Maurício Meneghini Fauth --- js/functions.js | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/js/functions.js b/js/functions.js index 0cbb39e4ec..cc29c17619 100644 --- a/js/functions.js +++ b/js/functions.js @@ -4543,8 +4543,9 @@ function PMA_createViewDialog ($this) { var $msg = PMA_ajaxShowMessage(); var syntaxHighlighter = null; var sep = PMA_commonParams.get('arg_separator'); - params = $this.getPostData(); - $.get($this.attr('href') + sep + 'ajax_request=1' + sep + 'ajax_dialog=1' + sep + params, function (data) { + var params = getJSConfirmCommonParam(this, $this.getPostData()); + params += sep + 'ajax_dialog=1'; + $.post($this.attr('href'), params, function (data) { if (typeof data !== 'undefined' && data.success === true) { PMA_ajaxRemoveMessage($msg); var buttonOptions = {}; From 3d9ed655cc6107bd0e8e6d5f5a5f58d0fc791564 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maur=C3=ADcio=20Meneghini=20Fauth?= Date: Wed, 18 Jul 2018 09:31:09 -0300 Subject: [PATCH 14/49] Retrieve parameters from $_POST in insert/edit pages MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Maurício Meneghini Fauth --- libraries/classes/InsertEdit.php | 94 ++++++++++++++++---------------- tbl_replace.php | 82 ++++++++++++++-------------- test/classes/InsertEditTest.php | 60 ++++++++++---------- 3 files changed, 118 insertions(+), 118 deletions(-) diff --git a/libraries/classes/InsertEdit.php b/libraries/classes/InsertEdit.php index c18e3797d6..a42ee74944 100644 --- a/libraries/classes/InsertEdit.php +++ b/libraries/classes/InsertEdit.php @@ -79,8 +79,8 @@ class InsertEdit $_form_params['where_clause[' . $key_id . ']'] = trim($where_clause); } } - if (isset($_REQUEST['clause_is_unique'])) { - $_form_params['clause_is_unique'] = $_REQUEST['clause_is_unique']; + if (isset($_POST['clause_is_unique'])) { + $_form_params['clause_is_unique'] = $_POST['clause_is_unique']; } return $_form_params; } @@ -280,13 +280,13 @@ class InsertEdit $this_url_params = array_merge($url_params, $params); if (! $is_show) { - return ' : ' + return ' : ' . $this->showTypeOrFunctionLabel($which) . ''; } - return '' . $this->showTypeOrFunctionLabel($which) . ''; @@ -1120,7 +1120,7 @@ class InsertEdit $html_output .= '