gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove the Core::isValid method

Browse Source 
This improves the type checking and simplifies the code.

Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
This commit is contained in:
Maurício Meneghini Fauth 2021-09-02 13:20:50 -03:00
parent 5725516656
commit 8f2f3eff40
No known key found for this signature in database
GPG Key ID: 6A16FD38AFC89CC8
32 changed files with 229 additions and 778 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
libraries/classes/Common.php
View File

@ -24,6 +24,7 @@ use function htmlspecialchars;
use function implode;
use function ini_get;
use function ini_set;
use function is_scalar;
use function mb_internal_encoding;
use function mb_strlen;
use function mb_strpos;
@ -461,9 +462,9 @@ final class Common
return;
}
if (Core::isValid($_POST['token'])) {
if (isset($_POST['token']) && is_scalar($_POST['token']) && strlen((string) $_POST['token']) > 0) {
$token_provided = true;
$token_mismatch = ! @hash_equals($_SESSION[' PMA_token '], $_POST['token']);
$token_mismatch = ! @hash_equals($_SESSION[' PMA_token '], (string) $_POST['token']);
}
if (! $token_mismatch) {
@ -493,11 +494,18 @@ final class Common
{
global $db, $table, $urlParams;
$databaseFromRequest = $_POST['db'] ?? $_GET['db'] ?? $_REQUEST['db'] ?? null;
$tableFromRequest = $_POST['table'] ?? $_GET['table'] ?? $_REQUEST['table'] ?? null;
$databaseFromRequest = $_POST['db'] ?? $_GET['db'] ?? $_REQUEST['db'] ?? '';
$tableFromRequest = $_POST['table'] ?? $_GET['table'] ?? $_REQUEST['table'] ?? '';
$db = Core::isValid($databaseFromRequest) ? $databaseFromRequest : '';
$table = Core::isValid($tableFromRequest) ? $tableFromRequest : '';
$db = '';
if (is_scalar($databaseFromRequest) && strlen((string) $databaseFromRequest) > 0) {
$db = (string) $databaseFromRequest;
}
$table = '';
if (is_scalar($tableFromRequest) && strlen((string) $tableFromRequest) > 0) {
$table = (string) $tableFromRequest;
}
$urlParams['db'] = $db;
$urlParams['table'] = $table;

11
libraries/classes/Controllers/Database/CentralColumnsController.php
View File

@ -7,7 +7,6 @@ declare(strict_types=1);
namespace PhpMyAdmin\Controllers\Database;
use PhpMyAdmin\Core;
use PhpMyAdmin\Database\CentralColumns;
use PhpMyAdmin\Message;
use PhpMyAdmin\ResponseRenderer;
@ -15,6 +14,7 @@ use PhpMyAdmin\Template;
use function __;
use function is_bool;
use function is_numeric;
use function parse_str;
use function sprintf;
@ -132,7 +132,7 @@ class CentralColumnsController extends AbstractController
]);
$pos = 0;
if (Core::isValid($_POST['pos'], 'integer')) {
if (isset($_POST['pos']) && is_numeric($_POST['pos'])) {
$pos = (int) $_POST['pos'];
}
@ -158,17 +158,14 @@ class CentralColumnsController extends AbstractController
{
global $text_dir;
if (
! empty($params['total_rows'])
&& Core::isValid($params['total_rows'], 'integer')
) {
if (! empty($params['total_rows']) && is_numeric($params['total_rows'])) {
$totalRows = (int) $params['total_rows'];
} else {
$totalRows = $this->centralColumns->getCount($this->db);
}
$pos = 0;
if (Core::isValid($params['pos'], 'integer')) {
if (isset($params['pos']) && is_numeric($params['pos'])) {
$pos = (int) $params['pos'];
}

4
libraries/classes/Controllers/Database/ImportController.php
View File

@ -7,7 +7,6 @@ namespace PhpMyAdmin\Controllers\Database;
use PhpMyAdmin\Charsets;
use PhpMyAdmin\Charsets\Charset;
use PhpMyAdmin\Config\PageSettings;
use PhpMyAdmin\Core;
use PhpMyAdmin\DatabaseInterface;
use PhpMyAdmin\Encoding;
use PhpMyAdmin\Import;
@ -22,6 +21,7 @@ use PhpMyAdmin\Utils\ForeignKey;
use function __;
use function intval;
use function is_numeric;
final class ImportController extends AbstractController
{
@ -82,7 +82,7 @@ final class ImportController extends AbstractController
}
$offset = null;
if (Core::isValid($_REQUEST['offset'], 'numeric')) {
if (isset($_REQUEST['offset']) && is_numeric($_REQUEST['offset'])) {
$offset = intval($_REQUEST['offset']);
}

3
libraries/classes/Controllers/Database/RoutinesController.php
View File

@ -5,7 +5,6 @@ declare(strict_types=1);
namespace PhpMyAdmin\Controllers\Database;
use PhpMyAdmin\CheckUserPrivileges;
use PhpMyAdmin\Core;
use PhpMyAdmin\Database\Routines;
use PhpMyAdmin\DatabaseInterface;
use PhpMyAdmin\DbTableExists;
@ -102,7 +101,7 @@ class RoutinesController extends AbstractController
$routines->handleExecute();
$routines->export();
if (! Core::isValid($type, ['FUNCTION', 'PROCEDURE'])) {
if (! isset($type) || ! in_array($type, ['FUNCTION', 'PROCEDURE'])) {
$type = null;
}

3
libraries/classes/Controllers/NormalizationController.php
View File

@ -12,6 +12,7 @@ use PhpMyAdmin\Url;
use function __;
use function _pgettext;
use function in_array;
use function intval;
use function json_decode;
use function json_encode;
@ -108,7 +109,7 @@ class NormalizationController extends AbstractController
$this->addScriptFiles(['normalization.js', 'vendor/jquery/jquery.uitablefilter.js']);
$normalForm = '1nf';
if (Core::isValid($_POST['normalizeTo'], ['1nf', '2nf', '3nf'])) {
if (isset($_POST['normalizeTo']) && in_array($_POST['normalizeTo'], ['1nf', '2nf', '3nf'])) {
$normalForm = $_POST['normalizeTo'];
}

4
libraries/classes/Controllers/Server/ImportController.php
View File

@ -8,7 +8,6 @@ use PhpMyAdmin\Charsets;
use PhpMyAdmin\Charsets\Charset;
use PhpMyAdmin\Config\PageSettings;
use PhpMyAdmin\Controllers\AbstractController;
use PhpMyAdmin\Core;
use PhpMyAdmin\DatabaseInterface;
use PhpMyAdmin\Encoding;
use PhpMyAdmin\Import;
@ -23,6 +22,7 @@ use PhpMyAdmin\Utils\ForeignKey;
use function __;
use function intval;
use function is_numeric;
final class ImportController extends AbstractController
{
@ -67,7 +67,7 @@ final class ImportController extends AbstractController
}
$offset = null;
if (Core::isValid($_REQUEST['offset'], 'numeric')) {
if (isset($_REQUEST['offset']) && is_numeric($_REQUEST['offset'])) {
$offset = intval($_REQUEST['offset']);
}

5
libraries/classes/Controllers/Setup/ConfigController.php
View File

@ -4,9 +4,10 @@ declare(strict_types=1);
namespace PhpMyAdmin\Controllers\Setup;
use PhpMyAdmin\Core;
use PhpMyAdmin\Setup\ConfigGenerator;
use function is_scalar;
class ConfigController extends AbstractController
{
/**
@ -28,7 +29,7 @@ class ConfigController extends AbstractController
return $this->template->render('setup/config/index', [
'formset' => $params['formset'] ?? '',
'pages' => $pages,
'eol' => Core::isValid($params['eol'], 'similar', 'unix') ? $params['eol'] : 'unix',
'eol' => isset($params['eol']) && is_scalar($params['eol']) ? $params['eol'] : 'unix',
'config' => $config,
'has_check_page_refresh' => $hasCheckPageRefresh,
]);

3
libraries/classes/Controllers/Setup/FormController.php
View File

@ -10,6 +10,7 @@ use PhpMyAdmin\Core;
use PhpMyAdmin\Setup\FormProcessing;
use function __;
use function is_scalar;
use function ob_get_clean;
use function ob_start;
@ -24,7 +25,7 @@ class FormController extends AbstractController
{
$pages = $this->getPages();
$formset = Core::isValid($params['formset'], 'scalar') ? $params['formset'] : null;
$formset = isset($params['formset']) && is_scalar($params['formset']) ? (string) $params['formset'] : '';
$formClass = SetupFormList::get($formset);
if ($formClass === null) {

12
libraries/classes/Controllers/Setup/HomeController.php
View File

@ -5,12 +5,12 @@ declare(strict_types=1);
namespace PhpMyAdmin\Controllers\Setup;
use PhpMyAdmin\Config\ServerConfigChecks;
use PhpMyAdmin\Core;
use PhpMyAdmin\LanguageManager;
use PhpMyAdmin\Sanitize;
use PhpMyAdmin\Setup\Index;
use function __;
use function is_scalar;
use function preg_replace;
use function uniqid;
@ -26,7 +26,9 @@ class HomeController extends AbstractController
$pages = $this->getPages();
// Handle done action info
$actionDone = Core::isValid($params['action_done'], 'scalar') ? $params['action_done'] : '';
$actionDone = isset($params['action_done']) && is_scalar($params['action_done'])
? (string) $params['action_done']
: '';
$actionDone = preg_replace('/[^a-z_]/', '', $actionDone);
// message handling
@ -132,8 +134,6 @@ class HomeController extends AbstractController
$hasCheckPageRefresh = true;
}
$isWindows = (bool) $GLOBALS['config']->get('PMA_IS_WINDOWS');
return $this->template->render('setup/home/index', [
'formset' => $params['formset'] ?? '',
'languages' => $languages,
@ -142,9 +142,9 @@ class HomeController extends AbstractController
'servers' => $servers,
'pages' => $pages,
'has_check_page_refresh' => $hasCheckPageRefresh,
'eol' => Core::isValid($_SESSION['eol'], 'similar', $isWindows ? 'win' : 'unix')
'eol' => isset($_SESSION['eol']) && is_scalar($_SESSION['eol'])
? $_SESSION['eol']
: ($isWindows ? 'win' : 'unix'),
: ($GLOBALS['config']->get('PMA_IS_WINDOWS') ? 'win' : 'unix'),
]);
}
}

6
libraries/classes/Controllers/Setup/ServersController.php
View File

@ -5,9 +5,9 @@ declare(strict_types=1);
namespace PhpMyAdmin\Controllers\Setup;
use PhpMyAdmin\Config\Forms\Setup\ServersForm;
use PhpMyAdmin\Core;
use PhpMyAdmin\Setup\FormProcessing;
use function is_numeric;
use function ob_get_clean;
use function ob_start;
@ -22,7 +22,7 @@ class ServersController extends AbstractController
{
$pages = $this->getPages();
$id = Core::isValid($params['id'], 'numeric') ? (int) $params['id'] : null;
$id = isset($params['id']) && is_numeric($params['id']) ? (int) $params['id'] : null;
$hasServer = ! empty($id) && $this->config->get('Servers/' . $id) !== null;
if (! $hasServer && ($params['mode'] !== 'revert' && $params['mode'] !== 'edit')) {
@ -49,7 +49,7 @@ class ServersController extends AbstractController
*/
public function destroy(array $params): void
{
$id = Core::isValid($params['id'], 'numeric') ? (int) $params['id'] : null;
$id = isset($params['id']) && is_numeric($params['id']) ? (int) $params['id'] : null;
$hasServer = ! empty($id) && $this->config->get('Servers/' . $id) !== null;

5
libraries/classes/Controllers/Table/GisVisualizationController.php
View File

@ -16,6 +16,7 @@ use PhpMyAdmin\Util;
use function __;
use function array_merge;
use function is_array;
/**
* Handles creation of the GIS visualizations.
@ -92,9 +93,9 @@ final class GisVisualizationController extends AbstractController
// Get settings if any posted
$visualizationSettings = [];
// Download as PNG/SVG/PDF use _GET and the normal form uses _POST
if (Core::isValid($_POST['visualizationSettings'], 'array')) {
if (isset($_POST['visualizationSettings']) && is_array($_POST['visualizationSettings'])) {
$visualizationSettings = $_POST['visualizationSettings'];
} elseif (Core::isValid($_GET['visualizationSettings'], 'array')) {
} elseif (isset($_GET['visualizationSettings']) && is_array($_GET['visualizationSettings'])) {
$visualizationSettings = $_GET['visualizationSettings'];
}

4
libraries/classes/Controllers/Table/ImportController.php
View File

@ -7,7 +7,6 @@ namespace PhpMyAdmin\Controllers\Table;
use PhpMyAdmin\Charsets;
use PhpMyAdmin\Charsets\Charset;
use PhpMyAdmin\Config\PageSettings;
use PhpMyAdmin\Core;
use PhpMyAdmin\DatabaseInterface;
use PhpMyAdmin\DbTableExists;
use PhpMyAdmin\Encoding;
@ -23,6 +22,7 @@ use PhpMyAdmin\Utils\ForeignKey;
use function __;
use function intval;
use function is_numeric;
final class ImportController extends AbstractController
{
@ -75,7 +75,7 @@ final class ImportController extends AbstractController
}
$offset = null;
if (Core::isValid($_REQUEST['offset'], 'numeric')) {
if (isset($_REQUEST['offset']) && is_numeric($_REQUEST['offset'])) {
$offset = intval($_REQUEST['offset']);
}

6
libraries/classes/Controllers/ViewCreateController.php
View File

@ -5,7 +5,6 @@ declare(strict_types=1);
namespace PhpMyAdmin\Controllers;
use PhpMyAdmin\Controllers\Table\StructureController;
use PhpMyAdmin\Core;
use PhpMyAdmin\DatabaseInterface;
use PhpMyAdmin\Html\Generator;
use PhpMyAdmin\Message;
@ -22,6 +21,7 @@ use function array_merge;
use function explode;
use function htmlspecialchars;
use function in_array;
use function is_array;
use function is_string;
use function sprintf;
use function str_contains;
@ -109,7 +109,7 @@ class ViewCreateController extends AbstractController
$sql_query = 'ALTER';
}
if (Core::isValid($_POST['view']['algorithm'], $view_algorithm_options)) {
if (isset($_POST['view']['algorithm']) && in_array($_POST['view']['algorithm'], $view_algorithm_options)) {
$sql_query .= $sep . ' ALGORITHM = ' . $_POST['view']['algorithm'];
}
@ -273,7 +273,7 @@ class ViewCreateController extends AbstractController
}
}
if (Core::isValid($_POST['view'], 'array')) {
if (isset($_POST['view']) && is_array($_POST['view'])) {
$view = array_merge($view, $_POST['view']);
}

124
libraries/classes/Core.php
View File

@ -19,7 +19,6 @@ use function explode;
use function filter_var;
use function function_exists;
use function getenv;
use function gettype;
use function gmdate;
use function hash_equals;
use function hash_hmac;
@ -29,8 +28,6 @@ use function http_build_query;
use function in_array;
use function intval;
use function is_array;
use function is_numeric;
use function is_scalar;
use function is_string;
use function json_encode;
use function mb_strlen;
@ -64,127 +61,6 @@ use const FILTER_VALIDATE_IP;
*/
class Core
{
/**
* checks given $var against $type or $compare
*
* $type can be:
* - false : no type checking
* - 'scalar' : whether type of $var is integer, float, string or boolean
* - 'numeric' : whether type of $var is any number representation
* - 'length' : whether type of $var is scalar with a string length > 0
* - 'similar' : whether type of $var is similar to type of $compare
* - 'equal' : whether type of $var is identical to type of $compare
* - 'identical' : whether $var is identical to $compare, not only the type!
* - or any other valid PHP variable type
*
* <code>
* // $_REQUEST['doit'] = true;
* Core::isValid($_REQUEST['doit'], 'identical', 'true'); // false
* // $_REQUEST['doit'] = 'true';
* Core::isValid($_REQUEST['doit'], 'identical', 'true'); // true
* </code>
*
* NOTE: call-by-reference is used to not get NOTICE on undefined vars,
* but the var is not altered inside this function, also after checking a var
* this var exists nut is not set, example:
* <code>
* // $var is not set
* isset($var); // false
* functionCallByReference($var); // false
* isset($var); // true
* functionCallByReference($var); // true
* </code>
*
* to avoid this we set this var to null if not isset
*
* @see https://www.php.net/gettype
*
* @param mixed $var variable to check
* @param mixed $type var type or array of valid values to check against $var
* @param mixed $compare var to compare with $var
*
* @return bool whether valid or not
*
* @todo add some more var types like hex, bin, ...?
*/
public static function isValid(&$var, $type = 'length', $compare = null): bool
{
if (! isset($var)) {
// var is not even set
return false;
}
if ($type === false) {
// no vartype requested
return true;
}
if (is_array($type)) {
return in_array($var, $type);
}
// allow some aliases of var types
$type = strtolower($type);
switch ($type) {
case 'identic':
$type = 'identical';
break;
case 'len':
$type = 'length';
break;
case 'bool':
$type = 'boolean';
break;
case 'float':
$type = 'double';
break;
case 'int':
$type = 'integer';
break;
case 'null':
$type = 'NULL';
break;
}
if ($type === 'identical') {
return $var === $compare;
}
// whether we should check against given $compare
if ($type === 'similar') {
switch (gettype($compare)) {
case 'string':
case 'boolean':
$type = 'scalar';
break;
case 'integer':
case 'double':
$type = 'numeric';
break;
default:
$type = gettype($compare);
}
} elseif ($type === 'equal') {
$type = gettype($compare);
}
// do the check
if ($type === 'length' || $type === 'scalar') {
$is_scalar = is_scalar($var);
if ($is_scalar && $type === 'length') {
return strlen((string) $var) > 0;
}
return $is_scalar;
}
if ($type === 'numeric') {
return is_numeric($var);
}
return gettype($var) === $type;
}
/**
* Removes insecure parts in a path; used before include() or
* require() when a part of the path comes from an insecure source

29
libraries/classes/Database/Qbe.php
View File

@ -7,7 +7,6 @@ declare(strict_types=1);
namespace PhpMyAdmin\Database;
use PhpMyAdmin\Core;
use PhpMyAdmin\DatabaseInterface;
use PhpMyAdmin\Html\Generator;
use PhpMyAdmin\Message;
@ -28,6 +27,8 @@ use function explode;
use function htmlspecialchars;
use function implode;
use function in_array;
use function is_array;
use function is_numeric;
use function key;
use function max;
use function mb_strlen;
@ -83,14 +84,14 @@ class Qbe
* Whether to insert a new column
*
* @access private
* @var array
* @var array|null
*/
private $criteriaColumnInsert;
/**
* Whether to delete a column
*
* @access private
* @var array
* @var array|null
*/
private $criteriaColumnDelete;
/**
@ -311,10 +312,10 @@ class Qbe
{
$criteriaColumnCount = $this->initializeCriteriasCount();
$this->criteriaColumnInsert = Core::isValid($_POST['criteriaColumnInsert'], 'array', null)
$this->criteriaColumnInsert = isset($_POST['criteriaColumnInsert']) && is_array($_POST['criteriaColumnInsert'])
? $_POST['criteriaColumnInsert']
: null;
$this->criteriaColumnDelete = Core::isValid($_POST['criteriaColumnDelete'], 'array', null)
$this->criteriaColumnDelete = isset($_POST['criteriaColumnDelete']) && is_array($_POST['criteriaColumnDelete'])
? $_POST['criteriaColumnDelete']
: null;
@ -343,7 +344,7 @@ class Qbe
private function setCriteriaTablesAndColumns()
{
// The tables list sent by a previously submitted form
if (Core::isValid($_POST['TableList'], 'array')) {
if (isset($_POST['TableList']) && is_array($_POST['TableList'])) {
foreach ($_POST['TableList'] as $eachTable) {
$this->criteriaTables[$eachTable] = ' selected="selected"';
}
@ -1842,11 +1843,11 @@ class Qbe
private function initializeCriteriasCount(): int
{
// sets column count
$criteriaColumnCount = Core::isValid($_POST['criteriaColumnCount'], 'numeric', 3)
? $_POST['criteriaColumnCount']
$criteriaColumnCount = isset($_POST['criteriaColumnCount']) && is_numeric($_POST['criteriaColumnCount'])
? (int) $_POST['criteriaColumnCount']
: 3;
$criteriaColumnAdd = Core::isValid($_POST['criteriaColumnAdd'], 'numeric', 0)
? $_POST['criteriaColumnAdd']
$criteriaColumnAdd = isset($_POST['criteriaColumnAdd']) && is_numeric($_POST['criteriaColumnAdd'])
? (int) $_POST['criteriaColumnAdd']
: 0;
$this->criteriaColumnCount = max(
$criteriaColumnCount + $criteriaColumnAdd,
@ -1854,14 +1855,16 @@ class Qbe
);
// sets row count
$rows = Core::isValid($_POST['rows'], 'numeric', 0) ? $_POST['rows'] : 0;
$criteriaRowAdd = Core::isValid($_POST['criteriaRowAdd'], 'numeric', 0) ? $_POST['criteriaRowAdd'] : 0;
$rows = isset($_POST['rows']) && is_numeric($_POST['rows']) ? (int) $_POST['rows'] : 0;
$criteriaRowAdd = isset($_POST['criteriaRowAdd']) && is_numeric($_POST['criteriaRowAdd'])
? (int) $_POST['criteriaRowAdd']
: 0;
$this->criteriaRowCount = min(
100,
max($rows + $criteriaRowAdd, 0)
);
return (int) $criteriaColumnCount;
return $criteriaColumnCount;
}
/**

3
libraries/classes/DatabaseInterface.php
View File

@ -36,6 +36,7 @@ use function count;
use function defined;
use function explode;
use function implode;
use function in_array;
use function is_array;
use function is_int;
use function is_string;
@ -1591,7 +1592,7 @@ class DatabaseInterface implements DbalInterface
if (! $GLOBALS['cfg']['Server']['DisableIS']) {
$query = QueryGenerator::getInformationSchemaRoutinesRequest(
$this->escapeString($db),
Core::isValid($which, ['FUNCTION', 'PROCEDURE']) ? $which : null,
isset($which) && in_array($which, ['FUNCTION', 'PROCEDURE']) ? $which : null,
empty($name) ? null : $this->escapeString($name)
);
$result = $this->fetchResult($query);

30
libraries/classes/Display/Results.php
View File

@ -46,8 +46,10 @@ use function file_exists;
use function floor;
use function htmlspecialchars;
use function implode;
use function in_array;
use function intval;
use function is_array;
use function is_numeric;
use function json_encode;
use function mb_check_encoding;
use function mb_strlen;
@ -3810,9 +3812,7 @@ class Results
// The value can also be from _GET as described on issue #16146 when sorting results
$sessionMaxRows = $_GET['session_max_rows'] ?? $_POST['session_max_rows'] ?? '';
// as this is a form value, the type is always string so we cannot
// use Core::isValid($_POST['session_max_rows'], 'integer')
if (Core::isValid($sessionMaxRows, 'numeric')) {
if (isset($sessionMaxRows) && is_numeric($sessionMaxRows)) {
$query['max_rows'] = (int) $sessionMaxRows;
unset($_GET['session_max_rows'], $_POST['session_max_rows']);
} elseif ($sessionMaxRows === self::ALL_ROWS) {
@ -3822,7 +3822,7 @@ class Results
$query['max_rows'] = intval($GLOBALS['cfg']['MaxRows']);
}
if (Core::isValid($_REQUEST['pos'], 'numeric')) {
if (isset($_REQUEST['pos']) && is_numeric($_REQUEST['pos'])) {
$query['pos'] = (int) $_REQUEST['pos'];
unset($_REQUEST['pos']);
} elseif (empty($query['pos'])) {
@ -3830,12 +3830,9 @@ class Results
}
if (
Core::isValid(
isset($_REQUEST['pftext']) && in_array(
$_REQUEST['pftext'],
[
self::DISPLAY_PARTIAL_TEXT,
self::DISPLAY_FULL_TEXT,
]
[self::DISPLAY_PARTIAL_TEXT, self::DISPLAY_FULL_TEXT]
)
) {
$query['pftext'] = $_REQUEST['pftext'];
@ -3845,12 +3842,9 @@ class Results
}
if (
Core::isValid(
isset($_REQUEST['relational_display']) && in_array(
$_REQUEST['relational_display'],
[
self::RELATIONAL_KEY,
self::RELATIONAL_DISPLAY_COLUMN,
]
[self::RELATIONAL_KEY, self::RELATIONAL_DISPLAY_COLUMN]
)
) {
$query['relational_display'] = $_REQUEST['relational_display'];
@ -3863,13 +3857,9 @@ class Results
}
if (
Core::isValid(
isset($_REQUEST['geoOption']) && in_array(
$_REQUEST['geoOption'],
[
self::GEOMETRY_DISP_WKT,
self::GEOMETRY_DISP_WKB,
self::GEOMETRY_DISP_GEOM,
]
[self::GEOMETRY_DISP_WKT, self::GEOMETRY_DISP_WKB, self::GEOMETRY_DISP_GEOM]
)
) {
$query['geoOption'] = $_REQUEST['geoOption'];

11
libraries/classes/Footer.php
View File

@ -14,6 +14,7 @@ use function file_exists;
use function in_array;
use function is_array;
use function is_object;
use function is_scalar;
use function json_encode;
use function json_last_error;
use function strlen;
@ -229,7 +230,11 @@ class Footer
global $dbi;
if (
Core::isValid($_REQUEST['no_history'])
(
isset($_REQUEST['no_history'])
&& is_scalar($_REQUEST['no_history'])
&& strlen((string) $_REQUEST['no_history']) > 0
)
|| ! empty($GLOBALS['error_message'])
|| empty($GLOBALS['sql_query'])
|| ! isset($dbi)
@ -239,8 +244,8 @@ class Footer
}
$this->relation->setHistory(
Core::isValid($GLOBALS['db'], 'similar', '') ? $GLOBALS['db'] : '',
Core::isValid($GLOBALS['table'], 'similar', '') ? $GLOBALS['table'] : '',
isset($GLOBALS['db']) && is_scalar($GLOBALS['db']) ? (string) $GLOBALS['db'] : '',
isset($GLOBALS['table']) && is_scalar($GLOBALS['table']) ? (string) $GLOBALS['table'] : '',
$GLOBALS['cfg']['Server']['user'],
$GLOBALS['sql_query']
);

11
libraries/classes/Operations.php
View File

@ -12,6 +12,7 @@ use function __;
use function array_merge;
use function count;
use function explode;
use function is_scalar;
use function mb_strtolower;
use function str_replace;
use function strlen;
@ -1020,7 +1021,7 @@ class Operations
/**
* A target table name has been sent to this script -> do the work
*/
if (Core::isValid($_POST['new_name'])) {
if (isset($_POST['new_name']) && is_scalar($_POST['new_name']) && strlen((string) $_POST['new_name']) > 0) {
if ($db == $_POST['target_db'] && $table == $_POST['new_name']) {
if (isset($_POST['submit_move'])) {
$message = Message::error(__('Can\'t move table to same one!'));
@ -1032,7 +1033,7 @@ class Operations
$db,
$table,
$_POST['target_db'],
$_POST['new_name'],
(string) $_POST['new_name'],
$_POST['what'],
isset($_POST['submit_move']),
'one_table'
@ -1047,14 +1048,14 @@ class Operations
$db,
$table,
$_POST['target_db'],
$_POST['new_name']
(string) $_POST['new_name']
);
} else {
$this->adjustPrivilegesCopyTable(
$db,
$table,
$_POST['target_db'],
$_POST['new_name']
(string) $_POST['new_name']
);
}
@ -1089,7 +1090,7 @@ class Operations
. Util::backquote($table);
$message->addParam($old);
$new_name = $_POST['new_name'];
$new_name = (string) $_POST['new_name'];
if ($this->dbi->getLowerCaseNames() === '1') {
$new_name = strtolower($new_name);
}

5
libraries/classes/Partitioning/TablePartitionDefinition.php
View File

@ -4,11 +4,10 @@ declare(strict_types=1);
namespace PhpMyAdmin\Partitioning;
use PhpMyAdmin\Core;
use function array_intersect_key;
use function array_merge;
use function array_splice;
use function is_numeric;
use function min;
final class TablePartitionDefinition
@ -83,7 +82,7 @@ final class TablePartitionDefinition
*/
private static function extractPartitionCount(string $paramLabel): int
{
if (Core::isValid($_POST[$paramLabel], 'numeric')) {
if (isset($_POST[$paramLabel]) && is_numeric($_POST[$paramLabel])) {
// MySQL's limit is 8192, so do not allow more
// @see https://dev.mysql.com/doc/refman/en/partitioning-limitations.html
$count = min((int) $_POST[$paramLabel], 8192);

22
libraries/classes/Relation.php
View File

@ -27,6 +27,7 @@ use function implode;
use function in_array;
use function is_array;
use function is_bool;
use function is_scalar;
use function is_string;
use function ksort;
use function mb_check_encoding;
@ -1432,20 +1433,31 @@ class Relation
$top = [];
$bottom = [];
if ($foreign_display) {
if (Core::isValid($GLOBALS['cfg']['ForeignKeyDropdownOrder'], 'array')) {
if (Core::isValid($GLOBALS['cfg']['ForeignKeyDropdownOrder'][0])) {
if (
isset($GLOBALS['cfg']['ForeignKeyDropdownOrder'])
&& is_array($GLOBALS['cfg']['ForeignKeyDropdownOrder'])
) {
if (
isset($GLOBALS['cfg']['ForeignKeyDropdownOrder'][0])
&& is_scalar($GLOBALS['cfg']['ForeignKeyDropdownOrder'][0])
&& strlen((string) $GLOBALS['cfg']['ForeignKeyDropdownOrder'][0]) > 0
) {
$top = $this->buildForeignDropdown(
$foreign,
$data,
$GLOBALS['cfg']['ForeignKeyDropdownOrder'][0]
(string) $GLOBALS['cfg']['ForeignKeyDropdownOrder'][0]
);
}
if (Core::isValid($GLOBALS['cfg']['ForeignKeyDropdownOrder'][1])) {
if (
isset($GLOBALS['cfg']['ForeignKeyDropdownOrder'][1])
&& is_scalar($GLOBALS['cfg']['ForeignKeyDropdownOrder'][1])
&& strlen((string) $GLOBALS['cfg']['ForeignKeyDropdownOrder'][1]) > 0
) {
$bottom = $this->buildForeignDropdown(
$foreign,
$data,
$GLOBALS['cfg']['ForeignKeyDropdownOrder'][1]
(string) $GLOBALS['cfg']['ForeignKeyDropdownOrder'][1]
);
}
} else {

7
libraries/classes/ResponseRenderer.php
View File

@ -11,6 +11,7 @@ use function defined;
use function headers_sent;
use function http_response_code;
use function is_array;
use function is_scalar;
use function json_encode;
use function json_last_error_msg;
use function mb_strlen;
@ -376,8 +377,10 @@ class ResponseRenderer
$this->addJSON(
'reloadQuerywindow',
[
'db' => Core::isValid($GLOBALS['db'], 'similar', '') ? $GLOBALS['db'] : '',
'table' => Core::isValid($GLOBALS['table'], 'similar', '') ? $GLOBALS['table'] : '',
'db' => isset($GLOBALS['db']) && is_scalar($GLOBALS['db'])
? (string) $GLOBALS['db'] : '',
'table' => isset($GLOBALS['table']) && is_scalar($GLOBALS['table'])
? (string) $GLOBALS['table'] : '',
'sql_query' => $query,
]
);

53
libraries/classes/Server/Privileges.php
View File

@ -8,7 +8,6 @@ declare(strict_types=1);
namespace PhpMyAdmin\Server;
use mysqli_stmt;
use PhpMyAdmin\Core;
use PhpMyAdmin\DatabaseInterface;
use PhpMyAdmin\Html\Generator;
use PhpMyAdmin\Html\MySQLDocumentation;
@ -31,6 +30,8 @@ use function htmlspecialchars;
use function implode;
use function in_array;
use function is_array;
use function is_scalar;
use function is_string;
use function json_decode;
use function ksort;
use function max;
@ -2864,18 +2865,34 @@ class Privileges
/**
* Checks if a dropdown box has been used for selecting a database / table
*/
if (Core::isValid($_POST['pred_tablename'])) {
$tablename = $_POST['pred_tablename'];
} elseif (Core::isValid($_REQUEST['tablename'])) {
$tablename = $_REQUEST['tablename'];
if (
isset($_POST['pred_tablename'])
&& is_scalar($_POST['pred_tablename'])
&& strlen((string) $_POST['pred_tablename']) > 0
) {
$tablename = (string) $_POST['pred_tablename'];
} elseif (
isset($_REQUEST['tablename'])
&& is_scalar($_REQUEST['tablename'])
&& strlen((string) $_REQUEST['tablename']) > 0
) {
$tablename = (string) $_REQUEST['tablename'];
} else {
unset($tablename);
}
if (Core::isValid($_POST['pred_routinename'])) {
$routinename = $_POST['pred_routinename'];
} elseif (Core::isValid($_REQUEST['routinename'])) {
$routinename = $_REQUEST['routinename'];
if (
isset($_POST['pred_routinename'])
&& is_scalar($_POST['pred_routinename'])
&& strlen((string) $_POST['pred_routinename']) > 0
) {
$routinename = (string) $_POST['pred_routinename'];
} elseif (
isset($_REQUEST['routinename'])
&& is_scalar($_REQUEST['routinename'])
&& strlen((string) $_REQUEST['routinename']) > 0
) {
$routinename = (string) $_REQUEST['routinename'];
} else {
unset($routinename);
}
@ -2883,7 +2900,7 @@ class Privileges
if (isset($_POST['pred_dbname'])) {
$isValidPredDbname = true;
foreach ($_POST['pred_dbname'] as $key => $dbName) {
if (! Core::isValid($dbName)) {
if (! isset($dbName) || ! is_scalar($dbName) || strlen((string) $dbName) === 0) {
$isValidPredDbname = false;
break;
}
@ -2894,13 +2911,17 @@ class Privileges
$isValidDbname = true;
if (is_array($_REQUEST['dbname'])) {
foreach ($_REQUEST['dbname'] as $key => $dbName) {
if (! Core::isValid($dbName)) {
if (! isset($dbName) || ! is_scalar($dbName) || strlen((string) $dbName) === 0) {
$isValidDbname = false;
break;
}
}
} else {
if (! Core::isValid($_REQUEST['dbname'])) {
if (
! isset($_REQUEST['dbname'])
|| ! is_scalar($_REQUEST['dbname'])
|| strlen((string) $_REQUEST['dbname']) === 0
) {
$isValidDbname = false;
}
}
@ -2913,7 +2934,7 @@ class Privileges
$dbname = $dbname[0];
}
} elseif (isset($isValidDbname) && $isValidDbname) {
$dbname = $_REQUEST['dbname'];
$dbname = (string) $_REQUEST['dbname'];
} else {
unset($dbname, $tablename);
}
@ -3274,10 +3295,10 @@ class Privileges
$privilegesTable = $this->getHtmlToDisplayPrivilegesTable(
// If $dbname is an array, pass any one db as all have same privs.
Core::isValid($dbname, 'length', is_array($dbname) ? $dbname[0] : '*')
is_string($dbname) && strlen($dbname) > 0
? $dbname
: (is_array($dbname) ? $dbname[0] : '*'),
Core::isValid($tablename, 'length', '*')
: (is_array($dbname) ? (string) $dbname[0] : '*'),
strlen($tablename) > 0
? $tablename
: '*'
);

5
libraries/classes/Setup/FormProcessing.php
View File

@ -8,11 +8,12 @@ declare(strict_types=1);
namespace PhpMyAdmin\Setup;
use PhpMyAdmin\Config\FormDisplay;
use PhpMyAdmin\Core;
use PhpMyAdmin\ResponseRenderer;
use PhpMyAdmin\Template;
use PhpMyAdmin\Url;
use function is_numeric;
/**
* PhpMyAdmin\Setup\FormProcessing class
*/
@ -54,7 +55,7 @@ class FormProcessing
// form has errors, show warning
$page = $_GET['page'] ?? '';
$formset = $_GET['formset'] ?? '';
$formId = Core::isValid($_GET['id'], 'numeric') ? $_GET['id'] : '';
$formId = isset($_GET['id']) && is_numeric($_GET['id']) ? (int) $_GET['id'] : null;
if ($formId === null && $page === 'servers') {
// we've just added a new server, get its id
$formId = $form_display->getConfigFile()->getServerCount();

8
libraries/classes/UserPassword.php
View File

@ -135,13 +135,7 @@ class UserPassword
*/
private function changePassHashingFunction()
{
if (
Core::isValid(
$_POST['authentication_plugin'],
'identical',
'mysql_old_password'
)
) {
if (isset($_POST['authentication_plugin']) && $_POST['authentication_plugin'] === 'mysql_old_password') {
$hashing_function = 'OLD_PASSWORD';
} else {
$hashing_function = 'PASSWORD';

13
libraries/classes/Util.php
View File

@ -46,6 +46,7 @@ use function ini_get;
use function is_array;
use function is_callable;
use function is_object;
use function is_scalar;
use function is_string;
use function log10;
use function mb_detect_encoding;
@ -2474,8 +2475,12 @@ class Util
if (count($sotCache) > 0) {
$tblGroupSql = '';
$whereAdded = false;
if (Core::isValid($_REQUEST['tbl_group'])) {
$group = self::escapeMysqlWildcards($_REQUEST['tbl_group']);
if (
isset($_REQUEST['tbl_group'])
&& is_scalar($_REQUEST['tbl_group'])
&& strlen((string) $_REQUEST['tbl_group']) > 0
) {
$group = self::escapeMysqlWildcards((string) $_REQUEST['tbl_group']);
$groupWithSeparator = self::escapeMysqlWildcards(
$_REQUEST['tbl_group']
. $GLOBALS['cfg']['NavigationTreeTableSeparator']
@ -2489,7 +2494,7 @@ class Util
$whereAdded = true;
}
if (Core::isValid($_REQUEST['tbl_type'], ['table', 'view'])) {
if (isset($_REQUEST['tbl_type']) && in_array($_REQUEST['tbl_type'], ['table', 'view'])) {
$tblGroupSql .= $whereAdded ? ' AND' : ' WHERE';
if ($_REQUEST['tbl_type'] === 'view') {
$tblGroupSql .= " `Table_type` NOT IN ('BASE TABLE', 'SYSTEM VERSIONED')";
@ -2761,7 +2766,7 @@ class Util
'sort_order' => $futureSortOrder,
];
if (Core::isValid($_REQUEST['tbl_type'], ['view', 'table'])) {
if (isset($_REQUEST['tbl_type']) && in_array($_REQUEST['tbl_type'], ['view', 'table'])) {
$urlParams['tbl_type'] = $_REQUEST['tbl_type'];
}

171
psalm-baseline.xml
View File

@ -422,18 +422,15 @@
</NonInvariantDocblockPropertyType>
</file>
<file src="libraries/classes/Common.php">
<MixedArgument occurrences="13">
<code>$_POST['token']</code>
<MixedArgument occurrences="10">
<code>$_REQUEST['back']</code>
<code>$_REQUEST['goto']</code>
<code>$_SESSION[' PMA_token ']</code>
<code>$back</code>
<code>$cfg['Server']['user']</code>
<code>$db</code>
<code>$goto</code>
<code>$sqlDelimiter</code>
<code>$sql_query</code>
<code>$table</code>
<code>$urlParams</code>
<code>$urlParams</code>
</MixedArgument>
@ -447,19 +444,15 @@
<code>$urlParams['goto']</code>
<code>$urlParams['table']</code>
</MixedArrayAssignment>
<MixedAssignment occurrences="13">
<MixedAssignment occurrences="9">
<code>$back</code>
<code>$controlLink</code>
<code>$databaseFromRequest</code>
<code>$db</code>
<code>$goto</code>
<code>$sqlDelimiter</code>
<code>$sql_query</code>
<code>$table</code>
<code>$tableFromRequest</code>
<code>$urlParams['db']</code>
<code>$urlParams['goto']</code>
<code>$urlParams['table']</code>
<code>$userLink</code>
</MixedAssignment>
</file>
@ -2795,29 +2788,16 @@
</PossiblyNullArrayAccess>
</file>
<file src="libraries/classes/Controllers/Setup/FormController.php">
<MixedArgument occurrences="1">
<code>$formset</code>
</MixedArgument>
<MixedAssignment occurrences="1">
<code>$formset</code>
</MixedAssignment>
<PossiblyNullArgument occurrences="1">
<code>$formset</code>
</PossiblyNullArgument>
<UndefinedClass occurrences="1">
<code>new $formClass($this-&gt;config)</code>
</UndefinedClass>
</file>
<file src="libraries/classes/Controllers/Setup/HomeController.php">
<MixedArgument occurrences="1">
<code>$actionDone</code>
</MixedArgument>
<MixedArgumentTypeCoercion occurrences="2">
<code>$id</code>
<code>$id</code>
</MixedArgumentTypeCoercion>
<MixedAssignment occurrences="2">
<code>$actionDone</code>
<MixedAssignment occurrences="1">
<code>$server</code>
</MixedAssignment>
<UnusedForeachValue occurrences="1">
@ -3262,14 +3242,13 @@
</MixedOperand>
</file>
<file src="libraries/classes/Controllers/Table/GisVisualizationController.php">
<MixedArgument occurrences="8">
<MixedArgument occurrences="7">
<code>$_GET['fileFormat']</code>
<code>$_GET['sql_query']</code>
<code>$_GET['sql_signature']</code>
<code>$result</code>
<code>$sqlQuery</code>
<code>$urlParams</code>
<code>$visualizationSettings</code>
<code>$visualizationSettings['spatialColumn']</code>
</MixedArgument>
<MixedArgumentTypeCoercion occurrences="1">
@ -3279,23 +3258,17 @@
<code>$_SESSION['tmpval']['max_rows']</code>
<code>$_SESSION['tmpval']['pos']</code>
</MixedArrayAccess>
<MixedArrayAssignment occurrences="8">
<MixedArrayAssignment occurrences="4">
<code>$urlParams['back']</code>
<code>$urlParams['goto']</code>
<code>$urlParams['sql_query']</code>
<code>$urlParams['sql_signature']</code>
<code>$visualizationSettings['isMariaDB']</code>
<code>$visualizationSettings['labelColumn']</code>
<code>$visualizationSettings['mysqlVersion']</code>
<code>$visualizationSettings['spatialColumn']</code>
</MixedArrayAssignment>
<MixedAssignment occurrences="7">
<MixedAssignment occurrences="5">
<code>$result</code>
<code>$sqlQuery</code>
<code>$sqlQuery</code>
<code>$val</code>
<code>$visualizationSettings</code>
<code>$visualizationSettings</code>
<code>$visualizationSettings[$setting]</code>
</MixedAssignment>
<PropertyNotSetInConstructor occurrences="1">
@ -4302,12 +4275,11 @@
<DocblockTypeContradiction occurrences="1">
<code>$view['as']</code>
</DocblockTypeContradiction>
<MixedArgument occurrences="15">
<MixedArgument occurrences="14">
<code>$_GET['db']</code>
<code>$_GET['db']</code>
<code>$_GET['table']</code>
<code>$_GET['table']</code>
<code>$_POST['view']</code>
<code>$_POST['view']['as']</code>
<code>$_POST['view']['column_names']</code>
<code>$_POST['view']['definer']</code>
@ -4322,9 +4294,7 @@
<MixedArgumentTypeCoercion occurrences="1">
<code>['db' =&gt; $db]</code>
</MixedArgumentTypeCoercion>
<MixedArrayAccess occurrences="10">
<code>$_POST['view']['algorithm']</code>
<code>$_POST['view']['algorithm']</code>
<MixedArrayAccess occurrences="8">
<code>$_POST['view']['as']</code>
<code>$_POST['view']['as']</code>
<code>$_POST['view']['column_names']</code>
@ -4395,7 +4365,7 @@
<code>$i</code>
<code>$i</code>
</LoopInvalidation>
<MixedArgument occurrences="8">
<MixedArgument occurrences="7">
<code>$GLOBALS[$post_key]</code>
<code>$GLOBALS['cfg']['TrustedProxies'][$direct_ip]</code>
<code>$one_post_pattern</code>
@ -4403,7 +4373,6 @@
<code>$query</code>
<code>$tables</code>
<code>$tables</code>
<code>$type</code>
</MixedArgument>
<MixedArgumentTypeCoercion occurrences="2">
<code>$post_key</code>
@ -4463,11 +4432,6 @@
<TypeDoesNotContainType occurrences="1">
<code>is_string($data)</code>
</TypeDoesNotContainType>
<UnusedVariable occurrences="3">
<code>$type</code>
<code>$type</code>
<code>$type</code>
</UnusedVariable>
</file>
<file src="libraries/classes/CreateAddField.php">
<MixedArgument occurrences="39">
@ -5243,16 +5207,13 @@
<code>$tsize[$table]</code>
<code>$tsize[$table]</code>
</MixedArrayOffset>
<MixedAssignment occurrences="62">
<MixedAssignment occurrences="54">
<code>$GLOBALS[${'cur' . $or}][$newColumnCount]</code>
<code>$allTables</code>
<code>$clause</code>
<code>$clause</code>
<code>$column</code>
<code>$columnReferences</code>
<code>$criteriaColumnAdd</code>
<code>$criteriaColumnCount</code>
<code>$criteriaRowAdd</code>
<code>$eachColumn</code>
<code>$eachTable</code>
<code>$eachTable</code>
@ -5279,7 +5240,6 @@
<code>$oneTable</code>
<code>$reference</code>
<code>$result</code>
<code>$rows</code>
<code>$select</code>
<code>$selectClauses[]</code>
<code>$selected</code>
@ -5291,10 +5251,6 @@
<code>$this-&gt;criteria</code>
<code>$this-&gt;criteriaAndOrColumn</code>
<code>$this-&gt;criteriaAndOrRow</code>
<code>$this-&gt;criteriaColumnCount</code>
<code>$this-&gt;criteriaColumnDelete</code>
<code>$this-&gt;criteriaColumnInsert</code>
<code>$this-&gt;criteriaRowCount</code>
<code>$this-&gt;criteriaRowDelete</code>
<code>$this-&gt;criteriaRowInsert</code>
<code>$this-&gt;prevCriteria</code>
@ -5311,12 +5267,10 @@
<code>array</code>
<code>string</code>
</MixedInferredReturnType>
<MixedOperand occurrences="29">
<MixedOperand occurrences="27">
<code>$_POST['Or' . $rowIndex][$columnIndex]</code>
<code>$clause</code>
<code>$columns[$columnIndex]</code>
<code>$criteriaColumnAdd</code>
<code>$criteriaRowAdd</code>
<code>$eachTable</code>
<code>$eachTable</code>
<code>$index['Column_name']</code>
@ -5857,7 +5811,7 @@
<code>$a</code>
<code>$b</code>
</MissingClosureParamType>
<MixedArgument occurrences="77">
<MixedArgument occurrences="76">
<code>$_SERVER['SCRIPT_NAME']</code>
<code>$a</code>
<code>$arrayKeys</code>
@ -5934,7 +5888,6 @@
<code>$user</code>
<code>$user</code>
<code>$warningsCount</code>
<code>Core::isValid($which, ['FUNCTION', 'PROCEDURE']) ? $which : null</code>
</MixedArgument>
<MixedArgumentTypeCoercion occurrences="5">
<code>$field</code>
@ -7204,6 +7157,16 @@
<PropertyNotSetInConstructor occurrences="1">
<code>$isAjax</code>
</PropertyNotSetInConstructor>
<RedundantCast occurrences="2">
<code>(string) $GLOBALS['db']</code>
<code>(string) $GLOBALS['table']</code>
</RedundantCast>
<RedundantCondition occurrences="4">
<code>is_scalar($GLOBALS['db'])</code>
<code>is_scalar($GLOBALS['table'])</code>
<code>isset($GLOBALS['db']) &amp;&amp; is_scalar($GLOBALS['db'])</code>
<code>isset($GLOBALS['table']) &amp;&amp; is_scalar($GLOBALS['table'])</code>
</RedundantCondition>
<TypeDoesNotContainNull occurrences="2">
<code>! isset($dbi)</code>
</TypeDoesNotContainNull>
@ -9807,13 +9770,10 @@
</InvalidReturnType>
</file>
<file src="libraries/classes/Operations.php">
<MixedArgument occurrences="53">
<MixedArgument occurrences="48">
<code>$_POST['comment']</code>
<code>$_POST['db_collation'] ?? ''</code>
<code>$_POST['new_auto_increment']</code>
<code>$_POST['new_name']</code>
<code>$_POST['new_name']</code>
<code>$_POST['new_name']</code>
<code>$_POST['newname']</code>
<code>$_POST['newname']</code>
<code>$_POST['newname']</code>
@ -9846,8 +9806,6 @@
<code>$function_name</code>
<code>$newRowFormat</code>
<code>$newRowFormat</code>
<code>$new_name</code>
<code>$new_name</code>
<code>$old_priv</code>
<code>$one_query</code>
<code>$procedure_name</code>
@ -9923,15 +9881,13 @@
<code>$warning['Level']</code>
<code>$warning['Message']</code>
</MixedArrayAccess>
<MixedAssignment occurrences="23">
<code>$GLOBALS['table']</code>
<MixedAssignment occurrences="21">
<code>$_POST['drop_if_exists']</code>
<code>$arr</code>
<code>$event_name</code>
<code>$foreignTable</code>
<code>$function_name</code>
<code>$newRowFormat</code>
<code>$new_name</code>
<code>$old_priv</code>
<code>$old_priv</code>
<code>$old_priv</code>
@ -13803,11 +13759,12 @@
<PossiblyNullPropertyAssignmentValue occurrences="1">
<code>$dbi</code>
</PossiblyNullPropertyAssignmentValue>
<PossiblyUndefinedArrayOffset occurrences="1">
<code>$GLOBALS['cfg']['ForeignKeyDropdownOrder'][1]</code>
</PossiblyUndefinedArrayOffset>
<RedundantCast occurrences="2">
<RedundantCast occurrences="6">
<code>(int) $GLOBALS['cfg']['LimitChars']</code>
<code>(string) $GLOBALS['cfg']['ForeignKeyDropdownOrder'][0]</code>
<code>(string) $GLOBALS['cfg']['ForeignKeyDropdownOrder'][0]</code>
<code>(string) $GLOBALS['cfg']['ForeignKeyDropdownOrder'][1]</code>
<code>(string) $GLOBALS['cfg']['ForeignKeyDropdownOrder'][1]</code>
<code>(string) $table[1]</code>
</RedundantCast>
<RedundantCastGivenDocblockType occurrences="3">
@ -13815,8 +13772,11 @@
<code>(string) $db</code>
<code>(string) $table</code>
</RedundantCastGivenDocblockType>
<RedundantCondition occurrences="1">
<RedundantCondition occurrences="7">
<code>is_array($GLOBALS['cfg']['ForeignKeyDropdownOrder'])</code>
<code>is_array($table)</code>
<code>is_scalar($GLOBALS['cfg']['ForeignKeyDropdownOrder'][0])</code>
<code>is_scalar($GLOBALS['cfg']['ForeignKeyDropdownOrder'][1])</code>
</RedundantCondition>
<TypeDoesNotContainType occurrences="1">
<code>$vtitle != ''</code>
@ -14032,7 +13992,15 @@
<MixedAssignment occurrences="1">
<code>$value</code>
</MixedAssignment>
<RedundantCondition occurrences="1">
<RedundantCast occurrences="2">
<code>(string) $GLOBALS['db']</code>
<code>(string) $GLOBALS['table']</code>
</RedundantCast>
<RedundantCondition occurrences="5">
<code>is_scalar($GLOBALS['db'])</code>
<code>is_scalar($GLOBALS['table'])</code>
<code>isset($GLOBALS['db']) &amp;&amp; is_scalar($GLOBALS['db'])</code>
<code>isset($GLOBALS['table']) &amp;&amp; is_scalar($GLOBALS['table'])</code>
<code>isset($dbi)</code>
</RedundantCondition>
</file>
@ -14217,7 +14185,7 @@
<code>$result</code>
<code>$result</code>
</InvalidArgument>
<MixedArgument occurrences="127">
<MixedArgument occurrences="121">
<code>$GLOBALS['dbname']</code>
<code>$_GET['initial']</code>
<code>$_GET['initial']</code>
@ -14260,8 +14228,6 @@
<code>$dbRightsRow['Db']</code>
<code>$dbname</code>
<code>$dbname</code>
<code>$dbname</code>
<code>$dbname</code>
<code>$dbname ?? ''</code>
<code>$eachUser</code>
<code>$exportUser</code>
@ -14337,8 +14303,6 @@
<code>$sqlQuery</code>
<code>$sqlQuery</code>
<code>$sqlQuery</code>
<code>$tablename</code>
<code>$tablename</code>
<code>$updQuery</code>
<code>$user</code>
<code>$username</code>
@ -14447,7 +14411,7 @@
<code>$specificPrivileges[$grant[0]]</code>
<code>$specificPrivileges[$grant[0]]</code>
</MixedArrayOffset>
<MixedAssignment occurrences="103">
<MixedAssignment occurrences="98">
<code>$GLOBALS[$key]</code>
<code>$account</code>
<code>$authenticationPlugin</code>
@ -14467,7 +14431,6 @@
<code>$dbRightsResult</code>
<code>$dbname</code>
<code>$dbname</code>
<code>$dbname</code>
<code>$eachUser</code>
<code>$exportUser</code>
<code>$extraData['db_wildcard_privs']</code>
@ -14527,8 +14490,6 @@
<code>$right</code>
<code>$routine</code>
<code>$routine</code>
<code>$routinename</code>
<code>$routinename</code>
<code>$routines[]</code>
<code>$row</code>
<code>$row['password']</code>
@ -14538,8 +14499,6 @@
<code>$selectedUsr</code>
<code>$sqlQuery</code>
<code>$sqlQuery</code>
<code>$tablename</code>
<code>$tablename</code>
<code>$tables[]</code>
<code>$tmpPrivs2['Insert'][]</code>
<code>$tmpPrivs2['References'][]</code>
@ -14628,7 +14587,8 @@
<code>$GLOBALS[$currentGrant[0]]</code>
<code>$dbname</code>
</PossiblyInvalidArgument>
<PossiblyInvalidCast occurrences="1">
<PossiblyInvalidCast occurrences="2">
<code>$_REQUEST['dbname']</code>
<code>$dbname</code>
</PossiblyInvalidCast>
<PossiblyNullArgument occurrences="6">
@ -14653,8 +14613,9 @@
<code>$alterUserQuery</code>
<code>$alterUserQuery</code>
</PossiblyNullOperand>
<PossiblyUndefinedArrayOffset occurrences="1">
<PossiblyUndefinedArrayOffset occurrences="2">
<code>$_POST['pred_dbname']</code>
<code>$_REQUEST['dbname']</code>
</PossiblyUndefinedArrayOffset>
<RedundantCast occurrences="1">
<code>(bool) ! $this-&gt;dbi-&gt;fetchValue($sql)</code>
@ -15023,8 +14984,7 @@
</PossiblyNullOperand>
</file>
<file src="libraries/classes/Setup/FormProcessing.php">
<MixedAssignment occurrences="3">
<code>$formId</code>
<MixedAssignment occurrences="2">
<code>$formset</code>
<code>$page</code>
</MixedAssignment>
@ -16565,8 +16525,7 @@
<code>$table['disp_name']</code>
<code>$units[$d]</code>
</InvalidArrayOffset>
<MixedArgument occurrences="19">
<code>$_REQUEST['tbl_group']</code>
<MixedArgument occurrences="18">
<code>$data</code>
<code>$dbInfoResult</code>
<code>$dbInfoResult</code>
@ -16697,8 +16656,7 @@
<code>$escapeMethod</code>
<code>new $escape[1]()</code>
</MixedMethodCall>
<MixedOperand occurrences="14">
<code>$_REQUEST['tbl_group']</code>
<MixedOperand occurrences="13">
<code>$group[$groupName]['tab' . $sep . 'count']</code>
<code>$row['Column_name']</code>
<code>$tableGroup</code>
@ -16720,7 +16678,8 @@
<code>$group[$groupName]['tab' . $sep . 'count']</code>
<code>$table['disp_name']</code>
</MixedStringOffsetAssignment>
<PossiblyFalseOperand occurrences="2">
<PossiblyFalseOperand occurrences="3">
<code>$GLOBALS['cfg']['NavigationTreeTableSeparator']</code>
<code>mb_strpos($value, '.')</code>
<code>mb_strrpos($columnSpecification, ')')</code>
</PossiblyFalseOperand>
@ -16746,7 +16705,8 @@
<code>$sep</code>
<code>$sep</code>
</PossiblyInvalidCast>
<PossiblyInvalidOperand occurrences="9">
<PossiblyInvalidOperand occurrences="10">
<code>$GLOBALS['cfg']['NavigationTreeTableSeparator']</code>
<code>$sep</code>
<code>$sep</code>
<code>$sep</code>
@ -16991,19 +16951,9 @@
</UnusedVariable>
</file>
<file src="setup/validate.php">
<MixedArgument occurrences="2">
<code>$ids</code>
<code>$vals</code>
</MixedArgument>
<MixedAssignment occurrences="3">
<code>$ids</code>
<code>$vals</code>
<MixedAssignment occurrences="1">
<code>$values</code>
</MixedAssignment>
<PossiblyNullArgument occurrences="2">
<code>$ids</code>
<code>$vals</code>
</PossiblyNullArgument>
</file>
<file src="test/classes/AbstractNetworkTestCase.php">
<MixedAssignment occurrences="1">
@ -17491,14 +17441,7 @@
<code>$arr['sarr'][0]</code>
<code>$arr['sarr'][0]</code>
</MixedArrayAccess>
<MixedAssignment occurrences="3">
<code>$out</code>
<code>$out</code>
<code>$out</code>
</MixedAssignment>
<MixedInferredReturnType occurrences="8">
<code>array</code>
<code>array</code>
<MixedInferredReturnType occurrences="6">
<code>array</code>
<code>array</code>
<code>array</code>

4
setup/config.php
View File

@ -33,7 +33,7 @@ if (isset($_POST['eol'])) {
$_SESSION['eol'] = $_POST['eol'] === 'unix' ? 'unix' : 'win';
}
if (Core::isValid($_POST['submit_clear'], 'similar', '') ? $_POST['submit_clear'] : '') {
if (isset($_POST['submit_clear']) && is_scalar($_POST['submit_clear']) ? $_POST['submit_clear'] : '') {
// Clear current config and return to main page
$GLOBALS['ConfigFile']->resetConfigData();
// drop post data
@ -41,7 +41,7 @@ if (Core::isValid($_POST['submit_clear'], 'similar', '') ? $_POST['submit_clear'
exit;
}
if (Core::isValid($_POST['submit_download'], 'similar', '') ? $_POST['submit_download'] : '') {
if (isset($_POST['submit_download']) && is_scalar($_POST['submit_download']) ? $_POST['submit_download'] : '') {
// Output generated config file
Core::downloadHeader('config.inc.php', 'text/plain');
$response->disable();

2
setup/index.php
View File

@ -32,7 +32,7 @@ if (@file_exists(CONFIG_FILE) && ! $cfg['DBG']['demo']) {
Core::fatalError(__('Configuration already exists, setup is disabled!'));
}
$page = Core::isValid($_GET['page'], 'scalar') ? (string) $_GET['page'] : '';
$page = isset($_GET['page']) && is_scalar($_GET['page']) ? (string) $_GET['page'] : '';
$page = preg_replace('/[^a-z]/', '', $page);
if ($page === '') {
$page = 'index';

4
setup/validate.php
View File

@ -23,9 +23,9 @@ require ROOT_PATH . 'setup/lib/common.inc.php';
Core::headerJSON();
$ids = Core::isValid($_POST['id'], 'scalar') ? $_POST['id'] : null;
$ids = isset($_POST['id']) && is_scalar($_POST['id']) ? (string) $_POST['id'] : '';
$vids = explode(',', $ids);
$vals = Core::isValid($_POST['values'], 'scalar') ? $_POST['values'] : null;
$vals = isset($_POST['values']) && is_scalar($_POST['values']) ? (string) $_POST['values'] : '';
$values = json_decode($vals);
if (! ($values instanceof stdClass)) {
Core::fatalError(__('Wrong data'));

411
test/classes/CoreTest.php
View File

@ -599,49 +599,6 @@ class CoreTest extends AbstractNetworkTestCase
Core::sendHeaderLocation($testUri);
}
/**
* Test for Core::ifSetOr
*/
public function testVarSet(): void
{
$default = 'foo';
$in = 'bar';
$out = Core::isValid($in, 'similar', $default) ? $in : $default;
$this->assertEquals($in, $out);
}
/**
* Test for Core::ifSetOr
*/
public function testVarSetWrongType(): void
{
$default = 'foo';
$in = 'bar';
$out = Core::isValid($in, 'boolean', $default) ? $in : $default;
$this->assertEquals($out, $default);
}
/**
* Test for Core::ifSetOr
*/
public function testVarNotSet(): void
{
$default = 'foo';
// $in is not set!
$out = Core::isValid($in, 'similar', $default) ? $in : $default;
$this->assertEquals($out, $default);
}
/**
* Test for Core::ifSetOr
*/
public function testVarNotSetNoDefault(): void
{
// $in is not set!
$out = Core::isValid($in, 'similar', null) ? $in : null;
$this->assertNull($out);
}
/**
* Test for unserializing
*
@ -702,374 +659,6 @@ class CoreTest extends AbstractNetworkTestCase
];
}
/**
* Test for Core::isValid
*
* @param mixed $var Variable to check
* @param mixed $type Type
* @param mixed $compare Compared value
*
* @dataProvider providerTestNoVarType
*/
public function testNoVarType($var, $type, $compare): void
{
$this->assertTrue(Core::isValid($var, $type, $compare));
}
/**
* Data provider for testNoVarType
*
* @return array
*/
public static function providerTestNoVarType(): array
{
return [
[
0,
false,
0,
],
[
0,
false,
1,
],
[
1,
false,
null,
],
[
1.1,
false,
null,
],
[
'',
false,
null,
],
[
' ',
false,
null,
],
[
'0',
false,
null,
],
[
'string',
false,
null,
],
[
[],
false,
null,
],
[
[
1,
2,
3,
],
false,
null,
],
[
true,
false,
null,
],
[
false,
false,
null,
],
];
}
/**
* Test for Core::isValid
*/
public function testVarNotSetAfterTest(): void
{
Core::isValid($var);
$this->assertFalse(isset($var));
}
/**
* Test for Core::isValid
*/
public function testNotSet(): void
{
$this->assertFalse(Core::isValid($var));
}
/**
* Test for Core::isValid
*/
public function testEmptyString(): void
{
$var = '';
$this->assertFalse(Core::isValid($var));
}
/**
* Test for Core::isValid
*/
public function testNotEmptyString(): void
{
$var = '0';
$this->assertTrue(Core::isValid($var));
}
/**
* Test for Core::isValid
*/
public function testZero(): void
{
$var = 0;
$this->assertTrue(Core::isValid($var));
$this->assertTrue(Core::isValid($var, 'int'));
}
/**
* Test for Core::isValid
*/
public function testNullFail(): void
{
$var = null;
$this->assertFalse(Core::isValid($var));
$var = 'null_text';
$this->assertFalse(Core::isValid($var, 'null'));
}
/**
* Test for Core::isValid
*/
public function testNotSetArray(): void
{
$array = ['x' => null];
$this->assertFalse(Core::isValid($array['x']));
}
/**
* Test for Core::isValid
*/
public function testScalarString(): void
{
$var = 'string';
$this->assertTrue(Core::isValid($var, 'len'));
$this->assertTrue(Core::isValid($var, 'scalar'));
$this->assertTrue(Core::isValid($var));
}
/**
* Test for Core::isValid
*/
public function testScalarInt(): void
{
$var = 1;
$this->assertTrue(Core::isValid($var, 'int'));
$this->assertTrue(Core::isValid($var, 'scalar'));
}
/**
* Test for Core::isValid
*/
public function testScalarFloat(): void
{
$var = 1.1;
$this->assertTrue(Core::isValid($var, 'float'));
$this->assertTrue(Core::isValid($var, 'double'));
$this->assertTrue(Core::isValid($var, 'scalar'));
}
/**
* Test for Core::isValid
*/
public function testScalarBool(): void
{
$var = true;
$this->assertTrue(Core::isValid($var, 'scalar'));
$this->assertTrue(Core::isValid($var, 'bool'));
$this->assertTrue(Core::isValid($var, 'boolean'));
}
/**
* Test for Core::isValid
*/
public function testNotScalarArray(): void
{
$var = ['test'];
$this->assertFalse(Core::isValid($var, 'scalar'));
}
/**
* Test for Core::isValid
*/
public function testNotScalarNull(): void
{
$var = null;
$this->assertFalse(Core::isValid($var, 'scalar'));
}
/**
* Test for Core::isValid
*/
public function testNumericInt(): void
{
$var = 1;
$this->assertTrue(Core::isValid($var, 'numeric'));
}
/**
* Test for Core::isValid
*/
public function testNumericFloat(): void
{
$var = 1.1;
$this->assertTrue(Core::isValid($var, 'numeric'));
}
/**
* Test for Core::isValid
*/
public function testNumericZero(): void
{
$var = 0;
$this->assertTrue(Core::isValid($var, 'numeric'));
}
/**
* Test for Core::isValid
*/
public function testNumericString(): void
{
$var = '+0.1';
$this->assertTrue(Core::isValid($var, 'numeric'));
}
/**
* Test for Core::isValid
*/
public function testValueInArray(): void
{
$var = 'a';
$this->assertTrue(Core::isValid($var, ['a', 'b']));
}
/**
* Test for Core::isValid
*/
public function testValueNotInArray(): void
{
$var = 'c';
$this->assertFalse(Core::isValid($var, ['a', 'b']));
}
/**
* Test for Core::isValid
*/
public function testNumericIdentical(): void
{
$var = 1;
$compare = 1;
$this->assertTrue(Core::isValid($var, 'identic', $compare));
$var = 1;
$compare += 2;
$this->assertFalse(Core::isValid($var, 'identic', $compare));
$var = 1;
$compare = '1';
$this->assertFalse(Core::isValid($var, 'identic', $compare));
}
/**
* Test for Core::isValid
*
* @param mixed $var Variable
* @param mixed $compare Compare
*
* @dataProvider provideTestSimilarType
*/
public function testSimilarType($var, $compare): void
{
$this->assertTrue(Core::isValid($var, 'similar', $compare));
$this->assertTrue(Core::isValid($var, 'equal', $compare));
$this->assertTrue(Core::isValid($compare, 'similar', $var));
$this->assertTrue(Core::isValid($compare, 'equal', $var));
}
/**
* Data provider for testSimilarType
*
* @return array
*/
public function provideTestSimilarType(): array
{
return [
[
1,
1,
],
[
1.5,
1.5,
],
[
true,
true,
],
[
'string',
'string',
],
[
[
1,
2,
3.4,
],
[
1,
2,
3.4,
],
],
[
[
1,
'2',
'3.4',
5,
'text',
],
[
'1',
'2',
3.4,
'5',
],
],
];
}
/**
* Test for Core::isValid
*/
public function testOtherTypes(): void
{
$var = new class {
};
$this->assertFalse(Core::isValid($var, 'class'));
}
/**
* Test for unserializing
*

8
url.php
View File

@ -57,9 +57,9 @@ $response->getHeader()->sendHttpHeaders();
$response->disable();
if (
! Core::isValid($_GET['url'])
|| ! preg_match('/^https:\/\/[^\n\r]*$/', $_GET['url'])
|| ! Core::isAllowedDomain($_GET['url'])
! isset($_GET['url']) || ! is_scalar($_GET['url']) || strlen((string) $_GET['url']) === 0
|| ! preg_match('/^https:\/\/[^\n\r]*$/', (string) $_GET['url'])
|| ! Core::isAllowedDomain((string) $_GET['url'])
) {
Core::sendHeaderLocation('./');
} else {
@ -69,7 +69,7 @@ if (
// external site.
$template = $containerBuilder->get('template');
echo $template->render('javascript/redirect', [
'url' => Sanitize::escapeJsString($_GET['url']),
'url' => Sanitize::escapeJsString((string) $_GET['url']),
]);
// Display redirecting msg on screen.
// Do not display the value of $_GET['url'] to avoid showing injected content