gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/master'

Browse Source
This commit is contained in:
Weblate 2016-02-22 16:10:53 +01:00
commit 8fa667e7e3
232 changed files with 1413 additions and 1506 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
db_central_columns.php
View File

@ -6,6 +6,8 @@
*
* @package PhpMyAdmin
*/
use PMA\libraries\URL;
/**
* Gets some core libraries
*/
@ -114,7 +116,7 @@ $response->addHTML($table_navigation_html);
$columnAdd = PMA_getHTMLforAddCentralColumn($total_rows, $pos, $db);
$response->addHTML($columnAdd);
$deleteRowForm = '<form method="post" id="del_form" action="db_central_columns.php">'
. PMA_URL_getHiddenInputs(
. URL::getHiddenInputs(
$db
)
. '<input id="del_col_name" type="hidden" name="col_name" value="">'

3
db_datadict.php
View File

@ -5,6 +5,7 @@
*
* @package PhpMyAdmin
*/
use PMA\libraries\URL;
/**
* Gets the variables sent or posted to this script, then displays headers
@ -45,7 +46,7 @@ PMA\libraries\Util::checkParameters(array('db'));
/**
* Defines the url to return to in case of error in a sql statement
*/
$err_url = 'db_sql.php' . PMA_URL_getCommon(array('db' => $db));
$err_url = 'db_sql.php' . URL::getCommon(array('db' => $db));
if ($cfgRelation['commwork']) {
$comment = PMA_getDbComment($db);

3
db_qbe.php
View File

@ -6,6 +6,7 @@
* @package PhpMyAdmin
*/
use PMA\libraries\SavedSearches;
use PMA\libraries\URL;
/**
* requirements
@ -131,7 +132,7 @@ unset($message_to_display);
// create new qbe search instance
$db_qbe = new PMA\libraries\DbQbe($GLOBALS['db'], $savedSearchList, $savedSearch);
$url = 'db_designer.php' . PMA_URL_getCommon(
$url = 'db_designer.php' . URL::getCommon(
array_merge(
$url_params,
array('query' => 1)

10
export.php
View File

@ -6,6 +6,8 @@
* @package PhpMyAdmin
*/
use PMA\libraries\plugins\ExportPlugin;
use PMA\libraries\URL;
use PMA\libraries\Sanitize;
/**
* Get the variables sent or posted to this script and a core script
@ -254,11 +256,11 @@ if (!defined('TESTSUITE')) {
// Generate error url and check for needed variables
if ($export_type == 'server') {
$err_url = 'server_export.php' . PMA_URL_getCommon();
$err_url = 'server_export.php' . URL::getCommon();
} elseif ($export_type == 'database'
&& mb_strlen($db)
) {
$err_url = 'db_export.php' . PMA_URL_getCommon(array('db' => $db));
$err_url = 'db_export.php' . URL::getCommon(array('db' => $db));
// Check if we have something to export
if (isset($table_select)) {
$tables = $table_select;
@ -268,7 +270,7 @@ if (!defined('TESTSUITE')) {
} elseif ($export_type == 'table' && mb_strlen($db)
&& mb_strlen($table)
) {
$err_url = 'tbl_export.php' . PMA_URL_getCommon(
$err_url = 'tbl_export.php' . URL::getCommon(
array(
'db' => $db, 'table' => $table
)
@ -371,7 +373,7 @@ if (!defined('TESTSUITE')) {
// (avoid rewriting data containing HTML with anchors and forms;
// this was reported to happen under Plesk)
@ini_set('url_rewriter.tags', '');
$filename = PMA_sanitizeFilename($filename);
$filename = Sanitize::sanitizeFilename($filename);
PMA_downloadHeader($filename, $mime_type);
} else {

3
gis_data_editor.php
View File

@ -7,6 +7,7 @@
*/
use PMA\libraries\gis\GISFactory;
use PMA\libraries\gis\GISVisualization;
use PMA\libraries\URL;
/**
* Escapes special characters if the variable is set.
@ -127,7 +128,7 @@ if (isset($_REQUEST['input_name'])) {
echo '<input type="hidden" name="input_name" value="'
, htmlspecialchars($_REQUEST['input_name']) , '" />';
}
echo PMA_URL_getHiddenInputs();
echo URL::getHiddenInputs();
echo '<!-- Visualization section -->';
echo '<div id="placeholder" style="width:450px;height:300px;'

13
import.php
View File

@ -6,6 +6,7 @@
* @package PhpMyAdmin
*/
use PMA\libraries\plugins\ImportPlugin;
use PMA\libraries\URL;
/**
* Get the variables sent or posted to this script and a core script
@ -241,7 +242,7 @@ $format = PMA_securePath($format);
// Create error and goto url
if ($import_type == 'table') {
$err_url = 'tbl_import.php' . PMA_URL_getCommon(
$err_url = 'tbl_import.php' . URL::getCommon(
array(
'db' => $db, 'table' => $table
)
@ -249,11 +250,11 @@ if ($import_type == 'table') {
$_SESSION['Import_message']['go_back_url'] = $err_url;
$goto = 'tbl_import.php';
} elseif ($import_type == 'database') {
$err_url = 'db_import.php' . PMA_URL_getCommon(array('db' => $db));
$err_url = 'db_import.php' . URL::getCommon(array('db' => $db));
$_SESSION['Import_message']['go_back_url'] = $err_url;
$goto = 'db_import.php';
} elseif ($import_type == 'server') {
$err_url = 'server_import.php' . PMA_URL_getCommon();
$err_url = 'server_import.php' . URL::getCommon();
$_SESSION['Import_message']['go_back_url'] = $err_url;
$goto = 'server_import.php';
} else {
@ -267,11 +268,11 @@ if ($import_type == 'table') {
}
}
if (mb_strlen($table) && mb_strlen($db)) {
$common = PMA_URL_getCommon(array('db' => $db, 'table' => $table));
$common = URL::getCommon(array('db' => $db, 'table' => $table));
} elseif (mb_strlen($db)) {
$common = PMA_URL_getCommon(array('db' => $db));
$common = URL::getCommon(array('db' => $db));
} else {
$common = PMA_URL_getCommon();
$common = URL::getCommon();
}
$err_url = $goto . $common
. (preg_match('@^tbl_[a-z]*\.php$@', $goto)

12
index.php
View File

@ -6,6 +6,8 @@
* @package PhpMyAdmin
*/
use PMA\libraries\RecentFavoriteTable;
use PMA\libraries\URL;
use PMA\libraries\Sanitize;
/**
* Gets some core libraries and displays a top message if required
@ -105,7 +107,7 @@ if (! empty($message)) {
unset($message);
}
$common_url_query = PMA_URL_getCommon();
$common_url_query = URL::getCommon();
$mysql_cur_user_and_host = '';
// when $server > 0, a server has been chosen so we can display
@ -202,7 +204,7 @@ if ($server > 0 || count($cfg['Servers']) > 1
} // end if
echo ' <li id="li_select_mysql_collation" class="no_bullets" >';
echo ' <form method="post" action="index.php">' , "\n"
. PMA_URL_getHiddenInputs(null, null, 4, 'collation_connection')
. URL::getHiddenInputs(null, null, 4, 'collation_connection')
. ' <label for="select_collation_connection">' . "\n"
. ' ' . PMA\libraries\Util::getImage('s_asci.png')
. "&nbsp;" . __('Server connection collation') . "\n"
@ -426,14 +428,14 @@ PMA_printListItem(
PMA_printListItem(
__('List of changes'),
'li_pma_changes',
'changelog.php' . PMA_URL_getCommon(),
'changelog.php' . URL::getCommon(),
null,
'_blank'
);
PMA_printListItem(
__('License'),
'li_pma_license',
'license.php' . PMA_URL_getCommon(),
'license.php' . URL::getCommon(),
null,
'_blank'
);
@ -607,7 +609,7 @@ if (isset($GLOBALS['dbi'])
)
) {
trigger_error(
PMA_sanitize(
Sanitize::sanitize(
sprintf(
__(
'Your PHP MySQL library version %s differs from your ' .

77
js/messages.php
View File

@ -25,8 +25,9 @@ if (!defined('TESTSUITE')) {
session_write_close();
}
// But this one is needed for PMA_escapeJsString()
require_once './libraries/js_escape.lib.php';
// But this one is needed for Sanitize::escapeJsString()
use PMA\libraries\Sanitize;
$buffer = PMA\libraries\OutputBuffering::getInstance();
$buffer->start();
@ -717,7 +718,7 @@ $js_messages['strCopyPrefix'] = __('Copy table with prefix');
echo "var PMA_messages = new Array();\n";
foreach ($js_messages as $name => $js_message) {
PMA_printJsValue("PMA_messages['" . $name . "']", $js_message);
Sanitize::printJsValue("PMA_messages['" . $name . "']", $js_message);
}
/* Calendar */
@ -738,20 +739,20 @@ echo 'var maxInputVars = '
echo "if ($.datepicker) {\n";
/* l10n: Display text for calendar close link */
PMA_printJsValue("$.datepicker.regional['']['closeText']", __('Done'));
Sanitize::printJsValue("$.datepicker.regional['']['closeText']", __('Done'));
/* l10n: Display text for previous month link in calendar */
PMA_printJsValue(
Sanitize::printJsValue(
"$.datepicker.regional['']['prevText']",
_pgettext('Previous month', 'Prev')
);
/* l10n: Display text for next month link in calendar */
PMA_printJsValue(
Sanitize::printJsValue(
"$.datepicker.regional['']['nextText']",
_pgettext('Next month', 'Next')
);
/* l10n: Display text for current month link in calendar */
PMA_printJsValue("$.datepicker.regional['']['currentText']", __('Today'));
PMA_printJsValue(
Sanitize::printJsValue("$.datepicker.regional['']['currentText']", __('Today'));
Sanitize::printJsValue(
"$.datepicker.regional['']['monthNames']",
array(
__('January'),
@ -768,7 +769,7 @@ PMA_printJsValue(
__('December')
)
);
PMA_printJsValue(
Sanitize::printJsValue(
"$.datepicker.regional['']['monthNamesShort']",
array(
/* l10n: Short month name */
@ -797,7 +798,7 @@ PMA_printJsValue(
__('Dec')
)
);
PMA_printJsValue(
Sanitize::printJsValue(
"$.datepicker.regional['']['dayNames']",
array(
__('Sunday'),
@ -809,7 +810,7 @@ PMA_printJsValue(
__('Saturday')
)
);
PMA_printJsValue(
Sanitize::printJsValue(
"$.datepicker.regional['']['dayNamesShort']",
array(
/* l10n: Short week day name */
@ -828,7 +829,7 @@ PMA_printJsValue(
__('Sat')
)
);
PMA_printJsValue(
Sanitize::printJsValue(
"$.datepicker.regional['']['dayNamesMin']",
array(
/* l10n: Minimal week day name */
@ -848,9 +849,9 @@ PMA_printJsValue(
)
);
/* l10n: Column header for week of the year in calendar */
PMA_printJsValue("$.datepicker.regional['']['weekHeader']", __('Wk'));
Sanitize::printJsValue("$.datepicker.regional['']['weekHeader']", __('Wk'));
PMA_printJsValue(
Sanitize::printJsValue(
"$.datepicker.regional['']['showMonthAfterYear']",
/* l10n: Month-year order for calendar, use either "calendar-month-year"
* or "calendar-year-month".
@ -859,7 +860,7 @@ PMA_printJsValue(
);
/* l10n: Year suffix for calendar, "none" is empty. */
$year_suffix = _pgettext('Year suffix', 'none');
PMA_printJsValue(
Sanitize::printJsValue(
"$.datepicker.regional['']['yearSuffix']",
($year_suffix == 'none' ? '' : $year_suffix)
);
@ -869,10 +870,10 @@ $.extend($.datepicker._defaults, $.datepicker.regional['']);
<?php
echo "if ($.timepicker) {\n";
PMA_printJsValue("$.timepicker.regional['']['timeText']", __('Time'));
PMA_printJsValue("$.timepicker.regional['']['hourText']", __('Hour'));
PMA_printJsValue("$.timepicker.regional['']['minuteText']", __('Minute'));
PMA_printJsValue("$.timepicker.regional['']['secondText']", __('Second'));
Sanitize::printJsValue("$.timepicker.regional['']['timeText']", __('Time'));
Sanitize::printJsValue("$.timepicker.regional['']['hourText']", __('Hour'));
Sanitize::printJsValue("$.timepicker.regional['']['minuteText']", __('Minute'));
Sanitize::printJsValue("$.timepicker.regional['']['secondText']", __('Second'));
?>
$.extend($.timepicker._defaults, $.timepicker.regional['']);
} /* if ($.timepicker) */
@ -883,67 +884,67 @@ $.extend($.timepicker._defaults, $.timepicker.regional['']);
echo "function extendingValidatorMessages() {\n";
echo "$.extend($.validator.messages, {\n";
/* Default validation functions */
PMA_printJsValueForFormValidation('required', __('This field is required'));
PMA_printJsValueForFormValidation('remote', __('Please fix this field'));
PMA_printJsValueForFormValidation('email', __('Please enter a valid email address'));
PMA_printJsValueForFormValidation('url', __('Please enter a valid URL'));
PMA_printJsValueForFormValidation('date', __('Please enter a valid date'));
PMA_printJsValueForFormValidation(
Sanitize::printJsValueForFormValidation('required', __('This field is required'));
Sanitize::printJsValueForFormValidation('remote', __('Please fix this field'));
Sanitize::printJsValueForFormValidation('email', __('Please enter a valid email address'));
Sanitize::printJsValueForFormValidation('url', __('Please enter a valid URL'));
Sanitize::printJsValueForFormValidation('date', __('Please enter a valid date'));
Sanitize::printJsValueForFormValidation(
'dateISO',
__('Please enter a valid date ( ISO )')
);
PMA_printJsValueForFormValidation('number', __('Please enter a valid number'));
PMA_printJsValueForFormValidation(
Sanitize::printJsValueForFormValidation('number', __('Please enter a valid number'));
Sanitize::printJsValueForFormValidation(
'creditcard',
__('Please enter a valid credit card number')
);
PMA_printJsValueForFormValidation('digits', __('Please enter only digits'));
PMA_printJsValueForFormValidation(
Sanitize::printJsValueForFormValidation('digits', __('Please enter only digits'));
Sanitize::printJsValueForFormValidation(
'equalTo',
__('Please enter the same value again')
);
PMA_printJsValueForFormValidation(
Sanitize::printJsValueForFormValidation(
'maxlength',
__('Please enter no more than {0} characters'),
true
);
PMA_printJsValueForFormValidation(
Sanitize::printJsValueForFormValidation(
'minlength',
__('Please enter at least {0} characters'),
true
);
PMA_printJsValueForFormValidation(
Sanitize::printJsValueForFormValidation(
'rangelength',
__('Please enter a value between {0} and {1} characters long'),
true
);
PMA_printJsValueForFormValidation(
Sanitize::printJsValueForFormValidation(
'range',
__('Please enter a value between {0} and {1}'),
true
);
PMA_printJsValueForFormValidation(
Sanitize::printJsValueForFormValidation(
'max',
__('Please enter a value less than or equal to {0}'),
true
);
PMA_printJsValueForFormValidation(
Sanitize::printJsValueForFormValidation(
'min',
__('Please enter a value greater than or equal to {0}'),
true
);
/* customed functions */
PMA_printJsValueForFormValidation(
Sanitize::printJsValueForFormValidation(
'validationFunctionForDateTime',
__('Please enter a valid date or time'),
true
);
PMA_printJsValueForFormValidation(
Sanitize::printJsValueForFormValidation(
'validationFunctionForHex',
__('Please enter a valid HEX input'),
true
);
PMA_printJsValueForFormValidation(
Sanitize::printJsValueForFormValidation(
'validationFunctionForFuns',
__('Error'),
true,

3
libraries/Advisor.php
View File

@ -9,6 +9,7 @@
namespace PMA\libraries;
use \Exception;
use PMA\libraries\URL;
require_once 'libraries/advisor.lib.php';
@ -326,7 +327,7 @@ class Advisor
// linking to server_variables.php
$rule['recommendation'] = preg_replace(
'/\{([a-z_0-9]+)\}/Ui',
'<a href="server_variables.php' . PMA_URL_getCommon()
'<a href="server_variables.php' . URL::getCommon()
. '&filter=\1">\1</a>',
$this->translate($rule['recommendation'])
);

3
libraries/Config.php
View File

@ -8,6 +8,7 @@
namespace PMA\libraries;
use DirectoryIterator;
use PMA\libraries\URL;
/**
* Indication for error handler (see end of this file).
@ -1549,7 +1550,7 @@ class Config
{
return '<form name="form_fontsize_selection" id="form_fontsize_selection"'
. ' method="get" action="index.php" class="disableAjax">' . "\n"
. PMA_URL_getHiddenInputs() . "\n"
. URL::getHiddenInputs() . "\n"
. Config::getFontsizeSelection() . "\n"
. '</form>';
}

3
libraries/DatabaseInterface.php
View File

@ -9,6 +9,7 @@ namespace PMA\libraries;
use PMA\libraries\dbi\DBIExtension;
use PMA\libraries\LanguageManager;
use PMA\libraries\URL;
require_once './libraries/logging.lib.php';
require_once './libraries/util.lib.php';
@ -2069,7 +2070,7 @@ class DatabaseInterface
*/
$error .= ' - ' . $error_message .
' (<a href="server_engines.php' .
PMA_URL_getCommon(
URL::getCommon(
array('engine' => 'InnoDB', 'page' => 'Status')
) . '">' . __('Details…') . '</a>)';
}

6
libraries/DbQbe.php
View File

@ -7,6 +7,8 @@
*/
namespace PMA\libraries;
use PMA\libraries\URL;
/**
* Class to handle database QBE search
*
@ -1828,7 +1830,7 @@ class DbQbe
$url_params['db'] = $this->_db;
$url_params['criteriaColumnCount'] = $this->_new_column_count;
$url_params['rows'] = $this->_new_row_count;
$html_output .= PMA_URL_getHiddenInputs($url_params);
$html_output .= URL::getHiddenInputs($url_params);
$html_output .= '</fieldset>';
// get footers
$html_output .= $this->_getTableFooters();
@ -1836,7 +1838,7 @@ class DbQbe
$html_output .= $this->_getTablesList();
$html_output .= '</form>';
$html_output .= '<form action="db_qbe.php" method="post" class="lock-page">';
$html_output .= PMA_URL_getHiddenInputs(array('db' => $this->_db));
$html_output .= URL::getHiddenInputs(array('db' => $this->_db));
// get SQL query
$html_output .= '<div class="floatleft" style="width:50%">';
$html_output .= '<fieldset>';

13
libraries/DbSearch.php
View File

@ -7,6 +7,9 @@
*/
namespace PMA\libraries;
use PMA\libraries\URL;
use PMA\libraries\Sanitize;
/**
* Class to handle database search
*
@ -336,12 +339,12 @@ class DbSearch
// Displays browse/delete link if result count > 0
if ($res_cnt > 0) {
$this_url_params['sql_query'] = $newsearchsqls['select_columns'];
$browse_result_path = 'sql.php' . PMA_URL_getCommon($this_url_params);
$browse_result_path = 'sql.php' . URL::getCommon($this_url_params);
$html_output .= '<td><a name="browse_search" class="ajax" href="'
. $browse_result_path . '" onclick="loadResult(\''
. $browse_result_path . '\',\''
. PMA_escapeJsString(htmlspecialchars($each_table)) . '\',\''
. PMA_URL_getCommon(
. Sanitize::escapeJsString(htmlspecialchars($each_table)) . '\',\''
. URL::getCommon(
array(
'db' => $GLOBALS['db'], 'table' => $each_table
)
@ -349,7 +352,7 @@ class DbSearch
. ');return false;" >'
. __('Browse') . '</a></td>';
$this_url_params['sql_query'] = $newsearchsqls['delete'];
$delete_result_path = 'sql.php' . PMA_URL_getCommon($this_url_params);
$delete_result_path = 'sql.php' . URL::getCommon($this_url_params);
$html_output .= '<td><a name="delete_search" class="ajax" href="'
. $delete_result_path . '" onclick="deleteResult(\''
. $delete_result_path . '\' , \''
@ -378,7 +381,7 @@ class DbSearch
$html_output .= '<form id="db_search_form"'
. ' class="ajax lock-page"'
. ' method="post" action="db_search.php" name="db_search">';
$html_output .= PMA_URL_getHiddenInputs($GLOBALS['db']);
$html_output .= URL::getHiddenInputs($GLOBALS['db']);
$html_output .= '<fieldset>';
// set legend caption
$html_output .= '<legend>' . __('Search in database') . '</legend>';

62
libraries/DisplayResults.php
View File

@ -9,6 +9,8 @@ namespace PMA\libraries;
use SqlParser\Utils\Query;
use PMA\libraries\plugins\transformations\Text_Plain_Link;
use PMA\libraries\URL;
use PMA\libraries\Sanitize;
require_once './libraries/transformations.lib.php';
@ -730,7 +732,7 @@ class DisplayResults
return '<td>'
. '<form action="sql.php" method="post" ' . $onsubmit . '>'
. PMA_URL_getHiddenInputs(
. URL::getHiddenInputs(
$this->__get('db'), $this->__get('table')
)
. '<input type="hidden" name="sql_query" value="'
@ -785,7 +787,7 @@ class DisplayResults
//<form> to keep the form alignment of button < and <<
// and also to know what to execute when the selector changes
$table_navigation_html .= '<form action="sql.php'
. PMA_URL_getCommon($_url_params)
. URL::getCommon($_url_params)
. '" method="post">';
$table_navigation_html .= Util::pageselector(
@ -935,7 +937,7 @@ class DisplayResults
. ')'
. '">';
$table_navigation_html .= PMA_URL_getHiddenInputs(
$table_navigation_html .= URL::getHiddenInputs(
$this->__get('db'), $this->__get('table')
);
@ -1007,7 +1009,7 @@ class DisplayResults
return "\n"
. '<td>'
. '<form action="sql.php" method="post">'
. PMA_URL_getHiddenInputs(
. URL::getHiddenInputs(
$this->__get('db'), $this->__get('table')
)
. '<input type="hidden" name="sql_query" value="'
@ -1286,7 +1288,7 @@ class DisplayResults
$table_headers_html .= '<input class="save_cells_at_once" type="hidden"'
. ' value="' . $GLOBALS['cfg']['SaveCellsAtOnce'] . '" />'
. '<div class="common_hidden_inputs">'
. PMA_URL_getHiddenInputs(
. URL::getHiddenInputs(
$this->__get('db'), $this->__get('table')
)
. '</div>';
@ -1420,11 +1422,11 @@ class DisplayResults
$drop_down_html .= '<form action="sql.php" method="post" ' .
'class="print_ignore">' . "\n"
. PMA_URL_getHiddenInputs(
. URL::getHiddenInputs(
$this->__get('db'), $this->__get('table')
)
// to avoid calling PMA_handleSortOrder() later
. PMA_getHiddenFields(array('sort_by_key' => '1'))
. URL::getHiddenFields(array('sort_by_key' => '1'))
. __('Sort by key')
. ': <select name="sql_query" class="autosubmit">' . "\n";
@ -1705,7 +1707,7 @@ class DisplayResults
'display_options_form' => 1
);
$options_html .= PMA_URL_getHiddenInputs($url_params)
$options_html .= URL::getHiddenInputs($url_params)
. '<br />'
. Util::getDivForSliderEffect(
'', __('Options')
@ -1830,7 +1832,7 @@ class DisplayResults
$tmp_image = '<img class="fulltext" src="' . $tmp_image_file . '" alt="'
. $tmp_txt . '" title="' . $tmp_txt . '" />';
$tmp_url = 'sql.php' . PMA_URL_getCommon($url_params_full_text);
$tmp_url = 'sql.php' . URL::getCommon($url_params_full_text);
return Util::linkOrButton(
$tmp_url, $tmp_image, array(), false
@ -1864,7 +1866,7 @@ class DisplayResults
$form_html .= ' class="ajax" ';
$form_html .= '>'
. PMA_URL_getHiddenInputs(
. URL::getHiddenInputs(
$this->__get('db'), $this->__get('table'), 1
)
. '<input type="hidden" name="goto" value="sql.php" />';
@ -1996,8 +1998,8 @@ class DisplayResults
'session_max_rows' => $session_max_rows,
'is_browse_distinct' => $this->__get('is_browse_distinct'),
);
$single_order_url = 'sql.php' . PMA_URL_getCommon($_single_url_params);
$multi_order_url = 'sql.php' . PMA_URL_getCommon($_multi_url_params);
$single_order_url = 'sql.php' . URL::getCommon($_single_url_params);
$multi_order_url = 'sql.php' . URL::getCommon($_multi_url_params);
// Displays the sorting URL
// enable sort order swapping for image
@ -3153,7 +3155,7 @@ class DisplayResults
}
$transform_options['wrapper_link']
= PMA_URL_getCommon($_url_params);
= URL::getCommon($_url_params);
$display_params = $this->__get('display_params');
@ -3270,7 +3272,7 @@ class DisplayResults
$divider = strpos($link_relations['default_page'], '?') ? '&' : '?';
if (empty($link_relations['link_dependancy_params'])) {
return $link_relations['default_page']
. PMA_URL_getCommon($linking_url_params, 'html', $divider);
. URL::getCommon($linking_url_params, 'html', $divider);
}
foreach ($link_relations['link_dependancy_params'] as $new_param) {
@ -3294,7 +3296,7 @@ class DisplayResults
}
return $link_relations['default_page']
. PMA_URL_getCommon($linking_url_params, 'html', $divider);
. URL::getCommon($linking_url_params, 'html', $divider);
}
@ -3459,12 +3461,12 @@ class DisplayResults
);
$edit_url = 'tbl_change.php'
. PMA_URL_getCommon(
. URL::getCommon(
$_url_params + array('default_action' => 'update')
);
$copy_url = 'tbl_change.php'
. PMA_URL_getCommon(
. URL::getCommon(
$_url_params + array('default_action' => 'insert')
);
@ -3518,7 +3520,7 @@ class DisplayResults
'goto' => (empty($goto) ? 'tbl_sql.php' : $goto),
);
$lnk_goto = 'sql.php' . PMA_URL_getCommon($_url_params, 'text');
$lnk_goto = 'sql.php' . URL::getCommon($_url_params, 'text');
$del_query = 'DELETE FROM '
. Util::backquote($this->__get('table'))
@ -3532,10 +3534,10 @@ class DisplayResults
'message_to_show' => __('The row has been deleted.'),
'goto' => $lnk_goto,
);
$del_url = 'sql.php' . PMA_URL_getCommon($_url_params);
$del_url = 'sql.php' . URL::getCommon($_url_params);
$js_conf = 'DELETE FROM ' . PMA_jsFormat($this->__get('table'))
. ' WHERE ' . PMA_jsFormat($where_clause, false)
$js_conf = 'DELETE FROM ' . Sanitize::jsFormat($this->__get('table'))
. ' WHERE ' . Sanitize::jsFormat($where_clause, false)
. ($clause_is_unique ? '' : ' LIMIT 1');
$del_str = $this->_getActionLinkContent('b_drop.png', __('Delete'));
@ -3550,7 +3552,7 @@ class DisplayResults
);
$lnk_goto = 'sql.php'
. PMA_URL_getCommon(
. URL::getCommon(
$_url_params, 'text'
);
@ -3562,7 +3564,7 @@ class DisplayResults
'goto' => $lnk_goto,
);
$del_url = 'sql.php' . PMA_URL_getCommon($_url_params);
$del_url = 'sql.php' . URL::getCommon($_url_params);
$js_conf = $kill;
$del_str = Util::getIcon(
'b_drop.png', __('Kill')
@ -4256,7 +4258,7 @@ class DisplayResults
// "j u s t b r o w s i n g"
$pre_count = '~';
$after_count = Util::showHint(
PMA_sanitize(
Sanitize::sanitize(
__('May be approximate. See [doc@faq3-11]FAQ 3.11[/doc].')
)
);
@ -5067,7 +5069,7 @@ class DisplayResults
'printview' => '1',
'sql_query' => $this->__get('sql_query'),
);
$url_query = PMA_URL_getCommon($_url_params);
$url_query = URL::getCommon($_url_params);
if (!$header_shown) {
$results_operations_html .= $header;
@ -5132,7 +5134,7 @@ class DisplayResults
}
$results_operations_html .= Util::linkOrButton(
'tbl_export.php' . PMA_URL_getCommon($_url_params),
'tbl_export.php' . URL::getCommon($_url_params),
Util::getIcon(
'b_tblexport.png', __('Export'), true
),
@ -5145,7 +5147,7 @@ class DisplayResults
// prepare chart
$results_operations_html .= Util::linkOrButton(
'tbl_chart.php' . PMA_URL_getCommon($_url_params),
'tbl_chart.php' . URL::getCommon($_url_params),
Util::getIcon(
'b_chart.png', __('Display chart'), true
),
@ -5170,7 +5172,7 @@ class DisplayResults
$results_operations_html
.= Util::linkOrButton(
'tbl_gis_visualization.php'
. PMA_URL_getCommon($_url_params),
. URL::getCommon($_url_params),
Util::getIcon(
'b_globe.gif', __('Visualize GIS data'), true
),
@ -5315,7 +5317,7 @@ class DisplayResults
&& (!empty($tmpdb) && !empty($meta->orgtable))
) {
$result = '<a href="tbl_get_field.php'
. PMA_URL_getCommon($url_params)
. URL::getCommon($url_params)
. '" class="disableAjax">'
. $result . '</a>';
}
@ -5483,7 +5485,7 @@ class DisplayResults
);
$result .= '<a class="ajax" href="sql.php'
. PMA_URL_getCommon($_url_params)
. URL::getCommon($_url_params)
. '"' . $title . '>';
if ($transformation_plugin != $default_function) {

10
libraries/Footer.php
View File

@ -8,6 +8,8 @@
namespace PMA\libraries;
use Traversable;
use PMA\libraries\URL;
use PMA\libraries\Sanitize;
/**
* Class used to output the footer
@ -134,7 +136,7 @@ class Footer
/**
* Returns the url of the current page
*
* @param string|null $encode See PMA_URL_getCommon()
* @param string|null $encode See URL::getCommon()
*
* @return string
*/
@ -178,7 +180,7 @@ class Footer
) {
$params['single_table'] = $_REQUEST['single_table'];
}
return basename(PMA_getenv('SCRIPT_NAME')) . PMA_URL_getCommon(
return basename(PMA_getenv('SCRIPT_NAME')) . URL::getCommon(
$params,
$encode
);
@ -326,9 +328,9 @@ class Footer
. ' scripts: %s,'
. ' menuHash: "%s"'
. '};',
PMA_escapeJsString($url),
Sanitize::escapeJsString($url),
json_encode($scripts),
PMA_escapeJsString($menuHash)
Sanitize::escapeJsString($menuHash)
)
);
}

12
libraries/Header.php
View File

@ -8,9 +8,9 @@
namespace PMA\libraries;
use PMA\libraries\navigation\Navigation;
use PMA\libraries\URL;
use PMA\libraries\Sanitize;
require_once 'libraries/js_escape.lib.php';
require_once 'libraries/url_generating.lib.php';
/**
* Class used to output the HTTP and HTML headers
@ -155,7 +155,7 @@ class Header
}
$this->_scripts->addFile('jquery/jquery-2.1.4.min.js');
$this->_scripts->addFile(
'whitelist.php' . PMA_URL_getCommon($params), false, true
'whitelist.php' . URL::getCommon($params), false, true
);
$this->_scripts->addFile('sprintf.js');
$this->_scripts->addFile('ajax.js');
@ -183,7 +183,7 @@ class Header
// Here would not be a good place to add CodeMirror because
// the user preferences have not been merged at this point
$this->_scripts->addFile('messages.php' . PMA_URL_getCommon($params));
$this->_scripts->addFile('messages.php' . URL::getCommon($params));
// Append the theme id to this url to invalidate
// the cache on a theme change. Though this might be
// unavailable for fatal errors.
@ -227,7 +227,7 @@ class Header
}
$params = array(
'common_query' => PMA_URL_getCommon(array(), 'text'),
'common_query' => URL::getCommon(array(), 'text'),
'opendb_url' => Util::getScriptNameForOption(
$GLOBALS['cfg']['DefaultTabDatabase'], 'database'
),
@ -275,7 +275,7 @@ class Header
{
$params = $this->getJsParams();
foreach ($params as $key => $value) {
$params[$key] = $key . ':"' . PMA_escapeJsString($value) . '"';
$params[$key] = $key . ':"' . Sanitize::escapeJsString($value) . '"';
}
return 'PMA_commonParams.setAll({' . implode(',', $params) . '});';
}

11
libraries/Index.php
View File

@ -7,6 +7,9 @@
*/
namespace PMA\libraries;
use PMA\libraries\URL;
use PMA\libraries\Sanitize;
/**
* Index manipulation class
*
@ -717,7 +720,7 @@ class Index
$r .= '" ' . $row_span . '>'
. ' <a class="';
$r .= 'ajax';
$r .= '" href="tbl_indexes.php' . PMA_URL_getCommon($this_params)
$r .= '" href="tbl_indexes.php' . URL::getCommon($this_params)
. '">' . Util::getIcon('b_edit.png', __('Edit')) . '</a>'
. '</td>' . "\n";
$this_params = $GLOBALS['url_params'];
@ -727,7 +730,7 @@ class Index
. ' DROP PRIMARY KEY;';
$this_params['message_to_show']
= __('The primary key has been dropped.');
$js_msg = PMA_jsFormat(
$js_msg = Sanitize::jsFormat(
'ALTER TABLE ' . $table . ' DROP PRIMARY KEY'
);
} else {
@ -738,7 +741,7 @@ class Index
__('Index %s has been dropped.'), $index->getName()
);
$js_msg = PMA_jsFormat(
$js_msg = Sanitize::jsFormat(
'ALTER TABLE ' . $table . ' DROP INDEX '
. $index->getName() . ';'
);
@ -750,7 +753,7 @@ class Index
. ' value="' . $js_msg . '" />';
$r .= ' <a class="drop_primary_key_index_anchor';
$r .= ' ajax';
$r .= '" href="sql.php' . PMA_URL_getCommon($this_params)
$r .= '" href="sql.php' . URL::getCommon($this_params)
. '" >'
. Util::getIcon('b_drop.png', __('Drop')) . '</a>'
. '</td>' . "\n";

8
libraries/Menu.php
View File

@ -7,6 +7,8 @@
*/
namespace PMA\libraries;
use PMA\libraries\URL;
/**
* Class for generating the top menu
*
@ -196,7 +198,7 @@ class Menu
Util::getScriptNameForOption(
$GLOBALS['cfg']['DefaultTabServer'], 'server'
),
PMA_URL_getCommon(),
URL::getCommon(),
htmlspecialchars($server_info),
__('Server')
);
@ -215,7 +217,7 @@ class Menu
Util::getScriptNameForOption(
$GLOBALS['cfg']['DefaultTabDatabase'], 'database'
),
PMA_URL_getCommon(array('db' => $this->_db)),
URL::getCommon(array('db' => $this->_db)),
htmlspecialchars($this->_db),
__('Database')
);
@ -240,7 +242,7 @@ class Menu
Util::getScriptNameForOption(
$GLOBALS['cfg']['DefaultTabTable'], 'table'
),
PMA_URL_getCommon(
URL::getCommon(
array(
'db' => $this->_db, 'table' => $this->_table
)

4
libraries/Message.php
View File

@ -7,6 +7,8 @@
*/
namespace PMA\libraries;
use PMA\libraries\Sanitize;
/**
* a single message
*
@ -583,7 +585,7 @@ class Message
*/
static public function decodeBB($message)
{
return PMA_sanitize($message, false, true);
return Sanitize::sanitize($message, false, true);
}
/**

12
libraries/RecentFavoriteTable.php
View File

@ -7,6 +7,8 @@
*/
namespace PMA\libraries;
use PMA\libraries\URL;
/**
* Handles the recently used and favorite tables.
*
@ -184,7 +186,7 @@ class RecentFavoriteTable
'table' => $table['table']
);
$recent_url = 'tbl_recent_favorite.php'
. PMA_URL_getCommon($recent_params);
. URL::getCommon($recent_params);
$html .= '<a href="' . $recent_url . '">`'
. htmlspecialchars($table['db']) . '`.`'
. htmlspecialchars($table['table']) . '`</a>';
@ -202,7 +204,7 @@ class RecentFavoriteTable
'remove_favorite' => true
);
$fav_rm_url = 'db_structure.php'
. PMA_URL_getCommon($fav_params);
. URL::getCommon($fav_params);
$html .= 'href="' . $fav_rm_url
. '" title="' . __("Remove from Favorites")
. '" data-favtargetn="'
@ -216,7 +218,7 @@ class RecentFavoriteTable
'table' => $table['table']
);
$table_url = 'tbl_recent_favorite.php'
. PMA_URL_getCommon($fav_params);
. URL::getCommon($fav_params);
$html .= '<a href="' . $table_url . '">`'
. htmlspecialchars($table['db']) . '`.`'
. htmlspecialchars($table['table']) . '`</a>';
@ -347,7 +349,7 @@ class RecentFavoriteTable
if (!$is_synced) {
$params = array('ajax_request' => true, 'favorite_table' => true,
'sync_favorite_tables' => true);
$url = 'db_structure.php' . PMA_URL_getCommon($params);
$url = 'db_structure.php' . URL::getCommon($params);
$retval = '<a class="hide" id="sync_favorite_tables"';
$retval .= ' href="' . $url . '"></a>';
}
@ -362,7 +364,7 @@ class RecentFavoriteTable
public static function getHtmlUpdateRecentTables()
{
$params = array('ajax_request' => true, 'recent_table' => true);
$url = 'index.php' . PMA_URL_getCommon($params);
$url = 'index.php' . URL::getCommon($params);
$retval = '<a class="hide" id="update_recent_tables"';
$retval .= ' href="' . $url . '"></a>';
return $retval;

365
libraries/Sanitize.php Normal file
View File

@ -0,0 +1,365 @@
<?php
/* vim: set expandtab sw=4 ts=4 sts=4: */
/**
* This is in a separate script because it's called from a number of scripts
*
* @package PhpMyAdmin
*/
namespace PMA\libraries;
use PMA\libraries\Util;
class Sanitize {
/**
* Checks whether given link is valid
*
* @param string $url URL to check
*
* @return boolean True if string can be used as link
*/
public static function checkLink($url)
{
$valid_starts = array(
'http://',
'https://',
'./url.php?url=http%3A%2F%2F',
'./url.php?url=https%3A%2F%2F',
'./doc/html/',
);
if (defined('PMA_SETUP')) {
$valid_starts[] = '?page=form&';
$valid_starts[] = '?page=servers&';
}
foreach ($valid_starts as $val) {
if (mb_substr($url, 0, mb_strlen($val)) == $val) {
return true;
}
}
return false;
}
/**
* Callback function for replacing [a@link@target] links in bb code.
*
* @param array $found Array of preg matches
*
* @return string Replaced string
*/
public static function replaceBBLink($found)
{
/* Check for valid link */
if (! Sanitize::checkLink($found[1])) {
return $found[0];
}
/* a-z and _ allowed in target */
if (! empty($found[3]) && preg_match('/[^a-z_]+/i', $found[3])) {
return $found[0];
}
/* Construct target */
$target = '';
if (! empty($found[3])) {
$target = ' target="' . $found[3] . '"';
}
/* Construct url */
if (substr($found[1], 0, 4) == 'http') {
$url = PMA_linkURL($found[1]);
} else {
$url = $found[1];
}
return '<a href="' . $url . '"' . $target . '>';
}
/**
* Callback function for replacing [doc@anchor] links in bb code.
*
* @param array $found Array of preg matches
*
* @return string Replaced string
*/
public static function replaceDocLink($found)
{
$anchor = $found[1];
if (strncmp('faq', $anchor, 3) == 0) {
$page = 'faq';
} else if (strncmp('cfg', $anchor, 3) == 0) {
$page = 'cfg';
} else {
/* Guess */
$page = 'setup';
}
$link = Util::getDocuLink($page, $anchor);
return '<a href="' . $link . '" target="documentation">';
}
/**
* Sanitizes $message, taking into account our special codes
* for formatting.
*
* If you want to include result in element attribute, you should escape it.
*
* Examples:
*
* <p><?php echo Sanitize::sanitize($foo); ?></p>
*
* <a title="<?php echo Sanitize::sanitize($foo, true); ?>">bar</a>
*
* @param string $message the message
* @param boolean $escape whether to escape html in result
* @param boolean $safe whether string is safe (can keep < and > chars)
*
* @return string the sanitized message
*/
public static function sanitize($message, $escape = false, $safe = false)
{
if (!$safe) {
$message = strtr($message, array('<' => '&lt;', '>' => '&gt;'));
}
/* Interpret bb code */
$replace_pairs = array(
'[em]' => '<em>',
'[/em]' => '</em>',
'[strong]' => '<strong>',
'[/strong]' => '</strong>',
'[code]' => '<code>',
'[/code]' => '</code>',
'[kbd]' => '<kbd>',
'[/kbd]' => '</kbd>',
'[br]' => '<br />',
'[/a]' => '</a>',
'[/doc]' => '</a>',
'[sup]' => '<sup>',
'[/sup]' => '</sup>',
// used in common.inc.php:
'[conferr]' => '<iframe src="show_config_errors.php" />',
// used in libraries/Util.php
'[dochelpicon]' => Util::getImage('b_help.png', __('Documentation')),
);
$message = strtr($message, $replace_pairs);
/* Match links in bb code ([a@url@target], where @target is options) */
$pattern = '/\[a@([^]"@]*)(@([^]"]*))?\]/';
/* Find and replace all links */
$message = preg_replace_callback($pattern, function($match){
return Sanitize::replaceBBLink($match);
}, $message);
/* Replace documentation links */
$message = preg_replace_callback(
'/\[doc@([a-zA-Z0-9_-]+)\]/',
function($match){
return Sanitize::replaceDocLink($match);
},
$message
);
/* Possibly escape result */
if ($escape) {
$message = htmlspecialchars($message);
}
return $message;
}
/**
* Sanitize a filename by removing anything besides legit characters
*
* Intended usecase:
* When using a filename in a Content-Disposition header
* the value should not contain ; or "
*
* When exporting, avoiding generation of an unexpected double-extension file
*
* @param string $filename The filename
* @param boolean $replaceDots Whether to also replace dots
*
* @return string the sanitized filename
*
*/
public static function sanitizeFilename($filename, $replaceDots = false)
{
$pattern = '/[^A-Za-z0-9_';
// if we don't have to replace dots
if (! $replaceDots) {
// then add the dot to the list of legit characters
$pattern .= '.';
}
$pattern .= '-]/';
$filename = preg_replace($pattern, '_', $filename);
return $filename;
}
/**
* Format a string so it can be a string inside JavaScript code inside an
* eventhandler (onclick, onchange, on..., ).
* This function is used to displays a javascript confirmation box for
* "DROP/DELETE/ALTER" queries.
*
* @param string $a_string the string to format
* @param boolean $add_backquotes whether to add backquotes to the string or not
*
* @return string the formatted string
*
* @access public
*/
public static function jsFormat($a_string = '', $add_backquotes = true)
{
if (is_string($a_string)) {
$a_string = htmlspecialchars($a_string);
$a_string = Sanitize::escapeJsString($a_string);
// Needed for inline javascript to prevent some browsers
// treating it as a anchor
$a_string = str_replace('#', '\\#', $a_string);
}
return $add_backquotes
? Util::backquote($a_string)
: $a_string;
} // end of the 'Sanitize::jsFormat()' function
/**
* escapes a string to be inserted as string a JavaScript block
* enclosed by <![CDATA[ ... ]]>
* this requires only to escape ' with \' and end of script block
*
* We also remove NUL byte as some browsers (namely MSIE) ignore it and
* inserting it anywhere inside </script would allow to bypass this check.
*
* @param string $string the string to be escaped
*
* @return string the escaped string
*/
public static function escapeJsString($string)
{
return preg_replace(
'@</script@i', '</\' + \'script',
strtr(
$string,
array(
"\000" => '',
'\\' => '\\\\',
'\'' => '\\\'',
'"' => '\"',
"\n" => '\n',
"\r" => '\r'
)
)
);
}
/**
* Formats a value for javascript code.
*
* @param string $value String to be formatted.
*
* @return string formatted value.
*/
public static function formatJsVal($value)
{
if (is_bool($value)) {
if ($value) {
return 'true';
}
return 'false';
}
if (is_int($value)) {
return (int)$value;
}
return '"' . Sanitize::escapeJsString($value) . '"';
}
/**
* Formats an javascript assignment with proper escaping of a value
* and support for assigning array of strings.
*
* @param string $key Name of value to set
* @param mixed $value Value to set, can be either string or array of strings
* @param bool $escape Whether to escape value or keep it as it is
* (for inclusion of js code)
*
* @return string Javascript code.
*/
public static function getJsValue($key, $value, $escape = true)
{
$result = $key . ' = ';
if (!$escape) {
$result .= $value;
} elseif (is_array($value)) {
$result .= '[';
foreach ($value as $val) {
$result .= Sanitize::formatJsVal($val) . ",";
}
$result .= "];\n";
} else {
$result .= Sanitize::formatJsVal($value) . ";\n";
}
return $result;
}
/**
* Prints an javascript assignment with proper escaping of a value
* and support for assigning array of strings.
*
* @param string $key Name of value to set
* @param mixed $value Value to set, can be either string or array of strings
*
* @return void
*/
public static function printJsValue($key, $value)
{
echo Sanitize::getJsValue($key, $value);
}
/**
* Formats javascript assignment for form validation api
* with proper escaping of a value.
*
* @param string $key Name of value to set
* @param string $value Value to set
* @param boolean $addOn Check if $.validator.format is required or not
* @param boolean $comma Check if comma is required
*
* @return string Javascript code.
*/
public static function getJsValueForFormValidation($key, $value, $addOn, $comma)
{
$result = $key . ': ';
if ($addOn) {
$result .= '$.validator.format(';
}
$result .= Sanitize::formatJsVal($value);
if ($addOn) {
$result .= ')';
}
if ($comma) {
$result .= ', ';
}
return $result;
}
/**
* Prints javascript assignment for form validation api
* with proper escaping of a value.
*
* @param string $key Name of value to set
* @param string $value Value to set
* @param boolean $addOn Check if $.validator.format is required or not
* @param boolean $comma Check if comma is required
*
* @return void
*/
public static function printJsValueForFormValidation($key, $value, $addOn=false, $comma=true)
{
echo Sanitize::getJsValueForFormValidation($key, $value, $addOn, $comma);
}
}

11
libraries/Scripts.php
View File

@ -7,6 +7,9 @@
*/
namespace PMA\libraries;
use PMA\libraries\URL;
use PMA\libraries\Sanitize;
/**
* Collects information about which JavaScript
* files and objects are necessary to render
@ -51,7 +54,7 @@ class Scripts
$first_dynamic_scripts = "";
$dynamic_scripts = "";
$scripts = array();
$separator = PMA_URL_getArgSeparator();
$separator = URL::getArgSeparator();
foreach ($files as $value) {
if (mb_strpos($value['filename'], "?") !== false) {
$file_name = $value['filename'] . $separator
@ -72,7 +75,7 @@ class Scripts
$scripts[] = "scripts%5B%5D=" . $value['filename'];
}
}
$separator = PMA_URL_getArgSeparator();
$separator = URL::getArgSeparator();
$static_scripts = '';
// Using chunks of 20 files to avoid too long URLs
$script_chunks = array_chunk($scripts, 20);
@ -237,7 +240,7 @@ class Scripts
foreach ($this->_files as $file) {
$code .= sprintf(
'.add("%s",%d)',
PMA_escapeJsString($file['filename']),
Sanitize::escapeJsString($file['filename']),
$file['has_onload'] ? 1 : 0
);
}
@ -248,7 +251,7 @@ class Scripts
foreach ($this->_files as $file) {
if ($file['has_onload']) {
$code .= 'AJAX.fireOnload("';
$code .= PMA_escapeJsString($file['filename']);
$code .= Sanitize::escapeJsString($file['filename']);
$code .= '");';
}
}

16
libraries/ServerStatusData.php
View File

@ -8,6 +8,8 @@
*/
namespace PMA\libraries;
use PMA\libraries\URL;
/**
* This class provides data about the server status
*
@ -142,13 +144,13 @@ class ServerStatusData
// variable or section name => (name => url)
$links['table'][__('Flush (close) all tables')] = $this->selfUrl
. PMA_URL_getCommon(
. URL::getCommon(
array(
'flush' => 'TABLES'
)
);
$links['table'][__('Show open tables')]
= 'sql.php' . PMA_URL_getCommon(
= 'sql.php' . URL::getCommon(
array(
'sql_query' => 'SHOW OPEN TABLES',
'goto' => $this->selfUrl,
@ -157,7 +159,7 @@ class ServerStatusData
if ($GLOBALS['replication_info']['master']['status']) {
$links['repl'][__('Show slave hosts')]
= 'sql.php' . PMA_URL_getCommon(
= 'sql.php' . URL::getCommon(
array(
'sql_query' => 'SHOW SLAVE HOSTS',
'goto' => $this->selfUrl,
@ -173,7 +175,7 @@ class ServerStatusData
$links['qcache'][__('Flush query cache')]
= $this->selfUrl
. PMA_URL_getCommon(
. URL::getCommon(
array(
'flush' => 'QUERY CACHE'
)
@ -190,10 +192,10 @@ class ServerStatusData
$links['innodb'][__('Variables')]
= 'server_engines.php?engine=InnoDB&amp;'
. PMA_URL_getCommon(array(), 'html', '');
. URL::getCommon(array(), 'html', '');
$links['innodb'][__('InnoDB Status')]
= 'server_engines.php'
. PMA_URL_getCommon(
. URL::getCommon(
array(
'engine' => 'InnoDB',
'page' => 'Status'
@ -416,7 +418,7 @@ class ServerStatusData
*/
public function getMenuHtml()
{
$url_params = PMA_URL_getCommon();
$url_params = URL::getCommon();
$items = array(
array(
'name' => __('Server'),

4
libraries/Theme.php
View File

@ -7,6 +7,8 @@
*/
namespace PMA\libraries;
use PMA\libraries\URL;
/**
* handles theme
*
@ -402,7 +404,7 @@ class Theme
public function getPrintPreview()
{
$url_params = array('set_theme' => $this->getId());
$url = 'index.php' . PMA_URL_getCommon($url_params);
$url = 'index.php' . URL::getCommon($url_params);
$retval = '<div class="theme_preview">';
$retval .= '<h2>';

4
libraries/ThemeManager.php
View File

@ -7,6 +7,8 @@
*/
namespace PMA\libraries;
use PMA\libraries\URL;
/**
* phpMyAdmin theme manager
*
@ -357,7 +359,7 @@ class ThemeManager
if ($form) {
$select_box .= '<form name="setTheme" method="get"';
$select_box .= ' action="index.php" class="disableAjax">';
$select_box .= PMA_URL_getHiddenInputs();
$select_box .= URL::getHiddenInputs();
}
$theme_preview_path= './themes.php';

251
libraries/URL.php Normal file
View File

@ -0,0 +1,251 @@
<?php
/* vim: set expandtab sw=4 ts=4 sts=4: */
/**
* URL/hidden inputs generating.
*
* @package PhpMyAdmin
*/
namespace PMA\libraries;
class URL {
/**
* Generates text with hidden inputs.
*
* @param string|array $db optional database name
* (can also be an array of parameters)
* @param string $table optional table name
* @param int $indent indenting level
* @param string|array $skip do not generate a hidden field for this parameter
* (can be an array of strings)
*
* @see URL::getCommon()
*
* @return string string with input fields
*
* @access public
*/
public static function getHiddenInputs($db = '', $table = '',
$indent = 0, $skip = array()
) {
if (is_array($db)) {
$params =& $db;
$_indent = empty($table) ? $indent : $table;
$_skip = empty($indent) ? $skip : $indent;
$indent =& $_indent;
$skip =& $_skip;
} else {
$params = array();
if (mb_strlen($db)) {
$params['db'] = $db;
}
if (mb_strlen($table)) {
$params['table'] = $table;
}
}
if (! empty($GLOBALS['server'])
&& $GLOBALS['server'] != $GLOBALS['cfg']['ServerDefault']
) {
$params['server'] = $GLOBALS['server'];
}
if (empty($_COOKIE['pma_lang']) && ! empty($GLOBALS['lang'])) {
$params['lang'] = $GLOBALS['lang'];
}
if (empty($_COOKIE['pma_collation_connection'])
&& ! empty($GLOBALS['collation_connection'])
) {
$params['collation_connection'] = $GLOBALS['collation_connection'];
}
$params['token'] = $_SESSION[' PMA_token '];
if (! is_array($skip)) {
if (isset($params[$skip])) {
unset($params[$skip]);
}
} else {
foreach ($skip as $skipping) {
if (isset($params[$skipping])) {
unset($params[$skipping]);
}
}
}
return URL::getHiddenFields($params);
}
/**
* create hidden form fields from array with name => value
*
* <code>
* $values = array(
* 'aaa' => aaa,
* 'bbb' => array(
* 'bbb_0',
* 'bbb_1',
* ),
* 'ccc' => array(
* 'a' => 'ccc_a',
* 'b' => 'ccc_b',
* ),
* );
* echo URL::getHiddenFields($values);
*
* // produces:
* <input type="hidden" name="aaa" Value="aaa" />
* <input type="hidden" name="bbb[0]" Value="bbb_0" />
* <input type="hidden" name="bbb[1]" Value="bbb_1" />
* <input type="hidden" name="ccc[a]" Value="ccc_a" />
* <input type="hidden" name="ccc[b]" Value="ccc_b" />
* </code>
*
* @param array $values hidden values
* @param string $pre prefix
*
* @return string form fields of type hidden
*/
public static function getHiddenFields($values, $pre = '')
{
$fields = '';
foreach ($values as $name => $value) {
if (! empty($pre)) {
$name = $pre . '[' . $name . ']';
}
if (is_array($value)) {
$fields .= URL::getHiddenFields($value, $name);
} else {
// do not generate an ending "\n" because
// URL::getHiddenInputs() is sometimes called
// from a JS document.write()
$fields .= '<input type="hidden" name="' . htmlspecialchars($name)
. '" value="' . htmlspecialchars($value) . '" />';
}
}
return $fields;
}
/**
* Generates text with URL parameters.
*
* <code>
* $params['myparam'] = 'myvalue';
* $params['db'] = 'mysql';
* $params['table'] = 'rights';
* // note the missing ?
* echo 'script.php' . URL::getCommon($params);
* // produces with cookies enabled:
* // script.php?myparam=myvalue&amp;db=mysql&amp;table=rights
* // with cookies disabled:
* // script.php?server=1&amp;lang=en&amp;myparam=myvalue&amp;db=mysql
* // &amp;table=rights
*
* // note the missing ?
* echo 'script.php' . URL::getCommon();
* // produces with cookies enabled:
* // script.php
* // with cookies disabled:
* // script.php?server=1&amp;lang=en
* </code>
*
* @param mixed $params optional, Contains an associative array with url params
*
* @param string $encode 'html' to use htmlspecialchars() on the resulting
* URL (for a normal URL displayed in HTML) or
* something else to avoid using htmlspecialchars()
* (for a URL sent via a header);
* if not set,'html' is assumed
*
* @param string $divider optional character to use instead of '?'
*
* @return string string with URL parameters
* @access public
*/
public static function getCommon($params = array(), $encode = 'html', $divider = '?')
{
$separator = URL::getArgSeparator();
// avoid overwriting when creating navi panel links to servers
if (isset($GLOBALS['server'])
&& $GLOBALS['server'] != $GLOBALS['cfg']['ServerDefault']
&& ! isset($params['server'])
&& ! defined('PMA_SETUP')
) {
$params['server'] = $GLOBALS['server'];
}
if (empty($_COOKIE['pma_lang']) && ! empty($GLOBALS['lang'])) {
$params['lang'] = $GLOBALS['lang'];
}
if (empty($_COOKIE['pma_collation_connection'])
&& ! empty($GLOBALS['collation_connection'])
) {
$params['collation_connection'] = $GLOBALS['collation_connection'];
}
if (isset($_SESSION[' PMA_token '])) {
$params['token'] = $_SESSION[' PMA_token '];
}
if (empty($params)) {
return '';
}
$query = $divider . http_build_query($params, null, $separator);
if ($encode === 'html') {
$query = htmlspecialchars($query);
}
return $query;
}
/**
* Returns url separator
*
* extracted from arg_separator.input as set in php.ini
* we do not use arg_separator.output to avoid problems with &amp; and &
*
* @param string $encode whether to encode separator or not,
* currently 'none' or 'html'
*
* @return string character used for separating url parts usually ; or &
* @access public
*/
public static function getArgSeparator($encode = 'none')
{
static $separator = null;
static $html_separator = null;
if (null === $separator) {
// use separators defined by php, but prefer ';'
// as recommended by W3C
// (see http://www.w3.org/TR/1999/REC-html401-19991224/appendix
// /notes.html#h-B.2.2)
$arg_separator = ini_get('arg_separator.input');
if (mb_strpos($arg_separator, ';') !== false) {
$separator = ';';
} elseif (mb_strlen($arg_separator) > 0) {
$separator = $arg_separator{0};
} else {
$separator = '&';
}
$html_separator = htmlentities($separator);
}
switch ($encode) {
case 'html':
return $html_separator;
case 'text' :
case 'none' :
default :
return $separator;
}
}
}

48
libraries/Util.php
View File

@ -14,6 +14,8 @@ use SqlParser\Parser;
use SqlParser\Token;
use stdClass;
use SqlParser\Utils\Error as ParserError;
use PMA\libraries\URL;
use PMA\libraries\Sanitize;
if (! defined('PHPMYADMIN')) {
exit;
@ -711,14 +713,14 @@ class Util
$_url_params['db'] = $db;
$_url_params['table'] = $table;
$doedit_goto = '<a href="tbl_sql.php'
. PMA_URL_getCommon($_url_params) . '">';
. URL::getCommon($_url_params) . '">';
} elseif (mb_strlen($db)) {
$_url_params['db'] = $db;
$doedit_goto = '<a href="db_sql.php'
. PMA_URL_getCommon($_url_params) . '">';
. URL::getCommon($_url_params) . '">';
} else {
$doedit_goto = '<a href="server_sql.php'
. PMA_URL_getCommon($_url_params) . '">';
. URL::getCommon($_url_params) . '">';
}
$error_msg .= $doedit_goto
@ -1113,9 +1115,9 @@ class Util
$retval .= $message->getDisplay();
} else {
$retval .= '<div class="' . $type . '">';
$retval .= PMA_sanitize($message);
$retval .= Sanitize::sanitize($message);
if (isset($GLOBALS['special_message'])) {
$retval .= PMA_sanitize($GLOBALS['special_message']);
$retval .= Sanitize::sanitize($GLOBALS['special_message']);
unset($GLOBALS['special_message']);
}
$retval .= '</div>';
@ -1195,7 +1197,7 @@ class Util
$explain_params['sql_query'] = 'EXPLAIN ' . $sql_query;
$explain_link = ' ['
. self::linkOrButton(
'import.php' . PMA_URL_getCommon($explain_params),
'import.php' . URL::getCommon($explain_params),
__('Explain SQL')
) . ']';
} elseif (preg_match(
@ -1206,7 +1208,7 @@ class Util
= mb_substr($sql_query, 8);
$explain_link = ' ['
. self::linkOrButton(
'import.php' . PMA_URL_getCommon($explain_params),
'import.php' . URL::getCommon($explain_params),
__('Skip Explain SQL')
) . ']';
$url = 'https://mariadb.org/explain_analyzer/analyze/'
@ -1230,7 +1232,7 @@ class Util
// even if the query is big and was truncated, offer the chance
// to edit it (unless it's enormous, see linkOrButton() )
if (! empty($cfg['SQLQuery']['Edit'])) {
$edit_link .= PMA_URL_getCommon($url_params) . '#querybox';
$edit_link .= URL::getCommon($url_params) . '#querybox';
$edit_link = ' ['
. self::linkOrButton($edit_link, __('Edit'))
. ']';
@ -1245,7 +1247,7 @@ class Util
if (! empty($GLOBALS['show_as_php'])) {
$php_link = ' ['
. self::linkOrButton(
'import.php' . PMA_URL_getCommon($url_params),
'import.php' . URL::getCommon($url_params),
__('Without PHP code'),
array(),
true,
@ -1257,7 +1259,7 @@ class Util
$php_link .= ' ['
. self::linkOrButton(
'import.php' . PMA_URL_getCommon($url_params),
'import.php' . URL::getCommon($url_params),
__('Submit query'),
array(),
true,
@ -1272,7 +1274,7 @@ class Util
$_message = __('Create PHP code');
$php_link = ' ['
. self::linkOrButton(
'import.php' . PMA_URL_getCommon($php_params),
'import.php' . URL::getCommon($php_params),
$_message
)
. ']';
@ -1286,7 +1288,7 @@ class Util
&& ! isset($GLOBALS['show_as_php']) // 'Submit query' does the same
&& preg_match('@^(SELECT|SHOW)[[:space:]]+@i', $sql_query)
) {
$refresh_link = 'import.php' . PMA_URL_getCommon($url_params);
$refresh_link = 'import.php' . URL::getCommon($url_params);
$refresh_link = ' ['
. self::linkOrButton($refresh_link, __('Refresh')) . ']';
} else {
@ -1308,7 +1310,7 @@ class Util
$retval .= '<div class="tools print_ignore">';
$retval .= '<form action="sql.php" method="post">';
$retval .= PMA_URL_getHiddenInputs($GLOBALS['db'], $GLOBALS['table']);
$retval .= URL::getHiddenInputs($GLOBALS['db'], $GLOBALS['table']);
$retval .= '<input type="hidden" name="sql_query" value="'
. htmlspecialchars($sql_query) . '" />';
@ -1773,10 +1775,10 @@ class Util
// build the link
if (! empty($tab['link'])) {
$tab['link'] = htmlentities($tab['link']);
$tab['link'] = $tab['link'] . PMA_URL_getCommon($url_params);
$tab['link'] = $tab['link'] . URL::getCommon($url_params);
if (! empty($tab['args'])) {
foreach ($tab['args'] as $param => $value) {
$tab['link'] .= PMA_URL_getArgSeparator('html')
$tab['link'] .= URL::getArgSeparator('html')
. urlencode($param) . '=' . urlencode($value);
}
}
@ -1901,7 +1903,7 @@ class Util
$tag_params = array();
if (! empty($tmp)) {
$tag_params['onclick'] = 'return confirmLink(this, \''
. PMA_escapeJsString($tmp) . '\')';
. Sanitize::escapeJsString($tmp) . '\')';
}
unset($tmp);
}
@ -2036,7 +2038,7 @@ class Util
public static function splitURLQuery($url)
{
// decode encoded url separators
$separator = PMA_URL_getArgSeparator();
$separator = URL::getArgSeparator();
// on most places separator is still hard coded ...
if ($separator !== '&') {
// ... so always replace & with $separator
@ -2589,19 +2591,19 @@ class Util
$_url_params[$name] = 0;
$list_navigator_html .= '<a' . $class . $title1 . ' href="' . $script
. PMA_URL_getCommon($_url_params) . '">' . $caption1
. URL::getCommon($_url_params) . '">' . $caption1
. '</a>';
$_url_params[$name] = $pos - $max_count;
$list_navigator_html .= ' <a' . $class . $title2
. ' href="' . $script . PMA_URL_getCommon($_url_params) . '">'
. ' href="' . $script . URL::getCommon($_url_params) . '">'
. $caption2 . '</a>';
}
$list_navigator_html .= '<form action="' . basename($script)
. '" method="post">';
$list_navigator_html .= PMA_URL_getHiddenInputs($_url_params);
$list_navigator_html .= URL::getHiddenInputs($_url_params);
$list_navigator_html .= self::pageselector(
$name,
$max_count,
@ -2628,7 +2630,7 @@ class Util
$_url_params[$name] = $pos + $max_count;
$list_navigator_html .= '<a' . $class . $title3 . ' href="' . $script
. PMA_URL_getCommon($_url_params) . '" >' . $caption3
. URL::getCommon($_url_params) . '" >' . $caption3
. '</a>';
$_url_params[$name] = floor($count / $max_count) * $max_count;
@ -2637,7 +2639,7 @@ class Util
}
$list_navigator_html .= ' <a' . $class . $title4
. ' href="' . $script . PMA_URL_getCommon($_url_params) . '" >'
. ' href="' . $script . URL::getCommon($_url_params) . '" >'
. $caption4 . '</a>';
}
$list_navigator_html .= '</div>' . "\n";
@ -2691,7 +2693,7 @@ class Util
. Util::getScriptNameForOption(
$GLOBALS['cfg']['DefaultTabDatabase'], 'database'
)
. PMA_URL_getCommon(array('db' => $database)) . '" title="'
. URL::getCommon(array('db' => $database)) . '" title="'
. htmlspecialchars(
sprintf(
__('Jump to database "%s".'),

3
libraries/browse_foreigners.lib.php
View File

@ -5,6 +5,7 @@
*
* @package PhpMyAdmin
*/
use PMA\libraries\URL;
/**
* Function to get html for one relational key
@ -116,7 +117,7 @@ function PMA_getHtmlForRelationalFieldSelection($db, $table, $field, $foreignDat
. 'id="browse_foreign_form" name="browse_foreign_from" '
. 'action="browse_foreigners.php" method="post">'
. '<fieldset>'
. PMA_URL_getHiddenInputs($db, $table)
. URL::getHiddenInputs($db, $table)
. '<input type="hidden" name="field" value="' . htmlspecialchars($field)
. '" />'
. '<input type="hidden" name="fieldkey" value="'

13
libraries/central_columns.lib.php
View File

@ -7,6 +7,7 @@
*/
use PMA\libraries\Message;
use PMA\libraries\Util;
use PMA\libraries\URL;
/**
* Defines the central_columns parameters for the current user
@ -613,7 +614,7 @@ function PMA_getHTMLforTableNavigation($total_rows, $pos, $db)
if ($pos - $max_rows >= 0) {
$table_navigation_html .= '<td>'
. '<form action="db_central_columns.php" method="post">'
. PMA_URL_getHiddenInputs(
. URL::getHiddenInputs(
$db
)
. '<input type="hidden" name="pos" value="' . ($pos - $max_rows) . '" />'
@ -628,7 +629,7 @@ function PMA_getHTMLforTableNavigation($total_rows, $pos, $db)
$table_navigation_html .= '<td>';
$table_navigation_html .= '<form action="db_central_columns.php'
. '" method="post">'
. PMA_URL_getHiddenInputs(
. URL::getHiddenInputs(
$db
)
. '<input type="hidden" name="total_rows" value="' . $total_rows . '"/>';
@ -641,7 +642,7 @@ function PMA_getHTMLforTableNavigation($total_rows, $pos, $db)
if ($pos + $max_rows < $total_rows) {
$table_navigation_html .= '<td>'
. '<form action="db_central_columns.php" method="post">'
. PMA_URL_getHiddenInputs(
. URL::getHiddenInputs(
$db
)
. '<input type="hidden" name="pos" value="' . ($pos + $max_rows) . '" />'
@ -801,7 +802,7 @@ function PMA_getHTMLforAddCentralColumn($total_rows, $pos, $db)
__('Add column')
)
. '<form id="add_column" action="db_central_columns.php" method="post">'
. PMA_URL_getHiddenInputs(
. URL::getHiddenInputs(
$db
)
. '<input type="hidden" name="add_column" value="add">'
@ -835,7 +836,7 @@ function PMA_getHTMLforCentralColumnsTableRow($row, $odd_row, $row_num, $db)
{
$tableHtml = '<tr data-rownum="' . $row_num . '" id="f_' . $row_num . '" '
. 'class="' . ($odd_row ? 'odd' : 'even') . '">'
. PMA_URL_getHiddenInputs(
. URL::getHiddenInputs(
$db
)
. '<input type="hidden" name="edit_save" value="save">'
@ -1259,7 +1260,7 @@ function PMA_getHTMLforAddNewColumn($db)
. '<span>+</span> ' . __('Add new column') . '</a>'
. '<form id="add_new" style="min-width:100%;display:none" '
. 'method="post" action="db_central_columns.php">'
. PMA_URL_getHiddenInputs(
. URL::getHiddenInputs(
$db
)
. '<input type="hidden" name="add_new_column" value="add_new_column">'

16
libraries/common.inc.php
View File

@ -91,11 +91,6 @@ $GLOBALS['error_handler'] = new ErrorHandler();
*/
require './libraries/core.lib.php';
/**
* Input sanitizing
*/
require './libraries/sanitizing.lib.php';
/**
* Warning about missing PHP extensions.
*/
@ -112,17 +107,6 @@ mb_internal_encoding('utf-8');
*/
require './libraries/relation.lib.php';
if (! defined('PMA_MINIMUM_COMMON') || defined('PMA_SETUP')) {
/**
* JavaScript escaping.
*/
include_once './libraries/js_escape.lib.php';
/**
* Include URL/hidden inputs generating.
*/
include_once './libraries/url_generating.lib.php';
}
/******************************************************************************/
/* start procedural code label_start_procedural */

11
libraries/config/FormDisplay.php
View File

@ -14,12 +14,13 @@
*/
namespace PMA\libraries\config;
use PMA\libraries\Sanitize;
/**
* Core libraries.
*/
use PMA\libraries\Util;
require_once './libraries/js_escape.lib.php';
require_once './libraries/config/FormDisplay.tpl.php';
/**
@ -335,7 +336,7 @@ class FormDisplay
$js_lang_sent = true;
$js_lang = array();
foreach ($this->_jsLangStrings as $strName => $strValue) {
$js_lang[] = "'$strName': '" . PMA_jsFormat($strValue, false) . '\'';
$js_lang[] = "'$strName': '" . Sanitize::jsFormat($strValue, false) . '\'';
}
$js[] = "$.extend(PMA_messages, {\n\t"
. implode(",\n\t", $js_lang) . '})';
@ -459,7 +460,7 @@ class FormDisplay
case 'short_text':
case 'number_text':
case 'password':
$js_line .= '\'' . PMA_escapeJsString($value_default) . '\'';
$js_line .= '\'' . Sanitize::escapeJsString($value_default) . '\'';
break;
case 'checkbox':
$js_line .= $value_default ? 'true' : 'false';
@ -468,10 +469,10 @@ class FormDisplay
$value_default_js = is_bool($value_default)
? (int) $value_default
: $value_default;
$js_line .= '[\'' . PMA_escapeJsString($value_default_js) . '\']';
$js_line .= '[\'' . Sanitize::escapeJsString($value_default_js) . '\']';
break;
case 'list':
$js_line .= '\'' . PMA_escapeJsString(implode("\n", $value_default))
$js_line .= '\'' . Sanitize::escapeJsString(implode("\n", $value_default))
. '\'';
break;
}

8
libraries/config/FormDisplay.tpl.php
View File

@ -7,6 +7,8 @@
*/
use PMA\libraries\Template;
use PMA\libraries\Util;
use PMA\libraries\URL;
use PMA\libraries\Sanitize;
/**
* Displays top part of the form
@ -37,8 +39,8 @@ function PMA_displayFormTop($action = null, $method = 'post', $hidden_fields = n
$htmlOutput .= '<input type="hidden" name="check_page_refresh" '
. ' id="check_page_refresh" value="" />' . "\n";
}
$htmlOutput .= PMA_URL_getHiddenInputs('', '', 0, 'server') . "\n";
$htmlOutput .= PMA_getHiddenFields((array)$hidden_fields);
$htmlOutput .= URL::getHiddenInputs('', '', 0, 'server') . "\n";
$htmlOutput .= URL::getHiddenFields((array)$hidden_fields);
return $htmlOutput;
}
@ -481,7 +483,7 @@ function PMA_addJsValidate($field_id, $validators, &$js_array)
$v_name = "PMA_" . $v_name;
$v_args = array();
foreach ($validator as $arg) {
$v_args[] = PMA_escapeJsString($arg);
$v_args[] = Sanitize::escapeJsString($arg);
}
$v_args = $v_args ? ", ['" . implode("', '", $v_args) . "']" : '';
$js_array[] = "validateField('$field_id', '$v_name', true$v_args)";

30
libraries/config/ServerConfigChecks.php
View File

@ -7,6 +7,8 @@
*/
namespace PMA\libraries\config;
use PMA\libraries\URL;
/**
* Performs various compatibility, security and consistency checks on current config
*
@ -376,13 +378,13 @@ class ServerConfigChecks
);
$sAllowArbitraryServerWarn = sprintf(
$sAllowArbitraryServerWarn,
'[a@?page=form' . PMA_URL_getCommon(array(), 'html', '&')
'[a@?page=form' . URL::getCommon(array(), 'html', '&')
. '&amp;formset=Features#tab_Security]',
'[/a]',
'[a@?page=form' . PMA_URL_getCommon(array(), 'html', '&')
'[a@?page=form' . URL::getCommon(array(), 'html', '&')
. '&amp;formset=Features#tab_Security]',
'[/a]',
'[a@?page=form' . PMA_URL_getCommon(array(), 'html', '&')
'[a@?page=form' . URL::getCommon(array(), 'html', '&')
. '&amp;formset=Features#tab_Security]',
'[/a]'
);
@ -398,7 +400,7 @@ class ServerConfigChecks
);
$sBZipDumpWarning = sprintf(
$sBZipDumpWarning,
'[a@?page=form' . PMA_URL_getCommon(array(), 'html', '&')
'[a@?page=form' . URL::getCommon(array(), 'html', '&')
. '&amp;formset=Features#tab_Import_export]',
'[/a]', '%s'
);
@ -413,7 +415,7 @@ class ServerConfigChecks
);
$sGZipDumpWarning = sprintf(
$sGZipDumpWarning,
'[a@?page=form' . PMA_URL_getCommon(array(), 'html', '&')
'[a@?page=form' . URL::getCommon(array(), 'html', '&')
. '&amp;formset=Features#tab_Import_export]',
'[/a]',
'%s'
@ -425,7 +427,7 @@ class ServerConfigChecks
);
$sLoginCookieValidityWarn = sprintf(
$sLoginCookieValidityWarn,
'[a@?page=form' . PMA_URL_getCommon(array(), 'html', '&')
'[a@?page=form' . URL::getCommon(array(), 'html', '&')
. '&amp;formset=Features#tab_Security]',
'[/a]',
'[a@' . PMA_getPHPDocLink(
@ -441,7 +443,7 @@ class ServerConfigChecks
);
$sLoginCookieValidityWarn2 = sprintf(
$sLoginCookieValidityWarn2,
'[a@?page=form' . PMA_URL_getCommon(array(), 'html', '&')
'[a@?page=form' . URL::getCommon(array(), 'html', '&')
. '&amp;formset=Features#tab_Security]',
'[/a]'
);
@ -452,10 +454,10 @@ class ServerConfigChecks
);
$sLoginCookieValidityWarn3 = sprintf(
$sLoginCookieValidityWarn3,
'[a@?page=form' . PMA_URL_getCommon(array(), 'html', '&')
'[a@?page=form' . URL::getCommon(array(), 'html', '&')
. '&amp;formset=Features#tab_Security]',
'[/a]',
'[a@?page=form' . PMA_URL_getCommon(array(), 'html', '&')
'[a@?page=form' . URL::getCommon(array(), 'html', '&')
. '&amp;formset=Features#tab_Security]',
'[/a]'
);
@ -467,10 +469,10 @@ class ServerConfigChecks
);
$sSecurityInfoMsg = sprintf(
$sSecurityInfoMsg,
'[a@?page=servers' . PMA_URL_getCommon(array(), 'html', '&')
'[a@?page=servers' . URL::getCommon(array(), 'html', '&')
. '&amp;mode=edit&amp;id=%1$d#tab_Server_config]',
'[/a]',
'[a@?page=form' . PMA_URL_getCommon(array(), 'html', '&')
'[a@?page=form' . URL::getCommon(array(), 'html', '&')
. '&amp;formset=Features#tab_Security]',
'[/a]'
);
@ -483,7 +485,7 @@ class ServerConfigChecks
);
$sServerAuthConfigMsg = sprintf(
$sServerAuthConfigMsg,
'[a@?page=servers' . PMA_URL_getCommon(array(), 'html', '&')
'[a@?page=servers' . URL::getCommon(array(), 'html', '&')
. '&amp;mode=edit&amp;id=%1$d#tab_Server]',
'[/a]'
);
@ -493,7 +495,7 @@ class ServerConfigChecks
);
$sZipDumpExportWarn = sprintf(
$sZipDumpExportWarn,
'[a@?page=form' . PMA_URL_getCommon(array(), 'html', '&')
'[a@?page=form' . URL::getCommon(array(), 'html', '&')
. '&amp;formset=Features#tab_Import_export]',
'[/a]',
'%s'
@ -504,7 +506,7 @@ class ServerConfigChecks
);
$sZipDumpImportWarn = sprintf(
$sZipDumpImportWarn,
'[a@?page=form' . PMA_URL_getCommon(array(), 'html', '&')
'[a@?page=form' . URL::getCommon(array(), 'html', '&')
. '&amp;formset=Features#tab_Import_export]',
'[/a]',
'%s'

5
libraries/config/config_functions.lib.php
View File

@ -5,11 +5,12 @@
*
* @package PhpMyAdmin
*/
use PMA\libraries\Sanitize;
/**
* Returns sanitized language string, taking into account our special codes
* for formatting. Takes variable number of arguments.
* Based on PMA_sanitize from sanitize.lib.php.
* Based on Sanitize::sanitize from sanitize.lib.php.
*
* @param string $lang_key key in $GLOBALS WITHOUT 'strSetup' prefix
*
@ -20,7 +21,7 @@ function PMA_lang($lang_key)
$message = isset($GLOBALS["strConfig$lang_key"])
? $GLOBALS["strConfig$lang_key"] : $lang_key;
$message = PMA_sanitize($message);
$message = Sanitize::sanitize($message);
if (func_num_args() == 1) {
return $message;

6
libraries/controllers/database/DatabaseStructureController.php
View File

@ -16,6 +16,8 @@ use PMA\libraries\RecentFavoriteTable;
use PMA\libraries\Template;
use PMA\libraries\Tracker;
use PMA\libraries\Util;
use PMA\libraries\URL;
use PMA\libraries\Sanitize;
require_once 'libraries/mysql_charsets.inc.php';
require_once 'libraries/display_create_table.lib.php';
@ -343,7 +345,7 @@ class DatabaseStructureController extends DatabaseController
public function multiSubmitAction()
{
$action = 'db_structure.php';
$err_url = 'db_structure.php' . PMA_URL_getCommon(
$err_url = 'db_structure.php' . URL::getCommon(
array('db' => $this->db)
);
@ -754,7 +756,7 @@ class DatabaseStructureController extends DatabaseController
) {
$approx_rows = true;
$show_superscript = Util::showHint(
PMA_sanitize(
Sanitize::sanitize(
sprintf(
__(
'This view has at least this number of '

9
libraries/controllers/server/ServerBinlogController.php
View File

@ -14,6 +14,7 @@ use PMA\libraries\DatabaseInterface;
use PMA\libraries\Message;
use PMA\libraries\Util;
use PMA\libraries\Template;
use PMA\libraries\URL;
/**
* Handles viewing binary logs
@ -188,7 +189,7 @@ class ServerBinlogController extends Controller
}
$html .= '<a href="server_binlog.php'
. PMA_URL_getCommon($this_url_params) . '"';
. URL::getCommon($this_url_params) . '"';
if (Util::showIcons('TableNavigationLinksMode')) {
$html .= ' title="' . _pgettext('Previous page', 'Previous') . '">';
} else {
@ -210,7 +211,7 @@ class ServerBinlogController extends Controller
$tempTitle = __('Show Full Queries');
$tempImgMode = 'full';
}
$html .= '<a href="server_binlog.php' . PMA_URL_getCommon($this_url_params)
$html .= '<a href="server_binlog.php' . URL::getCommon($this_url_params)
. '" title="' . $tempTitle . '">'
. '<img src="' . $GLOBALS['pmaThemeImage'] . 's_' . $tempImgMode
. 'text.png" alt="' . $tempTitle . '" /></a>';
@ -221,7 +222,7 @@ class ServerBinlogController extends Controller
$this_url_params = $url_params;
$this_url_params['pos'] = $pos + $GLOBALS['cfg']['MaxRows'];
$html .= ' - <a href="server_binlog.php'
. PMA_URL_getCommon($this_url_params)
. URL::getCommon($this_url_params)
. '"';
if (Util::showIcons('TableNavigationLinksMode')) {
$html .= ' title="' . _pgettext('Next page', 'Next') . '">';
@ -259,4 +260,4 @@ class ServerBinlogController extends Controller
}
return $html;
}
}
}

7
libraries/controllers/server/ServerDatabasesController.php
View File

@ -13,6 +13,7 @@ use PMA\libraries\controllers\Controller;
use PMA\libraries\Message;
use PMA\libraries\Template;
use PMA\libraries\Util;
use PMA\libraries\URL;
/**
* Handles viewing and creating and deleting databases
@ -163,7 +164,7 @@ class ServerDatabasesController extends Controller
'sql_query', Util::getMessage(null, $sql_query, 'success')
);
$url_query = PMA_URL_getCommon(array('db' => $_POST['new_db']));
$url_query = URL::getCommon(array('db' => $_POST['new_db']));
$this->response->addJSON(
'url_query',
Util::getScriptNameForOption(
@ -186,7 +187,7 @@ class ServerDatabasesController extends Controller
$message = Message::error(__('No databases selected.'));
} else {
$action = 'server_databases.php';
$err_url = $action . PMA_URL_getCommon();
$err_url = $action . URL::getCommon();
$GLOBALS['submit_mult'] = 'drop_db';
$GLOBALS['mult_btn'] = __('Yes');
@ -279,7 +280,7 @@ class ServerDatabasesController extends Controller
$html .= '<form class="ajax" action="server_databases.php" ';
$html .= 'method="post" name="dbStatsForm" id="dbStatsForm">' . "\n";
$html .= PMA_URL_getHiddenInputs($_url_params);
$html .= URL::getHiddenInputs($_url_params);
$_url_params['sort_by'] = 'SCHEMA_NAME';
$_url_params['sort_order']

3
libraries/controllers/server/ServerVariablesController.php
View File

@ -13,6 +13,7 @@ use PMA\libraries\controllers\Controller;
use PMA\libraries\Message;
use PMA\libraries\Template;
use PMA\libraries\Util;
use PMA\libraries\URL;
/**
* Handles viewing and editing server variables
@ -254,7 +255,7 @@ class ServerVariablesController extends Controller
*/
private function _getHtmlForLinkTemplates()
{
$url = 'server_variables.php' . PMA_URL_getCommon();
$url = 'server_variables.php' . URL::getCommon();
return Template::get('server/variables/link_template')
->render(array('url' => $url));
}

3
libraries/controllers/table/TableGisVisualizationController.php
View File

@ -13,6 +13,7 @@ use PMA\libraries\controllers\TableController;
use PMA\libraries\Message;
use PMA\libraries\Template;
use PMA\libraries\gis\GISVisualization;
use PMA\libraries\URL;
require_once 'libraries/common.inc.php';
require_once 'libraries/db_common.inc.php';
@ -185,7 +186,7 @@ class TableGisVisualizationController extends TableController
* Displays the page
*/
$this->url_params['sql_query'] = $this->sql_query;
$downloadUrl = 'tbl_gis_visualization.php' . PMA_URL_getCommon(
$downloadUrl = 'tbl_gis_visualization.php' . URL::getCommon(
array_merge(
$this->url_params,
array(

5
libraries/controllers/table/TableStructureController.php
View File

@ -20,6 +20,7 @@ use SqlParser\Statements\CreateStatement;
use SqlParser\Utils\Table as SqlTable;
use PMA\libraries\Table;
use PMA\libraries\controllers\TableController;
use PMA\libraries\URL;
require_once 'libraries/mysql_charsets.inc.php';
require_once 'libraries/transformations.lib.php';
@ -826,7 +827,7 @@ class TableStructureController extends TableController
*/
protected function updateColumns()
{
$err_url = 'tbl_structure.php' . PMA_URL_getCommon(
$err_url = 'tbl_structure.php' . URL::getCommon(
array(
'db' => $this->db, 'table' => $this->table
)
@ -1228,7 +1229,7 @@ class TableStructureController extends TableController
);
$edit_view_url = 'view_create.php'
. PMA_URL_getCommon($url_params) . '&amp;'
. URL::getCommon($url_params) . '&amp;'
. implode(
'&amp;',
array_map(

13
libraries/core.lib.php
View File

@ -8,6 +8,9 @@
* @package PhpMyAdmin
*/
use PMA\libraries\Message;
use PMA\libraries\URL;
use PMA\libraries\Sanitize;
if (! defined('PHPMYADMIN')) {
exit;
@ -478,7 +481,6 @@ function PMA_getenv($var_name)
function PMA_sendHeaderLocation($uri, $use_refresh = false)
{
if ($GLOBALS['PMA_Config']->get('PMA_IS_IIS') && mb_strlen($uri) > 600) {
include_once './libraries/js_escape.lib.php';
PMA\libraries\Response::getInstance()->disable();
echo PMA\libraries\Template::get('header_location')
@ -493,7 +495,7 @@ function PMA_sendHeaderLocation($uri, $use_refresh = false)
if (mb_strpos($uri, '?') === false) {
$response->header('Location: ' . $uri . '?' . SID);
} else {
$separator = PMA_URL_getArgSeparator();
$separator = URL::getArgSeparator();
$response->header('Location: ' . $uri . $separator . SID);
}
return;
@ -705,13 +707,10 @@ function PMA_linkURL($url)
return $url;
}
if (!function_exists('PMA_URL_getCommon')) {
include_once './libraries/url_generating.lib.php';
}
$params = array();
$params['url'] = $url;
$url = PMA_URL_getCommon($params);
$url = URL::getCommon($params);
//strip off token and such sensitive information. Just keep url.
$arr = parse_url($url);
parse_str($arr["query"], $vars);
@ -793,7 +792,7 @@ function PMA_addJSCode($str)
*/
function PMA_addJSVar($key, $value, $escape = true)
{
PMA_addJSCode(PMA_getJsValue($key, $value, $escape));
PMA_addJSCode(Sanitize::getJsValue($key, $value, $escape));
}
/**

9
libraries/db_common.inc.php
View File

@ -7,6 +7,7 @@
*/
use PMA\libraries\Message;
use PMA\libraries\Response;
use PMA\libraries\URL;
if (! defined('PHPMYADMIN')) {
exit;
@ -32,12 +33,12 @@ if ($db_is_system_schema) {
/**
* Defines the urls to return to in case of error in a sql statement
*/
$err_url_0 = 'index.php' . PMA_URL_getCommon();
$err_url_0 = 'index.php' . URL::getCommon();
$err_url = PMA\libraries\Util::getScriptNameForOption(
$GLOBALS['cfg']['DefaultTabDatabase'], 'database'
)
. PMA_URL_getCommon(array('db' => $db));
. URL::getCommon(array('db' => $db));
/**
* Ensures the database exists (else move to the "parent" script) and displays
@ -58,7 +59,7 @@ if (! isset($is_db) || ! $is_db) {
}
// Not a valid db name -> back to the welcome page
$uri = './index.php'
. PMA_URL_getCommon(array(), 'text')
. URL::getCommon(array(), 'text')
. (isset($message) ? '&message=' . urlencode($message) : '') . '&reload=1';
if (!mb_strlen($db) || ! $is_db) {
$response = PMA\libraries\Response::getInstance();
@ -106,5 +107,5 @@ if (isset($_REQUEST['submitcollation'])
/**
* Set parameters for links
*/
$url_query = PMA_URL_getCommon(array('db' => $db));
$url_query = URL::getCommon(array('db' => $db));

3
libraries/db_table_exists.lib.php
View File

@ -7,6 +7,7 @@
* @package PhpMyAdmin
*/
use PMA\libraries\Message;
use PMA\libraries\URL;
if (! defined('PHPMYADMIN')) {
exit;
@ -42,7 +43,7 @@ if (empty($is_db)) {
}
PMA_sendHeaderLocation(
'./index.php'
. PMA_URL_getCommon($url_params, 'text')
. URL::getCommon($url_params, 'text')
);
}
exit;

3
libraries/display_change_password.lib.php
View File

@ -6,6 +6,7 @@
* @package PhpMyAdmin
*/
use PMA\libraries\Message;
use PMA\libraries\URL;
/**
* Get HTML for the Change password dialog
@ -32,7 +33,7 @@ function PMA_getHtmlForChangePassword($mode, $username, $hostname)
. 'name="chgPassword" '
. 'class="' . ($is_privileges ? 'submenu-item' : '') . '">';
$html .= PMA_URL_getHiddenInputs();
$html .= URL::getHiddenInputs();
if (strpos($GLOBALS['PMA_PHP_SELF'], 'server_privileges') !== false) {
$html .= '<input type="hidden" name="username" '

7
libraries/display_export.lib.php
View File

@ -9,6 +9,7 @@
use PMA\libraries\Message;
use PMA\libraries\plugins\ExportPlugin;
use PMA\libraries\Table;
use PMA\libraries\URL;
/**
* Outputs appropriate checked statement for checkbox.
@ -107,11 +108,11 @@ function PMA_getHtmlForHiddenInput(
global $cfg;
$html = "";
if ($export_type == 'server') {
$html .= PMA_URL_getHiddenInputs('', '', 1);
$html .= URL::getHiddenInputs('', '', 1);
} elseif ($export_type == 'database') {
$html .= PMA_URL_getHiddenInputs($db, '', 1);
$html .= URL::getHiddenInputs($db, '', 1);
} else {
$html .= PMA_URL_getHiddenInputs($db, $table, 1);
$html .= URL::getHiddenInputs($db, $table, 1);
}
// just to keep this value for possible next display of this form after saving

28
libraries/display_import.lib.php
View File

@ -10,6 +10,8 @@
*/
use PMA\libraries\Message;
use PMA\libraries\plugins\ImportPlugin;
use PMA\libraries\URL;
use PMA\libraries\Sanitize;
/**
* Prints Html For Display Import Hidden Input
@ -24,11 +26,11 @@ function PMA_getHtmlForHiddenInputs($import_type, $db, $table)
{
$html = '';
if ($import_type == 'server') {
$html .= PMA_URL_getHiddenInputs('', '', 1);
$html .= URL::getHiddenInputs('', '', 1);
} elseif ($import_type == 'database') {
$html .= PMA_URL_getHiddenInputs($db, '', 1);
$html .= URL::getHiddenInputs($db, '', 1);
} else {
$html .= PMA_URL_getHiddenInputs($db, $table, 1);
$html .= URL::getHiddenInputs($db, $table, 1);
}
$html .= ' <input type="hidden" name="import_type" value="'
. $import_type . '" />' . "\n";
@ -64,7 +66,7 @@ function PMA_getHtmlForImportJS($upload_id)
} else { // no plugin available
$image_tag = '<img src="' . $GLOBALS['pmaThemeImage']
. 'ajax_clock_small.gif" width="16" height="16" alt="ajax clock" /> '
. PMA_jsFormat(
. Sanitize::jsFormat(
__(
'Please be patient, the file is being uploaded. '
. 'Details about the upload are not available.'
@ -474,8 +476,8 @@ function PMA_getHtmlForImportWithPlugin($upload_id)
{
//some variable for javascript
$ajax_url = "import_status.php?id=" . $upload_id . "&"
. PMA_URL_getCommon(array('import_status'=>1), 'text');
$promot_str = PMA_jsFormat(
. URL::getCommon(array('import_status'=>1), 'text');
$promot_str = Sanitize::jsFormat(
__(
'The file being uploaded is probably larger than '
. 'the maximum allowed size or this is a known bug in webkit '
@ -483,16 +485,16 @@ function PMA_getHtmlForImportWithPlugin($upload_id)
),
false
);
$statustext_str = PMA_escapeJsString(__('%s of %s'));
$upload_str = PMA_jsFormat(__('Uploading your import file…'), false);
$second_str = PMA_jsFormat(__('%s/sec.'), false);
$remaining_min = PMA_jsFormat(__('About %MIN min. %SEC sec. remaining.'), false);
$remaining_second = PMA_jsFormat(__('About %SEC sec. remaining.'), false);
$processed_str = PMA_jsFormat(
$statustext_str = Sanitize::escapeJsString(__('%s of %s'));
$upload_str = Sanitize::jsFormat(__('Uploading your import file…'), false);
$second_str = Sanitize::jsFormat(__('%s/sec.'), false);
$remaining_min = Sanitize::jsFormat(__('About %MIN min. %SEC sec. remaining.'), false);
$remaining_second = Sanitize::jsFormat(__('About %SEC sec. remaining.'), false);
$processed_str = Sanitize::jsFormat(
__('The file is being processed, please be patient.'),
false
);
$import_url = PMA_URL_getCommon(array('import_status'=>1), 'text');
$import_url = URL::getCommon(array('import_status'=>1), 'text');
//start output
$html = 'var finished = false; ';

3
libraries/display_select_lang.lib.php
View File

@ -6,6 +6,7 @@
* @package PhpMyAdmin
*/
use PMA\libraries\LanguageManager;
use PMA\libraries\URL;
/**
* Returns HTML code for the language selector
@ -31,7 +32,7 @@ function PMA_getLanguageSelectorHtml($use_fieldset = false, $show_doc = true)
'db' => $GLOBALS['db'],
'table' => $GLOBALS['table'],
);
$retval .= PMA_URL_getHiddenInputs($_form_params);
$retval .= URL::getHiddenInputs($_form_params);
// For non-English, display "Language" with emphasis because it's
// not a proper word in the current language; we show it to help

3
libraries/error.inc.php
View File

@ -5,6 +5,7 @@
*
* @package PhpMyAdmin
*/
use PMA\libraries\Sanitize;
if (! defined('PHPMYADMIN')) {
exit;
@ -53,6 +54,6 @@ if (! defined('TESTSUITE')) {
</head>
<body>
<h1>phpMyAdmin - <?php echo $error_header; ?></h1>
<p><?php echo PMA_sanitize($error_message); ?></p>
<p><?php echo Sanitize::sanitize($error_message); ?></p>
</body>
</html>

5
libraries/error_report.lib.php
View File

@ -5,6 +5,7 @@
*
* @package PhpMyAdmin
*/
use PMA\libraries\URL;
if (! defined('PHPMYADMIN')) {
exit;
@ -337,13 +338,13 @@ function PMA_getErrorReportForm()
{
$datas = array(
'report_data' => PMA_getPrettyReportData(),
'hidden_inputs' => PMA_URL_getHiddenInputs(),
'hidden_inputs' => URL::getHiddenInputs(),
'hidden_fields' => null,
);
$reportData = PMA_getReportData();
if (!empty($reportData)) {
$datas['hidden_fields'] = PMA_getHiddenFields($reportData);
$datas['hidden_fields'] = URL::getHiddenFields($reportData);
}
return PMA\libraries\Template::get('error/report_form')

11
libraries/export.lib.php
View File

@ -10,6 +10,9 @@ use PMA\libraries\Message;
use PMA\libraries\plugins\ExportPlugin;
use PMA\libraries\Table;
use PMA\libraries\ZipFile;
use PMA\libraries\URL;
use PMA\libraries\Sanitize;
/**
* Sets a session variable upon a possible fatal error during export
@ -280,7 +283,7 @@ function PMA_getExportFilenameAndMimetype(
$filename = PMA\libraries\Util::expandUserString($filename_template);
// remove dots in filename (coming from either the template or already
// part of the filename) to avoid a remote code execution vulnerability
$filename = PMA_sanitizeFilename($filename, $replaceDots = true);
$filename = Sanitize::sanitizeFilename($filename, $replaceDots = true);
// Grab basic dump extension and mime type
// Check if the user already added extension;
@ -475,11 +478,11 @@ function PMA_getHtmlForDisplayedExportHeader($export_type, $db, $table)
*/
$back_button = '<p>[ <a href="';
if ($export_type == 'server') {
$back_button .= 'server_export.php' . PMA_URL_getCommon();
$back_button .= 'server_export.php' . URL::getCommon();
} elseif ($export_type == 'database') {
$back_button .= 'db_export.php' . PMA_URL_getCommon(array('db' => $db));
$back_button .= 'db_export.php' . URL::getCommon(array('db' => $db));
} else {
$back_button .= 'tbl_export.php' . PMA_URL_getCommon(
$back_button .= 'tbl_export.php' . URL::getCommon(
array(
'db' => $db, 'table' => $table
)

5
libraries/gis/GISVisualization.php
View File

@ -9,7 +9,8 @@
namespace PMA\libraries\gis;
use PMA\libraries\Util;
use TCPDF;
use \TCPDF;
use PMA\libraries\Sanitize;
require_once 'libraries/sql.lib.php';
@ -245,7 +246,7 @@ class GISVisualization
*/
private function _sanitizeName($file_name, $ext)
{
$file_name = PMA_sanitizeFilename($file_name);
$file_name = Sanitize::sanitizeFilename($file_name);
// Check if the user already added extension;
// get the substring where the extension would be if it was included

13
libraries/import.lib.php
View File

@ -8,6 +8,7 @@
use PMA\libraries\Message;
use PMA\libraries\Table;
use PMA\libraries\Util;
use PMA\libraries\URL;
if (! defined('PHPMYADMIN')) {
exit;
@ -1246,8 +1247,8 @@ function PMA_buildSQL($db_name, &$tables, &$analyses = null,
}
$params = array('db' => (string)$db_name);
$db_url = 'db_structure.php' . PMA_URL_getCommon($params);
$db_ops_url = 'db_operations.php' . PMA_URL_getCommon($params);
$db_url = 'db_structure.php' . URL::getCommon($params);
$db_ops_url = 'db_operations.php' . URL::getCommon($params);
$message = '<br /><br />';
$message .= '<strong>' . __(
@ -1287,9 +1288,9 @@ function PMA_buildSQL($db_name, &$tables, &$analyses = null,
'db' => (string) $db_name,
'table' => (string) $tables[$i][TBL_NAME]
);
$tbl_url = 'sql.php' . PMA_URL_getCommon($params);
$tbl_struct_url = 'tbl_structure.php' . PMA_URL_getCommon($params);
$tbl_ops_url = 'tbl_operations.php' . PMA_URL_getCommon($params);
$tbl_url = 'sql.php' . URL::getCommon($params);
$tbl_struct_url = 'tbl_structure.php' . URL::getCommon($params);
$tbl_ops_url = 'tbl_operations.php' . URL::getCommon($params);
unset($params);
@ -1469,7 +1470,7 @@ function PMA_getMatchedRows($analyzed_sql_results = array())
'db' => $GLOBALS['db'],
'sql_query' => $matched_row_query
);
$matched_rows_url = 'sql.php' . PMA_URL_getCommon($_url_params);
$matched_rows_url = 'sql.php' . URL::getCommon($_url_params);
return array(
'sql_query' => PMA\libraries\Util::formatSql($analyzed_sql_results['query']),

3
libraries/index.lib.php
View File

@ -5,6 +5,7 @@
*
* @package PhpMyAdmin
*/
use PMA\libraries\URL;
/**
* Get HTML for display indexes
@ -28,7 +29,7 @@ function PMA_getHtmlForDisplayIndexes()
);
$html_output .= '<fieldset class="tblFooters print_ignore" style="text-align: '
. 'left;"><form action="tbl_indexes.php" method="post">';
$html_output .= PMA_URL_getHiddenInputs(
$html_output .= URL::getHiddenInputs(
$GLOBALS['db'], $GLOBALS['table']
);
$html_output .= sprintf(

24
libraries/insert_edit.lib.php
View File

@ -7,6 +7,8 @@
*/
use PMA\libraries\Message;
use PMA\libraries\plugins\TransformationsPlugin;
use PMA\libraries\URL;
use PMA\libraries\Sanitize;
/**
* Retrieve form parameters for insert/edit form
@ -222,12 +224,12 @@ function PMA_showTypeOrFunction($which, $url_params, $is_show)
if (! $is_show) {
return ' : <a href="tbl_change.php'
. PMA_URL_getCommon($this_url_params) . '">'
. URL::getCommon($this_url_params) . '">'
. PMA_showTypeOrFunctionLabel($which)
. '</a>';
}
return '<th><a href="tbl_change.php'
. PMA_URL_getCommon($this_url_params)
. URL::getCommon($this_url_params)
. '" title="' . __('Hide') . '">'
. PMA_showTypeOrFunctionLabel($which)
. '</a></th>';
@ -466,7 +468,7 @@ function PMA_getNullColumn($column, $column_name_appendix, $real_null_value,
$html_output .= '<input type="hidden" class="hashed_field" name="hashed_field'
. $column_name_appendix . '" value="' . $column['Field_md5'] . '" />';
$html_output .= '<input type="hidden" class="multi_edit" name="multi_edit'
. $column_name_appendix . '" value="' . PMA_escapeJsString($vkey) . '" />';
. $column_name_appendix . '" value="' . Sanitize::escapeJsString($vkey) . '" />';
$html_output .= '</td>' . "\n";
return $html_output;
@ -675,7 +677,7 @@ function PMA_getForeignLink($column, $backup_field, $column_name_appendix,
. 'value="' . htmlspecialchars($data) . '" />';
$html_output .= '<a class="ajax browse_foreign" href="browse_foreigners.php'
. PMA_URL_getCommon(
. URL::getCommon(
array(
'db' => $db,
'table' => $table,
@ -1377,7 +1379,7 @@ function PMA_getContinueInsertionForm($table, $db, $where_clause_array, $err_url
{
$html_output = '<form id="continueForm" method="post"'
. ' action="tbl_replace.php" name="continueForm">'
. PMA_URL_getHiddenInputs($db, $table)
. URL::getHiddenInputs($db, $table)
. '<input type="hidden" name="goto"'
. ' value="' . htmlspecialchars($GLOBALS['goto']) . '" />'
. '<input type="hidden" name="err_url"'
@ -1890,7 +1892,7 @@ function PMA_getErrorUrl($url_params)
if (isset($_REQUEST['err_url'])) {
return $_REQUEST['err_url'];
} else {
return 'tbl_change.php' . PMA_URL_getCommon($url_params);
return 'tbl_change.php' . URL::getCommon($url_params);
}
}
@ -2084,7 +2086,7 @@ function PMA_getLinkForRelationalDisplayField($map, $relation_field,
. $where_comparison
);
$output = '<a href="sql.php'
. PMA_URL_getCommon($_url_params) . '"' . $title . '>';
. URL::getCommon($_url_params) . '"' . $title . '>';
if ('D' == $_SESSION['tmpval']['relational_display']) {
// user chose "relational display field" in the
@ -2131,7 +2133,7 @@ function PMA_transformEditedValues($db, $table,
: ''
);
$transform_options['wrapper_link']
= PMA_URL_getCommon($_url_params);
= URL::getCommon($_url_params);
$class_name = PMA_getTransformationClassName($include_file);
/** @var TransformationsPlugin $transformation_plugin */
$transformation_plugin = new $class_name();
@ -2726,8 +2728,8 @@ function PMA_getHtmlForInsertEditFormColumn($table_columns, $column_number,
//Call validation when the form submitted...
$onChangeClause = $chg_evt_handler
. "=\"return verificationsAfterFieldChange('"
. PMA_escapeJsString($column['Field_md5']) . "', '"
. PMA_escapeJsString($jsvkey) . "','" . $column['pma_type'] . "')\"";
. Sanitize::escapeJsString($column['Field_md5']) . "', '"
. Sanitize::escapeJsString($jsvkey) . "','" . $column['pma_type'] . "')\"";
// Use an MD5 as an array index to avoid having special characters
// in the name attribute (see bug #1746964 )
@ -2846,7 +2848,7 @@ function PMA_getHtmlForInsertEditFormColumn($table_columns, $column_number,
'where_clause' => $where_clause
);
$transformation_options['wrapper_link']
= PMA_URL_getCommon($_url_params);
= URL::getCommon($_url_params);
$current_value = '';
if (isset($current_row[$column['Field']])) {
$current_value = $current_row[$column['Field']];

175
libraries/js_escape.lib.php
View File

@ -1,175 +0,0 @@
<?php
/* vim: set expandtab sw=4 ts=4 sts=4: */
/**
* Javascript escaping functions.
*
* @package PhpMyAdmin
*
*/
/**
* Format a string so it can be a string inside JavaScript code inside an
* eventhandler (onclick, onchange, on..., ).
* This function is used to displays a javascript confirmation box for
* "DROP/DELETE/ALTER" queries.
*
* @param string $a_string the string to format
* @param boolean $add_backquotes whether to add backquotes to the string or not
*
* @return string the formatted string
*
* @access public
*/
function PMA_jsFormat($a_string = '', $add_backquotes = true)
{
if (is_string($a_string)) {
$a_string = htmlspecialchars($a_string);
$a_string = PMA_escapeJsString($a_string);
// Needed for inline javascript to prevent some browsers
// treating it as a anchor
$a_string = str_replace('#', '\\#', $a_string);
}
return $add_backquotes
? PMA\libraries\Util::backquote($a_string)
: $a_string;
} // end of the 'PMA_jsFormat()' function
/**
* escapes a string to be inserted as string a JavaScript block
* enclosed by <![CDATA[ ... ]]>
* this requires only to escape ' with \' and end of script block
*
* We also remove NUL byte as some browsers (namely MSIE) ignore it and
* inserting it anywhere inside </script would allow to bypass this check.
*
* @param string $string the string to be escaped
*
* @return string the escaped string
*/
function PMA_escapeJsString($string)
{
return preg_replace(
'@</script@i', '</\' + \'script',
strtr(
$string,
array(
"\000" => '',
'\\' => '\\\\',
'\'' => '\\\'',
'"' => '\"',
"\n" => '\n',
"\r" => '\r'
)
)
);
}
/**
* Formats a value for javascript code.
*
* @param string $value String to be formatted.
*
* @return string formatted value.
*/
function PMA_formatJsVal($value)
{
if (is_bool($value)) {
if ($value) {
return 'true';
}
return 'false';
}
if (is_int($value)) {
return (int)$value;
}
return '"' . PMA_escapeJsString($value) . '"';
}
/**
* Formats an javascript assignment with proper escaping of a value
* and support for assigning array of strings.
*
* @param string $key Name of value to set
* @param mixed $value Value to set, can be either string or array of strings
* @param bool $escape Whether to escape value or keep it as it is
* (for inclusion of js code)
*
* @return string Javascript code.
*/
function PMA_getJsValue($key, $value, $escape = true)
{
$result = $key . ' = ';
if (!$escape) {
$result .= $value;
} elseif (is_array($value)) {
$result .= '[';
foreach ($value as $val) {
$result .= PMA_formatJsVal($val) . ",";
}
$result .= "];\n";
} else {
$result .= PMA_formatJsVal($value) . ";\n";
}
return $result;
}
/**
* Prints an javascript assignment with proper escaping of a value
* and support for assigning array of strings.
*
* @param string $key Name of value to set
* @param mixed $value Value to set, can be either string or array of strings
*
* @return void
*/
function PMA_printJsValue($key, $value)
{
echo PMA_getJsValue($key, $value);
}
/**
* Formats javascript assignment for form validation api
* with proper escaping of a value.
*
* @param string $key Name of value to set
* @param string $value Value to set
* @param boolean $addOn Check if $.validator.format is required or not
* @param boolean $comma Check if comma is required
*
* @return string Javascript code.
*/
function PMA_getJsValueForFormValidation($key, $value, $addOn, $comma)
{
$result = $key . ': ';
if ($addOn) {
$result .= '$.validator.format(';
}
$result .= PMA_formatJsVal($value);
if ($addOn) {
$result .= ')';
}
if ($comma) {
$result .= ', ';
}
return $result;
}
/**
* Prints javascript assignment for form validation api
* with proper escaping of a value.
*
* @param string $key Name of value to set
* @param string $value Value to set
* @param boolean $addOn Check if $.validator.format is required or not
* @param boolean $comma Check if comma is required
*
* @return void
*/
function PMA_printJsValueForFormValidation($key, $value, $addOn=false, $comma=true)
{
echo PMA_getJsValueForFormValidation($key, $value, $addOn, $comma);
}

9
libraries/mult_submits.lib.php
View File

@ -8,6 +8,7 @@
* @package PhpMyAdmin
*/
use PMA\libraries\Table;
use PMA\libraries\URL;
/**
* Gets url params
@ -323,7 +324,7 @@ function PMA_buildOrExecuteQueryForMulti(
function PMA_getHtmlForCopyMultipleTables($action, $_url_params)
{
$html = '<form id="ajax_form" action="' . $action . '" method="post">';
$html .= PMA_URL_getHiddenInputs($_url_params);
$html .= URL::getHiddenInputs($_url_params);
$html .= '<fieldset class = "input">';
$databases_list = $GLOBALS['dblist']->databases;
foreach ($databases_list as $key => $db_name)
@ -368,7 +369,7 @@ function PMA_getHtmlForCopyMultipleTables($action, $_url_params)
function PMA_getHtmlForReplacePrefixTable($action, $_url_params)
{
$html = '<form id="ajax_form" action="' . $action . '" method="post">';
$html .= PMA_URL_getHiddenInputs($_url_params);
$html .= URL::getHiddenInputs($_url_params);
$html .= '<fieldset class = "input">';
$html .= '<table>';
$html .= '<tr>';
@ -402,7 +403,7 @@ function PMA_getHtmlForReplacePrefixTable($action, $_url_params)
function PMA_getHtmlForAddPrefixTable($action, $_url_params)
{
$html = '<form id="ajax_form" action="' . $action . '" method="post">';
$html .= PMA_URL_getHiddenInputs($_url_params);
$html .= URL::getHiddenInputs($_url_params);
$html .= '<fieldset class = "input">';
$html .= '<table>';
$html .= '<tr>';
@ -433,7 +434,7 @@ function PMA_getHtmlForAddPrefixTable($action, $_url_params)
function PMA_getHtmlForOtherActions($what, $action, $_url_params, $full_query)
{
$html = '<form action="' . $action . '" method="post">';
$html .= PMA_URL_getHiddenInputs($_url_params);
$html .= URL::getHiddenInputs($_url_params);
$html .= '<fieldset class="confirmation">';
$html .= '<legend>';
if ($what == 'drop_db') {

5
libraries/navigation/Navigation.php
View File

@ -12,6 +12,7 @@ use PMA\libraries\config\PageSettings;
use PMA\libraries\Message;
use PMA\libraries\Response;
use PMA\libraries\Util;
use PMA\libraries\URL;
/**
* The navigation panel - displays server, db and table selection tree
@ -163,7 +164,7 @@ class Navigation
{
$html = '<form method="post" action="navigation.php" class="ajax">';
$html .= '<fieldset>';
$html .= PMA_URL_getHiddenInputs($dbName, $tableName);
$html .= URL::getHiddenInputs($dbName, $tableName);
$navTable = Util::backquote($GLOBALS['cfgRelation']['db'])
. "." . Util::backquote($GLOBALS['cfgRelation']['navigationhiding']);
@ -209,7 +210,7 @@ class Navigation
$html .= '<tr class="' . ($odd ? 'odd' : 'even') . '">';
$html .= '<td>' . htmlspecialchars($hiddenItem) . '</td>';
$html .= '<td style="width:80px"><a href="navigation.php'
. PMA_URL_getCommon()
. URL::getCommon()
. '&unhideNavItem=true'
. '&itemType=' . urlencode($t)
. '&itemName=' . urlencode($hiddenItem)

9
libraries/navigation/NavigationHeader.php
View File

@ -9,6 +9,7 @@ namespace PMA\libraries\navigation;
use PMA;
use PMA\libraries\Template;
use PMA\libraries\URL;
/**
* This class renders the logo, links, server selection,
@ -26,9 +27,9 @@ class NavigationHeader
public function getDisplay()
{
if (empty($GLOBALS['url_query'])) {
$GLOBALS['url_query'] = PMA_URL_getCommon();
$GLOBALS['url_query'] = URL::getCommon();
}
$link_url = PMA_URL_getCommon(
$link_url = URL::getCommon(
array(
'ajax_request' => true,
)
@ -124,7 +125,7 @@ class NavigationHeader
PHP_URL_HOST
);
if (empty($host)) {
$logoLink .= PMA_URL_getCommon();
$logoLink .= URL::getCommon();
} else {
$linkAttriks = 'target="_blank"';
}
@ -157,7 +158,7 @@ class NavigationHeader
$retval = '<!-- LINKS START -->';
$retval .= '<div id="navipanellinks">';
$retval .= PMA\libraries\Util::getNavigationLink(
'index.php' . PMA_URL_getCommon(),
'index.php' . URL::getCommon(),
$showText,
__('Home'),
$showIcon,

7
libraries/navigation/NavigationTree.php
View File

@ -15,6 +15,7 @@ use PMA\libraries\navigation\nodes\NodeViewContainer;
use PMA\libraries\RecentFavoriteTable;
use PMA\libraries\Response;
use PMA\libraries\Util;
use PMA\libraries\URL;
/**
* Displays a collapsible of database objects in the navigation frame
@ -1262,7 +1263,7 @@ class NavigationTree
);
$retval .= '<div id="pma_navigation_db_select">';
$retval .= '<form action="index.php">';
$retval .= PMA_getHiddenFields($url_params);
$retval .= URL::getHiddenFields($url_params);
$retval .= '<select name="db" class="hide" id="navi_db_select">'
. '<option value="" dir="' . $GLOBALS['text_dir'] . '">'
. '(' . __('Databases') . ') ...</option>' . "\n";
@ -1350,7 +1351,7 @@ class NavigationTree
);
$retval .= '<li class="fast_filter db_fast_filter">';
$retval .= '<form class="ajax fast_filter">';
$retval .= PMA_getHiddenFields($url_params);
$retval .= URL::getHiddenFields($url_params);
$retval .= '<input class="searchClause" type="text"';
$retval .= ' name="searchClause" accesskey="q"';
// allow html5 placeholder attribute
@ -1389,7 +1390,7 @@ class NavigationTree
);
$retval .= "<li class='fast_filter'>";
$retval .= "<form class='ajax fast_filter'>";
$retval .= PMA_getHiddenFields($url_params);
$retval .= URL::getHiddenFields($url_params);
$retval .= "<input class='searchClause' type='text'";
$retval .= " name='searchClause2'";
// allow html5 placeholder attribute

3
libraries/navigation/nodes/NodeDatabase.php
View File

@ -8,6 +8,7 @@
namespace PMA\libraries\navigation\nodes;
use PMA\libraries\Util;
use PMA\libraries\URL;
/**
* Represents a database node in the navigation tree
@ -688,7 +689,7 @@ class NodeDatabase extends Node
if ($this->hiddenCount > 0) {
$ret = '<span class="dbItemControls">'
. '<a href="navigation.php'
. PMA_URL_getCommon()
. URL::getCommon()
. '&showUnhideDialog=true'
. '&dbName=' . urldecode($this->real_name) . '"'
. ' class="showUnhide ajax">'

3
libraries/navigation/nodes/NodeDatabaseChild.php
View File

@ -8,6 +8,7 @@
namespace PMA\libraries\navigation\nodes;
use PMA;
use PMA\libraries\URL;
/**
* Represents a node that is a child of a database node
@ -39,7 +40,7 @@ abstract class NodeDatabaseChild extends Node
$item = $this->real_name;
$ret = '<span class="navItemControls">'
. '<a href="navigation.php'
. PMA_URL_getCommon()
. URL::getCommon()
. '&hideNavItem=true'
. '&itemType=' . urlencode($this->getItemType())
. '&itemName=' . urlencode($item)

3
libraries/normalization.lib.php
View File

@ -7,6 +7,7 @@
*/
use PMA\libraries\Message;
use PMA\libraries\Util;
use PMA\libraries\URL;
/**
* build the html for columns of $colTypeCategory category
@ -796,7 +797,7 @@ function PMA_getHtmlForNormalizetable()
. 'name="normalize" '
. 'id="normalizeTable" '
. '>'
. PMA_URL_getHiddenInputs($GLOBALS['db'], $GLOBALS['table'])
. URL::getHiddenInputs($GLOBALS['db'], $GLOBALS['table'])
. '<input type="hidden" name="step1" value="1">';
$html_output .= '<fieldset>';
$html_output .= '<legend>'

27
libraries/operations.lib.php
View File

@ -13,6 +13,7 @@ use PMA\libraries\Response;
use PMA\libraries\StorageEngine;
use PMA\libraries\Table;
use PMA\libraries\Util;
use PMA\libraries\URL;
/**
* Get HTML output for database comment
@ -25,7 +26,7 @@ function PMA_getHtmlForDatabaseComment($db)
{
$html_output = '<div class="operations_half_width">'
. '<form method="post" action="db_operations.php" id="formDatabaseComment">'
. PMA_URL_getHiddenInputs($db)
. URL::getHiddenInputs($db)
. '<fieldset>'
. '<legend>';
if (PMA\libraries\Util::showIcons('ActionLinksMode')) {
@ -67,7 +68,7 @@ function PMA_getHtmlForRenameDatabase($db)
}
$html_output .= '<input type="hidden" name="what" value="data" />'
. '<input type="hidden" name="db_rename" value="true" />'
. PMA_URL_getHiddenInputs($db)
. URL::getHiddenInputs($db)
. '<fieldset>'
. '<legend>';
@ -189,7 +190,7 @@ function PMA_getHtmlForCopyDatabase($db)
. 'value="' . $_REQUEST['db_collation'] . '" />' . "\n";
}
$html_output .= '<input type="hidden" name="db_copy" value="true" />' . "\n"
. PMA_URL_getHiddenInputs($db);
. URL::getHiddenInputs($db);
$html_output .= '<fieldset>'
. '<legend>';
@ -276,7 +277,7 @@ function PMA_getHtmlForChangeDatabaseCharset($db, $table)
$html_output .= 'class="ajax" ';
$html_output .= 'method="post" action="db_operations.php">';
$html_output .= PMA_URL_getHiddenInputs($db, $table);
$html_output .= URL::getHiddenInputs($db, $table);
$html_output .= '<fieldset>' . "\n"
. ' <legend>';
@ -770,7 +771,7 @@ function PMA_getHtmlForOrderTheTable($columns)
$html_output = '<div class="operations_half_width">';
$html_output .= '<form method="post" id="alterTableOrderby" '
. 'action="tbl_operations.php">';
$html_output .= PMA_URL_getHiddenInputs(
$html_output .= URL::getHiddenInputs(
$GLOBALS['db'], $GLOBALS['table']
);
$html_output .= '<fieldset id="fieldset_table_order">'
@ -812,7 +813,7 @@ function PMA_getHtmlForMoveTable()
$html_output .= '<form method="post" action="tbl_operations.php"'
. ' id="moveTableForm" class="ajax"'
. ' onsubmit="return emptyCheckTheField(this, \'new_name\')">'
. PMA_URL_getHiddenInputs($GLOBALS['db'], $GLOBALS['table']);
. URL::getHiddenInputs($GLOBALS['db'], $GLOBALS['table']);
$html_output .= '<input type="hidden" name="reload" value="1" />'
. '<input type="hidden" name="what" value="data" />'
@ -898,7 +899,7 @@ function PMA_getTableOptionDiv($comment, $tbl_collation, $tbl_storage_engine,
$html_output = '<div class="operations_half_width clearfloat">';
$html_output .= '<form method="post" action="tbl_operations.php"';
$html_output .= ' id="tableOptionsForm" class="ajax">';
$html_output .= PMA_URL_getHiddenInputs(
$html_output .= URL::getHiddenInputs(
$GLOBALS['db'], $GLOBALS['table']
);
$html_output .= '<input type="hidden" name="reload" value="1" />';
@ -1238,7 +1239,7 @@ function PMA_getHtmlForCopytable()
. 'id="copyTable" '
. ' class="ajax" '
. 'onsubmit="return emptyCheckTheField(this, \'new_name\')">'
. PMA_URL_getHiddenInputs($GLOBALS['db'], $GLOBALS['table'])
. URL::getHiddenInputs($GLOBALS['db'], $GLOBALS['table'])
. '<input type="hidden" name="reload" value="1" />';
$html_output .= '<fieldset>';
@ -1499,7 +1500,7 @@ function PMA_getMaintainActionlink($action_message, $params, $url_params, $link)
return '<li>'
. '<a class="maintain_action ajax" '
. 'href="sql.php'
. PMA_URL_getCommon(array_merge($url_params, $params)) . '">'
. URL::getCommon(array_merge($url_params, $params)) . '">'
. $action_message
. '</a>'
. PMA\libraries\Util::showMySQLDocu($link)
@ -1558,7 +1559,7 @@ function PMA_getHtmlForDeleteDataOrTable(
function PMA_getDeleteDataOrTablelink($url_params, $syntax, $link, $htmlId)
{
return '<li><a '
. 'href="sql.php' . PMA_URL_getCommon($url_params) . '"'
. 'href="sql.php' . URL::getCommon($url_params) . '"'
. ' id="' . $htmlId . '" class="ajax">'
. $link . '</a>'
. PMA\libraries\Util::showMySQLDocu($syntax)
@ -1597,7 +1598,7 @@ function PMA_getHtmlForPartitionMaintenance($partition_names, $url_params)
$html_output = '<div class="operations_half_width">'
. '<form id="partitionsForm" class="ajax" '
. 'method="post" action="tbl_operations.php" >'
. PMA_URL_getHiddenInputs($GLOBALS['db'], $GLOBALS['table'])
. URL::getHiddenInputs($GLOBALS['db'], $GLOBALS['table'])
. '<fieldset>'
. '<legend>'
. __('Partition maintenance')
@ -1634,7 +1635,7 @@ function PMA_getHtmlForPartitionMaintenance($partition_names, $url_params)
$html_output .= '<div class="clearfloat" /><br />';
$html_output .= '<a href="sql.php'
. PMA_URL_getCommon($this_url_params) . '">'
. URL::getCommon($this_url_params) . '">'
. __('Remove partitioning') . '</a>';
$html_output .= '</fieldset>'
@ -1703,7 +1704,7 @@ function PMA_getHtmlForReferentialIntegrityCheck($foreign, $url_params)
$html_output .= '<li>'
. '<a href="sql.php'
. PMA_URL_getCommon($this_url_params)
. URL::getCommon($this_url_params)
. '">'
. $master . '&nbsp;->&nbsp;' . $arr['foreign_db'] . '.'
. $arr['foreign_table'] . '.' . $arr['foreign_field']

4
libraries/plugins/AuthenticationPlugin.php
View File

@ -7,6 +7,8 @@
*/
namespace PMA\libraries\plugins;
use PMA\libraries\Sanitize;
/**
* Provides a common interface that will have to be implemented by all of the
* authentication plugins.
@ -74,7 +76,7 @@ abstract class AuthenticationPlugin
} else {
$dbi_error = $GLOBALS['dbi']->getError();
if (!empty($dbi_error)) {
return PMA_sanitize($dbi_error);
return Sanitize::sanitize($dbi_error);
} elseif (isset($GLOBALS['errno'])) {
return '#' . $GLOBALS['errno'] . ' '
. __('Cannot log in to the MySQL server');

3
libraries/plugins/auth/AuthenticationConfig.php
View File

@ -10,6 +10,7 @@ namespace PMA\libraries\plugins\auth;
use PMA\libraries\plugins\AuthenticationPlugin;
use PMA;
use PMA\libraries\URL;
/**
* Handles the config authentication method
@ -158,7 +159,7 @@ class AuthenticationConfig extends AuthenticationPlugin
$GLOBALS['cfg']['DefaultTabServer'],
'server'
)
, PMA_URL_getCommon(array()) , '" class="button disableAjax">'
, URL::getCommon(array()) , '" class="button disableAjax">'
, __('Retry to connect')
, '</a>' , "\n";
echo '</td>

5
libraries/plugins/auth/AuthenticationCookie.php
View File

@ -14,6 +14,7 @@ use PMA\libraries\plugins\AuthenticationPlugin;
use PMA\libraries\Response;
use PMA\libraries\Util;
use ReCaptcha\ReCaptcha;
use PMA\libraries\URL;
/**
* Remember where to redirect the user
@ -230,7 +231,7 @@ class AuthenticationCookie extends AuthenticationPlugin
}
// do not generate a "server" hidden field as we want the "server"
// drop-down to have priority
echo PMA_URL_getHiddenInputs($_form_params, '', 0, 'server');
echo URL::getHiddenInputs($_form_params, '', 0, 'server');
echo '</fieldset>
</form>';
@ -569,7 +570,7 @@ class AuthenticationCookie extends AuthenticationPlugin
->disable();
PMA_sendHeaderLocation(
$redirect_url . PMA_URL_getCommon($url_params, 'text'),
$redirect_url . URL::getCommon($url_params, 'text'),
true
);
if (! defined('TESTSUITE')) {

3
libraries/plugins/schema/ExportRelationSchema.php
View File

@ -9,6 +9,7 @@
namespace PMA\libraries\plugins\schema;
use PMA;
use PMA\libraries\URL;
/**
* This class is inherited by all schema classes
@ -293,7 +294,7 @@ class ExportRelationSchema
echo ' ' , $error_message , "\n";
echo '</p>' , "\n";
echo '<a href="db_designer.php'
, PMA_URL_getCommon(array('db' => $GLOBALS['db']))
, URL::getCommon(array('db' => $GLOBALS['db']))
, '&page=' . htmlspecialchars($pageNumber) , '">' , __('Back') , '</a>';
echo "\n";
exit;

3
libraries/relation.lib.php
View File

@ -9,6 +9,7 @@ use PMA\libraries\Message;
use PMA\libraries\Table;
use PMA\libraries\RecentFavoriteTable;
use SqlParser\Statements\CreateStatement;
use PMA\libraries\URL;
/**
* Executes a query as controluser if possible, otherwise as normal user
@ -1971,7 +1972,7 @@ function PMA_getHtmlFixPMATables($allTables, $createDb = false)
{
$retval = '';
$url_query = PMA_URL_getCommon(array('db' => $GLOBALS['db']));
$url_query = URL::getCommon(array('db' => $GLOBALS['db']));
if ($allTables) {
if ($createDb) {
$url_query .= '&amp;goto=db_operations.php&amp;create_pmadb=1';

31
libraries/replication_gui.lib.php
View File

@ -6,6 +6,7 @@
* @package PhpMyAdmin
*/
use PMA\libraries\Message;
use PMA\libraries\URL;
/**
* returns HTML for error message
@ -59,7 +60,7 @@ function PMA_getHtmlForMasterReplication()
$_url_params['repl_clear_scr'] = true;
$html .= ' <li><a href="server_replication.php';
$html .= PMA_URL_getCommon($_url_params)
$html .= URL::getCommon($_url_params)
. '" id="master_addslaveuser_href">';
$html .= __('Add slave replication user') . '</a></li>';
}
@ -116,7 +117,7 @@ function PMA_getHtmlForMasterConfiguration()
$html .= '</fieldset>';
$html .= '<fieldset class="tblFooters">';
$html .= ' <form method="post" action="server_replication.php" >';
$html .= PMA_URL_getHiddenInputs('', '');
$html .= URL::getHiddenInputs('', '');
$html .= ' <input type="submit" value="' . __('Go') . '" id="goButton" />';
$html .= ' </form>';
$html .= '</fieldset>';
@ -146,7 +147,7 @@ function PMA_getHtmlForSlaveConfiguration(
if ($server_slave_multi_replication) {
$html .= __('Master connection:');
$html .= '<form method="get" action="server_replication.php">';
$html .= PMA_URL_getHiddenInputs($GLOBALS['url_params']);
$html .= URL::getHiddenInputs($GLOBALS['url_params']);
$html .= ' <select name="master_connection">';
$html .= '<option value="">' . __('Default') . '</option>';
foreach ($server_slave_multi_replication as $server) {
@ -175,7 +176,7 @@ function PMA_getHtmlForSlaveConfiguration(
$_url_params['sr_slave_control_parm'] = 'IO_THREAD';
$slave_control_io_link = 'server_replication.php'
. PMA_URL_getCommon($_url_params);
. URL::getCommon($_url_params);
if ($server_slave_replication[0]['Slave_SQL_Running'] == 'No') {
$_url_params['sr_slave_action'] = 'start';
@ -185,7 +186,7 @@ function PMA_getHtmlForSlaveConfiguration(
$_url_params['sr_slave_control_parm'] = 'SQL_THREAD';
$slave_control_sql_link = 'server_replication.php'
. PMA_URL_getCommon($_url_params);
. URL::getCommon($_url_params);
if ($server_slave_replication[0]['Slave_IO_Running'] == 'No'
|| $server_slave_replication[0]['Slave_SQL_Running'] == 'No'
@ -197,17 +198,17 @@ function PMA_getHtmlForSlaveConfiguration(
$_url_params['sr_slave_control_parm'] = null;
$slave_control_full_link = 'server_replication.php'
. PMA_URL_getCommon($_url_params);
. URL::getCommon($_url_params);
$_url_params['sr_slave_action'] = 'reset';
$slave_control_reset_link = 'server_replication.php'
. PMA_URL_getCommon($_url_params);
. URL::getCommon($_url_params);
$_url_params = $GLOBALS['url_params'];
$_url_params['sr_take_action'] = true;
$_url_params['sr_slave_skip_error'] = true;
$slave_skip_error_link = 'server_replication.php'
. PMA_URL_getCommon($_url_params);
. URL::getCommon($_url_params);
if ($server_slave_replication[0]['Slave_SQL_Running'] == 'No') {
$html .= Message::error(
@ -225,7 +226,7 @@ function PMA_getHtmlForSlaveConfiguration(
$_url_params['repl_clear_scr'] = true;
$reconfiguremaster_link = 'server_replication.php'
. PMA_URL_getCommon($_url_params);
. URL::getCommon($_url_params);
$html .= __(
'Server is configured as slave in a replication process. Would you ' .
@ -285,7 +286,7 @@ function PMA_getHtmlForSlaveConfiguration(
'This server is not configured as slave in a replication process. '
. 'Would you like to <a href="%s">configure</a> it?'
),
'server_replication.php' . PMA_URL_getCommon($_url_params)
'server_replication.php' . URL::getCommon($_url_params)
);
}
$html .= '</fieldset>';
@ -314,7 +315,7 @@ function PMA_getHtmlForSlaveErrorManagement($slave_skip_error_link)
$html .= __('Skip current error') . '</a></li>';
$html .= ' <li>';
$html .= ' <form method="post" action="server_replication.php">';
$html .= PMA_URL_getHiddenInputs('', '');
$html .= URL::getHiddenInputs('', '');
$html .= sprintf(
__('Skip next %s errors.'),
'<input type="text" name="sr_skip_errors_count" value="1" '
@ -346,7 +347,7 @@ function PMA_getHtmlForNotServerReplication()
'This server is not configured as master in a replication process. '
. 'Would you like to <a href="%s">configure</a> it?'
),
'server_replication.php' . PMA_URL_getCommon($_url_params)
'server_replication.php' . URL::getCommon($_url_params)
);
$html .= '</fieldset>';
return $html;
@ -395,7 +396,7 @@ function PMA_getHtmlForReplicationChangeMaster($submitname)
= PMA_replicationGetUsernameHostnameLength();
$html .= '<form method="post" action="server_replication.php">';
$html .= PMA_URL_getHiddenInputs('', '');
$html .= URL::getHiddenInputs('', '');
$html .= ' <fieldset id="fieldset_add_user_login">';
$html .= ' <legend>' . __('Slave configuration');
$html .= ' - ' . __('Change or reconfigure master server') . '</legend>';
@ -694,7 +695,7 @@ function PMA_getHtmlForReplicationMasterAddSlaveuser()
$html .= '<form autocomplete="off" method="post" ';
$html .= 'action="server_privileges.php"';
$html .= ' onsubmit="return checkAddUser(this);">';
$html .= PMA_URL_getHiddenInputs('', '');
$html .= URL::getHiddenInputs('', '');
$html .= '<fieldset id="fieldset_add_user_login">'
. '<legend>' . __('Add slave replication user') . '</legend>'
. PMA_getHtmlForAddUserLoginForm($username_length)
@ -962,7 +963,7 @@ function PMA_handleControlRequest()
} else {
PMA_sendHeaderLocation(
'./server_replication.php'
. PMA_URL_getCommon($GLOBALS['url_params'], 'text')
. URL::getCommon($GLOBALS['url_params'], 'text')
);
}
}

3
libraries/rte/rte_events.lib.php
View File

@ -6,6 +6,7 @@
* @package PhpMyAdmin
*/
use PMA\libraries\Response;
use PMA\libraries\URL;
if (! defined('PHPMYADMIN')) {
exit;
@ -382,7 +383,7 @@ function PMA_EVN_getEditorForm($mode, $operation, $item)
$retval .= "<form class='rte_form' action='db_events.php' method='post'>\n";
$retval .= "<input name='{$mode}_item' type='hidden' value='1' />\n";
$retval .= $original_data;
$retval .= PMA_URL_getHiddenInputs($db, $table) . "\n";
$retval .= URL::getHiddenInputs($db, $table) . "\n";
$retval .= "<fieldset>\n";
$retval .= "<legend>" . __('Details') . "</legend>\n";
$retval .= "<table class='rte_table' style='width: 100%'>\n";

4
libraries/rte/rte_list.lib.php
View File

@ -6,6 +6,8 @@
* @package PhpMyAdmin
*/
use SqlParser\Statements\CreateStatement;
use PMA\libraries\URL;
if (! defined('PHPMYADMIN')) {
exit;
@ -56,7 +58,7 @@ function PMA_RTE_getList($type, $items)
break;
}
$retval .= '">';
$retval .= PMA_URL_getHiddenInputs($GLOBALS['db'], $GLOBALS['table']);
$retval .= URL::getHiddenInputs($GLOBALS['db'], $GLOBALS['table']);
$retval .= "<fieldset>\n";
$retval .= " <legend>\n";
$retval .= " " . PMA_RTE_getWord('title') . "\n";

4
libraries/rte/rte_main.inc.php
View File

@ -5,6 +5,8 @@
*
* @package PhpMyAdmin
*/
use PMA\libraries\URL;
if (! defined('PHPMYADMIN')) {
exit;
}
@ -50,7 +52,7 @@ if ($GLOBALS['is_ajax_request'] != true) {
if (mb_strlen($db)) {
$GLOBALS['dbi']->selectDb($db);
if (! isset($url_query)) {
$url_query = PMA_URL_getCommon(
$url_query = URL::getCommon(
array(
'db' => $db, 'table' => $table
)

5
libraries/rte/rte_routines.lib.php
View File

@ -9,6 +9,7 @@ use PMA\libraries\Message;
use PMA\libraries\Response;
use PMA\libraries\Util;
use SqlParser\Statements\CreateStatement;
use PMA\libraries\URL;
if (! defined('PHPMYADMIN')) {
exit;
@ -877,7 +878,7 @@ function PMA_RTN_getEditorForm($mode, $operation, $routine)
$retval .= "<form class='rte_form' action='db_routines.php' method='post'>\n";
$retval .= "<input name='{$mode}_item' type='hidden' value='1' />\n";
$retval .= $original_routine;
$retval .= PMA_URL_getHiddenInputs($db) . "\n";
$retval .= URL::getHiddenInputs($db) . "\n";
$retval .= "<fieldset>\n";
$retval .= "<legend>" . __('Details') . "</legend>\n";
$retval .= "<table class='rte_table' style='width: 100%'>\n";
@ -1567,7 +1568,7 @@ function PMA_RTN_getExecuteForm($routine)
$retval .= " value='{$routine['item_name']}' />\n";
$retval .= "<input type='hidden' name='item_type'\n";
$retval .= " value='{$routine['item_type']}' />\n";
$retval .= PMA_URL_getHiddenInputs($db) . "\n";
$retval .= URL::getHiddenInputs($db) . "\n";
$retval .= "<fieldset>\n";
if ($GLOBALS['is_ajax_request'] != true) {
$retval .= "<legend>{$routine['item_name']}</legend>\n";

3
libraries/rte/rte_triggers.lib.php
View File

@ -6,6 +6,7 @@
* @package PhpMyAdmin
*/
use PMA\libraries\Response;
use PMA\libraries\URL;
if (! defined('PHPMYADMIN')) {
exit;
@ -320,7 +321,7 @@ function PMA_TRI_getEditorForm($mode, $item)
$retval .= "<form class='rte_form' action='db_triggers.php' method='post'>\n";
$retval .= "<input name='{$mode}_item' type='hidden' value='1' />\n";
$retval .= $original_data;
$retval .= PMA_URL_getHiddenInputs($db, $table) . "\n";
$retval .= URL::getHiddenInputs($db, $table) . "\n";
$retval .= "<fieldset>\n";
$retval .= "<legend>" . __('Details') . "</legend>\n";
$retval .= "<table class='rte_table' style='width: 100%'>\n";

189
libraries/sanitizing.lib.php
View File

@ -1,189 +0,0 @@
<?php
/* vim: set expandtab sw=4 ts=4 sts=4: */
/**
* This is in a separate script because it's called from a number of scripts
*
* @package PhpMyAdmin
*/
/**
* Checks whether given link is valid
*
* @param string $url URL to check
*
* @return boolean True if string can be used as link
*/
function PMA_checkLink($url)
{
$valid_starts = array(
'http://',
'https://',
'./url.php?url=http%3A%2F%2F',
'./url.php?url=https%3A%2F%2F',
'./doc/html/',
);
if (defined('PMA_SETUP')) {
$valid_starts[] = '?page=form&';
$valid_starts[] = '?page=servers&';
}
foreach ($valid_starts as $val) {
if (mb_substr($url, 0, mb_strlen($val)) == $val) {
return true;
}
}
return false;
}
/**
* Callback function for replacing [a@link@target] links in bb code.
*
* @param array $found Array of preg matches
*
* @return string Replaced string
*/
function PMA_replaceBBLink($found)
{
/* Check for valid link */
if (! PMA_checkLink($found[1])) {
return $found[0];
}
/* a-z and _ allowed in target */
if (! empty($found[3]) && preg_match('/[^a-z_]+/i', $found[3])) {
return $found[0];
}
/* Construct target */
$target = '';
if (! empty($found[3])) {
$target = ' target="' . $found[3] . '"';
}
/* Construct url */
if (substr($found[1], 0, 4) == 'http') {
$url = PMA_linkURL($found[1]);
} else {
$url = $found[1];
}
return '<a href="' . $url . '"' . $target . '>';
}
/**
* Callback function for replacing [doc@anchor] links in bb code.
*
* @param array $found Array of preg matches
*
* @return string Replaced string
*/
function PMA_replaceDocLink($found)
{
$anchor = $found[1];
if (strncmp('faq', $anchor, 3) == 0) {
$page = 'faq';
} else if (strncmp('cfg', $anchor, 3) == 0) {
$page = 'cfg';
} else {
/* Guess */
$page = 'setup';
}
$link = PMA\libraries\Util::getDocuLink($page, $anchor);
return '<a href="' . $link . '" target="documentation">';
}
/**
* Sanitizes $message, taking into account our special codes
* for formatting.
*
* If you want to include result in element attribute, you should escape it.
*
* Examples:
*
* <p><?php echo PMA_sanitize($foo); ?></p>
*
* <a title="<?php echo PMA_sanitize($foo, true); ?>">bar</a>
*
* @param string $message the message
* @param boolean $escape whether to escape html in result
* @param boolean $safe whether string is safe (can keep < and > chars)
*
* @return string the sanitized message
*/
function PMA_sanitize($message, $escape = false, $safe = false)
{
if (!$safe) {
$message = strtr($message, array('<' => '&lt;', '>' => '&gt;'));
}
/* Interpret bb code */
$replace_pairs = array(
'[em]' => '<em>',
'[/em]' => '</em>',
'[strong]' => '<strong>',
'[/strong]' => '</strong>',
'[code]' => '<code>',
'[/code]' => '</code>',
'[kbd]' => '<kbd>',
'[/kbd]' => '</kbd>',
'[br]' => '<br />',
'[/a]' => '</a>',
'[/doc]' => '</a>',
'[sup]' => '<sup>',
'[/sup]' => '</sup>',
// used in common.inc.php:
'[conferr]' => '<iframe src="show_config_errors.php" />',
// used in libraries/Util.php
'[dochelpicon]' => PMA\libraries\Util::getImage('b_help.png', __('Documentation')),
);
$message = strtr($message, $replace_pairs);
/* Match links in bb code ([a@url@target], where @target is options) */
$pattern = '/\[a@([^]"@]*)(@([^]"]*))?\]/';
/* Find and replace all links */
$message = preg_replace_callback($pattern, 'PMA_replaceBBLink', $message);
/* Replace documentation links */
$message = preg_replace_callback(
'/\[doc@([a-zA-Z0-9_-]+)\]/',
'PMA_replaceDocLink',
$message
);
/* Possibly escape result */
if ($escape) {
$message = htmlspecialchars($message);
}
return $message;
}
/**
* Sanitize a filename by removing anything besides legit characters
*
* Intended usecase:
* When using a filename in a Content-Disposition header
* the value should not contain ; or "
*
* When exporting, avoiding generation of an unexpected double-extension file
*
* @param string $filename The filename
* @param boolean $replaceDots Whether to also replace dots
*
* @return string the sanitized filename
*
*/
function PMA_sanitizeFilename($filename, $replaceDots = false)
{
$pattern = '/[^A-Za-z0-9_';
// if we don't have to replace dots
if (! $replaceDots) {
// then add the dot to the list of legit characters
$pattern .= '.';
}
$pattern .= '-]/';
$filename = preg_replace($pattern, '_', $filename);
return $filename;
}

4
libraries/select_server.lib.php
View File

@ -14,6 +14,8 @@
*
* @return string
*/
use PMA\libraries\URL;
function PMA_selectServer($not_only_options, $omit_fieldset)
{
$retval = '';
@ -86,7 +88,7 @@ function PMA_selectServer($not_only_options, $omit_fieldset)
. PMA\libraries\Util::getScriptNameForOption(
$GLOBALS['cfg']['DefaultTabServer'], 'server'
)
. PMA_URL_getCommon(array('server' => $key))
. URL::getCommon(array('server' => $key))
. '" >' . htmlspecialchars($label) . '</a>';
}
$retval .= '</li>';

4
libraries/server_common.inc.php
View File

@ -5,6 +5,8 @@
*
* @package PhpMyAdmin
*/
use PMA\libraries\URL;
if (! defined('PHPMYADMIN')) {
exit;
}
@ -22,7 +24,7 @@ if (empty($viewing_mode)) {
/**
* Set parameters for links
*/
$GLOBALS['url_query'] = PMA_URL_getCommon(array('db' => $db));
$GLOBALS['url_query'] = URL::getCommon(array('db' => $db));
/**
* Defines the urls to return to in case of error in a sql statement

45
libraries/server_privileges.lib.php
View File

@ -9,6 +9,7 @@ use PMA\libraries\DatabaseInterface;
use PMA\libraries\Message;
use PMA\libraries\Template;
use PMA\libraries\Util;
use PMA\libraries\URL;
/**
* Get Html for User Group Dialog
@ -522,7 +523,7 @@ function PMA_getHtmlToChooseUserGroup($username)
$html_output = '<form class="ajax" id="changeUserGroupForm"'
. ' action="server_privileges.php" method="post">';
$params = array('username' => $username);
$html_output .= PMA_URL_getHiddenInputs($params);
$html_output .= URL::getHiddenInputs($params);
$html_output .= '<fieldset id="fieldset_user_group_selection">';
$html_output .= '<legend>' . __('User group') . '</legend>';
@ -2299,7 +2300,7 @@ function PMA_getHtmlForAddUser($dbname)
. '<form name="usersForm" id="addUsersForm"'
. ' onsubmit="return checkAddUser(this);"'
. ' action="server_privileges.php" method="post" autocomplete="off" >' . "\n"
. PMA_URL_getHiddenInputs('', '')
. URL::getHiddenInputs('', '')
. PMA_getHtmlForLoginInformationFields('new');
$html_output .= '<fieldset id="fieldset_add_user_database">' . "\n"
@ -2481,7 +2482,7 @@ function PMA_getHtmlForSpecificDbPrivileges($db)
if ($GLOBALS['is_superuser']) {
// check the privileges for a particular database.
$html_output = '<form id="usersForm" action="server_privileges.php">';
$html_output .= PMA_URL_getHiddenInputs($db);
$html_output .= URL::getHiddenInputs($db);
$html_output .= '<fieldset>';
$html_output .= '<legend>' . "\n"
. Util::getIcon('b_usrcheck.png')
@ -2491,7 +2492,7 @@ function PMA_getHtmlForSpecificDbPrivileges($db)
'<a href="' . Util::getScriptNameForOption(
$GLOBALS['cfg']['DefaultTabDatabase'], 'database'
)
. PMA_URL_getCommon(array('db' => $db)) . '">'
. URL::getCommon(array('db' => $db)) . '">'
. htmlspecialchars($db)
. '</a>'
)
@ -2548,7 +2549,7 @@ function PMA_getHtmlForSpecificTablePrivileges($db, $table)
if ($GLOBALS['is_superuser']) {
// check the privileges for a particular table.
$html_output = '<form id="usersForm" action="server_privileges.php">';
$html_output .= PMA_URL_getHiddenInputs($db, $table);
$html_output .= URL::getHiddenInputs($db, $table);
$html_output .= '<fieldset>';
$html_output .= '<legend>'
. Util::getIcon('b_usrcheck.png')
@ -2557,7 +2558,7 @@ function PMA_getHtmlForSpecificTablePrivileges($db, $table)
'<a href="' . Util::getScriptNameForOption(
$GLOBALS['cfg']['DefaultTabTable'], 'table'
)
. PMA_URL_getCommon(
. URL::getCommon(
array(
'db' => $db,
'table' => $table,
@ -2927,7 +2928,7 @@ function PMA_getUserLink(
}
$html .= ' href="server_privileges.php'
. PMA_URL_getCommon($params)
. URL::getCommon($params)
. '">';
switch($linktype) {
@ -2957,7 +2958,7 @@ function PMA_getUserGroupEditLink($username)
{
return '<a class="edit_user_group_anchor ajax"'
. ' href="server_privileges.php'
. PMA_URL_getCommon(array('username' => $username))
. URL::getCommon(array('username' => $username))
. '">'
. Util::getIcon('b_usrlist.png', __('Edit user group'))
. '</a>';
@ -3096,7 +3097,7 @@ function PMA_getExtraDataForAjaxBehavior(
mb_substr($username, 0, 1)
);
$newUserInitialString = '<a href="server_privileges.php'
. PMA_URL_getCommon(array('initial' => $new_user_initial)) . '">'
. URL::getCommon(array('initial' => $new_user_initial)) . '">'
. $new_user_initial . '</a>';
$extra_data['new_user_initial'] = $new_user_initial;
$extra_data['new_user_initial_string'] = $newUserInitialString;
@ -3155,7 +3156,7 @@ function PMA_getChangeLoginInformationHtmlForm($username, $hostname)
$html_output = '<form action="server_privileges.php" '
. 'onsubmit="return checkAddUser(this);" '
. 'method="post" class="copyUserForm submenu-item">' . "\n"
. PMA_URL_getHiddenInputs('', '')
. URL::getHiddenInputs('', '')
. '<input type="hidden" name="old_username" '
. 'value="' . htmlspecialchars($username) . '" />' . "\n"
. '<input type="hidden" name="old_hostname" '
@ -3201,7 +3202,7 @@ function PMA_getLinkToDbAndTable($url_dbname, $dbname, $tablename)
. ' <a href="' . Util::getScriptNameForOption(
$GLOBALS['cfg']['DefaultTabDatabase'], 'database'
)
. PMA_URL_getCommon(
. URL::getCommon(
array(
'db' => $url_dbname,
'reload' => 1
@ -3219,7 +3220,7 @@ function PMA_getLinkToDbAndTable($url_dbname, $dbname, $tablename)
. Util::getScriptNameForOption(
$GLOBALS['cfg']['DefaultTabTable'], 'table'
)
. PMA_URL_getCommon(
. URL::getCommon(
array(
'db' => $url_dbname,
'table' => $tablename,
@ -3574,7 +3575,7 @@ function PMA_getUsersOverview($result, $db_rights, $pmaThemeImage, $text_dir)
$html_output
= '<form name="usersForm" id="usersForm" action="server_privileges.php" '
. 'method="post">' . "\n"
. PMA_URL_getHiddenInputs('', '')
. URL::getHiddenInputs('', '')
. '<table id="tableuserrights" class="data">' . "\n"
. '<thead>' . "\n"
. '<tr><th></th>' . "\n"
@ -3856,14 +3857,14 @@ function PMA_getHtmlForInitials($array_initials)
&& $_REQUEST['initial'] === $tmp_initial
) ? ' active' : '')
. '" href="server_privileges.php'
. PMA_URL_getCommon(array('initial' => $tmp_initial))
. URL::getCommon(array('initial' => $tmp_initial))
. '">' . $tmp_initial
. '</a>'
. '</td>' . "\n";
}
$html_output .= '<td>'
. '<a href="server_privileges.php'
. PMA_URL_getCommon(array('showall' => 1))
. URL::getCommon(array('showall' => 1))
. '" class="nowrap">' . __('Show all') . '</a></td>' . "\n";
$html_output .= '</tr></table>';
@ -4586,9 +4587,9 @@ function PMA_getAddUserHtmlFieldset($db = '', $table = '')
return '<fieldset id="fieldset_add_user">' . "\n"
. '<legend>' . _pgettext('Create new user', 'New') . '</legend>'
. '<a id="add_user_anchor" href="server_privileges.php'
. PMA_URL_getCommon($url_params) . '" '
. URL::getCommon($url_params) . '" '
. (!empty($rel_params)
? ('rel="' . PMA_URL_getCommon($rel_params) . '" ')
? ('rel="' . URL::getCommon($rel_params) . '" ')
: '')
. '>' . "\n"
. Util::getIcon('b_usradd.png')
@ -4619,7 +4620,7 @@ function PMA_getHtmlHeaderForUserProperties(
if (! empty($dbname)) {
$html_output .= ' <i><a class="edit_user_anchor"'
. ' href="server_privileges.php'
. PMA_URL_getCommon(
. URL::getCommon(
array(
'username' => $username,
'hostname' => $hostname,
@ -4637,7 +4638,7 @@ function PMA_getHtmlHeaderForUserProperties(
? __('Databases') : __('Database');
if (! empty($_REQUEST['tablename'])) {
$html_output .= ' <i><a href="server_privileges.php'
. PMA_URL_getCommon(
. URL::getCommon(
array(
'username' => $username,
'hostname' => $hostname,
@ -4652,7 +4653,7 @@ function PMA_getHtmlHeaderForUserProperties(
. ' <i>' . htmlspecialchars($tablename) . '</i>';
} elseif (! empty($_REQUEST['routinename'])) {
$html_output .= ' <i><a href="server_privileges.php'
. PMA_URL_getCommon(
. URL::getCommon(
array(
'username' => $username,
'hostname' => $hostname,
@ -4826,7 +4827,7 @@ function PMA_getHtmlForUserOverview($pmaThemeImage, $text_dir)
Message::NOTICE
);
$flushLink = '<a href="server_privileges.php'
. PMA_URL_getCommon(array('flush_privileges' => 1))
. URL::getCommon(array('flush_privileges' => 1))
. '" id="reload_privileges_anchor">';
$flushnote->addParam(
$flushLink,
@ -4906,7 +4907,7 @@ function PMA_getHtmlForUserProperties($dbname_is_wildcard,$url_dbname,
$html_output .= '<form class="submenu-item" name="usersForm" '
. 'id="addUsersForm" action="server_privileges.php" method="post">' . "\n";
$html_output .= PMA_URL_getHiddenInputs($_params);
$html_output .= URL::getHiddenInputs($_params);
$html_output .= PMA_getHtmlToDisplayPrivilegesTable(
// If $dbname is an array, pass any one db as all have same privs.
PMA_ifSetOr($dbname, (is_array($dbname)) ? $dbname[0] : '*', 'length'),

11
libraries/server_status_processes.lib.php
View File

@ -10,6 +10,7 @@
use PMA\libraries\Message;
use PMA\libraries\ServerStatusData;
use PMA\libraries\Util;
use PMA\libraries\URL;
/**
* Prints html for auto refreshing processes list
@ -51,11 +52,11 @@ function PMA_getHtmlForServerProcesslist()
$show_full_sql = ! empty($_REQUEST['full']);
if ($show_full_sql) {
$url_params['full'] = 1;
$full_text_link = 'server_status_processes.php' . PMA_URL_getCommon(
$full_text_link = 'server_status_processes.php' . URL::getCommon(
array(), 'html', '?'
);
} else {
$full_text_link = 'server_status_processes.php' . PMA_URL_getCommon(
$full_text_link = 'server_status_processes.php' . URL::getCommon(
array('full' => 1)
);
}
@ -142,7 +143,7 @@ function PMA_getHtmlForServerProcesslist()
}
$retval .= '<th>';
$columnUrl = PMA_URL_getCommon($column);
$columnUrl = URL::getCommon($column);
$retval .= '<a href="server_status_processes.php' . $columnUrl . '" ';
if ($is_sorted) {
$retval .= 'onmouseout="$(\'.soimg\').toggle()" '
@ -231,7 +232,7 @@ function PMA_getHtmlForProcessListFilter()
$retval .= '<fieldset id="tableFilter">';
$retval .= '<legend>' . __('Filters') . '</legend>';
$retval .= '<form action="server_status_processes.php'
. PMA_URL_getCommon($url_params) . '">';
. URL::getCommon($url_params) . '">';
$retval .= '<input type="submit" value="' . __('Refresh') . '" />';
$retval .= '<div class="formelement">';
$retval .= '<input' . $showExecuting . ' type="checkbox" name="showExecuting"'
@ -275,7 +276,7 @@ function PMA_getHtmlForServerProcessItem($process, $odd_row, $show_full_sql)
'kill' => $process['Id'],
'ajax_request' => true
);
$kill_process = 'server_status_processes.php' . PMA_URL_getCommon($url_params);
$kill_process = 'server_status_processes.php' . URL::getCommon($url_params);
$retval = '<tr class="' . ($odd_row ? 'odd' : 'even') . '">';
$retval .= '<td><a class="ajax kill_process" href="' . $kill_process . '">'

3
libraries/server_status_variables.lib.php
View File

@ -8,6 +8,7 @@
* @package PhpMyAdmin
*/
use PMA\libraries\ServerStatusData;
use PMA\libraries\URL;
/**
* Returns the html for the list filter
@ -35,7 +36,7 @@ function PMA_getHtmlForFilter($ServerStatusData)
$retval .= '<fieldset id="tableFilter">';
$retval .= '<legend>' . __('Filters') . '</legend>';
$retval .= '<form action="server_status_variables.php'
. PMA_URL_getCommon() . '">';
. URL::getCommon() . '">';
$retval .= '<input type="submit" value="' . __('Refresh') . '" />';
$retval .= '<div class="formelement">';
$retval .= '<label for="filterText">' . __('Containing the word:') . '</label>';

13
libraries/server_user_groups.lib.php
View File

@ -5,6 +5,7 @@
*
* @package PhpMyAdmin
*/
use PMA\libraries\URL;
/**
* Return HTML to list the users belonging to a given user group
@ -68,7 +69,7 @@ function PMA_getHtmlForUserGroupsTable()
if ($result && $GLOBALS['dbi']->numRows($result)) {
$html_output .= '<form name="userGroupsForm" id="userGroupsForm"'
. ' action="server_privileges.php" method="post">';
$html_output .= PMA_URL_getHiddenInputs();
$html_output .= URL::getHiddenInputs();
$html_output .= '<table id="userGroupsTable">';
$html_output .= '<thead><tr>';
$html_output .= '<th style="white-space: nowrap">'
@ -98,7 +99,7 @@ function PMA_getHtmlForUserGroupsTable()
$html_output .= '<td>';
$html_output .= '<a class="" href="server_user_groups.php'
. PMA_URL_getCommon(
. URL::getCommon(
array(
'viewUsers' => 1, 'userGroup' => $groupName
)
@ -108,7 +109,7 @@ function PMA_getHtmlForUserGroupsTable()
. '</a>';
$html_output .= '&nbsp;&nbsp;';
$html_output .= '<a class="" href="server_user_groups.php'
. PMA_URL_getCommon(
. URL::getCommon(
array(
'editUserGroup' => 1, 'userGroup' => $groupName
)
@ -118,7 +119,7 @@ function PMA_getHtmlForUserGroupsTable()
$html_output .= '&nbsp;&nbsp;';
$html_output .= '<a class="deleteUserGroup ajax"'
. ' href="server_user_groups.php'
. PMA_URL_getCommon(
. URL::getCommon(
array(
'deleteUserGroup' => 1, 'userGroup' => $groupName
)
@ -140,7 +141,7 @@ function PMA_getHtmlForUserGroupsTable()
$html_output .= '<fieldset id="fieldset_add_user_group">';
$html_output .= '<a href="server_user_groups.php'
. PMA_URL_getCommon(array('addUserGroup' => 1)) . '">'
. URL::getCommon(array('addUserGroup' => 1)) . '">'
. PMA\libraries\Util::getIcon('b_usradd.png')
. __('Add user group') . '</a>';
$html_output .= '</fieldset>';
@ -222,7 +223,7 @@ function PMA_getHtmlToEditUserGroup($userGroup = null)
} else {
$urlParams['addUserGroupSubmit'] = '1';
}
$html_output .= PMA_URL_getHiddenInputs($urlParams);
$html_output .= URL::getHiddenInputs($urlParams);
$html_output .= '<fieldset id="fieldset_user_group_rights">';
$html_output .= '<legend>' . __('User group menu assignments')

3
libraries/server_users.lib.php
View File

@ -5,6 +5,7 @@
*
* @package PhpMyAdmin
*/
use PMA\libraries\URL;
/**
* Get HTML for secondary level menu tabs on 'Users' page
@ -15,7 +16,7 @@
*/
function PMA_getHtmlForSubMenusOnUsersPage($selfUrl)
{
$url_params = PMA_URL_getCommon();
$url_params = URL::getCommon();
$items = array(
array(
'name' => __('User accounts overview'),

9
libraries/sql.lib.php
View File

@ -9,6 +9,7 @@ use PMA\libraries\DisplayResults;
use PMA\libraries\Message;
use PMA\libraries\Table;
use PMA\libraries\Response;
use PMA\libraries\URL;
/**
* Parses and analyzes the given SQL query.
@ -188,7 +189,7 @@ function PMA_getHtmlForRelationalColumnDropdown($db, $table, $column, $curr_valu
. htmlspecialchars($_REQUEST['curr_value'])
. '</span>'
. '<a href="browse_foreigners.php'
. PMA_URL_getCommon($_url_params) . '"'
. URL::getCommon($_url_params) . '"'
. 'class="ajax browse_foreign" ' . '>'
. __('Browse foreign values')
. '</a>';
@ -222,7 +223,7 @@ function PMA_getHtmlForProfilingChart($url_query, $db, $profiling_results)
$pma_token = $_SESSION[' PMA_token '];
$url_query = isset($url_query)
? $url_query
: PMA_URL_getCommon(array('db' => $db));
: URL::getCommon(array('db' => $db));
$profiling_table = '';
$profiling_table .= '<fieldset><legend>' . __('Profiling')
@ -536,7 +537,7 @@ function PMA_getHtmlForBookmark($displayParts, $cfgBookmark, $sql_query, $db,
&& ! empty($sql_query)
) {
$goto = 'sql.php'
. PMA_URL_getCommon(
. URL::getCommon(
array(
'db' => $db,
'table' => $table,
@ -551,7 +552,7 @@ function PMA_getHtmlForBookmark($displayParts, $cfgBookmark, $sql_query, $db,
. ' onsubmit="return ! emptyCheckTheField(this,'
. '\'bkm_fields[bkm_label]\');"'
. ' class="bookmarkQueryForm print_ignore">';
$html .= PMA_URL_getHiddenInputs();
$html .= URL::getHiddenInputs();
$html .= '<input type="hidden" name="db"'
. ' value="' . htmlspecialchars($db) . '" />';
$html .= '<input type="hidden" name="goto" value="' . $goto . '" />';

8
libraries/sql_query_form.lib.php
View File

@ -10,6 +10,8 @@
* @usedby tbl_tracking.php
* @package PhpMyAdmin
*/
use PMA\libraries\URL;
if (! defined('PHPMYADMIN')) {
exit;
}
@ -81,7 +83,7 @@ function PMA_getHtmlForSqlQueryForm(
$html .= ' id="sqlqueryform" name="sqlform">' . "\n";
$html .= '<input type="hidden" name="is_js_confirmed" value="0" />'
. "\n" . PMA_URL_getHiddenInputs($db, $table) . "\n"
. "\n" . URL::getHiddenInputs($db, $table) . "\n"
. '<input type="hidden" name="pos" value="0" />' . "\n"
. '<input type="hidden" name="goto" value="'
. htmlspecialchars($goto) . '" />' . "\n"
@ -147,7 +149,7 @@ function PMA_initQueryForm($query)
$tmp_db_link = '<a href="' . PMA\libraries\Util::getScriptNameForOption(
$GLOBALS['cfg']['DefaultTabDatabase'], 'database'
)
. PMA_URL_getCommon(array('db' => $db)) . '"';
. URL::getCommon(array('db' => $db)) . '"';
$tmp_db_link .= '>'
. htmlspecialchars($db) . '</a>';
$legend = sprintf(__('Run SQL query/queries on database %s'), $tmp_db_link);
@ -168,7 +170,7 @@ function PMA_initQueryForm($query)
$tmp_tbl_link = '<a href="' . PMA\libraries\Util::getScriptNameForOption(
$GLOBALS['cfg']['DefaultTabTable'], 'table'
) . PMA_URL_getCommon(array('db' => $db, 'table' => $table)) . '" >';
) . URL::getCommon(array('db' => $db, 'table' => $table)) . '" >';
$tmp_tbl_link .= htmlspecialchars($db)
. '.' . htmlspecialchars($table) . '</a>';
$legend = sprintf(__('Run SQL query/queries on table %s'), $tmp_tbl_link);

8
libraries/tbl_common.inc.php
View File

@ -5,6 +5,8 @@
*
* @package PhpMyAdmin
*/
use PMA\libraries\URL;
if (! defined('PHPMYADMIN')) {
exit;
}
@ -23,7 +25,7 @@ $db_is_system_schema = $GLOBALS['dbi']->isSystemSchema($db);
* Set parameters for links
* @deprecated
*/
$url_query = PMA_URL_getCommon(array('db' => $db, 'table' => $table));
$url_query = URL::getCommon(array('db' => $db, 'table' => $table));
/**
* Set parameters for links
@ -38,12 +40,12 @@ $url_params['table'] = $table;
$err_url_0 = PMA\libraries\Util::getScriptNameForOption(
$GLOBALS['cfg']['DefaultTabDatabase'], 'database'
)
. PMA_URL_getCommon(array('db' => $db));
. URL::getCommon(array('db' => $db));
$err_url = PMA\libraries\Util::getScriptNameForOption(
$GLOBALS['cfg']['DefaultTabTable'], 'table'
)
. PMA_URL_getCommon($url_params);
. URL::getCommon($url_params);
/**

24
libraries/tracking.lib.php
View File

@ -8,6 +8,8 @@
use PMA\libraries\Message;
use PMA\libraries\Response;
use PMA\libraries\Tracker;
use PMA\libraries\URL;
use PMA\libraries\Sanitize;
/**
* Filters tracking entries
@ -59,7 +61,7 @@ function PMA_getHtmlForDataDefinitionAndManipulationStatements($url_query,
) {
$html = '<div id="div_create_version">';
$html .= '<form method="post" action="' . $url_query . '">';
$html .= PMA_URL_getHiddenInputs($db);
$html .= URL::getHiddenInputs($db);
foreach ($selected as $selected_table) {
$html .= '<input type="hidden" name="selected[]"'
. ' value="' . htmlspecialchars($selected_table) . '" />';
@ -273,7 +275,7 @@ function PMA_getHtmlForTableVersionDetails(
$html = '<form method="post" action="tbl_tracking.php" name="versionsForm"'
. ' id="versionsForm" class="ajax">';
$html .= PMA_URL_getHiddenInputs($GLOBALS['db'], $GLOBALS['table']);
$html .= URL::getHiddenInputs($GLOBALS['db'], $GLOBALS['table']);
$html .= '<table id="versions" class="data">';
$html .= '<thead>';
$html .= '<tr>';
@ -326,7 +328,7 @@ function PMA_getHtmlForTableVersionDetails(
$html .= '<td><a class="delete_version_anchor ajax"'
. ' href="' . $delete_link . '" >' . $delete . '</a></td>';
$html .= '<td><a href="tbl_tracking.php';
$html .= PMA_URL_getCommon(
$html .= URL::getCommon(
$url_params + array(
'report' => 'true', 'version' => $version['version']
)
@ -334,7 +336,7 @@ function PMA_getHtmlForTableVersionDetails(
$html .= '">' . $report . '</a>';
$html .= '&nbsp;&nbsp;';
$html .= '<a href="tbl_tracking.php';
$html .= PMA_URL_getCommon(
$html .= URL::getCommon(
$url_params + array(
'snapshot' => 'true', 'version' => $version['version']
)
@ -575,7 +577,7 @@ function PMA_getHtmlForTrackingReportExportForm1(
$ddlog_count = 0;
$html = '<form method="post" action="tbl_tracking.php'
. PMA_URL_getCommon(
. URL::getCommon(
$url_params + array(
'report' => 'true', 'version' => $_REQUEST['version']
)
@ -625,7 +627,7 @@ function PMA_getHtmlForTrackingReportExportForm2(
$url_params, $str1, $str2, $str3, $str4, $str5
) {
$html = '<form method="post" action="tbl_tracking.php'
. PMA_URL_getCommon(
. URL::getCommon(
$url_params + array(
'report' => 'true', 'version' => $_REQUEST['version']
)
@ -638,7 +640,7 @@ function PMA_getHtmlForTrackingReportExportForm2(
$html .= '</form>';
$html .= '<form class="disableAjax" method="post" action="tbl_tracking.php'
. PMA_URL_getCommon(
. URL::getCommon(
$url_params
+ array('report' => 'true', 'version' => $_REQUEST['version'])
)
@ -657,7 +659,7 @@ function PMA_getHtmlForTrackingReportExportForm2(
. '</option>'
. '<option value="sqldump">' . __('SQL dump') . '</option>'
. '<option value="execution" onclick="alert(\''
. PMA_escapeJsString(
. Sanitize::escapeJsString(
__('This option will replace your table and contained data.')
)
. '\')">' . __('SQL execution') . '</option>' . '</select>';
@ -736,7 +738,7 @@ function PMA_getHtmlForOneStatement($entry, $filter_users,
$html .= '<td>' . $statement . '</td>';
$html .= '<td class="nowrap"><a class="delete_entry_anchor ajax"'
. ' href="tbl_tracking.php'
. PMA_URL_getCommon(
. URL::getCommon(
$url_params + array(
'report' => 'true',
'version' => $_REQUEST['version'],
@ -1464,7 +1466,7 @@ function PMA_displayUntrackedTables(
<form method="post" action="db_tracking.php" name="untrackedForm"
id="untrackedForm" class="ajax">
<?php
echo PMA_URL_getHiddenInputs($db)
echo URL::getHiddenInputs($db)
?>
<table id="noversions" class="data">
<thead>
@ -1610,7 +1612,7 @@ function PMA_displayTrackedTables(
<form method="post" action="db_tracking.php" name="trackedForm"
id="trackedForm" class="ajax">
<?php
echo PMA_URL_getHiddenInputs($db)
echo URL::getHiddenInputs($db)
?>
<table id="versions" class="data">
<thead>

248
libraries/url_generating.lib.php
View File

@ -1,248 +0,0 @@
<?php
/* vim: set expandtab sw=4 ts=4 sts=4: */
/**
* URL/hidden inputs generating.
*
* @package PhpMyAdmin
*/
if (! defined('PHPMYADMIN')) {
exit;
}
/**
* Generates text with hidden inputs.
*
* @param string|array $db optional database name
* (can also be an array of parameters)
* @param string $table optional table name
* @param int $indent indenting level
* @param string|array $skip do not generate a hidden field for this parameter
* (can be an array of strings)
*
* @see PMA_URL_getCommon()
*
* @return string string with input fields
*
* @access public
*/
function PMA_URL_getHiddenInputs($db = '', $table = '',
$indent = 0, $skip = array()
) {
if (is_array($db)) {
$params =& $db;
$_indent = empty($table) ? $indent : $table;
$_skip = empty($indent) ? $skip : $indent;
$indent =& $_indent;
$skip =& $_skip;
} else {
$params = array();
if (mb_strlen($db)) {
$params['db'] = $db;
}
if (mb_strlen($table)) {
$params['table'] = $table;
}
}
if (! empty($GLOBALS['server'])
&& $GLOBALS['server'] != $GLOBALS['cfg']['ServerDefault']
) {
$params['server'] = $GLOBALS['server'];
}
if (empty($_COOKIE['pma_lang']) && ! empty($GLOBALS['lang'])) {
$params['lang'] = $GLOBALS['lang'];
}
if (empty($_COOKIE['pma_collation_connection'])
&& ! empty($GLOBALS['collation_connection'])
) {
$params['collation_connection'] = $GLOBALS['collation_connection'];
}
$params['token'] = $_SESSION[' PMA_token '];
if (! is_array($skip)) {
if (isset($params[$skip])) {
unset($params[$skip]);
}
} else {
foreach ($skip as $skipping) {
if (isset($params[$skipping])) {
unset($params[$skipping]);
}
}
}
return PMA_getHiddenFields($params);
}
/**
* create hidden form fields from array with name => value
*
* <code>
* $values = array(
* 'aaa' => aaa,
* 'bbb' => array(
* 'bbb_0',
* 'bbb_1',
* ),
* 'ccc' => array(
* 'a' => 'ccc_a',
* 'b' => 'ccc_b',
* ),
* );
* echo PMA_getHiddenFields($values);
*
* // produces:
* <input type="hidden" name="aaa" Value="aaa" />
* <input type="hidden" name="bbb[0]" Value="bbb_0" />
* <input type="hidden" name="bbb[1]" Value="bbb_1" />
* <input type="hidden" name="ccc[a]" Value="ccc_a" />
* <input type="hidden" name="ccc[b]" Value="ccc_b" />
* </code>
*
* @param array $values hidden values
* @param string $pre prefix
*
* @return string form fields of type hidden
*/
function PMA_getHiddenFields($values, $pre = '')
{
$fields = '';
foreach ($values as $name => $value) {
if (! empty($pre)) {
$name = $pre . '[' . $name . ']';
}
if (is_array($value)) {
$fields .= PMA_getHiddenFields($value, $name);
} else {
// do not generate an ending "\n" because
// PMA_URL_getHiddenInputs() is sometimes called
// from a JS document.write()
$fields .= '<input type="hidden" name="' . htmlspecialchars($name)
. '" value="' . htmlspecialchars($value) . '" />';
}
}
return $fields;
}
/**
* Generates text with URL parameters.
*
* <code>
* $params['myparam'] = 'myvalue';
* $params['db'] = 'mysql';
* $params['table'] = 'rights';
* // note the missing ?
* echo 'script.php' . PMA_URL_getCommon($params);
* // produces with cookies enabled:
* // script.php?myparam=myvalue&amp;db=mysql&amp;table=rights
* // with cookies disabled:
* // script.php?server=1&amp;lang=en&amp;myparam=myvalue&amp;db=mysql
* // &amp;table=rights
*
* // note the missing ?
* echo 'script.php' . PMA_URL_getCommon();
* // produces with cookies enabled:
* // script.php
* // with cookies disabled:
* // script.php?server=1&amp;lang=en
* </code>
*
* @param mixed $params optional, Contains an associative array with url params
*
* @param string $encode 'html' to use htmlspecialchars() on the resulting
* URL (for a normal URL displayed in HTML) or
* something else to avoid using htmlspecialchars()
* (for a URL sent via a header);
* if not set,'html' is assumed
*
* @param string $divider optional character to use instead of '?'
*
* @return string string with URL parameters
* @access public
*/
function PMA_URL_getCommon($params = array(), $encode = 'html', $divider = '?')
{
$separator = PMA_URL_getArgSeparator();
// avoid overwriting when creating navi panel links to servers
if (isset($GLOBALS['server'])
&& $GLOBALS['server'] != $GLOBALS['cfg']['ServerDefault']
&& ! isset($params['server'])
&& ! defined('PMA_SETUP')
) {
$params['server'] = $GLOBALS['server'];
}
if (empty($_COOKIE['pma_lang']) && ! empty($GLOBALS['lang'])) {
$params['lang'] = $GLOBALS['lang'];
}
if (empty($_COOKIE['pma_collation_connection'])
&& ! empty($GLOBALS['collation_connection'])
) {
$params['collation_connection'] = $GLOBALS['collation_connection'];
}
if (isset($_SESSION[' PMA_token '])) {
$params['token'] = $_SESSION[' PMA_token '];
}
if (empty($params)) {
return '';
}
$query = $divider . http_build_query($params, null, $separator);
if ($encode === 'html') {
$query = htmlspecialchars($query);
}
return $query;
}
/**
* Returns url separator
*
* extracted from arg_separator.input as set in php.ini
* we do not use arg_separator.output to avoid problems with &amp; and &
*
* @param string $encode whether to encode separator or not,
* currently 'none' or 'html'
*
* @return string character used for separating url parts usually ; or &
* @access public
*/
function PMA_URL_getArgSeparator($encode = 'none')
{
static $separator = null;
static $html_separator = null;
if (null === $separator) {
// use separators defined by php, but prefer ';'
// as recommended by W3C
// (see http://www.w3.org/TR/1999/REC-html401-19991224/appendix
// /notes.html#h-B.2.2)
$arg_separator = ini_get('arg_separator.input');
if (mb_strpos($arg_separator, ';') !== false) {
$separator = ';';
} elseif (mb_strlen($arg_separator) > 0) {
$separator = $arg_separator{0};
} else {
$separator = '&';
}
$html_separator = htmlentities($separator);
}
switch ($encode) {
case 'html':
return $html_separator;
case 'text' :
case 'none' :
default :
return $separator;
}
}

3
libraries/user_preferences.inc.php
View File

@ -6,6 +6,7 @@
* @package PhpMyAdmin
*/
use PMA\libraries\Message;
use PMA\libraries\Sanitize;
if (!defined('PHPMYADMIN')) {
exit;
@ -77,7 +78,7 @@ if (! $cfgRelation['userconfigwork']) {
'Your preferences will be saved for current session only. Storing them '
. 'permanently requires %sphpMyAdmin configuration storage%s.'
);
$msg = PMA_sanitize(
$msg = Sanitize::sanitize(
sprintf($msg, '[doc@linked-tables]', '[/doc]')
);
Message::notice($msg)->display();

5
libraries/user_preferences.lib.php
View File

@ -7,6 +7,7 @@
*/
use PMA\libraries\config\ConfigFile;
use PMA\libraries\Message;
use PMA\libraries\URL;
if (! defined('PHPMYADMIN')) {
exit;
@ -256,7 +257,7 @@ function PMA_userprefsRedirect($file_name,
$hash = '#' . urlencode($hash);
}
PMA_sendHeaderLocation('./' . $file_name
. PMA_URL_getCommon($url_params, '&') . $hash
. URL::getCommon($url_params, '&') . $hash
);
}
@ -283,7 +284,7 @@ function PMA_userprefsAutoloadGetHeader()
return PMA\libraries\Template::get('prefs_autoload')
->render(
array(
'hiddenInputs' => PMA_URL_getHiddenInputs(),
'hiddenInputs' => URL::getHiddenInputs(),
'return_url' => $return_url,
)
);

5
normalization.php
View File

@ -5,6 +5,7 @@
*
* @package PhpMyAdmin
*/
use PMA\libraries\URL;
/**
*
@ -28,7 +29,7 @@ if (isset($_REQUEST['getColumns'])) {
if (isset($_REQUEST['splitColumn'])) {
$num_fields = $_REQUEST['numFields'];
$html = PMA_getHtmlForCreateNewColumn($num_fields, $db, $table);
$html .= PMA_URL_getHiddenInputs($db, $table);
$html .= URL::getHiddenInputs($db, $table);
echo $html;
exit;
}
@ -38,7 +39,7 @@ if (isset($_REQUEST['addNewPrimary'])) {
$html = PMA_getHtmlForCreateNewColumn(
$num_fields, $db, $table, $columnMeta
);
$html .= PMA_URL_getHiddenInputs($db, $table);
$html .= URL::getHiddenInputs($db, $table);
echo $html;
exit;
}

3
prefs_forms.php
View File

@ -8,6 +8,7 @@
use PMA\libraries\config\ConfigFile;
use PMA\libraries\config\FormDisplay;
use PMA\libraries\Response;
use PMA\libraries\URL;
/**
* Gets some core libraries and displays a top message if required
@ -45,7 +46,7 @@ if (isset($_POST['revert'])) {
$url_params = array('form' => $form_param);
PMA_sendHeaderLocation(
'./prefs_forms.php'
. PMA_URL_getCommon($url_params, 'text')
. URL::getCommon($url_params, 'text')
);
exit;
}

12
prefs_manage.php
View File

@ -10,6 +10,8 @@ use PMA\libraries\config\FormDisplay;
use PMA\libraries\Message;
use PMA\libraries\Response;
use PMA\libraries\Util;
use PMA\libraries\URL;
use PMA\libraries\Sanitize;
/**
* Gets some core libraries and displays a top message if required
@ -122,7 +124,7 @@ if (isset($_POST['submit_export'])
echo $form_display->displayErrors();
echo '</div>';
echo '<form action="prefs_manage.php" method="post">';
echo PMA_URL_getHiddenInputs() , "\n";
echo URL::getHiddenInputs() , "\n";
echo '<input type="hidden" name="json" value="'
, htmlspecialchars($json) , '" />';
echo '<input type="hidden" name="fix_errors" value="1" />';
@ -227,7 +229,7 @@ if ($error) {
?>
<script type="text/javascript">
<?php
PMA_printJsValue("PMA_messages['strSavedOn']", __('Saved on: @DATE@'));
Sanitize::printJsValue("PMA_messages['strSavedOn']", __('Saved on: @DATE@'));
?>
</script>
<div id="maincontainer">
@ -238,7 +240,7 @@ echo '<h2>' , __('Import') , '</h2>'
, '<form class="group-cnt prefs-form disableAjax" name="prefs_import"'
, ' action="prefs_manage.php" method="post" enctype="multipart/form-data">'
, Util::generateHiddenMaxFileSize($GLOBALS['max_upload_size'])
, PMA_URL_getHiddenInputs()
, URL::getHiddenInputs()
, '<input type="hidden" name="json" value="" />'
, '<input type="radio" id="import_text_file" name="import_type"'
, ' value="text_file" checked="checked" />'
@ -309,7 +311,7 @@ if (file_exists('setup/index.php')) {
</div>
<form class="group-cnt prefs-form disableAjax" name="prefs_export"
action="prefs_manage.php" method="post">
<?php echo PMA_URL_getHiddenInputs(); ?>
<?php echo URL::getHiddenInputs(); ?>
<div style="padding-bottom:0.5em">
<input type="radio" id="export_text_file" name="export_type"
value="text_file" checked="checked" />
@ -361,7 +363,7 @@ if (file_exists('setup/index.php')) {
<form class="group-cnt prefs-form disableAjax" name="prefs_reset"
action="prefs_manage.php" method="post">
<?php
echo PMA_URL_getHiddenInputs() , __(
echo URL::getHiddenInputs() , __(
'You can reset all your settings and restore them to default '
. 'values.'
);

11
setup/config.php
View File

@ -7,6 +7,7 @@
*/
use PMA\libraries\config\FormDisplay;
use PMA\setup\lib\ConfigGenerator;
use PMA\libraries\URL;
/**
* Core libraries.
@ -31,7 +32,7 @@ if (PMA_ifSetOr($_POST['submit_clear'], '')) {
$GLOBALS['ConfigFile']->resetConfigData();
// drop post data
header('HTTP/1.1 303 See Other');
header('Location: index.php' . PMA_URL_getCommon());
header('Location: index.php' . URL::getCommon());
exit;
} elseif (PMA_ifSetOr($_POST['submit_download'], '')) {
//
@ -49,7 +50,7 @@ if (PMA_ifSetOr($_POST['submit_clear'], '')) {
ConfigGenerator::getConfigFile($GLOBALS['ConfigFile'])
);
header('HTTP/1.1 303 See Other');
header('Location: index.php' . PMA_URL_getCommon() . '&action_done=config_saved');
header('Location: index.php' . URL::getCommon() . '&action_done=config_saved');
exit;
} elseif (PMA_ifSetOr($_POST['submit_load'], '')) {
//
@ -59,7 +60,7 @@ if (PMA_ifSetOr($_POST['submit_clear'], '')) {
include_once $config_file_path;
$GLOBALS['ConfigFile']->setConfigData($cfg);
header('HTTP/1.1 303 See Other');
header('Location: index.php' . PMA_URL_getCommon());
header('Location: index.php' . URL::getCommon());
exit;
} elseif (PMA_ifSetOr($_POST['submit_delete'], '')) {
//
@ -67,13 +68,13 @@ if (PMA_ifSetOr($_POST['submit_clear'], '')) {
//
@unlink($config_file_path);
header('HTTP/1.1 303 See Other');
header('Location: index.php' . PMA_URL_getCommon());
header('Location: index.php' . URL::getCommon());
exit;
} else {
//
// Show generated config file in a <textarea>
//
header('HTTP/1.1 303 See Other');
header('Location: index.php' . PMA_URL_getCommon() . '&page=config');
header('Location: index.php' . URL::getCommon() . '&page=config');
exit;
}

18
setup/frames/index.inc.php
View File

@ -10,6 +10,8 @@ use PMA\libraries\config\ConfigFile;
use PMA\libraries\config\FormDisplay;
use PMA\libraries\config\ServerConfigChecks;
use PMA\libraries\LanguageManager;
use PMA\libraries\URL;
use PMA\libraries\Sanitize;
if (!defined('PHPMYADMIN')) {
exit;
@ -27,7 +29,7 @@ $all_languages = LanguageManager::getInstance()->sortedLanguages();
/** @var ConfigFile $cf */
$cf = $GLOBALS['ConfigFile'];
$separator = PMA_URL_getArgSeparator('html');
$separator = URL::getArgSeparator('html');
// message handling
PMA_messagesBegin();
@ -55,7 +57,7 @@ PMA_checkConfigRw($config_readable, $config_writable, $config_exists);
if (!$config_writable || !$config_readable) {
PMA_messagesSet(
'error', 'config_rw', __('Cannot load or save configuration'),
PMA_sanitize(
Sanitize::sanitize(
__(
'Please create web server writable folder [em]config[/em] in '
. 'phpMyAdmin top level directory as described in '
@ -81,7 +83,7 @@ if (!$is_https) {
'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']
);
$text .= ' ';
$text .= PMA_sanitize(
$text .= Sanitize::sanitize(
sprintf(
__(
'If your server is also configured to accept HTTPS requests '
@ -96,7 +98,7 @@ if (!$is_https) {
echo '<form id="select_lang" method="post" action="'
, htmlspecialchars($_SERVER['REQUEST_URI']) , '">';
echo PMA_URL_getHiddenInputs();
echo URL::getHiddenInputs();
echo '<bdo lang="en" dir="ltr"><label for="lang">';
echo __('Language') , (__('Language') != 'Language' ? ' - Language' : '');
echo '</label></bdo><br />';
@ -120,7 +122,7 @@ case 'config_saved':
/* Use uniqid to display this message every time configuration is saved */
PMA_messagesSet(
'notice', uniqid('config_saved'), __('Configuration saved.'),
PMA_sanitize(
Sanitize::sanitize(
__(
'Configuration saved to file config/config.inc.php in phpMyAdmin '
. 'top level directory, copy it to top level one and delete '
@ -177,11 +179,11 @@ if ($cf->getServerCount() > 0) {
echo '<td>' , htmlspecialchars($cf->getServerDSN($id)) , '</td>';
echo '<td style="white-space: nowrap">';
echo '<small>';
echo '<a href="' , PMA_URL_getCommon() , $separator , 'page=servers'
echo '<a href="' , URL::getCommon() , $separator , 'page=servers'
, $separator , 'mode=edit' , $separator , 'id=' , $id , '">'
, __('Edit') , '</a>';
echo ' | ';
echo '<a href="' , PMA_URL_getCommon() , $separator , 'page=servers'
echo '<a href="' , URL::getCommon() , $separator , 'page=servers'
, $separator , 'mode=remove' , $separator , 'id=' , $id , '">'
, __('Delete') , '</a>';
echo '</small>';
@ -310,6 +312,6 @@ echo '<div id="footer">';
echo '<a href="https://www.phpmyadmin.net/">' , __('phpMyAdmin homepage') , '</a>';
echo '<a href="https://www.phpmyadmin.net/donate/">'
, __('Donate') , '</a>';
echo '<a href="' , PMA_URL_getCommon() , $separator , 'version_check=1">'
echo '<a href="' , URL::getCommon() , $separator , 'version_check=1">'
, __('Check for latest version') , '</a>';
echo '</div>';

7
setup/frames/menu.inc.php
View File

@ -5,6 +5,7 @@
*
* @package PhpMyAdmin-Setup
*/
use PMA\libraries\URL;
if (!defined('PHPMYADMIN')) {
exit;
@ -12,9 +13,9 @@ if (!defined('PHPMYADMIN')) {
$formset_id = isset($_GET['formset']) ? $_GET['formset'] : null;
$separator = PMA_URL_getArgSeparator('html');
$separator = URL::getArgSeparator('html');
echo '<ul>';
echo '<li><a href="index.php' , PMA_URL_getCommon() , '"'
echo '<li><a href="index.php' , URL::getCommon() , '"'
, ($formset_id === null ? ' class="active' : '')
, '">' , __('Overview') , '</a></li>';
@ -28,7 +29,7 @@ $formsets = array(
);
foreach ($formsets as $formset => $label) {
echo '<li><a href="' , PMA_URL_getCommon() , $separator , 'page=form'
echo '<li><a href="' , URL::getCommon() , $separator , 'page=form'
, $separator , 'formset=' , $formset , '" '
, ($formset_id === $formset ? ' class="active' : '')
, '">' , $label , '</a></li>';

3
setup/frames/servers.inc.php
View File

@ -8,6 +8,7 @@
use PMA\libraries\config\ConfigFile;
use PMA\libraries\config\FormDisplay;
use PMA\libraries\URL;
if (!defined('PHPMYADMIN')) {
exit;
@ -33,7 +34,7 @@ if ($mode == 'edit' && $server_exists) {
. ' <small>(' . htmlspecialchars($cf->getServerDSN($id)) . ')</small>';
} elseif ($mode == 'remove' && $server_exists) {
$cf->removeServer($id);
header('Location: index.php' . PMA_URL_getCommon());
header('Location: index.php' . URL::getCommon());
exit;
} elseif ($mode == 'revert' && $server_exists) {
// handled by process_formset()

1
setup/lib/common.inc.php
View File

@ -22,7 +22,6 @@ if (!file_exists('./libraries/common.inc.php')) {
require_once './libraries/common.inc.php';
require_once './libraries/config/config_functions.lib.php';
require_once './libraries/config/messages.inc.php';
require_once './libraries/url_generating.lib.php';
require_once './libraries/user_preferences.lib.php';
// use default error handler

11
setup/lib/form_processing.lib.php
View File

@ -6,6 +6,7 @@
* @package PhpMyAdmin-Setup
*/
use PMA\libraries\config\FormDisplay;
use PMA\libraries\URL;
/**
* Processes forms registered in $form_display, handles error correction
@ -35,7 +36,7 @@ function PMA_Process_formset(FormDisplay $form_display)
}
// form has errors, show warning
$separator = PMA_URL_getArgSeparator('html');
$separator = URL::getArgSeparator('html');
$page = isset($_GET['page']) ? $_GET['page'] : null;
$formset = isset($_GET['formset']) ? $_GET['formset'] : null;
$formset = $formset ? "{$separator}formset=$formset" : '';
@ -49,16 +50,16 @@ function PMA_Process_formset(FormDisplay $form_display)
<div class="error">
<h4><?php echo __('Warning') ?></h4>
<?php echo __('Submitted form contains errors') ?><br />
<a href="<?php echo PMA_URL_getCommon() , $separator ?>page=<?php echo $page , $formset , $formId , $separator ?>mode=revert">
<a href="<?php echo URL::getCommon() , $separator ?>page=<?php echo $page , $formset , $formId , $separator ?>mode=revert">
<?php echo __('Try to revert erroneous fields to their default values') ?>
</a>
</div>
<?php echo $form_display->displayErrors() ?>
<a class="btn" href="index.php<?php echo PMA_URL_getCommon() ?>">
<a class="btn" href="index.php<?php echo URL::getCommon() ?>">
<?php echo __('Ignore errors') ?>
</a>
&nbsp;
<a class="btn" href="<?php echo PMA_URL_getCommon() , $separator ?>page=<?php echo $page , $formset , $formId , $separator ?>mode=edit">
<a class="btn" href="<?php echo URL::getCommon() , $separator ?>page=<?php echo $page , $formset , $formId , $separator ?>mode=edit">
<?php echo __('Show form') ?>
</a>
<?php
@ -73,7 +74,7 @@ function PMA_generateHeader303()
{
// drop post data
header('HTTP/1.1 303 See Other');
header('Location: index.php' . PMA_URL_getCommon());
header('Location: index.php' . URL::getCommon());
if (!defined('TESTSUITE')) {
exit;

3
setup/lib/index.lib.php
View File

@ -7,6 +7,7 @@
*/
use PMA\libraries\VersionInformation;
use PMA\libraries\Sanitize;
if (!defined('PHPMYADMIN')) {
exit;
@ -174,7 +175,7 @@ function PMA_versionCheck()
'notice',
$message_id,
__('Version check'),
PMA_sanitize(sprintf(__('You are using Git version, run [kbd]git pull[/kbd] :-)[br]The latest stable version is %s, released on %s.'), $version, $date))
Sanitize::sanitize(sprintf(__('You are using Git version, run [kbd]git pull[/kbd] :-)[br]The latest stable version is %s, released on %s.'), $version, $date))
);
} else {
PMA_messagesSet(

5
sql.php
View File

@ -10,6 +10,7 @@
use PMA\libraries\config\PageSettings;
use PMA\libraries\Response;
use PMA\libraries\Util;
use PMA\libraries\URL;
/**
* Gets some core libraries
@ -60,7 +61,7 @@ if (empty($goto)) {
if (! isset($err_url)) {
$err_url = (! empty($back) ? $back : $goto)
. '?' . PMA_URL_getCommon(array('db' => $GLOBALS['db']))
. '?' . URL::getCommon(array('db' => $GLOBALS['db']))
. ((mb_strpos(' ' . $goto, 'db_') != 1
&& mb_strlen($table))
? '&amp;table=' . urlencode($table)
@ -187,7 +188,7 @@ if (isset($_POST['store_bkm'])) {
*/
if ($goto == 'sql.php') {
$is_gotofile = false;
$goto = 'sql.php' . PMA_URL_getCommon(
$goto = 'sql.php' . URL::getCommon(
array(
'db' => $db,
'table' => $table,

Some files were not shown because too many files have changed in this diff Show More