From 09e74a94150d84ba0014f7455446383311c6d190 Mon Sep 17 00:00:00 2001 From: Piotr Przybylski Date: Wed, 13 Jul 2011 23:40:58 +0200 Subject: [PATCH 1/3] Improve readability of XML export code --- libraries/export/xml.php | 25 ++++++++++--------------- 1 file changed, 10 insertions(+), 15 deletions(-) diff --git a/libraries/export/xml.php b/libraries/export/xml.php index 26650513d2..35971f078b 100644 --- a/libraries/export/xml.php +++ b/libraries/export/xml.php @@ -71,13 +71,12 @@ function PMA_exportFooter() { function PMA_exportHeader() { global $crlf; global $cfg; - global $what; global $db; global $table; global $tables; - $export_struct = isset($GLOBALS[$what . '_export_struc']) ? true : false; - $export_data = isset($GLOBALS[$what . '_export_contents']) ? true : false; + $export_struct = isset($GLOBALS['xml_export_struc']) ? true : false; + $export_data = isset($GLOBALS['xml_export_contents']) ? true : false; if ($GLOBALS['output_charset_conversion']) { $charset = $GLOBALS['charset_of_file']; @@ -131,11 +130,11 @@ function PMA_exportHeader() { $type = 'table'; } - if ($is_view && ! isset($GLOBALS[$what . '_export_views'])) { + if ($is_view && ! isset($GLOBALS['xml_export_views'])) { continue; } - if (! $is_view && ! isset($GLOBALS[$what . '_export_tables'])) { + if (! $is_view && ! isset($GLOBALS['xml_export_tables'])) { continue; } @@ -147,7 +146,7 @@ function PMA_exportHeader() { $head .= $tbl . ';' . $crlf; $head .= ' ' . $crlf; - if (isset($GLOBALS[$what . '_export_triggers']) && $GLOBALS[$what . '_export_triggers']) { + if (isset($GLOBALS['xml_export_triggers']) && $GLOBALS['xml_export_triggers']) { // Export triggers $triggers = PMA_DBI_get_triggers($db, $table); if ($triggers) { @@ -170,7 +169,7 @@ function PMA_exportHeader() { } } - if (isset($GLOBALS[$what . '_export_functions']) && $GLOBALS[$what . '_export_functions']) { + if (isset($GLOBALS['xml_export_functions']) && $GLOBALS['xml_export_functions']) { // Export functions $functions = PMA_DBI_get_procedures_or_functions($db, 'FUNCTION'); if ($functions) { @@ -193,7 +192,7 @@ function PMA_exportHeader() { } } - if (isset($GLOBALS[$what . '_export_procedures']) && $GLOBALS[$what . '_export_procedures']) { + if (isset($GLOBALS['xml_export_procedures']) && $GLOBALS['xml_export_procedures']) { // Export procedures $procedures = PMA_DBI_get_procedures_or_functions($db, 'PROCEDURE'); if ($procedures) { @@ -239,9 +238,8 @@ function PMA_exportHeader() { */ function PMA_exportDBHeader($db) { global $crlf; - global $what; - if (isset($GLOBALS[$what . '_export_contents']) && $GLOBALS[$what . '_export_contents']) { + if (isset($GLOBALS['xml_export_contents']) && $GLOBALS['xml_export_contents']) { $head = ' ' . $crlf @@ -265,9 +263,8 @@ function PMA_exportDBHeader($db) { */ function PMA_exportDBFooter($db) { global $crlf; - global $what; - if (isset($GLOBALS[$what . '_export_contents']) && $GLOBALS[$what . '_export_contents']) { + if (isset($GLOBALS['xml_export_contents']) && $GLOBALS['xml_export_contents']) { return PMA_exportOutputHandler(' ' . $crlf); } else @@ -301,9 +298,7 @@ function PMA_exportDBCreate($db) { * @access public */ function PMA_exportData($db, $table, $crlf, $error_url, $sql_query) { - global $what; - - if (isset($GLOBALS[$what . '_export_contents']) && $GLOBALS[$what . '_export_contents']) { + if (isset($GLOBALS['xml_export_contents']) && $GLOBALS['xml_export_contents']) { $result = PMA_DBI_query($sql_query, null, PMA_DBI_QUERY_UNBUFFERED); $columns_cnt = PMA_DBI_num_fields($result); From 667cf67954c44facf978660f5fa7b9ed5c2b1b89 Mon Sep 17 00:00:00 2001 From: Piotr Przybylski Date: Wed, 13 Jul 2011 23:42:29 +0200 Subject: [PATCH 2/3] Better escaping in XML export Note: it's still incorrect --- libraries/export/xml.php | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libraries/export/xml.php b/libraries/export/xml.php index 35971f078b..21fc95568e 100644 --- a/libraries/export/xml.php +++ b/libraries/export/xml.php @@ -111,7 +111,7 @@ function PMA_exportHeader() { $head .= ' - Structure schemas' . $crlf; $head .= ' -->' . $crlf; $head .= ' ' . $crlf; - $head .= ' ' . $crlf; + $head .= ' ' . $crlf; if (count($tables) == 0) { $tables[] = $table; @@ -302,6 +302,7 @@ function PMA_exportData($db, $table, $crlf, $error_url, $sql_query) { $result = PMA_DBI_query($sql_query, null, PMA_DBI_QUERY_UNBUFFERED); $columns_cnt = PMA_DBI_num_fields($result); + $columns = array(); for ($i = 0; $i < $columns_cnt; $i++) { $columns[$i] = stripslashes(str_replace(' ', '_', PMA_DBI_field_name($result, $i))); } @@ -319,7 +320,7 @@ function PMA_exportData($db, $table, $crlf, $error_url, $sql_query) { if (!isset($record[$i]) || is_null($record[$i])) { $record[$i] = 'NULL'; } - $buffer .= ' ' . htmlspecialchars((string)$record[$i]) + $buffer .= ' ' . htmlspecialchars((string)$record[$i]) . '' . $crlf; } $buffer .= ' ' . $crlf; From d84d51c77552bd166c03dcb6a1623f93952ad058 Mon Sep 17 00:00:00 2001 From: Piotr Przybylski Date: Thu, 14 Jul 2011 00:05:58 +0200 Subject: [PATCH 3/3] Fix XML export so it actually can export table structure More escaping fixes --- libraries/export/xml.php | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/libraries/export/xml.php b/libraries/export/xml.php index 21fc95568e..85bab5f77f 100644 --- a/libraries/export/xml.php +++ b/libraries/export/xml.php @@ -75,7 +75,9 @@ function PMA_exportHeader() { global $table; global $tables; - $export_struct = isset($GLOBALS['xml_export_struc']) ? true : false; + $export_struct = isset($GLOBALS['xml_export_functions']) || isset($GLOBALS['xml_export_procedures']) + || isset($GLOBALS['xml_export_tables']) || isset($GLOBALS['xml_export_triggers']) + || isset($GLOBALS['xml_export_views']); $export_data = isset($GLOBALS['xml_export_contents']) ? true : false; if ($GLOBALS['output_charset_conversion']) { @@ -140,7 +142,7 @@ function PMA_exportHeader() { $head .= ' ' . $crlf; - $tbl = " " . $tbl; + $tbl = " " . htmlspecialchars($tbl); $tbl = str_replace("\n", "\n ", $tbl); $head .= $tbl . ';' . $crlf; @@ -156,7 +158,7 @@ function PMA_exportHeader() { // Do some formatting $code = substr(rtrim($code), 0, -3); - $code = " " . $code; + $code = " " . htmlspecialchars($code); $code = str_replace("\n", "\n ", $code); $head .= $code . $crlf; @@ -179,7 +181,7 @@ function PMA_exportHeader() { // Do some formatting $sql = PMA_DBI_get_definition($db, 'FUNCTION', $function); $sql = rtrim($sql); - $sql = " " . $sql; + $sql = " " . htmlspecialchars($sql); $sql = str_replace("\n", "\n ", $sql); $head .= $sql . $crlf; @@ -202,7 +204,7 @@ function PMA_exportHeader() { // Do some formatting $sql = PMA_DBI_get_definition($db, 'PROCEDURE', $procedure); $sql = rtrim($sql); - $sql = " " . $sql; + $sql = " " . htmlspecialchars($sql); $sql = str_replace("\n", "\n ", $sql); $head .= $sql . $crlf; @@ -243,7 +245,7 @@ function PMA_exportDBHeader($db) { $head = ' ' . $crlf - . ' ' . $crlf; + . ' ' . $crlf; return PMA_exportOutputHandler($head); }