diff --git a/phpstan-baseline.neon b/phpstan-baseline.neon index 162524d2f6..84b2f1d2fb 100644 --- a/phpstan-baseline.neon +++ b/phpstan-baseline.neon @@ -3504,48 +3504,12 @@ parameters: count: 3 path: src/Controllers/Server/PrivilegesController.php - - - message: '#^Loose comparison via "\=\=" is not allowed\.$#' - identifier: equal.notAllowed - count: 2 - path: src/Controllers/Server/PrivilegesController.php - - message: '#^Method PhpMyAdmin\\Controllers\\Server\\PrivilegesController\:\:getExportPageTitle\(\) has parameter \$selectedUsers with no value type specified in iterable type array\.$#' identifier: missingType.iterableValue count: 1 path: src/Controllers/Server/PrivilegesController.php - - - message: '#^Parameter \#1 \$username of method PhpMyAdmin\\Controllers\\Server\\PrivilegesController\:\:getExportPageTitle\(\) expects string, mixed given\.$#' - identifier: argument.type - count: 1 - path: src/Controllers/Server/PrivilegesController.php - - - - message: '#^Parameter \#1 \$username of method PhpMyAdmin\\Server\\Privileges\:\:getExportUserDefinitionTextarea\(\) expects string, mixed given\.$#' - identifier: argument.type - count: 1 - path: src/Controllers/Server/PrivilegesController.php - - - - message: '#^Parameter \#1 \$username of method PhpMyAdmin\\Server\\Privileges\:\:getHtmlForRoutineSpecificPrivileges\(\) expects string, mixed given\.$#' - identifier: argument.type - count: 1 - path: src/Controllers/Server/PrivilegesController.php - - - - message: '#^Parameter \#1 \$username of method PhpMyAdmin\\Server\\Privileges\:\:setUserGroup\(\) expects string, mixed given\.$#' - identifier: argument.type - count: 1 - path: src/Controllers/Server/PrivilegesController.php - - - - message: '#^Parameter \#1 \$username of method PhpMyAdmin\\Server\\Privileges\:\:updatePrivileges\(\) expects string, mixed given\.$#' - identifier: argument.type - count: 2 - path: src/Controllers/Server/PrivilegesController.php - - message: '#^Parameter \#2 \$hostname of method PhpMyAdmin\\Server\\Privileges\:\:getHtmlForRoutineSpecificPrivileges\(\) expects string, mixed given\.$#' identifier: argument.type @@ -3558,48 +3522,12 @@ parameters: count: 1 path: src/Controllers/Server/PrivilegesController.php - - - message: '#^Parameter \#2 \$username of method PhpMyAdmin\\Server\\Privileges\:\:addUser\(\) expects string, mixed given\.$#' - identifier: argument.type - count: 1 - path: src/Controllers/Server/PrivilegesController.php - - - - message: '#^Parameter \#2 \$username of method PhpMyAdmin\\Server\\Privileges\:\:getDbSpecificPrivsQueriesForChangeOrCopyUser\(\) expects string, mixed given\.$#' - identifier: argument.type - count: 1 - path: src/Controllers/Server/PrivilegesController.php - - - - message: '#^Parameter \#2 \$username of method PhpMyAdmin\\Server\\Privileges\:\:updatePassword\(\) expects string, mixed given\.$#' - identifier: argument.type - count: 1 - path: src/Controllers/Server/PrivilegesController.php - - - - message: '#^Parameter \#3 \$username of method PhpMyAdmin\\Server\\Privileges\:\:getHtmlForUserProperties\(\) expects string, mixed given\.$#' - identifier: argument.type - count: 1 - path: src/Controllers/Server/PrivilegesController.php - - - - message: '#^Parameter \#3 \$username of method PhpMyAdmin\\Server\\Privileges\:\:getMessageAndSqlQueryForPrivilegesRevoke\(\) expects string, mixed given\.$#' - identifier: argument.type - count: 1 - path: src/Controllers/Server/PrivilegesController.php - - message: '#^Parameter \#4 \$hostname of method PhpMyAdmin\\Server\\Privileges\:\:getHtmlForUserProperties\(\) expects string, mixed given\.$#' identifier: argument.type count: 1 path: src/Controllers/Server/PrivilegesController.php - - - message: '#^Parameter \#4 \$username of method PhpMyAdmin\\Server\\Privileges\:\:getExtraDataForAjaxBehavior\(\) expects string, mixed given\.$#' - identifier: argument.type - count: 1 - path: src/Controllers/Server/PrivilegesController.php - - message: '#^Only booleans are allowed in an if condition, mixed given\.$#' identifier: if.condNotBoolean @@ -5442,12 +5370,6 @@ parameters: count: 1 path: src/Controllers/UserPasswordController.php - - - message: '#^Parameter \#1 \$username of method PhpMyAdmin\\UserPassword\:\:getFormForChangePassword\(\) expects string\|null, mixed given\.$#' - identifier: argument.type - count: 1 - path: src/Controllers/UserPasswordController.php - - message: '#^Parameter \#2 \$hostname of method PhpMyAdmin\\UserPassword\:\:getFormForChangePassword\(\) expects string\|null, mixed given\.$#' identifier: argument.type @@ -15096,16 +15018,10 @@ parameters: count: 1 path: src/Server/Privileges.php - - - message: '#^Parameter \#1 \$username of method PhpMyAdmin\\Server\\Privileges\:\:getUserHostCondition\(\) expects string, mixed given\.$#' - identifier: argument.type - count: 1 - path: src/Server/Privileges.php - - message: '#^Parameter \#1 \$username of method PhpMyAdmin\\Server\\Privileges\:\:setUserGroup\(\) expects string, mixed given\.$#' identifier: argument.type - count: 2 + count: 1 path: src/Server/Privileges.php - @@ -15138,12 +15054,6 @@ parameters: count: 2 path: src/Server/Privileges.php - - - message: '#^Parameter \#3 \$username of method PhpMyAdmin\\Server\\Privileges\:\:getSqlQueryForDisplayPrivTable\(\) expects string, mixed given\.$#' - identifier: argument.type - count: 1 - path: src/Server/Privileges.php - - message: '#^Parameter \#4 \$dbname of method PhpMyAdmin\\Server\\Privileges\:\:getUserLink\(\) expects string, mixed given\.$#' identifier: argument.type diff --git a/psalm.xml b/psalm.xml index 613a9af121..b22c8423d6 100644 --- a/psalm.xml +++ b/psalm.xml @@ -48,7 +48,6 @@ conn_error: string, display_query: string, errno: int, - error: bool, file_handle: resource|null, from_cookie: bool, hostname: string, @@ -64,8 +63,7 @@ pma_auth_server: string, querytime: float|int, save_on_server: bool, - SESSION_KEY: string, - username: string + SESSION_KEY: string }"/> diff --git a/src/Controllers/Server/PrivilegesController.php b/src/Controllers/Server/PrivilegesController.php index bc582fadb1..bf96845fd6 100644 --- a/src/Controllers/Server/PrivilegesController.php +++ b/src/Controllers/Server/PrivilegesController.php @@ -46,7 +46,6 @@ final class PrivilegesController implements InvocableController public function __invoke(ServerRequest $request): Response { - $GLOBALS['username'] ??= null; $GLOBALS['hostname'] ??= null; $userPrivileges = $this->userPrivilegesFactory->getPrivileges(); @@ -80,7 +79,7 @@ final class PrivilegesController implements InvocableController $this->dbi->selectDb('mysql'); } - $GLOBALS['username'] = $serverPrivileges->getUsernameParam($request); + $serverPrivileges->username = $serverPrivileges->getUsernameParam($request); $GLOBALS['hostname'] = $serverPrivileges->getHostnameParam($request); $databaseName = $serverPrivileges->getDbname($request); $tablename = $serverPrivileges->getTablename($request); @@ -115,8 +114,8 @@ final class PrivilegesController implements InvocableController */ if ( $request->hasBodyParam('change_copy') - && $GLOBALS['username'] == $request->getParsedBodyParam('old_username') - && $GLOBALS['hostname'] == $request->getParsedBodyParam('old_hostname') + && $serverPrivileges->username === $request->getParsedBodyParam('old_username') + && $GLOBALS['hostname'] === $request->getParsedBodyParam('old_hostname') ) { $this->response->addHTML( Message::error( @@ -161,7 +160,7 @@ final class PrivilegesController implements InvocableController $addUserError, ] = $serverPrivileges->addUser( is_string($databaseName) ? $databaseName : '', - $GLOBALS['username'] ?? '', + $serverPrivileges->username ?? '', $hostname, $password, $relationParameters->configurableMenusFeature !== null, @@ -176,10 +175,14 @@ final class PrivilegesController implements InvocableController /** * Changes / copies a user, part III */ - if ($request->hasBodyParam('change_copy') && $GLOBALS['username'] !== null && $GLOBALS['hostname'] !== null) { + if ( + $request->hasBodyParam('change_copy') + && $serverPrivileges->username !== null + && $GLOBALS['hostname'] !== null + ) { $queries = $serverPrivileges->getDbSpecificPrivsQueriesForChangeOrCopyUser( $queries, - $GLOBALS['username'], + $serverPrivileges->username, $GLOBALS['hostname'], $request->getParsedBodyParamAsString('old_username'), $request->getParsedBodyParamAsString('old_hostname'), @@ -199,7 +202,7 @@ final class PrivilegesController implements InvocableController $statements = []; foreach ($databaseName as $key => $dbName) { [$statements[$key], Current::$message] = $serverPrivileges->updatePrivileges( - $GLOBALS['username'] ?? '', + $serverPrivileges->username ?? '', $GLOBALS['hostname'] ?? '', $tablename ?? $routinename ?? '', $dbName, @@ -210,7 +213,7 @@ final class PrivilegesController implements InvocableController Current::$sqlQuery = implode("\n", $statements); } else { [Current::$sqlQuery, Current::$message] = $serverPrivileges->updatePrivileges( - $GLOBALS['username'] ?? '', + $serverPrivileges->username ?? '', $GLOBALS['hostname'] ?? '', $tablename ?? $routinename ?? '', $databaseName ?? '', @@ -227,7 +230,7 @@ final class PrivilegesController implements InvocableController && $this->dbi->isSuperUser() && $this->dbi->isCreateUser() ) { $serverPrivileges->setUserGroup( - $GLOBALS['username'] ?? '', + $serverPrivileges->username ?? '', $request->getParsedBodyParamAsString('userGroup', ''), ); Current::$message = Message::success(); @@ -240,7 +243,7 @@ final class PrivilegesController implements InvocableController [Current::$message, Current::$sqlQuery] = $serverPrivileges->getMessageAndSqlQueryForPrivilegesRevoke( is_string($databaseName) ? $databaseName : '', $tablename ?? $routinename ?? '', - $GLOBALS['username'] ?? '', + $serverPrivileges->username ?? '', $GLOBALS['hostname'] ?? '', $itemType, ); @@ -252,7 +255,7 @@ final class PrivilegesController implements InvocableController if ($request->hasBodyParam('change_pw')) { Current::$message = $serverPrivileges->updatePassword( $errorUrl, - $GLOBALS['username'] ?? '', + $serverPrivileges->username ?? '', $GLOBALS['hostname'] ?? '', ); } @@ -306,7 +309,7 @@ final class PrivilegesController implements InvocableController $password ?? '', Current::$sqlQuery, $GLOBALS['hostname'] ?? '', - $GLOBALS['username'] ?? '', + $serverPrivileges->username ?? '', ! is_array($databaseName) ? $databaseName : null, ); @@ -332,15 +335,20 @@ final class PrivilegesController implements InvocableController /** @var string[]|null $selectedUsers */ $selectedUsers = $request->getParsedBodyParam('selected_usr'); - $title = $this->getExportPageTitle($GLOBALS['username'] ?? '', $GLOBALS['hostname'] ?? '', $selectedUsers); - - $export = $serverPrivileges->getExportUserDefinitionTextarea( - $GLOBALS['username'] ?? '', + $title = $this->getExportPageTitle( + $serverPrivileges->username ?? '', $GLOBALS['hostname'] ?? '', $selectedUsers, ); - unset($GLOBALS['username'], $GLOBALS['hostname']); + $export = $serverPrivileges->getExportUserDefinitionTextarea( + $serverPrivileges->username ?? '', + $GLOBALS['hostname'] ?? '', + $selectedUsers, + ); + + $serverPrivileges->username = null; + unset($GLOBALS['hostname']); if ($request->isAjax()) { $this->response->addJSON('message', $export); @@ -369,7 +377,7 @@ final class PrivilegesController implements InvocableController ); } - if (! isset($GLOBALS['username'])) { + if ($serverPrivileges->username === null) { // No username is given --> display the overview $this->response->addHTML($serverPrivileges->getHtmlForUserOverview( $userPrivileges, @@ -378,7 +386,7 @@ final class PrivilegesController implements InvocableController } elseif (! empty($routinename)) { $this->response->addHTML( $serverPrivileges->getHtmlForRoutineSpecificPrivileges( - $GLOBALS['username'], + $serverPrivileges->username, $GLOBALS['hostname'] ?? '', is_string($databaseName) ? $databaseName : '', $routinename, @@ -396,7 +404,7 @@ final class PrivilegesController implements InvocableController $serverPrivileges->getHtmlForUserProperties( $dbnameIsWildcard, $serverPrivileges->escapeGrantWildcards($urlDbname ?? ''), - $GLOBALS['username'], + $serverPrivileges->username, $GLOBALS['hostname'] ?? '', $databaseName ?? '', $tablename ?? '', diff --git a/src/Controllers/UserPasswordController.php b/src/Controllers/UserPasswordController.php index b5d73bc4b8..4dfb6ff9b0 100644 --- a/src/Controllers/UserPasswordController.php +++ b/src/Controllers/UserPasswordController.php @@ -31,7 +31,6 @@ final class UserPasswordController implements InvocableController public function __invoke(ServerRequest $request): Response { $GLOBALS['hostname'] ??= null; - $GLOBALS['username'] ??= null; $this->response->addScriptFiles(['server/privileges.js', 'vendor/zxcvbn-ts.js']); @@ -105,7 +104,7 @@ final class UserPasswordController implements InvocableController } $this->response->addHTML($this->userPassword->getFormForChangePassword( - $GLOBALS['username'], + '', $GLOBALS['hostname'], $request->getRoute(), )); diff --git a/src/Server/Privileges.php b/src/Server/Privileges.php index e157c69cf2..530114fd16 100644 --- a/src/Server/Privileges.php +++ b/src/Server/Privileges.php @@ -70,6 +70,7 @@ use function uksort; */ class Privileges { + public string|null $username = null; private string|null $sslType = null; private string|null $sslCipher = null; private string|null $x509Issuer = null; @@ -470,8 +471,8 @@ class Privileges $username = ''; $hostname = ''; $row = []; - if (isset($GLOBALS['username'])) { - $username = $GLOBALS['username']; + if ($this->username !== null) { + $username = $this->username; $hostname = $GLOBALS['hostname']; $sqlQuery = $this->getSqlQueryForDisplayPrivTable($db, $table, $username, $hostname); $row = $this->dbi->fetchSingleRow($sqlQuery); @@ -595,13 +596,12 @@ class Privileges ): string { $GLOBALS['pred_username'] ??= null; $GLOBALS['pred_hostname'] ??= null; - $GLOBALS['username'] ??= null; $GLOBALS['hostname'] ??= null; $GLOBALS['new_username'] ??= null; [$usernameLength, $hostnameLength] = $this->getUsernameAndHostnameLength(); - if (isset($GLOBALS['username']) && $GLOBALS['username'] === '') { + if ($this->username !== null && $this->username === '') { $GLOBALS['pred_username'] = 'any'; } @@ -649,7 +649,7 @@ class Privileges 'pred_hostname' => $GLOBALS['pred_hostname'] ?? null, 'username_length' => $usernameLength, 'hostname_length' => $hostnameLength, - 'username' => $GLOBALS['username'] ?? null, + 'username' => $this->username, 'new_username' => $GLOBALS['new_username'] ?? null, 'hostname' => $GLOBALS['hostname'] ?? null, 'this_host' => $thisHost, @@ -2295,7 +2295,7 @@ class Privileges isset($_POST['createdb-3']), ); if (! empty($_POST['userGroup']) && $isMenuwork) { - $this->setUserGroup($GLOBALS['username'], $_POST['userGroup']); + $this->setUserGroup($this->username ?? '', $_POST['userGroup']); } return [ diff --git a/tests/unit/Server/PrivilegesTest.php b/tests/unit/Server/PrivilegesTest.php index 5ac3996cf1..7b59b5bbeb 100644 --- a/tests/unit/Server/PrivilegesTest.php +++ b/tests/unit/Server/PrivilegesTest.php @@ -315,7 +315,6 @@ class PrivilegesTest extends AbstractTestCase public function testAddUser(): void { Config::getInstance()->selectedServer['DisableIS'] = false; - $GLOBALS['username'] = 'pma_username'; $dummyDbi = $this->createDbiDummy(); $dummyDbi->addResult('SELECT \'1\' FROM `mysql`.`user` WHERE `User` = \'\' AND `Host` = \'localhost\';', []); @@ -333,6 +332,7 @@ class PrivilegesTest extends AbstractTestCase $serverPrivileges = $this->getPrivileges($dbi); + $serverPrivileges->username = 'pma_username'; $dbname = 'pma_dbname'; $username = 'pma_username'; $hostname = 'localhost'; @@ -380,7 +380,7 @@ class PrivilegesTest extends AbstractTestCase $serverPrivileges = $this->getPrivileges($dbi); - $GLOBALS['username'] = 'username'; + $serverPrivileges->username = 'username'; $dbname = 'pma_dbname'; $username = 'pma_username'; $hostname = 'localhost'; @@ -600,12 +600,11 @@ class PrivilegesTest extends AbstractTestCase public function testGetHtmlToDisplayPrivilegesTable(): void { $GLOBALS['hostname'] = 'hostname'; - $GLOBALS['username'] = 'username'; $dbi = $this->createDatabaseInterface(); $serverPrivileges = $this->getPrivileges($dbi); + $serverPrivileges->username = 'username'; $html = $serverPrivileges->getHtmlToDisplayPrivilegesTable(); - $GLOBALS['username'] = 'username'; //validate 2: button self::assertStringContainsString('Update user privileges', $html); @@ -877,7 +876,7 @@ class PrivilegesTest extends AbstractTestCase $dbi = $this->createDatabaseInterface(); $serverPrivileges->dbi = $dbi; - $GLOBALS['username'] = 'PMA_username'; + $serverPrivileges->username = 'PMA_username'; $GLOBALS['hostname'] = 'PMA_hostname'; $html = $serverPrivileges->getHtmlToDisplayPrivilegesTable('PMA_db', 'PMA_table'); @@ -917,7 +916,7 @@ class PrivilegesTest extends AbstractTestCase $dbi = $this->createDatabaseInterface(); $serverPrivileges = $this->getPrivileges($dbi); - $GLOBALS['username'] = 'pma_username'; + $serverPrivileges->username = 'pma_username'; $dbi = $this->getMockBuilder(DatabaseInterface::class) ->disableOriginalConstructor() @@ -1473,7 +1472,7 @@ class PrivilegesTest extends AbstractTestCase $serverPrivileges = $this->getPrivileges($this->dbi); - $GLOBALS['username'] = 'user'; + $serverPrivileges->username = 'user'; $GLOBALS['hostname'] = 'host'; $actual = $serverPrivileges->getHtmlForUserProperties(