Merge pull request #12696 from devenbansod/fix_12299

Fix #12299: Change to POST request to avoid possibly very long URIs

js/db_search.js

@@ -19,6 +19,8 @@
  * Unbind all event handlers before tearing down a page
  */
 AJAX.registerTeardown('db_search.js', function () {
+    $('a.browse_results').unbind('click');
+    $('a.delete_results').unbind('click');
     $('#buttonGo').unbind('click');
     $('#togglesearchresultlink').unbind('click');
     $("#togglequerybox").unbind('click');
@@ -26,91 +28,6 @@ AJAX.registerTeardown('db_search.js', function () {
     $(document).off('submit', "#db_search_form.ajax");
 });
 
-/**
- * Loads the database search results
- *
- * @param result_path Url of the page to load
- * @param table_name  Name of table to browse
- *
- * @return nothing
- */
-function loadResult(result_path, table_name, link)
-{
-    $(function () {
-        /**   Hides the results shown by the delete criteria */
-        var $msg = PMA_ajaxShowMessage(PMA_messages.strBrowsing, false);
-        $('#sqlqueryform').hide();
-        $('#togglequerybox').hide();
-        /**  Load the browse results to the page */
-        $("#table-info").show();
-        $('#table-link').attr({"href" : 'sql.php' + link }).text(table_name);
-        var url = result_path + "#searchresults";
-        $.get(url, {'ajax_request': true, 'is_js_confirmed': true}, function (data) {
-            if (typeof data !== 'undefined' && data.success) {
-                $('#browse-results').html(data.message);
-                PMA_ajaxRemoveMessage($msg);
-                $('.table_results').each(function () {
-                    PMA_makegrid(this, true, true, true, true);
-                });
-                $('#browse-results').show();
-                PMA_highlightSQL($('#browse-results'));
-                $('html, body')
-                    .animate({
-                        scrollTop: $("#browse-results").offset().top
-                    }, 1000);
-            } else {
-                PMA_ajaxShowMessage(data.error, false);
-            }
-        });
-    });
-}
-
-/**
- *  Delete the selected search results
- *
- * @param result_path Url of the page to load
- * @param msg         Text for the confirmation dialog
- *
- * @return nothing
- */
-function deleteResult(result_path, msg)
-{
-    $(function () {
-        /**  Hides the results shown by the browse criteria */
-        $("#table-info").hide();
-        $('#sqlqueryform').hide();
-        $('#togglequerybox').hide();
-        /** Conformation message for deletion */
-        if (confirm(msg)) {
-            var $msg = PMA_ajaxShowMessage(PMA_messages.strDeleting, false);
-            /** Load the deleted option to the page*/
-            $('#sqlqueryform').html('');
-            $.post(result_path, {'ajax_request': true, 'is_js_confirmed': true},
-                function (data) {
-                    if (typeof data === 'undefined' || !data.success) {
-                        PMA_ajaxShowMessage(data.error, false);
-                        return;
-                    }
-
-                    $('#sqlqueryform').html(data.sql_query);
-                    /** Refresh the search results after the deletion */
-                    document.getElementById('buttonGo').click();
-                    $('#togglequerybox').html(PMA_messages.strHideQueryBox);
-                    /** Show the results of the deletion option */
-                    $('#browse-results').hide();
-                    $('#sqlqueryform').show();
-                    $('#togglequerybox').show();
-                    $('html, body')
-                        .animate({
-                            scrollTop: $("#browse-results").offset().top
-                        }, 1000);
-                    PMA_ajaxRemoveMessage($msg);
-                }
-            );
-        }
-    });
-}
-
 AJAX.registerOnload('db_search.js', function () {
     /** Hide the table link in the initial search result */
     var icon = PMA_getImage('s_tbl.png', '', {'id': 'table-image'}).toString();
@@ -192,6 +109,95 @@ AJAX.registerOnload('db_search.js', function () {
             /** avoid default click action */
             return false;
         });
+
+    /*
+     * Ajax Event handler for retrieving the results from a table
+     */
+    $(document).on('click', 'a.browse_results', function(e){
+        e.preventDefault();
+        /**   Hides the results shown by the delete criteria */
+        var $msg = PMA_ajaxShowMessage(PMA_messages.strBrowsing, false);
+        $('#sqlqueryform').hide();
+        $('#togglequerybox').hide();
+        /**  Load the browse results to the page */
+        $("#table-info").show();
+        var table_name = $(this).data('table-name');
+        $('#table-link').attr({"href" : $(this).attr('href')}).text(table_name);
+
+        var url = $(this).attr('href') + "#searchresults";
+        var browse_sql = $(this).data('browse-sql');
+        var params = {
+            'ajax_request': true,
+            'is_js_confirmed': true,
+            'sql_query' : browse_sql
+        };
+        $.post(url, params, function (data) {
+            if (typeof data !== 'undefined' && data.success) {
+                $('#browse-results').html(data.message);
+                PMA_ajaxRemoveMessage($msg);
+                $('.table_results').each(function () {
+                    PMA_makegrid(this, true, true, true, true);
+                });
+                $('#browse-results').show();
+                PMA_highlightSQL($('#browse-results'));
+                $('html, body')
+                    .animate({
+                        scrollTop: $("#browse-results").offset().top
+                    }, 1000);
+            } else {
+                PMA_ajaxShowMessage(data.error, false);
+            }
+        });
+    });
+
+    /*
+     * Ajax Event handler for deleting the results from a table
+     */
+    $(document).on('click', 'a.delete_results', function(e){
+        e.preventDefault();
+        /**  Hides the results shown by the browse criteria */
+        $("#table-info").hide();
+        $('#sqlqueryform').hide();
+        $('#togglequerybox').hide();
+        /** Conformation message for deletion */
+        var msg = PMA_sprintf(
+            PMA_messages.strConfirmDeleteResults,
+            $(this).data('table-name')
+        );
+        if (confirm(msg)) {
+            var $msg = PMA_ajaxShowMessage(PMA_messages.strDeleting, false);
+            /** Load the deleted option to the page*/
+            $('#sqlqueryform').html('');
+            var params = {
+                'ajax_request': true,
+                'is_js_confirmed': true,
+                'sql_query': $(this).data('delete-sql')
+            };
+            var url = $(this).attr('href');
+
+            $.post(url, params, function (data) {
+                if (typeof data === 'undefined' || !data.success) {
+                    PMA_ajaxShowMessage(data.error, false);
+                    return;
+                }
+
+                $('#sqlqueryform').html(data.sql_query);
+                /** Refresh the search results after the deletion */
+                document.getElementById('buttonGo').click();
+                $('#togglequerybox').html(PMA_messages.strHideQueryBox);
+                /** Show the results of the deletion option */
+                $('#browse-results').hide();
+                $('#sqlqueryform').show();
+                $('#togglequerybox').show();
+                $('html, body')
+                    .animate({
+                        scrollTop: $("#browse-results").offset().top
+                    }, 1000);
+                PMA_ajaxRemoveMessage($msg);
+            });
+        }
+    });
+
     /**
      * Ajax Event handler for retrieving the result of an SQL Query
      */

js/messages.php

@@ -380,6 +380,7 @@ $js_messages['strHideSearchResults'] = __('Hide search results');
 $js_messages['strShowSearchResults'] = __('Show search results');
 $js_messages['strBrowsing'] = __('Browsing');
 $js_messages['strDeleting'] = __('Deleting');
+$js_messages['strConfirmDeleteResults'] = __('Delete the matches for the %s table?');
 
 /* For db_routines.js */
 $js_messages['MissingReturn']

libraries/DbSearch.php

@@ -334,30 +334,23 @@ class DbSearch
         $html_output .= '</td>';
         // Displays browse/delete link if result count > 0
         if ($res_cnt > 0) {
-            $this_url_params['sql_query'] = $newsearchsqls['select_columns'];
+            $this_url_params['db'] = htmlspecialchars($GLOBALS['db']);
+            $this_url_params['table'] = htmlspecialchars($each_table);
             $browse_result_path = 'sql.php' . PMA_URL_getCommon($this_url_params);
-            $html_output .= '<td><a name="browse_search" class="ajax" href="'
-                . $browse_result_path . '" onclick="loadResult(\''
-                . $browse_result_path . '\',\''
-                . PMA_escapeJsString(htmlspecialchars($each_table)) . '\',\''
-                . PMA_URL_getCommon(
-                    array(
-                        'db' => $GLOBALS['db'], 'table' => $each_table
-                    )
-                ) . '\''
-                . ');return false;" >'
+            $html_output .= '<td><a name="browse_search" '
+                . ' class="ajax browse_results" href="'
+                . $browse_result_path . '" '
+                . 'data-browse-sql="'
+                . htmlspecialchars($newsearchsqls['select_columns']). '" '
+                . 'data-table-name="' . htmlspecialchars($each_table) . '" >'
                 . __('Browse') . '</a></td>';
-            $this_url_params['sql_query'] = $newsearchsqls['delete'];
-            $delete_result_path = 'sql.php' . PMA_URL_getCommon($this_url_params);
-            $html_output .= '<td><a name="delete_search" class="ajax" href="'
-                . $delete_result_path . '" onclick="deleteResult(\''
-                . $delete_result_path . '\' , \''
-                . PMA_escapeJsString(sprintf(
-                    __('Delete the matches for the %s table?'),
-                    htmlspecialchars($each_table)
-                ))
-                . '\');return false;">'
-                . __('Delete') . '</a></td>';
+
+            $delete_result_path = $browse_result_path;
+            $html_output .= '<td><a name="delete_search" class="ajax delete_results"'
+                . ' href="' . $delete_result_path . '"'
+                . ' data-delete-sql="' . htmlspecialchars($newsearchsqls['delete'])
+                . ' data-table-name="' . htmlspecialchars($each_table) . '"'
+                . '" >' . __('Delete') . '</a></td>';
         } else {
             $html_output .= '<td>&nbsp;</td>'
                 . '<td>&nbsp;</td>';

test/classes/DbSearchTest.php

@@ -41,6 +41,7 @@ class DbSearchTest extends PMATestCase
         $this->object = new DbSearch('pma_test');
         $GLOBALS['server'] = 0;
         $GLOBALS['db'] = 'pma';
+        $GLOBALS['collation_connection'] = 'utf-8';
 
         //mock DBI
         $dbi = $this->getMockBuilder('PMA\libraries\DatabaseInterface')
@@ -166,28 +167,19 @@ class DbSearchTest extends PMATestCase
                 ),
                 true,
                 '<tr class="noclick odd"><td>2 matches in <strong>table1</strong>'
-                . '</td><td><a name="browse_search" class="ajax" '
+                . '</td><td><a name="browse_search"  class="ajax browse_results" '
                 . 'href="sql.php?db=pma&amp;table'
                 . '=table1&amp;goto=db_sql.php&amp;pos=0&amp;is_js_confirmed=0&amp;'
-                . 'sql_query=column1&amp;server=0&amp;lang=en&amp;'
+                . 'server=0&amp;lang=en&amp;'
                 . 'collation_connection=utf-8&amp;token=token" '
-                . 'onclick="loadResult(\'sql.php?db=pma&amp;table=table1&amp;goto='
-                . 'db_sql.php&amp;pos=0&amp;is_js_confirmed=0&amp;sql_query=column1'
-                . '&amp;server=0&amp;lang=en&amp;collation_connection=utf-8'
-                . '&amp;token=token\',\'table1\',\'?db=pma'
-                . '&amp;table=table1&amp;server=0&amp;lang=en'
-                . '&amp;collation_connection=utf-8&amp;token=token\');'
-                . 'return false;" >Browse</a></td><td>'
-                . '<a name="delete_search" class="ajax" href'
+                . 'browse_sql="column1" table_name="table1" '
+                . '>Browse</a></td><td>'
+                . '<a name="delete_search" class="ajax delete_results" href'
                 . '="sql.php?db=pma&amp;table=table1&amp;goto=db_sql.php&amp;pos=0'
-                . '&amp;is_js_confirmed=0&amp;sql_query=column2&amp;server=0&amp;'
-                . 'lang=en&amp;collation_connection=utf-8&amp;token=token"'
-                . ' onclick="deleteResult(\'sql.php?db=pma'
-                . '&amp;table=table1&amp;goto=db_sql.php&amp;pos=0&amp;is_js_'
-                . 'confirmed=0&amp;sql_query=column2&amp;server=0&amp;lang=en'
-                . '&amp;collation_connection=utf-8&amp;'
-                . 'token=token\' , \'Delete the matches for the table1 table?\');'
-                . 'return false;">Delete</a></td></tr>'
+                . '&amp;is_js_confirmed=0&amp;server=0&amp;'
+                . 'lang=en&amp;collation_connection=utf-8&amp;token=token" '
+                . 'table_name="table1" delete_sql="column2" '
+                . '>Delete</a></td></tr>'
             )
         );
     }