gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Better filtering on generation of 'CREATE [ROUTINE|TRIGGER|EVENT]' queries.

Browse Source
This commit is contained in:
Rouslan Placella 2011-07-08 12:58:33 +01:00
parent ec83a934d1
commit cae5bba400
3 changed files with 77 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
libraries/rte/rte_events.lib.php
View File

@ -445,14 +445,23 @@ function PMA_EVN_getEditorForm($mode, $operation, $item)
return $retval;
}
function PMA_EVN_getQueryFromRequest() // FIXME: need better error checking here
/**
* Composes the query necessary to create an event from an HTTP request.
*
* @return string The CREATE EVENT query.
*/
function PMA_EVN_getQueryFromRequest()
{
global $_REQUEST, $cfg, $db, $errors, $event_status;
global $_REQUEST, $db, $errors, $event_status, $event_type, $event_interval;
$query = 'CREATE ';
if (! empty($_REQUEST['item_definer']) && strpos($_REQUEST['item_definer'], '@') !== false) {
$arr = explode('@', $_REQUEST['item_definer']);
$query .= 'DEFINER=' . PMA_backquote($arr[0]) . '@' . PMA_backquote($arr[1]) . ' ';
if (! empty($_REQUEST['item_definer'])) {
if (strpos($_REQUEST['item_definer'], '@') !== false) {
$arr = explode('@', $_REQUEST['item_definer']);
$query .= 'DEFINER=' . PMA_backquote($arr[0]) . '@' . PMA_backquote($arr[1]) . ' ';
} else {
$errors[] = __('The definer must be in the "username@hostname" format');
}
}
$query .= 'EVENT ';
if (! empty($_REQUEST['item_name'])) {
@ -461,17 +470,30 @@ function PMA_EVN_getQueryFromRequest() // FIXME: need better error checking here
$errors[] = __('You must provide an event name');
}
$query .= 'ON SCHEDULE ';
if ($_REQUEST['item_type'] == 'RECURRING') {
$query .= 'EVERY ' . $_REQUEST['item_interval_value'] . ' ';
$query .= $_REQUEST['item_interval_field'] . ' ';
if (! empty($_REQUEST['item_starts'])) {
$query .= "STARTS '" . $_REQUEST['item_starts'] . "' ";
}
if (! empty($_REQUEST['item_ends'])) {
$query .= "ENDS '" . $_REQUEST['item_ends'] . "' ";
if (! empty($_REQUEST['item_type']) && in_array($_REQUEST['item_type'], $event_type)) {
if ($_REQUEST['item_type'] == 'RECURRING') {
if (! empty($_REQUEST['item_interval_value'])
&& !empty($_REQUEST['item_interval_field'])
&& in_array($_REQUEST['item_interval_field'], $event_interval)) {
$query .= 'EVERY ' . intval($_REQUEST['item_interval_value']) . ' ' . $_REQUEST['item_interval_field'] . ' ';
} else {
$errors[] = __('You must provide a valid interval value for the event.');
}
if (! empty($_REQUEST['item_starts'])) {
$query .= "STARTS '" . PMA_sqlAddSlashes($_REQUEST['item_starts']) . "' ";
}
if (! empty($_REQUEST['item_ends'])) {
$query .= "ENDS '" . PMA_sqlAddSlashes($_REQUEST['item_ends']) . "' ";
}
} else {
if (! empty($_REQUEST['item_execute_at'])) {
$query .= "AT '" . PMA_sqlAddSlashes($_REQUEST['item_execute_at']) . "' ";
} else {
$errors[] = __('You must provide a valid execution time for the event.');
}
}
} else {
$query .= "AT '" . $_REQUEST['item_execute_at'] . "' ";
$errors[] = __('You must provide a valid type for the event.');
}
$query .= 'ON COMPLETION ';
if (empty($_REQUEST['item_preserve'])) {
@ -492,7 +514,8 @@ function PMA_EVN_getQueryFromRequest() // FIXME: need better error checking here
} else {
$errors[] = __('You must provide an event definition.');
}
return $query;
}
} // end PMA_EVN_getQueryFromRequest()
?>

33
libraries/rte/rte_routines.lib.php
View File

@ -492,7 +492,6 @@ function PMA_RTN_handleEditor()
* and 'Change routine type' functionalities when JS is disabled.
*
* @return array Data necessary to create the routine editor.
*
*/
function PMA_RTN_getRoutineDataFromRequest()
{
@ -649,16 +648,19 @@ function PMA_RTN_getRoutineDataFromRequest()
/**
* Composes the query necessary to create a routine from an HTTP request.
*
* @return string The CREATE [ROUTINE | PROCEDURE] query.
*
* @return string The CREATE [ROUTINE | PROCEDURE] query.
*/
function PMA_RTN_getQueryFromRequest() {
global $_REQUEST, $cfg, $errors, $param_sqldataaccess;
global $_REQUEST, $cfg, $errors, $param_sqldataaccess, $param_opts_num;
$query = 'CREATE ';
if (! empty($_REQUEST['routine_definer']) && strpos($_REQUEST['routine_definer'], '@') !== false) {
$arr = explode('@', $_REQUEST['routine_definer']);
$query .= 'DEFINER=' . PMA_backquote($arr[0]) . '@' . PMA_backquote($arr[1]) . ' ';
if (! empty($_REQUEST['routine_definer'])) {
if (strpos($_REQUEST['routine_definer'], '@') !== false) {
$arr = explode('@', $_REQUEST['routine_definer']);
$query .= 'DEFINER=' . PMA_backquote($arr[0]) . '@' . PMA_backquote($arr[1]) . ' ';
} else {
$errors[] = __('The definer must be in the "username@hostname" format');
}
}
if ($_REQUEST['routine_type'] == 'FUNCTION' || $_REQUEST['routine_type'] == 'PROCEDURE') {
$query .= $_REQUEST['routine_type'] . ' ';
@ -713,7 +715,7 @@ function PMA_RTN_getQueryFromRequest() {
if (! empty($_REQUEST['routine_param_opts_num'][$i])) {
if (isset($cfg['RestrictColumnTypes'][strtoupper($_REQUEST['routine_param_type'][$i])])) {
$group = $cfg['RestrictColumnTypes'][strtoupper($_REQUEST['routine_param_type'][$i])];
if ($group == 'FUNC_NUMBER') {
if ($group == 'FUNC_NUMBER' && in_array($_REQUEST['routine_param_opts_num'][$i], $param_opts_num)) {
$params .= ' ' . strtoupper($_REQUEST['routine_param_opts_num'][$i]);
}
}
@ -730,11 +732,15 @@ function PMA_RTN_getQueryFromRequest() {
}
$query .= " (" . $params . ") ";
if ($_REQUEST['routine_type'] == 'FUNCTION') {
$query .= "RETURNS {$_REQUEST['routine_returntype']}";
if (! empty($_REQUEST['routine_returntype']) && in_array($_REQUEST['routine_returntype'], $cfg['Functions'])) {
$query .= "RETURNS {$_REQUEST['routine_returntype']}";
} else {
$errors[] = __('You must provide a valid return type for the routine.');
}
if (! empty($_REQUEST['routine_returnlength'])
&& !preg_match('@^(DATE|DATETIME|TIME|TINYBLOB|TINYTEXT|BLOB|TEXT|MEDIUMBLOB|MEDIUMTEXT|LONGBLOB|LONGTEXT)$@i',
$_REQUEST['routine_returntype'])) {
$query .= "(" . $_REQUEST['routine_returnlength'] . ")";
$query .= "(" . intval($_REQUEST['routine_returnlength']) . ")";
} else if (empty($_REQUEST['routine_returnlength'])
&& preg_match('@^(ENUM|SET|VARCHAR|VARBINARY)$@i', $_REQUEST['routine_returntype'])) {
if (! $warned_about_length) {
@ -754,7 +760,7 @@ function PMA_RTN_getQueryFromRequest() {
if (! empty($_REQUEST['routine_returnopts_num'])) {
if (isset($cfg['RestrictColumnTypes'][strtoupper($_REQUEST['routine_returntype'])])) {
$group = $cfg['RestrictColumnTypes'][strtoupper($_REQUEST['routine_returntype'])];
if ($group == 'FUNC_NUMBER') {
if ($group == 'FUNC_NUMBER' && in_array($_REQUEST['routine_returnopts_num'], $param_opts_num)) {
$query .= ' ' . strtoupper($_REQUEST['routine_returnopts_num']);
}
}
@ -762,14 +768,14 @@ function PMA_RTN_getQueryFromRequest() {
$query .= ' ';
}
if (! empty($_REQUEST['routine_comment'])) {
$query .= "COMMENT '{$_REQUEST['routine_comment']}' ";
$query .= "COMMENT '" . PMA_sqlAddslashes($_REQUEST['routine_comment']) . "' ";
}
if (isset($_REQUEST['routine_isdeterministic'])) {
$query .= 'DETERMINISTIC ';
} else {
$query .= 'NOT DETERMINISTIC ';
}
if (! empty($_REQUEST['routine_sqldataaccess']) && in_array($_REQUEST['routine_sqldataaccess'], $param_sqldataaccess, true)) {
if (! empty($_REQUEST['routine_sqldataaccess']) && in_array($_REQUEST['routine_sqldataaccess'], $param_sqldataaccess)) {
$query .= $_REQUEST['routine_sqldataaccess'] . ' ';
}
if (! empty($_REQUEST['routine_securitytype'])) {
@ -782,6 +788,7 @@ function PMA_RTN_getQueryFromRequest() {
} else {
$errors[] = __('You must provide a routine definition.');
}
return $query;
} // end PMA_RTN_getQueryFromRequest()

27
libraries/rte/rte_triggers.lib.php
View File

@ -332,13 +332,23 @@ function PMA_TRI_getEditorForm($mode, $item)
return $retval;
}
function PMA_TRI_getQueryFromRequest() {
global $_REQUEST, $cfg, $db, $errors, $action_timings, $event_manipulations;
/**
* Composes the query necessary to create a trigger from an HTTP request.
*
* @return string The CREATE TRIGGER query.
*/
function PMA_TRI_getQueryFromRequest()
{
global $_REQUEST, $db, $errors, $action_timings, $event_manipulations;
$query = 'CREATE ';
if (! empty($_REQUEST['item_definer']) && strpos($_REQUEST['item_definer'], '@') !== false) {
$arr = explode('@', $_REQUEST['item_definer']);
$query .= 'DEFINER=' . PMA_backquote($arr[0]) . '@' . PMA_backquote($arr[1]) . ' ';
if (! empty($_REQUEST['item_definer'])) {
if (strpos($_REQUEST['item_definer'], '@') !== false) {
$arr = explode('@', $_REQUEST['item_definer']);
$query .= 'DEFINER=' . PMA_backquote($arr[0]) . '@' . PMA_backquote($arr[1]) . ' ';
} else {
$errors[] = __('The definer must be in the "username@hostname" format');
}
}
$query .= 'TRIGGER ';
if (! empty($_REQUEST['item_name'])) {
@ -349,12 +359,12 @@ function PMA_TRI_getQueryFromRequest() {
if (! empty($_REQUEST['item_timing']) && in_array($_REQUEST['item_timing'], $action_timings)) {
$query .= $_REQUEST['item_timing'] . ' ';
} else {
$query .= 'BEFORE ';
$errors[] = __('You must provide a valid timing for the trigger');
}
if (! empty($_REQUEST['item_event']) && in_array($_REQUEST['item_event'], $event_manipulations)) {
$query .= $_REQUEST['item_event'] . ' ';
} else {
$query .= 'INSERT ';
$errors[] = __('You must provide a valid event for the trigger');
}
$query .= 'ON ';
if (! empty($_REQUEST['item_table']) && in_array($_REQUEST['item_table'], PMA_DBI_get_tables($db))) {
@ -368,7 +378,8 @@ function PMA_TRI_getQueryFromRequest() {
} else {
$errors[] = __('You must provide a trigger definition.');
}
return $query;
}
} // end PMA_TRI_getQueryFromRequest()
?>