diff --git a/libraries/classes/Controllers/Server/Databases/DestroyController.php b/libraries/classes/Controllers/Server/Databases/DestroyController.php index 915f560031..fdcfb09d4e 100644 --- a/libraries/classes/Controllers/Server/Databases/DestroyController.php +++ b/libraries/classes/Controllers/Server/Databases/DestroyController.php @@ -8,6 +8,7 @@ use PhpMyAdmin\ConfigStorage\RelationCleanup; use PhpMyAdmin\Controllers\AbstractController; use PhpMyAdmin\DatabaseInterface; use PhpMyAdmin\Message; +use PhpMyAdmin\Query\Utilities; use PhpMyAdmin\ResponseRenderer; use PhpMyAdmin\Template; use PhpMyAdmin\Transformations; @@ -16,8 +17,10 @@ use PhpMyAdmin\Util; use function __; use function _ngettext; +use function array_filter; use function count; use function is_array; +use function is_string; final class DestroyController extends AbstractController { @@ -47,8 +50,6 @@ final class DestroyController extends AbstractController { global $selected, $errorUrl, $cfg, $dblist, $reload; - $selected_dbs = $_POST['selected_dbs'] ?? null; - if ( ! $this->response->isAjax() || (! $this->dbi->isSuperUser() && ! $cfg['AllowUserDropDatabase']) @@ -61,10 +62,14 @@ final class DestroyController extends AbstractController return; } - if ( - ! is_array($selected_dbs) - || $selected_dbs === [] - ) { + $selected_dbs = isset($_POST['selected_dbs']) && is_array($_POST['selected_dbs']) ? $_POST['selected_dbs'] : []; + $selected_dbs = array_filter($selected_dbs, static function ($database): bool { + return is_string($database) + && ! Utilities::isSystemSchema($database, true) + && $database !== ($GLOBALS['cfg']['Server']['pmadb'] ?? ''); + }); + + if ($selected_dbs === []) { $message = Message::error(__('No databases selected.')); $json = ['message' => $message]; $this->response->setRequestStatus($message->isSuccess()); diff --git a/phpstan-baseline.neon b/phpstan-baseline.neon index 39b56168c3..48241d6457 100644 --- a/phpstan-baseline.neon +++ b/phpstan-baseline.neon @@ -7280,6 +7280,16 @@ parameters: count: 1 path: libraries/classes/Controllers/Server/Databases/DestroyController.php + - + message: "#^Cannot access offset 'Server' on mixed\\.$#" + count: 1 + path: libraries/classes/Controllers/Server/Databases/DestroyController.php + + - + message: "#^Cannot access offset 'pmadb' on mixed\\.$#" + count: 1 + path: libraries/classes/Controllers/Server/Databases/DestroyController.php + - message: "#^Cannot access property \\$databases on mixed\\.$#" count: 1 @@ -7290,21 +7300,6 @@ parameters: count: 1 path: libraries/classes/Controllers/Server/Databases/DestroyController.php - - - message: "#^Parameter \\#1 \\$db of method PhpMyAdmin\\\\ConfigStorage\\\\RelationCleanup\\:\\:database\\(\\) expects string, mixed given\\.$#" - count: 1 - path: libraries/classes/Controllers/Server/Databases/DestroyController.php - - - - message: "#^Parameter \\#1 \\$db of method PhpMyAdmin\\\\Transformations\\:\\:clear\\(\\) expects string, mixed given\\.$#" - count: 1 - path: libraries/classes/Controllers/Server/Databases/DestroyController.php - - - - message: "#^Parameter \\#1 \\$identifier of static method PhpMyAdmin\\\\Util\\:\\:backquote\\(\\) expects string\\|Stringable\\|null, mixed given\\.$#" - count: 1 - path: libraries/classes/Controllers/Server/Databases/DestroyController.php - - message: "#^Call to function array_search\\(\\) requires parameter \\#3 to be set\\.$#" count: 4 diff --git a/psalm-baseline.xml b/psalm-baseline.xml index 100c449229..b595711bda 100644 --- a/psalm-baseline.xml +++ b/psalm-baseline.xml @@ -2455,18 +2455,6 @@ $dblist->databases - - $database - $database - $database - - - $database - $database - - - $selected_dbs === [] -