gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/master'

Browse Source
This commit is contained in:
Weblate 2013-06-13 18:22:49 +02:00
commit ebb640350c
3 changed files with 47 additions and 164 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
libraries/bookmark.lib.php
View File

@ -138,8 +138,8 @@ function PMA_Bookmark_get($db, $id, $id_field = 'id', $action_bookmark_all = fal
/**
* Adds a bookmark
*
* @param array $fields the properties of the bookmark to add; here,
* $fields['query'] is urlencoded
* @param array $bkm_fields the properties of the bookmark to add; here,
* $bkm_fields['bkm_sql_query'] is urlencoded
* @param boolean $all_users whether to make the bookmark available for all users
*
* @return boolean whether the INSERT succeeds or not
@ -148,7 +148,7 @@ function PMA_Bookmark_get($db, $id, $id_field = 'id', $action_bookmark_all = fal
*
* @global resource the controluser db connection handle
*/
function PMA_Bookmark_save($fields, $all_users = false)
function PMA_Bookmark_save($bkm_fields, $all_users = false)
{
global $controllink;
@ -161,10 +161,10 @@ function PMA_Bookmark_save($fields, $all_users = false)
$query = 'INSERT INTO ' . PMA_Util::backquote($cfgBookmark['db'])
. '.' . PMA_Util::backquote($cfgBookmark['table'])
. ' (id, dbase, user, query, label)'
. ' VALUES (NULL, \'' . PMA_Util::sqlAddSlashes($fields['dbase']) . '\', '
. '\'' . ($all_users ? '' : PMA_Util::sqlAddSlashes($fields['user'])) . '\', '
. '\'' . PMA_Util::sqlAddSlashes(urldecode($fields['query'])) . '\', '
. '\'' . PMA_Util::sqlAddSlashes($fields['label']) . '\')';
. ' VALUES (NULL, \'' . PMA_Util::sqlAddSlashes($bkm_fields['bkm_database']) . '\', '
. '\'' . ($all_users ? '' : PMA_Util::sqlAddSlashes($bkm_fields['bkm_user'])) . '\', '
. '\'' . PMA_Util::sqlAddSlashes(urldecode($bkm_fields['bkm_sql_query'])) . '\', '
. '\'' . PMA_Util::sqlAddSlashes($bkm_fields['bkm_label']) . '\')';
return $GLOBALS['dbi']->query($query, $controllink);
} // end of the 'PMA_Bookmark_save()' function

14
libraries/sqlparser.lib.php
View File

@ -2913,4 +2913,18 @@ function PMA_SQP_isKeyWord($column)
return in_array(strtoupper($column), $PMA_SQPdata_forbidden_word);
}
/**
* Checks whether a given query is to drop a database
*
* @param string $sql_query The SQL query to be checked for drop database
*
* @return boolean whether true or false
*/
function PMA_isDropDatabase($sql_query)
{
return preg_match(
'/DROP[[:space:]]+(DATABASE|SCHEMA)[[:space:]]+/i',
$sql_query
);
}
?>

183
sql.php
View File

@ -17,6 +17,7 @@ require_once 'libraries/Header.class.php';
require_once 'libraries/check_user_privileges.lib.php';
require_once 'libraries/bookmark.lib.php';
require_once 'libraries/sql.lib.php';
require_once 'libraries/sqlparser.lib.php';
$response = PMA_Response::getInstance();
$header = $response->getHeader();
@ -35,42 +36,6 @@ if (isset($ajax_reload) && $ajax_reload['reload'] === true) {
$response->addJSON('ajax_reload', $ajax_reload);
}
/**
* Sets globals from $_POST
*/
$post_params = array(
'bkm_all_users',
'fields',
'store_bkm'
);
foreach ($post_params as $one_post_param) {
if (isset($_POST[$one_post_param])) {
$GLOBALS[$one_post_param] = $_POST[$one_post_param];
}
}
/**
* Sets globals from $_GET
*/
$get_params = array(
'id_bookmark',
'label',
'sql_query'
);
foreach ($get_params as $one_get_param) {
if (isset($_GET[$one_get_param])) {
$GLOBALS[$one_get_param] = $_GET[$one_get_param];
}
}
if (isset($_REQUEST['printview'])) {
$GLOBALS['printview'] = $_REQUEST['printview'];
}
if (!isset($_SESSION['is_multi_query'])) {
$_SESSION['is_multi_query'] = false;
}
/**
* Defines the url to return to in case of error in a sql statement
@ -102,13 +67,15 @@ if (! isset($err_url)) {
} // end if
// Coming from a bookmark dialog
if (isset($fields['query'])) {
$sql_query = $fields['query'];
if (isset($_POST['bkm_fields']['bkm_sql_query'])) {
$sql_query = $_POST['bkm_fields']['bkm_sql_query'];
} elseif (isset($_GET['sql_query'])) {
$sql_query = $_GET['sql_query'];
}
// This one is just to fill $db
if (isset($fields['dbase'])) {
$db = $fields['dbase'];
if (isset($_POST['bkm_fields']['bkm_database'])) {
$db = $_POST['bkm_fields']['bkm_database'];
}
@ -232,12 +199,6 @@ if (empty($sql_query) && strlen($table) && strlen($db)) {
PMA_Util::checkParameters(array('sql_query'));
}
// instead of doing the test twice
$is_drop_database = preg_match(
'/DROP[[:space:]]+(DATABASE|SCHEMA)[[:space:]]+/i',
$sql_query
);
/**
* Check rights in case of DROP DATABASE
*
@ -247,7 +208,7 @@ $is_drop_database = preg_match(
*/
if (! defined('PMA_CHK_DROP')
&& ! $cfg['AllowUserDropDatabase']
&& $is_drop_database
&& PMA_isDropDatabase($sql_query)
&& ! $is_superuser
) {
PMA_Util::mysqlDie(
@ -283,16 +244,16 @@ if (isset($find_real_end) && $find_real_end) {
/**
* Bookmark add
*/
if (isset($store_bkm)) {
if (isset($_POST['store_bkm'])) {
$result = PMA_Bookmark_save(
$fields,
(isset($bkm_all_users) && $bkm_all_users == 'true' ? true : false)
$_POST['bkm_fields'],
(isset($_POST['bkm_all_users']) && $_POST['bkm_all_users'] == 'true' ? true : false)
);
$response = PMA_Response::getInstance();
if ($response->isAjax()) {
if ($result) {
$msg = PMA_message::success(__('Bookmark %s created'));
$msg->addParam($fields['label']);
$msg->addParam($_POST['bkm_fields']['bkm_label']);
$response->addJSON('message', $msg);
} else {
$msg = PMA_message::error(__('Bookmark not created'));
@ -303,7 +264,7 @@ if (isset($store_bkm)) {
} else {
// go back to sql.php to redisplay query; do not use & in this case:
PMA_sendHeaderLocation(
$cfg['PmaAbsoluteUri'] . $goto . '&label=' . $fields['label']
$cfg['PmaAbsoluteUri'] . $goto . '&label=' . $_POST['bkm_fields']['bkm_label']
);
}
} // end if
@ -344,98 +305,6 @@ if (isset($_REQUEST['btnDrop']) && $_REQUEST['btnDrop'] == __('No')) {
exit();
} // end if
/**
* Displays the confirm page if required
*
* This part of the script is bypassed if $is_js_confirmed = 1 (already checked
* with js) because possible security issue is not so important here: at most,
* the confirm message isn't displayed.
*
* Also bypassed if only showing php code.or validating a SQL query
*/
// if we are coming from a "Create PHP code" or a "Without PHP Code"
// dialog, we won't execute the query anyway, so don't confirm
if (! $cfg['Confirm']
|| isset($_REQUEST['is_js_confirmed'])
|| isset($_REQUEST['btnDrop'])
|| isset($GLOBALS['show_as_php'])
|| ! empty($GLOBALS['validatequery'])
) {
$do_confirm = false;
} else {
$do_confirm = isset($analyzed_sql[0]['queryflags']['need_confirm']);
}
if ($do_confirm) {
$stripped_sql_query = $sql_query;
$input = '<input type="hidden" name="%s" value="%s" />';
$output = '';
if ($is_drop_database) {
$output .= '<h1 class="error">';
$output .= __('You are about to DESTROY a complete database!');
$output .= '</h1>';
}
$form = '<form class="disableAjax" action="sql.php" method="post">';
$form .= PMA_generate_common_hidden_inputs($db, $table);
$form .= sprintf(
$input, 'sql_query', htmlspecialchars($sql_query)
);
$form .= sprintf(
$input, 'message_to_show',
(isset($message_to_show) ? PMA_sanitize($message_to_show, true) : '')
);
$form .= sprintf(
$input, 'goto', $goto
);
$form .= sprintf(
$input, 'back',
(isset($back) ? PMA_sanitize($back, true) : '')
);
$form .= sprintf(
$input, 'reload',
(isset($reload) ? PMA_sanitize($reload, true) : '')
);
$form .= sprintf(
$input, 'purge',
(isset($purge) ? PMA_sanitize($purge, true) : '')
);
$form .= sprintf(
$input, 'dropped_column',
(isset($dropped_column) ? PMA_sanitize($dropped_column, true) : '')
);
$form .= sprintf(
$input, 'show_query',
(isset($message_to_show) ? PMA_sanitize($show_query, true) : '')
);
$form = str_replace('%', '%%', $form) . '%s</form>';
$output .='<fieldset class="confirmation">'
.'<legend>'
. __('Do you really want to execute the following query?')
. '</legend>'
.'<code>' . htmlspecialchars($stripped_sql_query) . '</code>'
.'</fieldset>'
.'<fieldset class="tblFooters">';
$yes_input = sprintf($input, 'btnDrop', __('Yes'));
$yes_input .= '<input type="submit" value="' . __('Yes') . '" id="buttonYes" />';
$no_input = sprintf($input, 'btnDrop', __('No'));
$no_input .= '<input type="submit" value="' . __('No') . '" id="buttonNo" />';
$output .= sprintf($form, $yes_input);
$output .= sprintf($form, $no_input);
$output .='</fieldset>';
$output .= '';
PMA_Response::getInstance()->addHTML($output);
exit;
} // end if $do_confirm
// Defines some variables
// A table has to be created, renamed, dropped -> navi frame should be reloaded
/**
@ -615,7 +484,7 @@ if (isset($GLOBALS['show_as_php']) || ! empty($GLOBALS['validatequery'])) {
}
}
PMA_Bookmark_save($bfields, isset($bkm_all_users));
PMA_Bookmark_save($bfields, isset($_POST['bkm_all_users']));
$bookmark_created = true;
} // end store bookmarks
@ -978,7 +847,7 @@ if ((0 == $num_rows && 0 == $unlim_num_rows) || $is_affected) {
// Should be initialized these parameters before parsing
$showtable = isset($showtable) ? $showtable : null;
$printview = isset($printview) ? $printview : null;
$printview = isset($_REQUEST['printview']) ? $_REQUEST['printview'] : null;
$url_query = isset($url_query) ? $url_query : null;
if (!empty($sql_data) && ($sql_data['valid_queries'] > 1)) {
@ -1011,7 +880,7 @@ if ((0 == $num_rows && 0 == $unlim_num_rows) || $is_affected) {
if (isset($show_query)) {
unset($show_query);
}
if (isset($printview) && $printview == '1') {
if (isset($_REQUEST['printview']) && $_REQUEST['printview'] == '1') {
PMA_Util::checkParameters(array('db', 'full_sql_query'));
$response = PMA_Response::getInstance();
@ -1111,15 +980,15 @@ if ((0 == $num_rows && 0 == $unlim_num_rows) || $is_affected) {
$html_output .= $msg->getDisplay();
}
if (isset($label)) {
if (isset($_GET['label'])) {
$msg = PMA_message::success(__('Bookmark %s created'));
$msg->addParam($label);
$msg->addParam($_GET['label']);
$html_output .= $msg->getDisplay();
}
// Should be initialized these parameters before parsing
$showtable = isset($showtable) ? $showtable : null;
$printview = isset($printview) ? $printview : null;
$printview = isset($_REQUEST['printview']) ? $_REQUEST['printview'] : null;
$url_query = isset($url_query) ? $url_query : null;
if (! empty($sql_data) && ($sql_data['valid_queries'] > 1) || $is_procedure) {
@ -1164,7 +1033,7 @@ if ((0 == $num_rows && 0 == $unlim_num_rows) || $is_affected) {
// Bookmark support if required
if ($disp_mode[7] == '1'
&& (! empty($cfg['Bookmark']) && empty($id_bookmark))
&& (! empty($cfg['Bookmark']) && empty($_GET['id_bookmark']))
&& ! empty($sql_query)
) {
$html_output .= "\n";
@ -1174,15 +1043,15 @@ if ((0 == $num_rows && 0 == $unlim_num_rows) || $is_affected) {
. '&amp;id_bookmark=1';
$html_output .= '<form action="sql.php" method="post"'
. ' onsubmit="return ! emptyFormElements(this, \'fields[label]\');"'
. ' onsubmit="return ! emptyFormElements(this, \'bkm_fields[bkm_label]\');"'
. ' id="bookmarkQueryForm">';
$html_output .= PMA_generate_common_hidden_inputs();
$html_output .= '<input type="hidden" name="goto" value="' . $goto . '" />';
$html_output .= '<input type="hidden" name="fields[dbase]"'
$html_output .= '<input type="hidden" name="bkm_fields[bkm_database]"'
. ' value="' . htmlspecialchars($db) . '" />';
$html_output .= '<input type="hidden" name="fields[user]"'
$html_output .= '<input type="hidden" name="bkm_fields[bkm_user]"'
. ' value="' . $cfg['Bookmark']['user'] . '" />';
$html_output .= '<input type="hidden" name="fields[query]"' . ' value="'
$html_output .= '<input type="hidden" name="bkm_fields[bkm_sql_query]"' . ' value="'
. urlencode(isset($complete_query) ? $complete_query : $sql_query)
. '" />';
$html_output .= '<fieldset>';
@ -1194,7 +1063,7 @@ if ((0 == $num_rows && 0 == $unlim_num_rows) || $is_affected) {
$html_output .= '<div class="formelement">';
$html_output .= '<label for="fields_label_">' . __('Label:') . '</label>';
$html_output .= '<input type="text" id="fields_label_"'
. ' name="fields[label]" value="" />';
. ' name="bkm_fields[bkm_label]" value="" />';
$html_output .= '</div>';
$html_output .= '<div class="formelement">';
$html_output .= '<input type="checkbox" name="bkm_all_users"'
@ -1214,7 +1083,7 @@ if ((0 == $num_rows && 0 == $unlim_num_rows) || $is_affected) {
} // end bookmark support
// Do print the page if required
if (isset($printview) && $printview == '1') {
if (isset($_REQUEST['printview']) && $_REQUEST['printview'] == '1') {
$html_output .= PMA_Util::getButton();
} // end print case
$html_output .= '</div>'; // end sqlqueryresults div