diff --git a/ChangeLog b/ChangeLog index de4269377..7da7071d0 100755 --- a/ChangeLog +++ b/ChangeLog @@ -5,6 +5,10 @@ phpMyAdmin - Changelog $Id$ $Source$ +2003-01-08 Marc Delisle + * libraries/sqlparser.lib.php3, libraries/functions.js, + sql.php3: use the parser for confirmation requests + 2003-01-08 Michal Cihar * libraries/url_generating.lib.php3, libraries/common.lib.php3: New URL and hidden input generating stuff. diff --git a/libraries/sqlparser.lib.php3 b/libraries/sqlparser.lib.php3 index 177214a43..9ebc0d6c2 100644 --- a/libraries/sqlparser.lib.php3 +++ b/libraries/sqlparser.lib.php3 @@ -567,6 +567,7 @@ if (!defined('PMA_SQP_LIB_INCLUDED')) { $size = $arr['len']; $subresult = array( 'querytype' => '', + 'queryflags' => array(), 'select_expr' => array(), 'table_ref' => array() ); @@ -648,10 +649,10 @@ if (!defined('PMA_SQP_LIB_INCLUDED')) { ); $supported_query_types_cnt = count($supported_query_types); - // main loop for each token + // loop #1 for each token: select_expr, table_ref for SELECT for ($i = 0; $i < $size; $i++) { -//echo "trace " . $arr[$i]['data'] . " (" . $arr[$i]['type'] . ")
"; +//echo "trace 1" . $arr[$i]['data'] . " (" . $arr[$i]['type'] . ")
"; // High speed seek for locating the end of the current query if ($seek_queryend == TRUE) { @@ -828,8 +829,10 @@ if (!defined('PMA_SQP_LIB_INCLUDED')) { } // end if (save a select expr) -//========================= + //====================================== // s a v e a t a b l e r e f + //====================================== + // maybe we just saw the end of table refs // but the last table ref has to be saved // or we are at the last token (TODO: there could be another @@ -895,7 +898,7 @@ if (!defined('PMA_SQP_LIB_INCLUDED')) { } // end if (set the true names) - // e n d o f l o o p + // e n d i n g l o o p #1 // set the $previous_was_identifier to FALSE if the current // token is not an identifier if (($arr[$i]['type'] != 'alpha_identifier') @@ -946,8 +949,7 @@ if (!defined('PMA_SQP_LIB_INCLUDED')) { $save_table_ref = FALSE; } // end if - - } // end for $i (main loop) + } // end for $i (loop #1) // ------------------------------------------------------- // This is a big hunk of debugging code by Marc for this. @@ -970,6 +972,56 @@ if (!defined('PMA_SQP_LIB_INCLUDED')) { */ // ------------------------------------------------------- + + // loop #2: for queryflags + // and querytype (for queries != 'SELECT') + // + // This is not in the loop 1 to keep logic simple + + $seen_reserved_word = FALSE; + + for ($i = 0; $i < $size; $i++) { +//echo "trace 2" . $arr[$i]['data'] . " (" . $arr[$i]['type'] . ")
"; + // c o n f i r m a t i o n r e q u e s t s + // + // check for reserved words that will have to generate + // a confirmation request later in sql.php3 + // the cases are: + // DROP TABLE + // DROP DATABASE + // ALTER TABLE... DROP + // DELETE FROM... + // + // this code is not used for confirmations coming from functions.js + + // TODO: check for punct_queryend + + if ($arr[$i]['type'] == 'alpha_reservedWord') { + $upper_data = strtoupper($arr[$i]['data']); + if (!$seen_reserved_word) { + $first_reserved_word = $upper_data; + $subresult['querytype'] = $upper_data; + $seen_reserved_word = TRUE; + + // if the first reserved word is DROP or DELETE, + // we know this is a query that needs to be confirmed + if ($first_reserved_word=='DROP' + || $first_reserved_word == 'DELETE') { + $subresult['queryflags']['need_confirm'] = 1; + break; + } + } else { + if ($upper_data=='DROP' && $first_reserved_word=='ALTER') { + $subresult['queryflags']['need_confirm'] = 1; + break; + + } + } + } + + } // end for $i (loop #2) + + // They are naughty and didn't have a trailing semi-colon, // then still handle it properly if ($subresult['querytype'] != '') { diff --git a/sql.php3 b/sql.php3 index 6427dcf09..d94e86ada 100755 --- a/sql.php3 +++ b/sql.php3 @@ -162,8 +162,9 @@ if (!$cfg['Confirm'] || !empty($GLOBALS['validatequery'])) { $do_confirm = FALSE; } else { - /* SQL-Parser-Analyzer */ - $do_confirm = (eregi('DROP[[:space:]]+(IF[[:space:]]+EXISTS[[:space:]]+)?(TABLE|DATABASE[[:space:]])|ALTER[[:space:]]+TABLE[[:space:]]+((`[^`]+`)|([A-Za-z0-9_$]+))[[:space:]]+DROP[[:space:]]|DELETE[[:space:]]+FROM[[:space:]]', $sql_query)); + //$do_confirm = (eregi('DROP[[:space:]]+(IF[[:space:]]+EXISTS[[:space:]]+)?(TABLE|DATABASE[[:space:]])|ALTER[[:space:]]+TABLE[[:space:]]+((`[^`]+`)|([A-Za-z0-9_$]+))[[:space:]]+DROP[[:space:]]|DELETE[[:space:]]+FROM[[:space:]]', $sql_query)); + + $do_confirm = isset($analyzed_sql[0]['queryflags']['need_confirm']); } if ($do_confirm) {