nettika/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

make use of PMA_isValid() and initialize $sql_query

Browse Source
This commit is contained in:
Sebastian Mendel
2007-03-29 06:02:22 +00:00
parent 11dd7b3f5b
commit 858a4d1b42
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
libraries/common.inc.php
View File

@@ -365,7 +365,7 @@ if (PMA_checkPageValidity($_REQUEST['back'], $goto_whitelist)) {
* @todo variables should be handled by their respective owners (objects)
* f.e. lang, server, convcharset, collation_connection in PMA_Config
*/
if ((isset($_REQUEST['token']) && !is_string($_REQUEST['token'])) || empty($_REQUEST['token']) || $_SESSION[' PMA_token '] != $_REQUEST['token']) {
if (! PMA_isValid($_REQUEST['token']) || $_SESSION[' PMA_token '] != $_REQUEST['token']) {
/**
* List of parameters which are allowed from unsafe source
*/
@@ -403,7 +403,7 @@ if (isset($_REQUEST['convcharset'])) {
* @global string $GLOBALS['db']
*/
$GLOBALS['db'] = '';
if (isset($_REQUEST['db']) && is_string($_REQUEST['db'])) {
if (PMA_isValid($_REQUEST['db'])) {
// can we strip tags from this?
// only \ and / is not allowed in db names for MySQL
$GLOBALS['db'] = $_REQUEST['db'];
@@ -415,7 +415,7 @@ if (isset($_REQUEST['db']) && is_string($_REQUEST['db'])) {
* @global string $GLOBALS['table']
*/
$GLOBALS['table'] = '';
if (isset($_REQUEST['table']) && is_string($_REQUEST['table'])) {
if (PMA_isValid($_REQUEST['table'])) {
// can we strip tags from this?
// only \ and / is not allowed in table names for MySQL
$GLOBALS['table'] = $_REQUEST['table'];
@@ -426,7 +426,8 @@ if (isset($_REQUEST['table']) && is_string($_REQUEST['table'])) {
* sql query to be executed
* @global string $GLOBALS['sql_query']
*/
if (isset($_REQUEST['sql_query']) && is_string($_REQUEST['sql_query'])) {
$GLOBALS['sql_query'] = null;
if (PMA_isValid($_REQUEST['sql_query'])) {
$GLOBALS['sql_query'] = $_REQUEST['sql_query'];
}