nettika/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

make use of PMA_isValid() and initialize $sql_query

Browse Source
This commit is contained in:
Sebastian Mendel
2007-03-29 06:02:22 +00:00
parent 11dd7b3f5b
commit 858a4d1b42
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
libraries/common.inc.php
View File

@@ -365,7 +365,7 @@ if (PMA_checkPageValidity($_REQUEST['back'], $goto_whitelist)) {
* @todo variables should be handled by their respective owners (objects) * @todo variables should be handled by their respective owners (objects)
* f.e. lang, server, convcharset, collation_connection in PMA_Config * f.e. lang, server, convcharset, collation_connection in PMA_Config
*/ */
if ((isset($_REQUEST['token']) && !is_string($_REQUEST['token'])) || empty($_REQUEST['token']) || $_SESSION[' PMA_token '] != $_REQUEST['token']) { if (! PMA_isValid($_REQUEST['token']) || $_SESSION[' PMA_token '] != $_REQUEST['token']) {
/** /**
* List of parameters which are allowed from unsafe source * List of parameters which are allowed from unsafe source
*/ */
@@ -403,7 +403,7 @@ if (isset($_REQUEST['convcharset'])) {
* @global string $GLOBALS['db'] * @global string $GLOBALS['db']
*/ */
$GLOBALS['db'] = ''; $GLOBALS['db'] = '';
if (isset($_REQUEST['db']) && is_string($_REQUEST['db'])) { if (PMA_isValid($_REQUEST['db'])) {
// can we strip tags from this? // can we strip tags from this?
// only \ and / is not allowed in db names for MySQL // only \ and / is not allowed in db names for MySQL
$GLOBALS['db'] = $_REQUEST['db']; $GLOBALS['db'] = $_REQUEST['db'];
@@ -415,7 +415,7 @@ if (isset($_REQUEST['db']) && is_string($_REQUEST['db'])) {
* @global string $GLOBALS['table'] * @global string $GLOBALS['table']
*/ */
$GLOBALS['table'] = ''; $GLOBALS['table'] = '';
if (isset($_REQUEST['table']) && is_string($_REQUEST['table'])) { if (PMA_isValid($_REQUEST['table'])) {
// can we strip tags from this? // can we strip tags from this?
// only \ and / is not allowed in table names for MySQL // only \ and / is not allowed in table names for MySQL
$GLOBALS['table'] = $_REQUEST['table']; $GLOBALS['table'] = $_REQUEST['table'];
@@ -426,7 +426,8 @@ if (isset($_REQUEST['table']) && is_string($_REQUEST['table'])) {
* sql query to be executed * sql query to be executed
* @global string $GLOBALS['sql_query'] * @global string $GLOBALS['sql_query']
*/ */
if (isset($_REQUEST['sql_query']) && is_string($_REQUEST['sql_query'])) { $GLOBALS['sql_query'] = null;
if (PMA_isValid($_REQUEST['sql_query'])) {
$GLOBALS['sql_query'] = $_REQUEST['sql_query']; $GLOBALS['sql_query'] = $_REQUEST['sql_query'];
} }