nettika/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Sanitize filenames before using in Content-Disposition header

Browse Source
This commit is contained in:
Herman van Rink
2011-08-08 20:07:09 +02:00
parent b659fbeb12
commit c547703b10
9 changed files with 29 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
export.php
View File

@@ -343,6 +343,7 @@ if (!$save_on_server) {
// (avoid rewriting data containing HTML with anchors and forms;
// this was reported to happen under Plesk)
@ini_set('url_rewriter.tags','');
$filename = PMA_sanitize_filename($filename);
header('Content-Type: ' . $mime_type);
header('Expires: ' . gmdate('D, d M Y H:i:s') . ' GMT');

18
libraries/sanitizing.lib.php
View File

@@ -86,4 +86,22 @@ function PMA_sanitize($message, $escape = false, $safe = false)
return $message;
}
/**
* Sanitize a filename by removing anything besides A-Za-z0-9_.-
*
* Intended usecase:
* When using a filename in a Content-Disposition header the value should not contain ; or "
*
* @param string The filename
*
* @return string the sanitized filename
*
*/
function PMA_sanitize_filename($filename) {
$filename = preg_replace('/[^A-Za-z0-9_.-]/', '_', $filename);
return $filename;
}
?>

1
libraries/schema/Dia_Relation_Schema.class.php
View File

@@ -173,6 +173,7 @@ class PMA_DIA extends XMLWriter
if(ob_get_clean()){
ob_end_clean();
}
$fileName = PMA_sanitize_filename($fileName);
header('Content-type: application/x-dia-diagram');
header('Content-Disposition: attachment; filename="'.$fileName.'.dia"');
$output = $this->flush();

1
libraries/schema/Eps_Relation_Schema.class.php
View File

@@ -336,6 +336,7 @@ class PMA_EPS
// if(ob_get_clean()){
//ob_end_clean();
//}
$fileName = PMA_sanitize_filename($fileName);
header('Content-type: image/x-eps');
header('Content-Disposition: attachment; filename="'.$fileName.'.eps"');
$output = $this->stringCommands;

2
libraries/schema/Pdf_Relation_Schema.class.php
View File

@@ -1075,6 +1075,8 @@ class PMA_Pdf_Relation_Schema extends PMA_Export_Relation_Schema
if (empty($filename)) {
$filename = $pageNumber . '.pdf';
}
$fileName = PMA_sanitize_filename($fileName);
// instead of $pdf->Output():
$pdfData = $pdf->getPDFData();
header('Content-Type: application/pdf');

1
libraries/schema/Svg_Relation_Schema.class.php
View File

@@ -171,6 +171,7 @@ class PMA_SVG extends XMLWriter
function showOutput($fileName)
{
//ob_get_clean();
$fileName = PMA_sanitize_filename($fileName);
header('Content-type: image/svg+xml');
header('Content-Disposition: attachment; filename="'.$fileName.'.svg"');
$output = $this->flush();

1
libraries/schema/Visio_Relation_Schema.class.php
View File

@@ -158,6 +158,7 @@ class PMA_VISIO extends XMLWriter
//if(ob_get_clean()){
//ob_end_clean();
//}
$fileName = PMA_sanitize_filename($fileName);
header('Content-type: application/visio');
header('Content-Disposition: attachment; filename="'.$fileName.'.vdx"');
$output = $this->flush();

3
tbl_get_field.php
View File

@@ -39,7 +39,8 @@ if ($result === false) {
header('Content-Type: ' . PMA_detectMIME($result));
header('Expires: ' . gmdate('D, d M Y H:i:s') . ' GMT');
header('Content-Disposition: attachment; filename="' . $table . '-' . $transform_key . '.bin"');
$filename = PMA_sanitize_filename($table . '-' . $transform_key . '.bin');
header('Content-Disposition: attachment; filename="' . $filename . '"');
if (PMA_USR_BROWSER_AGENT == 'IE') {
header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
header('Pragma: public');

3
tbl_tracking.php
View File

@@ -111,7 +111,8 @@ if (isset($_REQUEST['report_export']) && $_REQUEST['export_type'] == 'sqldumpfil
foreach($entries as $entry) {
$dump .= $entry['statement'];
}
$filename = 'log_' . str_replace(';', '', htmlspecialchars($_REQUEST['table'])) . '.sql';
//$filename = 'log_' . str_replace(';', '', htmlspecialchars($_REQUEST['table'])) . '.sql';
$filename = PMA_sanitize_filename('log_' . $_REQUEST['table'] . '.sql');
header('Content-Type: text/x-sql');
header('Expires: ' . gmdate('D, d M Y H:i:s') . ' GMT');
header('Content-Disposition: attachment; filename="' . $filename . '"');