nettika/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactored:

Browse Source 
made register_globals independent;
added documentation;
removed unused code;
fixed bug #1597686 last insert id message wrong;
and much more i don't remember ...
This commit is contained in:
Sebastian Mendel
2006-12-19 16:54:29 +00:00
parent 14ff3c4729
commit d3f335ac3d
4 changed files with 497 additions and 432 deletions
Download Patch File Download Diff File Expand all files Collapse all files

353
libraries/tbl_replace_fields.inc.php
View File

@@ -1,226 +1,221 @@
<?php
/* $Id$ */
// vim: expandtab sw=4 ts=4 sts=4:
/**
* f i e l d u p l o a d e d f r o m a f i l e
*
* garvin: original if-clause checked, whether input was stored in a possible
* fields_upload_XX var. Now check, if the field is set. If it is empty or a
* malicious file, do not alter fields contents. If an empty or invalid file is
* specified, the binary data gets deleter. Maybe a nice new text-variable is
* appropriate to document this behaviour.
*
* garvin: security cautions! You could trick the form and submit any file the
* webserver has access to for upload to a binary field. Shouldn't be that easy! ;)
*
* garvin: default is to advance to the field-value parsing. Will only be set to
* true when a binary file is uploaded, thus bypassing further manipulation of $val.
*
* note: grab_globals has extracted the fields from _FILES or HTTP_POST_FILES
*
* @version $Id$
* vim: expandtab sw=4 ts=4 sts=4:
*
* @uses $GLOBALS['cfg']['UploadDir']
* @uses $_FILES
* @uses $_REQUEST
* @uses defined()
* @uses define()
* @uses is_uploaded_file()
* @uses ini_get()
* @uses is_dir()
* @uses mkdir()
* @uses chmod()
* @uses is_writable()
* @uses is_readable()
* @uses move_uploaded_file()
* @uses basename()
* @uses preg_replace()
* @uses bin2hex()
* @uses fread()
* @uses fopen()
* @uses filesize()
* @uses unlink()
* @uses strlen()
* @uses md5()
* @uses implode()
* @uses PMA_IS_WINDOWS
* @uses PMA_NO_VARIABLES_IMPORT
* @uses PMA_checkParameters()
* @uses PMA_sqlAddslashes()
* @uses PMA_userDir()
*/
// note: grab_globals has extracted the fields from _FILES
// or HTTP_POST_FILES
/**
* do not import request variable into global scope
*/
if (! defined('PMA_NO_VARIABLES_IMPORT')) {
define('PMA_NO_VARIABLES_IMPORT', true);
}
/**
* Gets some core libraries
*/
require_once './libraries/common.lib.php';
// Check parameters
require_once('./libraries/common.lib.php');
PMA_checkParameters(array('db', 'encoded_key'));
// f i e l d u p l o a d e d f r o m a f i l e
// garvin: original if-clause checked, whether input was stored in a possible fields_upload_XX var.
// Now check, if the field is set. If it is empty or a malicious file, do not alter fields contents.
// If an empty or invalid file is specified, the binary data gets deleter. Maybe a nice
// new text-variable is appropriate to document this behaviour.
// garvin: security cautions! You could trick the form and submit any file the webserver has access to
// for upload to a binary field. Shouldn't be that easy! ;)
// garvin: default is to advance to the field-value parsing. Will only be set to true when a
// binary file is uploaded, thus bypassing further manipulation of $val.
$check_stop = false;
$valid_file_was_uploaded = false;
// Check if a multi-edit row was found
${'me_fields_upload_' . $encoded_key} = (isset($enc_primary_key) && isset(${'fields_upload_' . $encoded_key}['multi_edit']) ? ${'fields_upload_' . $encoded_key}['multi_edit'][$enc_primary_key] : (isset(${'fields_upload_' . $encoded_key}) ? ${'fields_upload_' . $encoded_key} : null));
${'me_fields_uploadlocal_' . $encoded_key} = (isset($enc_primary_key) && isset(${'fields_uploadlocal_' . $encoded_key}['multi_edit']) ? ${'fields_uploadlocal_' . $encoded_key}['multi_edit'][$enc_primary_key] : (isset(${'fields_uploadlocal_' . $encoded_key}) ? ${'fields_uploadlocal_' . $encoded_key} : null));
if (isset(${'me_fields_upload_' . $encoded_key}) && ${'me_fields_upload_' . $encoded_key} != 'none'){
$me_fields_upload =
(isset($_FILES['fields_upload_' . $key]['tmp_name']['multi_edit'][$primary_key])
? $_FILES['fields_upload_' . $key]['tmp_name']['multi_edit'][$primary_key]
: (isset($_FILES['fields_upload_' . $key]['tmp_name'])
? $_FILES['fields_upload_' . $key]['tmp_name']
: 'none'));
$me_fields_uploadlocal =
(isset($_REQUEST['fields_uploadlocal_' . $key]['multi_edit'])
? $_REQUEST['fields_uploadlocal_' . $key]['multi_edit'][$primary_key]
: (isset($_REQUEST['fields_uploadlocal_' . $key])
? $_REQUEST['fields_uploadlocal_' . $key]
: null));
if ($me_fields_upload != 'none') {
// garvin: This fields content is a blob-file upload.
if (!empty(${'me_fields_upload_' . $encoded_key})) {
// garvin: The blob-field is not empty. Check what we have there.
$file_to_insert = false;
$unlink = false;
$data_file = ${'me_fields_upload_' . $encoded_key};
if (is_uploaded_file($me_fields_upload)) {
// whether we insert form uploaded file ...
if (is_uploaded_file($data_file)) {
// garvin: A valid uploaded file is found. Look into the file...
$val = fread(fopen($data_file, 'rb'), filesize($data_file));
// nijel: This is probably the best way how to put binary data
// into MySQL and it also allow not to care about charset
// conversion that would otherwise corrupt the data.
if (!empty($val)) {
// garvin: The upload was valid. Check in new blob-field's contents.
$val = '0x' . bin2hex($val);
$seen_binary = TRUE;
$check_stop = TRUE;
}
// garvin: ELSE: an empty file was uploaded. Remove blob-field's contents.
// Blob-fields are preserved, see below. ($protected$)
} else {
// garvin: Danger, will robinson. File is malicious. Blob-fields are preserved, see below. ($protected$)
// void
}
} elseif (!empty(${'me_fields_uploadlocal_' . $encoded_key})) {
$file_to_upload = PMA_userDir($cfg['UploadDir']) . preg_replace('@\.\.*@', '.', ${'me_fields_uploadlocal_' . $encoded_key});
// A local file will be uploaded.
$open_basedir = @ini_get('open_basedir');
$file_to_insert = $me_fields_upload;
// If we are on a server with open_basedir, we must move the file
// before opening it. The doc explains how to create the "./tmp"
// directory
$unlink = false;
if (!empty($open_basedir)) {
// before opening it. The FAQ 1.11 explains how to create the "./tmp"
// directory - if needed
if ('' != ini_get('open_basedir')) {
$tmp_subdir = (PMA_IS_WINDOWS ? '.\\tmp\\' : './tmp/');
// function is_writeable() is valid on PHP3 and 4
if (!is_writeable($tmp_subdir)) {
if (! is_dir($tmp_subdir)) {
// try to create the tmp directory if not exists
if (mkdir($tmp_subdir, 0777)) {
chmod($tmp_subdir, 0777);
}
}
if (! is_writable($tmp_subdir)) {
// if we cannot move the file don't change blob fields
$file_to_upload = '';
$file_to_insert = false;
} else {
$new_file_to_upload = $tmp_subdir . basename($file_to_upload);
move_uploaded_file($file_to_upload, $new_file_to_upload);
$new_file_to_upload = $tmp_subdir . basename($file_to_insert);
$file_to_upload = $new_file_to_upload;
move_uploaded_file($file_to_insert, $new_file_to_upload);
$file_to_insert = $new_file_to_upload;
$unlink = true;
unset($new_file_to_upload);
}
unset($tmp_subdir);
}
} elseif (! empty($me_fields_uploadlocal)) {
// ... or selected file from $cfg['UploadDir']
if ($file_to_upload != '') {
$file_to_insert = PMA_userDir($GLOBALS['cfg']['UploadDir']) . preg_replace('@\.\.*@', '.', $me_fields_uploadlocal);
$val = fread(fopen($file_to_upload, 'rb'), filesize($file_to_upload));
if (!empty($val)) {
$val = '0x' . bin2hex($val);
$seen_binary = TRUE;
$check_stop = TRUE;
}
if ($unlink == TRUE) {
unlink($file_to_upload);
}
if (! is_readable($file_to_insert)) {
$file_to_insert = false;
}
}
// garvin: else: Post-field contains no data. Blob-fields are preserved, see below. ($protected$)
if ($file_to_insert) {
$val = '';
// check if file is not empty
if (function_exists('file_get_contents')) {
$val = file_get_contents($file_to_insert);
} elseif ($file_to_insert_size = filesize($file_to_insert)) {
$val = fread(fopen($file_to_insert, 'rb'), $file_to_insert_size);
}
if (! empty($val)) {
$val = '0x' . bin2hex($val);
$seen_binary = true;
$valid_file_was_uploaded = true;
}
if ($unlink == true) {
unlink($file_to_insert);
}
}
unset($file_to_insert, $file_to_insert_size, $unlink);
}
if (!$check_stop) {
if (false === $valid_file_was_uploaded) {
// f i e l d v a l u e i n t h e f o r m
// f i e l d v a l u e i n t h e f o r m
if (isset($me_fields_type[$encoded_key])) {
$type = $me_fields_type[$encoded_key];
if (isset($me_fields_type[$key])) {
$type = $me_fields_type[$key];
} else {
$type = '';
}
$f = 'field_' . md5($key);
$t_fval = (isset($$f) ? $$f : null);
if (isset($t_fval['multi_edit']) && isset($t_fval['multi_edit'][$enc_primary_key])) {
$fval = &$t_fval['multi_edit'][$enc_primary_key];
} else {
$fval = null;
if (0 === strlen($val)) {
// default
$val = "''";
switch ($type) {
case 'enum':
// if we have an enum, then construct the value
case 'set':
// if we have a set, then construct the value
case 'foreign':
// if we have a foreign key, then construct the value
if (! empty($_REQUEST[$f]['multi_edit'][$primary_key])) {
$val = implode(',', $_REQUEST[$f]['multi_edit'][$primary_key]);
$val = "'" . PMA_sqlAddslashes($val) . "'";
}
break;
case 'protected':
// here we are in protected mode (asked in the config)
// so tbl_change has put this special value in the
// fields array, so we do not change the field value
// but we can still handle field upload
// garvin: when in UPDATE mode, do not alter field's contents. When in INSERT
// mode, insert empty field because no values were submitted. If protected
// blobs where set, insert original fields content.
if (! empty($prot_row[$key])) {
$val = '0x' . bin2hex($prot_row[$key]);
$seen_binary = true;
}
break;
default:
// best way to avoid problems in strict mode (works also in non-strict mode)
if (isset($me_auto_increment) && isset($me_auto_increment[$key])) {
$val = 'NULL';
}
break;
}
} elseif (! ($type == 'timestamp' && $val == 'CURRENT_TIMESTAMP')) {
$val = "'" . PMA_sqlAddslashes($val) . "'";
}
switch (strtolower($val)) {
// let users type NULL or null to input this string and not a NULL value
//case 'null':
// break;
case '':
switch ($type) {
case 'enum':
// if we have an enum, then construct the value
if (!empty($fval)) {
$val = implode(',', $fval);
if ($val == 'null') {
// void
} else {
// the data here is urlencoded
$val = "'" . PMA_sqlAddslashes(urldecode($val)) . "'";
}
} else {
$val = "''";
}
break;
case 'set':
// if we have a set, then construct the value
if (!empty($fval)) {
$val = implode(',', $fval);
// the data here is urlencoded
$val = "'" . PMA_sqlAddslashes(urldecode($val)) . "'";
} else {
$val = "''";
}
break;
case 'foreign':
// if we have a foreign key, then construct the value
if (!empty($fval)) {
$val = implode(',', $fval);
if ($val == 'null') {
// void
} else {
// the data here is not urlencoded!
//$val = "'" . PMA_sqlAddslashes(urldecode($val)) . "'";
$val = "'" . PMA_sqlAddslashes($val) . "'";
}
} else {
$val = "''";
}
break;
case 'protected':
// here we are in protected mode (asked in the config)
// so tbl_change has put this special value in the
// fields array, so we do not change the field value
// but we can still handle field upload
// garvin: when in UPDATE mode, do not alter field's contents. When in INSERT
// mode, insert empty field because no values were submitted. If protected
// blobs where set, insert original fields content.
if (isset($fieldlist)) {
if (isset($prot_row) && isset($prot_row[$key]) && !empty($prot_row[$key])) {
$val = '0x' . bin2hex($prot_row[$key]);
$seen_binary = TRUE;
} else {
$val = "''";
}
} else {
unset($val);
}
break;
default:
// best way to avoid problems in strict mode (works also in non-strict mode)
if (isset($me_auto_increment) && isset($me_auto_increment[$encoded_key])) {
$val = 'NULL';
} else {
$val = "'" . PMA_sqlAddslashes($val) . "'";
}
break;
}
break;
default:
if (!($type == 'timestamp' && $val == 'CURRENT_TIMESTAMP')) {
$val = "'" . PMA_sqlAddslashes($val) . "'";
}
break;
} // end switch
// Was the Null checkbox checked for this field?
// (if there is a value, we ignore the Null checkbox: this could
// be possible if Javascript is disabled in the browser)
if (isset($me_fields_null) && isset($me_fields_null[$encoded_key])
&& $val=="''") {
if (isset($me_fields_null[$key])
&& $val == "''") {
$val = 'NULL';
}
// The Null checkbox was unchecked for this field
if (empty($val) && isset($me_fields_null_prev) && isset($me_fields_null_prev[$encoded_key]) && !isset($me_fields_null[$encoded_key])) {
$val = "''";
if (empty($val) && isset($me_fields_null_prev[$key]) && ! isset($me_fields_null[$key])) {
$val = "''";
}
} // end else (field value in the form)
unset($valid_file_was_uploaded, $me_fields_upload, $me_fields_uploadlocal, $type, $f);
?>