PageRenderTime 43ms CodeModel.GetById 20ms RepoModel.GetById 0ms app.codeStats 0ms

/phpMyAdmin/libraries/tbl_replace_fields.inc.php

https://bitbucket.org/izubizarreta/https-bitbucket.org-bityvip
PHP | 111 lines | 59 code | 11 blank | 41 comment | 35 complexity | 368d48a1cd84ab4b656dcc3df8e875d7 MD5 | raw file
Possible License(s): LGPL-3.0, LGPL-2.0, JSON, GPL-2.0, BSD-3-Clause, LGPL-2.1, MIT
  1. <?php
  2. /* vim: set expandtab sw=4 ts=4 sts=4: */
  3. /**
  4. * handle field values (possibly uploaded from a file)
  5. *
  6. * original if-clause checked, whether input was stored in a possible
  7. * fields_upload_XX var. Now check, if the field is set. If it is empty or a
  8. * malicious file, do not alter fields contents. If an empty or invalid file is
  9. * specified, the binary data gets deleter. Maybe a nice new text-variable is
  10. * appropriate to document this behaviour.
  11. *
  12. * security cautions! You could trick the form and submit any file the
  13. * webserver has access to for upload to a binary field. Shouldn't be that easy! ;)
  14. *
  15. * default is to advance to the field-value parsing. Will only be set to
  16. * true when a binary file is uploaded, thus bypassing further manipulation of $val.
  17. *
  18. * note: grab_globals has extracted the fields from _FILES or HTTP_POST_FILES
  19. *
  20. *
  21. * @package PhpMyAdmin
  22. */
  23. if (! defined('PHPMYADMIN')) {
  24. exit;
  25. }
  26. /**
  27. * do not import request variable into global scope
  28. */
  29. if (! defined('PMA_NO_VARIABLES_IMPORT')) {
  30. define('PMA_NO_VARIABLES_IMPORT', true);
  31. }
  32. /**
  33. * Gets some core libraries
  34. */
  35. require_once './libraries/common.inc.php';
  36. require_once './libraries/File.class.php';
  37. $file_to_insert = new PMA_File();
  38. $file_to_insert->checkTblChangeForm($key, $rownumber);
  39. $possibly_uploaded_val = $file_to_insert->getContent();
  40. if ($file_to_insert->isError()) {
  41. $message .= $file_to_insert->getError();
  42. }
  43. $file_to_insert->cleanUp();
  44. if (false !== $possibly_uploaded_val) {
  45. $val = $possibly_uploaded_val;
  46. } else {
  47. // f i e l d v a l u e i n t h e f o r m
  48. if (isset($me_fields_type[$key])) {
  49. $type = $me_fields_type[$key];
  50. } else {
  51. $type = '';
  52. }
  53. // $key contains the md5() of the fieldname
  54. if ($type != 'protected' && $type != 'set' && 0 === strlen($val)) {
  55. // best way to avoid problems in strict mode (works also in non-strict mode)
  56. if (isset($me_auto_increment) && isset($me_auto_increment[$key])) {
  57. $val = 'NULL';
  58. } else {
  59. $val = "''";
  60. }
  61. } elseif ($type == 'set') {
  62. if (! empty($_REQUEST['fields']['multi_edit'][$rownumber][$key])) {
  63. $val = implode(',', $_REQUEST['fields']['multi_edit'][$rownumber][$key]);
  64. $val = "'" . PMA_sqlAddSlashes($val) . "'";
  65. } else {
  66. $val = "''";
  67. }
  68. } elseif ($type == 'protected') {
  69. // here we are in protected mode (asked in the config)
  70. // so tbl_change has put this special value in the
  71. // fields array, so we do not change the field value
  72. // but we can still handle field upload
  73. // when in UPDATE mode, do not alter field's contents. When in INSERT
  74. // mode, insert empty field because no values were submitted. If protected
  75. // blobs where set, insert original fields content.
  76. if (! empty($prot_row[$me_fields_name[$key]])) {
  77. $val = '0x' . bin2hex($prot_row[$me_fields_name[$key]]);
  78. } else {
  79. $val = '';
  80. }
  81. } elseif ($type == 'bit') {
  82. $val = preg_replace('/[^01]/', '0', $val);
  83. $val = "b'" . PMA_sqlAddSlashes($val) . "'";
  84. } elseif (! (($type == 'datetime' || $type == 'timestamp') && $val == 'CURRENT_TIMESTAMP')) {
  85. $val = "'" . PMA_sqlAddSlashes($val) . "'";
  86. }
  87. // Was the Null checkbox checked for this field?
  88. // (if there is a value, we ignore the Null checkbox: this could
  89. // be possible if Javascript is disabled in the browser)
  90. if (! empty($me_fields_null[$key])
  91. && ($val == "''" || $val == '')) {
  92. $val = 'NULL';
  93. }
  94. // The Null checkbox was unchecked for this field
  95. if (empty($val) && ! empty($me_fields_null_prev[$key]) && ! isset($me_fields_null[$key])) {
  96. $val = "''";
  97. }
  98. } // end else (field value in the form)
  99. unset($type);
  100. ?>