libraries/tbl_replace_fields.inc.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * handle field values (possibly uploaded from a file)
   5  *
   6  * original if-clause checked, whether input was stored in a possible
   7  * fields_upload_XX var. Now check, if the field is set. If it is empty or a
   8  * malicious file, do not alter fields contents. If an empty or invalid file is
   9  * specified, the binary data gets deleter. Maybe a nice new text-variable is
  10  * appropriate to document this behaviour.
  11  *
  12  * security cautions! You could trick the form and submit any file the
  13  * webserver has access to for upload to a binary field. Shouldn't be that easy! ;)
  14  *
  15  * default is to advance to the field-value parsing. Will only be set to
  16  * true when a binary file is uploaded, thus bypassing further manipulation of $val.
  17  *
  18  * note: grab_globals has extracted the fields from _FILES or HTTP_POST_FILES
  19  *
  20  *
  21  * @package PhpMyAdmin
  22  */
  23 if (! defined('PHPMYADMIN')) {
  24     exit;
  25 }
  26
  27 /**
  28  * do not import request variable into global scope
  29  */
  30 if (! defined('PMA_NO_VARIABLES_IMPORT')) {
  31     define('PMA_NO_VARIABLES_IMPORT', true);
  32 }
  33 /**
  34  * Gets some core libraries
  35  */
  36 require_once './libraries/common.inc.php';
  37 require_once './libraries/File.class.php';
  38
  39 $file_to_insert = new PMA_File();
  40 $file_to_insert->checkTblChangeForm($key, $rownumber);
  41
  42 $possibly_uploaded_val = $file_to_insert->getContent();
  43
  44 if ($file_to_insert->isError()) {
  45     $message .= $file_to_insert->getError();
  46 }
  47 $file_to_insert->cleanUp();
  48
  49 if (false !== $possibly_uploaded_val) {
  50     $val = $possibly_uploaded_val;
  51 } else {
  52
  53     // f i e l d    v a l u e    i n    t h e    f o r m
  54
  55     if (isset($me_fields_type[$key])) {
  56         $type = $me_fields_type[$key];
  57     } else {
  58         $type = '';
  59     }
  60
  61     // $key contains the md5() of the fieldname
  62     if ($type != 'protected' && $type != 'set' && 0 === strlen($val)) {
  63         // best way to avoid problems in strict mode (works also in non-strict mode)
  64         if (isset($me_auto_increment)  && isset($me_auto_increment[$key])) {
  65             $val = 'NULL';
  66         } else {
  67             $val = "''";
  68         }
  69     } elseif ($type == 'set') {
  70         if (! empty($_REQUEST['fields']['multi_edit'][$rownumber][$key])) {
  71             $val = implode(',', $_REQUEST['fields']['multi_edit'][$rownumber][$key]);
  72             $val = "'" . PMA_sqlAddSlashes($val) . "'";
  73         } else {
  74              $val = "''";
  75         }
  76     } elseif ($type == 'protected') {
  77         // here we are in protected mode (asked in the config)
  78         // so tbl_change has put this special value in the
  79         // fields array, so we do not change the field value
  80         // but we can still handle field upload
  81
  82         // when in UPDATE mode, do not alter field's contents. When in INSERT
  83         // mode, insert empty field because no values were submitted. If protected
  84         // blobs where set, insert original fields content.
  85             if (! empty($prot_row[$me_fields_name[$key]])) {
  86                 $val = '0x' . bin2hex($prot_row[$me_fields_name[$key]]);
  87             } else {
  88                 $val = '';
  89             }
  90     } elseif ($type == 'bit') {
  91         $val = preg_replace('/[^01]/', '0', $val);
  92         $val = "b'" . PMA_sqlAddSlashes($val) . "'";
  93     } elseif (! (($type == 'datetime' || $type == 'timestamp') && $val == 'CURRENT_TIMESTAMP')) {
  94         $val = "'" . PMA_sqlAddSlashes($val) . "'";
  95     }
  96
  97     // Was the Null checkbox checked for this field?
  98     // (if there is a value, we ignore the Null checkbox: this could
  99     // be possible if Javascript is disabled in the browser)
 100     if (! empty($me_fields_null[$key])
 101      && ($val == "''" || $val == '')) {
 102         $val = 'NULL';
 103     }
 104
 105     // The Null checkbox was unchecked for this field
 106     if (empty($val) && ! empty($me_fields_null_prev[$key]) && ! isset($me_fields_null[$key])) {
 107         $val = "''";
 108     }
 109 }  // end else (field value in the form)
 110 unset($type);
 111 ?>