phpmyadmin/js/get_scripts.js.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * Concatenates several js files to reduce the number of
   5  * http requests sent to the server
   6  *
   7  * @package PhpMyAdmin
   8  */
   9
  10 chdir('..');
  11
  12 // Close session early as we won't write anything there
  13 session_write_close();
  14
  15 // Send correct type
  16 header('Content-Type: text/javascript; charset=UTF-8');
  17 // Enable browser cache for 1 hour
  18 header('Expires: ' . gmdate('D, d M Y H:i:s', time() + 3600) . ' GMT');
  19
  20 // When a token is not presented, even though whitelisted arrays are removed
  21 // in PMA_removeRequestVars(). This is a workaround for that.
  22 $_GET['scripts'] = json_encode($_GET['scripts']);
  23
  24 // Avoid loading the full common.inc.php because this would add many
  25 // non-js-compatible stuff like DOCTYPE
  26 define('PMA_MINIMUM_COMMON', true);
  27 require_once './libraries/common.inc.php';
  28
  29 require_once './libraries/OutputBuffering.class.php';
  30 $buffer = PMA_OutputBuffering::getInstance();
  31 $buffer->start();
  32 register_shutdown_function(
  33     function () {
  34         echo PMA_OutputBuffering::getInstance()->getContents();
  35     }
  36 );
  37
  38 $_GET['scripts'] = json_decode($_GET['scripts']);
  39 if (! empty($_GET['scripts']) && is_array($_GET['scripts'])) {
  40     foreach ($_GET['scripts'] as $script) {
  41         // Sanitise filename
  42         $script_name = 'js';
  43
  44         $path = explode("/", $script);
  45         foreach ($path as $index => $filename) {
  46             // Allow alphanumeric, "." and "-" chars only, no files starting
  47             // with .
  48             if (preg_match("@^[\w][\w\.-]+$@", $filename)) {
  49                 $script_name .= DIRECTORY_SEPARATOR . $filename;
  50             }
  51         }
  52
  53         // Output file contents
  54         if (preg_match("@\.js$@", $script_name) && is_readable($script_name)) {
  55             readfile($script_name);
  56             echo ";\n\n";
  57         }
  58     }
  59 }
  60
  61 if (isset($_GET['call_done'])) {
  62     echo "AJAX.scriptHandler.done();";
  63 }