For bug 3168757:
[phpmyadmin-themes.git] / libraries / tbl_replace_fields.inc.php
blob84377bfdf3539f76e9a188ead73bd56c7f12bdd0
1 <?php
2 /* vim: set expandtab sw=4 ts=4 sts=4: */
3 /**
4 * handle field values (possibly uploaded from a file)
6 * original if-clause checked, whether input was stored in a possible
7 * fields_upload_XX var. Now check, if the field is set. If it is empty or a
8 * malicious file, do not alter fields contents. If an empty or invalid file is
9 * specified, the binary data gets deleter. Maybe a nice new text-variable is
10 * appropriate to document this behaviour.
12 * security cautions! You could trick the form and submit any file the
13 * webserver has access to for upload to a binary field. Shouldn't be that easy! ;)
15 * default is to advance to the field-value parsing. Will only be set to
16 * true when a binary file is uploaded, thus bypassing further manipulation of $val.
18 * note: grab_globals has extracted the fields from _FILES or HTTP_POST_FILES
21 * @uses $_REQUEST
22 * @uses defined()
23 * @uses define()
24 * @uses bin2hex()
25 * @uses strlen()
26 * @uses md5()
27 * @uses implode()
28 * @uses PMA_NO_VARIABLES_IMPORT
29 * @uses PMA_sqlAddslashes()
30 * @package phpMyAdmin
32 if (! defined('PHPMYADMIN')) {
33 exit;
36 /**
37 * do not import request variable into global scope
39 if (! defined('PMA_NO_VARIABLES_IMPORT')) {
40 define('PMA_NO_VARIABLES_IMPORT', true);
42 /**
43 * Gets some core libraries
45 require_once './libraries/common.inc.php';
46 require_once './libraries/File.class.php';
48 $file_to_insert = new PMA_File();
49 $file_to_insert->checkTblChangeForm($key, $rownumber);
51 $possibly_uploaded_val = $file_to_insert->getContent();
53 if ($file_to_insert->isError()) {
54 $message .= $file_to_insert->getError();
56 $file_to_insert->cleanUp();
58 if (false !== $possibly_uploaded_val) {
59 $val = $possibly_uploaded_val;
60 } else {
62 // f i e l d v a l u e i n t h e f o r m
64 if (isset($me_fields_type[$key])) {
65 $type = $me_fields_type[$key];
66 } else {
67 $type = '';
70 // $key contains the md5() of the fieldname
71 if (0 === strlen($val)) {
72 // best way to avoid problems in strict mode (works also in non-strict mode)
73 if (isset($me_auto_increment) && isset($me_auto_increment[$key])) {
74 $val = 'NULL';
75 } else {
76 $val = "''";
78 } elseif ($type == 'set') {
79 if (! empty($_REQUEST['fields']['multi_edit'][$rownumber][$key])) {
80 $val = implode(',', $_REQUEST['fields']['multi_edit'][$rownumber][$key]);
81 $val = "'" . PMA_sqlAddslashes($val) . "'";
83 } elseif ($type == 'protected') {
84 // here we are in protected mode (asked in the config)
85 // so tbl_change has put this special value in the
86 // fields array, so we do not change the field value
87 // but we can still handle field upload
89 // when in UPDATE mode, do not alter field's contents. When in INSERT
90 // mode, insert empty field because no values were submitted. If protected
91 // blobs where set, insert original fields content.
92 if (! empty($prot_row[$me_fields_name[$key]])) {
93 $val = '0x' . bin2hex($prot_row[$me_fields_name[$key]]);
94 } else {
95 $val = '';
97 } elseif ($type == 'bit') {
98 $val = preg_replace('/[^01]/', '0', $val);
99 $val = "b'" . PMA_sqlAddslashes($val) . "'";
100 } elseif (! (($type == 'datetime' || $type == 'timestamp') && $val == 'CURRENT_TIMESTAMP')) {
101 $val = "'" . PMA_sqlAddslashes($val) . "'";
104 // Was the Null checkbox checked for this field?
105 // (if there is a value, we ignore the Null checkbox: this could
106 // be possible if Javascript is disabled in the browser)
107 if (isset($me_fields_null[$key])
108 && ($val == "''" || $val == '')) {
109 $val = 'NULL';
112 // The Null checkbox was unchecked for this field
113 if (empty($val) && isset($me_fields_null_prev[$key]) && ! isset($me_fields_null[$key])) {
114 $val = "''";
116 } // end else (field value in the form)
117 unset($type);