libraries/classes/Controllers/Table/GetFieldController.php

   1 <?php
   2 declare(strict_types=1);
   3
   4 namespace PhpMyAdmin\Controllers\Table;
   5
   6 use PhpMyAdmin\Core;
   7 use PhpMyAdmin\Html\Generator;
   8 use PhpMyAdmin\Mime;
   9 use PhpMyAdmin\Util;
  10 use function htmlspecialchars;
  11 use function ini_set;
  12 use function sprintf;
  13 use function strlen;
  14
  15 /**
  16  * Provides download to a given field defined in parameters.
  17  */
  18 class GetFieldController extends AbstractController
  19 {
  20     public function index(): void
  21     {
  22         global $db, $table;
  23
  24         $this->response->disable();
  25
  26         /* Check parameters */
  27         Util::checkParameters([
  28             'db',
  29             'table',
  30         ]);
  31
  32         /* Select database */
  33         if (! $this->dbi->selectDb($db)) {
  34             Generator::mysqlDie(
  35                 sprintf(__('\'%s\' database does not exist.'), htmlspecialchars($db)),
  36                 '',
  37                 false
  38             );
  39         }
  40
  41         /* Check if table exists */
  42         if (! $this->dbi->getColumns($db, $table)) {
  43             Generator::mysqlDie(__('Invalid table name'));
  44         }
  45
  46         if (! isset($_GET['where_clause'])
  47             || ! isset($_GET['where_clause_sign'])
  48             || ! Core::checkSqlQuerySignature($_GET['where_clause'], $_GET['where_clause_sign'])
  49         ) {
  50             /* l10n: In case a SQL query did not pass a security check  */
  51             Core::fatalError(__('There is an issue with your request.'));
  52             exit;
  53         }
  54
  55         /* Grab data */
  56         $sql = 'SELECT ' . Util::backquote($_GET['transform_key'])
  57             . ' FROM ' . Util::backquote($table)
  58             . ' WHERE ' . $_GET['where_clause'] . ';';
  59         $result = $this->dbi->fetchValue($sql);
  60
  61         /* Check return code */
  62         if ($result === false) {
  63             Generator::mysqlDie(
  64                 __('MySQL returned an empty result set (i.e. zero rows).'),
  65                 $sql
  66             );
  67         }
  68
  69         /* Avoid corrupting data */
  70         ini_set('url_rewriter.tags', '');
  71
  72         Core::downloadHeader(
  73             $table . '-' . $_GET['transform_key'] . '.bin',
  74             Mime::detect($result),
  75             strlen($result)
  76         );
  77         echo $result;
  78     }
  79 }