libraries/grab_globals.lib.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * This library grabs the names and values of the variables sent or posted to a
   5  * script in $_GET, $_POST and $_FILES superglobals and sets simple globals
   6  * variables from them. It does the same work for $HTTP_ACCEPT_LANGUAGE and
   7  * $HTTP_AUTHORIZATION.
   8  *
   9  * @package PhpMyAdmin
  10  */
  11 if (! defined('PHPMYADMIN')) {
  12     exit;
  13 }
  14
  15 /**
  16  * copy values from one array to another, usually from a superglobal into $GLOBALS
  17  *
  18  * @param array   $array      values from
  19  * @param array   &$target    values to
  20  * @param bool    $sanitize   prevent importing key names in $_import_blacklist
  21  * @return bool
  22  */
  23 function PMA_recursive_extract($array, &$target, $sanitize = true)
  24 {
  25     if (! is_array($array)) {
  26         return false;
  27     }
  28
  29     if ($sanitize) {
  30         $valid_variables = preg_replace($GLOBALS['_import_blacklist'], '',
  31             array_keys($array));
  32         $valid_variables = array_unique($valid_variables);
  33     } else {
  34         $valid_variables = array_keys($array);
  35     }
  36
  37     foreach ($valid_variables as $key) {
  38
  39         if (strlen($key) === 0) {
  40             continue;
  41         }
  42
  43         if (is_array($array[$key])) {
  44             // there could be a variable coming from a cookie of
  45             // another application, with the same name as this array
  46             unset($target[$key]);
  47
  48             PMA_recursive_extract($array[$key], $target[$key], false);
  49         } else {
  50             $target[$key] = $array[$key];
  51         }
  52     }
  53     return true;
  54 }
  55
  56
  57 /**
  58  * @var array $_import_blacklist variable names that should NEVER be imported
  59  *                              from superglobals
  60  */
  61 $_import_blacklist = array(
  62     '/^cfg$/i',         // PMA configuration
  63     '/^server$/i',      // selected server
  64     '/^db$/i',          // page to display
  65     '/^table$/i',       // page to display
  66     '/^goto$/i',        // page to display
  67     '/^back$/i',        // the page go back
  68     '/^lang$/i',        // selected language
  69     '/^collation_connection$/i', //
  70     '/^set_theme$/i',   //
  71     '/^sql_query$/i',   // the query to be executed
  72     '/^GLOBALS$/i',     // the global scope
  73     '/^str.*$/i',       // PMA localized strings
  74     '/^error_handler.*$/i',       // the error handler
  75     '/^_.*$/i',         // PMA does not use variables starting with _ from extern
  76     '/^.*\s+.*$/i',     // no whitespaces anywhere
  77     '/^[0-9]+.*$/i',    // numeric variable names
  78     //'/^PMA_.*$/i',      // other PMA variables
  79 );
  80
  81 if (! empty($_GET)) {
  82     PMA_recursive_extract($_GET, $GLOBALS);
  83 }
  84
  85 if (! empty($_POST)) {
  86     PMA_recursive_extract($_POST, $GLOBALS);
  87 }
  88
  89 if (! empty($_FILES)) {
  90     $_valid_variables = preg_replace($GLOBALS['_import_blacklist'], '', array_keys($_FILES));
  91     foreach ($_valid_variables as $name) {
  92         if (strlen($name) != 0) {
  93             $$name = $_FILES[$name]['tmp_name'];
  94             ${$name . '_name'} = $_FILES[$name]['name'];
  95         }
  96     }
  97     unset($name, $value);
  98 }
  99
 100 /**
 101  * globalize some environment variables
 102  */
 103 $server_vars = array('HTTP_ACCEPT_LANGUAGE', 'HTTP_AUTHORIZATION');
 104 foreach ($server_vars as $current) {
 105     // it's not important HOW we detect html tags
 106     // it's more important to prevent XSS
 107     // so it's not important if we result in an invalid string,
 108     // it's even better than a XSS capable string
 109     if (PMA_getenv($current) && false === strpos(PMA_getenv($current), '<')) {
 110         $$current = PMA_getenv($current);
 111     // already imported by register_globals?
 112     } elseif (! isset($$current) || false !== strpos($$current, '<')) {
 113         $$current = '';
 114     }
 115 }
 116 unset($server_vars, $current, $_import_blacklist);
 117
 118 ?>