file_echo.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * "Echo" service to allow force downloading of exported charts (png or svg)
   5  * and server status monitor settings
   6  *
   7  * @package PhpMyAdmin
   8  */
   9
  10 define('PMA_MINIMUM_COMMON', true);
  11 require_once 'libraries/common.inc.php';
  12
  13 /* For chart exporting */
  14 if (isset($_REQUEST['filename']) && isset($_REQUEST['image'])) {
  15     $allowed = array(
  16         'image/png'     => 'png',
  17         'image/svg+xml' => 'svg',
  18     );
  19
  20     /* Check whether MIME type is allowed */
  21     if (! isset($allowed[$_REQUEST['type']])) {
  22         PMA_fatalError(__('Invalid export type'));
  23     }
  24
  25     /*
  26      * Check file name to match mime type and not contain new lines
  27      * to prevent response splitting.
  28      */
  29     $extension = $allowed[$_REQUEST['type']];
  30     $valid_match = '/^[^\n\r]*\.' . $extension . '$/';
  31     if (! preg_match($valid_match, $_REQUEST['filename'])) {
  32         if (! preg_match('/^[^\n\r]*$/', $_REQUEST['filename'])) {
  33             /* Filename is unsafe, discard it */
  34             $filename = 'download.' . $extension;
  35         } else {
  36             /* Add extension */
  37             $filename = $_REQUEST['filename'] . '.' . $extension;
  38         }
  39     } else {
  40         /* Filename from request should be safe here */
  41         $filename = $_REQUEST['filename'];
  42     }
  43
  44     /* Decode data */
  45     if ($extension != 'svg') {
  46         $data = mb_substr(
  47             $_REQUEST['image'],
  48             mb_strpos($_REQUEST['image'], ',') + 1
  49         );
  50         $data = base64_decode($data);
  51     } else {
  52         $data = $_REQUEST['image'];
  53     }
  54
  55     /* Send download header */
  56     PMA_downloadHeader(
  57         $filename,
  58         $_REQUEST['type'],
  59         mb_strlen($data)
  60     );
  61
  62     /* Send data */
  63     echo $data;
  64
  65 } else if (isset($_REQUEST['monitorconfig'])) {
  66     /* For monitor chart config export */
  67     PMA_downloadHeader('monitor.cfg', 'application/force-download');
  68     echo urldecode($_REQUEST['monitorconfig']);
  69
  70 } else if (isset($_REQUEST['import'])) {
  71     /* For monitor chart config import */
  72     header('Content-type: text/plain');
  73     if (!file_exists($_FILES['file']['tmp_name'])) {
  74         exit();
  75     }
  76     echo file_get_contents($_FILES['file']['tmp_name']);
  77 }