3 // vim: expandtab sw=4 ts=4 sts=4:
5 // note: grab_globals has extracted the fields from _FILES
10 if (!defined('PMA_COMMON_LIB_INCLUDED')) {
11 include('./libraries/common.lib.php3');
14 PMA_checkParameters(array('db','encoded_key'));
17 // f i e l d u p l o a d e d f r o m a f i l e
19 // garvin: original if-clause checked, whether input was stored in a possible fields_upload_XX var.
20 // Now check, if the field is set. If it is empty or a malicious file, do not alter fields contents.
21 // If an empty or invalid file is specified, the binary data gets deleter. Maybe a nice
22 // new text-variable is appropriate to document this behaviour.
24 // garvin: security cautions! You could trick the form and submit any file the webserver has access to
25 // for upload to a binary field. Shouldn't be that easy! ;)
27 // garvin: default is to advance to the field-value parsing. Will only be set to true when a
28 // binary file is uploaded, thus bypassing further manipulation of $val.
31 if (isset($
{"fields_upload_" . $encoded_key}) && $
{"fields_upload_" . $encoded_key} != 'none'){
32 // garvin: This fields content is a blob-file upload.
34 if (!empty($
{"fields_upload_" . $encoded_key})) {
35 // garvin: The blob-field is not empty. Check what we have there.
37 $data_file = $
{"fields_upload_" . $encoded_key};
39 if (is_uploaded_file($data_file)) {
40 // garvin: A valid uploaded file is found. Look into the file...
42 $val = fread(fopen($data_file, "rb"), filesize($data_file));
43 // nijel: This is probably the best way how to put binary data
44 // into MySQL and it also allow not to care about charset
45 // conversion that would otherwise corrupt the data.
48 // garvin: The upload was valid. Check in new blob-field's contents.
49 $val = '0x' . bin2hex($val);
53 // garvin: ELSE: an empty file was uploaded. Remove blob-field's contents.
54 // Blob-fields are preserved, see below. ($protected$)
57 // garvin: Danger, will robinson. File is malicious. Blob-fields are preserved, see below. ($protected$)
61 } elseif (!empty($
{'fields_uploadlocal_' . $encoded_key})) {
62 $file_to_upload = $cfg['UploadDir'] . eregi_replace('\.\.*', '.', $
{'fields_uploadlocal_' . $encoded_key});
64 // A local file will be uploaded.
66 if (PMA_PHP_INT_VERSION
>= 40000) {
67 $open_basedir = @ini_get
('open_basedir');
69 if (empty($open_basedir)) {
70 $open_basedir = @get_cfg_var
('open_basedir');
73 // If we are on a server with open_basedir, we must move the file
74 // before opening it. The doc explains how to create the "./tmp"
78 if (!empty($open_basedir)) {
80 $tmp_subdir = (PMA_IS_WINDOWS ?
'.\\tmp\\' : './tmp/');
82 // function is_writeable() is valid on PHP3 and 4
83 if (!is_writeable($tmp_subdir)) {
84 // if we cannot move the file don't change blob fields
87 $new_file_to_upload = $tmp_subdir . basename($file_to_upload);
88 if (PMA_PHP_INT_VERSION
< 40003) {
89 copy($file_to_upload, $new_file_to_upload);
91 move_uploaded_file($file_to_upload, $new_file_to_upload);
94 $file_to_upload = $new_file_to_upload;
99 if ($file_to_upload != '') {
101 $val = fread(fopen($file_to_upload, "rb"), filesize($file_to_upload));
103 $val = '0x' . bin2hex($val);
108 if ($unlink == TRUE) {
109 unlink($file_to_upload);
114 // garvin: else: Post-field contains no data. Blob-fields are preserved, see below. ($protected$)
119 // f i e l d v a l u e i n t h e f o r m
120 if (isset($fields_type[$encoded_key])) $type = $fields_type[$encoded_key];
122 switch (strtolower($val)) {
128 // if we have an enum, then construct the value
129 $f = 'field_' . md5($key);
131 $val = implode(',', $
$f);
132 if ($val == 'null') {
135 $val = "'" . PMA_sqlAddslashes(urldecode($val)) . "'";
142 // if we have a set, then construct the value
143 $f = 'field_' . md5($key);
145 $val = implode(',', $
$f);
146 $val = "'" . PMA_sqlAddslashes(urldecode($val)) . "'";
152 // if we have a foreign key, then construct the value
153 $f = 'field_' . md5($key);
155 $val = implode(',', $
$f);
156 if ($val == 'null') {
159 $val = "'" . PMA_sqlAddslashes(urldecode($val)) . "'";
166 // here we are in protected mode (asked in the config)
167 // so tbl_change has put this special value in the
168 // fields array, so we do not change the field value
169 // but we can still handle field upload
171 // garvin: when in UPDATE mode, do not alter field's contents. When in INSERT
172 // mode, insert empty field because no values were submitted. If protected
173 // blobs where set, insert original fields content.
174 if (isset($fieldlist)) {
175 if (isset($prot_row) && isset($prot_row[$key]) && !empty($prot_row[$key])) {
176 $val = '0x' . bin2hex($prot_row[$key]);
187 $val = "'" . PMA_sqlAddslashes($val) . "'";
192 $val = "'" . PMA_sqlAddslashes($val) . "'";
196 // Was the Null checkbox checked for this field?
197 // (if there is a value, we ignore the Null checkbox: this could
198 // be possible if Javascript is disabled in the browser)
199 if (isset($fields_null) && isset($fields_null[$encoded_key])
203 } // end else (field value in the form)