tbl_replace_fields.php3

   1 <?php
   2 /* $Id$ */
   3 // vim: expandtab sw=4 ts=4 sts=4:
   4
   5 // note: grab_globals has extracted the fields from _FILES
   6 //       or HTTP_POST_FILES
   7
   8 // f i e l d    u p l o a d e d    f r o m    a    f i l e
   9
  10 // garvin: original if-clause checked, whether input was stored in a possible fields_upload_XX var.
  11 // Now check, if the field is set. If it is empty or a malicious file, do not alter fields contents.
  12 // If an empty or invalid file is specified, the binary data gets deleter. Maybe a nice
  13 // new text-variable is appropriate to document this behaviour.
  14
  15 // garvin: security cautions! You could trick the form and submit any file the webserver has access to
  16 // for upload to a binary field. Shouldn't be that easy! ;)
  17
  18 // garvin: default is to advance to the field-value parsing. Will only be set to true when a
  19 // binary file is uploaded, thus bypassing further manipulation of $val.
  20
  21 $check_stop = false;
  22 if (isset(${"fields_upload_" . $key}) && ${"fields_upload_" . $key} != 'none'){
  23     // garvin: This fields content is a blob-file upload.
  24
  25     if (!empty(${"fields_upload_" . $key})) {
  26         // garvin: The blob-field is not empty. Check what we have there.
  27
  28         $data_file = ${"fields_upload_" . $key};
  29
  30         if (is_uploaded_file($data_file)) {
  31             // garvin: A valid uploaded file is found. Look into the file...
  32
  33             $val = fread(fopen($data_file, "rb"), filesize($data_file));
  34             // nijel: This is probably the best way how to put binary data
  35             // into MySQL and it also allow not to care about charset
  36             // conversion that would otherwise corrupt the data.
  37
  38             if (!empty($val)) {
  39                 // garvin: The upload was valid. Check in new blob-field's contents.
  40                 $val = '0x' . bin2hex($val);
  41                 $seen_binary = TRUE;
  42                 $check_stop = TRUE;
  43             }
  44             // garvin: ELSE: an empty file was uploaded. Remove blob-field's contents.
  45             // Blob-fields are preserved, see below. ($protected$)
  46
  47         } else {
  48             // garvin: Danger, will robinson. File is malicious. Blob-fields are preserved, see below. ($protected$)
  49             // void
  50         }
  51
  52     } elseif (!empty(${'fields_uploadlocal_' . $key})) {
  53         $file_to_upload = $cfg['UploadDir'] . eregi_replace('\.\.*', '.', ${'fields_uploadlocal_' . $key});
  54
  55         // A local file will be uploaded.
  56         $open_basedir     = '';
  57         if (PMA_PHP_INT_VERSION >= 40000) {
  58             $open_basedir = @ini_get('open_basedir');
  59         }
  60         if (empty($open_basedir)) {
  61             $open_basedir = @get_cfg_var('open_basedir');
  62         }
  63
  64         // If we are on a server with open_basedir, we must move the file
  65         // before opening it. The doc explains how to create the "./tmp"
  66         // directory
  67
  68         $unlink = false;
  69         if (!empty($open_basedir)) {
  70
  71             $tmp_subdir = (PMA_IS_WINDOWS ? '.\\tmp\\' : './tmp/');
  72
  73             // function is_writeable() is valid on PHP3 and 4
  74             if (!is_writeable($tmp_subdir)) {
  75                 // if we cannot move the file don't change blob fields
  76                 $file_to_upload = '';
  77             } else {
  78                 $new_file_to_upload = $tmp_subdir . basename($file_to_upload);
  79                 if (PMA_PHP_INT_VERSION < 40003) {
  80                     copy($file_to_upload, $new_file_to_upload);
  81                 } else {
  82                     move_uploaded_file($file_to_upload, $new_file_to_upload);
  83                 }
  84
  85                 $file_to_upload = $new_file_to_upload;
  86                 $unlink = true;
  87             }
  88         }
  89
  90         if ($file_to_upload != '') {
  91
  92             $val = fread(fopen($file_to_upload, "rb"), filesize($file_to_upload));
  93             if (!empty($val)) {
  94                 $val = '0x' . bin2hex($val);
  95                 $seen_binary = TRUE;
  96                 $check_stop = TRUE;
  97             }
  98
  99             if ($unlink == TRUE) {
 100                 unlink($file_to_upload);
 101             }
 102         }
 103
 104     }
 105     // garvin: else: Post-field contains no data. Blob-fields are preserved, see below. ($protected$)
 106
 107 }
 108
 109 if (!$check_stop) {
 110 // f i e l d    v a l u e    i n    t h e    f o r m
 111     if (isset($fields_type[$key])) $type = $fields_type[$key];
 112     else $type = '';
 113     switch (strtolower($val)) {
 114         case 'null':
 115             break;
 116         case '':
 117             switch ($type) {
 118                 case 'enum':
 119                     // if we have an enum, then construct the value
 120                         $f = 'field_' . md5($key);
 121                         if (!empty($$f)) {
 122                             $val     = implode(',', $$f);
 123                             if ($val == 'null') {
 124                                 // void
 125                             } else {
 126                                 $val = "'" . PMA_sqlAddslashes(urldecode($val)) . "'";
 127                             }
 128                         } else {
 129                             $val     = "''";
 130                         }
 131                         break;
 132                 case 'set':
 133                     // if we have a set, then construct the value
 134                     $f = 'field_' . md5($key);
 135                     if (!empty($$f)) {
 136                         $val = implode(',', $$f);
 137                         $val = "'" . PMA_sqlAddslashes(urldecode($val)) . "'";
 138                     } else {
 139                         $val = "''";
 140                     }
 141                     break;
 142                 case 'foreign':
 143                     // if we have a foreign key, then construct the value
 144                     $f = 'field_' . md5($key);
 145                     if (!empty($$f)) {
 146                         $val     = implode(',', $$f);
 147                         if ($val == 'null') {
 148                             // void
 149                         } else {
 150                             $val = "'" . PMA_sqlAddslashes(urldecode($val)) . "'";
 151                         }
 152                     } else {
 153                         $val     = "''";
 154                     }
 155                     break;
 156                 case 'protected':
 157                     // here we are in protected mode (asked in the config)
 158                     // so tbl_change has put this special value in the
 159                     // fields array, so we do not change the field value
 160                     // but we can still handle field upload
 161
 162                     // garvin: when in UPDATE mode, do not alter field's contents. When in INSERT
 163                     // mode, insert empty field because no values were submitted.
 164                     if (isset($fieldlist)) {
 165                         $val = "''";
 166                     } else {
 167                         unset($val);
 168                     }
 169
 170                     break;
 171                 default:
 172                     $val = "'" . PMA_sqlAddslashes($val) . "'";
 173                     break;
 174             }
 175             break;
 176         default:
 177             $val = "'" . PMA_sqlAddslashes($val) . "'";
 178             break;
 179     } // end switch
 180
 181     // Was the Null checkbox checked for this field?
 182     // (if there is a value, we ignore the Null checkbox: this could
 183     // be possible if Javascript is disabled in the browser)
 184     if (isset($fields_null) && isset($fields_null[$encoded_key])
 185         && $val=="''") {
 186         $val = 'NULL';
 187     }
 188 }  // end else (field value in the form)
 189 ?>