lang
[phpmyadmin/crack.git] / tbl_replace_fields.php3
blobb4b6a6e7e9a4fc2881ee96b810e0b249c40ebb73
1 <?php
2 /* $Id$ */
3 // vim: expandtab sw=4 ts=4 sts=4:
5 // note: grab_globals has extracted the fields from _FILES
6 // or HTTP_POST_FILES
8 // f i e l d u p l o a d e d f r o m a f i l e
10 // garvin: original if-clause checked, whether input was stored in a possible fields_upload_XX var.
11 // Now check, if the field is set. If it is empty or a malicious file, do not alter fields contents.
12 // If an empty or invalid file is specified, the binary data gets deleter. Maybe a nice
13 // new text-variable is appropriate to document this behaviour.
15 // garvin: security cautions! You could trick the form and submit any file the webserver has access to
16 // for upload to a binary field. Shouldn't be that easy! ;)
18 // garvin: default is to advance to the field-value parsing. Will only be set to true when a
19 // binary file is uploaded, thus bypassing further manipulation of $val.
21 $check_stop = false;
22 if (isset(${"fields_upload_" . $key}) && ${"fields_upload_" . $key} != 'none'){
23 // garvin: This fields content is a blob-file upload.
25 if (!empty(${"fields_upload_" . $key})) {
26 // garvin: The blob-field is not empty. Check what we have there.
28 $data_file = ${"fields_upload_" . $key};
30 if (is_uploaded_file($data_file)) {
31 // garvin: A valid uploaded file is found. Look into the file...
33 $val = fread(fopen($data_file, "rb"), filesize($data_file));
34 // nijel: This is probably the best way how to put binary data
35 // into MySQL and it also allow not to care about charset
36 // conversion that would otherwise corrupt the data.
38 if (!empty($val)) {
39 // garvin: The upload was valid. Check in new blob-field's contents.
40 $val = '0x' . bin2hex($val);
41 $seen_binary = TRUE;
42 $check_stop = TRUE;
44 // garvin: ELSE: an empty file was uploaded. Remove blob-field's contents.
45 // Blob-fields are preserved, see below. ($protected$)
47 } else {
48 // garvin: Danger, will robinson. File is malicious. Blob-fields are preserved, see below. ($protected$)
49 // void
52 } elseif (!empty(${'fields_uploadlocal_' . $key})) {
53 $file_to_upload = $cfg['UploadDir'] . eregi_replace('\.\.*', '.', ${'fields_uploadlocal_' . $key});
55 // A local file will be uploaded.
56 $open_basedir = '';
57 if (PMA_PHP_INT_VERSION >= 40000) {
58 $open_basedir = @ini_get('open_basedir');
60 if (empty($open_basedir)) {
61 $open_basedir = @get_cfg_var('open_basedir');
64 // If we are on a server with open_basedir, we must move the file
65 // before opening it. The doc explains how to create the "./tmp"
66 // directory
68 $unlink = false;
69 if (!empty($open_basedir)) {
71 $tmp_subdir = (PMA_IS_WINDOWS ? '.\\tmp\\' : './tmp/');
73 // function is_writeable() is valid on PHP3 and 4
74 if (!is_writeable($tmp_subdir)) {
75 // if we cannot move the file don't change blob fields
76 $file_to_upload = '';
77 } else {
78 $new_file_to_upload = $tmp_subdir . basename($file_to_upload);
79 if (PMA_PHP_INT_VERSION < 40003) {
80 copy($file_to_upload, $new_file_to_upload);
81 } else {
82 move_uploaded_file($file_to_upload, $new_file_to_upload);
85 $file_to_upload = $new_file_to_upload;
86 $unlink = true;
90 if ($file_to_upload != '') {
92 $val = fread(fopen($file_to_upload, "rb"), filesize($file_to_upload));
93 if (!empty($val)) {
94 $val = '0x' . bin2hex($val);
95 $seen_binary = TRUE;
96 $check_stop = TRUE;
99 if ($unlink == TRUE) {
100 unlink($file_to_upload);
105 // garvin: else: Post-field contains no data. Blob-fields are preserved, see below. ($protected$)
109 if (!$check_stop) {
110 // f i e l d v a l u e i n t h e f o r m
111 if (isset($fields_type[$key])) $type = $fields_type[$key];
112 else $type = '';
113 switch (strtolower($val)) {
114 case 'null':
115 break;
116 case '':
117 switch ($type) {
118 case 'enum':
119 // if we have an enum, then construct the value
120 $f = 'field_' . md5($key);
121 if (!empty($$f)) {
122 $val = implode(',', $$f);
123 if ($val == 'null') {
124 // void
125 } else {
126 $val = "'" . PMA_sqlAddslashes(urldecode($val)) . "'";
128 } else {
129 $val = "''";
131 break;
132 case 'set':
133 // if we have a set, then construct the value
134 $f = 'field_' . md5($key);
135 if (!empty($$f)) {
136 $val = implode(',', $$f);
137 $val = "'" . PMA_sqlAddslashes(urldecode($val)) . "'";
138 } else {
139 $val = "''";
141 break;
142 case 'foreign':
143 // if we have a foreign key, then construct the value
144 $f = 'field_' . md5($key);
145 if (!empty($$f)) {
146 $val = implode(',', $$f);
147 if ($val == 'null') {
148 // void
149 } else {
150 $val = "'" . PMA_sqlAddslashes(urldecode($val)) . "'";
152 } else {
153 $val = "''";
155 break;
156 case 'protected':
157 // here we are in protected mode (asked in the config)
158 // so tbl_change has put this special value in the
159 // fields array, so we do not change the field value
160 // but we can still handle field upload
162 // garvin: when in UPDATE mode, do not alter field's contents. When in INSERT
163 // mode, insert empty field because no values were submitted.
164 if (isset($fieldlist)) {
165 $val = "''";
166 } else {
167 unset($val);
170 break;
171 default:
172 $val = "'" . PMA_sqlAddslashes($val) . "'";
173 break;
175 break;
176 default:
177 $val = "'" . PMA_sqlAddslashes($val) . "'";
178 break;
179 } // end switch
181 // Was the Null checkbox checked for this field?
182 // (if there is a value, we ignore the Null checkbox: this could
183 // be possible if Javascript is disabled in the browser)
184 if (isset($fields_null) && isset($fields_null[$encoded_key])
185 && $val=="''") {
186 $val = 'NULL';
188 } // end else (field value in the form)