tbl_replace_fields.php3

   1 <?php
   2 /* $Id$ */
   3 // vim: expandtab sw=4 ts=4 sts=4:
   4
   5 // note: grab_globals has extracted the fields from _FILES
   6 //       or HTTP_POST_FILES
   7
   8 // f i e l d    u p l o a d e d    f r o m    a    f i l e
   9
  10 // garvin: original if-clause checked, whether input was stored in a possible fields_upload_XX var.
  11 // Now check, if the field is set. If it is empty or a malicious file, do not alter fields contents.
  12 // If an empty or invalid file is specified, the binary data gets deleter. Maybe a nice
  13 // new text-variable is appropriate to document this behaviour.
  14
  15 // garvin: security cautions! You could trick the form and submit any file the webserver has access to
  16 // for upload to a binary field. Shouldn't be that easy! ;)
  17
  18 // garvin: default is to advance to the field-value parsing. Will only be set to true when a
  19 // binary file is uploaded, thus bypassing further manipulation of $val.
  20
  21 $check_stop = false;
  22 if (isset(${"fields_upload_" . $key}) && ${"fields_upload_" . $key} != 'none'){
  23     // garvin: This fields content is a blob-file upload.
  24
  25     if (!empty(${"fields_upload_" . $key})) {
  26         // garvin: The blob-field is not empty. Check what we have there.
  27
  28         $data_file = ${"fields_upload_" . $key};
  29
  30         if (is_uploaded_file($data_file)) {
  31             // garvin: A valid uploaded file is found. Look into the file...
  32
  33             $val = fread(fopen($data_file, "rb"), filesize($data_file));
  34             // nijel: This is probably the best way how to put binary data
  35             // into MySQL and it also allow not to care about charset
  36             // conversion that would otherwise corrupt the data.
  37
  38             if (!empty($val)) {
  39                 // garvin: The upload was valid. Check in new blob-field's contents.
  40                 $val = '0x' . bin2hex($val);
  41                 $seen_binary = TRUE;
  42                 $check_stop = TRUE;
  43             }
  44             // garvin: ELSE: an empty file was uploaded. Remove blob-field's contents.
  45             // Blob-fields are preserved, see below. ($protected$)
  46
  47         } else {
  48             // garvin: Danger, will robinson. File is malicious. Blob-fields are preserved, see below. ($protected$)
  49             // void
  50         }
  51
  52     }
  53     // garvin: else: Post-field contains no data. Blob-fields are preserved, see below. ($protected$)
  54
  55 }
  56
  57 if (!$check_stop) {
  58 // f i e l d    v a l u e    i n    t h e    f o r m
  59     if (isset($fields_type[$key])) $type = $fields_type[$key];
  60     else $type = '';
  61     switch (strtolower($val)) {
  62         case 'null':
  63             break;
  64         case '':
  65             switch ($type) {
  66                 case 'enum':
  67                     // if we have an enum, then construct the value
  68                         $f = 'field_' . md5($key);
  69                         if (!empty($$f)) {
  70                             $val     = implode(',', $$f);
  71                             if ($val == 'null') {
  72                                 // void
  73                             } else {
  74                                 $val = "'" . PMA_sqlAddslashes(urldecode($val)) . "'";
  75                             }
  76                         } else {
  77                             $val     = "''";
  78                         }
  79                         break;
  80                 case 'set':
  81                     // if we have a set, then construct the value
  82                     $f = 'field_' . md5($key);
  83                     if (!empty($$f)) {
  84                         $val = implode(',', $$f);
  85                         $val = "'" . PMA_sqlAddslashes(urldecode($val)) . "'";
  86                     } else {
  87                         $val = "''";
  88                     }
  89                     break;
  90                 case 'foreign':
  91                     // if we have a foreign key, then construct the value
  92                     $f = 'field_' . md5($key);
  93                     if (!empty($$f)) {
  94                         $val     = implode(',', $$f);
  95                         if ($val == 'null') {
  96                             // void
  97                         } else {
  98                             $val = "'" . PMA_sqlAddslashes(urldecode($val)) . "'";
  99                         }
 100                     } else {
 101                         $val     = "''";
 102                     }
 103                     break;
 104                 case 'protected':
 105                     // here we are in protected mode (asked in the config)
 106                     // so tbl_change has put this special value in the
 107                     // fields array, so we do not change the field value
 108                     // but we can still handle field upload
 109
 110                     // garvin: when in UPDATE mode, do not alter field's contents. When in INSERT
 111                     // mode, insert empty field because no values were submitted.
 112                     if (isset($fieldlist)) {
 113                         $val = "''";
 114                     } else {
 115                         unset($val);
 116                     }
 117
 118                     break;
 119                 default:
 120                     $val = "'" . PMA_sqlAddslashes($val) . "'";
 121                     break;
 122             }
 123             break;
 124         default:
 125             $val = "'" . PMA_sqlAddslashes($val) . "'";
 126             break;
 127     } // end switch
 128
 129     // Was the Null checkbox checked for this field?
 130     // (if there is a value, we ignore the Null checkbox: this could
 131     // be possible if Javascript is disabled in the browser)
 132     if (isset($fields_null) && isset($fields_null[$encoded_key])
 133         && $val=="''") {
 134         $val = 'NULL';
 135     }
 136 }  // end else (field value in the form)
 137 ?>