libraries/grab_globals.lib.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * This library grabs the names and values of the variables sent or posted to a
   5  * script in $_GET, $_POST and $_FILES superglobals and sets simple globals
   6  * variables from them. It does the same work for $HTTP_ACCEPT_LANGUAGE and
   7  * $HTTP_AUTHORIZATION.
   8  *
   9  * @version $Id$
  10  * @package phpMyAdmin
  11  */
  12 if (! defined('PHPMYADMIN')) {
  13     exit;
  14 }
  15
  16 /**
  17  * copy values from one array to another, usually from a superglobal into $GLOBALS
  18  *
  19  * @uses    $GLOBALS['_import_blacklist']
  20  * @uses    preg_replace()
  21  * @uses    array_keys()
  22  * @uses    array_unique()
  23  * @uses    stripslashes()
  24  * @param   array   $array      values from
  25  * @param   array   $target     values to
  26  * @param   boolean $sanitize   prevent importing key names in $_import_blacklist
  27  */
  28 function PMA_recursive_extract($array, &$target, $sanitize = true)
  29 {
  30     if (! is_array($array)) {
  31         return false;
  32     }
  33
  34     if ($sanitize) {
  35         $valid_variables = preg_replace($GLOBALS['_import_blacklist'], '',
  36             array_keys($array));
  37         $valid_variables = array_unique($valid_variables);
  38     } else {
  39         $valid_variables = array_keys($array);
  40     }
  41
  42     foreach ($valid_variables as $key) {
  43
  44         if (strlen($key) === 0) {
  45             continue;
  46         }
  47
  48         if (is_array($array[$key])) {
  49             // there could be a variable coming from a cookie of
  50             // another application, with the same name as this array
  51             unset($target[$key]);
  52
  53             PMA_recursive_extract($array[$key], $target[$key], false);
  54         } else {
  55             $target[$key] = $array[$key];
  56         }
  57     }
  58     return true;
  59 }
  60
  61
  62 /**
  63  * @var array $_import_blacklist variable names that should NEVER be imported
  64  *                              from superglobals
  65  */
  66 $_import_blacklist = array(
  67     '/^cfg$/i',         // PMA configuration
  68     '/^server$/i',      // selected server
  69     '/^db$/i',          // page to display
  70     '/^table$/i',       // page to display
  71     '/^goto$/i',        // page to display
  72     '/^back$/i',        // the page go back
  73     '/^lang$/i',        // selected language
  74     '/^convcharset$/i', // PMA convert charset
  75     '/^collation_connection$/i', //
  76     '/^set_theme$/i',   //
  77     '/^sql_query$/i',   // the query to be executed
  78     '/^GLOBALS$/i',     // the global scope
  79     '/^str.*$/i',       // PMA localized strings
  80     '/^error_handler.*$/i',       // the error handler
  81     '/^_.*$/i',         // PMA does not use variables starting with _ from extern
  82     '/^.*\s+.*$/i',     // no whitespaces anywhere
  83     '/^[0-9]+.*$/i',    // numeric variable names
  84     //'/^PMA_.*$/i',      // other PMA variables
  85 );
  86
  87 if (! empty($_GET)) {
  88     PMA_recursive_extract($_GET, $GLOBALS);
  89 }
  90
  91 if (! empty($_POST)) {
  92     PMA_recursive_extract($_POST, $GLOBALS);
  93 }
  94
  95 if (! empty($_FILES)) {
  96     $_valid_variables = preg_replace($GLOBALS['_import_blacklist'], '', array_keys($_FILES));
  97     foreach ($_valid_variables as $name) {
  98         if (strlen($name) != 0) {
  99             $$name = $_FILES[$name]['tmp_name'];
 100             ${$name . '_name'} = $_FILES[$name]['name'];
 101         }
 102     }
 103     unset($name, $value);
 104 }
 105
 106 /**
 107  * globalize some environment variables
 108  */
 109 $server_vars = array('HTTP_ACCEPT_LANGUAGE', 'HTTP_AUTHORIZATION');
 110 foreach ($server_vars as $current) {
 111     // it's not important HOW we detect html tags
 112     // it's more important to prevent XSS
 113     // so it's not important if we result in an invalid string,
 114     // it's even better than a XSS capable string
 115     if (PMA_getenv($current) && false === strpos(PMA_getenv($current), '<')) {
 116         $$current = PMA_getenv($current);
 117     // already imported by register_globals?
 118     } elseif (! isset($$current) || false !== strpos($$current, '<')) {
 119         $$current = '';
 120     }
 121 }
 122 unset($server_vars, $current, $_import_blacklist);
 123
 124 ?>