libraries/tbl_replace_fields.inc.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * handle field values (possibly uploaded from a file)
   5  *
   6  * original if-clause checked, whether input was stored in a possible
   7  * fields_upload_XX var. Now check, if the field is set. If it is empty or a
   8  * malicious file, do not alter fields contents. If an empty or invalid file is
   9  * specified, the binary data gets deleter. Maybe a nice new text-variable is
  10  * appropriate to document this behaviour.
  11  *
  12  * security cautions! You could trick the form and submit any file the
  13  * webserver has access to for upload to a binary field. Shouldn't be that easy! ;)
  14  *
  15  * default is to advance to the field-value parsing. Will only be set to
  16  * true when a binary file is uploaded, thus bypassing further manipulation of $val.
  17  *
  18  * note: grab_globals has extracted the fields from _FILES or HTTP_POST_FILES
  19  *
  20  * @version $Id$
  21  *
  22  * @uses $_REQUEST
  23  * @uses defined()
  24  * @uses define()
  25  * @uses bin2hex()
  26  * @uses strlen()
  27  * @uses md5()
  28  * @uses implode()
  29  * @uses PMA_NO_VARIABLES_IMPORT
  30  * @uses PMA_sqlAddslashes()
  31  * @package phpMyAdmin
  32  */
  33 if (! defined('PHPMYADMIN')) {
  34     exit;
  35 }
  36
  37 /**
  38  * do not import request variable into global scope
  39  */
  40 if (! defined('PMA_NO_VARIABLES_IMPORT')) {
  41     define('PMA_NO_VARIABLES_IMPORT', true);
  42 }
  43 /**
  44  * Gets some core libraries
  45  */
  46 require_once './libraries/common.inc.php';
  47 require_once './libraries/File.class.php';
  48
  49 $file_to_insert = new PMA_File();
  50 $file_to_insert->checkTblChangeForm($key, $rowcount);
  51
  52 $possibly_uploaded_val = $file_to_insert->getContent();
  53
  54 if ($file_to_insert->isError()) {
  55     $message .= $file_to_insert->getError();
  56 }
  57 $file_to_insert->cleanUp();
  58
  59 if (false !== $possibly_uploaded_val) {
  60     $val = $possibly_uploaded_val;
  61 } else {
  62
  63     // f i e l d    v a l u e    i n    t h e    f o r m
  64
  65     if (isset($me_fields_type[$key])) {
  66         $type = $me_fields_type[$key];
  67     } else {
  68         $type = '';
  69     }
  70
  71     // $key contains the md5() of the fieldname
  72     $f = 'field_' . $key;
  73
  74     if (0 === strlen($val)) {
  75         // default
  76         $val = "''";
  77
  78         switch ($type) {
  79             case 'enum':
  80                 // if we have an enum, then construct the value
  81             case 'set':
  82                 // if we have a set, then construct the value
  83             case 'foreign':
  84                 // if we have a foreign key, then construct the value
  85                 if (! empty($_REQUEST[$f]['multi_edit'][$rowcount])) {
  86                     $val = implode(',', $_REQUEST[$f]['multi_edit'][$rowcount]);
  87                     $val = "'" . PMA_sqlAddslashes($val) . "'";
  88                 }
  89                 break;
  90             case 'protected':
  91                 // here we are in protected mode (asked in the config)
  92                 // so tbl_change has put this special value in the
  93                 // fields array, so we do not change the field value
  94                 // but we can still handle field upload
  95
  96                 // when in UPDATE mode, do not alter field's contents. When in INSERT
  97                 // mode, insert empty field because no values were submitted. If protected
  98                 // blobs where set, insert original fields content.
  99                 if (! empty($prot_row[$me_fields_name[$key]])) {
 100                     $val = '0x' . bin2hex($prot_row[$me_fields_name[$key]]);
 101                 } else {
 102                     $val = '';
 103                 }
 104
 105                 break;
 106             default:
 107                 // best way to avoid problems in strict mode (works also in non-strict mode)
 108                 if (isset($me_auto_increment)  && isset($me_auto_increment[$key])) {
 109                     $val = 'NULL';
 110                 }
 111                 break;
 112         }
 113     } elseif ($type == 'bit') {
 114         $val = preg_replace('/[^01]/', '0', $val);
 115         $val = "b'" . PMA_sqlAddslashes($val) . "'";
 116     } elseif (! (($type == 'datetime' || $type == 'timestamp') && $val == 'CURRENT_TIMESTAMP')) {
 117         $val = "'" . PMA_sqlAddslashes($val) . "' /*" . $type . " */";
 118     }
 119
 120     // Was the Null checkbox checked for this field?
 121     // (if there is a value, we ignore the Null checkbox: this could
 122     // be possible if Javascript is disabled in the browser)
 123     if (isset($me_fields_null[$key])
 124      && ($val == "''" || $val == '')) {
 125         $val = 'NULL';
 126     }
 127
 128     // The Null checkbox was unchecked for this field
 129     if (empty($val) && isset($me_fields_null_prev[$key]) && ! isset($me_fields_null[$key])) {
 130         $val = "''";
 131     }
 132 }  // end else (field value in the form)
 133 unset($type, $f);
 134 ?>