Skip to content

Commit

Permalink
Merge branch 'QA_3_4'
Browse files Browse the repository at this point in the history
  • Loading branch information
Marc Delisle committed Aug 24, 2011
2 parents df4f5b7 + 3b75f54 commit 4d2521a
Show file tree
Hide file tree
Showing 3 changed files with 57 additions and 34 deletions.
1 change: 1 addition & 0 deletions export.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -346,6 +346,7 @@ function PMA_exportOutputHandler($line)
// (avoid rewriting data containing HTML with anchors and forms;
// this was reported to happen under Plesk)
@ini_set('url_rewriter.tags','');
$filename = PMA_sanitize_filename($filename);

PMA_download_header($filename, $mime_type);
} else {
Expand Down
18 changes: 18 additions & 0 deletions libraries/sanitizing.lib.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -129,4 +129,22 @@ function PMA_sanitize($message, $escape = false, $safe = false)

return $message;
}


/**
* Sanitize a filename by removing anything besides A-Za-z0-9_.-
*
* Intended usecase:
* When using a filename in a Content-Disposition header the value should not contain ; or "
*
* @param string The filename
*
* @return string the sanitized filename
*
*/
function PMA_sanitize_filename($filename) {
$filename = preg_replace('/[^A-Za-z0-9_.-]/', '_', $filename);
return $filename;
}

?>
72 changes: 38 additions & 34 deletions tbl_tracking.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -271,17 +271,17 @@ function PMA_filter_tracking($data, $filter_ts_from, $filter_ts_to, $filter_user
<tr class="noclick <?php echo $style; ?>">
<?php
if ($field['Key'] == 'PRI') {
echo '<td><b><u>' . $field['Field'] . '</u></b></td>' . "\n";
echo '<td><b><u>' . htmlspecialchars($field['Field']) . '</u></b></td>' . "\n";
} else {
echo '<td><b>' . $field['Field'] . '</b></td>' . "\n";
echo '<td><b>' . htmlspecialchars($field['Field']) . '</b></td>' . "\n";
}
?>
<td><?php echo $field['Type'];?></td>
<td><?php echo $field['Collation'];?></td>
<td><?php echo $field['Null'];?></td>
<td><?php echo $field['Default'];?></td>
<td><?php echo $field['Extra'];?></td>
<td><?php echo $field['Comment'];?></td>
<td><?php echo htmlspecialchars($field['Type']);?></td>
<td><?php echo htmlspecialchars($field['Collation']);?></td>
<td><?php echo htmlspecialchars($field['Null']);?></td>
<td><?php echo htmlspecialchars($field['Default']);?></td>
<td><?php echo htmlspecialchars($field['Extra']);?></td>
<td><?php echo htmlspecialchars($field['Comment']);?></td>
</tr>
<?php
if ($style == 'even') {
Expand Down Expand Up @@ -327,15 +327,15 @@ function PMA_filter_tracking($data, $filter_ts_from, $filter_ts_to, $filter_user
}
?>
<tr class="noclick <?php echo $style; ?>">
<td><b><?php echo $index['Key_name'];?></b></td>
<td><?php echo $index['Index_type'];?></td>
<td><b><?php echo htmlspecialchars($index['Key_name']);?></b></td>
<td><?php echo htmlspecialchars($index['Index_type']);?></td>
<td><?php echo $str_unique;?></td>
<td><?php echo $str_packed;?></td>
<td><?php echo $index['Column_name'];?></td>
<td><?php echo $index['Cardinality'];?></td>
<td><?php echo $index['Collation'];?></td>
<td><?php echo $index['Null'];?></td>
<td><?php echo $index['Comment'];?></td>
<td><?php echo htmlspecialchars($index['Column_name']);?></td>
<td><?php echo htmlspecialchars($index['Cardinality']);?></td>
<td><?php echo htmlspecialchars($index['Collation']);?></td>
<td><?php echo htmlspecialchars($index['Null']);?></td>
<td><?php echo htmlspecialchars($index['Comment']);?></td>
</tr>
<?php
if ($style == 'even') {
Expand Down Expand Up @@ -399,20 +399,20 @@ function PMA_filter_tracking($data, $filter_ts_from, $filter_ts_to, $filter_user
?>
<h3><?php echo __('Tracking report');?> [<a href="tbl_tracking.php?<?php echo $url_query;?>"><?php echo __('Close');?></a>]</h3>

<small><?php echo __('Tracking statements') . ' ' . $data['tracking']; ?></small><br/>
<small><?php echo __('Tracking statements') . ' ' . htmlspecialchars($data['tracking']); ?></small><br/>
<br/>

<form method="post" action="tbl_tracking.php?<?php echo $url_query; ?>&amp;report=true&amp;version=<?php echo $_REQUEST['version'];?>">
<form method="post" action="tbl_tracking.php<?php echo PMA_generate_common_url($url_params + array('report' => 'true', 'version' => $_REQUEST['version'])); ?>">
<?php

$str1 = '<select name="logtype">' .
'<option value="schema"' . ($selection_schema ? ' selected="selected"' : '') . '>' . __('Structure only') . '</option>' .
'<option value="data"' . ($selection_data ? ' selected="selected"' : ''). '>' . __('Data only') . '</option>' .
'<option value="schema_and_data"' . ($selection_both ? ' selected="selected"' : '') . '>' . __('Structure and data') . '</option>' .
'</select>';
$str2 = '<input type="text" name="date_from" value="' . $_REQUEST['date_from'] . '" size="19" />';
$str3 = '<input type="text" name="date_to" value="' . $_REQUEST['date_to'] . '" size="19" />';
$str4 = '<input type="text" name="users" value="' . $_REQUEST['users'] . '" />';
$str2 = '<input type="text" name="date_from" value="' . htmlspecialchars($_REQUEST['date_from']) . '" size="19" />';
$str3 = '<input type="text" name="date_to" value="' . htmlspecialchars($_REQUEST['date_to']) . '" size="19" />';
$str4 = '<input type="text" name="users" value="' . htmlspecialchars($_REQUEST['users']) . '" />';
$str5 = '<input type="submit" name="list_report" value="' . __('Go') . '" />';

printf(__('Show %s with dates from %s to %s by user %s %s'), $str1, $str2, $str3, $str4, $str5);
Expand Down Expand Up @@ -464,8 +464,8 @@ function PMA_filter_tracking($data, $filter_ts_from, $filter_ts_to, $filter_user
?>
<tr class="noclick <?php echo $style; ?>">
<td><small><?php echo $i;?></small></td>
<td><small><?php echo $entry['date'];?></small></td>
<td><small><?php echo $entry['username']; ?></small></td>
<td><small><?php echo htmlspecialchars($entry['date']);?></small></td>
<td><small><?php echo htmlspecialchars($entry['username']); ?></small></td>
<td><?php echo $statement; ?></td>
<td nowrap="nowrap"><a href="tbl_tracking.php?<?php echo $url_query;?>&amp;report=true&amp;version=<?php echo $version['version'];?>&amp;delete_ddlog=<?php echo $i-1; ?>"><?php echo $drop_image_or_text; ?></a></td>
</tr>
Expand Down Expand Up @@ -520,8 +520,8 @@ function PMA_filter_tracking($data, $filter_ts_from, $filter_ts_to, $filter_user
?>
<tr class="noclick <?php echo $style; ?>">
<td><small><?php echo $i; ?></small></td>
<td><small><?php echo $entry['date']; ?></small></td>
<td><small><?php echo $entry['username']; ?></small></td>
<td><small><?php echo htmlspecialchars($entry['date']); ?></small></td>
<td><small><?php echo htmlspecialchars($entry['username']); ?></small></td>
<td><?php echo $statement; ?></td>
<td nowrap="nowrap"><a href="tbl_tracking.php?<?php echo $url_query;?>&amp;report=true&amp;version=<?php echo $version['version'];?>&amp;delete_dmlog=<?php echo $i-$ddlog_count; ?>"><?php echo $drop_image_or_text; ?></a></td>
</tr>
Expand All @@ -541,7 +541,7 @@ function PMA_filter_tracking($data, $filter_ts_from, $filter_ts_to, $filter_user
}
?>
</form>
<form method="post" action="tbl_tracking.php?<?php echo $url_query; ?>&amp;report=true&amp;version=<?php echo $_REQUEST['version'];?>">
<form method="post" action="tbl_tracking.php<?php echo PMA_generate_common_url($url_params + array('report' => 'true', 'version' => $_REQUEST['version'])); ?>">
<?php
printf(__('Show %s with dates from %s to %s by user %s %s'), $str1, $str2, $str3, $str4, $str5);

Expand All @@ -554,11 +554,11 @@ function PMA_filter_tracking($data, $filter_ts_from, $filter_ts_to, $filter_user
$str_export2 = '<input type="submit" name="report_export" value="' . __('Go') .'" />';
?>
</form>
<form method="post" action="tbl_tracking.php?<?php echo $url_query; ?>&amp;report=true&amp;version=<?php echo $_REQUEST['version'];?>">
<input type="hidden" name="logtype" value="<?php echo $_REQUEST['logtype'];?>" />
<input type="hidden" name="date_from" value="<?php echo $_REQUEST['date_from'];?>" />
<input type="hidden" name="date_to" value="<?php echo $_REQUEST['date_to'];?>" />
<input type="hidden" name="users" value="<?php echo $_REQUEST['users'];?>" />
<form method="post" action="tbl_tracking.php<?php echo PMA_generate_common_url($url_params + array('report' => 'true', 'version' => $_REQUEST['version'])); ?>">
<input type="hidden" name="logtype" value="<?php echo htmlspecialchars($_REQUEST['logtype']);?>" />
<input type="hidden" name="date_from" value="<?php echo htmlspecialchars($_REQUEST['date_from']);?>" />
<input type="hidden" name="date_to" value="<?php echo htmlspecialchars($_REQUEST['date_to']);?>" />
<input type="hidden" name="users" value="<?php echo htmlspecialchars($_REQUEST['users']);?>" />
<?php
echo "<br/>" . sprintf(__('Export as %s'), $str_export1) . $str_export2 . "<br/>";
?>
Expand Down Expand Up @@ -660,11 +660,15 @@ function PMA_filter_tracking($data, $filter_ts_from, $filter_ts_to, $filter_user
<tr class="noclick <?php echo $style;?>">
<td><?php echo htmlspecialchars($version['db_name']);?></td>
<td><?php echo htmlspecialchars($version['table_name']);?></td>
<td><?php echo $version['version'];?></td>
<td><?php echo $version['date_created'];?></td>
<td><?php echo $version['date_updated'];?></td>
<td><?php echo htmlspecialchars($version['version']);?></td>
<td><?php echo htmlspecialchars($version['date_created']);?></td>
<td><?php echo htmlspecialchars($version['date_updated']);?></td>
<td><?php echo $version_status;?></td>
<td> <a href="tbl_tracking.php?<?php echo $url_query;?>&amp;report=true&amp;version=<?php echo $version['version'];?>"><?php echo __('Tracking report');?></a> | <a href="tbl_tracking.php?<?php echo $url_query;?>&amp;snapshot=true&amp;version=<?php echo $version['version'];?>"><?php echo __('Structure snapshot');?></a></td>
<td> <a href="tbl_tracking.php<?php echo PMA_generate_common_url($url_params + array('report' => 'true', 'version' => $version['version'])
);?>"><?php echo __('Tracking report');?></a>
| <a href="tbl_tracking.php<?php echo PMA_generate_common_url($url_params + array('snapshot' => 'true', 'version' => $version['version'])
);?>"><?php echo __('Structure snapshot');?></a>
</td>
</tr>
<?php
if ($style == 'even') {
Expand Down

0 comments on commit 4d2521a

Please sign in to comment.