Some bad escaped variables found on my way

diff --git a/classes/Misc.php b/classes/Misc.php
index 1d459fa2f17a2c9d6724c31d5ca4cd6b3ca9173e..d5e78bd81b590be5af007a46313d5b426cf1239e 100644 (file)
--- a/classes/Misc.php
+++ b/classes/Misc.php
@@ -277,6 +277,15 @@
                        if (is_array($var)) {
                                foreach($var as $k => $v) {
                                        $this->stripVar($var[$k]);
+
+                                       /* magic_quotes_gpc escape keys as well ...*/
+                                       if (is_string($k)) {
+                                               $ek = stripslashes($k);
+                                               if ($ek !== $k) {
+                                                       $var[$ek] = $var[$k];
+                                                       unset($var[$k]);
+                                               }
+                                       }
                                }
                        }
                        else
@@ -1299,20 +1308,20 @@
                        if ($subject == 'slony_cluster') $done = true;
 
                        if (isset($_REQUEST['table']) && !$done) {
-                               $vars .= "subject=table&table=".urlencode($_REQUEST['table']);
+                               $vars .= "table=".urlencode($_REQUEST['table']);
                                $trail['table'] = array(
                                        'title' => $lang['strtable'],
                                        'text'  => $_REQUEST['table'],
-                                       'url'   => "redirect.php?{$vars}",
+                                       'url'   => "redirect.php?subject=table&{$vars}",
                                        'help'  => 'pg.table',
                                        'icon'  => 'Table'
                                );
                        } elseif (isset($_REQUEST['view']) && !$done) {
-                               $vars .= "subject=view&view=".urlencode($_REQUEST['view']);
+                               $vars .= "view=".urlencode($_REQUEST['view']);
                                $trail['view'] = array(
                                        'title' => $lang['strview'],
                                        'text'  => $_REQUEST['view'],
-                                       'url'   => "redirect.php?{$vars}",
+                                       'url'   => "redirect.php?subject=view&{$vars}",
                                        'help'  => 'pg.view',
                                        'icon'  => 'View'
                                );
@@ -1374,7 +1383,7 @@
                                                );
                                                break;
                                        case 'column':
-                                               $vars .= "&column={$_REQUEST['column']}&subject=column";
+                                               $vars .= "&column=". urlencode($_REQUEST['column']) ."&subject=column";
                                                $trail['column'] = array (
                                                        'title' => $lang['strcolumn'],
                                                        'text'  => $_REQUEST['column'],

diff --git a/classes/database/Postgres.php b/classes/database/Postgres.php
index 29f07afc1947bb404d53a80115264a2a359633ec..14c52e9733b4c6aa42234630faa96b005d5e0dec 100755 (executable)
--- a/classes/database/Postgres.php
+++ b/classes/database/Postgres.php
@@ -3199,7 +3199,6 @@ class Postgres extends ADODB_base {
         */
        function alterView($view, $name, $owner, $schema, $comment) {
 
-               $this->fieldClean($view);
                $data = $this->getView($view);
                if ($data->recordCount() != 1)
                        return -2;
@@ -3718,16 +3717,20 @@ class Postgres extends ADODB_base {
        function getLinkingKeys($tables) {
                if (!is_array($tables)) return -1;
                
+               $this->clean($tables[0]['tablename']);
+               $this->clean($tables[0]['schemaname']);
                $tables_list = "'{$tables[0]['tablename']}'";
                $schema_list = "'{$tables[0]['schemaname']}'";
                $schema_tables_list = "'{$tables[0]['schemaname']}.{$tables[0]['tablename']}'";
 
                for ($i = 1; $i < sizeof($tables); $i++) {
+                       $this->clean($tables[$i]['tablename']);
+                       $this->clean($tables[$i]['schemaname']);
                        $tables_list .= ", '{$tables[$i]['tablename']}'";
                        $schema_list .= ", '{$tables[$i]['schemaname']}'";
                        $schema_tables_list .= ", '{$tables[$i]['schemaname']}.{$tables[$i]['tablename']}'";
                }
-               echo "<pre>", print_r(array($tables_list, $schema_list), 1), "</pre>";
+
                $maxDimension = 1;
 
                $sql = "
@@ -7631,8 +7634,9 @@ class Postgres extends ADODB_base {
                $this->fieldClean($table);
 
                if (isset($_REQUEST['schema'])) {
-                       $this->fieldClean($_REQUEST['schema']);
-                       $sql .= "\"{$_REQUEST['schema']}\".";
+                       $f_schema = $_REQUEST['schema'];
+                       $this->fieldClean($f_schema);
+                       $sql .= "\"{$f_schema}\".";
                }
                $sql .= "\"{$table}\"";
 

diff --git a/colproperties.php b/colproperties.php
index 00ce9d122ce5202dead356b662c3e43a0016c318..9aa7f7293d6d9b23f084b7936e53a1cdfe9f2312 100644 (file)
--- a/colproperties.php
+++ b/colproperties.php
@@ -231,26 +231,40 @@
                        echo "<br />\n";
 
                        echo "<ul class=\"navlink\">\n";
+                       $f_attname = $_REQUEST['column'];
+                       $f_table = $tableName;
+                       $f_schema = $data->_schema;
+                       $data->fieldClean($f_attname);
+                       $data->fieldClean($f_table);
+                       $data->fieldClean($f_schema);
+                       $query_url = urlencode("SELECT \"{$f_attname}\", count(*) AS \"count\" FROM \"{$f_schema}\".\"{$f_table}\" GROUP BY \"{$f_attname}\" ORDER BY \"{$f_attname}\"") ;
+
                        if ($isTable) {
-                               $return_url = urlencode("colproperties.php?{$misc->href}&amp;table=$tableName&amp;column={$_REQUEST['column']}");
+                               $return_url = urlencode("colproperties.php?{$misc->href}&amp;table=". urlencode($tableName)
+                                       ."&amp;column=". urlencode($_REQUEST['column']));
 
                                /* Browse link */
-                               echo "\t<li><a href=\"display.php?{$misc->href}&amp;subject=column&amp;table=", urlencode($_REQUEST['table']), "&amp;column=",
-                                       urlencode($_REQUEST['column']), "&amp;return_url={$return_url}&amp;return_desc=", urlencode($lang['strback']), "&amp;query=", 
-                                       urlencode("SELECT \"{$_REQUEST['column']}\", count(*) AS \"count\" FROM \"{$data->_schema}\".\"$tableName\" GROUP BY \"{$_REQUEST['column']}\" ORDER BY \"{$_REQUEST['column']}\"") , "\">{$lang['strbrowse']}</a></li>\n";
+                               /* FIXME browsing a col should somehow be a action so we don't
+                                * send an ugly SQL in the URL */
+                               echo "\t<li><a href=\"display.php?{$misc->href}&amp;subject=column&amp;table=",
+                                       urlencode($_REQUEST['table']),
+                                       "&amp;column=", urlencode($_REQUEST['column']),
+                                       "&amp;return_url={$return_url}&amp;return_desc=", urlencode($lang['strback']), 
+                                       "&amp;query={$query_url}\">{$lang['strbrowse']}</a></li>\n";
 
                                /* Edit link */
-                               echo "\t<li><a href=\"colproperties.php?action=properties&amp;{$misc->href}&amp;table=", urlencode($_REQUEST['table']),
+                               echo "\t<li><a href=\"colproperties.php?action=properties&amp;{$misc->href}&amp;table=", urlencode($tableName),
                                    "&amp;column=", urlencode($_REQUEST['column']) . "\">{$lang['stralter']}</a></li>\n";
                                
-                                       echo "\t<li><a href=\"tblproperties.php?action=confirm_drop&amp;{$misc->href}&amp;table=", urlencode($_REQUEST['table']),
+                                       echo "\t<li><a href=\"tblproperties.php?action=confirm_drop&amp;{$misc->href}&amp;table=", urlencode($tableName),
                                                "&amp;column=" . urlencode($_REQUEST['column']) . "\">{$lang['strdrop']}</a></li>\n";
                        } else {
-                               $return_url = urlencode("colproperties.php?{$misc->href}&amp;view=$tableName&amp;column={$_REQUEST['column']}");
+                               $return_url = urlencode("colproperties.php?{$misc->href}&amp;view=". urlencode($tableName)
+                                       ."&amp;column=". urlencode($_REQUEST['column']));
                                /* Browse link */
                                echo "\t<li><a href=\"display.php?{$misc->href}&amp;subject=column&amp;column=",
-                                       urlencode($_REQUEST['column']), "&amp;return_url={$return_url}&amp;return_desc=", urlencode($lang['strback']), "&amp;query=",
-                                       urlencode("SELECT \"{$_REQUEST['column']}\", count(*) AS \"count\" FROM \"$tableName\" GROUP BY \"{$_REQUEST['column']}\" ORDER BY \"{$_REQUEST['column']}\"") , "\">{$lang['strbrowse']}</a></li>\n";
+                                       urlencode($_REQUEST['column']), "&amp;return_url={$return_url}&amp;return_desc=", urlencode($lang['strback']),
+                                       "&amp;query={$query_url}\">{$lang['strbrowse']}</a></li>\n";
                        }
 
                        echo "</ul>\n";

diff --git a/privileges.php b/privileges.php
index d703907acb34ec63eca81d65231c465dfbade2b3..451bb2dc031ec80245cf0b8f0e9943455a50dc37 100644 (file)
--- a/privileges.php
+++ b/privileges.php
@@ -250,7 +250,7 @@
                
                if ($_REQUEST['subject'] == 'function') {
                        $objectoid = $_REQUEST[$_REQUEST['subject'].'_oid'];
-                       $alterurl = "privileges.php?action=alter&{$misc->href}&{$subject}={$object}&{$subject}_oid=$objectoid&subject={$subject}&mode=";
+                       $alterurl = "privileges.php?action=alter&{$misc->href}&{$subject}={$object}&{$subject}_oid={$objectoid}&subject={$subject}&mode=";
                }
                else if ($_REQUEST['subject'] == 'column') {
                        $alterurl = "privileges.php?action=alter&{$misc->href}&{$subject}={$object}"

diff --git a/tblproperties.php b/tblproperties.php
index 2136a7d04d763d65ca149686b34bc1a5f09424be..2b98efc8d0c458f23539d0748761b2dce9c1bf2e 100644 (file)
--- a/tblproperties.php
+++ b/tblproperties.php
@@ -443,7 +443,13 @@
                function attPre(&$rowdata, $actions) {
                        global $data;
                        $rowdata->fields['+type'] = $data->formatType($rowdata->fields['type'], $rowdata->fields['atttypmod']);
-                       $actions['browse']['url'] .= 'query=' . urlencode("SELECT \"{$rowdata->fields['attname']}\", count(*) AS \"count\" FROM \"{$_REQUEST['table']}\" GROUP BY \"{$rowdata->fields['attname']}\" ORDER BY \"{$rowdata->fields['attname']}\"") . '&';
+                       $attname = $rowdata->fields['attname'];
+                       $table = $_REQUEST['table'];
+                       $data->fieldClean($attname);
+                       $data->fieldClean($table);
+
+                       $actions['browse']['url'] .= 'query=' . urlencode("SELECT \"{$attname}\", count(*) AS \"count\"
+                               FROM \"{$table}\" GROUP BY \"{$attname}\" ORDER BY \"{$attname}\"") . '&';
                        return $actions;
                }
 
@@ -515,19 +521,19 @@
                                if ($c['p_field'] == $s)
                                        switch ($c['contype']) {
                                                case 'p':
-                                                       $str .= '<a href="constraints.php?'. $misc->href ."&amp;table={$c['p_table']}&amp;schema={$c['p_schema']}\"><img src=\"".
+                                                       $str .= '<a href="constraints.php?'. $misc->href ."&amp;table=". urlencode($c['p_table']) ."&amp;schema=". urlencode($c['p_schema']) ."\"><img src=\"".
                                                                $misc->icon('PrimaryKey') .'" alt="[pk]" title="'. htmlentities($c['consrc']) .'" /></a>';
                                                break;
                                                case 'f':
-                                                       $str .= '<a href="tblproperties.php?'. $misc->href ."&amp;table={$c['f_table']}&amp;schema={$c['f_schema']}\"><img src=\"".
+                                                       $str .= '<a href="tblproperties.php?'. $misc->href ."&amp;table=". urlencode($c['f_table']) ."&amp;schema=". urlencode($c['f_schema']) ."\"><img src=\"".
                                                                $misc->icon('ForeignKey') .'" alt="[fk]" title="'. htmlentities($c['consrc']) .'" /></a>';
                                                break;
                                                case 'u':
-                                                       $str .= '<a href="constraints.php?'. $misc->href ."&amp;table={$c['p_table']}&amp;schema={$c['p_schema']}\"><img src=\"".
+                                                       $str .= '<a href="constraints.php?'. $misc->href ."&amp;table=". urlencode($c['p_table']) ."&amp;schema=". urlencode($c['p_schema']) ."\"><img src=\"".
                                                                $misc->icon('UniqueConstraint') .'" alt="[uniq]" title="'. htmlentities($c['consrc']) .'" /></a>';
                                                break;
                                                case 'c':
-                                                       $str .= '<a href="constraints.php?'. $misc->href ."&amp;table={$c['p_table']}&amp;schema={$c['p_schema']}\"><img src=\"".
+                                                       $str .= '<a href="constraints.php?'. $misc->href ."&amp;table=". urlencode($c['p_table']) ."&amp;schema=". urlencode($c['p_schema']) ."\"><img src=\"".
                                                                $misc->icon('CheckConstraint') .'" alt="[check]" title="'. htmlentities($c['consrc']) .'" /></a>';
                                        }
                        }
@@ -535,7 +541,7 @@
                        return $str;
                }
 
-               $return_url = urlencode("tblproperties.php?{$misc->href}&amp;table={$_REQUEST['table']}");
+               $return_url = urlencode("tblproperties.php?{$misc->href}&amp;table=". urlencode($_REQUEST['table']));
 
                $actions = array(
                        'browse' => array(

diff --git a/views.php b/views.php
index c39e8e8bdec91276a5daf2aee777dea1487c0e5c..e784103136241de0fb1e3e0779e95cdc1c232e56 100644 (file)
--- a/views.php
+++ b/views.php
@@ -111,7 +111,7 @@
                                $query = $data->getSelectSQL($_REQUEST['view'], array_keys($_POST['show']),
                                        $_POST['values'], $_POST['ops']);
                                $_REQUEST['query'] = $query;
-                               $_REQUEST['return_url'] = "views.php?action=confselectrows&{$misc->href}&view={$_REQUEST['view']}";
+                               $_REQUEST['return_url'] = "views.php?action=confselectrows&{$misc->href}&view=". urlencode($_REQUEST['view']);
                                $_REQUEST['return_desc'] = $lang['strback'];
                        
                                 $_no_output = true;