Skip to content

Commit be3ecbb

Browse files
committed
Simplify and cleanup transformation plugins
Remove PMA_transformation_global_html_replace which makes the code only more confusing. Also add escaping to browse transformations. Signed-off-by: Michal Čihař <michal@cihar.com>
1 parent d648ade commit be3ecbb

12 files changed

+41
-144
lines changed

Diff for: libraries/plugins/transformations/abs/DateFormatTransformationsPlugin.php

+6-4
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@
1111
use PMA;
1212
use PMA\libraries\plugins\TransformationsPlugin;
1313

14+
require_once 'libraries/js_escape.lib.php';
15+
1416
/**
1517
* Provides common methods for all of the date format transformations plugins.
1618
*
@@ -145,11 +147,11 @@ public function applyTransformation($buffer, $options = array(), $meta = '')
145147
} else {
146148
$text = 'INVALID DATE TYPE';
147149
}
148-
$buffer = '<dfn onclick="alert(\'' . $source . '\');" title="'
149-
. $source . '">' . $text . '</dfn>';
150+
return '<dfn onclick="alert(\'' . PMA_jsFormat($source, false) . '\');" title="'
151+
. htmlspecialchars($source) . '">' . htmlspecialchars($text) . '</dfn>';
152+
} else {
153+
return htmlspecialchars($buffer);
150154
}
151-
152-
return $buffer;
153155
}
154156

155157
/* ~~~~~~~~~~~~~~~~~~~~ Getters and Setters ~~~~~~~~~~~~~~~~~~~~ */

Diff for: libraries/plugins/transformations/abs/DownloadTransformationsPlugin.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ public function applyTransformation($buffer, $options = array(), $meta = '')
6969
'<a href="transformation_wrapper.php%s&amp;ct=application'
7070
. '/octet-stream&amp;cn=%s" title="%s" class="disableAjax">%s</a>',
7171
$options['wrapper_link'],
72-
urlencode($cn),
72+
htmlspecialchars(urlencode($cn)),
7373
htmlspecialchars($cn),
7474
htmlspecialchars($cn)
7575
);

Diff for: libraries/plugins/transformations/abs/ImageLinkTransformationsPlugin.php

+2-10
Original file line numberDiff line numberDiff line change
@@ -49,16 +49,8 @@ public function applyTransformation($buffer, $options = array(), $meta = '')
4949
{
5050
// must disable the page loader, see
5151
// https://wiki.phpmyadmin.net/pma/Page_loader#Bypassing_the_page_loader
52-
$transform_options = array(
53-
'string' => '<a class="disableAjax"'
54-
. ' target="_new" href="transformation_wrapper.php'
55-
. $options['wrapper_link'] . '" alt="[__BUFFER__]">[BLOB]</a>',
56-
);
57-
58-
return PMA_Transformation_globalHtmlReplace(
59-
$buffer,
60-
$transform_options
61-
);
52+
return '<a class="disableAjax" target="_new" href="transformation_wrapper.php'
53+
. $options['wrapper_link'] . '" alt="[' . htmlspecialchars($buffer) . ']">[BLOB]</a>';
6254
}
6355

6456
/* ~~~~~~~~~~~~~~~~~~~~ Getters and Setters ~~~~~~~~~~~~~~~~~~~~ */

Diff for: libraries/plugins/transformations/abs/InlineTransformationsPlugin.php

+11-19
Original file line numberDiff line numberDiff line change
@@ -49,30 +49,22 @@ public static function getInfo()
4949
public function applyTransformation($buffer, $options = array(), $meta = '')
5050
{
5151
if (PMA_IS_GD2) {
52-
$transform_options = array(
53-
'string' => '<a href="transformation_wrapper.php'
54-
. $options['wrapper_link']
55-
. '" target="_blank"><img src="transformation_wrapper.php'
56-
. $options['wrapper_link'] . '&amp;resize=jpeg&amp;newWidth='
57-
. (isset($options[0]) ? $options[0] : '100') . '&amp;newHeight='
58-
. (isset($options[1]) ? $options[1] : 100)
59-
. '" alt="[__BUFFER__]" border="0" /></a>',
60-
);
52+
return '<a href="transformation_wrapper.php'
53+
. $options['wrapper_link']
54+
. '" target="_blank"><img src="transformation_wrapper.php'
55+
. $options['wrapper_link'] . '&amp;resize=jpeg&amp;newWidth='
56+
. (isset($options[0]) ? $options[0] : '100') . '&amp;newHeight='
57+
. (isset($options[1]) ? $options[1] : 100)
58+
. '" alt="[' . htmlspecialchars($buffer) . ']" border="0" /></a>';
6159
} else {
62-
$transform_options = array(
63-
'string' => '<img src="transformation_wrapper.php'
64-
. $options['wrapper_link']
65-
. '" alt="[__BUFFER__]" width="320" height="240" />',
66-
);
60+
return '<img src="transformation_wrapper.php'
61+
. $options['wrapper_link']
62+
. '" alt="[' . htmlspecialchars($buffer) . ']" width="320" height="240" />';
6763
}
68-
69-
return PMA_Transformation_globalHtmlReplace(
70-
$buffer,
71-
$transform_options
72-
);
7364
}
7465

7566

67+
7668
/* ~~~~~~~~~~~~~~~~~~~~ Getters and Setters ~~~~~~~~~~~~~~~~~~~~ */
7769

7870
/**

Diff for: libraries/plugins/transformations/abs/LongToIPv4TransformationsPlugin.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ public static function getInfo()
4242
public function applyTransformation($buffer, $options = array(), $meta = '')
4343
{
4444
if ($buffer < 0 || $buffer > 4294967295) {
45-
return $buffer;
45+
return htmlspecialchars($buffer);
4646
}
4747

4848
return long2ip($buffer);

Diff for: libraries/plugins/transformations/abs/PreApPendTransformationsPlugin.php

+1-3
Original file line numberDiff line numberDiff line change
@@ -46,10 +46,8 @@ public function applyTransformation($buffer, $options = array(), $meta = '')
4646
$options = $this->getOptions($options, array('', ''));
4747

4848
//just prepend and/or append the options to the original text
49-
$newtext = htmlspecialchars($options[0]) . $buffer
49+
return htmlspecialchars($options[0]) . htmlspecialchars($buffer)
5050
. htmlspecialchars($options[1]);
51-
52-
return $newtext;
5351
}
5452

5553
/* ~~~~~~~~~~~~~~~~~~~~ Getters and Setters ~~~~~~~~~~~~~~~~~~~~ */

Diff for: libraries/plugins/transformations/abs/SubstringTransformationsPlugin.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ public function applyTransformation($buffer, $options = array(), $meta = '')
7171
}
7272
}
7373

74-
return $newtext;
74+
return htmlspecialchars($newtext);
7575
}
7676

7777

Diff for: libraries/plugins/transformations/abs/TextImageLinkTransformationsPlugin.php

+6-18
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,6 @@
1414
exit;
1515
}
1616

17-
/* For PMA_Transformation_globalHtmlReplace */
18-
require_once 'libraries/transformations.lib.php';
19-
2017
/**
2118
* Provides common methods for all of the image link transformations plugins.
2219
*
@@ -49,21 +46,12 @@ public static function getInfo()
4946
*/
5047
public function applyTransformation($buffer, $options = array(), $meta = '')
5148
{
52-
$transform_options = array(
53-
'string' => '<a href="' . (isset($options[0]) ? $options[0] : '')
54-
. $buffer . '" target="_blank"><img src="'
55-
. (isset($options[0]) ? $options[0] : '') . $buffer
56-
. '" border="0" width="' . (isset($options[1]) ? $options[1] : 100)
57-
. '" height="' . (isset($options[2]) ? $options[2] : 50) . '" />'
58-
. $buffer . '</a>',
59-
);
60-
61-
$buffer = PMA_Transformation_globalHtmlReplace(
62-
$buffer,
63-
$transform_options
64-
);
65-
66-
return $buffer;
49+
return '<a href="' . htmlspecialchars(isset($options[0]) ? $options[0] : '')
50+
. htmlspecialchars($buffer) . '" target="_blank"><img src="'
51+
. htmlspecialchars(isset($options[0]) ? $options[0] : '') . htmlspecialchars($buffer)
52+
. '" border="0" width="' . (isset($options[1]) ? $options[1] : 100)
53+
. '" height="' . (isset($options[2]) ? $options[2] : 50) . '" />'
54+
. htmlspecialchars($buffer) . '</a>';
6755
}
6856

6957

Diff for: libraries/plugins/transformations/abs/TextLinkTransformationsPlugin.php

+9-18
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,6 @@
1414
exit;
1515
}
1616

17-
/* For PMA_Transformation_globalHtmlReplace */
18-
require_once 'libraries/transformations.lib.php';
19-
2017
/**
2118
* Provides common methods for all of the link transformations plugins.
2219
*
@@ -49,25 +46,19 @@ public static function getInfo()
4946
*/
5047
public function applyTransformation($buffer, $options = array(), $meta = '')
5148
{
52-
5349
$append_part = (isset($options[2]) && $options[2]) ? '' : $buffer;
5450

55-
$transform_options = array(
56-
'string' => '<a href="'
57-
. (isset($options[0]) ? $options[0] : '') . $append_part
58-
. '" title="'
59-
. htmlspecialchars(isset($options[1]) ? $options[1] : '')
60-
. '" target="_new">'
61-
. htmlspecialchars(isset($options[1]) ? $options[1] : $buffer)
62-
. '</a>',
63-
);
64-
65-
return PMA_Transformation_globalHtmlReplace(
66-
$buffer,
67-
$transform_options
68-
);
51+
return '<a href="'
52+
. htmlspecialchars(isset($options[0]) ? $options[0] : '')
53+
. htmlspecialchars($append_part)
54+
. '" title="'
55+
. htmlspecialchars(isset($options[1]) ? $options[1] : '')
56+
. '" target="_new">'
57+
. htmlspecialchars(isset($options[1]) ? $options[1] : $buffer)
58+
. '</a>';
6959
}
7060

61+
7162
/* ~~~~~~~~~~~~~~~~~~~~ Getters and Setters ~~~~~~~~~~~~~~~~~~~~ */
7263

7364
/**

Diff for: libraries/transformations.lib.php

-38
Original file line numberDiff line numberDiff line change
@@ -400,44 +400,6 @@ function PMA_setMIME($db, $table, $key, $mimetype, $transformation,
400400
* GLOBAL Plugin functions
401401
*/
402402

403-
404-
/**
405-
* Replaces "[__BUFFER__]" occurrences found in $options['string'] with the text
406-
* in $buffer, after performing a regular expression search and replace on
407-
* $buffer using $options['regex'] and $options['regex_replace'].
408-
*
409-
* @param string $buffer text that will be replaced in $options['string'],
410-
* after being formatted
411-
* @param array $options the options required to format $buffer
412-
* = array (
413-
* 'string' => 'string', // text containing "[__BUFFER__]"
414-
* 'regex' => 'mixed', // the pattern to search for
415-
* 'regex_replace' => 'mixed', // string or array of strings to replace
416-
* // with
417-
* );
418-
*
419-
* @return string containing the text with all the replacements
420-
*/
421-
function PMA_Transformation_globalHtmlReplace($buffer, $options = array())
422-
{
423-
if (! isset($options['string'])) {
424-
$options['string'] = '';
425-
}
426-
427-
if (isset($options['regex']) && isset($options['regex_replace'])) {
428-
$buffer = preg_replace(
429-
'@' . str_replace('@', '\@', $options['regex']) . '@si',
430-
$options['regex_replace'],
431-
$buffer
432-
);
433-
}
434-
435-
// Replace occurrences of [__BUFFER__] with actual text
436-
$return = str_replace("[__BUFFER__]", $buffer, $options['string']);
437-
return $return;
438-
}
439-
440-
441403
/**
442404
* Delete related transformation details
443405
* after deleting database. table or column

Diff for: test/classes/plugin/transformations/TransformationPluginsTest.php

+3-3
Original file line numberDiff line numberDiff line change
@@ -780,7 +780,7 @@ public function transformationDataProvider()
780780
'<a href="transformation_wrapper.phpPMA_wrapper_link" '
781781
. 'target="_blank"><img src="transformation_wrapper.php'
782782
. 'PMA_wrapper_link&amp;resize=jpeg&amp;newWidth=./image/&amp;'
783-
. 'newHeight=200" alt="PMA_JPEG_Inline" border="0" /></a>'
783+
. 'newHeight=200" alt="[PMA_JPEG_Inline]" border="0" /></a>'
784784
),
785785
array(
786786
new Image_JPEG_Link(),
@@ -790,7 +790,7 @@ public function transformationDataProvider()
790790
),
791791
'<a class="disableAjax" target="_new"'
792792
. ' href="transformation_wrapper.phpPMA_wrapper_link"'
793-
. ' alt="PMA_IMAGE_LINK">[BLOB]</a>'
793+
. ' alt="[PMA_IMAGE_LINK]">[BLOB]</a>'
794794
),
795795
array(
796796
new Image_PNG_Inline(),
@@ -802,7 +802,7 @@ public function transformationDataProvider()
802802
. ' target="_blank"><img src="transformation_wrapper.php'
803803
. 'PMA_wrapper_link&amp;'
804804
. 'resize=jpeg&amp;newWidth=./image/&amp;newHeight=200" '
805-
. 'alt="PMA_PNG_Inline" border="0" /></a>'
805+
. 'alt="[PMA_PNG_Inline]" border="0" /></a>'
806806
),
807807
array(
808808
new Text_Plain_Dateformat(),

Diff for: test/libraries/PMA_transformation_test.php

-28
Original file line numberDiff line numberDiff line change
@@ -208,34 +208,6 @@ public function testGetMime()
208208
);
209209
}
210210

211-
/**
212-
* Test for PMA_Transformation_globalHtmlReplace
213-
*
214-
* @return void
215-
*/
216-
public function testTransformationGlobalHtmlReplace()
217-
{
218-
// Case 1
219-
$actual = PMA_Transformation_globalHtmlReplace('', array());
220-
$this->assertEquals(
221-
'',
222-
$actual
223-
);
224-
225-
// Case 2
226-
$buffer = 'foobar';
227-
$options = array(
228-
'regex' => 'foo',
229-
'regex_replace' => 'bar',
230-
'string' => 'x[__BUFFER__]x'
231-
);
232-
$actual = PMA_Transformation_globalHtmlReplace($buffer, $options);
233-
$this->assertEquals(
234-
'xbarbarx',
235-
$actual
236-
);
237-
}
238-
239211
/**
240212
* Test for PMA_clearTransformations
241213
*

0 commit comments

Comments
 (0)