New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

arg_separator breaks PMA: Call to a member function getCurrentUserAndHost #13940

Closed
xuefer opened this Issue Jan 16, 2018 · 4 comments

Comments

Projects
None yet
3 participants
@xuefer

xuefer commented Jan 16, 2018

Steps to reproduce

  1. delete one row in "Browse"

Expected behaviour

row get deleted, success

Actual behaviour

Fatal error: Uncaught Error: Call to a member function getCurrentUserAndHost() on null in /var/www/htdocs/phpMyAdmin/libraries/check_user_privileges.inc.php:14
Stack trace:
#0 /var/www/htdocs/phpMyAdmin/sql.php(21): require_once()
#1 {main} thrown in /var/www/htdocs/phpMyAdmin/libraries/check_user_privileges.inc.php on line 14

Server configuration

Operating system: Gentoo

Web server: lighttpd

Database: mariadb

PHP version: 7.1

phpMyAdmin version: git master rev 2823d27

Client configuration

Browser: Chrome

Operating system: Windows

it is triggered by arg_separator.input = "&;" php setting
PMA tends to use ";" which is ok most of the time, but for POST data, php (nor chrome F12 developer tools) don't recognize ; as separator, see php-src code at http://git.php.net/?p=php-src.git;a=blob;f=main/php_variables.c;h=9e7f185bd944715b11d3e69005b533b99b983d65;hb=HEAD#l295

the data being posted is:
ajax_request=true&ajax_page_request=true&db=tracker;table=lkp;where_clause=%60lkp%60.%60userid%60+%3D+10+AND+%60lkp%60.%60type%60+%3D+%27gps%27;clause_is_unique=1;sql_query=SELECT+%2A+FROM+%60lkp%60;goto=sql.php;default_action=update;server=1&_nocache=1516126509642566829&token=.....
as you can see it mix ; with & while both should be supported when in query string, it is not supported in post content, even Content-Type is application/x-www-form-urlencoded; charset=UTF-8

@OlafvdSpek

This comment has been minimized.

OlafvdSpek commented Jan 17, 2018

";" is NOT in arg_separator.input by default is it (unfortunately)?
How did this ever work?

@xuefer

This comment has been minimized.

xuefer commented Jan 18, 2018

for years i use input="&;" and output=";" without problems, not with old PMA, but i just got PMA updated recently and this bug happen

it isn't by default but recommended by w3c, and prefered (if set) by pma
it works by having arg_separator.output = ";" (whichtell generate ";") and arg_separator.input = "&;" (which make PHP parser recognize "&;", but only in query string parser, not for post data)
PHP assume all data POST to server is generated by browser using & in all case, which is right
while PMA copy query string and concat it as POST data for XMLHttpRequest

should i post this bug PHP group instead?

@nijel nijel self-assigned this Mar 1, 2018

@nijel nijel added the bug label Mar 1, 2018

@nijel nijel added this to the 4.7.9 milestone Mar 1, 2018

@nijel nijel closed this in 984c6a0 Mar 1, 2018

@OlafvdSpek

This comment has been minimized.

OlafvdSpek commented Mar 1, 2018

@nijel Are you sure the fix is correct? AFAIK POST requires &, even though PHP might be set to require ; for GET.

@nijel

This comment has been minimized.

Member

nijel commented Mar 5, 2018

It seemed to work correctly in my tests, but I'll try to test this again...

@nijel nijel modified the milestones: 4.7.9, 4.8.0 Mar 5, 2018

nijel added a commit that referenced this issue Mar 5, 2018

Revert "Honor arg_separator in AJAX requests"
This reverts commit 984c6a0.

See #13940

Signed-off-by: Michal Čihař <michal@cihar.com>

nijel added a commit that referenced this issue Mar 5, 2018

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment