diff --git a/adminer/create.inc.php b/adminer/create.inc.php index 019ccf9a..67472e80 100644 --- a/adminer/create.inc.php +++ b/adminer/create.inc.php @@ -14,9 +14,9 @@ if ($TABLE != "") { $orig_fields = fields($TABLE); $orig_status = table_status($TABLE); } -if ($_POST && !$_POST["fields"]) { - $_POST["fields"] = array(); -} + +$row = $_POST; +$row["fields"] = (array) $row["fields"]; if ($_POST && !$error && !$_POST["add"] && !$_POST["drop_col"] && !$_POST["up"] && !$_POST["down"]) { if ($_POST["drop"]) { @@ -26,18 +26,18 @@ if ($_POST && !$error && !$_POST["add"] && !$_POST["drop_col"] && !$_POST["up"] $all_fields = array(); $use_all_fields = false; $foreign = array(); - ksort($_POST["fields"]); + ksort($row["fields"]); $orig_field = reset($orig_fields); $after = " FIRST"; - foreach ($_POST["fields"] as $key => $field) { + foreach ($row["fields"] as $key => $field) { $foreign_key = $foreign_keys[$field["type"]]; $type_field = ($foreign_key !== null ? $referencable_primary[$foreign_key] : $field); //! can collide with user defined type if ($field["field"] != "") { if (!$field["has_default"]) { $field["default"] = null; } - if ($key == $_POST["auto_increment_col"]) { + if ($key == $row["auto_increment_col"]) { $field["auto_increment"] = true; } $process_field = process_field($field, $type_field); @@ -65,17 +65,17 @@ if ($_POST && !$error && !$_POST["add"] && !$_POST["drop_col"] && !$_POST["up"] } $partitioning = ""; - if (in_array($_POST["partition_by"], $partition_by)) { + if (in_array($row["partition_by"], $partition_by)) { $partitions = array(); - if ($_POST["partition_by"] == 'RANGE' || $_POST["partition_by"] == 'LIST') { - foreach (array_filter($_POST["partition_names"]) as $key => $val) { - $value = $_POST["partition_values"][$key]; - $partitions[] = "\nPARTITION " . idf_escape($val) . " VALUES " . ($_POST["partition_by"] == 'RANGE' ? "LESS THAN" : "IN") . ($value != "" ? " ($value)" : " MAXVALUE"); //! SQL injection + if ($row["partition_by"] == 'RANGE' || $row["partition_by"] == 'LIST') { + foreach (array_filter($row["partition_names"]) as $key => $val) { + $value = $row["partition_values"][$key]; + $partitions[] = "\nPARTITION " . idf_escape($val) . " VALUES " . ($row["partition_by"] == 'RANGE' ? "LESS THAN" : "IN") . ($value != "" ? " ($value)" : " MAXVALUE"); //! SQL injection } } - $partitioning .= "\nPARTITION BY $_POST[partition_by]($_POST[partition])" . ($partitions // $_POST["partition"] can be expression, not only column + $partitioning .= "\nPARTITION BY $row[partition_by]($row[partition])" . ($partitions // $row["partition"] can be expression, not only column ? " (" . implode(",", $partitions) . "\n)" - : ($_POST["partitions"] ? " PARTITIONS " . (+$_POST["partitions"]) : "") + : ($row["partitions"] ? " PARTITIONS " . (+$row["partitions"]) : "") ); } elseif (support("partitioning") && ereg("partitioned", $orig_status["Create_options"])) { $partitioning .= "\nREMOVE PARTITIONING"; @@ -83,20 +83,20 @@ if ($_POST && !$error && !$_POST["add"] && !$_POST["drop_col"] && !$_POST["up"] $message = lang('Table has been altered.'); if ($TABLE == "") { - cookie("adminer_engine", $_POST["Engine"]); + cookie("adminer_engine", $row["Engine"]); $message = lang('Table has been created.'); } - $name = trim($_POST["name"]); + $name = trim($row["name"]); queries_redirect(ME . "table=" . urlencode($name), $message, alter_table( $TABLE, $name, ($jush == "sqlite" && ($use_all_fields || $foreign) ? $all_fields : $fields), $foreign, - $_POST["Comment"], - ($_POST["Engine"] && $_POST["Engine"] != $orig_status["Engine"] ? $_POST["Engine"] : ""), - ($_POST["Collation"] && $_POST["Collation"] != $orig_status["Collation"] ? $_POST["Collation"] : ""), - ($_POST["Auto_increment"] != "" ? +$_POST["Auto_increment"] : ""), + $row["Comment"], + ($row["Engine"] && $row["Engine"] != $orig_status["Engine"] ? $row["Engine"] : ""), + ($row["Collation"] && $row["Collation"] != $orig_status["Collation"] ? $row["Collation"] : ""), + ($row["Auto_increment"] != "" ? +$row["Auto_increment"] : ""), $partitioning )); } @@ -104,14 +104,7 @@ if ($_POST && !$error && !$_POST["add"] && !$_POST["drop_col"] && !$_POST["up"] page_header(($TABLE != "" ? lang('Alter table') : lang('Create table')), $error, array("table" => $TABLE), $TABLE); -$row = array( - "Engine" => $_COOKIE["adminer_engine"], - "fields" => array(array("field" => "", "type" => (isset($types["int"]) ? "int" : (isset($types["integer"]) ? "integer" : "")))), - "partition_names" => array(""), -); - if ($_POST) { - $row = $_POST; if ($row["auto_increment_col"]) { $row["fields"][$row["auto_increment_col"]]["auto_increment"] = true; } @@ -141,6 +134,13 @@ if ($_POST) { } $row["partition_names"][] = ""; } + +} else { + $row = array( + "Engine" => $_COOKIE["adminer_engine"], + "fields" => array(array("field" => "", "type" => (isset($types["int"]) ? "int" : (isset($types["integer"]) ? "integer" : "")))), + "partition_names" => array(""), + ); } $collations = collations(); diff --git a/adminer/database.inc.php b/adminer/database.inc.php index 022a0d98..2306144a 100644 --- a/adminer/database.inc.php +++ b/adminer/database.inc.php @@ -1,7 +1,9 @@ ' . h($name) . '
' : '' -) . "\n" . ($collations ? html_select("collation", array("" => "(" . lang('collation') . ")") + $collations, $collate) : ""); +) . "\n" . ($collations ? html_select("collation", array("" => "(" . lang('collation') . ")") + $collations, $row["collation"]) : ""); ?> diff --git a/adminer/event.inc.php b/adminer/event.inc.php index ce38c5da..e561532e 100644 --- a/adminer/event.inc.php +++ b/adminer/event.inc.php @@ -2,32 +2,32 @@ $EVENT = $_GET["event"]; $intervals = array("YEAR", "QUARTER", "MONTH", "DAY", "HOUR", "MINUTE", "WEEK", "SECOND", "YEAR_MONTH", "DAY_HOUR", "DAY_MINUTE", "DAY_SECOND", "HOUR_MINUTE", "HOUR_SECOND", "MINUTE_SECOND"); $statuses = array("ENABLED" => "ENABLE", "DISABLED" => "DISABLE", "SLAVESIDE_DISABLED" => "DISABLE ON SLAVE"); +$row = $_POST; if ($_POST && !$error) { if ($_POST["drop"]) { query_redirect("DROP EVENT " . idf_escape($EVENT), substr(ME, 0, -1), lang('Event has been dropped.')); - } elseif (in_array($_POST["INTERVAL_FIELD"], $intervals) && isset($statuses[$_POST["STATUS"]])) { - $schedule = "\nON SCHEDULE " . ($_POST["INTERVAL_VALUE"] - ? "EVERY " . q($_POST["INTERVAL_VALUE"]) . " $_POST[INTERVAL_FIELD]" - . ($_POST["STARTS"] ? " STARTS " . q($_POST["STARTS"]) : "") - . ($_POST["ENDS"] ? " ENDS " . q($_POST["ENDS"]) : "") //! ALTER EVENT doesn't drop ENDS - MySQL bug #39173 - : "AT " . q($_POST["STARTS"]) - ) . " ON COMPLETION" . ($_POST["ON_COMPLETION"] ? "" : " NOT") . " PRESERVE" + } elseif (in_array($row["INTERVAL_FIELD"], $intervals) && isset($statuses[$row["STATUS"]])) { + $schedule = "\nON SCHEDULE " . ($row["INTERVAL_VALUE"] + ? "EVERY " . q($row["INTERVAL_VALUE"]) . " $row[INTERVAL_FIELD]" + . ($row["STARTS"] ? " STARTS " . q($row["STARTS"]) : "") + . ($row["ENDS"] ? " ENDS " . q($row["ENDS"]) : "") //! ALTER EVENT doesn't drop ENDS - MySQL bug #39173 + : "AT " . q($row["STARTS"]) + ) . " ON COMPLETION" . ($row["ON_COMPLETION"] ? "" : " NOT") . " PRESERVE" ; queries_redirect(substr(ME, 0, -1), ($EVENT != "" ? lang('Event has been altered.') : lang('Event has been created.')), queries(($EVENT != "" ? "ALTER EVENT " . idf_escape($EVENT) . $schedule - . ($EVENT != $_POST["EVENT_NAME"] ? "\nRENAME TO " . idf_escape($_POST["EVENT_NAME"]) : "") - : "CREATE EVENT " . idf_escape($_POST["EVENT_NAME"]) . $schedule - ) . "\n" . $statuses[$_POST["STATUS"]] . " COMMENT " . q($_POST["EVENT_COMMENT"]) - . rtrim(" DO\n$_POST[EVENT_DEFINITION]", ";") . ";" + . ($EVENT != $row["EVENT_NAME"] ? "\nRENAME TO " . idf_escape($row["EVENT_NAME"]) : "") + : "CREATE EVENT " . idf_escape($row["EVENT_NAME"]) . $schedule + ) . "\n" . $statuses[$row["STATUS"]] . " COMMENT " . q($row["EVENT_COMMENT"]) + . rtrim(" DO\n$row[EVENT_DEFINITION]", ";") . ";" )); } } page_header(($EVENT != "" ? lang('Alter event') . ": " . h($EVENT) : lang('Create event')), $error); -$row = $_POST; if (!$row && $EVENT != "") { $rows = get_rows("SELECT * FROM information_schema.EVENTS WHERE EVENT_SCHEMA = " . q(DB) . " AND EVENT_NAME = " . q($EVENT)); $row = reset($rows); diff --git a/adminer/foreign.inc.php b/adminer/foreign.inc.php index e733f3b9..1768a101 100644 --- a/adminer/foreign.inc.php +++ b/adminer/foreign.inc.php @@ -1,41 +1,45 @@ $val) { - $target[$key] = $_POST["target"][$key]; + $target[$key] = $row["target"][$key]; } query_redirect("ALTER TABLE " . table($TABLE) - . ($_GET["name"] != "" ? "\nDROP " . ($jush == "sql" ? "FOREIGN KEY " : "CONSTRAINT ") . idf_escape($_GET["name"]) . "," : "") - . "\nADD FOREIGN KEY (" . implode(", ", array_map('idf_escape', $source)) . ") REFERENCES " . table($_POST["table"]) . " (" . implode(", ", array_map('idf_escape', $target)) . ")" //! reuse $_GET["name"] - check in older MySQL versions - . (ereg("^($on_actions)\$", $_POST["on_delete"]) ? " ON DELETE $_POST[on_delete]" : "") - . (ereg("^($on_actions)\$", $_POST["on_update"]) ? " ON UPDATE $_POST[on_update]" : "") - , ME . "table=" . urlencode($TABLE), ($_GET["name"] != "" ? lang('Foreign key has been altered.') : lang('Foreign key has been created.'))); + . ($name != "" ? "\nDROP " . ($jush == "sql" ? "FOREIGN KEY " : "CONSTRAINT ") . idf_escape($name) . "," : "") + . "\nADD FOREIGN KEY (" . implode(", ", array_map('idf_escape', $source)) . ") REFERENCES " . table($row["table"]) . " (" . implode(", ", array_map('idf_escape', $target)) . ")" //! reuse $name - check in older MySQL versions + . (ereg("^($on_actions)\$", $row["on_delete"]) ? " ON DELETE $row[on_delete]" : "") + . (ereg("^($on_actions)\$", $row["on_update"]) ? " ON UPDATE $row[on_update]" : "") + , ME . "table=" . urlencode($TABLE), ($name != "" ? lang('Foreign key has been altered.') : lang('Foreign key has been created.'))); $error = lang('Source and target columns must have the same data type, there must be an index on the target columns and referenced data must exist.') . "
$error"; //! no partitioning } } page_header(lang('Foreign key'), $error, array("table" => $TABLE), $TABLE); -$row = array("table" => $TABLE, "source" => array("")); if ($_POST) { - $row = $_POST; ksort($row["source"]); if ($_POST["add"]) { $row["source"][] = ""; } elseif ($_POST["change"] || $_POST["change-js"]) { $row["target"] = array(); } -} elseif ($_GET["name"] != "") { +} elseif ($name != "") { $foreign_keys = foreign_keys($TABLE); - $row = $foreign_keys[$_GET["name"]]; + $row = $foreign_keys[$name]; $row["source"][] = ""; +} else { + $row["table"] = $TABLE; + $row["source"] = array(""); } $source = array_keys(fields($TABLE)); //! no text and blob @@ -69,6 +73,6 @@ foreach ($row["source"] as $key => $val) {