tools_list.php

Go to the documentation of this file.

<?php

class Tools_List extends oxAdminList
{
    protected $_sThisTemplate = 'tools_list.tpl';

    public function performsql()
    {
        $oAuthUser = oxNew( 'oxuser' );
        $oAuthUser->loadAdminUser();
        if ( $oAuthUser->oxuser__oxrights->value != "malladmin" ) {
            return;
        }

        $sUpdateSQL = oxConfig::getParameter("updatesql");
        $sUpdateSQLFile = $this->_processFiles();

        if ( $sUpdateSQLFile && strlen( $sUpdateSQLFile)>0) {
            if ( isset( $sUpdateSQL) && strlen( $sUpdateSQL))
                $sUpdateSQL .= ";\r\n".$sUpdateSQLFile;
            else
                $sUpdateSQL  = $sUpdateSQLFile;
        }

        $sUpdateSQL = trim(stripslashes($sUpdateSQL));
        $oStr = getStr();
        $iLen = $oStr->strlen($sUpdateSQL);
        if ( $this->_prepareSQL(trim(stripslashes($sUpdateSQL)), $iLen)) {
            $aQueries = $this->aSQLs;
            $this->_aViewData["aQueries"] = array();
            $aPassedQueries  = array();
            $aQAffectedRows  = array();
            $aQErrorMessages = array();
            $aQErrorNumbers  = array();

            if ( count( $aQueries) > 0) {
                $blStop = false;
                $oDB = oxDb::getDb();
                $iQueriesCounter = 0;
                for ($i=0;$i<count( $aQueries);$i++) {
                    $sUpdateSQL = $aQueries[$i];
                    $sUpdateSQL = trim( $sUpdateSQL);

                    if ( strlen( $sUpdateSQL)>0) {
                        $aPassedQueries[$iQueriesCounter] = nl2br( htmlentities($sUpdateSQL));
                        if ( getStr()->strlen( $aPassedQueries[$iQueriesCounter]) > 200)
                            $aPassedQueries[$iQueriesCounter] = $oStr->substr( $aPassedQueries[$iQueriesCounter], 0, 200)."...";

                        while ( $sUpdateSQL[ $oStr->strlen( $sUpdateSQL)-1] == ";") {
                            $sUpdateSQL = $oStr->substr( $sUpdateSQL, 0, ( $oStr->strlen( $sUpdateSQL)-1));
                        }

                        try {
                            $oDB->execute( $sUpdateSQL );
                        } catch ( Exception $oExcp ) {
                            // catching exception ...
                            $blStop = true;
                        }

                        $aQAffectedRows [$iQueriesCounter] = null;
                        $aQErrorMessages[$iQueriesCounter] = null;
                        $aQErrorNumbers [$iQueriesCounter] = null;

                        $iErrorNum = $oDB->ErrorNo();
                        if ( $iAffectedRows = $oDB->affected_Rows() !== false && $iErrorNum == 0 ) {
                            $aQAffectedRows[$iQueriesCounter] =  $iAffectedRows;
                        } else {
                            $aQErrorMessages[$iQueriesCounter] = htmlentities( $oDB->errorMsg() );
                            $aQErrorNumbers[$iQueriesCounter]  = htmlentities( $iErrorNum );
                        }
                        $iQueriesCounter++;

                        // stopping on first error..
                        if ( $blStop ) {
                            break;
                        }
                    }
                }
            }
            $this->_aViewData["aQueries"]       = $aPassedQueries;
            $this->_aViewData["aAffectedRows"]  = $aQAffectedRows;
            $this->_aViewData["aErrorMessages"] = $aQErrorMessages;
            $this->_aViewData["aErrorNumbers"]  = $aQErrorNumbers;
        }
        $this->_iDefEdit = 1;
    }

    protected function _processFiles()
    {
        if ( isset( $_FILES['myfile']['name'])) {
            // process all files
            while (list($key, $value) = each($_FILES['myfile']['name'])) {
                $aSource = $_FILES['myfile']['tmp_name'];
                $sSource = $aSource[$key];
                $aFiletype = explode( "@", $key);
                $key    = $aFiletype[1];
                $sType  = $aFiletype[0];
                $value = strtolower( $value);
                // add type to name
                $aFilename = explode( ".", $value);

                //hack?

                $aBadFiles = array("php", "jsp", "cgi", "cmf", "exe");

                if (in_array($aFilename[1], $aBadFiles))
                    die("We don't play this game, go away");

                //reading SQL dump file
                if ( $sSource) {
                    $rHandle   = fopen( $sSource, "r");
                    $sContents = fread( $rHandle, filesize ( $sSource));
                    fclose( $rHandle);
                    //reading only one SQL dump file
                    return $sContents;
                }
                return;
            }
        }
        return;
    }

    protected function _prepareSQL($sSQL, $iSQLlen)
    {
        $sChar = "";
        $sStrStart = "";
        $blString  = false;
        $oStr = getStr();

        //removing "mysqldump" application comments
        while ( preg_match("/^\-\-.*\n/", $sSQL))
            $sSQL = trim(preg_replace("/^\-\-.*\n/", "", $sSQL));
        while ( preg_match("/\n\-\-.*\n/", $sSQL))
            $sSQL = trim(preg_replace("/\n\-\-.*\n/", "\n", $sSQL));

        for ( $iPos = 0; $iPos < $iSQLlen; ++$iPos) {
            $sChar = $sSQL[$iPos];
            if ( $blString) {
                while ( true) {
                    $iPos = $oStr->strpos( $sSQL, $sStrStart, $iPos);
                    //we are at the end of string ?
                    if (!$iPos) {
                        $this->aSQLs[] = $sSQL;
                        return true;
                    } elseif ( $sStrStart == '`' || $sSQL[$iPos-1] != '\\') { //found some query separators
                        $blString  = false;
                        $sStrStart = "";
                        break;
                    } else {
                        $iNext = 2;
                        $blBackslash = false;
                        while ( $iPos-$iNext > 0 && $sSQL[$iPos-$iNext] == '\\') {
                            $blBackslash = !$blBackslash;
                            $iNext++;
                        }
                        if ( $blBackslash) {
                            $blString  = false;
                            $sStrStart = "";
                            break;
                        } else
                            $iPos++;
                    }
                }
            } elseif ( $sChar == ";") { // delimiter found, appending query array
                $this->aSQLs[] = $oStr->substr( $sSQL, 0, $iPos);
                $sSQL = ltrim( $oStr->substr( $sSQL, min( $iPos + 1, $iSQLlen)));
                $iSQLlen = $oStr->strlen( $sSQL);
                if ( $iSQLlen)
                    $iPos      = -1;
                else
                    return true;
            } elseif ( ( $sChar == '"') || ( $sChar == '\'') || ( $sChar == '`')) {
                $blString  = true;
                $sStrStart = $sChar;
            } elseif ( $sChar == "#" || ( $sChar == ' ' && $iPos > 1 && $sSQL[$iPos-2] . $sSQL[$iPos-1] == '--')) {  // removing # commented query code
                $iCommStart = (( $sSQL[$iPos] == "#") ? $iPos : $iPos-2);
                $iCommEnd = ($oStr->strpos(' ' . $sSQL, "\012", $iPos+2))
                           ? $oStr->strpos(' ' . $sSQL, "\012", $iPos+2)
                           : $oStr->strpos(' ' . $sSQL, "\015", $iPos+2);
                if ( !$iCommEnd) {
                    if ( $iCommStart > 0)
                        $this->aSQLs[] = trim($oStr->substr($sSQL, 0, $iCommStart));
                    return true;
                } else {
                    $sSQL = $oStr->substr($sSQL, 0, $iCommStart).ltrim($oStr->substr($sSQL, $iCommEnd));
                    $iSQLlen = $oStr->strlen($sSQL);
                    $iPos--;
                }
            } elseif ( 32358 < 32270 && ($sChar == '!' && $iPos > 1  && $sSQL[$iPos-2] . $sSQL[$iPos-1] == '/*'))  // removing comments like /**/
                $sSQL[$iPos] = ' ';
        }

        if (!empty($sSQL) && ereg("[^[:space:]]+", $sSQL)) {
            $this->aSQLs[] = $sSQL;
        }
        return true;
    }
}

---