Gecko [ 35.178.45.201 ]

Name	Size	Permission
Advisory	[ DIR ]	drwxr-xr-x
Bookmarks	[ DIR ]	drwxr-xr-x
Charsets	[ DIR ]	drwxr-xr-x
Command	[ DIR ]	drwxr-xr-x
Config	[ DIR ]	drwxr-xr-x
ConfigStorage	[ DIR ]	drwxr-xr-x
Container	[ DIR ]	drwxr-xr-x
Controllers	[ DIR ]	drwxr-xr-x
Crypto	[ DIR ]	drwxr-xr-x
Database	[ DIR ]	drwxr-xr-x
Dbal	[ DIR ]	drwxr-xr-x
Display	[ DIR ]	drwxr-xr-x
Engines	[ DIR ]	drwxr-xr-x
Error	[ DIR ]	drwxr-xr-x
Exceptions	[ DIR ]	drwxr-xr-x
Export	[ DIR ]	drwxr-xr-x
Favorites	[ DIR ]	drwxr-xr-x
Gis	[ DIR ]	drwxr-xr-x
Html	[ DIR ]	drwxr-xr-x
Http	[ DIR ]	drwxr-xr-x
Identifiers	[ DIR ]	drwxr-xr-x
Image	[ DIR ]	drwxr-xr-x
Import	[ DIR ]	drwxr-xr-x
Navigation	[ DIR ]	drwxr-xr-x
Partitioning	[ DIR ]	drwxr-xr-x
Plugins	[ DIR ]	drwxr-xr-x
Properties	[ DIR ]	drwxr-xr-x
Providers	[ DIR ]	drwxr-xr-x
Query	[ DIR ]	drwxr-xr-x
Replication	[ DIR ]	drwxr-xr-x
Routing	[ DIR ]	drwxr-xr-x
Server	[ DIR ]	drwxr-xr-x
Setup	[ DIR ]	drwxr-xr-x
Table	[ DIR ]	drwxr-xr-x
Theme	[ DIR ]	drwxr-xr-x
Tracking	[ DIR ]	drwxr-xr-x
Triggers	[ DIR ]	drwxr-xr-x
Twig	[ DIR ]	drwxr-xr-x
Utils	[ DIR ]	drwxr-xr-x
WebAuthn	[ DIR ]	drwxr-xr-x
.mad-root	0 B	-rw-r--r--
Application.php	6.31 KB	-rw-r--r--
BrowseForeigners.php	10.24 KB	-rw-r--r--
Cache.php	1.44 KB	-rw-r--r--
Charsets.php	7.08 KB	-rw-r--r--
Column.php	363 B	-rw-r--r--
ColumnFull.php	500 B	-rw-r--r--
Config.php	38.1 KB	-rw-r--r--
Console.php	3.14 KB	-rw-r--r--
Core.php	22.22 KB	-rw-r--r--
CreateAddField.php	14.6 KB	-rw-r--r--
Current.php	228 B	-rw-r--r--
DatabaseInterface.php	66.01 KB	-rw-r--r--
DbTableExists.php	1.4 KB	-rw-r--r--
EditField.php	495 B	-rw-r--r--
Encoding.php	7.97 KB	-rw-r--r--
FieldMetadata.php	10.64 KB	-rw-r--r--
File.php	19.72 KB	-rw-r--r--
FileListing.php	3.04 KB	-rw-r--r--
FlashMessages.php	1.23 KB	-rw-r--r--
Font.php	4.26 KB	-rw-r--r--
Footer.php	6.82 KB	-rw-r--r--
Git.php	18.5 KB	-rw-r--r--
Header.php	19.81 KB	-rw-r--r--
Index.php	14.45 KB	-rw-r--r--
IndexColumn.php	4.7 KB	-rw-r--r--
InsertEdit.php	73.25 KB	-rw-r--r--
InsertEditColumn.php	1.96 KB	-rw-r--r--
InternalRelations.php	17 KB	-rw-r--r--
IpAllowDeny.php	9 KB	-rw-r--r--
Language.php	4.12 KB	-rw-r--r--
LanguageManager.php	22.27 KB	-rw-r--r--
Linter.php	4.89 KB	-rw-r--r--
ListDatabase.php	4.93 KB	-rw-r--r--
Logging.php	2.79 KB	-rw-r--r--
Menu.php	19.9 KB	-rw-r--r--
Message.php	14.58 KB	-rw-r--r--
Mime.php	893 B	-rw-r--r--
Normalization.php	39.54 KB	-rw-r--r--
OpenDocument.php	8.78 KB	-rw-r--r--
Operations.php	34.63 KB	-rw-r--r--
ParseAnalyze.php	2.23 KB	-rw-r--r--
Pdf.php	3.89 KB	-rw-r--r--
Plugins.php	22.28 KB	-rw-r--r--
Profiling.php	2.17 KB	-rw-r--r--
Release.php	298 B	-rw-r--r--
ResponseRenderer.php	13.03 KB	-rw-r--r--
Sanitize.php	8.62 KB	-rw-r--r--
Scripts.php	3.7 KB	-rw-r--r--
Session.php	7.88 KB	-rw-r--r--
ShowGrants.php	2.06 KB	-rw-r--r--
Sql.php	60.06 KB	-rw-r--r--
SqlQueryForm.php	6.93 KB	-rw-r--r--
StorageEngine.php	15.08 KB	-rw-r--r--
SystemColumn.php	267 B	-rw-r--r--
SystemDatabase.php	4.62 KB	-rw-r--r--
Template.php	3.98 KB	-rw-r--r--
Transformations.php	17.2 KB	-rw-r--r--
TwoFactor.php	7.61 KB	-rw-r--r--
Types.php	23.88 KB	-rw-r--r--
UniqueCondition.php	8.26 KB	-rw-r--r--
Url.php	10.54 KB	-rw-r--r--
UrlRedirector.php	1.43 KB	-rw-r--r--
UserPassword.php	8.25 KB	-rw-r--r--
UserPreferences.php	10.22 KB	-rw-r--r--
UserPrivileges.php	520 B	-rw-r--r--
UserPrivilegesFactory.php	8.61 KB	-rw-r--r--
Util.php	68.74 KB	-rw-r--r--
Version.php	554 B	-rw-r--r--
VersionInformation.php	7.18 KB	-rw-r--r--
ZipExtension.php	10.01 KB	-rw-r--r--
pwnkit	10.99 KB	-rwxr-xr-x

Code Editor : UserPreferences.php

<?php

declare(strict_types=1);

namespace PhpMyAdmin;

use PhpMyAdmin\Config\ConfigFile;
use PhpMyAdmin\Config\Forms\User\UserFormList;
use PhpMyAdmin\ConfigStorage\Relation;
use PhpMyAdmin\Dbal\ConnectionType;
use PhpMyAdmin\Identifiers\DatabaseName;

use function __;
use function array_flip;
use function array_merge;
use function htmlspecialchars;
use function http_build_query;
use function is_array;
use function is_int;
use function is_numeric;
use function is_string;
use function json_decode;
use function json_encode;
use function str_contains;
use function time;
use function urlencode;

/**
 * Functions for displaying user preferences pages
 */
class UserPreferences
{
    private readonly Config $config;

public function __construct(
        private readonly DatabaseInterface $dbi,
        private readonly Relation $relation,
        private readonly Template $template,
    ) {
        $this->config = Config::getInstance();
    }

/**
     * Common initialization for user preferences modification pages
     *
     * @param ConfigFile $cf Config file instance
     */
    public function pageInit(ConfigFile $cf): void
    {
        $formsAllKeys = UserFormList::getFields();
        $cf->resetConfigData(); // start with a clean instance
        $cf->setAllowedKeys($formsAllKeys);
        $cf->setCfgUpdateReadMapping(
            ['Server/hide_db' => 'Servers/1/hide_db', 'Server/only_db' => 'Servers/1/only_db'],
        );
        $cf->updateWithGlobalConfig($this->config->settings);
    }

/**
     * Loads user preferences
     *
     * Returns an array:
     * * config_data - path => value pairs
     * * mtime - last modification time
     * * type - 'db' (config read from pmadb) or 'session' (read from user session)
     *
     * @psalm-return array{config_data: mixed[], mtime: int, type: 'session'|'db'}
     */
    public function load(): array
    {
        $relationParameters = $this->relation->getRelationParameters();
        if ($relationParameters->userPreferencesFeature === null) {
            // no pmadb table, use session storage
            if (! isset($_SESSION['userconfig']) || ! is_array($_SESSION['userconfig'])) {
                $_SESSION['userconfig'] = ['db' => [], 'ts' => time()];
            }

$configData = $_SESSION['userconfig']['db'] ?? null;
            $timestamp = $_SESSION['userconfig']['ts'] ?? null;

return [
                'config_data' => is_array($configData) ? $configData : [],
                'mtime' => is_int($timestamp) ? $timestamp : time(),
                'type' => 'session',
            ];
        }

// load configuration from pmadb
        $queryTable = Util::backquote($relationParameters->userPreferencesFeature->database) . '.'
            . Util::backquote($relationParameters->userPreferencesFeature->userConfig);
        $query = 'SELECT `config_data`, UNIX_TIMESTAMP(`timevalue`) ts'
            . ' FROM ' . $queryTable
            . ' WHERE `username` = '
            . $this->dbi->quoteString((string) $relationParameters->user);
        $row = $this->dbi->fetchSingleRow($query, DatabaseInterface::FETCH_ASSOC, ConnectionType::ControlUser);
        if (! is_array($row) || ! isset($row['config_data']) || ! isset($row['ts'])) {
            return ['config_data' => [], 'mtime' => time(), 'type' => 'db'];
        }

$configData = is_string($row['config_data']) ? json_decode($row['config_data'], true) : [];

return [
            'config_data' => is_array($configData) ? $configData : [],
            'mtime' => is_numeric($row['ts']) ? (int) $row['ts'] : time(),
            'type' => 'db',
        ];
    }

/**
     * Saves user preferences
     *
     * @param mixed[] $configArray configuration array
     *
     * @return true|Message
     */
    public function save(array $configArray): bool|Message
    {
        $relationParameters = $this->relation->getRelationParameters();
        $cacheKey = 'server_' . Current::$server;
        if (
            $relationParameters->userPreferencesFeature === null
            || $relationParameters->user === null
            || $relationParameters->db === null
        ) {
            // no pmadb table, use session storage
            $_SESSION['userconfig'] = ['db' => $configArray, 'ts' => time()];
            if (isset($_SESSION['cache'][$cacheKey]['userprefs'])) {
                unset($_SESSION['cache'][$cacheKey]['userprefs']);
            }

return true;
        }

// save configuration to pmadb
        $queryTable = Util::backquote($relationParameters->userPreferencesFeature->database) . '.'
            . Util::backquote($relationParameters->userPreferencesFeature->userConfig);
        $query = 'SELECT `username` FROM ' . $queryTable
            . ' WHERE `username` = '
            . $this->dbi->quoteString($relationParameters->user);

$hasConfig = $this->dbi->fetchValue($query, 0, ConnectionType::ControlUser);
        $configData = json_encode($configArray);
        if ($hasConfig) {
            $query = 'UPDATE ' . $queryTable
                . ' SET `timevalue` = NOW(), `config_data` = '
                . $this->dbi->quoteString($configData)
                . ' WHERE `username` = '
                . $this->dbi->quoteString($relationParameters->user);
        } else {
            $query = 'INSERT INTO ' . $queryTable
                . ' (`username`, `timevalue`,`config_data`) '
                . 'VALUES ('
                . $this->dbi->quoteString($relationParameters->user) . ', NOW(), '
                . $this->dbi->quoteString($configData) . ')';
        }

if (isset($_SESSION['cache'][$cacheKey]['userprefs'])) {
            unset($_SESSION['cache'][$cacheKey]['userprefs']);
        }

if (! $this->dbi->tryQuery($query, ConnectionType::ControlUser)) {
            $message = Message::error(__('Could not save configuration'));
            $message->addMessage(
                Message::error($this->dbi->getError(ConnectionType::ControlUser)),
                '<br><br>',
            );
            if (! $this->hasAccessToDatabase($relationParameters->db)) {
                /**
                 * When phpMyAdmin cached the configuration storage parameters, it checked if the database can be
                 * accessed, so if it could not be accessed anymore, then the cache must be cleared as it's out of date.
                 */
                $message->addMessage(Message::error(htmlspecialchars(
                    __('The phpMyAdmin configuration storage database could not be accessed.'),
                )), '<br><br>');
            }

return $message;
        }

return true;
    }

private function hasAccessToDatabase(DatabaseName $database): bool
    {
        $query = 'SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA WHERE SCHEMA_NAME = '
            . $this->dbi->quoteString($database->getName());
        if ($this->config->selectedServer['DisableIS']) {
            $query = 'SHOW DATABASES LIKE '
                . $this->dbi->quoteString(
                    $this->dbi->escapeMysqlWildcards($database->getName()),
                );
        }

return (bool) $this->dbi->fetchSingleRow($query, 'ASSOC', ConnectionType::ControlUser);
    }

/**
     * Returns a user preferences array filtered by $cfg['UserprefsDisallow']
     * (exclude list) and keys from user preferences form (allow list)
     *
     * @param mixed[] $configData path => value pairs
     *
     * @return mixed[]
     */
    public function apply(array $configData): array
    {
        $cfg = [];
        $excludeList = array_flip($this->config->settings['UserprefsDisallow']);
        $allowList = array_flip(UserFormList::getFields());
        // allow some additional fields which are custom handled
        $allowList['ThemeDefault'] = true;
        $allowList['lang'] = true;
        $allowList['Server/hide_db'] = true;
        $allowList['Server/only_db'] = true;
        $allowList['2fa'] = true;
        foreach ($configData as $path => $value) {
            if (! isset($allowList[$path]) || isset($excludeList[$path])) {
                continue;
            }

Core::arrayWrite($path, $cfg, $value);
        }

return $cfg;
    }

/**
     * Updates one user preferences option (loads and saves to database).
     *
     * No validation is done!
     *
     * @param string $path         configuration
     * @param mixed  $value        value
     * @param mixed  $defaultValue default value
     *
     * @return true|Message
     */
    public function persistOption(string $path, mixed $value, mixed $defaultValue): bool|Message
    {
        $prefs = $this->load();
        if ($value === $defaultValue) {
            if (! isset($prefs['config_data'][$path])) {
                return true;
            }

unset($prefs['config_data'][$path]);
        } else {
            $prefs['config_data'][$path] = $value;
        }

return $this->save($prefs['config_data']);
    }

/**
     * Redirects after saving new user preferences
     *
     * @param string       $fileName Filename
     * @param mixed[]|null $params   URL parameters
     * @param string|null  $hash     Hash value
     */
    public function redirect(
        string $fileName,
        array|null $params = null,
        string|null $hash = null,
    ): void {
        // redirect
        $urlParams = ['saved' => 1];
        if (is_array($params)) {
            $urlParams = array_merge($params, $urlParams);
        }

if ($hash !== null && $hash !== '') {
            $hash = '#' . urlencode($hash);
        }

ResponseRenderer::getInstance()->redirect(
            './' . $fileName . Url::getCommonRaw($urlParams, ! str_contains($fileName, '?') ? '?' : '&') . $hash,
        );
    }

/**
     * Shows form which allows to quickly load
     * settings stored in browser's local storage
     */
    public function autoloadGetHeader(): string
    {
        if (isset($_REQUEST['prefs_autoload']) && $_REQUEST['prefs_autoload'] === 'hide') {
            $_SESSION['userprefs_autoload'] = true;

return '';
        }

$returnUrl = '?' . http_build_query($_GET, '', '&');

return $this->template->render('preferences/autoload', [
            'hidden_inputs' => Url::getHiddenInputs(),
            'return_url' => $returnUrl,
        ]);
    }
}

${this.title}

Code Editor : UserPreferences.php