]> git.joonet.de Git - adminer.git/commitdiff
projects / adminer.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 9307f13)
Direct links from HTTPS to HTTP
authorJakub Vrana <jakub@vrana.cz>
Tue, 25 May 2010 09:39:13 +0000 (11:39 +0200)
committerJakub Vrana <jakub@vrana.cz>
Wed, 26 May 2010 16:09:29 +0000 (18:09 +0200)
adminer/include/bootstrap.inc.php patch | blob | history
adminer/include/design.inc.php patch | blob | history
adminer/include/functions.inc.php patch | blob | history
adminer/select.inc.php patch | blob | history

diff --git a/adminer/include/bootstrap.inc.php b/adminer/include/bootstrap.inc.php
index f43fbee9cb78c47b6729836a39b2edb8ccd68864..e8009b90e2ced79b4b81389119f8d23b821ed657 100644 (file)
--- a/adminer/include/bootstrap.inc.php
+++ b/adminer/include/bootstrap.inc.php
@@ -24,11 +24,12 @@ include "../adminer/include/functions.inc.php";
 if (!isset($_SERVER["REQUEST_URI"])) {
        $_SERVER["REQUEST_URI"] = $_SERVER["ORIG_PATH_INFO"] . ($_SERVER["QUERY_STRING"] != "" ? "?$_SERVER[QUERY_STRING]" : ""); // IIS 5 compatibility
 }
+$HTTPS = $_SERVER["HTTPS"] && strcasecmp($_SERVER["HTTPS"], "off");
 
 @ini_set("session.use_trans_sid", false); // protect links in export, @ - may be disabled
 if (!ini_bool("session.auto_start")) {
        session_name("adminer_sid"); // use specific session name to get own namespace
-       $params = array(0, preg_replace('~\\?.*~', '', $_SERVER["REQUEST_URI"]), "", $_SERVER["HTTPS"] && strcasecmp($_SERVER["HTTPS"], "off"));
+       $params = array(0, preg_replace('~\\?.*~', '', $_SERVER["REQUEST_URI"]), "", $HTTPS);
        if (version_compare(PHP_VERSION, '5.2.0') >= 0) {
                $params[] = true; // HttpOnly
        }
diff --git a/adminer/include/design.inc.php b/adminer/include/design.inc.php
index 5c89085c19a3dd73a52d065289e6cc2b7b23d814..6cb3626faf321af7e8eabff51af586490044043c 100644 (file)
--- a/adminer/include/design.inc.php
+++ b/adminer/include/design.inc.php
@@ -7,11 +7,11 @@
 * @return null
 */
 function page_header($title, $error = "", $breadcrumb = array(), $title2 = "") {
-       global $LANG, $VERSION, $adminer, $connection, $drivers;
+       global $LANG, $VERSION, $HTTPS, $adminer, $connection, $drivers;
        header("Content-Type: text/html; charset=utf-8");
        header("X-Frame-Options: deny"); // ClickJacking protection in IE8, Safari 4, Chrome 2, Firefox NoScript plugin
        $title_all = $title . ($title2 != "" ? ": " . h($title2) : "");
-       $protocol = ($_SERVER["HTTPS"] && strcasecmp($_SERVER["HTTPS"], "off") ? "https" : "http");
+       $protocol = ($HTTPS ? "https" : "http");
        ?>
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">
 <html lang="<?php echo $LANG; ?>">
diff --git a/adminer/include/functions.inc.php b/adminer/include/functions.inc.php
index 74d1a4c7a9ac7bdc09a0758f6981672a4261a774..ab06932ba63a77559269ecff0278f9610c9fd97a 100644 (file)
--- a/adminer/include/functions.inc.php
+++ b/adminer/include/functions.inc.php
@@ -245,13 +245,14 @@ function where_link($i, $column, $value, $operator = "=") {
 * @return bool
 */
 function cookie($name, $value) {
+       global $HTTPS;
        $params = array(
                $name,
                (ereg("\n", $value) ? "" : $value), // HTTP Response Splitting protection in PHP < 5.1.2
                time() + 2592000, // 2592000 - 30 days
                preg_replace('~\\?.*~', '', $_SERVER["REQUEST_URI"]),
                "",
-               $_SERVER["HTTPS"] && strcasecmp($_SERVER["HTTPS"], "off")
+               $HTTPS
        );
        if (version_compare(PHP_VERSION, '5.2.0') >= 0) {
                $params[] = true; // HttpOnly
@@ -703,11 +704,11 @@ function is_email($email) {
 
 /** Check whether the string is URL address
 * @param string
-* @return bool
+* @return string "http", "https" or ""
 */
 function is_url($string) {
-       $domain = '[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])'; // one domain component
-       return preg_match("~^https?://($domain?\\.)+$domain(:[0-9]+)?(/.*)?(\\?.*)?(#.*)?\$~i", $string); //! restrict path, query and fragment characters
+       $domain = '[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])'; // one domain component //! IDN
+       return (preg_match("~^(https?)://($domain?\\.)+$domain(:[0-9]+)?(/.*)?(\\?.*)?(#.*)?\$~i", $string, $match) ? strtolower($match[1]) : ""); //! restrict path, query and fragment characters
 }
 
 /** Print header for hidden fieldset (close by </div></fieldset>)
diff --git a/adminer/select.inc.php b/adminer/select.inc.php
index eed76f9402c1a51bf2a28473ef0f1bbe99d584a4..2380fa26400d262b084dd9973f86450f60cf7958 100644 (file)
--- a/adminer/select.inc.php
+++ b/adminer/select.inc.php
@@ -315,11 +315,16 @@ if (!$columns) {
                                                                }
                                                        }
                                                }
-                                               if (!$link && is_email($val)) {
-                                                       $link = "mailto:$val";
-                                               }
-                                               if (!$link && is_url($row[$key])) {
-                                                       $link = "http://www.adminer.org/redirect/?url=" . urlencode($row[$key]); // intermediate page to hide Referer, may be changed to rel="noreferrer" in HTML5
+                                               if (!$link) {
+                                                       if (is_email($val)) {
+                                                               $link = "mailto:$val";
+                                                       }
+                                                       if ($protocol = is_url($row[$key])) {
+                                                               $link = ($protocol == "http" && $HTTPS
+                                                                       ? $row[$key] // HTTP links from HTTPS pages don't receive Referer automatically
+                                                                       : "$protocol://www.adminer.org/redirect/?url=" . urlencode($row[$key]) // intermediate page to hide Referer, may be changed to rel="noreferrer" in HTML5
+                                                               );
+                                                       }
                                                }
                                                $id = h("val[$unique_idf][" . bracket_escape($key) . "]");
                                                $value = $_POST["val"][$unique_idf][bracket_escape($key)];
Sources of adminer, a webclient for database management systems.