Use ServerRequestObject to access POST-vars

Signed-off-by: Sebastian Walther <swalther@complex-it.de>
2026-10-28 07:41:55 +03:00 · 2022-10-13 13:58:34 +02:00
parent d3a8edb4e2
commit d569fe2f05
8 changed files with 68 additions and 25 deletions
--- a/libraries/classes/Controllers/Database/CentralColumns/PopulateColumnsController.php
+++ b/libraries/classes/Controllers/Database/CentralColumns/PopulateColumnsController.php
@@ -26,7 +26,10 @@ final class PopulateColumnsController extends AbstractController

    public function __invoke(ServerRequest $request): void
    {
-        $columns = $this->centralColumns->getColumnsNotInCentralList($GLOBALS['db'], $_POST['selectedTable']);
+        $columns = $this->centralColumns->getColumnsNotInCentralList(
+            $GLOBALS['db'],
+            $request->getParsedBodyParam('selectedTable')
+        );
        $this->render('database/central_columns/populate_columns', ['columns' => $columns]);
    }
 }
--- a/libraries/classes/Controllers/Database/SqlController.php
+++ b/libraries/classes/Controllers/Database/SqlController.php
@@ -63,7 +63,7 @@ class SqlController extends AbstractController
            true,
            false,
            isset($_POST['delimiter'])
-                ? htmlspecialchars($_POST['delimiter'])
+                ? htmlspecialchars($request->getParsedBodyParam('delimiter'))
                : ';'
        ));
    }
--- a/libraries/classes/Controllers/Database/SqlFormatController.php
+++ b/libraries/classes/Controllers/Database/SqlFormatController.php
@@ -17,7 +17,7 @@ class SqlFormatController extends AbstractController
 {
    public function __invoke(ServerRequest $request): void
    {
-        $params = ['sql' => $_POST['sql'] ?? null];
+        $params = ['sql' => $request->getParsedBodyParam('sql')];
        $query = strlen((string) $params['sql']) > 0 ? $params['sql'] : '';
        $this->response->addJSON(['sql' => Formatter::format($query)]);
    }
--- a/libraries/classes/Controllers/Database/StructureController.php
+++ b/libraries/classes/Controllers/Database/StructureController.php
@@ -168,7 +168,7 @@ class StructureController extends AbstractController
            ]);
        }

-        $this->replicationInfo->load($_POST['primary_connection'] ?? null);
+        $this->replicationInfo->load($request->getParsedBodyParam('primary_connection'));
        $replicaInfo = $this->replicationInfo->getReplicaInfo();

        $pageSettings = new PageSettings('DbStructure');
--- a/libraries/classes/Controllers/HomeController.php
+++ b/libraries/classes/Controllers/HomeController.php
@@ -82,7 +82,7 @@ class HomeController extends AbstractController
        // This is for $cfg['ShowDatabasesNavigationAsTree'] = false;
        // See: https://github.com/phpmyadmin/phpmyadmin/issues/16520
        // The DB is defined here and sent to the JS front-end to refresh the DB tree
-        $GLOBALS['db'] = $_POST['db'] ?? '';
+        $GLOBALS['db'] = $request->getParsedBodyParam('db', '');
        $GLOBALS['table'] = '';
        $GLOBALS['show_query'] = '1';
        $GLOBALS['errorUrl'] = Url::getFromRoute('/');
--- a/libraries/classes/Controllers/LintController.php
+++ b/libraries/classes/Controllers/LintController.php
@@ -22,7 +22,7 @@ class LintController extends AbstractController
    {
        $params = [
            'sql_query' => $_POST['sql_query'] ?? null,
-            'options' => $_POST['options'] ?? null,
+            'options' => $request->getParsedBodyParam('options'),
        ];

        /**
--- a/phpstan-baseline.neon
+++ b/phpstan-baseline.neon
@@ -975,6 +975,11 @@ parameters:
 			count: 1
 			path: libraries/classes/Controllers/Config/SetConfigController.php

+		-
+			message: "#^Parameter \\#2 \\$table of method PhpMyAdmin\\\\Database\\\\CentralColumns\\:\\:getColumnsNotInCentralList\\(\\) expects string, mixed given\\.$#"
+			count: 1
+			path: libraries/classes/Controllers/Database/CentralColumns/PopulateColumnsController.php
+
 		-
 			message: "#^Method PhpMyAdmin\\\\Controllers\\\\Database\\\\CentralColumnsController\\:\\:addColumn\\(\\) has parameter \\$params with no value type specified in iterable type array\\.$#"
 			count: 1
@@ -1055,6 +1060,21 @@ parameters:
 			count: 1
 			path: libraries/classes/Controllers/Database/SqlAutoCompleteController.php

+		-
+			message: "#^Parameter \\#1 \\$string of function htmlspecialchars expects string, mixed given\\.$#"
+			count: 1
+			path: libraries/classes/Controllers/Database/SqlController.php
+
+		-
+			message: "#^Cannot cast mixed to string\\.$#"
+			count: 1
+			path: libraries/classes/Controllers/Database/SqlFormatController.php
+
+		-
+			message: "#^Parameter \\#1 \\$query of static method PhpMyAdmin\\\\SqlParser\\\\Utils\\\\Formatter\\:\\:format\\(\\) expects string, mixed given\\.$#"
+			count: 1
+			path: libraries/classes/Controllers/Database/SqlFormatController.php
+
 		-
 			message: "#^Cannot access offset non\\-empty\\-string on mixed\\.$#"
 			count: 1
@@ -1160,6 +1180,11 @@ parameters:
 			count: 1
 			path: libraries/classes/Controllers/Database/StructureController.php

+		-
+			message: "#^Parameter \\#1 \\$connection of method PhpMyAdmin\\\\ReplicationInfo\\:\\:load\\(\\) expects string\\|null, mixed given\\.$#"
+			count: 1
+			path: libraries/classes/Controllers/Database/StructureController.php
+
 		-
 			message: "#^Parameter \\#4 \\$formattedSize of method PhpMyAdmin\\\\Controllers\\\\Database\\\\StructureController\\:\\:getValuesForAriaTable\\(\\) expects int, string given\\.$#"
 			count: 1
@@ -1240,6 +1265,21 @@ parameters:
 			count: 1
 			path: libraries/classes/Controllers/HomeController.php

+		-
+			message: "#^Cannot access offset 'eventEditor' on mixed\\.$#"
+			count: 1
+			path: libraries/classes/Controllers/LintController.php
+
+		-
+			message: "#^Cannot access offset 'routineEditor' on mixed\\.$#"
+			count: 1
+			path: libraries/classes/Controllers/LintController.php
+
+		-
+			message: "#^Cannot access offset 'triggerEditor' on mixed\\.$#"
+			count: 1
+			path: libraries/classes/Controllers/LintController.php
+
 		-
 			message: "#^Parameter \\#1 \\$partialDependencies of method PhpMyAdmin\\\\Normalization\\:\\:createNewTablesFor2NF\\(\\) expects array, mixed given\\.$#"
 			count: 1
--- a/psalm-baseline.xml
+++ b/psalm-baseline.xml
@@ -941,12 +941,9 @@
    </MixedArgument>
  </file>
  <file src="libraries/classes/Controllers/Database/CentralColumns/PopulateColumnsController.php">
-    <PossiblyInvalidArgument occurrences="1">
-      <code>$_POST['selectedTable']</code>
-    </PossiblyInvalidArgument>
-    <PossiblyInvalidCast occurrences="1">
-      <code>$_POST['selectedTable']</code>
-    </PossiblyInvalidCast>
+    <MixedArgument occurrences="1">
+      <code>$request-&gt;getParsedBodyParam('selectedTable')</code>
+    </MixedArgument>
  </file>
  <file src="libraries/classes/Controllers/Database/CentralColumnsController.php">
    <MixedArgument occurrences="22">
@@ -1395,22 +1392,21 @@
    </MixedAssignment>
  </file>
  <file src="libraries/classes/Controllers/Database/SqlController.php">
+    <MixedArgument occurrences="1">
+      <code>$request-&gt;getParsedBodyParam('delimiter')</code>
+    </MixedArgument>
    <MixedAssignment occurrences="2">
      <code>$GLOBALS['back']</code>
      <code>$GLOBALS['errorUrl']</code>
    </MixedAssignment>
-    <PossiblyInvalidArgument occurrences="1">
-      <code>$_POST['delimiter']</code>
-    </PossiblyInvalidArgument>
  </file>
  <file src="libraries/classes/Controllers/Database/SqlFormatController.php">
-    <PossiblyInvalidArgument occurrences="1">
+    <MixedArgument occurrences="1">
      <code>$query</code>
-    </PossiblyInvalidArgument>
-    <PossiblyInvalidCast occurrences="2">
-      <code>$params['sql']</code>
+    </MixedArgument>
+    <MixedAssignment occurrences="1">
      <code>$query</code>
-    </PossiblyInvalidCast>
+    </MixedAssignment>
  </file>
  <file src="libraries/classes/Controllers/Database/Structure/AddPrefixController.php">
    <MixedAssignment occurrences="2">
@@ -1668,7 +1664,7 @@
      <code>$formattedOverhead</code>
      <code>$formattedSize</code>
    </InvalidScalarArgument>
-    <MixedArgument occurrences="36">
+    <MixedArgument occurrences="37">
      <code>$checkTime</code>
      <code>$checkTimeAll</code>
      <code>$createTime</code>
@@ -1700,6 +1696,7 @@
      <code>$replicaInfo['Ignore_Table']</code>
      <code>$replicaInfo['Wild_Do_Table']</code>
      <code>$replicaInfo['Wild_Ignore_Table']</code>
+      <code>$request-&gt;getParsedBodyParam('primary_connection')</code>
      <code>$sumSize</code>
      <code>$tableIsView</code>
      <code>$truename</code>
@@ -1771,9 +1768,6 @@
      <code>$currentTable['TABLE_NAME']</code>
      <code>$currentTable['TABLE_ROWS']</code>
    </MixedOperand>
-    <PossiblyInvalidArgument occurrences="1">
-      <code>$_POST['primary_connection'] ?? null</code>
-    </PossiblyInvalidArgument>
    <PossiblyNullArrayAccess occurrences="8">
      <code>$formattedOverhead</code>
      <code>$formattedSize</code>
@@ -2192,7 +2186,8 @@
    <MixedArrayAccess occurrences="1">
      <code>$GLOBALS['language_stats'][$GLOBALS['lang']]</code>
    </MixedArrayAccess>
-    <MixedAssignment occurrences="2">
+    <MixedAssignment occurrences="3">
+      <code>$GLOBALS['db']</code>
      <code>$GLOBALS['errorUrl']</code>
      <code>$GLOBALS['show_query']</code>
    </MixedAssignment>
@@ -2334,6 +2329,11 @@
      <code>$_GET['id']</code>
    </PossiblyInvalidCast>
  </file>
+  <file src="libraries/classes/Controllers/LintController.php">
+    <MixedAssignment occurrences="1">
+      <code>$options</code>
+    </MixedAssignment>
+  </file>
  <file src="libraries/classes/Controllers/LogoutController.php">
    <MixedAssignment occurrences="1">
      <code>$GLOBALS['auth_plugin']</code>