fix: csv should use safe mode when it is enabled; encode query to prevent cf filters from baning request to backend (gr8b)

Co-authored-by: gr8b <[email protected]>

Author: gr8b

Module.php

@@ -56,11 +56,10 @@ public function getDatabase() {
         ];
     }
 
-    public function dbSelect(string $query) {
+    public function dbSelect(string $query, &$error = null) {
         global $DB;
 
         $db = null;
-        $error = null;
         $rows = [];
         $config = $this->getManifest();
 

actions/SqlForm.php

@@ -51,6 +51,14 @@ protected function doAction() {
         ];
         $this->getInputs($data, array_keys($data));
 
+        if ($this->hasInput('query')) {
+            $query = @base64_decode($data['query']);
+
+            if ($query !== false) {
+                $data['query'] = urldecode($query);
+            }
+        }
+
         $this->setResponse(
             $this->getAction() === 'sqlexplorer.csv'
                 ? $this->getCsvResponse($data)
@@ -59,14 +67,16 @@ protected function doAction() {
     }
 
     protected function getCsvResponse(array $data) {
-        $cursor = DBselect($data['query']);
-        if ($cursor === false) {
+        $error = null;
+        $rows = $this->module->dbSelect($data['query'], $error);
+
+        if ($error !== null) {
             $response = new CControllerResponseRedirect(
                 (new CUrl('zabbix.php'))
                     ->setArgument('action', 'sqlexplorer.form')
                     ->getUrl()
             );
-            $response->setFormData($this->getInputAll());
+            $response->setFormData($data);
 
             if (version_compare(ZABBIX_VERSION, '6.0', '<')) {
                 [$message] = clear_messages();
@@ -79,8 +89,6 @@ protected function getCsvResponse(array $data) {
             return $response;
         }
 
-        $rows = DBfetchArray($cursor);
-
         if ($rows && $data['add_column_names']) {
             array_unshift($rows, array_keys($rows[0]));
         }
@@ -106,12 +114,18 @@ protected function getCsvResponse(array $data) {
 
     protected function getHtmlResponse(array $data) {
         if ($this->hasInput('preview')) {
-            $data['rows'] = $this->module->dbSelect($data['query']);
-            $data['rows_limit'] = $this->getGuiSearchLimit();
-            $data['rows_count'] = count($data['rows']);
+            $error = null;
+            $rows = $this->module->dbSelect($data['query'], $error);
+
+            if ($error === null) {
+                $data['rows_limit'] = $this->getGuiSearchLimit();
+                $data['rows_count'] = count($rows);
+
+                if ($data['rows_count'] > $data['rows_limit']) {
+                    $data['rows'] = array_slice($rows, 0, $data['rows_limit']);
+                }
 
-            if ($data['rows_count'] > $data['rows_limit']) {
-                $data['rows'] = array_slice($data['rows'], 0, $data['rows_limit']);
+                $data['rows'] = $rows;
             }
 
             if (version_compare(ZABBIX_VERSION, '6.0', '<')) {

app.js

@@ -26,6 +26,7 @@ document.getElementById('csv').addEventListener('click', function() {
     setActionToken('sqlexplorer.csv', form)
     form.setAttribute('action', 'zabbix.php?action=sqlexplorer.csv')
     setLoadingState(true)
+    query_textbox.value = window.btoa(unescape(encodeURIComponent(editor.state.doc.toString())))
     form.submit()
     setTimeout(() => setLoadingState(false), 1000)
 });
@@ -40,6 +41,7 @@ document.getElementById('preview').addEventListener('click', function(e) {
         return false
     }
 
+    query_textbox.value = window.btoa(unescape(encodeURIComponent(editor.state.doc.toString())))
     setLoadingState(true)
     form.submit()
 });
@@ -157,9 +159,6 @@ let editor = new EditorView({
     }),
     parent: query_textbox.parentElement
 })
-form.addEventListener('submit', e => {
-    query_textbox.value = editor.state.doc.toString()
-})
 query_textbox.addEventListener('change', e => {
     let old_value = editor.state.doc.toString()