Do we prefer using trigger_error() or the direct PMA_Message::display variant?
Generally anything what comes as an error from PHP needs to be escaped, so there are two options:
- pass our error messages to trigger_error as some object (let's call
it SafeString for now) and if error handler sees SafeString, it won't do any processing of that
- do not use trigger_error for anything what includes markup
I'd prefer first solution (actually marking strings as safe to output is generally useful thing to prevent XSS).
The concept would be great—but trigger_error only accepts strings. See the signature here:
bool trigger_error ( string $error_msg [, int $error_type = E_USER_NOTICE ] )
I suggest a workaround. We might store the message’s MD5 hash in a global variable, like this:
function whitelist_error($errstr) { if (!isset($GLOBALS['error_whitelist'])) { $GLOBALS['error_whitelist'] = array(); } $GLOBALS['error_whitelist'][] = md5($the_message); }
Within the PMA_Error_Handler::handleError function, we would check if the current $errstr is whitelisted:
// if error message is not whitelisted, sanitize it if (! isset($GLOBALS['error_whitelist']) || ! in_array(md5($errstr), $GLOBALS['error_whitelist'])) {
$errstr = htmlspecialchars($errstr); } $error = new PMA_Error($errno, $errstr, $errfile, $errline);
But looking at this, do we still prefer trigger_error over directly echoing PMA_Error objects as with The phpMyAdmin configuration storage is not completely configured in main.php line 322?