From a5ee3451ac5695625b7294b84f2c119be1131c65 Mon Sep 17 00:00:00 2001
From: Jakub Vrana <jakub@vrana.cz>
Date: Fri, 12 Jan 2018 14:43:55 +0100
Subject: [PATCH] Use <script> instead of inline event handler in confirm()

---
 adminer/create.inc.php            | 2 +-
 adminer/database.inc.php          | 2 +-
 adminer/db.inc.php                | 4 ++--
 adminer/event.inc.php             | 2 +-
 adminer/foreign.inc.php           | 2 +-
 adminer/include/connect.inc.php   | 2 +-
 adminer/include/functions.inc.php | 7 ++++---
 adminer/procedure.inc.php         | 2 +-
 adminer/scheme.inc.php            | 2 +-
 adminer/select.inc.php            | 2 +-
 adminer/sequence.inc.php          | 2 +-
 adminer/trigger.inc.php           | 2 +-
 adminer/type.inc.php              | 2 +-
 adminer/user.inc.php              | 2 +-
 adminer/view.inc.php              | 2 +-
 15 files changed, 19 insertions(+), 18 deletions(-)

diff --git a/adminer/create.inc.php b/adminer/create.inc.php
index 93604df9..3e6cf2cd 100644
--- a/adminer/create.inc.php
+++ b/adminer/create.inc.php
@@ -197,7 +197,7 @@ edit_fields($row["fields"], $collations, "TABLE", $foreign_keys, $comments);
 <input type="submit" value="<?php echo lang('Save'); ?>">
 <?php } ?>
 
-<?php if ($TABLE != "") { ?><input type="submit" name="drop" value="<?php echo lang('Drop'); ?>"<?php echo confirm(); ?>><?php } ?>
+<?php if ($TABLE != "") { ?><input type="submit" name="drop" value="<?php echo lang('Drop'); ?>"><?php echo confirm(); ?><?php } ?>
 <?php
 if (support("partitioning")) {
 	$partition_table = preg_match('~RANGE|LIST~', $row["partition_by"]);
diff --git a/adminer/database.inc.php b/adminer/database.inc.php
index 57a6643c..92e2b478 100644
--- a/adminer/database.inc.php
+++ b/adminer/database.inc.php
@@ -70,7 +70,7 @@ echo ($_POST["add_x"] || strpos($name, "\n")
 <input type="submit" value="<?php echo lang('Save'); ?>">
 <?php
 if (DB != "") {
-	echo "<input type='submit' name='drop' value='" . lang('Drop') . "'" . confirm() . ">\n";
+	echo "<input type='submit' name='drop' value='" . lang('Drop') . "'>" . confirm() . "\n";
 } elseif (!$_POST["add_x"] && $_GET["db"] == "") {
 	echo "<input type='image' class='icon' name='add' src='../adminer/static/plus.gif' alt='+' title='" . lang('Add next') . "'>\n";
 }
diff --git a/adminer/db.inc.php b/adminer/db.inc.php
index deb5c251..a36ecba2 100644
--- a/adminer/db.inc.php
+++ b/adminer/db.inc.php
@@ -125,8 +125,8 @@ if ($adminer->homepage()) {
 					. "<input type='submit' name='check' value='" . lang('Check') . "'" . on_help("'CHECK TABLE'") . "> "
 					. "<input type='submit' name='repair' value='" . lang('Repair') . "'" . on_help("'REPAIR TABLE'") . "> "
 				: "")))
-				. "<input type='submit' name='truncate' value='" . lang('Truncate') . "'" . confirm() . on_help($jush == "sqlite" ? "'DELETE'" : "'TRUNCATE" . ($jush == "pgsql" ? "'" : " TABLE'")) . "> "
-				. "<input type='submit' name='drop' value='" . lang('Drop') . "'" . confirm() . on_help("'DROP TABLE'") . ">\n";
+				. "<input type='submit' name='truncate' value='" . lang('Truncate') . "'" . on_help($jush == "sqlite" ? "'DELETE'" : "'TRUNCATE" . ($jush == "pgsql" ? "'" : " TABLE'")) . "> " . confirm()
+				. "<input type='submit' name='drop' value='" . lang('Drop') . "'" . on_help("'DROP TABLE'") . ">" . confirm() . "\n";
 				$databases = (support("scheme") ? $adminer->schemas() : $adminer->databases());
 				if (count($databases) != 1 && $jush != "sqlite") {
 					$db = (isset($_POST["target"]) ? $_POST["target"] : (support("scheme") ? $_GET["ns"] : DB));
diff --git a/adminer/event.inc.php b/adminer/event.inc.php
index e561532e..d008952b 100644
--- a/adminer/event.inc.php
+++ b/adminer/event.inc.php
@@ -47,6 +47,6 @@ if (!$row && $EVENT != "") {
 <p><?php textarea("EVENT_DEFINITION", $row["EVENT_DEFINITION"]); ?>
 <p>
 <input type="submit" value="<?php echo lang('Save'); ?>">
-<?php if ($EVENT != "") { ?><input type="submit" name="drop" value="<?php echo lang('Drop'); ?>"<?php echo confirm(); ?>><?php } ?>
+<?php if ($EVENT != "") { ?><input type="submit" name="drop" value="<?php echo lang('Drop'); ?>"><?php echo confirm(); ?><?php } ?>
 <input type="hidden" name="token" value="<?php echo $token; ?>">
 </form>
diff --git a/adminer/foreign.inc.php b/adminer/foreign.inc.php
index 85779357..2e0ff74f 100644
--- a/adminer/foreign.inc.php
+++ b/adminer/foreign.inc.php
@@ -86,6 +86,6 @@ foreach ($row["source"] as $key => $val) {
 <input type="submit" value="<?php echo lang('Save'); ?>">
 <noscript><p><input type="submit" name="add" value="<?php echo lang('Add column'); ?>"></noscript>
 <?php } ?>
-<?php if ($name != "") { ?><input type="submit" name="drop" value="<?php echo lang('Drop'); ?>"<?php echo confirm(); ?>><?php } ?>
+<?php if ($name != "") { ?><input type="submit" name="drop" value="<?php echo lang('Drop'); ?>"><?php echo confirm(); ?><?php } ?>
 <input type="hidden" name="token" value="<?php echo $token; ?>">
 </form>
diff --git a/adminer/include/connect.inc.php b/adminer/include/connect.inc.php
index 4d3be410..a398e728 100644
--- a/adminer/include/connect.inc.php
+++ b/adminer/include/connect.inc.php
@@ -58,7 +58,7 @@ function connect_error() {
 			echo (support("database")
 				? "<fieldset><legend>" . lang('Selected') . " <span id='selected'></span></legend><div>\n"
 					. "<input type='hidden' name='all' value=''><script>qsl('input').onclick = function () { selectCount('selected', formChecked(this, /^db/)); };</script>\n" // used by trCheck()
-					. "<input type='submit' name='drop' value='" . lang('Drop') . "'" . confirm() . ">\n"
+					. "<input type='submit' name='drop' value='" . lang('Drop') . "'>" . confirm() . "\n"
 					. "</div></fieldset>\n"
 				: ""
 			);
diff --git a/adminer/include/functions.inc.php b/adminer/include/functions.inc.php
index 3bd4d0fa..abe934a0 100644
--- a/adminer/include/functions.inc.php
+++ b/adminer/include/functions.inc.php
@@ -189,10 +189,11 @@ function select_input($attrs, $options, $value = "", $onchange = "", $placeholde
 }
 
 /** Get onclick confirmation
+* @param string
 * @return string
 */
-function confirm() {
-	return " onclick=\"return confirm('" . lang('Are you sure?') . "');\"";
+function confirm($selector = "qsl('input')") {
+	return "<script>$selector.onclick = function () { return confirm('" . lang('Are you sure?') . "'); };</script>";
 }
 
 /** Print header for hidden fieldset (close by </div></fieldset>)
@@ -1385,7 +1386,7 @@ function edit_form($TABLE, $fields, $row, $update) {
 			) . "' title='Ctrl+Shift+Enter'>\n";
 		}
 	}
-	echo ($update ? "<input type='submit' name='delete' value='" . lang('Delete') . "'" . confirm() . ">\n"
+	echo ($update ? "<input type='submit' name='delete' value='" . lang('Delete') . "'>" . confirm() . "\n"
 		: ($_POST || !$fields ? "" : "<script>focus(qsa('td', qs('#form'))[1].firstChild);</script>\n")
 	);
 	if (isset($_GET["select"])) {
diff --git a/adminer/procedure.inc.php b/adminer/procedure.inc.php
index 83a1668a..466e0b8d 100644
--- a/adminer/procedure.inc.php
+++ b/adminer/procedure.inc.php
@@ -49,6 +49,6 @@ if (isset($_GET["function"])) {
 <p><?php textarea("definition", $row["definition"]); ?>
 <p>
 <input type="submit" value="<?php echo lang('Save'); ?>">
-<?php if ($PROCEDURE != "") { ?><input type="submit" name="drop" value="<?php echo lang('Drop'); ?>"<?php echo confirm(); ?>><?php } ?>
+<?php if ($PROCEDURE != "") { ?><input type="submit" name="drop" value="<?php echo lang('Drop'); ?>"><?php echo confirm(); ?><?php } ?>
 <input type="hidden" name="token" value="<?php echo $token; ?>">
 </form>
diff --git a/adminer/scheme.inc.php b/adminer/scheme.inc.php
index fc588dd6..bc79e1b9 100644
--- a/adminer/scheme.inc.php
+++ b/adminer/scheme.inc.php
@@ -31,7 +31,7 @@ if (!$row) {
 <input type="submit" value="<?php echo lang('Save'); ?>">
 <?php
 if ($_GET["ns"] != "") {
-	echo "<input type='submit' name='drop' value='" . lang('Drop') . "'" . confirm() . ">\n";
+	echo "<input type='submit' name='drop' value='" . lang('Drop') . "'>" . confirm() . "\n";
 }
 ?>
 <input type="hidden" name="token" value="<?php echo $token; ?>">
diff --git a/adminer/select.inc.php b/adminer/select.inc.php
index ef9d3e48..12767bdc 100644
--- a/adminer/select.inc.php
+++ b/adminer/select.inc.php
@@ -503,7 +503,7 @@ if (!$columns && support("table")) {
 <fieldset><legend><?php echo lang('Selected'); ?> <span id="selected"></span></legend><div>
 <input type="submit" name="edit" value="<?php echo lang('Edit'); ?>">
 <input type="submit" name="clone" value="<?php echo lang('Clone'); ?>">
-<input type="submit" name="delete" value="<?php echo lang('Delete'); ?>"<?php echo confirm(); ?>>
+<input type="submit" name="delete" value="<?php echo lang('Delete'); ?>"><?php echo confirm(); ?>
 </div></fieldset>
 <?php
 			}
diff --git a/adminer/sequence.inc.php b/adminer/sequence.inc.php
index e09ff089..a7bac926 100644
--- a/adminer/sequence.inc.php
+++ b/adminer/sequence.inc.php
@@ -28,7 +28,7 @@ if (!$row) {
 <input type="submit" value="<?php echo lang('Save'); ?>">
 <?php
 if ($SEQUENCE != "") {
-	echo "<input type='submit' name='drop' value='" . lang('Drop') . "'" . confirm() . ">\n";
+	echo "<input type='submit' name='drop' value='" . lang('Drop') . "'>" . confirm() . "\n";
 }
 ?>
 <input type="hidden" name="token" value="<?php echo $token; ?>">
diff --git a/adminer/trigger.inc.php b/adminer/trigger.inc.php
index 94b98ba9..498b54e5 100644
--- a/adminer/trigger.inc.php
+++ b/adminer/trigger.inc.php
@@ -44,6 +44,6 @@ page_header(($name != "" ? lang('Alter trigger') . ": " . h($name) : lang('Creat
 <p><?php textarea("Statement", $row["Statement"]); ?>
 <p>
 <input type="submit" value="<?php echo lang('Save'); ?>">
-<?php if ($name != "") { ?><input type="submit" name="drop" value="<?php echo lang('Drop'); ?>"<?php echo confirm(); ?>><?php } ?>
+<?php if ($name != "") { ?><input type="submit" name="drop" value="<?php echo lang('Drop'); ?>"><?php echo confirm(); ?><?php } ?>
 <input type="hidden" name="token" value="<?php echo $token; ?>">
 </form>
diff --git a/adminer/type.inc.php b/adminer/type.inc.php
index 01712b26..4ba78bc3 100644
--- a/adminer/type.inc.php
+++ b/adminer/type.inc.php
@@ -22,7 +22,7 @@ if (!$row) {
 <p>
 <?php
 if ($TYPE != "") {
-	echo "<input type='submit' name='drop' value='" . lang('Drop') . "'" . confirm() . ">\n";
+	echo "<input type='submit' name='drop' value='" . lang('Drop') . "'>" . confirm() . "\n";
 } else {
 	echo "<input name='name' value='" . h($row['name']) . "' autocapitalize='off'>\n";
 	textarea("as", $row["as"]);
diff --git a/adminer/user.inc.php b/adminer/user.inc.php
index 9442c487..97b3b4a1 100644
--- a/adminer/user.inc.php
+++ b/adminer/user.inc.php
@@ -180,6 +180,6 @@ echo "</table>\n";
 ?>
 <p>
 <input type="submit" value="<?php echo lang('Save'); ?>">
-<?php if (isset($_GET["host"])) { ?><input type="submit" name="drop" value="<?php echo lang('Drop'); ?>"<?php echo confirm(); ?>><?php } ?>
+<?php if (isset($_GET["host"])) { ?><input type="submit" name="drop" value="<?php echo lang('Drop'); ?>"><?php echo confirm(); ?><?php } ?>
 <input type="hidden" name="token" value="<?php echo $token; ?>">
 </form>
diff --git a/adminer/view.inc.php b/adminer/view.inc.php
index 9c09a546..fee3fcdf 100644
--- a/adminer/view.inc.php
+++ b/adminer/view.inc.php
@@ -53,6 +53,6 @@ page_header(($TABLE != "" ? lang('Alter view') : lang('Create view')), $error, a
 <p><?php textarea("select", $row["select"]); ?>
 <p>
 <input type="submit" value="<?php echo lang('Save'); ?>">
-<?php if ($_GET["view"] != "") { ?><input type="submit" name="drop" value="<?php echo lang('Drop'); ?>"<?php echo confirm(); ?>><?php } ?>
+<?php if ($_GET["view"] != "") { ?><input type="submit" name="drop" value="<?php echo lang('Drop'); ?>"><?php echo confirm(); ?><?php } ?>
 <input type="hidden" name="token" value="<?php echo $token; ?>">
 </form>