From e1f0fded693c99fb77fe780288c75bd131f3ac9a Mon Sep 17 00:00:00 2001
From: Jakub Vrana <jakub@vrana.cz>
Date: Mon, 17 Mar 2025 18:45:08 +0100
Subject: [PATCH] Add helper for <input type=hidden name=token>

---
 adminer/call.inc.php            |  2 +-
 adminer/check.inc.php           |  2 +-
 adminer/create.inc.php          |  2 +-
 adminer/database.inc.php        |  2 +-
 adminer/db.inc.php              |  2 +-
 adminer/dump.inc.php            |  2 +-
 adminer/event.inc.php           |  2 +-
 adminer/foreign.inc.php         |  2 +-
 adminer/include/connect.inc.php |  2 +-
 adminer/include/design.inc.php  |  4 ++--
 adminer/include/html.inc.php    | 13 +++++++++++--
 adminer/include/lang.inc.php    |  2 +-
 adminer/indexes.inc.php         |  2 +-
 adminer/procedure.inc.php       |  2 +-
 adminer/processlist.inc.php     |  2 +-
 adminer/scheme.inc.php          |  2 +-
 adminer/select.inc.php          |  2 +-
 adminer/sequence.inc.php        |  2 +-
 adminer/sql.inc.php             |  4 ++--
 adminer/trigger.inc.php         |  2 +-
 adminer/type.inc.php            |  2 +-
 adminer/user.inc.php            |  2 +-
 adminer/view.inc.php            |  2 +-
 23 files changed, 35 insertions(+), 26 deletions(-)

diff --git a/adminer/call.inc.php b/adminer/call.inc.php
index b46eccd8..a9df194d 100644
--- a/adminer/call.inc.php
+++ b/adminer/call.inc.php
@@ -85,7 +85,7 @@ if ($in) {
 ?>
 <p>
 <input type="submit" value="<?php echo lang('Call'); ?>">
-<input type="hidden" name="token" value="<?php echo $token; ?>">
+<?php echo input_token(); ?>
 </form>
 
 <pre>
diff --git a/adminer/check.inc.php b/adminer/check.inc.php
index 6dd64831..05989ed6 100644
--- a/adminer/check.inc.php
+++ b/adminer/check.inc.php
@@ -47,5 +47,5 @@ echo doc_link(array(
 <?php if ($name != "") { ?>
 <input type="submit" name="drop" value="<?php echo lang('Drop'); ?>"><?php echo confirm(lang('Drop %s?', $name)); ?>
 <?php } ?>
-<input type="hidden" name="token" value="<?php echo $token; ?>">
+<?php echo input_token(); ?>
 </form>
diff --git a/adminer/create.inc.php b/adminer/create.inc.php
index 84c4271d..f2e897bb 100644
--- a/adminer/create.inc.php
+++ b/adminer/create.inc.php
@@ -234,6 +234,6 @@ if (support("partitioning")) {
 	}
 	echo "</table>\n</div></fieldset>\n";
 }
+echo input_token();
 ?>
-<input type="hidden" name="token" value="<?php echo $token; ?>">
 </form>
diff --git a/adminer/database.inc.php b/adminer/database.inc.php
index fed0964e..04bc3f8e 100644
--- a/adminer/database.inc.php
+++ b/adminer/database.inc.php
@@ -76,6 +76,6 @@ if (DB != "") {
 } elseif (!$_POST["add_x"] && $_GET["db"] == "") {
 	echo "<input type='image' class='icon' name='add' src='../adminer/static/plus.gif' alt='+' title='" . lang('Add next') . "'>\n";
 }
+echo input_token();
 ?>
-<input type="hidden" name="token" value="<?php echo $token; ?>">
 </form>
diff --git a/adminer/db.inc.php b/adminer/db.inc.php
index d969733f..ee3695f1 100644
--- a/adminer/db.inc.php
+++ b/adminer/db.inc.php
@@ -157,7 +157,7 @@ if ($adminer->homepage()) {
 				}
 				echo "<input type='hidden' name='all' value=''>"; // used by trCheck()
 				echo script("qsl('input').onclick = function () { selectCount('selected', formChecked(this, /^(tables|views)\[/));" . (support("table") ? " selectCount('selected2', formChecked(this, /^tables\[/) || $tables);" : "") . " }");
-				echo "<input type='hidden' name='token' value='$token'>\n";
+				echo input_token();
 				echo "</div></fieldset>\n";
 				echo "</div></div>\n";
 			}
diff --git a/adminer/dump.inc.php b/adminer/dump.inc.php
index 366e1e66..16a3c8f3 100644
--- a/adminer/dump.inc.php
+++ b/adminer/dump.inc.php
@@ -183,7 +183,7 @@ echo "<tr><th>" . lang('Data') . "<td>" . html_select('data_style', $data_style,
 ?>
 </table>
 <p><input type="submit" value="<?php echo lang('Export'); ?>">
-<input type="hidden" name="token" value="<?php echo $token; ?>">
+<?php echo input_token(); ?>
 
 <table>
 <?php
diff --git a/adminer/event.inc.php b/adminer/event.inc.php
index 73cea00d..1f08f5f8 100644
--- a/adminer/event.inc.php
+++ b/adminer/event.inc.php
@@ -56,5 +56,5 @@ if (!$row && $EVENT != "") {
 <?php if ($EVENT != "") { ?>
 <input type="submit" name="drop" value="<?php echo lang('Drop'); ?>"><?php echo confirm(lang('Drop %s?', $EVENT)); ?>
 <?php } ?>
-<input type="hidden" name="token" value="<?php echo $token; ?>">
+<?php echo input_token(); ?>
 </form>
diff --git a/adminer/foreign.inc.php b/adminer/foreign.inc.php
index e371b762..c01856c2 100644
--- a/adminer/foreign.inc.php
+++ b/adminer/foreign.inc.php
@@ -116,5 +116,5 @@ foreach ($row["source"] as $key => $val) {
 <?php if ($name != "") { ?>
 <input type="submit" name="drop" value="<?php echo lang('Drop'); ?>"><?php echo confirm(lang('Drop %s?', $name)); ?>
 <?php } ?>
-<input type="hidden" name="token" value="<?php echo $token; ?>">
+<?php echo input_token(); ?>
 </form>
diff --git a/adminer/include/connect.inc.php b/adminer/include/connect.inc.php
index 474c19b0..e69b51e8 100644
--- a/adminer/include/connect.inc.php
+++ b/adminer/include/connect.inc.php
@@ -84,7 +84,7 @@ if (
 					. "</div></div>\n"
 				: ""
 			);
-			echo "<input type='hidden' name='token' value='$token'>\n";
+			echo input_token();
 			echo "</form>\n";
 			echo script("tableCheck();");
 		}
diff --git a/adminer/include/design.inc.php b/adminer/include/design.inc.php
index 97c5eafa..1d90e308 100644
--- a/adminer/include/design.inc.php
+++ b/adminer/include/design.inc.php
@@ -182,7 +182,7 @@ function page_messages($error) {
 * @return null
 */
 function page_footer($missing = "") {
-	global $adminer, $token;
+	global $adminer;
 	?>
 </div>
 
@@ -195,7 +195,7 @@ function page_footer($missing = "") {
 <p class="logout">
 <span><?php echo h($_GET["username"]) . "\n"; ?></span>
 <input type="submit" name="logout" value="<?php echo lang('Logout'); ?>" id="logout">
-<input type="hidden" name="token" value="<?php echo $token; ?>">
+<?php echo input_token(); ?>
 </p>
 </form>
 <?php } ?>
diff --git a/adminer/include/html.inc.php b/adminer/include/html.inc.php
index 58927e56..5fdfe56b 100644
--- a/adminer/include/html.inc.php
+++ b/adminer/include/html.inc.php
@@ -25,6 +25,15 @@ function nonce() {
 	return ' nonce="' . get_nonce() . '"';
 }
 
+/** Get <input type="hidden" name="token">
+* @param string token to use instead of global $token
+* @return string HTML
+*/
+function input_token($special = "") {
+	global $token;
+	return "<input type='hidden' name='token' value='" . ($special ?: $token) . "'>\n";
+}
+
 /** Get a target="_blank" attribute
 * @return string
 */
@@ -414,7 +423,7 @@ function on_help($command, $side = 0) {
 * @return null
 */
 function edit_form($table, $fields, $row, $update) {
-	global $adminer, $token, $error;
+	global $adminer, $error;
 	$table_name = $adminer->tableName(table_status1($table, true));
 	page_header(
 		($update ? lang('Edit') : lang('Insert')),
@@ -514,7 +523,7 @@ function edit_form($table, $fields, $row, $update) {
 	?>
 <input type="hidden" name="referer" value="<?php echo h(isset($_POST["referer"]) ? $_POST["referer"] : $_SERVER["HTTP_REFERER"]); ?>">
 <input type="hidden" name="save" value="1">
-<input type="hidden" name="token" value="<?php echo $token; ?>">
+<?php echo input_token(); ?>
 </form>
 <?php
 }
diff --git a/adminer/include/lang.inc.php b/adminer/include/lang.inc.php
index a7376386..7e01db72 100644
--- a/adminer/include/lang.inc.php
+++ b/adminer/include/lang.inc.php
@@ -95,7 +95,7 @@ function switch_lang() {
 	echo "<form action='' method='post'>\n<div id='lang'>";
 	echo lang('Language') . ": " . html_select("lang", $langs, $LANG, "this.form.submit();");
 	echo " <input type='submit' value='" . lang('Use') . "' class='hidden'>\n";
-	echo "<input type='hidden' name='token' value='" . get_token() . "'>\n"; // $token may be empty in auth.inc.php
+	echo input_token(get_token()); // $token may be empty in auth.inc.php
 	echo "</div>\n</form>\n";
 }
 
diff --git a/adminer/indexes.inc.php b/adminer/indexes.inc.php
index e96d5a17..0e954299 100644
--- a/adminer/indexes.inc.php
+++ b/adminer/indexes.inc.php
@@ -155,5 +155,5 @@ foreach ($row["indexes"] as $index) {
 </div>
 <p>
 <input type="submit" value="<?php echo lang('Save'); ?>">
-<input type="hidden" name="token" value="<?php echo $token; ?>">
+<?php echo input_token(); ?>
 </form>
diff --git a/adminer/procedure.inc.php b/adminer/procedure.inc.php
index 3feaffcd..79f34857 100644
--- a/adminer/procedure.inc.php
+++ b/adminer/procedure.inc.php
@@ -59,5 +59,5 @@ if (isset($_GET["function"])) {
 <?php if ($PROCEDURE != "") { ?>
 <input type="submit" name="drop" value="<?php echo lang('Drop'); ?>"><?php echo confirm(lang('Drop %s?', $PROCEDURE)); ?>
 <?php } ?>
-<input type="hidden" name="token" value="<?php echo $token; ?>">
+<?php echo input_token(); ?>
 </form>
diff --git a/adminer/processlist.inc.php b/adminer/processlist.inc.php
index 1bf479b1..dbef17b6 100644
--- a/adminer/processlist.inc.php
+++ b/adminer/processlist.inc.php
@@ -56,7 +56,7 @@ if (support("kill")) {
 	echo ($i + 1) . "/" . lang('%d in total', max_connections());
 	echo "<p><input type='submit' value='" . lang('Kill') . "'>\n";
 }
+echo input_token();
 ?>
-<input type="hidden" name="token" value="<?php echo $token; ?>">
 </form>
 <?php echo script("tableCheck();"); ?>
diff --git a/adminer/scheme.inc.php b/adminer/scheme.inc.php
index 6c2c10ac..1f87c554 100644
--- a/adminer/scheme.inc.php
+++ b/adminer/scheme.inc.php
@@ -34,6 +34,6 @@ if (!$row) {
 if ($_GET["ns"] != "") {
 	echo "<input type='submit' name='drop' value='" . lang('Drop') . "'>" . confirm(lang('Drop %s?', $_GET["ns"])) . "\n";
 }
+echo input_token();
 ?>
-<input type="hidden" name="token" value="<?php echo $token; ?>">
 </form>
diff --git a/adminer/select.inc.php b/adminer/select.inc.php
index c5ad89d8..eebf3e5b 100644
--- a/adminer/select.inc.php
+++ b/adminer/select.inc.php
@@ -594,7 +594,7 @@ if (!$columns && support("table")) {
 				echo "</div>";
 			}
 
-			echo "<input type='hidden' name='token' value='$token'>\n";
+			echo input_token();
 			echo "</form>\n";
 			echo (!$group && $select ? "" : script("tableCheck();"));
 		}
diff --git a/adminer/sequence.inc.php b/adminer/sequence.inc.php
index c8bbb9fb..4e49f1ec 100644
--- a/adminer/sequence.inc.php
+++ b/adminer/sequence.inc.php
@@ -32,6 +32,6 @@ if (!$row) {
 if ($SEQUENCE != "") {
 	echo "<input type='submit' name='drop' value='" . lang('Drop') . "'>" . confirm(lang('Drop %s?', $SEQUENCE)) . "\n";
 }
+echo input_token();
 ?>
-<input type="hidden" name="token" value="<?php echo $token; ?>">
 </form>
diff --git a/adminer/sql.inc.php b/adminer/sql.inc.php
index d2f401f3..34b30e60 100644
--- a/adminer/sql.inc.php
+++ b/adminer/sql.inc.php
@@ -169,7 +169,7 @@ if (!$error && $_POST) {
 												. html_select("output", $adminer->dumpOutput(), $adminer_export["output"]) . " "
 												. html_select("format", $dump_format, $adminer_export["format"])
 												. "<input type='hidden' name='query' value='" . h($q) . "'>"
-												. " <input type='submit' name='export' value='" . lang('Export') . "'><input type='hidden' name='token' value='$token'></span>\n"
+												. " <input type='submit' name='export' value='" . lang('Export') . "'>" . input_token() . "</span>\n"
 												. "</form>\n"
 											;
 										}
@@ -258,7 +258,7 @@ if (!isset($_GET["import"])) {
 
 echo checkbox("error_stops", 1, ($_POST ? $_POST["error_stops"] : isset($_GET["import"]) || $_GET["error_stops"]), lang('Stop on error')) . "\n";
 echo checkbox("only_errors", 1, ($_POST ? $_POST["only_errors"] : isset($_GET["import"]) || $_GET["only_errors"]), lang('Show only errors')) . "\n";
-echo "<input type='hidden' name='token' value='$token'>\n";
+echo input_token();
 
 if (!isset($_GET["import"]) && $history) {
 	print_fieldset("history", lang('History'), $_GET["history"] != "");
diff --git a/adminer/trigger.inc.php b/adminer/trigger.inc.php
index 3b776940..ed103d41 100644
--- a/adminer/trigger.inc.php
+++ b/adminer/trigger.inc.php
@@ -49,5 +49,5 @@ page_header(($name != "" ? lang('Alter trigger') . ": " . h($name) : lang('Creat
 <?php if ($name != "") { ?>
 <input type="submit" name="drop" value="<?php echo lang('Drop'); ?>"><?php echo confirm(lang('Drop %s?', $name)); ?>
 <?php } ?>
-<input type="hidden" name="token" value="<?php echo $token; ?>">
+<?php echo input_token(); ?>
 </form>
diff --git a/adminer/type.inc.php b/adminer/type.inc.php
index da252cd8..8b2d839a 100644
--- a/adminer/type.inc.php
+++ b/adminer/type.inc.php
@@ -38,6 +38,6 @@ if ($TYPE != "") {
 	textarea("as", $row["as"]);
 	echo "<p><input type='submit' value='" . lang('Save') . "'>\n";
 }
+echo input_token();
 ?>
-<input type="hidden" name="token" value="<?php echo $token; ?>">
 </form>
diff --git a/adminer/user.inc.php b/adminer/user.inc.php
index 07e3d61e..9b6b9594 100644
--- a/adminer/user.inc.php
+++ b/adminer/user.inc.php
@@ -195,5 +195,5 @@ echo "</table>\n";
 <?php if (isset($_GET["host"])) { ?>
 <input type="submit" name="drop" value="<?php echo lang('Drop'); ?>"><?php echo confirm(lang('Drop %s?', "$USER@$_GET[host]")); ?>
 <?php } ?>
-<input type="hidden" name="token" value="<?php echo $token; ?>">
+<?php echo input_token(); ?>
 </form>
diff --git a/adminer/view.inc.php b/adminer/view.inc.php
index ce44e65c..28bd40ec 100644
--- a/adminer/view.inc.php
+++ b/adminer/view.inc.php
@@ -58,5 +58,5 @@ page_header(($TABLE != "" ? lang('Alter view') : lang('Create view')), $error, a
 <?php if ($TABLE != "") { ?>
 <input type="submit" name="drop" value="<?php echo lang('Drop'); ?>"><?php echo confirm(lang('Drop %s?', $TABLE)); ?>
 <?php } ?>
-<input type="hidden" name="token" value="<?php echo $token; ?>">
+<?php echo input_token(); ?>
 </form>