Remove $_POST variables from Table\TrackingController

Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>

5 files changed, 91 insertions, 86 deletions

diff --git a/libraries/classes/Controllers/Table/TrackingController.php b/libraries/classes/Controllers/Table/TrackingController.php
index 62073a9ecc..acf0502ed1 100644
--- a/libraries/classes/Controllers/Table/TrackingController.php
+++ b/libraries/classes/Controllers/Table/TrackingController.php
@@ -98,6 +98,10 @@ final class TrackingController extends AbstractController
 
         $logType = $this->validateLogTypeParam($request->getParsedBodyParam('log_type'));
 
+        $dateFrom = '';
+        $dateTo = '';
+        $users = '';
+
         // Init vars for tracking report
         if ($report || $reportExport !== null) {
             $trackedData = Tracker::getTrackedData(
@@ -108,21 +112,10 @@ final class TrackingController extends AbstractController
 
             /** @var string $dateFrom */
             $dateFrom = $request->getParsedBodyParam('date_from', $trackedData['date_from']);
-            if (! isset($_POST['date_from'])) {
-                $_POST['date_from'] = $trackedData['date_from'];
-            }
-
             /** @var string $dateTo */
             $dateTo = $request->getParsedBodyParam('date_to', $trackedData['date_to']);
-            if (! isset($_POST['date_to'])) {
-                $_POST['date_to'] = $trackedData['date_to'];
-            }
-
             /** @var string $users */
             $users = $request->getParsedBodyParam('users', '*');
-            if (! isset($_POST['users'])) {
-                $_POST['users'] = '*';
-            }
 
             $GLOBALS['filter_ts_from'] = strtotime($dateFrom);
             $GLOBALS['filter_ts_to'] = strtotime($dateTo);
@@ -235,8 +228,8 @@ final class TrackingController extends AbstractController
                 $GLOBALS['table'],
                 $versionParam,
                 $trackedData,
-                isset($_POST['delete_ddlog']),
-                isset($_POST['delete_dmlog'])
+                $request->hasBodyParam('delete_ddlog'),
+                $request->hasBodyParam('delete_dmlog')
             );
         }
 
@@ -248,7 +241,11 @@ final class TrackingController extends AbstractController
                 $logType,
                 (int) $GLOBALS['filter_ts_to'],
                 (int) $GLOBALS['filter_ts_from'],
-                $GLOBALS['filter_users']
+                $GLOBALS['filter_users'],
+                $versionParam,
+                $dateFrom,
+                $dateTo,
+                $users
             );
         }
 
diff --git a/libraries/classes/Tracking.php b/libraries/classes/Tracking.php
index eedd24cbee..1445d64b0b 100644
--- a/libraries/classes/Tracking.php
+++ b/libraries/classes/Tracking.php
@@ -224,7 +224,11 @@ class Tracking
         string $logType,
         $filter_ts_to,
         $filter_ts_from,
-        array $filter_users
+        array $filter_users,
+        string $version,
+        string $dateFrom,
+        string $dateTo,
+        string $users
     ) {
         $html = '<h3>' . __('Tracking report')
             . '  [<a href="' . Url::getFromRoute('/table/tracking', $url_params) . '">' . __('Close')
@@ -234,7 +238,12 @@ class Tracking
             . htmlspecialchars($data['tracking']) . '</small><br>';
         $html .= '<br>';
 
-        [$str1, $str2, $str3, $str4, $str5] = $this->getHtmlForElementsOfTrackingReport($logType);
+        [$str1, $str2, $str3, $str4, $str5] = $this->getHtmlForElementsOfTrackingReport(
+            $logType,
+            $dateFrom,
+            $dateTo,
+            $users
+        );
 
         // Prepare delete link content here
         $drop_image_or_text = '';
@@ -267,10 +276,23 @@ class Tracking
             $str3,
             $str4,
             $str5,
-            $drop_image_or_text
+            $drop_image_or_text,
+            $version
         );
 
-        $html .= $this->getHtmlForTrackingReportExportForm2($url_params, $str1, $str2, $str3, $str4, $str5, $logType);
+        $html .= $this->getHtmlForTrackingReportExportForm2(
+            $url_params,
+            $str1,
+            $str2,
+            $str3,
+            $str4,
+            $str5,
+            $logType,
+            $version,
+            $dateFrom,
+            $dateTo,
+            $users
+        );
 
         $html .= "<br><br><hr><br>\n";
 
@@ -282,10 +304,14 @@ class Tracking
      *
      * @psalm-param 'schema'|'data'|'schema_and_data' $logType
      *
-     * @return array
+     * @return string[]
      */
-    public function getHtmlForElementsOfTrackingReport(string $logType)
-    {
+    public function getHtmlForElementsOfTrackingReport(
+        string $logType,
+        string $dateFrom,
+        string $dateTo,
+        string $users
+    ): array {
         $str1 = '<select name="log_type">'
             . '<option value="schema"'
             . ($logType === 'schema' ? ' selected="selected"' : '') . '>'
@@ -298,11 +324,11 @@ class Tracking
             . __('Structure and data') . '</option>'
             . '</select>';
         $str2 = '<input type="text" name="date_from" value="'
-            . htmlspecialchars($_POST['date_from']) . '" size="19">';
+            . htmlspecialchars($dateFrom) . '" size="19">';
         $str3 = '<input type="text" name="date_to" value="'
-            . htmlspecialchars($_POST['date_to']) . '" size="19">';
+            . htmlspecialchars($dateTo) . '" size="19">';
         $str4 = '<input type="text" name="users" value="'
-            . htmlspecialchars($_POST['users']) . '">';
+            . htmlspecialchars($users) . '">';
         $str5 = '<input type="hidden" name="list_report" value="1">'
             . '<input class="btn btn-primary" type="submit" value="' . __('Go') . '">';
 
@@ -345,14 +371,15 @@ class Tracking
         $str3,
         $str4,
         $str5,
-        $drop_image_or_text
+        $drop_image_or_text,
+        string $version
     ) {
         $ddlog_count = 0;
 
         $html = '<form method="post" action="' . Url::getFromRoute('/table/tracking') . '">';
         $html .= Url::getHiddenInputs($url_params + [
             'report' => 'true',
-            'version' => $_POST['version'],
+            'version' => $version,
         ]);
 
         $html .= sprintf(
@@ -371,7 +398,8 @@ class Tracking
                 $filter_ts_from,
                 $filter_ts_to,
                 $url_params,
-                $drop_image_or_text
+                $drop_image_or_text,
+                $version
             );
             $html .= $temp;
             unset($temp);
@@ -386,7 +414,8 @@ class Tracking
                 $filter_ts_to,
                 $url_params,
                 $ddlog_count,
-                $drop_image_or_text
+                $drop_image_or_text,
+                $version
             );
         }
 
@@ -415,12 +444,16 @@ class Tracking
         $str3,
         $str4,
         $str5,
-        string $logType
+        string $logType,
+        string $version,
+        string $dateFrom,
+        string $dateTo,
+        string $users
     ) {
         $html = '<form method="post" action="' . Url::getFromRoute('/table/tracking') . '">';
         $html .= Url::getHiddenInputs($url_params + [
             'report' => 'true',
-            'version' => $_POST['version'],
+            'version' => $version,
         ]);
 
         $html .= sprintf(
@@ -436,11 +469,11 @@ class Tracking
         $html .= '<form class="disableAjax" method="post" action="' . Url::getFromRoute('/table/tracking') . '">';
         $html .= Url::getHiddenInputs($url_params + [
             'report' => 'true',
-            'version' => $_POST['version'],
+            'version' => $version,
             'log_type' => $logType,
-            'date_from' => $_POST['date_from'],
-            'date_to' => $_POST['date_to'],
-            'users' => $_POST['users'],
+            'date_from' => $dateFrom,
+            'date_to' => $dateTo,
+            'users' => $users,
             'report_export' => 'true',
         ]);
 
@@ -483,7 +516,8 @@ class Tracking
         $filter_ts_to,
         array $url_params,
         $ddlog_count,
-        $drop_image_or_text
+        $drop_image_or_text,
+        string $version
     ) {
         // no need for the second returned parameter
         [$html] = $this->getHtmlForDataStatements(
@@ -496,7 +530,8 @@ class Tracking
             'dmlog',
             __('Data manipulation statement'),
             $ddlog_count,
-            'dml_versions'
+            'dml_versions',
+            $version
         );
 
         return $html;
@@ -520,7 +555,8 @@ class Tracking
         $filter_ts_from,
         $filter_ts_to,
         array $url_params,
-        $drop_image_or_text
+        $drop_image_or_text,
+        string $version
     ) {
         [$html, $line_number] = $this->getHtmlForDataStatements(
             $data,
@@ -532,7 +568,8 @@ class Tracking
             'ddlog',
             __('Data definition statement'),
             1,
-            'ddl_versions'
+            'ddl_versions',
+            $version
         );
 
         return [
@@ -567,7 +604,8 @@ class Tracking
         $whichLog,
         $headerMessage,
         $lineNumber,
-        $tableId
+        $tableId,
+        string $version
     ) {
         $offset = $lineNumber;
         $entries = [];
@@ -583,7 +621,7 @@ class Tracking
                 $deleteParam = 'delete_' . $whichLog;
                 $entry['url_params'] = Url::getCommon($urlParams + [
                     'report' => 'true',
-                    'version' => $_POST['version'],
+                    'version' => $version,
                     $deleteParam => $lineNumber - $offset,
                 ], '');
                 $entry['line_number'] = $lineNumber;
diff --git a/phpstan-baseline.neon b/phpstan-baseline.neon
index c3f09efdde..1a89c07005 100644
--- a/phpstan-baseline.neon
+++ b/phpstan-baseline.neon
@@ -8486,11 +8486,6 @@ parameters:
 			path: libraries/classes/Tracking.php
 
 		-
-			message: "#^Method PhpMyAdmin\\\\Tracking\\:\\:getHtmlForElementsOfTrackingReport\\(\\) return type has no value type specified in iterable type array\\.$#"
-			count: 1
-			path: libraries/classes/Tracking.php
-
-		-
 			message: "#^Method PhpMyAdmin\\\\Tracking\\:\\:getHtmlForIndexes\\(\\) has parameter \\$indexes with no value type specified in iterable type array\\.$#"
 			count: 1
 			path: libraries/classes/Tracking.php
diff --git a/psalm-baseline.xml b/psalm-baseline.xml
index df7c7db0b6..1af57e1e20 100644
--- a/psalm-baseline.xml
+++ b/psalm-baseline.xml
@@ -13583,8 +13583,7 @@
     </RedundantConditionGivenDocblockType>
   </file>
   <file src="libraries/classes/Tracking.php">
-    <InvalidArgument occurrences="1"/>
-    <MixedArgument occurrences="31">
+    <MixedArgument occurrences="21">
       <code>$columns</code>
       <code>$data[$which_log]</code>
       <code>$data['ddlog']</code>
@@ -13605,18 +13604,9 @@
       <code>$indexes</code>
       <code>$selected_table</code>
       <code>$selected_table</code>
-      <code>$str1</code>
-      <code>$str1</code>
-      <code>$str2</code>
-      <code>$str2</code>
-      <code>$str3</code>
-      <code>$str3</code>
-      <code>$str4</code>
-      <code>$str4</code>
-      <code>$str5</code>
-      <code>$str5</code>
       <code>$value['Name']</code>
     </MixedArgument>
+    <MixedArgumentTypeCoercion occurrences="1"/>
     <MixedArrayAccess occurrences="17">
       <code>$data[$which_log][$delete_id]</code>
       <code>$entry['date']</code>
@@ -13678,10 +13668,7 @@
       <code>$sep</code>
       <code>$sep</code>
     </PossiblyFalseOperand>
-    <PossiblyInvalidArgument occurrences="4">
-      <code>$_POST['date_from']</code>
-      <code>$_POST['date_to']</code>
-      <code>$_POST['users']</code>
+    <PossiblyInvalidArgument occurrences="1">
       <code>$data['schema_snapshot']</code>
     </PossiblyInvalidArgument>
     <PossiblyInvalidArrayOffset occurrences="2">
diff --git a/test/classes/TrackingTest.php b/test/classes/TrackingTest.php
index 4daea85754..c677bfd342 100644
--- a/test/classes/TrackingTest.php
+++ b/test/classes/TrackingTest.php
@@ -268,10 +268,6 @@ class TrackingTest extends AbstractTestCase
      */
     public function testGetHtmlForTrackingReportr(): void
     {
-        $_POST['version'] = 10;
-        $_POST['date_from'] = 'date_from';
-        $_POST['date_to'] = 'date_to';
-        $_POST['users'] = 'users';
         $data = [
             'tracking' => 'tracking',
             'ddlog' => [['date' => '2022-11-02 22:15:24']],
@@ -288,7 +284,11 @@ class TrackingTest extends AbstractTestCase
             'schema_and_data',
             $filter_ts_to,
             $filter_ts_from,
-            $filter_users
+            $filter_users,
+            '10',
+            '2022-11-03 22:15:24',
+            '2022-11-04 22:15:24',
+            'users'
         );
 
         $this->assertStringContainsString(
@@ -305,7 +305,7 @@ class TrackingTest extends AbstractTestCase
 
         $version = Url::getHiddenInputs($url_params + [
             'report' => 'true',
-            'version' => $_POST['version'],
+            'version' => '10',
         ]);
 
         $this->assertStringContainsString($version, $html);
@@ -327,20 +327,9 @@ class TrackingTest extends AbstractTestCase
             $html
         );
 
-        $this->assertStringContainsString(
-            htmlspecialchars($_POST['date_from']),
-            $html
-        );
-
-        $this->assertStringContainsString(
-            htmlspecialchars($_POST['date_to']),
-            $html
-        );
-
-        $this->assertStringContainsString(
-            htmlspecialchars($_POST['users']),
-            $html
-        );
+        $this->assertStringContainsString('2022-11-03 22:15:24', $html);
+        $this->assertStringContainsString('2022-11-04 22:15:24', $html);
+        $this->assertStringContainsString('users', $html);
     }
 
     /**
@@ -348,7 +337,6 @@ class TrackingTest extends AbstractTestCase
      */
     public function testGetHtmlForDataManipulationStatements(): void
     {
-        $_POST['version'] = '10';
         $data = [
             'tracking' => 'tracking',
             'dmlog' => [
@@ -374,7 +362,8 @@ class TrackingTest extends AbstractTestCase
             $filter_ts_to,
             $url_params,
             $ddlog_count,
-            $drop_image_or_text
+            $drop_image_or_text,
+            '10'
         );
 
         $this->assertStringContainsString(
@@ -402,8 +391,6 @@ class TrackingTest extends AbstractTestCase
      */
     public function testGetHtmlForDataDefinitionStatements(): void
     {
-        $_POST['version'] = '10';
-
         $data = [
             'tracking' => 'tracking',
             'ddlog' => [
@@ -427,7 +414,8 @@ class TrackingTest extends AbstractTestCase
             $filter_ts_from,
             $filter_ts_to,
             $url_params,
-            $drop_image_or_text
+            $drop_image_or_text,
+            '10'
         );
 
         $this->assertStringContainsString(