From cb9edac1bcb50d68b9790434fe8cfd0ecc363d70 Mon Sep 17 00:00:00 2001
From: Sajeeb Asim Lohani <saloh2@student.monash.edu>
Date: Thu, 15 Jun 2017 16:01:11 +1000
Subject: [PATCH 1/3] XSS Sanitisation Patch

Added in HTML Encoding for all echo statements. This should take care of any XSS issues that are within the software.
---
 phpminiadmin.php | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/phpminiadmin.php b/phpminiadmin.php
index 5fb0c75..9c307ff 100644
--- a/phpminiadmin.php
+++ b/phpminiadmin.php
@@ -422,7 +422,7 @@ function cfg_toggle(){
  e.style.display=e.style.display=='none'?'':'none';
 }
 function qtpl(s){
- $('qraw').value=s.replace(/%T/g,'`<?php echo $_REQUEST['t']?b64d($_REQUEST['t']):'tablename'?>`');
+ $('qraw').value=s.replace(/%T/g,'`<?php echo htmlentities($_REQUEST['t']?b64d($_REQUEST['t']):'tablename', ENT_QUOTES)?>`');
 }
 function smview(){
  if($('is_sm').checked){$('res').className+=' sm'}else{$('res').className = $('res').className.replace(/\bsm\b/,' ')}
@@ -452,11 +452,11 @@ function sht(f){
 <a href="http://phpminiadmin.sourceforge.net/" target="_blank"><b>phpMiniAdmin <?php eo($VERSION)?></b></a>
 <?php if ($_SESSION['is_logged'] && $dbh){ ?>
  | <a href="?<?php eo($xurl)?>&q=<?=b64e("show databases");?>">Databases</a>: <select name="db" onChange="frefresh()"><option value='*'> - select/refresh -</option><option value=''> - show all -</option>
-<?php echo get_db_select($dbn)?></select>
+<?php echo htmlentities(get_db_select($dbn), ENT_QUOTES)?></select>
 <?php if($dbn){ $z=" &#183; <a href='".hs($self."?$xurl&db=$dbn"); ?>
-<?php echo $z.'&q='.b64e($SHOW_T)?>'>show tables</a>
-<?php echo $z?>&shex=1'>export</a>
-<?php echo $z?>&shim=1'>import</a>
+<?php echo htmlentities($z.'&q='.b64e($SHOW_T), ENT_QUOTES) ?>'>show tables</a>
+<?php echo htmlentities($z, ENT_QUOTES) ?>&shex=1'>export</a>
+<?php echo htmlentities($z, ENT_QUOTES) ?>&shim=1'>import</a>
 <?php } ?>
  | <a href="?showcfg=1">Settings</a>
 <?php } ?>
@@ -500,7 +500,7 @@ function print_screen(){
 Records: <b><?php eo($reccount); if(!is_null($last_count) && $reccount<$last_count){eo(' out of '.$last_count);}?></b> in <b><?php eo($time_all)?></b> sec<br>
 <b><?php eo($out_message)?></b>
 </div>
-<?php echo $nav.$sqldr.$nav; ?>
+<?php echo htmlentities($nav.$sqldr.$nav, ENT_QUOTES); ?>
 <?php
  print_footer();
 }
@@ -542,7 +542,7 @@ function print_cfg(){
 <div id="cfg-adv" style="display:none;">
 <label><div class="l">DB name:</div><input type="text" name="v[db]" value="<?php eo($DB['db'])?>"></label><br>
 <label><div class="l">MySQL host:</div><input type="text" name="v[host]" value="<?php eo($DB['host'])?>"></label> <label>port: <input type="text" name="v[port]" value="<?php eo($DB['port'])?>" size="4"></label><br>
-<label><div class="l">Charset:</div><select name="v[chset]"><option value="">- default -</option><?php echo chset_select($DB['chset'])?></select></label><br>
+<label><div class="l">Charset:</div><select name="v[chset]"><option value="">- default -</option><?php echo htmlentities(chset_select($DB['chset']), ENT_QUOTES) ?></select></label><br>
 <br><label for ="rmb"><input type="checkbox" name="rmb" id="rmb" value="1" checked> Remember in cookies for 30 days or until Logoff</label>
 </div>
 <center>
@@ -958,7 +958,7 @@ function ex_w($s){
     if ($ex_issrv){
         fwrite($ex_f,$s);
     }else{
-        echo $s;
+        echo htmlentities($s, ENT_QUOTES);
     }
  }
 }
@@ -999,13 +999,13 @@ function print_import(){
 .csv file (Excel style): <input type="file" name="file2" value="" size=40><br>
 <input type="checkbox" name="r1" value="1" checked> first row contain field names<br>
 <small>(note: for success, field names should be exactly the same as in DB)</small><br>
-Character set of the file: <select name="chset"><?php echo chset_select('utf8')?></select>
+Character set of the file: <select name="chset"><?php echo htmlentities(chset_select('utf8'), ENT_QUOTES)?></select>
 <br><br>
 Import into:<br>
 <input type="radio" name="tt" value="1" checked="checked"> existing table:
  <select name="t">
  <option value=''>- select -</option>
- <?php echo sel(db_array('show tables',NULL,0,1), 0, ''); ?>
+ <?php echo htmlentities(sel(db_array('show tables',NULL,0,1), 0, ''), ENT_QUOTES); ?>
 </select>
 <div style="margin-left:20px">
  <input type="checkbox" name="ttr" value="1"> replace existing DB data<br>

From 621b7ea307225c61e14c3e44ffb2aa40f054d22a Mon Sep 17 00:00:00 2001
From: unknown <sajeeblohani@bulletproofapplications.com>
Date: Tue, 4 Jul 2017 19:05:01 +1000
Subject: [PATCH 2/3] Fixed up the XSS patch. There is a single case where it
 doesnt seem to work, but that is if the table or the database contacts
 special character (like <> ). I feel that it shouldn't be a problem as the
 most likely users of such characters are probably people trying to exploit
 that application.

---
 phpminiadmin.php | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/phpminiadmin.php b/phpminiadmin.php
index 9c307ff..ff00fd3 100644
--- a/phpminiadmin.php
+++ b/phpminiadmin.php
@@ -206,7 +206,7 @@ function display_select($sth,$q){
  for($i=0;$i<$fields_num;$i++){
     if ($is_sht && $i>0) break;
     $meta=mysqli_fetch_field($sth);
-    $headers.="<th><div>".$meta->name."</div></th>";
+    $headers.="<th><div>".htmlentities($meta->name, ENT_QUOTES)."</div></th>";
  }
  if ($is_shd) $headers.="<th>show create database</th><th>show table status</th><th>show triggers</th>";
  if ($is_sht) $headers.="<th>engine</th><th>~rows</th><th>data size</th><th>index size</th><th>show create table</th><th>explain</th><th>indexes</th><th>export</th><th>drop</th><th>truncate</th><th>optimize</th><th>repair</th><th>comment</th>";
@@ -215,7 +215,7 @@ function display_select($sth,$q){
  $swapper=false;
  while($row=mysqli_fetch_row($sth)){
    $sqldr.="<tr class='".$rc[$swp=!$swp]."' onclick='tc(this)'>";
-   $v=$row[0];
+   $v=htmlentities($row[0], ENT_QUOTES);
    if ($is_sht){
      $vq='`'.$v.'`';
      $url='?'.$xurl."&db=$dbn&t=".b64e($v);
@@ -452,11 +452,11 @@ function sht(f){
 <a href="http://phpminiadmin.sourceforge.net/" target="_blank"><b>phpMiniAdmin <?php eo($VERSION)?></b></a>
 <?php if ($_SESSION['is_logged'] && $dbh){ ?>
  | <a href="?<?php eo($xurl)?>&q=<?=b64e("show databases");?>">Databases</a>: <select name="db" onChange="frefresh()"><option value='*'> - select/refresh -</option><option value=''> - show all -</option>
-<?php echo htmlentities(get_db_select($dbn), ENT_QUOTES)?></select>
-<?php if($dbn){ $z=" &#183; <a href='".hs($self."?$xurl&db=$dbn"); ?>
-<?php echo htmlentities($z.'&q='.b64e($SHOW_T), ENT_QUOTES) ?>'>show tables</a>
-<?php echo htmlentities($z, ENT_QUOTES) ?>&shex=1'>export</a>
-<?php echo htmlentities($z, ENT_QUOTES) ?>&shim=1'>import</a>
+<?php echo get_db_select($dbn) ?></select>
+<?php if($dbn){ $z=" &#183; <a href='".hs($self . "?$xurl&db=" . htmlentities($dbn, ENT_QUOTES)); ?>
+<?php echo $z.'&q='.b64e($SHOW_T) ?>'>show tables</a>
+<?php echo $z ?>&shex=1'>export</a>
+<?php echo $z ?>&shim=1'>import</a>
 <?php } ?>
  | <a href="?showcfg=1">Settings</a>
 <?php } ?>
@@ -500,7 +500,7 @@ function print_screen(){
 Records: <b><?php eo($reccount); if(!is_null($last_count) && $reccount<$last_count){eo(' out of '.$last_count);}?></b> in <b><?php eo($time_all)?></b> sec<br>
 <b><?php eo($out_message)?></b>
 </div>
-<?php echo htmlentities($nav.$sqldr.$nav, ENT_QUOTES); ?>
+<?php echo $nav.$sqldr.$nav; ?>
 <?php
  print_footer();
 }
@@ -674,7 +674,7 @@ function sel($arr,$n,$sel=''){
  foreach($arr as $a){
 #   echo $a[0];
    $b=$a[$n];
-   $res.="<option value='$b' ".($sel && $sel==$b?'selected':'').">$b</option>";
+   $res.="<option value='$b' ".($sel && $sel==$b?'selected':'').">" . htmlentities($b, ENT_QUOTES) . "</option>";
  }
  return $res;
 }
@@ -999,7 +999,7 @@ function print_import(){
 .csv file (Excel style): <input type="file" name="file2" value="" size=40><br>
 <input type="checkbox" name="r1" value="1" checked> first row contain field names<br>
 <small>(note: for success, field names should be exactly the same as in DB)</small><br>
-Character set of the file: <select name="chset"><?php echo htmlentities(chset_select('utf8'), ENT_QUOTES)?></select>
+Character set of the file: <select name="chset"><?php echo chset_select('utf8'); ?></select>
 <br><br>
 Import into:<br>
 <input type="radio" name="tt" value="1" checked="checked"> existing table:

From fc7332c34e00a5a306023dedaba116d22d4d46e7 Mon Sep 17 00:00:00 2001
From: unknown <sajeeblohani@bulletproofapplications.com>
Date: Mon, 10 Jul 2017 11:46:00 +1000
Subject: [PATCH 3/3] Changed all htmlentities to now use hs or eo. Fixed
 spaces issue.

---
 phpminiadmin.php | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/phpminiadmin.php b/phpminiadmin.php
index ff00fd3..58ac789 100644
--- a/phpminiadmin.php
+++ b/phpminiadmin.php
@@ -206,7 +206,7 @@ function display_select($sth,$q){
  for($i=0;$i<$fields_num;$i++){
     if ($is_sht && $i>0) break;
     $meta=mysqli_fetch_field($sth);
-    $headers.="<th><div>".htmlentities($meta->name, ENT_QUOTES)."</div></th>";
+    $headers.="<th><div>".hs($meta->name)."</div></th>";
  }
  if ($is_shd) $headers.="<th>show create database</th><th>show table status</th><th>show triggers</th>";
  if ($is_sht) $headers.="<th>engine</th><th>~rows</th><th>data size</th><th>index size</th><th>show create table</th><th>explain</th><th>indexes</th><th>export</th><th>drop</th><th>truncate</th><th>optimize</th><th>repair</th><th>comment</th>";
@@ -215,7 +215,7 @@ function display_select($sth,$q){
  $swapper=false;
  while($row=mysqli_fetch_row($sth)){
    $sqldr.="<tr class='".$rc[$swp=!$swp]."' onclick='tc(this)'>";
-   $v=htmlentities($row[0], ENT_QUOTES);
+   $v=hs($row[0]);
    if ($is_sht){
      $vq='`'.$v.'`';
      $url='?'.$xurl."&db=$dbn&t=".b64e($v);
@@ -422,7 +422,7 @@ function cfg_toggle(){
  e.style.display=e.style.display=='none'?'':'none';
 }
 function qtpl(s){
- $('qraw').value=s.replace(/%T/g,'`<?php echo htmlentities($_REQUEST['t']?b64d($_REQUEST['t']):'tablename', ENT_QUOTES)?>`');
+ $('qraw').value=s.replace(/%T/g,'`<?php eo($_REQUEST['t']?b64d($_REQUEST['t']):'tablename')?>`');
 }
 function smview(){
  if($('is_sm').checked){$('res').className+=' sm'}else{$('res').className = $('res').className.replace(/\bsm\b/,' ')}
@@ -453,7 +453,7 @@ function sht(f){
 <?php if ($_SESSION['is_logged'] && $dbh){ ?>
  | <a href="?<?php eo($xurl)?>&q=<?=b64e("show databases");?>">Databases</a>: <select name="db" onChange="frefresh()"><option value='*'> - select/refresh -</option><option value=''> - show all -</option>
 <?php echo get_db_select($dbn) ?></select>
-<?php if($dbn){ $z=" &#183; <a href='".hs($self . "?$xurl&db=" . htmlentities($dbn, ENT_QUOTES)); ?>
+<?php if($dbn){ $z=" &#183; <a href='".hs($self."?$xurl&db=".$dbn); ?>
 <?php echo $z.'&q='.b64e($SHOW_T) ?>'>show tables</a>
 <?php echo $z ?>&shex=1'>export</a>
 <?php echo $z ?>&shim=1'>import</a>
@@ -542,7 +542,7 @@ function print_cfg(){
 <div id="cfg-adv" style="display:none;">
 <label><div class="l">DB name:</div><input type="text" name="v[db]" value="<?php eo($DB['db'])?>"></label><br>
 <label><div class="l">MySQL host:</div><input type="text" name="v[host]" value="<?php eo($DB['host'])?>"></label> <label>port: <input type="text" name="v[port]" value="<?php eo($DB['port'])?>" size="4"></label><br>
-<label><div class="l">Charset:</div><select name="v[chset]"><option value="">- default -</option><?php echo htmlentities(chset_select($DB['chset']), ENT_QUOTES) ?></select></label><br>
+<label><div class="l">Charset:</div><select name="v[chset]"><option value="">- default -</option><?php eo(chset_select($DB['chset']))?></select></label><br>
 <br><label for ="rmb"><input type="checkbox" name="rmb" id="rmb" value="1" checked> Remember in cookies for 30 days or until Logoff</label>
 </div>
 <center>
@@ -674,7 +674,7 @@ function sel($arr,$n,$sel=''){
  foreach($arr as $a){
 #   echo $a[0];
    $b=$a[$n];
-   $res.="<option value='$b' ".($sel && $sel==$b?'selected':'').">" . htmlentities($b, ENT_QUOTES) . "</option>";
+   $res.="<option value='$b' ".($sel && $sel==$b?'selected':'').">".hs($b)."</option>";
  }
  return $res;
 }
@@ -958,7 +958,7 @@ function ex_w($s){
     if ($ex_issrv){
         fwrite($ex_f,$s);
     }else{
-        echo htmlentities($s, ENT_QUOTES);
+        eo($s);
     }
  }
 }
@@ -1005,7 +1005,7 @@ function print_import(){
 <input type="radio" name="tt" value="1" checked="checked"> existing table:
  <select name="t">
  <option value=''>- select -</option>
- <?php echo htmlentities(sel(db_array('show tables',NULL,0,1), 0, ''), ENT_QUOTES); ?>
+ <?php eo(sel(db_array('show tables',NULL,0,1), 0, '')); ?>
 </select>
 <div style="margin-left:20px">
  <input type="checkbox" name="ttr" value="1"> replace existing DB data<br>