security fix

phpmyadmin · Oct 21, 2005 · 429b629 · 429b629
1 parent 0a3c8dc
commit 429b629
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 0 deletions.
diff --git a/ChangeLog b/ChangeLog
@@ -5,6 +5,9 @@ phpMyAdmin - Changelog
 $Id$
 $Source$
 
+2005-10-20 Marc Delisle  <lem9@users.sourceforge.net>
+    * server_databases.php: security fix
+
 2005-10-20 Alexander M. Turek  <me@derrabus.de>
     * libraries/mysql_charsets.lib.php:
       - On MySQL 5.0.6, we don't have to parse SHOW CREATE DATABASE anymore,

diff --git a/server_databases.php b/server_databases.php
@@ -134,13 +134,17 @@ function PMA_dbCmp($a, $b)
 // avoids 'undefined index' errors
 if (empty($sort_by)) {
     $sort_by = 'db_name';
+} else {
+    $sort_by = PMA_sanitize($sort_by);
 }
 if (empty($sort_order)) {
     if ($sort_by == 'db_name') {
         $sort_order = 'asc';
     } else {
         $sort_order = 'desc';
     }
+} else {
+    $sort_order = PMA_sanitize($sort_order);
 }
 
 // sorts the array