Skip to content
Permalink
Browse files Browse the repository at this point in the history
Fix XSS in database structure page
Forward ported commit 90df124

Signed-off-by: Michal Čihař <michal@cihar.com>
  • Loading branch information
nijel committed Feb 25, 2016
1 parent 16a6a02 commit 983faa9
Showing 1 changed file with 11 additions and 7 deletions.
18 changes: 11 additions & 7 deletions templates/database/structure/sortable_header.phtml
Expand Up @@ -51,16 +51,20 @@ if ($requested_sort == $sort) {
}
$_url_params = array(
'db' => $_REQUEST['db'],
'pos' => 0, // We set the position back to 0 every time they sort.
'sort' => $sort,
'sort_order' => $future_sort_order,
);
$url = 'db_structure.php' . PMA_URL_getCommon($_url_params);
// We set the position back to 0 every time they sort.
$url .= "&amp;pos=0&amp;sort=$sort&amp;sort_order=$future_sort_order";
if (! empty($_REQUEST['tbl_type'])) {
$url .= "&amp;tbl_type=" . $_REQUEST['tbl_type'];

if (PMA_isValid($_REQUEST['tbl_type'], array('view', 'table'))) {
$_url_params['tbl_type'] = $_REQUEST['tbl_type'];
}
if (! empty($_REQUEST['tbl_group'])) {
$url .= "&amp;tbl_group=" . $_REQUEST['tbl_group'];
$_url_params['tbl_group'] = $_REQUEST['tbl_group'];
}

$url = 'db_structure.php' . PMA_URL_getCommon($_url_params);

echo PMA_Util::linkOrButton(
$url, $title . $order_img, $order_link_params
);
);

0 comments on commit 983faa9

Please sign in to comment.