Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse files

Fix XSS in recent/favorite tables list feature

Signed-off-by: Ann + J.M <phpMyAdmin@ZweiSteinSoft.de>
  • Loading branch information...
commit cb7c703c03f656debcea2a16468bd53660fc888e 1 parent 588bb79
@ZweiSteinSoft ZweiSteinSoft authored
View
13 libraries/RecentFavoriteTable.class.php
@@ -206,8 +206,9 @@ public function getHtmlList()
$html .= '<a href="sql.php?server=' . $GLOBALS['server']
. '&db=' . $table['db']
. '&table=' . $table['table']
- . '&token=' . $_SESSION[' PMA_token ']
- . '">`' . $table['db'] . '`.`' . $table['table'] . '`</a>';
+ . '&token=' . $_SESSION[' PMA_token '] . '">`'
+ . htmlspecialchars($table['db']) . '`.`'
+ . htmlspecialchars($table['table']) . '`</a>';
$html .= '</li>';
}
} else {
@@ -223,7 +224,8 @@ public function getHtmlList()
. PMA_URL_getCommon($fav_params);
$html .= 'href="' . $fav_rm_url
. '" title="' . __("Remove from Favorites")
- . '" data-favtargetn="' . $table['db'] . "." . $table['table']
+ . '" data-favtargetn="'
+ . md5($table['db'] . "." . $table['table'])
. '" >'
. PMA_Util::getIcon('b_favorite.png')
. '</a>';
@@ -231,8 +233,9 @@ public function getHtmlList()
$html .= '<a href="sql.php?server=' . $GLOBALS['server']
. '&db=' . $table['db']
. '&table=' . $table['table']
- . '&token=' . $_SESSION[' PMA_token ']
- . '">`' . $table['db'] . '`.`' . $table['table'] . '`</a>';
+ . '&token=' . $_SESSION[' PMA_token '] . '">`'
+ . htmlspecialchars($table['db']) . '`.`'
+ . htmlspecialchars($table['table']) . '`</a>';
$html .= '</li>';
}
}
View
11 libraries/structure.lib.php
@@ -2736,9 +2736,8 @@ function PMA_checkFavoriteTable($db, $current_table)
function PMA_getHtmlForFavoriteAnchor($db, $current_table, $titles)
{
$html_output = '<a ';
- $html_output .= 'id="' . preg_replace(
- '/\s+/', '', $current_table['TABLE_NAME']
- ) . '_favorite_anchor" ';
+ $html_output .= 'id="' . md5($current_table['TABLE_NAME'])
+ . '_favorite_anchor" ';
$html_output .= 'class="ajax favorite_table_anchor';
// Check if current table is already in favorite list.
@@ -2746,13 +2745,15 @@ function PMA_getHtmlForFavoriteAnchor($db, $current_table, $titles)
$fav_params = array('db' => $db,
'ajax_request' => true,
'favorite_table' => $current_table['TABLE_NAME'],
- (($already_favorite?'remove':'add') . '_favorite') => true);
+ (($already_favorite?'remove':'add') . '_favorite') => true
+ );
$fav_url = 'db_structure.php' . PMA_URL_getCommon($fav_params);
$html_output .= '" ';
$html_output .= 'href="' . $fav_url
. '" title="' . ($already_favorite ? __("Remove from Favorites")
: __("Add to Favorites"))
- . '" data-favtargets="' . $db . "." . $current_table['TABLE_NAME']
+ . '" data-favtargets="'
+ . md5($db . "." . $current_table['TABLE_NAME'])
. '" >'
. (!$already_favorite ? $titles['NoFavorite']
: $titles['Favorite']) . '</a>';
Please sign in to comment.
Something went wrong with that request. Please try again.