gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/QA_4_6' into QA_4_6

Browse Source
This commit is contained in:
Weblate 2016-11-18 11:01:27 +01:00
commit 002240af4e
2 changed files with 3 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
libraries/LanguageManager.php
View File

@ -819,9 +819,8 @@ class LanguageManager
$langs = $this->availableLanguages();
// try to find out user's language by checking its HTTP_ACCEPT_LANGUAGE variable;
// prevent XSS
$accepted_languages = PMA_getenv('HTTP_ACCEPT_LANGUAGE');
if ($accepted_languages && false === mb_strpos($accepted_languages, '<')) {
if ($accepted_languages) {
foreach (explode(',', $accepted_languages) as $header) {
foreach ($langs as $language) {
if ($language->matchesAcceptLanguage($header)) {

6
libraries/plugins/auth/AuthenticationHttp.php
View File

@ -128,10 +128,8 @@ class AuthenticationHttp extends AuthenticationPlugin
} elseif (PMA_getenv('AUTH_USER')) {
// WebSite Professional
$PHP_AUTH_USER = PMA_getenv('AUTH_USER');
} elseif (PMA_getenv('HTTP_AUTHORIZATION')
&& false === strpos(PMA_getenv('HTTP_AUTHORIZATION'), '<')
) {
// IIS, might be encoded, see below; also prevent XSS
} elseif (PMA_getenv('HTTP_AUTHORIZATION')) {
// IIS, might be encoded, see below
$PHP_AUTH_USER = PMA_getenv('HTTP_AUTHORIZATION');
} elseif (PMA_getenv('Authorization')) {
// FastCGI, might be encoded, see below