From cc961340d9feb7a675b24da1a6667bb6d1673439 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Fri, 18 Nov 2016 10:52:57 +0100 Subject: [PATCH 1/2] Remove check for < in Accept-Language header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It is no longer needed since we do match language against existing ones. Issue #12710 Signed-off-by: Michal Čihař --- libraries/LanguageManager.php | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/libraries/LanguageManager.php b/libraries/LanguageManager.php index 910108d518..6003948e72 100644 --- a/libraries/LanguageManager.php +++ b/libraries/LanguageManager.php @@ -819,9 +819,8 @@ class LanguageManager $langs = $this->availableLanguages(); // try to find out user's language by checking its HTTP_ACCEPT_LANGUAGE variable; - // prevent XSS $accepted_languages = PMA_getenv('HTTP_ACCEPT_LANGUAGE'); - if ($accepted_languages && false === mb_strpos($accepted_languages, '<')) { + if ($accepted_languages) { foreach (explode(',', $accepted_languages) as $header) { foreach ($langs as $language) { if ($language->matchesAcceptLanguage($header)) { From 53f07e717975aba39efd45e1c2856feaee92bacc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Fri, 18 Nov 2016 11:00:11 +0100 Subject: [PATCH 2/2] Remove protection against < in HTTP Authorization header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It really doesn't make sense here as the username can potentionally contain < anyway and we need to deal with it later (and we do). Fixes #12710 Signed-off-by: Michal Čihař --- libraries/plugins/auth/AuthenticationHttp.php | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/libraries/plugins/auth/AuthenticationHttp.php b/libraries/plugins/auth/AuthenticationHttp.php index 62dcc01690..3f76a130b5 100644 --- a/libraries/plugins/auth/AuthenticationHttp.php +++ b/libraries/plugins/auth/AuthenticationHttp.php @@ -128,10 +128,8 @@ class AuthenticationHttp extends AuthenticationPlugin } elseif (PMA_getenv('AUTH_USER')) { // WebSite Professional $PHP_AUTH_USER = PMA_getenv('AUTH_USER'); - } elseif (PMA_getenv('HTTP_AUTHORIZATION') - && false === strpos(PMA_getenv('HTTP_AUTHORIZATION'), '<') - ) { - // IIS, might be encoded, see below; also prevent XSS + } elseif (PMA_getenv('HTTP_AUTHORIZATION')) { + // IIS, might be encoded, see below $PHP_AUTH_USER = PMA_getenv('HTTP_AUTHORIZATION'); } elseif (PMA_getenv('Authorization')) { // FastCGI, might be encoded, see below