gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Protect against external links which could perform any action (CVE-2006-1804).

Browse Source
This commit is contained in:
Michal Čihař 2006-04-20 14:45:42 +00:00
parent 890918a20d
commit 0bf717892f
4 changed files with 40 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ChangeLog
View File

@ -7,6 +7,9 @@ $Source$
2006-04-20 Michal Čihař <michal@cihar.com>
* index.php: Check target against goto_whitelist.
* libraries/url_generating.lib.php, libraries/session.inc.php,
libraries/common.lib.php: Protect against external links which could
perform any action (CVE-2006-1804).
2006-04-13 Marc Delisle <lem9@users.sourceforge.net>
* server_databases.php: need brackets for correct calculation of page

26
libraries/common.lib.php
View File

@ -2767,6 +2767,32 @@ if (PMA_checkPageValidity($_REQUEST['back'], $goto_whitelist)) {
unset($_REQUEST['back'], $_GET['back'], $_POST['back'], $_COOKIE['back']);
}
/**
* Check whether user supplied token is valid, if not remove any
* possibly dangerous stuff from request.
*/
if (!isset($_REQUEST['token']) || $_SESSION['PMA_token'] != $_REQUEST['token']) {
/* List of parameters which are allowed from unsafe source */
$allow_list = array(
'db', 'table', 'lang', 'server', 'convcharset', 'collation_connection', 'target',
/* Session ID */
'phpMyAdmin',
/* Cookie preferences */
'pma_lang', 'pma_charset', 'pma_collation_connection', 'pma_convcharset',
);
$keys = array_keys($_REQUEST);
/* Remove any non allowed stuff from requests */
foreach($keys as $key) {
if (!in_array($key, $allow_list)) {
unset($_REQUEST[$key]);
unset($_GET[$key]);
unset($_POST[$key]);
unset($GLOBALS[$key]);
}
}
}
/**
* @var string $convcharset
* @see also select_lang.lib.php

7
libraries/session.inc.php
View File

@ -100,6 +100,13 @@ ini_set('session.save_handler', 'files');
@session_name('phpMyAdmin');
@session_start();
/**
* Token which is used for authenticating access queries.
*/
if (!isset($_SESSION['PMA_token'])) {
$_SESSION['PMA_token'] = md5(uniqid(rand(), true));
}
/**
* trys to secure session from hijacking and fixation
* should be called before login and after successfull login

4
libraries/url_generating.lib.php
View File

@ -64,6 +64,8 @@ function PMA_generate_common_hidden_inputs($db = '', $table = '', $indent = 0, $
$params['collation_connection'] = $GLOBALS['collation_connection'];
}
$params['token'] = $_SESSION['PMA_token'];
if (! is_array($skip)) {
if (isset($params[$skip])) {
unset($params[$skip]);
@ -187,6 +189,8 @@ function PMA_generate_common_url ($db = '', $table = '', $delim = '&amp;')
$params['collation_connection'] = $GLOBALS['collation_connection'];
}
$params['token'] = $_SESSION['PMA_token'];
$param_strings = array();
foreach ($params as $key => $val) {
$param_strings[] = urlencode($key) . '=' . urlencode($val);