diff --git a/ChangeLog b/ChangeLog
index 0a7c788c78..c41e823c5b 100755
--- a/ChangeLog
+++ b/ChangeLog
@@ -7,6 +7,9 @@ $Source$
 
 2006-04-20 Michal Čihař  <michal@cihar.com>
     * index.php: Check target against goto_whitelist.
+    * libraries/url_generating.lib.php, libraries/session.inc.php,
+      libraries/common.lib.php: Protect against external links which could
+      perform any action (CVE-2006-1804).
 
 2006-04-13 Marc Delisle  <lem9@users.sourceforge.net>
     * server_databases.php: need brackets for correct calculation of page
diff --git a/libraries/common.lib.php b/libraries/common.lib.php
index 15a344344b..2663d1215b 100644
--- a/libraries/common.lib.php
+++ b/libraries/common.lib.php
@@ -2767,6 +2767,32 @@ if (PMA_checkPageValidity($_REQUEST['back'], $goto_whitelist)) {
     unset($_REQUEST['back'], $_GET['back'], $_POST['back'], $_COOKIE['back']);
 }
 
+/**
+ * Check whether user supplied token is valid, if not remove any 
+ * possibly dangerous stuff from request.
+ */
+if (!isset($_REQUEST['token']) || $_SESSION['PMA_token'] != $_REQUEST['token']) {
+    /* List of parameters which are allowed from unsafe source */
+    $allow_list = array(
+        'db', 'table', 'lang', 'server', 'convcharset', 'collation_connection', 'target',
+        /* Session ID */
+        'phpMyAdmin', 
+        /* Cookie preferences */
+        'pma_lang', 'pma_charset', 'pma_collation_connection', 'pma_convcharset',
+    );
+    $keys = array_keys($_REQUEST);
+    /* Remove any non allowed stuff from requests */
+    foreach($keys as $key) {
+        if (!in_array($key, $allow_list)) {
+            unset($_REQUEST[$key]);
+            unset($_GET[$key]);
+            unset($_POST[$key]);
+            unset($GLOBALS[$key]);
+        }
+    }
+}
+
+
 /**
  * @var string $convcharset
  * @see also select_lang.lib.php
diff --git a/libraries/session.inc.php b/libraries/session.inc.php
index fb60ff997a..02badf0a4e 100644
--- a/libraries/session.inc.php
+++ b/libraries/session.inc.php
@@ -100,6 +100,13 @@ ini_set('session.save_handler', 'files');
 @session_name('phpMyAdmin');
 @session_start();
 
+/**
+ * Token which is used for authenticating access queries.
+ */
+if (!isset($_SESSION['PMA_token'])) {
+    $_SESSION['PMA_token'] = md5(uniqid(rand(), true));
+}
+
 /**
  * trys to secure session from hijacking and fixation
  * should be called before login and after successfull login
diff --git a/libraries/url_generating.lib.php b/libraries/url_generating.lib.php
index 7a03da4050..be3b193c34 100644
--- a/libraries/url_generating.lib.php
+++ b/libraries/url_generating.lib.php
@@ -64,6 +64,8 @@ function PMA_generate_common_hidden_inputs($db = '', $table = '', $indent = 0, $
         $params['collation_connection'] = $GLOBALS['collation_connection'];
     }
 
+    $params['token'] = $_SESSION['PMA_token'];
+
     if (! is_array($skip)) {
         if (isset($params[$skip])) {
             unset($params[$skip]);
@@ -187,6 +189,8 @@ function PMA_generate_common_url ($db = '', $table = '', $delim = '&amp;')
         $params['collation_connection'] = $GLOBALS['collation_connection'];
     }
 
+    $params['token'] = $_SESSION['PMA_token'];
+
     $param_strings = array();
     foreach ($params as $key => $val) {
         $param_strings[] = urlencode($key) . '=' . urlencode($val);