gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bug #4594 [security] Path traversal in file inclusion of GIS factory

Browse Source 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
This commit is contained in:
Madhura Jayaratne 2014-11-17 11:03:55 +05:30
parent 58cdd91fc8
commit 2e3f0b9457
2 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
ChangeLog
View File

@ -4,6 +4,7 @@ phpMyAdmin - ChangeLog
4.0.10.6 (not yet released)
- bug #4578 [security] XSS vulnerability in table print view
- bug #4579 [security] XSS vulnerability in zoom search page
- bug #4594 [security] Path traversal in file inclusion of GIS factory
4.0.10.5 (2014-10-21)
- bug #4562 [security] XSS in debug SQL output

4
libraries/gis/pma_gis_factory.php
View File

@ -31,7 +31,9 @@ class PMA_GIS_Factory
include_once './libraries/gis/pma_gis_geometry.php';
$type_lower = strtolower($type);
if (! file_exists('./libraries/gis/pma_gis_' . $type_lower . '.php')) {
if (! PMA_isValid($type_lower, PMA_Util::getGISDatatypes())
|| ! file_exists('./libraries/gis/pma_gis_' . $type_lower . '.php')
) {
return false;
}
if (include_once './libraries/gis/pma_gis_' . $type_lower . '.php') {