From 647c9d12e33a6b64e1c3ff7487f72696bdf2dccb Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Sun, 17 Aug 2014 08:45:10 -0400 Subject: [PATCH 1/5] bug #4501 [security] XSS in table browse page Signed-off-by: Marc Delisle --- ChangeLog | 1 + js/sql.js | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index cec9d77fad..54120c2053 100644 --- a/ChangeLog +++ b/ChangeLog @@ -2,6 +2,7 @@ phpMyAdmin - ChangeLog ====================== 4.2.7.1 (2014-08-17) +- bug #4501 [security] XSS in table browse page - bug #4505 [security] XSS in view operations page 4.2.7.0 (2014-07-31) diff --git a/js/sql.js b/js/sql.js index 8b77c1aae0..aad4a454e8 100644 --- a/js/sql.js +++ b/js/sql.js @@ -119,7 +119,7 @@ AJAX.registerOnload('sql.js', function () { // Delete row from SQL results $('a.delete_row.ajax').live('click', function (e) { e.preventDefault(); - var question = $.sprintf(PMA_messages.strDoYouReally, $(this).closest('td').find('div').text()); + var question = $.sprintf(PMA_messages.strDoYouReally, escapeHtml($(this).closest('td').find('div').text())); var $link = $(this); $link.PMA_confirm(question, $link.attr('href'), function (url) { $msgbox = PMA_ajaxShowMessage(); From 2c45d7caa614afd71dbe3d0f7270f51ce5569614 Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Sun, 17 Aug 2014 08:47:53 -0400 Subject: [PATCH 2/5] bug #4502 [security] Self-XSS in enum value editor Signed-off-by: Marc Delisle --- ChangeLog | 1 + js/functions.js | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 54120c2053..941a059ada 100644 --- a/ChangeLog +++ b/ChangeLog @@ -3,6 +3,7 @@ phpMyAdmin - ChangeLog 4.2.7.1 (2014-08-17) - bug #4501 [security] XSS in table browse page +- bug #4502 [security] Self-XSS in enum value editor - bug #4505 [security] XSS in view operations page 4.2.7.0 (2014-07-31) diff --git a/js/functions.js b/js/functions.js index a970a81584..bcdead8e17 100644 --- a/js/functions.js +++ b/js/functions.js @@ -2692,7 +2692,7 @@ AJAX.registerOnload('functions.js', function () { } else { title = PMA_messages.enum_columnVals.replace( /%s/, - '"' + decodeURIComponent(colname) + '"' + '"' + escapeHtml(decodeURIComponent(colname)) + '"' ); } // Get the values as a string From cd9f302bf7f91a160fe7080f9a612019ef847f1c Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Sun, 17 Aug 2014 08:50:27 -0400 Subject: [PATCH 3/5] bug #4503 [security] Self-XSSes in monitor Signed-off-by: Marc Delisle --- ChangeLog | 1 + js/server_status_monitor.js | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 941a059ada..94b41b5d26 100644 --- a/ChangeLog +++ b/ChangeLog @@ -4,6 +4,7 @@ phpMyAdmin - ChangeLog 4.2.7.1 (2014-08-17) - bug #4501 [security] XSS in table browse page - bug #4502 [security] Self-XSS in enum value editor +- bug #4503 [security] Self-XSSes in monitor - bug #4505 [security] XSS in view operations page 4.2.7.0 (2014-07-31) diff --git a/js/server_status_monitor.js b/js/server_status_monitor.js index c3a0c53893..f5465ed6f7 100644 --- a/js/server_status_monitor.js +++ b/js/server_status_monitor.js @@ -908,7 +908,7 @@ AJAX.registerOnload('server_status_monitor.js', function () { label: $('#variableInput').val().replace(/_/g, " ") }; newChart.series.push(newSeries); - $('#seriesPreview').append('- ' + newSeries.label + str + '
'); + $('#seriesPreview').append('- ' + escapeHtml(newSeries.label + str) + '
'); newChart.nodes.push(serie); $('#variableInput').val(''); $('input[name="differentialValue"]').prop('checked', true); From 90ddeecf60fc029608b972e490b735f3a65ed0cb Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Sun, 17 Aug 2014 08:52:05 -0400 Subject: [PATCH 4/5] bug #4504 [security] Self-XSS in query charts Signed-off-by: Marc Delisle --- ChangeLog | 1 + js/tbl_chart.js | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 94b41b5d26..eea09d6158 100644 --- a/ChangeLog +++ b/ChangeLog @@ -5,6 +5,7 @@ phpMyAdmin - ChangeLog - bug #4501 [security] XSS in table browse page - bug #4502 [security] Self-XSS in enum value editor - bug #4503 [security] Self-XSSes in monitor +- bug #4504 [security] Self-XSS in query charts - bug #4505 [security] XSS in view operations page 4.2.7.0 (2014-07-31) diff --git a/js/tbl_chart.js b/js/tbl_chart.js index 943d4aee35..04c9c40b0c 100644 --- a/js/tbl_chart.js +++ b/js/tbl_chart.js @@ -47,7 +47,7 @@ function PMA_queryChart(data, columnNames, settings) { }, axes : { xaxis : { - label : settings.xaxisLabel + label : escapeHtml(settings.xaxisLabel) }, yaxis : { label : settings.yaxisLabel From 3ffc967fb60cf2910cc2f571017e977558c67821 Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Sun, 17 Aug 2014 08:54:05 -0400 Subject: [PATCH 5/5] bug #4517 [security] XSS in relation view Signed-off-by: Marc Delisle --- ChangeLog | 1 + libraries/tbl_relation.lib.php | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index eea09d6158..1edd1858bc 100644 --- a/ChangeLog +++ b/ChangeLog @@ -7,6 +7,7 @@ phpMyAdmin - ChangeLog - bug #4503 [security] Self-XSSes in monitor - bug #4504 [security] Self-XSS in query charts - bug #4505 [security] XSS in view operations page +- bug #4517 [security] XSS in relation view 4.2.7.0 (2014-07-31) - bug Broken links on home page diff --git a/libraries/tbl_relation.lib.php b/libraries/tbl_relation.lib.php index 0e1bc3d802..60b020ed47 100644 --- a/libraries/tbl_relation.lib.php +++ b/libraries/tbl_relation.lib.php @@ -554,7 +554,7 @@ function PMA_getHtmlForForeignKey($save_row, $i, $existrel_foreign, $myfield, $d $html_output .= __('Constraint name'); $html_output .= ''; + . ' value="' . htmlspecialchars($constraint_name) . '"/>'; $html_output .= '' . "\n"; $html_output .= '';