From 56e9ede5223219cef2187ced385924ef2e0ae21d Mon Sep 17 00:00:00 2001 From: Dieter Adriaenssens Date: Sun, 7 Jul 2013 15:15:57 +0200 Subject: [PATCH 01/62] fix unescaped parameter, see PMASA-2013-8 for details --- libraries/DisplayResults.class.php | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) diff --git a/libraries/DisplayResults.class.php b/libraries/DisplayResults.class.php index 35dd112eaf..5a090f1458 100644 --- a/libraries/DisplayResults.class.php +++ b/libraries/DisplayResults.class.php @@ -4920,19 +4920,18 @@ class PMA_DisplayResults $message_view_warning = false; } - $message = PMA_Message::success(__('Showing rows')); - $message->addMessage($first_shown_rec); + $message = PMA_Message::success(__('Showing rows %1s - %2s')); + $message->addParam($first_shown_rec); if ($message_view_warning) { - - $message->addMessage('...', ' - '); - $message->addMessage($message_view_warning); - $message->addMessage('('); - + $message->addParam('... ' . $message_view_warning, false); } else { + $message->addParam($last_shown_rec); + } - $message->addMessage($last_shown_rec, ' - '); - $message->addMessage(' ('); + $message->addMessage('('); + + if (!$message_view_warning) { $message->addMessage( $pre_count . PMA_Util::formatNumber($total, 0) ); @@ -4944,7 +4943,6 @@ class PMA_DisplayResults $message->addMessage($selectstring, ''); $message->addMessage(', ', ''); - } $messagge_qt = PMA_Message::notice(__('Query took %01.4f sec') . ')'); From ff27a2c5e0c706f401b7ee8677cbd46568a4eca2 Mon Sep 17 00:00:00 2001 From: Dieter Adriaenssens Date: Sun, 7 Jul 2013 15:32:17 +0200 Subject: [PATCH 02/62] add total as parameter to message --- libraries/DisplayResults.class.php | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/libraries/DisplayResults.class.php b/libraries/DisplayResults.class.php index 5a090f1458..8077c80d47 100644 --- a/libraries/DisplayResults.class.php +++ b/libraries/DisplayResults.class.php @@ -4932,14 +4932,13 @@ class PMA_DisplayResults $message->addMessage('('); if (!$message_view_warning) { - $message->addMessage( - $pre_count . PMA_Util::formatNumber($total, 0) - ); - $message->addString(__('total')); + $message_total = PMA_Message::notice($precount . __('%d total')); + $message_total->addParam($total); if (!empty($after_count)) { - $message->addMessage($after_count); + $message_total->addMessage($after_count); } + $message->addMessage($message_total, ''); $message->addMessage($selectstring, ''); $message->addMessage(', ', ''); From 2005c4b7c15afa61a41e1087464fe12645f535e1 Mon Sep 17 00:00:00 2001 From: "J.M" Date: Sun, 7 Jul 2013 15:51:20 +0200 Subject: [PATCH 03/62] [security] Fix stored XSS in Server status monitor, see PMASA-2013-9 --- ChangeLog | 3 +++ server_status.php | 8 ++++---- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/ChangeLog b/ChangeLog index a46e88c0b6..d72d60ebc5 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,9 @@ phpMyAdmin - ChangeLog ====================== +4.0.4.2 (not released yet) +- [security] Fix stored XSS in Server status monitor, see PMASA-2013-9 + 4.0.4.1 (2013-06-30) - [security] Global variables scope injection vulnerability (see PMASA-2013-7) diff --git a/server_status.php b/server_status.php index 27d3c6ad80..1db92fac5a 100644 --- a/server_status.php +++ b/server_status.php @@ -466,10 +466,10 @@ function getServerTrafficHtml($ServerStatusData) $retval .= ''; $retval .= '' . __('Kill') . ''; $retval .= '' . $process['Id'] . ''; - $retval .= '' . $process['User'] . ''; - $retval .= '' . $process['Host'] . ''; - $retval .= '' . ((! isset($process['db']) || ! strlen($process['db'])) ? '' . __('None') . '' : $process['db']) . ''; - $retval .= '' . $process['Command'] . ''; + $retval .= '' . htmlspecialchars($process['User']) . ''; + $retval .= '' . htmlspecialchars($process['Host']) . ''; + $retval .= '' . ((! isset($process['db']) || ! strlen($process['db'])) ? '' . __('None') . '' : htmlspecialchars($process['db'])) . ''; + $retval .= '' . htmlspecialchars($process['Command']) . ''; $retval .= '' . $process['Time'] . ''; $retval .= '' . (empty($process['State']) ? '---' : $process['State']) . ''; $retval .= ''; From d096a0fc46ef4708f3f4a440a8aba40163e3b72a Mon Sep 17 00:00:00 2001 From: "J.M" Date: Sun, 7 Jul 2013 16:52:20 +0200 Subject: [PATCH 04/62] [security] Fix stored XSS in navigation panel logo link, see PMASA-2013-9 --- ChangeLog | 1 + libraries/navigation/NavigationHeader.class.php | 11 ++++++++--- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index d72d60ebc5..5bcddfc20a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -3,6 +3,7 @@ phpMyAdmin - ChangeLog 4.0.4.2 (not released yet) - [security] Fix stored XSS in Server status monitor, see PMASA-2013-9 +- [security] Fix stored XSS in navigation panel logo link, see PMASA-2013-9 4.0.4.1 (2013-06-30) - [security] Global variables scope injection vulnerability (see PMASA-2013-7) diff --git a/libraries/navigation/NavigationHeader.class.php b/libraries/navigation/NavigationHeader.class.php index b1513d2c03..5f10403d11 100644 --- a/libraries/navigation/NavigationHeader.class.php +++ b/libraries/navigation/NavigationHeader.class.php @@ -79,9 +79,14 @@ class PMA_NavigationHeader } $retval .= '