Merge branch 'QA_4_6-security' into master-security

index.php

@@ -393,7 +393,7 @@ PMA_printListItem(
 PMA_printListItem(
     __('Official Homepage'),
     'li_pma_homepage',
-    PMA_linkURL('https://www.phpMyAdmin.net/'),
+    PMA_linkURL('https://www.phpmyadmin.net/'),
     null,
     '_blank'
 );

libraries/core.lib.php

@@ -730,10 +730,17 @@ function PMA_linkURL($url)
 function PMA_isAllowedDomain($url)
 {
     $arr = parse_url($url);
-    // Avoid URLs without hostname or with credentials
-    if (empty($arr['host']) || ! empty($arr['user']) || ! empty($arr['pass'])) {
+    // We need host to be set
+    if (! isset($arr['host']) || strlen($arr['host']) == 0) {
         return false;
     }
+    // We do not want these to be present
+    $blocked = array('user', 'pass', 'port');
+    foreach ($blocked as $part) {
+        if (isset($arr[$part]) && strlen($arr[$part]) != 0) {
+            return false;
+        }
+    }
     $domain = $arr["host"];
     $domainWhiteList = array(
         /* Include current domain */
@@ -742,6 +749,7 @@ function PMA_isAllowedDomain($url)
         'wiki.phpmyadmin.net', 'www.phpmyadmin.net', 'phpmyadmin.net',
         'demo.phpmyadmin.net',
         'docs.phpmyadmin.net',
+        'demo.phpmyadmin.net',
         /* mysql.com domains */
         'dev.mysql.com','bugs.mysql.com',
         /* mariadb domains */
@@ -757,7 +765,7 @@ function PMA_isAllowedDomain($url)
         /* Following are doubtful ones. */
         'mysqldatabaseadministration.blogspot.com',
     );
-    if (in_array(mb_strtolower($domain), $domainWhiteList)) {
+    if (in_array($domain, $domainWhiteList)) {
         return true;
     }
 

test/classes/MessageTest.php

@@ -107,6 +107,7 @@ class MessageTest extends PMATestCase
     {
         $this->object = new PMA\libraries\Message('', PMA\libraries\Message::ERROR);
         $this->object->setMessage('test<&>');
+        $this->object->setBBCode(false);
 
         $this->assertEquals($this->object, PMA\libraries\Message::rawError('test<&>'));
     }
@@ -120,6 +121,7 @@ class MessageTest extends PMATestCase
     {
         $this->object = new PMA\libraries\Message('', PMA\libraries\Message::NOTICE);
         $this->object->setMessage('test<&>');
+        $this->object->setBBCode(false);
 
         $this->assertEquals($this->object, PMA\libraries\Message::rawNotice('test<&>'));
     }
@@ -133,6 +135,7 @@ class MessageTest extends PMATestCase
     {
         $this->object = new PMA\libraries\Message('', PMA\libraries\Message::SUCCESS);
         $this->object->setMessage('test<&>');
+        $this->object->setBBCode(false);
 
         $this->assertEquals($this->object, PMA\libraries\Message::rawSuccess('test<&>'));
     }

test/libraries/core/PMA_isAllowedDomain_test.php

@@ -43,6 +43,9 @@ class PMA_isAllowedDomain_test extends PHPUnit_Framework_TestCase
             array('https://www.phpmyadmin.net/', true),
             array('http://duckduckgo.com\\@github.com', false),
             array('https://github.com/', true),
+            array('https://github.com:123/', false),
+            array('https://user:pass@github.com:123/', false),
+            array('https://user:pass@github.com/', false),
             array('https://server.local/', true),
             array('./relative/', false),
         );