From 50d1a4884306ae6705f0bb665ba71da24089b6fe Mon Sep 17 00:00:00 2001 From: Rouslan Placella Date: Thu, 9 Aug 2012 13:08:31 -0400 Subject: [PATCH 1/5] Fix for trigger page vulnerability, see PMASA-2012-4 --- libraries/rte/rte_triggers.lib.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libraries/rte/rte_triggers.lib.php b/libraries/rte/rte_triggers.lib.php index 0a9d27ceaf..92eb22dadf 100644 --- a/libraries/rte/rte_triggers.lib.php +++ b/libraries/rte/rte_triggers.lib.php @@ -317,7 +317,9 @@ function PMA_TRI_getEditorForm($mode, $item) } else if ($mode == 'edit' && $value == $item['item_table']) { $selected = " selected='selected'"; } - $retval .= " $value\n"; + $retval .= ""; + $retval .= htmlspecialchars($value); + $retval .= "\n"; } $retval .= " \n"; $retval .= " \n"; From ee306681d0d5ac09b6fc62a7d573020af083e856 Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Thu, 9 Aug 2012 13:13:08 -0400 Subject: [PATCH 2/5] Fix for Empty and Drop vulnerabilities on db Structure and Operations, see PMASA-2012-4 --- js/db_structure.js | 4 ++-- js/functions.js | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/js/db_structure.js b/js/db_structure.js index b87c42210e..4c7ccb2f4f 100644 --- a/js/db_structure.js +++ b/js/db_structure.js @@ -276,7 +276,7 @@ $(document).ready(function() { /** * @var question String containing the question to be asked for confirmation */ - var question = 'TRUNCATE ' + curr_table_name; + var question = 'TRUNCATE ' + escapeHtml(curr_table_name); $this_anchor.PMA_confirm(question, $this_anchor.attr('href'), function(url) { @@ -335,7 +335,7 @@ $(document).ready(function() { } else { question += 'TABLE'; } - question += ' ' + curr_table_name; + question += ' ' + escapeHtml(curr_table_name); $this_anchor.PMA_confirm(question, $this_anchor.attr('href'), function(url) { diff --git a/js/functions.js b/js/functions.js index 1bb944544c..06281c2508 100644 --- a/js/functions.js +++ b/js/functions.js @@ -3342,7 +3342,7 @@ $(document).ready(function() { /** * @var question String containing the question to be asked for confirmation */ - var question = PMA_messages['strDropTableStrongWarning'] + '\n' + PMA_messages['strDoYouReally'] + ' :\n' + 'DROP TABLE ' + window.parent.table; + var question = PMA_messages['strDropTableStrongWarning'] + '\n' + PMA_messages['strDoYouReally'] + ' :\n' + 'DROP TABLE ' + escapeHtml(window.parent.table); $(this).PMA_confirm(question, $(this).attr('href') ,function(url) { @@ -3373,7 +3373,7 @@ $(document).ready(function() { /** * @var question String containing the question to be asked for confirmation */ - var question = PMA_messages['strTruncateTableStrongWarning'] + '\n' + PMA_messages['strDoYouReally'] + ' :\n' + 'TRUNCATE TABLE ' + window.parent.table; + var question = PMA_messages['strTruncateTableStrongWarning'] + '\n' + PMA_messages['strDoYouReally'] + ' :\n' + 'TRUNCATE TABLE ' + escapeHtml(window.parent.table); $(this).PMA_confirm(question, $(this).attr('href') ,function(url) { From dca22c5046aa16899042592b40a0af7b5c4f1fc7 Mon Sep 17 00:00:00 2001 From: Dieter Adriaenssens Date: Fri, 10 Aug 2012 16:04:54 +0200 Subject: [PATCH 3/5] [security] properly escape name of newly created table, see PMASA-2012-4 --- tbl_create.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/tbl_create.php b/tbl_create.php index 63cd26a1da..7caade9ea7 100644 --- a/tbl_create.php +++ b/tbl_create.php @@ -272,7 +272,9 @@ if (isset($_REQUEST['do_save_data'])) { $new_table_string .= ' ' . "\n"; $new_table_string .= ''; - $new_table_string .= ''. $table . ''; + $new_table_string .= '' + . htmlspecialchars($table) . ''; if (PMA_Tracker::isActive()) { $truename = str_replace(' ', ' ', htmlspecialchars($table)); From 1aec25f5f2163029da51da39a1d13dcb20fb00ea Mon Sep 17 00:00:00 2001 From: Rouslan Placella Date: Fri, 10 Aug 2012 16:26:11 +0200 Subject: [PATCH 4/5] [security] properly escape query error message when creating new trigger, see PMASA-2012-4 --- libraries/rte/rte_triggers.lib.php | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/libraries/rte/rte_triggers.lib.php b/libraries/rte/rte_triggers.lib.php index 92eb22dadf..4e344ce474 100644 --- a/libraries/rte/rte_triggers.lib.php +++ b/libraries/rte/rte_triggers.lib.php @@ -100,8 +100,12 @@ function PMA_TRI_handleEditor() // 'Add a new item' mode $result = PMA_DBI_try_query($item_query); if (! $result) { - $errors[] = sprintf(__('The following query has failed: "%s"'), $item_query) . '

' - . __('MySQL said: ') . PMA_DBI_getError(null); + $errors[] = sprintf( + __('The following query has failed: "%s"'), + htmlspecialchars($item_query) + ) + . '

' + . __('MySQL said: ') . PMA_DBI_getError(null); } else { $message = PMA_Message::success(__('Trigger %1$s has been created.')); $message->addParam(PMA_backquote($_REQUEST['item_name'])); From d56335691cf1c1d8be3453904a885038da0a8c93 Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Sun, 12 Aug 2012 06:40:36 +0530 Subject: [PATCH 5/5] [security] Properly escape content of tooltips in GIS visualization --- js/tbl_gis_visualization.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/js/tbl_gis_visualization.js b/js/tbl_gis_visualization.js index 3000e883c0..38722a474e 100644 --- a/js/tbl_gis_visualization.js +++ b/js/tbl_gis_visualization.js @@ -297,7 +297,7 @@ $(document).ready(function() { */ $('.polygon, .multipolygon, .point, .multipoint, .linestring, .multilinestring, ' + '.geometrycollection').live('mousemove', function(event) { - contents = $.trim($(this).attr('name')); + contents = $.trim(escapeHtml($(this).attr('name'))); $("#tooltip").remove(); if (contents != '') { $('
' + contents + '
').css({