From 733a5d582193d32c5435bd6324316c9da1b01678 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@cihar.com>
Date: Fri, 2 Sep 2016 14:17:52 +0200
Subject: [PATCH] Avoid rendering BB code when showing PHP/MySQL errors
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michal Čihař <michal@cihar.com>
---
 libraries/ErrorHandler.php                 |  9 +++++---
 libraries/Message.php                      | 25 +++++++++++++++++++++-
 libraries/plugins/AuthenticationPlugin.php |  2 +-
 3 files changed, 31 insertions(+), 5 deletions(-)

diff --git a/libraries/ErrorHandler.php b/libraries/ErrorHandler.php
index 8bd408d5a1..31beca5bdb 100644
--- a/libraries/ErrorHandler.php
+++ b/libraries/ErrorHandler.php
@@ -175,16 +175,19 @@ class ErrorHandler
         $this->errors[$error->getHash()] = $error;
 
         switch ($error->getNumber()) {
-        case E_USER_NOTICE:
-        case E_USER_WARNING:
         case E_STRICT:
         case E_DEPRECATED:
         case E_NOTICE:
         case E_WARNING:
         case E_CORE_WARNING:
         case E_COMPILE_WARNING:
-        case E_USER_ERROR:
         case E_RECOVERABLE_ERROR:
+            /* Avoid rendering BB code in PHP errors */
+            $error->setBBCode(false);
+            break;
+        case E_USER_NOTICE:
+        case E_USER_WARNING:
+        case E_USER_ERROR:
             // just collect the error
             // display is called from outside
             break;
diff --git a/libraries/Message.php b/libraries/Message.php
index 1b500aff39..fefd50ff44 100644
--- a/libraries/Message.php
+++ b/libraries/Message.php
@@ -112,6 +112,14 @@ class Message
      */
     protected $isDisplayed = false;
 
+    /**
+     * Whether to use BB code when displaying.
+     *
+     * @access  protected
+     * @var     boolean
+     */
+    protected $useBBCode = true;
+
     /**
      * Unique id
      *
@@ -236,6 +244,7 @@ class Message
     {
         $r = new Message('', $type);
         $r->setMessage($message);
+        $r->setBBCode(false);
         return $r;
     }
 
@@ -392,6 +401,18 @@ class Message
         return $this->getNumber() === Message::ERROR;
     }
 
+    /**
+     * Set whether we should use BB Code when rendering.
+     *
+     * @param boolean $useBBCode Use BB Code?
+     *
+     * @return void
+     */
+    public function setBBCode($useBBCode)
+    {
+        $this->useBBCode = $useBBCode;
+    }
+
     /**
      * set raw message (overrides string)
      *
@@ -647,7 +668,9 @@ class Message
             $message = Message::format($message, $this->getParams());
         }
 
-        $message = Message::decodeBB($message);
+        if ($this->useBBCode) {
+            $message = Message::decodeBB($message);
+        }
 
         foreach ($this->getAddedMessages() as $add_message) {
             $message .= $add_message;
diff --git a/libraries/plugins/AuthenticationPlugin.php b/libraries/plugins/AuthenticationPlugin.php
index 33f83f4a63..3a435d22f0 100644
--- a/libraries/plugins/AuthenticationPlugin.php
+++ b/libraries/plugins/AuthenticationPlugin.php
@@ -114,7 +114,7 @@ abstract class AuthenticationPlugin
         } else {
             $dbi_error = $GLOBALS['dbi']->getError();
             if (!empty($dbi_error)) {
-                return PMA_sanitize($dbi_error);
+                return htmlspecialchars($dbi_error);
             } elseif (isset($GLOBALS['errno'])) {
                 return '#' . $GLOBALS['errno'] . ' '
                 . __('Cannot log in to the MySQL server');