From cb7c703c03f656debcea2a16468bd53660fc888e Mon Sep 17 00:00:00 2001 From: "Ann + J.M" Date: Fri, 6 Jun 2014 18:40:19 +0200 Subject: [PATCH 1/4] Fix XSS in recent/favorite tables list feature Signed-off-by: Ann + J.M --- libraries/RecentFavoriteTable.class.php | 13 ++++++++----- libraries/structure.lib.php | 11 ++++++----- 2 files changed, 14 insertions(+), 10 deletions(-) diff --git a/libraries/RecentFavoriteTable.class.php b/libraries/RecentFavoriteTable.class.php index 54041c51a3..84aed20988 100644 --- a/libraries/RecentFavoriteTable.class.php +++ b/libraries/RecentFavoriteTable.class.php @@ -206,8 +206,9 @@ class PMA_RecentFavoriteTable $html .= '`' . $table['db'] . '`.`' . $table['table'] . '`'; + . '&token=' . $_SESSION[' PMA_token '] . '">`' + . htmlspecialchars($table['db']) . '`.`' + . htmlspecialchars($table['table']) . '`'; $html .= ''; } } else { @@ -223,7 +224,8 @@ class PMA_RecentFavoriteTable . PMA_URL_getCommon($fav_params); $html .= 'href="' . $fav_rm_url . '" title="' . __("Remove from Favorites") - . '" data-favtargetn="' . $table['db'] . "." . $table['table'] + . '" data-favtargetn="' + . md5($table['db'] . "." . $table['table']) . '" >' . PMA_Util::getIcon('b_favorite.png') . ''; @@ -231,8 +233,9 @@ class PMA_RecentFavoriteTable $html .= '`' . $table['db'] . '`.`' . $table['table'] . '`'; + . '&token=' . $_SESSION[' PMA_token '] . '">`' + . htmlspecialchars($table['db']) . '`.`' + . htmlspecialchars($table['table']) . '`'; $html .= ''; } } diff --git a/libraries/structure.lib.php b/libraries/structure.lib.php index 5e32c6935e..db5777184f 100644 --- a/libraries/structure.lib.php +++ b/libraries/structure.lib.php @@ -2736,9 +2736,8 @@ function PMA_checkFavoriteTable($db, $current_table) function PMA_getHtmlForFavoriteAnchor($db, $current_table, $titles) { $html_output = ' $db, 'ajax_request' => true, 'favorite_table' => $current_table['TABLE_NAME'], - (($already_favorite?'remove':'add') . '_favorite') => true); + (($already_favorite?'remove':'add') . '_favorite') => true + ); $fav_url = 'db_structure.php' . PMA_URL_getCommon($fav_params); $html_output .= '" '; $html_output .= 'href="' . $fav_url . '" title="' . ($already_favorite ? __("Remove from Favorites") : __("Add to Favorites")) - . '" data-favtargets="' . $db . "." . $current_table['TABLE_NAME'] + . '" data-favtargets="' + . md5($db . "." . $current_table['TABLE_NAME']) . '" >' . (!$already_favorite ? $titles['NoFavorite'] : $titles['Favorite']) . ''; From 42a65a5ab6166c4ce15cf4e74e80b7acca7c8e08 Mon Sep 17 00:00:00 2001 From: "Ann + J.M" Date: Fri, 6 Jun 2014 20:46:14 +0200 Subject: [PATCH 2/4] Trim some trailing space Signed-off-by: Ann + J.M --- libraries/RecentFavoriteTable.class.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libraries/RecentFavoriteTable.class.php b/libraries/RecentFavoriteTable.class.php index 84aed20988..bc8cc5873e 100644 --- a/libraries/RecentFavoriteTable.class.php +++ b/libraries/RecentFavoriteTable.class.php @@ -96,7 +96,7 @@ class PMA_RecentFavoriteTable /** * Returns the recent/favorite tables array * - * @return array + * @return array */ public function getTables() { From d18a2dd9faad7e0e96df799b59e16ef587afb838 Mon Sep 17 00:00:00 2001 From: "Ann + J.M" Date: Thu, 19 Jun 2014 12:50:56 +0200 Subject: [PATCH 3/4] Fix XSS in PMA_RecentFavoriteTable::getHtmlList() Signed-off-by: Ann + J.M --- libraries/RecentFavoriteTable.class.php | 38 +++++++++++++++---------- 1 file changed, 23 insertions(+), 15 deletions(-) diff --git a/libraries/RecentFavoriteTable.class.php b/libraries/RecentFavoriteTable.class.php index bc8cc5873e..9221ba38b6 100644 --- a/libraries/RecentFavoriteTable.class.php +++ b/libraries/RecentFavoriteTable.class.php @@ -203,10 +203,13 @@ class PMA_RecentFavoriteTable if ($this->_tableType == 'recent') { foreach ($this->_tables as $table) { $html .= '
  • '; - $html .= '`' + $recent_params = array( + 'db' => $table['db'], + 'table' => $table['table'] + ); + $recent_url = 'sql.php' + . PMA_URL_getCommon($recent_params); + $html .= '`' . htmlspecialchars($table['db']) . '`.`' . htmlspecialchars($table['table']) . '`'; $html .= '
    • '; @@ -215,11 +218,13 @@ class PMA_RecentFavoriteTable foreach ($this->_tables as $table) { $html .= '
  • '; - $html .= ' $table['db'], - 'ajax_request' => true, - 'favorite_table' => $table['table'], - 'remove_favorite' => true); + $html .= ' $table['db'], + 'ajax_request' => true, + 'favorite_table' => $table['table'], + 'remove_favorite' => true + ); $fav_rm_url = 'db_structure.php' . PMA_URL_getCommon($fav_params); $html .= 'href="' . $fav_rm_url @@ -230,12 +235,15 @@ class PMA_RecentFavoriteTable . PMA_Util::getIcon('b_favorite.png') . ''; - $html .= '`' - . htmlspecialchars($table['db']) . '`.`' - . htmlspecialchars($table['table']) . '`'; + $fav_params = array( + 'db' => $table['db'], + 'table' => $table['table'] + ); + $table_url = 'sql.php' + . PMA_URL_getCommon($fav_params); + $html .= '`' + . htmlspecialchars($table['db']) . '`.`' + . htmlspecialchars($table['table']) . '`'; $html .= '
    • '; } } From d4f754c937f9e2c0beadff5b2e38215dde1d6a79 Mon Sep 17 00:00:00 2001 From: "Ann + J.M" Date: Thu, 19 Jun 2014 12:57:59 +0200 Subject: [PATCH 4/4] Fix XSS in Hide navigation items feature Signed-off-by: Ann + J.M --- libraries/navigation/Navigation.class.php | 6 +++--- libraries/navigation/Nodes/Node_DatabaseChild.class.php | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/libraries/navigation/Navigation.class.php b/libraries/navigation/Navigation.class.php index b7827f6b1c..d036c7e54c 100644 --- a/libraries/navigation/Navigation.class.php +++ b/libraries/navigation/Navigation.class.php @@ -189,9 +189,9 @@ class PMA_Navigation $html .= '' . PMA_Util::getIcon('lightbulb.png', __('Show')) . ''; diff --git a/libraries/navigation/Nodes/Node_DatabaseChild.class.php b/libraries/navigation/Nodes/Node_DatabaseChild.class.php index 6e0a7ec57f..962a48c010 100644 --- a/libraries/navigation/Nodes/Node_DatabaseChild.class.php +++ b/libraries/navigation/Nodes/Node_DatabaseChild.class.php @@ -32,9 +32,9 @@ abstract class Node_DatabaseChild extends Node . '' . PMA_Util::getImage('lightbulb_off.png', __('Hide')) . '';