gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bug #4594 [security] Path traversal in file inclusion of GIS factory

Browse Source 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
This commit is contained in:
Madhura Jayaratne 2014-11-20 06:32:57 +05:30
parent 1bc04ec950
commit 80cd40b668
2 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
ChangeLog
View File

@ -17,6 +17,7 @@ phpMyAdmin - ChangeLog
- bug #4595 [security] Path traversal can lead to leakage of line count
- bug #4578 [security] XSS vulnerability in table print view
- bug #4579 [security] XSS vulnerability in zoom search page
- bug #4594 [security] Path traversal in file inclusion of GIS factory
4.2.11.0 (2014-10-31)
- bug ReferenceError: Table_onover is not defined

4
libraries/gis/GIS_Factory.class.php
View File

@ -33,7 +33,9 @@ class PMA_GIS_Factory
include_once './libraries/gis/GIS_Geometry.class.php';
$type_lower = strtolower($type);
if (! file_exists('./libraries/gis/GIS_' . ucfirst($type_lower) . '.class.php')) {
if (! PMA_isValid($type_lower, PMA_Util::getGISDatatypes())
|| ! file_exists('./libraries/gis/GIS_' . ucfirst($type_lower) . '.class.php')
) {
return false;
}
if (include_once './libraries/gis/GIS_' . ucfirst($type_lower) . '.class.php') {