From 8147dee382229a25223e1f7efa1f4437f246b560 Mon Sep 17 00:00:00 2001
From: Marc Delisle <marc@infomarc.info>
Date: Wed, 2 May 2012 10:54:27 -0400
Subject: [PATCH] bug #3522930 [browse] Missing validation in Ajax mode

---
 ChangeLog       |  1 +
 js/messages.php |  1 +
 js/sql.js       | 27 +++++++++++++++++++--------
 3 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 477e324994..38e759bedb 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -6,6 +6,7 @@ phpMyAdmin - ChangeLog
 - bug #3521313 [core] Call to undefined function __()
 - bug #3521016 [edit] NOW() function incorrectly selected
 - bug [GUI] Invalid HTML code on transformation_overview.php
+- bug #3522930 [browse] Missing validation in Ajax mode
 
 3.5.1.0 (not yet released)
 - bug #3510784 [edit] Limit clause ignored when sort order is remembered
diff --git a/js/messages.php b/js/messages.php
index b5ebea2176..89bc869c07 100644
--- a/js/messages.php
+++ b/js/messages.php
@@ -285,6 +285,7 @@ $js_messages['strEdit'] = __('Edit');
 $js_messages['strNoRowSelected'] = __('No rows selected');
 $js_messages['strChangeTbl'] = __('Change');
 $js_messages['strQueryExecutionTime'] = __('Query execution time');
+$js_messages['strNotValidRowNumber'] = __('%d is not valid row number.');
 
 /* For server_variables.js */
 $js_messages['strSave'] = __('Save');
diff --git a/js/sql.js b/js/sql.js
index 13703ca8cb..e62a3ee422 100644
--- a/js/sql.js
+++ b/js/sql.js
@@ -289,16 +289,27 @@ $(document).ready(function() {
          */
         var $form = $(this).parent("form");
 
-        PMA_prepareForAjaxRequest($form);
+        if (checkFormElementInRange(
+                $form[0], 
+                'session_max_rows', 
+                PMA_messages['strNotValidRowNumber'], 1)
+            &&
+            checkFormElementInRange(
+                $form[0], 
+                'pos', 
+                PMA_messages['strNotValidRowNumber'], 0)) {
 
-        $.post($form.attr('action'), $form.serialize(), function(data) {
-            $("#sqlqueryresults")
-             .html(data)
-             .trigger('makegrid');
-            PMA_init_slider();
+            PMA_prepareForAjaxRequest($form);
 
-            PMA_ajaxRemoveMessage($msgbox);
-        }); // end $.post()
+            $.post($form.attr('action'), $form.serialize(), function(data) {
+                $("#sqlqueryresults")
+                 .html(data)
+                 .trigger('makegrid');
+                PMA_init_slider();
+
+                PMA_ajaxRemoveMessage($msgbox);
+            }); // end $.post()
+        }
     }); // end Paginate results table
 
     /**