diff --git a/ChangeLog b/ChangeLog
index 4f9a0f2599..525b80ce90 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -16,6 +16,10 @@ phpMyAdmin - ChangeLog
- bug Escape database and table names for partition maintenance
- bug Invalid value for CURLOPT_SSL_VERIFYPEER
+4.4.6.1 (2015-05-13)
+- bug #4899 [security] CSRF vulnerability in setup
+- bug #4900 [security] Vulnerability allowing man-in-the-middle attack
+
4.4.6.0 (2015-05-07)
- bug #4890 webkitStorageInfo and webkitIndexedDB is deprecated
- bug #4892 Undefined variable: unique_conditions
diff --git a/libraries/Config.class.php b/libraries/Config.class.php
index 1609cea772..dc0316237b 100644
--- a/libraries/Config.class.php
+++ b/libraries/Config.class.php
@@ -756,8 +756,6 @@ class PMA_Config
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
- curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
- curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5);
curl_setopt($ch, CURLOPT_TIMEOUT, 5);
if (! defined('TESTSUITE')) {
diff --git a/libraries/url_generating.lib.php b/libraries/url_generating.lib.php
index bc078ad9f1..799489b225 100644
--- a/libraries/url_generating.lib.php
+++ b/libraries/url_generating.lib.php
@@ -179,6 +179,7 @@ function PMA_URL_getCommon($params = array(), $encode = 'html', $divider = '?')
if (isset($GLOBALS['server'])
&& $GLOBALS['server'] != $GLOBALS['cfg']['ServerDefault']
&& ! isset($params['server'])
+ && ! defined('PMA_SETUP')
) {
$params['server'] = $GLOBALS['server'];
}
diff --git a/setup/frames/form.inc.php b/setup/frames/form.inc.php
index 2fb2cda0f4..4e25bfe1d2 100644
--- a/setup/frames/form.inc.php
+++ b/setup/frames/form.inc.php
@@ -19,8 +19,8 @@ require_once './setup/lib/form_processing.lib.php';
require './libraries/config/setup.forms.php';
-$formset_id = filter_input(INPUT_GET, 'formset');
-$mode = filter_input(INPUT_GET, 'mode');
+$formset_id = isset($_GET['formset']) ? $_GET['formset'] : null;
+$mode = isset($_GET['mode']) ? $_GET['mode'] : null;
if (! isset($forms[$formset_id])) {
PMA_fatalError(__('Incorrect formset, check $formsets array in setup/frames/form.inc.php!'));
}
diff --git a/setup/frames/index.inc.php b/setup/frames/index.inc.php
index c291c3c327..2c341ec2c9 100644
--- a/setup/frames/index.inc.php
+++ b/setup/frames/index.inc.php
@@ -174,12 +174,12 @@ if ($cf->getServerCount() > 0) {
echo '| ' . htmlspecialchars($cf->getServerDSN($id)) . ' | ';
echo '';
echo '';
- echo ''
+ echo ''
. __('Edit') . '';
echo ' | ';
- echo ''
+ echo ''
. __('Delete') . '';
echo '';
echo ' | ';
@@ -308,7 +308,6 @@ echo '';
diff --git a/setup/frames/menu.inc.php b/setup/frames/menu.inc.php
index d82dce07f2..a78c84d689 100644
--- a/setup/frames/menu.inc.php
+++ b/setup/frames/menu.inc.php
@@ -10,11 +10,11 @@ if (!defined('PHPMYADMIN')) {
exit;
}
-$formset_id = filter_input(INPUT_GET, 'formset');
+$formset_id = isset($_GET['formset']) ? $_GET['formset'] : null;
$separator = PMA_URL_getArgSeparator('html');
echo '';
-echo '- ' . __('Overview') . '
';
@@ -28,7 +28,8 @@ $formsets = array(
);
foreach ($formsets as $formset => $label) {
- echo '- ' . $label . '
';
}
diff --git a/setup/frames/servers.inc.php b/setup/frames/servers.inc.php
index 87c5cee1d7..859a784816 100644
--- a/setup/frames/servers.inc.php
+++ b/setup/frames/servers.inc.php
@@ -19,8 +19,8 @@ require_once './setup/lib/form_processing.lib.php';
require './libraries/config/setup.forms.php';
-$mode = filter_input(INPUT_GET, 'mode');
-$id = filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT);
+$mode = isset($_GET['mode']) ? $_GET['mode'] : null;
+$id = PMA_isValid($_GET['id'], 'numeric') ? $_GET['id'] : null;
$cf = $GLOBALS['ConfigFile'];
$server_exists = !empty($id) && $cf->get("Servers/$id") !== null;
diff --git a/setup/index.php b/setup/index.php
index 53d333a63f..5ef68c268e 100644
--- a/setup/index.php
+++ b/setup/index.php
@@ -12,7 +12,7 @@
*/
require './lib/common.inc.php';
-$page = filter_input(INPUT_GET, 'page');
+$page = isset($_GET['page']) ? $_GET['page'] : null;
$page = preg_replace('/[^a-z]/', '', $page);
if ($page === '') {
$page = 'index';
@@ -23,7 +23,7 @@ if (!file_exists("./setup/frames/$page.inc.php")) {
}
// Handle done action info
-$action_done = filter_input(INPUT_GET, 'action_done');
+$action_done = isset($_GET['action_done']) ? $_GET['action_done'] : null;
$action_done = preg_replace('/[^a-z_]/', '', $action_done);
PMA_noCacheHeader();
diff --git a/setup/lib/form_processing.lib.php b/setup/lib/form_processing.lib.php
index 5d762e76c5..db80e44ec5 100644
--- a/setup/lib/form_processing.lib.php
+++ b/setup/lib/form_processing.lib.php
@@ -15,7 +15,7 @@
*/
function PMA_Process_formset(FormDisplay $form_display)
{
- if (filter_input(INPUT_GET, 'mode') == 'revert') {
+ if (isset($_GET['mode']) && $_GET['mode'] == 'revert') {
// revert erroneous fields to their default values
$form_display->fixErrors();
PMA_generateHeader303();
@@ -35,10 +35,10 @@ function PMA_Process_formset(FormDisplay $form_display)
// form has errors, show warning
$separator = PMA_URL_getArgSeparator('html');
- $page = filter_input(INPUT_GET, 'page');
- $formset = filter_input(INPUT_GET, 'formset');
+ $page = isset($_GET['page']) ? $_GET['page'] : null;
+ $formset = isset($_GET['formset']) ? $_GET['formset'] : null;
$formset = $formset ? "{$separator}formset=$formset" : '';
- $formId = filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT);
+ $formId = PMA_isValid($_GET['id'], 'numeric') ? $_GET['id'] : null;
if ($formId === null && $page == 'servers') {
// we've just added a new server, get its id
$formId = $form_display->getConfigFile()->getServerCount();
@@ -48,15 +48,18 @@ function PMA_Process_formset(FormDisplay $form_display)
displayErrors() ?>
-
+
+
-