From bd68c54d1beeef79d237e8bfda44690834012a76 Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Tue, 21 Oct 2014 08:42:02 +0530 Subject: [PATCH 1/2] bug #4562 [security] XSS in debug SQL output Signed-off-by: Madhura Jayaratne --- ChangeLog | 3 +++ libraries/DatabaseInterface.class.php | 5 +++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 975b173306..02d02217d0 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,9 @@ phpMyAdmin - ChangeLog ====================== +4.2.10.1 (not yet released) +- bug #4562 [security] XSS in debug SQL output + 4.2.10.0 (2014-10-11) - bug #4361 Can't change font size (when config.inc.php not present) - bug #4542 Tab key in column name not shown diff --git a/libraries/DatabaseInterface.class.php b/libraries/DatabaseInterface.class.php index c126c17d5d..c7c5171420 100644 --- a/libraries/DatabaseInterface.class.php +++ b/libraries/DatabaseInterface.class.php @@ -139,10 +139,11 @@ class PMA_DatabaseInterface $_SESSION['debug']['queries'][$hash] = array(); if ($result == false) { $_SESSION['debug']['queries'][$hash]['error'] - = '' . mysqli_error($link) . ''; + = '' + . htmlspecialchars(mysqli_error($link)) . ''; } $_SESSION['debug']['queries'][$hash]['count'] = 1; - $_SESSION['debug']['queries'][$hash]['query'] = $query; + $_SESSION['debug']['queries'][$hash]['query'] = htmlspecialchars($query); $_SESSION['debug']['queries'][$hash]['time'] = $time; } From 7b8962dede7631298c81e2c1cd267b81f1e08a8c Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Tue, 21 Oct 2014 08:45:09 +0530 Subject: [PATCH 2/2] bug #4563 [security] XSS in monitor query analyzer Signed-off-by: Madhura Jayaratne --- ChangeLog | 1 + js/server_status_monitor.js | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 02d02217d0..c0597da6e9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -3,6 +3,7 @@ phpMyAdmin - ChangeLog 4.2.10.1 (not yet released) - bug #4562 [security] XSS in debug SQL output +- bug #4563 [security] XSS in monitor query analyzer 4.2.10.0 (2014-10-11) - bug #4361 Can't change font size (when config.inc.php not present) diff --git a/js/server_status_monitor.js b/js/server_status_monitor.js index 4432cafdc6..97684d8ced 100644 --- a/js/server_status_monitor.js +++ b/js/server_status_monitor.js @@ -1855,7 +1855,7 @@ AJAX.registerOnload('server_status_monitor.js', function () { if (name == 'user_host') { return value.replace(/(\[.*?\])+/g, ''); } - return value; + return escapeHtml(value); }; for (var i = 0, l = rows.length; i < l; i++) { @@ -2011,7 +2011,7 @@ AJAX.registerOnload('server_status_monitor.js', function () { for (i = 0, l = data.explain.length; i < l; i++) { explain += '
0 ? 'style="display:none;"' : '') + '>'; $.each(data.explain[i], function (key, value) { - value = (value === null) ? 'null' : value; + value = (value === null) ? 'null' : escapeHtml(value); if (key == 'type' && value.toLowerCase() == 'all') { value = '' + value + '';