gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/master'

Browse Source
This commit is contained in:
Weblate 2018-04-19 04:06:12 +02:00
commit 8f32791b87
3 changed files with 9 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libraries/classes/Core.php
View File

@ -436,22 +436,20 @@ class Core
} // end getRealSize()
/**
* boolean phpMyAdmin.Core::checkPageValidity(string &$page, array $whitelist)
*
* checks given $page against given $whitelist and returns true if valid
* Checks given $page against given $whitelist and returns true if valid
* it optionally ignores query parameters in $page (script.php?ignored)
*
* @param string|null $page page to check
* @param array $whitelist whitelist to check page against
* @param string $page page to check
* @param array $whitelist whitelist to check page against
*
* @return boolean whether $page is valid or not (in $whitelist or not)
*/
public static function checkPageValidity(?string $page, array $whitelist = []): bool
public static function checkPageValidity(string $page, array $whitelist = []): bool
{
if (empty($whitelist)) {
$whitelist = self::$goto_whitelist;
}
if (! isset($page) || !is_string($page)) {
if (empty($page)) {
return false;
}

4
libraries/common.inc.php
View File

@ -140,7 +140,7 @@ $GLOBALS['url_params'] = array();
*/
$GLOBALS['goto'] = '';
// Security fix: disallow accessing serious server files via "?goto="
if (Core::checkPageValidity($_REQUEST['goto'])) {
if (isset($_REQUEST['goto']) && Core::checkPageValidity($_REQUEST['goto'])) {
$GLOBALS['goto'] = $_REQUEST['goto'];
$GLOBALS['url_params']['goto'] = $_REQUEST['goto'];
} else {
@ -151,7 +151,7 @@ if (Core::checkPageValidity($_REQUEST['goto'])) {
* returning page
* @global string $GLOBALS['back']
*/
if (Core::checkPageValidity($_REQUEST['back'])) {
if (isset($_REQUEST['back']) && Core::checkPageValidity($_REQUEST['back'])) {
$GLOBALS['back'] = $_REQUEST['back'];
} else {
unset($_REQUEST['back'], $_GET['back'], $_POST['back'], $_COOKIE['back']);

3
test/classes/CoreTest.php
View File

@ -280,7 +280,8 @@ class CoreTest extends PmaTestCase
public function providerTestGotoNowhere()
{
return array(
array(null, [], false),
array('', [], false),
array('', [''], false),
array('export.php', [], true),
array('export.php', $this->goto_whitelist, true),
array('shell.php', $this->goto_whitelist, false),