From e64c50aff8fb83ef59a91eecab0666b410e07383 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maur=C3=ADcio=20Meneghini=20Fauth?=
 <mauriciofauth@gmail.com>
Date: Wed, 18 Apr 2018 23:01:19 -0300
Subject: [PATCH] Fix "undefined index" notices in common.inc.php
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Maurício Meneghini Fauth <mauriciofauth@gmail.com>
---
 libraries/classes/Core.php | 12 +++++-------
 libraries/common.inc.php   |  4 ++--
 test/classes/CoreTest.php  |  3 ++-
 3 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/libraries/classes/Core.php b/libraries/classes/Core.php
index 99be009f20..b0dae17906 100644
--- a/libraries/classes/Core.php
+++ b/libraries/classes/Core.php
@@ -436,22 +436,20 @@ class Core
     } // end getRealSize()
 
     /**
-     * boolean phpMyAdmin.Core::checkPageValidity(string &$page, array $whitelist)
-     *
-     * checks given $page against given $whitelist and returns true if valid
+     * Checks given $page against given $whitelist and returns true if valid
      * it optionally ignores query parameters in $page (script.php?ignored)
      *
-     * @param string|null $page      page to check
-     * @param array       $whitelist whitelist to check page against
+     * @param string $page      page to check
+     * @param array  $whitelist whitelist to check page against
      *
      * @return boolean whether $page is valid or not (in $whitelist or not)
      */
-    public static function checkPageValidity(?string $page, array $whitelist = []): bool
+    public static function checkPageValidity(string $page, array $whitelist = []): bool
     {
         if (empty($whitelist)) {
             $whitelist = self::$goto_whitelist;
         }
-        if (! isset($page) || !is_string($page)) {
+        if (empty($page)) {
             return false;
         }
 
diff --git a/libraries/common.inc.php b/libraries/common.inc.php
index ff65c14384..45c4356b3b 100644
--- a/libraries/common.inc.php
+++ b/libraries/common.inc.php
@@ -140,7 +140,7 @@ $GLOBALS['url_params'] = array();
  */
 $GLOBALS['goto'] = '';
 // Security fix: disallow accessing serious server files via "?goto="
-if (Core::checkPageValidity($_REQUEST['goto'])) {
+if (isset($_REQUEST['goto']) && Core::checkPageValidity($_REQUEST['goto'])) {
     $GLOBALS['goto'] = $_REQUEST['goto'];
     $GLOBALS['url_params']['goto'] = $_REQUEST['goto'];
 } else {
@@ -151,7 +151,7 @@ if (Core::checkPageValidity($_REQUEST['goto'])) {
  * returning page
  * @global string $GLOBALS['back']
  */
-if (Core::checkPageValidity($_REQUEST['back'])) {
+if (isset($_REQUEST['back']) && Core::checkPageValidity($_REQUEST['back'])) {
     $GLOBALS['back'] = $_REQUEST['back'];
 } else {
     unset($_REQUEST['back'], $_GET['back'], $_POST['back'], $_COOKIE['back']);
diff --git a/test/classes/CoreTest.php b/test/classes/CoreTest.php
index 7a04cf763c..7f38a8cb8c 100644
--- a/test/classes/CoreTest.php
+++ b/test/classes/CoreTest.php
@@ -280,7 +280,8 @@ class CoreTest extends PmaTestCase
     public function providerTestGotoNowhere()
     {
         return array(
-            array(null, [], false),
+            array('', [], false),
+            array('', [''], false),
             array('export.php', [], true),
             array('export.php', $this->goto_whitelist, true),
             array('shell.php', $this->goto_whitelist, false),