gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix XSS in database structure page

Browse Source 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
This commit is contained in:
Madhura Jayaratne 2016-02-25 19:48:08 +11:00
parent 32f5126985
commit 90df124797
1 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
libraries/structure.lib.php
View File

@ -962,18 +962,19 @@ function PMA_sortableTableHeader($title, $sort, $initial_sort_order = 'ASC')
$_url_params = array(
'db' => $_REQUEST['db'],
'pos' => 0, // We set the position back to 0 every time they sort.
'sort' => $sort,
'sort_order' => $future_sort_order,
);
$url = 'db_structure.php' . PMA_URL_getCommon($_url_params);
// We set the position back to 0 every time they sort.
$url .= "&amp;pos=0&amp;sort=$sort&amp;sort_order=$future_sort_order";
if (! empty($_REQUEST['tbl_type'])) {
$url .= "&amp;tbl_type=" . $_REQUEST['tbl_type'];
if (PMA_isValid($_REQUEST['tbl_type'], array('view', 'table'))) {
$_url_params['tbl_type'] = $_REQUEST['tbl_type'];
}
if (! empty($_REQUEST['tbl_group'])) {
$url .= "&amp;tbl_group=" . $_REQUEST['tbl_group'];
$_url_params['tbl_group'] = $_REQUEST['tbl_group'];
}
$url = 'db_structure.php' . PMA_URL_getCommon($_url_params);
return PMA_Util::linkOrButton(
$url, $title . $order_img, $order_link_params
);