From cd097656758f981f80fb9029c7d6b4294582b706 Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Fri, 23 Oct 2015 06:50:04 -0400 Subject: [PATCH] Port content spoofing fix Signed-off-by: Marc Delisle --- ChangeLog | 4 ++++ url.php | 3 ++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index d0bd66a90e..e4eac27cc0 100644 --- a/ChangeLog +++ b/ChangeLog @@ -142,6 +142,10 @@ phpMyAdmin - ChangeLog - issue #11448 Clarify doc about the MemoryLimit directive - issue #11489 Cannot copy a database under certain conditions +4.4.15.1 (2015-10-23) +- issue #11464 phpMyAdmin suggests upgrading to newer version not usable on that system +- issue [security] Content spoofing on url.php + 4.4.15.0 (2015-09-20) - issue #11411 Undefined "replace" function on numeric scalar - issue #11421 Stored-proc / routine - broken parameter parsing diff --git a/url.php b/url.php index eec78a52b1..9c4c8846b6 100644 --- a/url.php +++ b/url.php @@ -32,6 +32,7 @@ if (! PMA_isValid($_REQUEST['url']) } "; // Display redirecting msg on screen. - printf(__('Taking you to %s.'), htmlspecialchars($_REQUEST['url'])); + // Do not display the value of $_REQUEST['url'] to avoid showing injected content + echo __('Taking you to the target site.'); } die();