gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'MAINT_4_5_5-security' into QA_4_6-security

Browse Source
This commit is contained in:
Michal Čihař 2016-02-29 10:35:47 +01:00
commit a29f154f37
15 changed files with 82 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ChangeLog
View File

@ -54,6 +54,10 @@ phpMyAdmin - ChangeLog
- issue #12012 Column definition with default value and comment in CREATE TABLE expoerted faulty.
- issue #12020 New statement but no delimiter and unexpected token with REPLACE.
- issue #12029 Fixed incorrect usage of SQL parser context in SQL export
- issue [security] XSS vulnerability in SQL parser, see PMASA-2016-10.
- issue [security] Multiple XSS vulnerabilities, see PMASA-2016-11.
- issue [security] Multiple XSS vulnerabilities, see PMASA-2016-12.
- issue [security] Vulnerability allowing man-in-the-middle attack on API call to GitHub, see PMASA-2016-13.
4.5.5.0 (2016-02-22)
- issue Undefined index: is_ajax_request

2
db_central_columns.php
View File

@ -92,7 +92,7 @@ if (isset($_REQUEST['total_rows']) && $_REQUEST['total_rows']) {
} else {
$total_rows = PMA_getCentralColumnsCount($db);
}
if (isset($_REQUEST['pos'])) {
if (PMA_isValid($_REQUEST['pos'], 'integer')) {
$pos = $_REQUEST['pos'];
} else {
$pos = 0;

8
file_echo.php
View File

@ -64,12 +64,16 @@ if (isset($_REQUEST['filename']) && isset($_REQUEST['image'])) {
} else if (isset($_REQUEST['monitorconfig'])) {
/* For monitor chart config export */
PMA_downloadHeader('monitor.cfg', 'application/force-download');
PMA_downloadHeader('monitor.cfg', 'application/json; charset=UTF-8');
header('X-Content-Type-Options: nosniff');
echo urldecode($_REQUEST['monitorconfig']);
} else if (isset($_REQUEST['import'])) {
/* For monitor chart config import */
header('Content-type: text/plain');
header('Content-Type: application/json; charset=UTF-8');
header('X-Content-Type-Options: nosniff');
if (!file_exists($_FILES['file']['tmp_name'])) {
exit();
}

20
js/functions.js
View File

@ -340,6 +340,24 @@ function escapeHtml(unsafe) {
}
}
function escapeJsString(unsafe) {
if (typeof(unsafe) != 'undefined') {
return unsafe
.toString()
.replace("\000", '')
.replace('\\', '\\\\')
.replace('\'', '\\\'')
.replace("'", "\\\'")
.replace('"', '\"')
.replace(""", "\"")
.replace("\n", '\n')
.replace("\r", '\r')
.replace(/<\/script/gi, '</\' + \'script')
} else {
return false;
}
}
function PMA_sprintf() {
return sprintf.apply(this, arguments);
}
@ -1819,7 +1837,7 @@ AJAX.registerOnload('functions.js', function () {
var $inner_sql = $(this).parent().prev().find('code.sql');
var old_text = $inner_sql.html();
var new_content = "<textarea name=\"sql_query_edit\" id=\"sql_query_edit\">" + sql_query + "</textarea>\n";
var new_content = "<textarea name=\"sql_query_edit\" id=\"sql_query_edit\">" + escapeHtml(sql_query) + "</textarea>\n";
new_content += getForeignKeyCheckboxLoader();
new_content += "<input type=\"submit\" id=\"sql_query_edit_save\" class=\"button btnSave\" value=\"" + PMA_messages.strGo + "\"/>\n";
new_content += "<input type=\"button\" id=\"sql_query_edit_discard\" class=\"button btnDiscard\" value=\"" + PMA_messages.strCancel + "\"/>\n";

8
js/normalization.js
View File

@ -82,7 +82,7 @@ function goTo2NFStep1() {
$("#mainContent #extra").html(data.extra);
$("#mainContent #newCols").html('');
if (data.subText !== '') {
$('.tblFooters').html('<input type="submit" value="' + PMA_messages.strDone + '" onclick="processDependencies(\'' + data.primary_key + '\');">');
$('.tblFooters').html('<input type="submit" value="' + PMA_messages.strDone + '" onclick="processDependencies(\'' + escapeJsString(escapeHtml(data.primary_key)) + '\');">');
} else {
if (normalizeto === '3nf') {
$("#mainContent #newCols").html(PMA_messages.strToNextStep);
@ -128,7 +128,7 @@ function goToStep4()
$("#mainContent #newCols").html('');
$('.tblFooters').html('');
for(var pk in primary_key) {
$("#extra input[value='" + primary_key[pk] + "']").attr("disabled","disabled");
$("#extra input[value='" + escapeJsString(primary_key[pk]) + "']").attr("disabled","disabled");
}
}
);
@ -153,7 +153,7 @@ function goToStep3()
$('.tblFooters').html('');
primary_key = $.parseJSON(data.primary_key);
for(var pk in primary_key) {
$("#extra input[value='" + primary_key[pk] + "']").attr("disabled","disabled");
$("#extra input[value='" + escapeJsString(primary_key[pk]) + "']").attr("disabled","disabled");
}
}
);
@ -638,7 +638,7 @@ AJAX.registerOnload('normalization.js', function() {
'</ol>';
$("#newCols").html(confirmStr);
$('.tblFooters').html('<input type="submit" value="' + PMA_messages.strCancel + '" onclick="$(\'#newCols\').html(\'\');$(\'#extra input[type=checkbox]\').removeAttr(\'checked\')"/>' +
'<input type="submit" value="' + PMA_messages.strGo + '" onclick="moveRepeatingGroup(\'' + repeatingCols + '\')"/>');
'<input type="submit" value="' + PMA_messages.strGo + '" onclick="moveRepeatingGroup(\'' + escapeJsString(escapeHtml(repeatingCols)) + '\')"/>');
}
});
$("#mainContent p").on("click", "#createPrimaryKey", function(event) {

4
libraries/Config.php
View File

@ -724,8 +724,8 @@ class Config
Util::configureCurl($handle);
curl_setopt($handle, CURLOPT_FOLLOWLOCATION, 0);
curl_setopt($handle, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($handle, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($handle, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt($handle, CURLOPT_SSL_VERIFYHOST, '2');
curl_setopt($handle, CURLOPT_SSL_VERIFYPEER, '1');
curl_setopt($handle, CURLOPT_CONNECTTIMEOUT, 5);
curl_setopt($handle, CURLOPT_TIMEOUT, 5);
curl_setopt($handle, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V4);

6
libraries/controllers/table/TableSearchController.php
View File

@ -460,7 +460,11 @@ class TableSearchController extends TableController
return;
}
$key = array_search($field, $this->_columnNames);
$properties = $this->getColumnProperties($_REQUEST['it'], $key);
$search_index = 0;
if (PMA_isValid($_REQUEST['it'], 'integer')) {
$search_index = $_REQUEST['it'];
}
$properties = $this->getColumnProperties($search_index, $key);
$this->response->addJSON(
'field_type', htmlspecialchars($properties['type'])
);

2
libraries/server_privileges.lib.php
View File

@ -3608,7 +3608,7 @@ function PMA_getUsersOverview($result, $db_rights, $pmaThemeImage, $text_dir)
__('Export'), 'b_tblexport.png', 'export'
);
$html_output .= '<input type="hidden" name="initial" '
. 'value="' . (isset($_GET['initial']) ? $_GET['initial'] : '') . '" />';
. 'value="' . (isset($_GET['initial']) ? htmlspecialchars($_GET['initial']) : '') . '" />';
$html_output .= '</div>'
. '<div class="clear_both" style="clear:both"></div>';

2
libraries/sql-parser/src/Utils/Error.php
View File

@ -90,7 +90,7 @@ class Error
++$i,
$err[0],
$err[1],
$err[2],
htmlspecialchars($err[2]),
$err[3]
);
}

2
libraries/tcpdf/include/tcpdf_static.php
View File

@ -2508,8 +2508,6 @@ class TCPDF_STATIC {
}
curl_setopt($cs, CURLOPT_CONNECTTIMEOUT, 5);
curl_setopt($cs, CURLOPT_TIMEOUT, 30);
curl_setopt($cs, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($cs, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($cs, CURLOPT_USERAGENT, 'TCPDF');
$ret = curl_exec($cs);
curl_close($cs);

2
normalization.php
View File

@ -71,7 +71,7 @@ $scripts = $header->getScripts();
$scripts->addFile('normalization.js');
$scripts->addFile('jquery/jquery.uitablefilter.js');
$normalForm = '1nf';
if (isset($_REQUEST['normalizeTo'])) {
if (PMA_isValid($_REQUEST['normalizeTo'], array('1nf', '2nf', '3nf'))) {
$normalForm = $_REQUEST['normalizeTo'];
}
if (isset($_REQUEST['createNewTables2NF'])) {

19
templates/database/structure/sortable_header.phtml
View File

@ -51,16 +51,21 @@ if ($requested_sort == $sort) {
}
$_url_params = array(
'db' => $_REQUEST['db'],
'pos' => 0, // We set the position back to 0 every time they sort.
'sort' => $sort,
'sort_order' => $future_sort_order,
);
$url = 'db_structure.php' . PMA_URL_getCommon($_url_params);
// We set the position back to 0 every time they sort.
$url .= "&amp;pos=0&amp;sort=$sort&amp;sort_order=$future_sort_order";
if (! empty($_REQUEST['tbl_type'])) {
$url .= "&amp;tbl_type=" . $_REQUEST['tbl_type'];
if (PMA_isValid($_REQUEST['tbl_type'], array('view', 'table'))) {
$_url_params['tbl_type'] = $_REQUEST['tbl_type'];
}
if (! empty($_REQUEST['tbl_group'])) {
$url .= "&amp;tbl_group=" . $_REQUEST['tbl_group'];
$_url_params['tbl_group'] = $_REQUEST['tbl_group'];
}
$url = 'db_structure.php' . PMA_URL_getCommon($_url_params);
echo PMA_Util::linkOrButton(
echo PMA\libraries\Util::linkOrButton(
$url, $title . $order_img, $order_link_params
);
);

18
templates/table/search/input_box.phtml
View File

@ -20,7 +20,7 @@ if ($_foreigners
<?php if (isset($criteriaValues[$column_index])
&& is_string($criteriaValues[$column_index])
): ?>
value="<?= $criteriaValues[$column_index]; ?>"
value="<?= htmlspecialchars($criteriaValues[$column_index]); ?>"
<?php endif; ?> />
<a class="ajax browse_foreign"
href="<?= ('browse_foreigners.php') , PMA_URL_getCommon(array('db' => $db, 'table' => $table))
@ -90,6 +90,7 @@ if ($_foreigners
&& is_array($criteriaValues[$column_index])
&& in_array($value[$j], $criteriaValues[$column_index])
): ?>
<<<<<<< HEAD
<option value="<?= $value[$j]; ?>"
selected>
<?= $value[$j]; ?>
@ -97,6 +98,15 @@ if ($_foreigners
<?php else: ?>
<option value="<?= $value[$j]; ?>">
<?= $value[$j]; ?>
=======
<option value="<?php echo htmlspecialchars($value[$j]); ?>"
selected>
<?php echo htmlspecialchars($value[$j]); ?>
</option>
<?php else: ?>
<option value="<?php echo htmlspecialchars($value[$j]); ?>">
<?php echo htmlspecialchars($value[$j]); ?>
>>>>>>> MAINT_4_5_5-security
</option>
<?php endif; ?>
<?php endfor; ?>
@ -126,7 +136,11 @@ if ($_foreigners
<?php if (isset($criteriaValues[$column_index])
&& is_string($criteriaValues[$column_index])
): ?>
<<<<<<< HEAD
value="<?= $criteriaValues[$column_index]; ?>"
=======
value="<?php echo htmlspecialchars($criteriaValues[$column_index]); ?>"
>>>>>>> MAINT_4_5_5-security
<?php endif; ?>/>
<?php endif; ?>
<?php endif; ?>

2
templates/table/search/rows_zoom.phtml
View File

@ -68,7 +68,7 @@ for ($i = 0; $i < 4; $i++): ?>
</td>
<!-- Inputbox for search criteria value -->
<td>
<?= (isset($value[$i]) ? htmlspecialchars($value[$i]) : ''); ?>
<?= (isset($value[$i]) ? $value[$i] : ''); ?>
</td>
</tr>
<!-- Displays hidden fields -->

12
test/classes/ConfigTest.php
View File

@ -50,6 +50,7 @@ class ConfigTest extends PMATestCase
$GLOBALS['server'] = 0;
$_SESSION['is_git_revision'] = true;
$GLOBALS['PMA_Config'] = new PMA\libraries\Config(CONFIG_FILE);
$GLOBALS['cfg']['ProxyUrl'] = '';
//for testing file permissions
$this->permTestObj = new PMA\libraries\Config("./config.sample.inc.php");
@ -889,14 +890,19 @@ class ConfigTest extends PMATestCase
$this->markTestSkipped('Missing curl extension!');
}
$this->assertTrue(
$this->object->checkHTTP("http://www.phpmyadmin.net/test/data")
$this->object->checkHTTP("https://www.phpmyadmin.net/test/data")
);
$this->assertContains(
"TEST DATA",
$this->object->checkHTTP("http://www.phpmyadmin.net/test/data", true)
$this->object->checkHTTP("https://www.phpmyadmin.net/test/data", true)
);
$this->assertFalse(
$this->object->checkHTTP("http://www.phpmyadmin.net/test/nothing")
$this->object->checkHTTP("https://www.phpmyadmin.net/test/nothing")
);
// Use rate limit API as it's not subject to rate limiting
$this->assertContains(
'"resources"',
$this->object->checkHTTP("https://api.github.com/rate_limit", true)
);
}
}