From 39dd5f9e4f766165e99a5bb844cedddc4cac51a0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <mcihar@suse.cz>
Date: Thu, 3 Oct 2013 15:39:59 +0200
Subject: [PATCH 1/3] Do not load common.inc for js/get_scripts.js.php

No functionality is being used there and the token protection only
causes troubles.
---
 js/get_scripts.js.php | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/js/get_scripts.js.php b/js/get_scripts.js.php
index b23ccefd11..3c0bc87146 100644
--- a/js/get_scripts.js.php
+++ b/js/get_scripts.js.php
@@ -9,10 +9,6 @@
 
 chdir('..');
 
-// Avoid loading the full common.inc.php because this would add many
-// non-js-compatible stuff like DOCTYPE
-define('PMA_MINIMUM_COMMON', true);
-require_once './libraries/common.inc.php';
 // Close session early as we won't write anything there
 session_write_close();
 

From 0ad8714cb113ce5e15b0ca222eaa936ac684541b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <mcihar@suse.cz>
Date: Thu, 3 Oct 2013 15:50:37 +0200
Subject: [PATCH 2/3] Properly detect variable presence

---
 js/get_scripts.js.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/get_scripts.js.php b/js/get_scripts.js.php
index 3c0bc87146..72b3b44de8 100644
--- a/js/get_scripts.js.php
+++ b/js/get_scripts.js.php
@@ -41,7 +41,7 @@ if (! empty($_GET['scripts']) && is_array($_GET['scripts'])) {
     }
 }
 
-if ($_GET['call_done']) {
+if (isset($_GET['call_done'])) {
     echo "AJAX.scriptHandler.done();";
 }
 ?>

From 52be2f7fc9e4b4d517ca1d5190ba1a997fc04099 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <mcihar@suse.cz>
Date: Thu, 3 Oct 2013 15:54:50 +0200
Subject: [PATCH 3/3] Simplify file name validation

We don't want to expose possible hidden files as well (starting with .
on unix).
---
 js/get_scripts.js.php | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/js/get_scripts.js.php b/js/get_scripts.js.php
index 72b3b44de8..fdeddf4c3b 100644
--- a/js/get_scripts.js.php
+++ b/js/get_scripts.js.php
@@ -24,11 +24,9 @@ if (! empty($_GET['scripts']) && is_array($_GET['scripts'])) {
 
         $path = explode("/", $script);
         foreach ($path as $index => $filename) {
-            if (! preg_match("@^\.+$@", $filename)
-                && preg_match("@^[\w\.-]+$@", $filename)
-            ) {
-                // Disallow "." and ".." alone
-                // Allow alphanumeric, "." and "-" chars only
+            // Allow alphanumeric, "." and "-" chars only, no files starting
+            // with .
+            if (preg_match("@^[\w][\w\.-]+$@", $filename)) {
                 $script_name .= DIRECTORY_SEPARATOR . $filename;
             }
         }