From d8b37769e66570d461c5ac6f964acc62573d5353 Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Wed, 4 Mar 2015 12:44:21 -0500 Subject: [PATCH 1/2] [security] Risk of BREACH attack MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Thanks to Michal Čihař for the message suggestion. Signed-off-by: Marc Delisle --- libraries/select_lang.lib.php | 28 ++++------------------------ 1 file changed, 4 insertions(+), 24 deletions(-) diff --git a/libraries/select_lang.lib.php b/libraries/select_lang.lib.php index 6ac358714b..5a943ce275 100644 --- a/libraries/select_lang.lib.php +++ b/libraries/select_lang.lib.php @@ -606,34 +606,14 @@ $GLOBALS['l']['w_page'] = __('Page number:'); // now, that we have loaded the language strings we can send the errors -if ($GLOBALS['lang_failed_cfg']) { +if ($GLOBALS['lang_failed_cfg'] + || $GLOBALS['lang_failed_cookie'] + || $GLOBALS['lang_failed_request']) { trigger_error( - sprintf( - __('Unknown language: %1$s.'), - htmlspecialchars($GLOBALS['lang_failed_cfg']) - ), + __('Ignoring unsupported language code.'), E_USER_ERROR ); } -if ($GLOBALS['lang_failed_cookie']) { - trigger_error( - sprintf( - __('Unknown language: %1$s.'), - htmlspecialchars($GLOBALS['lang_failed_cookie']) - ), - E_USER_ERROR - ); -} -if ($GLOBALS['lang_failed_request']) { - trigger_error( - sprintf( - __('Unknown language: %1$s.'), - htmlspecialchars($GLOBALS['lang_failed_request']) - ), - E_USER_ERROR - ); -} - unset( $line, $fall_back_lang, $GLOBALS['lang_failed_cfg'], $GLOBALS['lang_failed_cookie'], $GLOBALS['lang_failed_request'] From ddcf57717ddfd7c9976d37f49a96bf161861398c Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Wed, 4 Mar 2015 12:45:44 -0500 Subject: [PATCH 2/2] ChangeLog entry Signed-off-by: Marc Delisle --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 67880164c9..0deae604e7 100644 --- a/ChangeLog +++ b/ChangeLog @@ -68,6 +68,9 @@ explanation 4.3.12.0 (not yet released) - bug #4746 Right-aligned columns have left-aligned header +4.3.11.1 (not yet released) +- bug [security] Risk of BREACH attack, see PMASA-2015-1 + 4.3.11.0 (not yet released) - bug #4774 SQL links are completely wrong - bug #4768 MariaDB: version mismatch