gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix phpmyadmin-security#240 Multiple CSRF vulnerabilities

Browse Source 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
This commit is contained in:
Madhura Jayaratne 2018-04-18 00:07:48 +10:00
parent 301cbe4ef7
commit c6dd6b56e2
5 changed files with 16 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ChangeLog
View File

@ -1,7 +1,8 @@
phpMyAdmin - ChangeLog
======================
4.8.1 (not yet released)
4.8.0.1 (not yet released)
- issue [security] Multiple CSRF vulnerabilities, See PMASA-2018-02
4.8.0 (2018-04-07)
- issue #12946 Allow to export JSON with unescaped unicode chars

7
js/db_operations.js
View File

@ -134,6 +134,7 @@ AJAX.registerOnload('db_operations.js', function () {
*/
$(document).on('click', '#drop_db_anchor.ajax', function (event) {
event.preventDefault();
var $link = $(this);
/**
* @var question String containing the question to be asked for confirmation
*/
@ -142,10 +143,8 @@ AJAX.registerOnload('db_operations.js', function () {
PMA_messages.strDoYouReally,
'DROP DATABASE `' + escapeHtml(PMA_commonParams.get('db') + '`')
);
var params = {
'is_js_confirmed': '1',
'ajax_request': true
};
var params = getJSConfirmCommonParam(this, $link.getPostData());
$(this).PMA_confirm(question, $(this).attr('href'), function (url) {
PMA_ajaxShowMessage(PMA_messages.strProcessingRequest);
$.post(url, params, function (data) {

6
js/tbl_operations.js
View File

@ -218,6 +218,7 @@ AJAX.registerOnload('tbl_operations.js', function () {
$(document).on('click', '#drop_tbl_anchor.ajax', function (event) {
event.preventDefault();
var $link = $(this);
/**
* @var question String containing the question to be asked for confirmation
*/
@ -230,7 +231,7 @@ AJAX.registerOnload('tbl_operations.js', function () {
$(this).PMA_confirm(question, $(this).attr('href'), function (url) {
var $msgbox = PMA_ajaxShowMessage(PMA_messages.strProcessingRequest);
var params = getJSConfirmCommonParam(this);
var params = getJSConfirmCommonParam(this, $link.getPostData());
$.post(url, params, function (data) {
if (typeof data !== 'undefined' && data.success === true) {
@ -289,6 +290,7 @@ AJAX.registerOnload('tbl_operations.js', function () {
$(document).on('click', '#truncate_tbl_anchor.ajax', function (event) {
event.preventDefault();
var $link = $(this);
/**
* @var question String containing the question to be asked for confirmation
*/
@ -300,7 +302,7 @@ AJAX.registerOnload('tbl_operations.js', function () {
$(this).PMA_confirm(question, $(this).attr('href'), function (url) {
PMA_ajaxShowMessage(PMA_messages.strProcessingRequest);
var params = getJSConfirmCommonParam(this);
var params = getJSConfirmCommonParam(this, $link.getPostData());
$.post(url, params, function (data) {
if ($('.sqlqueryresults').length !== 0) {

9
libraries/classes/Operations.php
View File

@ -1559,10 +1559,11 @@ class Operations
*/
public function getDeleteDataOrTablelink(array $url_params, $syntax, $link, $htmlId)
{
return '<li><a '
. 'href="sql.php' . Url::getCommon($url_params) . '"'
. ' id="' . $htmlId . '" class="ajax">'
. $link . '</a>'
return '<li>' . Util::linkOrButton(
'sql.php' . Url::getCommon($url_params),
$link,
array('id' => $htmlId, 'class' => 'ajax')
)
. Util::showMySQLDocu($syntax)
. '</li>';
}

4
sql.php
View File

@ -69,8 +69,8 @@ if (! isset($err_url)) {
// Coming from a bookmark dialog
if (isset($_POST['bkm_fields']['bkm_sql_query'])) {
$sql_query = $_POST['bkm_fields']['bkm_sql_query'];
} elseif (isset($_GET['sql_query'])) {
$sql_query = $_GET['sql_query'];
} elseif (isset($_POST['sql_query'])) {
$sql_query = $_POST['sql_query'];
}
// This one is just to fill $db