Merge remote-tracking branch 'origin/QA_4_0' into QA_4_0

ChangeLog

@@ -9,6 +9,9 @@ phpMyAdmin - ChangeLog
 - bug #3960 NavigationBarIconic config not honored
 - bug #3985 Call to undefined function mb_detect_encoding
 
+4.0.4.1 (2013-06-30)
+- [security] Global variables scope injection vulnerability (see PMASA-2013-7)
+
 4.0.4.0 (2013-06-17)
 - bug #3959 Using DefaultTabDatabase in NavigationTree for Database Click
 - bug #3961 Avoid Suhosin warning when in simulation mode

import.php

@@ -122,6 +122,24 @@ if ($_POST == array() && $_GET == array()) {
  * We only need to load the selected plugin
  */
 
+if (! in_array(
+    $format, 
+    array(
+        'csv',
+        'ldi',
+        'mediawiki',
+        'ods',
+        'shp',
+        'sql',
+        'xml'
+    )
+)
+) {
+    // this should not happen for a normal user
+    // but only during an attack
+    PMA_fatalError('Incorrect format parameter');
+}
+
 $post_patterns = array(
     '/^force_file_/',
     '/^'. $format . '_/'