gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'QA_4_8'

Browse Source 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
This commit is contained in:
Isaac Bennetch 2018-06-21 13:54:08 -04:00
commit d1360f46ce
4 changed files with 30 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ChangeLog
View File

@ -9,9 +9,13 @@ phpMyAdmin - ChangeLog
- issue #14155 Add move columns preview SQL button
- issue #14296 Enable strict mode in PHP files
4.8.2 (not yet released)
4.8.3 (not yet released)
4.8.2 (2018-06-21)
- issue #14370 WHERE 0 causes Fatal error
- issue #14225 Fix missing index icon
- issue [security] XSS vulnerability in Designer, see PMASA-2018-3
- issue [security] File inclusion and remote code execution vulnerability, see PMASA-2018-4
4.8.1 (2018-05-24)
- issue #12772 Fix case where the central columns attributes don't get filled in

2
index.php
View File

@ -59,7 +59,7 @@ if (! empty($_REQUEST['target'])
&& is_string($_REQUEST['target'])
&& ! preg_match('/^index/', $_REQUEST['target'])
&& ! in_array($_REQUEST['target'], $target_blacklist)
&& Core::checkPageValidity($_REQUEST['target'])
&& Core::checkPageValidity($_REQUEST['target'], [], true)
) {
include $_REQUEST['target'];
exit;

12
libraries/classes/Core.php
View File

@ -438,15 +438,18 @@ class Core
} // end getRealSize()
/**
* boolean phpMyAdmin.Core::checkPageValidity(string &$page, array $whitelist, boolean $include)
*
* Checks given $page against given $whitelist and returns true if valid
* it optionally ignores query parameters in $page (script.php?ignored)
*
* @param string $page page to check
* @param array $whitelist whitelist to check page against
* @param string &$page page to check
* @param array $whitelist whitelist to check page against
* @param boolean $include whether the page is going to be included
*
* @return boolean whether $page is valid or not (in $whitelist or not)
*/
public static function checkPageValidity(string $page, array $whitelist = []): bool
public static function checkPageValidity(&$page, array $whitelist = [], $include = false): bool
{
if (empty($whitelist)) {
$whitelist = self::$goto_whitelist;
@ -458,6 +461,9 @@ class Core
if (in_array($page, $whitelist)) {
return true;
}
if ($include) {
return false;
}
$_page = mb_substr(
$page,

25
test/classes/CoreTest.php
View File

@ -269,9 +269,9 @@ class CoreTest extends PmaTestCase
*
* @dataProvider providerTestGotoNowhere
*/
public function testGotoNowhere($page, $whiteList, $expected)
public function testGotoNowhere($page, $whiteList, $include, $expected)
{
$this->assertSame($expected, Core::checkPageValidity($page, $whiteList));
$this->assertSame($expected, Core::checkPageValidity($page, $whiteList, $include));
}
/**
@ -282,14 +282,19 @@ class CoreTest extends PmaTestCase
public function providerTestGotoNowhere()
{
return [
['', [], false],
['', [''], false],
['export.php', [], true],
['export.php', $this->goto_whitelist, true],
['shell.php', $this->goto_whitelist, false],
['index.php?sql.php&test=true', $this->goto_whitelist, true],
['index.php%3Fsql.php%26test%3Dtrue', $this->goto_whitelist, true],
];
[null, [], false, false],
[null, [], true, false],
['export.php', [], false, true],
['export.php', [], true, true],
['export.php', $this->goto_whitelist, false, true],
['export.php', $this->goto_whitelist, true, true],
['shell.php', $this->goto_whitelist, false, false],
['shell.php', $this->goto_whitelist, true, false],
['index.php?sql.php&test=true', $this->goto_whitelist, false, true],
['index.php?sql.php&test=true', $this->goto_whitelist, true, false],
['index.php%3Fsql.php%26test%3Dtrue', $this->goto_whitelist, false, true],
['index.php%3Fsql.php%26test%3Dtrue', $this->goto_whitelist, true, false],
];
}
/**