From d368a81ccaf2c1013bd49cbf51ec23be346aeffb Mon Sep 17 00:00:00 2001 From: Tyron Madlener Date: Fri, 5 Aug 2011 11:35:09 +0300 Subject: [PATCH] Chart import config now returned as application/json to prevent possible XSS attacks --- file_echo.php | 10 ++++++++-- js/functions.js | 7 ------- js/server_status.js | 4 +++- 3 files changed, 11 insertions(+), 10 deletions(-) diff --git a/file_echo.php b/file_echo.php index 5e92cb7d1b..3ebf6734d3 100644 --- a/file_echo.php +++ b/file_echo.php @@ -9,6 +9,7 @@ require_once './libraries/common.inc.php'; +/* For chart exporting */ if (isset($_REQUEST['filename']) && isset($_REQUEST['image'])) { $allowed = array( 'image/png' => 'png', @@ -53,10 +54,15 @@ if (isset($_REQUEST['filename']) && isset($_REQUEST['image'])) { /* Send data */ echo $data; +/* For monitor chart config export */ } else if (isset($_REQUEST['monitorconfig'])) { PMA_download_header('monitor.cfg', 'application/force-download'); echo urldecode($_REQUEST['monitorconfig']); + +/* For monitor chart config import */ } else if (isset($_REQUEST['import'])) { - echo '' . file_get_contents($_FILES['file']['tmp_name']) . ''; + header('Content-type: application/json'); + if(!file_exists($_FILES['file']['tmp_name'])) exit(); + echo file_get_contents($_FILES['file']['tmp_name']); } -?> +?> \ No newline at end of file diff --git a/js/functions.js b/js/functions.js index b6b7692442..0cca1d1d6b 100644 --- a/js/functions.js +++ b/js/functions.js @@ -29,13 +29,6 @@ var codemirror_editor = false; */ var chart_activeTimeouts = new Object(); -if(window.parent) { - $(document).ready(function() { - if(window.parent.currentWidth() == 0) - $('div#frameExpand').show(); - }); -} - /** * Add a hidden field to the form to indicate that this will be an * Ajax request (only if this hidden field does not exist) diff --git a/js/server_status.js b/js/server_status.js index 60a3490a9a..eced236372 100644 --- a/js/server_status.js +++ b/js/server_status.js @@ -1029,7 +1029,9 @@ $(function() { // Try loading config try { - json = $.secureEvalJSON($('body',$('iframe#monitorConfigUpload')[0].contentWindow.document).html()); + var data = $('body',$('iframe#monitorConfigUpload')[0].contentWindow.document).html(); + // Chrome wraps around '
' to any text content -.-
+                    json = $.secureEvalJSON(data.substring(data.indexOf("{"), data.lastIndexOf("}") + 1));
                 } catch (err) {
                     alert(PMA_messages['strFailedParsingConfig']);
                     $('div#emptyDialog').dialog('close');