gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security: remove dots in template to avoid a remote code execution vulnerability

Browse Source
This commit is contained in:
Marc Delisle 2013-04-20 07:07:29 -04:00
parent ffa720d90a
commit d3fafdfba0
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
export.php
View File

@ -272,6 +272,8 @@ if ($asfile) {
'Export/file_template_table', $filename_template);
}
}
// remove dots in template to avoid a remote code execution vulnerability
$filename_template = str_replace('.', '', $filename_template);
$filename = PMA_expandUserString($filename_template);
$filename = PMA_sanitize_filename($filename);