From de86283ad3d7c7f4e1e14cd657e9c130dada4772 Mon Sep 17 00:00:00 2001 From: Garvin Hicking Date: Fri, 14 Mar 2003 14:06:52 +0000 Subject: [PATCH] Bug #703555 --- ChangeLog | 5 +++++ db_details_importdocsql.php3 | 2 +- libraries/display_tbl.lib.php3 | 30 ++++++++++++++---------------- 3 files changed, 20 insertions(+), 17 deletions(-) diff --git a/ChangeLog b/ChangeLog index 59dc3de3b5..08b2076a6b 100755 --- a/ChangeLog +++ b/ChangeLog @@ -5,6 +5,11 @@ phpMyAdmin - Changelog $Id$ $Source$ +2003-03-14 Garvin Hicking + * libraries/display_tbl.lib.php3, db_details_importdocsql.php3: Fixed + '../' safety issues, display transformations only if file exists + (Bug #703555) + 2003-03-14 Robin Johnson * config.inc.php3, libraries/config_import.lib.php3 tbl_change.php3: - Typo fixes: diff --git a/db_details_importdocsql.php3 b/db_details_importdocsql.php3 index 312a967b6b..8c4ffad583 100644 --- a/db_details_importdocsql.php3 +++ b/db_details_importdocsql.php3 @@ -206,7 +206,7 @@ if (isset($do) && $do == 'import') { } else { // echo '

Starting Import

'; - $docpath = $DOCUMENT_ROOT . dirname($PHP_SELF) . '/' . str_replace('../', './', $docpath); + $docpath = $DOCUMENT_ROOT . dirname($PHP_SELF) . '/' . eregi_replace('\.\.*', '.', $docpath); if (substr($docpath, strlen($docpath) - 2, 1) != '/') { $docpath = $docpath . '/'; } diff --git a/libraries/display_tbl.lib.php3 b/libraries/display_tbl.lib.php3 index 4521f2e2c2..ab022100f6 100644 --- a/libraries/display_tbl.lib.php3 +++ b/libraries/display_tbl.lib.php3 @@ -1046,24 +1046,22 @@ if (!defined('PMA_DISPLAY_TBL_LIB_INCLUDED')) { if ($GLOBALS['cfgRelation']['mimework'] && $GLOBALS['cfg']['BrowseMIME']) { - if (isset($GLOBALS['mime_map'][$meta->name]['mimetype']) && isset($GLOBALS['mime_map'][$meta->name]['transformation'])) { + if (isset($GLOBALS['mime_map'][$meta->name]['mimetype']) && isset($GLOBALS['mime_map'][$meta->name]['transformation']) && !empty($GLOBALS['mime_map'][$meta->name]['transformation'])) { // garvin: for security, never allow to break out from transformations directory - $include_file = eregi_replace('^[\./]*(.*)', '\1', $GLOBALS['mime_map'][$meta->name]['transformation']); + $include_file = eregi_replace('\.\.*', '.', $GLOBALS['mime_map'][$meta->name]['transformation']); - $transformfunction_name = str_replace('.inc.php3', '', $GLOBALS['mime_map'][$meta->name]['transformation']); - - include('./libraries/transformations/' . $include_file); - - if (defined('PMA_TRANSFORMATION_' . strtoupper($transformfunction_name)) && function_exists('PMA_transformation_' . $transformfunction_name)) { - - $transform_function = 'PMA_transformation_' . $transformfunction_name; - $transform_options = PMA_transformation_getOptions((isset($GLOBALS['mime_map'][$meta->name]['transformation_options']) ? $GLOBALS['mime_map'][$meta->name]['transformation_options'] : '')); - - } - - } - - } + if (file_exists('./libraries/transformations/' . $include_file)) { + $transformfunction_name = str_replace('.inc.php3', '', $GLOBALS['mime_map'][$meta->name]['transformation']); + + @include('./libraries/transformations/' . $include_file); + + if (defined('PMA_TRANSFORMATION_' . strtoupper($transformfunction_name)) && function_exists('PMA_transformation_' . $transformfunction_name)) { + $transform_function = 'PMA_transformation_' . $transformfunction_name; + $transform_options = PMA_transformation_getOptions((isset($GLOBALS['mime_map'][$meta->name]['transformation_options']) ? $GLOBALS['mime_map'][$meta->name]['transformation_options'] : '')); + } + } // end if file_exists + } // end if transformation is set + } // end if mime/transformation works. $transform_options['wrapper_link'] = '?' . (isset($url_query) ? $url_query : '')