From 16c4ca0daa9648257d5a2548e4035d2988805fd5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@cihar.com>
Date: Tue, 26 Jul 2016 16:47:01 +0200
Subject: [PATCH] Properly escape configuration parameters when rendering
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michal Čihař <michal@cihar.com>
---
 db_central_columns.php                                  | 2 +-
 libraries/DisplayResults.php                            | 4 ++--
 libraries/browse_foreigners.lib.php                     | 2 +-
 libraries/controllers/server/ServerBinlogController.php | 4 ++--
 libraries/plugins/AuthenticationPlugin.php              | 2 +-
 libraries/plugins/auth/AuthenticationCookie.php         | 2 +-
 templates/columns_definitions/column_name.phtml         | 4 ++--
 templates/table/search/options.phtml                    | 4 ++--
 templates/table/search/options_zoom.phtml               | 6 +++---
 9 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/db_central_columns.php b/db_central_columns.php
index 0b1294f812..a1cd31ba7d 100644
--- a/db_central_columns.php
+++ b/db_central_columns.php
@@ -64,7 +64,7 @@ $scripts->addFile('db_central_columns.js');
 $cfgCentralColumns = PMA_centralColumnsGetParams();
 $pmadb = $cfgCentralColumns['db'];
 $pmatable = $cfgCentralColumns['table'];
-$max_rows = $GLOBALS['cfg']['MaxRows'];
+$max_rows = intval($GLOBALS['cfg']['MaxRows']);
 
 if (isset($_REQUEST['edit_central_columns_page'])) {
     $selected_fld = $_REQUEST['selected_fld'];
diff --git a/libraries/DisplayResults.php b/libraries/DisplayResults.php
index a24ae288e4..d398b3e81d 100644
--- a/libraries/DisplayResults.php
+++ b/libraries/DisplayResults.php
@@ -1023,7 +1023,7 @@ class DisplayResults
             . '<input type="hidden" name="is_browse_distinct" value="'
             . $this->__get('is_browse_distinct') . '" />'
             . '<input type="hidden" name="session_max_rows" value="'
-            . (! $showing_all ? 'all' : $GLOBALS['cfg']['MaxRows']) . '" />'
+            . (! $showing_all ? 'all' : intval($GLOBALS['cfg']['MaxRows'])) . '" />'
             . '<input type="hidden" name="goto" value="' . $this->__get('goto')
             . '" />'
             . '<input type="checkbox" name="navig"'
@@ -4094,7 +4094,7 @@ class DisplayResults
             $query['max_rows'] = self::ALL_ROWS;
             unset($_REQUEST['session_max_rows']);
         } elseif (empty($query['max_rows'])) {
-            $query['max_rows'] = $GLOBALS['cfg']['MaxRows'];
+            $query['max_rows'] = intval($GLOBALS['cfg']['MaxRows']);
         }
 
         if (PMA_isValid($_REQUEST['pos'], 'numeric')) {
diff --git a/libraries/browse_foreigners.lib.php b/libraries/browse_foreigners.lib.php
index 5d7be5946b..b83296d581 100644
--- a/libraries/browse_foreigners.lib.php
+++ b/libraries/browse_foreigners.lib.php
@@ -341,5 +341,5 @@ function PMA_getForeignLimit($foreign_showAll)
         return null;
     }
     isset($_REQUEST['pos']) ? $pos = $_REQUEST['pos'] : $pos = 0;
-    return 'LIMIT ' . $pos . ', ' . $GLOBALS['cfg']['MaxRows'] . ' ';
+    return 'LIMIT ' . $pos . ', ' . intval($GLOBALS['cfg']['MaxRows']) . ' ';
 }
diff --git a/libraries/controllers/server/ServerBinlogController.php b/libraries/controllers/server/ServerBinlogController.php
index 626fb6179e..c1165ec526 100644
--- a/libraries/controllers/server/ServerBinlogController.php
+++ b/libraries/controllers/server/ServerBinlogController.php
@@ -112,7 +112,7 @@ class ServerBinlogController extends Controller
         if (! empty($_REQUEST['log'])) {
             $sql_query .= ' IN \'' . $_REQUEST['log'] . '\'';
         }
-        $sql_query .= ' LIMIT ' . $pos . ', ' . (int) $GLOBALS['cfg']['MaxRows'];
+        $sql_query .= ' LIMIT ' . $pos . ', ' . intval($GLOBALS['cfg']['MaxRows']);
 
         /**
          * Sends the query
@@ -259,4 +259,4 @@ class ServerBinlogController extends Controller
         }
         return $html;
     }
-}
\ No newline at end of file
+}
diff --git a/libraries/plugins/AuthenticationPlugin.php b/libraries/plugins/AuthenticationPlugin.php
index d6753dd637..33f83f4a63 100644
--- a/libraries/plugins/AuthenticationPlugin.php
+++ b/libraries/plugins/AuthenticationPlugin.php
@@ -109,7 +109,7 @@ abstract class AuthenticationPlugin
         } elseif (!empty($GLOBALS['no_activity'])) {
             return sprintf(
                 __('No activity within %s seconds; please log in again.'),
-                $GLOBALS['cfg']['LoginCookieValidity']
+                intval($GLOBALS['cfg']['LoginCookieValidity'])
             );
         } else {
             $dbi_error = $GLOBALS['dbi']->getError();
diff --git a/libraries/plugins/auth/AuthenticationCookie.php b/libraries/plugins/auth/AuthenticationCookie.php
index c77dc0f238..0cb425ae95 100644
--- a/libraries/plugins/auth/AuthenticationCookie.php
+++ b/libraries/plugins/auth/AuthenticationCookie.php
@@ -207,7 +207,7 @@ class AuthenticationCookie extends AuthenticationPlugin
             echo '<script src="https://www.google.com/recaptcha/api.js?hl='
                 , $GLOBALS['lang'] , '" async defer></script>';
             echo '<div class="g-recaptcha" data-sitekey="'
-                , $GLOBALS['cfg']['CaptchaLoginPublicKey'] , '"></div>';
+                , htmlspecialchars($GLOBALS['cfg']['CaptchaLoginPublicKey']) , '"></div>';
         }
 
         echo '</fieldset>
diff --git a/templates/columns_definitions/column_name.phtml b/templates/columns_definitions/column_name.phtml
index 6d64b2effc..9659679f8b 100644
--- a/templates/columns_definitions/column_name.phtml
+++ b/templates/columns_definitions/column_name.phtml
@@ -37,10 +37,10 @@ if (empty($title)) {
 ): ?>
     <p style="font-size:80%;margin:5px 2px"
        id="central_columns_<?= $columnNumber; ?>_<?= ($ci - $ci_offset); ?>">
-        <a data-maxrows="<?= $GLOBALS['cfg']['MaxRows']; ?>"
+        <a data-maxrows="<?= intval($GLOBALS['cfg']['MaxRows']); ?>"
            href="#"
            class="central_columns_dialog">
             <?= __('Pick from Central Columns'); ?>
         </a>
     </p>
-<?php endif; ?>
\ No newline at end of file
+<?php endif; ?>
diff --git a/templates/table/search/options.phtml b/templates/table/search/options.phtml
index f673459f64..89908c0e24 100644
--- a/templates/table/search/options.phtml
+++ b/templates/table/search/options.phtml
@@ -47,7 +47,7 @@
            name="session_max_rows"
            required="required"
            min="1"
-           value="<?= $GLOBALS['cfg']['MaxRows']; ?>"
+           value="<?= intval($GLOBALS['cfg']['MaxRows']); ?>"
            class="textfield" />
 </fieldset>
 
@@ -75,4 +75,4 @@
     ); ?>
 
 </fieldset>
-<br style="clear: both;" />
\ No newline at end of file
+<br style="clear: both;" />
diff --git a/templates/table/search/options_zoom.phtml b/templates/table/search/options_zoom.phtml
index 4304e78050..d288db040d 100644
--- a/templates/table/search/options_zoom.phtml
+++ b/templates/table/search/options_zoom.phtml
@@ -41,8 +41,8 @@
                    id="maxRowPlotLimit"
                    required="required"
                    value="<?= ((! empty($_POST['maxPlotLimit']))
-                       ? htmlspecialchars($_POST['maxPlotLimit'])
-                       : $GLOBALS['cfg']['maxRowPlotLimit']); ?>" />
+                       ? intval($_POST['maxPlotLimit'])
+                       : intval($GLOBALS['cfg']['maxRowPlotLimit'])); ?>" />
         </td>
     </tr>
-</table>
\ No newline at end of file
+</table>