Merge remote-tracking branch 'origin/master'

ChangeLog

@@ -67,7 +67,7 @@ phpMyAdmin - ChangeLog
 - bug #4391 Upgraded to 4.2.0, insanely slow now
 + rfe #1537 PHP OpenSSL support for cookie encryption/decryption
 
-4.2.12.0 (not yet released)
+4.2.12.0 (2014-11-20)
 - bug #4574 Blank/white page when JavaScript disabled
 - bug #4577 Multi row actions cause full page reloads
 - bug       ReferenceError: targeturl is not defined
@@ -80,6 +80,13 @@ phpMyAdmin - ChangeLog
 - bug #4602 Exporting selected rows exports all rows of the query
 - bug #4444 No insert statement produced in SQL export for queries with alias
 - bug #4603 Field disabled when internal relations used
+- bug #4596 [security] XSS through exception stack
+- bug #4595 [security] Path traversal can lead to leakage of line count
+- bug #4578 [security] XSS vulnerability in table print view
+- bug #4579 [security] XSS vulnerability in zoom search page
+- bug #4594 [security] Path traversal in file inclusion of GIS factory
+- bug #4598 [security] XSS in multi submit
+- bug #4597 [security] XSS through pma_fontsize cookie
 
 4.2.11.0 (2014-10-31)
 - bug       ReferenceError: Table_onover is not defined

libraries/Config.class.php

@@ -1770,7 +1770,7 @@ class PMA_Config
         // for the case when there is no config file (this is supported)
         if (empty($current_size)) {
             if (isset($_COOKIE['pma_fontsize'])) {
-                $current_size = $_COOKIE['pma_fontsize'];
+                $current_size = htmlspecialchars($_COOKIE['pma_fontsize']);
             } else {
                 $current_size = '82%';
             }

libraries/Theme.class.php

@@ -434,7 +434,7 @@ class PMA_Theme
             return $fs;
         }
         if (isset($_COOKIE['pma_fontsize'])) {
-            return $_COOKIE['pma_fontsize'];
+            return htmlspecialchars($_COOKIE['pma_fontsize']);
         }
         return '82%';
     }

libraries/error_report.lib.php

@@ -237,6 +237,19 @@ function PMA_countLines($filename)
         return $LINE_COUNT[$filename];
     }
 
+    // ensure that the file is inside the phpMyAdmin folder
+    $depath = 1;
+    foreach (explode('/', $filename) as $part) {
+        if ($part == '..') {
+            $depath--;
+        } elseif ($part != '.') {
+            $depath++;
+        }
+        if ($depath < 0) {
+            return 0;
+        }
+    }
+
     $linecount = 0;
     $handle = fopen('./js/' . $filename, 'r');
     while (!feof($handle)) {
@@ -342,7 +355,7 @@ function PMA_getErrorReportForm()
             . __('You may examine the data in the error report:')
             . '</p></label></div>'
             . '<pre class="report-data">'
-            . PMA_getPrettyReportData()
+            . htmlspecialchars(PMA_getPrettyReportData())
             . '</pre>';
 
     $html .= '<div class="label"><label><p>'

libraries/gis/GIS_Factory.class.php

@@ -32,9 +32,10 @@ class PMA_GIS_Factory
     {
         include_once './libraries/gis/GIS_Geometry.class.php';
 
-        $file = './libraries/gis/GIS_'
-            . ucfirst(/*overload*/mb_strtolower($type)) . '.class.php';
-        if (! file_exists($file)) {
+        $type_lower = strtolower($type);
+        if (! PMA_isValid($type_lower, PMA_Util::getGISDatatypes())
+            || ! file_exists('./libraries/gis/GIS_' . ucfirst($type_lower) . '.class.php')
+        ) {
             return false;
         }
         if (include_once $file) {

libraries/mult_submits.lib.php

@@ -571,13 +571,14 @@ function PMA_getQueryFromSelected($what, $db, $table, $selected, $views)
     foreach ($selected as $sval) {
         switch ($what) {
         case 'row_delete':
-            $full_query .= 'DELETE FROM ' . PMA_Util::backquote($db)
-                . '.' . PMA_Util::backquote($table)
+            $full_query .= 'DELETE FROM '
+                . PMA_Util::backquote(htmlspecialchars($db))
+                . '.' . PMA_Util::backquote(htmlspecialchars($table))
                 // Do not append a "LIMIT 1" clause here
                 // (it's not binlog friendly).
                 // We don't need the clause because the calling panel permits
                 // this feature only when there is a unique index.
-                . ' WHERE ' . urldecode($sval)
+                . ' WHERE ' . urldecode(htmlspecialchars($sval))
                 . ';<br />';
             break;
         case 'drop_db':

libraries/tbl_printview.lib.php

@@ -107,7 +107,7 @@ function PMA_getHtmlForPrintViewColumns(
         }
         $html .= "\n";
         $html .= '</td>';
-        $html .= '<td>' . $type . '<bdo dir="ltr"></bdo></td>';
+        $html .= '<td>' . htmlspecialchars($type) . '<bdo dir="ltr"></bdo></td>';
         $html .= '<td>';
         $html .= (($row['Null'] == '' || $row['Null'] == 'NO')
             ? __('No')

tbl_zoom_select.php

@@ -81,7 +81,7 @@ if (isset($_REQUEST['change_tbl_info']) && $_REQUEST['change_tbl_info'] == true)
     }
     $key = array_search($field, $table_search->getColumnNames());
     $properties = $table_search->getColumnProperties($_REQUEST['it'], $key);
-    $response->addJSON('field_type', $properties['type']);
+    $response->addJSON('field_type', htmlspecialchars($properties['type']));
     $response->addJSON('field_collation', $properties['collation']);
     $response->addJSON('field_operators', $properties['func']);
     $response->addJSON('field_value', $properties['value']);