From 3bd0971db7da6d5f8f7127562261302ce16b6d16 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Fri, 22 Jan 2016 09:42:54 +0100 Subject: [PATCH] Validate version information before further processing it Do basic sanity checking before we return the value further. This can especially happen in case the curl/allow_url_fopen is missing. Fixes #11874 --- ChangeLog | 1 + libraries/VersionInformation.php | 16 +++++++++++----- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/ChangeLog b/ChangeLog index a827292689..743183a2f7 100644 --- a/ChangeLog +++ b/ChangeLog @@ -4,6 +4,7 @@ phpMyAdmin - ChangeLog 4.5.5.0 (not yet released) - issue Undefined index: is_ajax_request - issue #11855 Fix password change on MariaDB 10.1 and newer +- issue #11874 Validate version information before further processing it 4.5.4.0 (not yet released) - issue #11724 live data edit of big sets is not working diff --git a/libraries/VersionInformation.php b/libraries/VersionInformation.php index e889b9c683..3821c7c834 100644 --- a/libraries/VersionInformation.php +++ b/libraries/VersionInformation.php @@ -87,13 +87,19 @@ class VersionInformation } } + /* Parse response */ $data = json_decode($response); - if (is_object($data) - && ! empty($data->version) - && ! empty($data->releases) - && ! empty($data->date) - && $save + + /* Basic sanity checking */ + if (! is_object($data) + || empty($data->version) + || empty($data->releases) + || empty($data->date) ) { + return null; + } + + if ($save) { if (! isset($_SESSION) && ! defined('TESTSUITE')) { ini_set('session.use_only_cookies', 'false'); ini_set('session.use_cookies', 'false');