From fea1d39fef540afa4105c6fbcc849f7e516f3da8 Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Tue, 12 May 2015 19:56:53 +0530 Subject: [PATCH] bug #4899 [security] CSRF vulnerability in setup Signed-off-by: Madhura Jayaratne --- ChangeLog | 3 +++ libraries/url_generating.lib.php | 1 + setup/frames/form.inc.php | 4 ++-- setup/frames/index.inc.php | 4 ++-- setup/frames/menu.inc.php | 14 +++++++------- setup/frames/servers.inc.php | 4 ++-- setup/index.php | 4 ++-- setup/lib/form_processing.lib.php | 14 +++++++------- setup/validate.php | 6 ++++-- 9 files changed, 30 insertions(+), 24 deletions(-) diff --git a/ChangeLog b/ChangeLog index c8c7e67535..40b913d86b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,9 @@ phpMyAdmin - ChangeLog ====================== +4.0.10.10 (Not yet released) +- bug #4899 [security] CSRF vulnerability in setup + 4.0.10.9 (2015-03-04) - bug [security] Risk of BREACH attack, see PMASA-2015-1 diff --git a/libraries/url_generating.lib.php b/libraries/url_generating.lib.php index e995710052..a739087524 100644 --- a/libraries/url_generating.lib.php +++ b/libraries/url_generating.lib.php @@ -228,6 +228,7 @@ function PMA_generate_common_url() if (isset($GLOBALS['server']) && $GLOBALS['server'] != $GLOBALS['cfg']['ServerDefault'] && ! isset($params['server']) + && ! defined('PMA_SETUP') ) { $params['server'] = $GLOBALS['server']; } diff --git a/setup/frames/form.inc.php b/setup/frames/form.inc.php index cf188eb2b0..fc498efa1f 100644 --- a/setup/frames/form.inc.php +++ b/setup/frames/form.inc.php @@ -19,8 +19,8 @@ require_once './setup/lib/form_processing.lib.php'; require './libraries/config/setup.forms.php'; -$formset_id = filter_input(INPUT_GET, 'formset'); -$mode = filter_input(INPUT_GET, 'mode'); +$formset_id = isset($_GET['formset']) ? $_GET['formset'] : null; +$mode = isset($_GET['mode']) ? $_GET['mode'] : null; if (! isset($forms[$formset_id])) { PMA_fatalError(__('Incorrect formset, check $formsets array in setup/frames/form.inc.php')); } diff --git a/setup/frames/index.inc.php b/setup/frames/index.inc.php index ddc6af5265..68624497ea 100644 --- a/setup/frames/index.inc.php +++ b/setup/frames/index.inc.php @@ -144,8 +144,8 @@ PMA_displayFormTop( getServerDSN($id)) ?> - "> - | "> + "> + | "> diff --git a/setup/frames/menu.inc.php b/setup/frames/menu.inc.php index 69563a243b..80edd40c44 100644 --- a/setup/frames/menu.inc.php +++ b/setup/frames/menu.inc.php @@ -13,11 +13,11 @@ if (!defined('PHPMYADMIN')) { $separator = PMA_get_arg_separator('html'); ?> diff --git a/setup/frames/servers.inc.php b/setup/frames/servers.inc.php index d28a17d389..c7cc6fa34b 100644 --- a/setup/frames/servers.inc.php +++ b/setup/frames/servers.inc.php @@ -19,8 +19,8 @@ require_once './setup/lib/form_processing.lib.php'; require './libraries/config/setup.forms.php'; -$mode = filter_input(INPUT_GET, 'mode'); -$id = filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT); +$mode = isset($_GET['mode']) ? $_GET['mode'] : null; +$id = PMA_isValid($_GET['id'], 'numeric') ? $_GET['id'] : null; $cf = ConfigFile::getInstance(); $server_exists = !empty($id) && $cf->get("Servers/$id") !== null; diff --git a/setup/index.php b/setup/index.php index 373825b40e..5234cccd30 100644 --- a/setup/index.php +++ b/setup/index.php @@ -12,7 +12,7 @@ */ require './lib/common.inc.php'; -$page = filter_input(INPUT_GET, 'page'); +$page = isset($_GET['page']) ? $_GET['page'] : null; $page = preg_replace('/[^a-z]/', '', $page); if ($page === '') { $page = 'index'; @@ -23,7 +23,7 @@ if (!file_exists("./setup/frames/$page.inc.php")) { } // Handle done action info -$action_done = filter_input(INPUT_GET, 'action_done'); +$action_done = isset($_GET['action_done']) ? $_GET['action_done'] : null; $action_done = preg_replace('/[^a-z_]/', '', $action_done); PMA_noCacheHeader(); diff --git a/setup/lib/form_processing.lib.php b/setup/lib/form_processing.lib.php index d9b6e6aea3..eb5202bc74 100644 --- a/setup/lib/form_processing.lib.php +++ b/setup/lib/form_processing.lib.php @@ -15,7 +15,7 @@ */ function process_formset(FormDisplay $form_display) { - if (filter_input(INPUT_GET, 'mode') == 'revert') { + if (isset($_GET['mode']) && $_GET['mode'] == 'revert') { // revert erroneous fields to their default values $form_display->fixErrors(); // drop post data @@ -31,10 +31,10 @@ function process_formset(FormDisplay $form_display) if ($form_display->hasErrors()) { // form has errors, show warning $separator = PMA_get_arg_separator('html'); - $page = filter_input(INPUT_GET, 'page'); - $formset = filter_input(INPUT_GET, 'formset'); + $page = isset($_GET['page']) ? $_GET['page'] : null; + $formset = isset($_GET['formset']) ? $_GET['formset'] : null; $formset = $formset ? "{$separator}formset=$formset" : ''; - $id = filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT); + $id = PMA_isValid($_GET['id'], 'numeric') ? $_GET['id'] : null; if ($id === null && $page == 'servers') { // we've just added a new server, get it's id $id = ConfigFile::getInstance()->getServerCount(); @@ -44,12 +44,12 @@ function process_formset(FormDisplay $form_display)


- +
displayErrors() ?> - +   - +