Hi,
----- Original Message -----
From: Herman van Rink rink@initfour.nl
Dear students/developers,
Below is a small example of new code that has a vulnerability. Please lookout for places where you use ANY data that comes from the user, either through the web or through a database. In this case a table name. Luckily this has not yet been included in a release...
diff --git a/libraries/RecentTable.class.php b/libraries/RecentTable.class.php index f844bbc..bfb6081 100644 --- a/libraries/RecentTable.class.php +++ b/libraries/RecentTable.class.php @@ -142,7 +142,7 @@ class PMA_RecentTable $html = '<option value="">(' . __('Recent tables') . ') ...</option>'; if (count($this->tables)) { foreach ($this->tables as $table) { - $html .= '<option value="' . $table . '">' . $table . '</option>'; + $html .= '<option value="' . htmlspecialchars($table) . '">' . htmlspecialchars($table) . '</option>'; } } else { $html .= '<option value="">' . __('There are no recent tables') . '</option>'; @@ -158,7 +158,7 @@ class PMA_RecentTable public function getHtmlSelect() { $html = '<input type="hidden" name="goto" id="LeftDefaultTabTable" value="' . - $GLOBALS['cfg']['LeftDefaultTabTable'] . '" />'; + htmlspecialchars($GLOBALS['cfg']['LeftDefaultTabTable']) . '" />'; $html .= '<select name="table" id="recentTable">'; $html .= $this->getHtmlSelectOption(); $html .= '</select>';
Thanks for fixing this. I'll remember it next time.
-- Aris Feryanto