September 2011 - Git - lists.phpmyadmin.net

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_5RC1-18576-geeeba84
by Madhura Jayaratne 10 Sep '11

10 Sep '11

The branch, master has been updated via eeeba849c37de3932fc6ecee5958901cfbc07cb0 (commit) from a67e233fa7b97223f23e66cf6758505b173612b5 (commit) - Log ----------------------------------------------------------------- commit eeeba849c37de3932fc6ecee5958901cfbc07cb0 Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: Sat Sep 10 11:28:02 2011 +0530 Fix for bug #3403165 for 3.5 branch ----------------------------------------------------------------------- Summary of changes: tbl_structure.php | 18 ++++++++++-------- 1 files changed, 10 insertions(+), 8 deletions(-) diff --git a/tbl_structure.php b/tbl_structure.php index c7c0c25..1577111 100644 --- a/tbl_structure.php +++ b/tbl_structure.php @@ -260,19 +260,21 @@ foreach ($fields as $row) { // for the case ENUM('–','“') $type = htmlspecialchars($type); // in case it is too long + $start = 0; if (strlen($type) > $GLOBALS['cfg']['LimitChars']) { + $start = 13; $type = '<abbr title="' . $type . '">' . substr($type, 0, $GLOBALS['cfg']['LimitChars']) . '</abbr>'; } unset($field_charset); - if ((substr($type, 0, 4) == 'char' - || substr($type, 0, 7) == 'varchar' - || substr($type, 0, 4) == 'text' - || substr($type, 0, 8) == 'tinytext' - || substr($type, 0, 10) == 'mediumtext' - || substr($type, 0, 8) == 'longtext' - || substr($type, 0, 3) == 'set' - || substr($type, 0, 4) == 'enum') + if ((substr($type, $start, 4) == 'char' + || substr($type, $start, 7) == 'varchar' + || substr($type, $start, 4) == 'text' + || substr($type, $start, 8) == 'tinytext' + || substr($type, $start, 10) == 'mediumtext' + || substr($type, $start, 8) == 'longtext' + || substr($type, $start, 3) == 'set' + || substr($type, $start, 4) == 'enum') && !$extracted_fieldspec['binary'] ) { if (strpos($type, ' character set ')) { hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_5RC1-18575-ga67e233
by Madhura Jayaratne 10 Sep '11

10 Sep '11

The branch, master has been updated via a67e233fa7b97223f23e66cf6758505b173612b5 (commit) via 5a82da9ad352dede10c4b78cafb055a246e7af5f (commit) via 4232fcd458b70913a08240897cde0073c6e78959 (commit) from 9d4e9efe4bafbc60a82a02b1cc27d66f150dbc9d (commit) - Log ----------------------------------------------------------------- commit a67e233fa7b97223f23e66cf6758505b173612b5 Merge: 9d4e9ef 5a82da9 Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: Sat Sep 10 11:13:49 2011 +0530 Merge branch 'QA_3_4' Conflicts: tbl_structure.php ----------------------------------------------------------------------- Summary of changes: ChangeLog | 1 + tbl_structure.php | 5 +++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index b76d296..e78cf44 100644 --- a/ChangeLog +++ b/ChangeLog @@ -52,6 +52,7 @@ phpMyAdmin - ChangeLog 3.4.6.0 (not yet released) - patch #3404173 InnoDB comment display with tooltips/aliases - bug #3404886 [navi] Edit SQL statement after error +- bug #3403165 [interface] Collation not displayed for long enum fields 3.4.5.0 (not yet released) - bug #3375325 [interface] Page list in navigation frame looks odd diff --git a/tbl_structure.php b/tbl_structure.php index e86636c..c7c0c25 100644 --- a/tbl_structure.php +++ b/tbl_structure.php @@ -272,8 +272,9 @@ foreach ($fields as $row) { || substr($type, 0, 10) == 'mediumtext' || substr($type, 0, 8) == 'longtext' || substr($type, 0, 3) == 'set' - || substr($type, 0, 4) == 'enum' - ) && !$extracted_fieldspec['binary']) { + || substr($type, 0, 4) == 'enum') + && !$extracted_fieldspec['binary'] + ) { if (strpos($type, ' character set ')) { $type = substr($type, 0, strpos($type, ' character set ')); } hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_4, updated. RELEASE_3_4_5RC1-8-g5a82da9
by Madhura Jayaratne 10 Sep '11

10 Sep '11

The branch, QA_3_4 has been updated via 5a82da9ad352dede10c4b78cafb055a246e7af5f (commit) via 4232fcd458b70913a08240897cde0073c6e78959 (commit) from 7e7e55b953b63b1f44bc64f636b564a5c754fcda (commit) - Log ----------------------------------------------------------------- commit 5a82da9ad352dede10c4b78cafb055a246e7af5f Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: Sat Sep 10 10:49:44 2011 +0530 Coding style commit 4232fcd458b70913a08240897cde0073c6e78959 Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: Sat Sep 10 10:47:37 2011 +0530 bug #3403165 [interface] Collation not displayed for long enum fields ----------------------------------------------------------------------- Summary of changes: ChangeLog | 1 + tbl_structure.php | 6 +++++- 2 files changed, 6 insertions(+), 1 deletions(-) diff --git a/ChangeLog b/ChangeLog index 7566511..9949461 100644 --- a/ChangeLog +++ b/ChangeLog @@ -4,6 +4,7 @@ phpMyAdmin - ChangeLog 3.4.6.0 (not yet released) - patch #3404173 InnoDB comment display with tooltips/aliases - bug #3404886 [navi] Edit SQL statement after error +- bug #3403165 [interface] Collation not displayed for long enum fields 3.4.5.0 (not yet released) - bug #3375325 [interface] Page list in navigation frame looks odd diff --git a/tbl_structure.php b/tbl_structure.php index 4c0b185..246bd0e 100644 --- a/tbl_structure.php +++ b/tbl_structure.php @@ -245,6 +245,7 @@ while ($row = PMA_DBI_fetch_assoc($fields_rs)) { $type = $row['Type']; $extracted_fieldspec = PMA_extractFieldSpec($row['Type']); + $truncated = false; if ('set' == $extracted_fieldspec['type'] || 'enum' == $extracted_fieldspec['type']) { $type = $extracted_fieldspec['type'] . '(' . str_replace("','", "', '", $extracted_fieldspec['spec_in_brackets']) . ')'; @@ -252,6 +253,7 @@ while ($row = PMA_DBI_fetch_assoc($fields_rs)) { // for the case ENUM('–','“') $type = htmlspecialchars($type); if(strlen($type) > $GLOBALS['cfg']['LimitChars']) { + $truncated = true; $type = '<abbr title="' . $type . '">' . substr($type, 0, $GLOBALS['cfg']['LimitChars']) . '</abbr>'; } @@ -292,7 +294,9 @@ while ($row = PMA_DBI_fetch_assoc($fields_rs)) { || substr($type, 0, 8) == 'longtext' || substr($type, 0, 3) == 'set' || substr($type, 0, 4) == 'enum' - ) && !$binary) { + || ($truncated && substr($type, 13, 4) == 'enum')) + && !$binary + ) { if (strpos($type, ' character set ')) { $type = substr($type, 0, strpos($type, ' character set ')); } hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_5RC1-18572-g9d4e9ef
by Madhura Jayaratne 10 Sep '11

10 Sep '11

The branch, master has been updated via 9d4e9efe4bafbc60a82a02b1cc27d66f150dbc9d (commit) via 7e7e55b953b63b1f44bc64f636b564a5c754fcda (commit) from 68cb87a81829581e7457c4a8a6fe6b85ef663834 (commit) - Log ----------------------------------------------------------------- commit 9d4e9efe4bafbc60a82a02b1cc27d66f150dbc9d Merge: 68cb87a 7e7e55b Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: Sat Sep 10 08:47:35 2011 +0530 Merge branch 'QA_3_4' ----------------------------------------------------------------------- Summary of changes: ChangeLog | 1 + libraries/common.lib.php | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 01d1357..b76d296 100644 --- a/ChangeLog +++ b/ChangeLog @@ -51,6 +51,7 @@ phpMyAdmin - ChangeLog 3.4.6.0 (not yet released) - patch #3404173 InnoDB comment display with tooltips/aliases +- bug #3404886 [navi] Edit SQL statement after error 3.4.5.0 (not yet released) - bug #3375325 [interface] Page list in navigation frame looks odd diff --git a/libraries/common.lib.php b/libraries/common.lib.php index dc7d152..b65405b 100644 --- a/libraries/common.lib.php +++ b/libraries/common.lib.php @@ -578,12 +578,12 @@ $is_modify_link = true, $back_url = '', $exit = true) if (strlen($table)) { $_url_params['db'] = $db; $_url_params['table'] = $table; - $doedit_goto = '<a href="tbl_sql.php?' . PMA_generate_common_url($_url_params) . '">'; + $doedit_goto = '<a href="tbl_sql.php' . PMA_generate_common_url($_url_params) . '">'; } elseif (strlen($db)) { $_url_params['db'] = $db; - $doedit_goto = '<a href="db_sql.php?' . PMA_generate_common_url($_url_params) . '">'; + $doedit_goto = '<a href="db_sql.php' . PMA_generate_common_url($_url_params) . '">'; } else { - $doedit_goto = '<a href="server_sql.php?' . PMA_generate_common_url($_url_params) . '">'; + $doedit_goto = '<a href="server_sql.php' . PMA_generate_common_url($_url_params) . '">'; } $error_msg_output .= $doedit_goto hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_4, updated. RELEASE_3_4_5RC1-6-g7e7e55b
by Madhura Jayaratne 10 Sep '11

10 Sep '11

The branch, QA_3_4 has been updated via 7e7e55b953b63b1f44bc64f636b564a5c754fcda (commit) from c5a641961861f3e82b282582c1b86222d73409bf (commit) - Log ----------------------------------------------------------------- commit 7e7e55b953b63b1f44bc64f636b564a5c754fcda Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: Sat Sep 10 08:43:13 2011 +0530 bug #3404886 [navi] Edit SQL statement after error ----------------------------------------------------------------------- Summary of changes: ChangeLog | 1 + libraries/common.lib.php | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 94d28fa..7566511 100644 --- a/ChangeLog +++ b/ChangeLog @@ -3,6 +3,7 @@ phpMyAdmin - ChangeLog 3.4.6.0 (not yet released) - patch #3404173 InnoDB comment display with tooltips/aliases +- bug #3404886 [navi] Edit SQL statement after error 3.4.5.0 (not yet released) - bug #3375325 [interface] Page list in navigation frame looks odd diff --git a/libraries/common.lib.php b/libraries/common.lib.php index 5b353ec..ad38266 100644 --- a/libraries/common.lib.php +++ b/libraries/common.lib.php @@ -614,12 +614,12 @@ function PMA_mysqlDie($error_message = '', $the_query = '', if (strlen($table)) { $_url_params['db'] = $db; $_url_params['table'] = $table; - $doedit_goto = '<a href="tbl_sql.php?' . PMA_generate_common_url($_url_params) . '">'; + $doedit_goto = '<a href="tbl_sql.php' . PMA_generate_common_url($_url_params) . '">'; } elseif (strlen($db)) { $_url_params['db'] = $db; - $doedit_goto = '<a href="db_sql.php?' . PMA_generate_common_url($_url_params) . '">'; + $doedit_goto = '<a href="db_sql.php' . PMA_generate_common_url($_url_params) . '">'; } else { - $doedit_goto = '<a href="server_sql.php?' . PMA_generate_common_url($_url_params) . '">'; + $doedit_goto = '<a href="server_sql.php' . PMA_generate_common_url($_url_params) . '">'; } $error_msg_output .= $doedit_goto hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_5RC1-18570-g68cb87a
by Marc Delisle 09 Sep '11

09 Sep '11

The branch, master has been updated via 68cb87a81829581e7457c4a8a6fe6b85ef663834 (commit) from 85fc658f3146d245d88d29085f98c62e686eee13 (commit) - Log ----------------------------------------------------------------- commit 68cb87a81829581e7457c4a8a6fe6b85ef663834 Author: Marc Delisle <marc(a)infomarc.info> Date: Fri Sep 9 13:12:24 2011 -0400 Escape HTML in column names and values before json_encode() ----------------------------------------------------------------------- Summary of changes: tbl_chart.php | 15 +++++++++++++-- 1 files changed, 13 insertions(+), 2 deletions(-) diff --git a/tbl_chart.php b/tbl_chart.php index 8caa38e..43de351 100644 --- a/tbl_chart.php +++ b/tbl_chart.php @@ -130,14 +130,25 @@ url_query = '<?php echo $url_query;?>'; </div> <div style="float:left; padding-left:40px;"> <?php echo __('X-Axis label:'); ?> <input style="margin-top:0;" type="text" name="xaxis_label" - value="<?php echo ($yaxis == -1) ? __('X Values') : $keys[$yaxis]; ?>"><br /> + value="<?php echo ($yaxis == -1) ? __('X Values') : htmlspecialchars($keys[$yaxis]); ?>"><br /> <?php echo __('Y-Axis label:'); ?> <input type="text" name="yaxis_label" value="<?php echo __('Y Values'); ?>"> </div> <p style="clear:both;"> </p> <div id="resizer" style="width:600px; height:400px;"> <div id="inner-resizer"> <div id="querychart" style="display:none;"> - <?php echo json_encode($data); ?> +<?php +$sanitized_data = array(); +foreach ($data as $data_row_number => $data_row) { + $tmp_row = array(); + foreach ($data_row as $data_column => $data_value) { + $tmp_row[htmlspecialchars($data_column)] = htmlspecialchars($data_value); + } + $sanitized_data[] = $tmp_row; +} +echo json_encode($sanitized_data); +unset($sanitized_data); +?> </div> </div> </div> hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin annotated tag, RELEASE_3_4_5RC1, created. RELEASE_3_4_5RC1
by Marc Delisle 08 Sep '11

08 Sep '11

The annotated tag, RELEASE_3_4_5RC1 has been created at 70256bd9e20353b292c05602908f7bdeeff3a888 (tag) tagging bda213c58aec44925be661acb0e76c19483ea170 (commit) replaces RELEASE_3_4_4 tagged by Marc Delisle on Thu Sep 8 16:00:40 2011 -0400 - Log ----------------------------------------------------------------- Released 3.4.5-rc1 Dieter Adriaenssens (2): Remove library PHPExcel, due to license issues remove another mention of Excel export Herman van Rink (1): [security] Fixed XSS in Inline Edit on save action Madhura Jayaratne (5): bug #3313235 [interface] Error div misplaced Changelog entry for bug #3383711. Some formatting Documentation about suhosin.get.max_value_length limitation Typo Sanitize filenames (in a unified manner) before using in Content-Disposition header Marc Delisle (8): 3.4.3.2 release 3.4.5 started 3.4.5-dev bug #3392920 [edit] BLOB emptied after editing another column Merge branch 'MAINT_3_4_4' into QA_3_4 ChangeLog and 3.4.4 XSS fix Preparing 3.4.5-rc1 Escape HTML in js-generated confirmation messages Michal Čihař (18): Update from master Update from master Translations from master Add missing space (bug#3386434) Changelog entry Update translations from master Merge remote-tracking branch 'origin/MAINT_3_4_3' into QA_3_4 Update translations from master This is already done Escape displayed user input Missing escaping More of missing escaping Revert "More of missing escaping" Revert "Revert "More of missing escaping"" Do not escape field here, it is used as index to vairous arrays Merge remote-tracking branch 'origin/MAINT_3_4_4' into QA_3_4 Update translations from master Avoid loading themes from non directories, . and .. Rouslan Placella (2): Fixed bug #3375325 - Page list in navigation frame looks odd Fixed bug #3374802 - Comment on a column breaks inline editing Sven Strickroth (1): quick fix for issue #3383711 ----------------------------------------------------------------------- hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_4-18606-g85fc658
by Marc Delisle 08 Sep '11

08 Sep '11

The branch, master has been updated via 85fc658f3146d245d88d29085f98c62e686eee13 (commit) via b0ef11932a56b413cfb7accc69fc1e83ea051196 (commit) via c5a641961861f3e82b282582c1b86222d73409bf (commit) via bda213c58aec44925be661acb0e76c19483ea170 (commit) via 2f28ce9c800274190418da0945ce3647d36e1db6 (commit) via 4039683ab3ca63c979948e02345b6d38452f8dee (commit) from d6303215118e73062ac3749f893ab9630a948816 (commit) - Log ----------------------------------------------------------------- commit 85fc658f3146d245d88d29085f98c62e686eee13 Author: Marc Delisle <marc(a)infomarc.info> Date: Thu Sep 8 15:54:36 2011 -0400 Missing function after merging commit b0ef11932a56b413cfb7accc69fc1e83ea051196 Merge: d630321 c5a6419 Author: Marc Delisle <marc(a)infomarc.info> Date: Thu Sep 8 15:44:07 2011 -0400 Merge branch 'QA_3_4' ----------------------------------------------------------------------- Summary of changes: ChangeLog | 2 ++ js/functions.js | 16 ++++++++++++++-- js/tbl_structure.js | 4 ++-- 3 files changed, 18 insertions(+), 4 deletions(-) diff --git a/ChangeLog b/ChangeLog index c22bfe9..01d1357 100644 --- a/ChangeLog +++ b/ChangeLog @@ -62,6 +62,8 @@ phpMyAdmin - ChangeLog - [export] Remove native Excel export modules (xls and xlsx formats) - [import] Remove native Excel import modules (xls and xlsx formats) - bug #3392920 [edit] BLOB emptied after editing another column +- [security] Fixed XSS in Inline Edit on save action, see PMASA-2011-14 +- [security] Fixed XSS with db/table/column names, see PMASA-2011-14 3.4.4.0 (2011-08-24) - bug #3323060 [parser] SQL parser breaks AJAX requests if query has unclosed quotes diff --git a/js/functions.js b/js/functions.js index c63a3d0..b27dcc4 100644 --- a/js/functions.js +++ b/js/functions.js @@ -199,7 +199,7 @@ function selectContent( element, lock, only_once ) } /** - * Displays a confirmation box before to submit a "DROP/DELETE/ALTER" query. + * Displays a confirmation box before submitting a "DROP/DELETE/ALTER" query. * This function is called while clicking links * * @param object the link @@ -2246,7 +2246,7 @@ $(document).ready(function() { /** * @var question String containing the question to be asked for confirmation */ - var question = PMA_messages['strDropDatabaseStrongWarning'] + '\n' + PMA_messages['strDoYouReally'] + ' :\n' + 'DROP DATABASE ' + window.parent.db; + var question = PMA_messages['strDropDatabaseStrongWarning'] + '\n' + PMA_messages['strDoYouReally'] + ' :\n' + 'DROP DATABASE ' + escapeHtml(window.parent.db); $(this).PMA_confirm(question, $(this).attr('href') ,function(url) { @@ -3374,3 +3374,15 @@ function PMA_clearSelection() { if(sel.removeAllRanges) sel.removeAllRanges(); } } + +/** + * HTML escaping + */ +function escapeHtml(unsafe) { + return unsafe + .replace(/&/g, "&") + .replace(/</g, "<") + .replace(/>/g, ">") + .replace(/"/g, """) + .replace(/'/g, "'"); +} diff --git a/js/tbl_structure.js b/js/tbl_structure.js index 63fa60f..bdcf1ee 100644 --- a/js/tbl_structure.js +++ b/js/tbl_structure.js @@ -44,7 +44,7 @@ $(document).ready(function() { /** * @var question String containing the question to be asked for confirmation */ - var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + curr_table_name + '` DROP `' + curr_column_name + '`'; + var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + escapeHtml(curr_table_name) + '` DROP `' + escapeHtml(curr_column_name) + '`'; $(this).PMA_confirm(question, $(this).attr('href'), function(url) { @@ -83,7 +83,7 @@ $(document).ready(function() { /** * @var question String containing the question to be asked for confirmation */ - var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + curr_table_name + '` ADD PRIMARY KEY(`' + curr_column_name + '`)'; + var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + escapeHtml(curr_table_name) + '` ADD PRIMARY KEY(`' + escapeHtml(curr_column_name) + '`)'; $(this).PMA_confirm(question, $(this).attr('href'), function(url) { hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_4, updated. RELEASE_3_4_4-42-gc5a6419
by Marc Delisle 08 Sep '11

08 Sep '11

The branch, QA_3_4 has been updated via c5a641961861f3e82b282582c1b86222d73409bf (commit) via bda213c58aec44925be661acb0e76c19483ea170 (commit) via 2f28ce9c800274190418da0945ce3647d36e1db6 (commit) via 4039683ab3ca63c979948e02345b6d38452f8dee (commit) from c02bd600eeee9a9f17a51c602bc32917de5e28eb (commit) - Log ----------------------------------------------------------------- commit c5a641961861f3e82b282582c1b86222d73409bf Merge: c02bd60 bda213c Author: Marc Delisle <marc(a)infomarc.info> Date: Thu Sep 8 15:41:40 2011 -0400 Merge branch 'MAINT_3_4_5' into QA_3_4 ----------------------------------------------------------------------- Summary of changes: ChangeLog | 2 ++ js/functions.js | 15 +++++++++++++-- js/sql.js | 2 +- js/tbl_structure.js | 4 ++-- 4 files changed, 18 insertions(+), 5 deletions(-) diff --git a/ChangeLog b/ChangeLog index 614d066..94d28fa 100644 --- a/ChangeLog +++ b/ChangeLog @@ -14,6 +14,8 @@ phpMyAdmin - ChangeLog - [export] Remove native Excel export modules (xls and xlsx formats) - [import] Remove native Excel import modules (xls and xlsx formats) - bug #3392920 [edit] BLOB emptied after editing another column +- [security] Fixed XSS in Inline Edit on save action, see PMASA-2011-14 +- [security] Fixed XSS with db/table/column names, see PMASA-2011-14 3.4.4.0 (2011-08-24) - bug #3323060 [parser] SQL parser breaks AJAX requests if query has unclosed quotes diff --git a/js/functions.js b/js/functions.js index 75fd677..b076661 100644 --- a/js/functions.js +++ b/js/functions.js @@ -172,7 +172,7 @@ function selectContent( element, lock, only_once ) { } /** - * Displays a confirmation box before to submit a "DROP/DELETE/ALTER" query. + * Displays a confirmation box before submitting a "DROP/DELETE/ALTER" query. * This function is called while clicking links * * @param object the link @@ -1657,7 +1657,7 @@ $(document).ready(function() { /** * @var question String containing the question to be asked for confirmation */ - var question = PMA_messages['strDropDatabaseStrongWarning'] + '\n' + PMA_messages['strDoYouReally'] + ' :\n' + 'DROP DATABASE ' + window.parent.db; + var question = PMA_messages['strDropDatabaseStrongWarning'] + '\n' + PMA_messages['strDoYouReally'] + ' :\n' + 'DROP DATABASE ' + escapeHtml(window.parent.db); $(this).PMA_confirm(question, $(this).attr('href') ,function(url) { @@ -2287,3 +2287,14 @@ $(document).ready(function() { }) // end of $(document).ready() +/** + * HTML escaping + */ +function escapeHtml(unsafe) { + return unsafe + .replace(/&/g, "&") + .replace(/</g, "<") + .replace(/>/g, ">") + .replace(/"/g, """) + .replace(/'/g, "'"); +} diff --git a/js/sql.js b/js/sql.js index dbba441..842b6c6 100644 --- a/js/sql.js +++ b/js/sql.js @@ -1111,7 +1111,7 @@ function PMA_unInlineEditRow($del_hide, $chg_submit, $this_td, $input_siblings, } } } - $this_sibling.html(new_html); + $this_sibling.text(new_html); } }) } diff --git a/js/tbl_structure.js b/js/tbl_structure.js index 352848c..493f0eb 100644 --- a/js/tbl_structure.js +++ b/js/tbl_structure.js @@ -44,7 +44,7 @@ $(document).ready(function() { /** * @var question String containing the question to be asked for confirmation */ - var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + curr_table_name + '` DROP `' + curr_column_name + '`'; + var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + escapeHtml(curr_table_name) + '` DROP `' + escapeHtml(curr_column_name) + '`'; $(this).PMA_confirm(question, $(this).attr('href'), function(url) { @@ -83,7 +83,7 @@ $(document).ready(function() { /** * @var question String containing the question to be asked for confirmation */ - var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + curr_table_name + '` ADD PRIMARY KEY(`' + curr_column_name + '`)'; + var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + escapeHtml(curr_table_name) + '` ADD PRIMARY KEY(`' + escapeHtml(curr_column_name) + '`)'; $(this).PMA_confirm(question, $(this).attr('href'), function(url) { hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, MAINT_3_4_5, updated. RELEASE_3_4_4-37-gbda213c
by Marc Delisle 08 Sep '11

08 Sep '11

The branch, MAINT_3_4_5 has been updated via bda213c58aec44925be661acb0e76c19483ea170 (commit) from 2f28ce9c800274190418da0945ce3647d36e1db6 (commit) - Log ----------------------------------------------------------------- commit bda213c58aec44925be661acb0e76c19483ea170 Author: Marc Delisle <marc(a)infomarc.info> Date: Thu Sep 8 15:38:40 2011 -0400 Escape HTML in js-generated confirmation messages ----------------------------------------------------------------------- Summary of changes: ChangeLog | 3 ++- js/functions.js | 15 +++++++++++++-- js/tbl_structure.js | 4 ++-- 3 files changed, 17 insertions(+), 5 deletions(-) diff --git a/ChangeLog b/ChangeLog index 1376169..326c8c0 100644 --- a/ChangeLog +++ b/ChangeLog @@ -11,6 +11,8 @@ phpMyAdmin - ChangeLog - [export] Remove native Excel export modules (xls and xlsx formats) - [import] Remove native Excel import modules (xls and xlsx formats) - bug #3392920 [edit] BLOB emptied after editing another column +- [security] Fixed XSS in Inline Edit on save action, see PMASA-2011-14 +- [security] Fixed XSS with db/table/column names, see PMASA-2011-14 3.4.4.0 (2011-08-24) - bug #3323060 [parser] SQL parser breaks AJAX requests if query has unclosed quotes @@ -31,7 +33,6 @@ phpMyAdmin - ChangeLog - bug #3374347 [display] Backquotes in normal text on import page - bug #3358750 [core] With Suhosin, urls are too long in edit links - [security] Missing sanitization on the table, column and index names leads to XSS vulnerabilities, see PMASA-2011-13 -- [security] Fixed XSS in Inline Edit on save action 3.4.3.2 (2011-07-23) - [security] Fixed XSS vulnerability, see PMASA-2011-9 diff --git a/js/functions.js b/js/functions.js index 75fd677..b076661 100644 --- a/js/functions.js +++ b/js/functions.js @@ -172,7 +172,7 @@ function selectContent( element, lock, only_once ) { } /** - * Displays a confirmation box before to submit a "DROP/DELETE/ALTER" query. + * Displays a confirmation box before submitting a "DROP/DELETE/ALTER" query. * This function is called while clicking links * * @param object the link @@ -1657,7 +1657,7 @@ $(document).ready(function() { /** * @var question String containing the question to be asked for confirmation */ - var question = PMA_messages['strDropDatabaseStrongWarning'] + '\n' + PMA_messages['strDoYouReally'] + ' :\n' + 'DROP DATABASE ' + window.parent.db; + var question = PMA_messages['strDropDatabaseStrongWarning'] + '\n' + PMA_messages['strDoYouReally'] + ' :\n' + 'DROP DATABASE ' + escapeHtml(window.parent.db); $(this).PMA_confirm(question, $(this).attr('href') ,function(url) { @@ -2287,3 +2287,14 @@ $(document).ready(function() { }) // end of $(document).ready() +/** + * HTML escaping + */ +function escapeHtml(unsafe) { + return unsafe + .replace(/&/g, "&") + .replace(/</g, "<") + .replace(/>/g, ">") + .replace(/"/g, """) + .replace(/'/g, "'"); +} diff --git a/js/tbl_structure.js b/js/tbl_structure.js index 352848c..493f0eb 100644 --- a/js/tbl_structure.js +++ b/js/tbl_structure.js @@ -44,7 +44,7 @@ $(document).ready(function() { /** * @var question String containing the question to be asked for confirmation */ - var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + curr_table_name + '` DROP `' + curr_column_name + '`'; + var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + escapeHtml(curr_table_name) + '` DROP `' + escapeHtml(curr_column_name) + '`'; $(this).PMA_confirm(question, $(this).attr('href'), function(url) { @@ -83,7 +83,7 @@ $(document).ready(function() { /** * @var question String containing the question to be asked for confirmation */ - var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + curr_table_name + '` ADD PRIMARY KEY(`' + curr_column_name + '`)'; + var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + escapeHtml(curr_table_name) + '` ADD PRIMARY KEY(`' + escapeHtml(curr_column_name) + '`)'; $(this).PMA_confirm(question, $(this).attr('href'), function(url) { hooks/post-receive -- phpMyAdmin

1 0