webapp/phpmyadmin
1
0
Fork 0
mirror of https://github.com/phpmyadmin/phpmyadmin.git synced 2026-10-28 07:41:55 +03:00
Code Activity

[security] XSS with malicious ENUM values

Browse Source 
Signed-off-by: Marc Delisle <marc@infomarc.info>
This commit is contained in:
Marc Delisle
2014-09-28 09:48:13 -04:00
parent 247ebb6077
commit 71ccbbc423
2 changed files with 14 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
libraries/TableSearch.class.php
View File

@@ -316,6 +316,7 @@ EOT;
private function _getEnumSetInputBox($column_index, $criteriaValues,
$column_type, $column_id, $in_zoom_search_edit = false
) {
$column_type = htmlspecialchars($column_type);
$html_output = '';
$value = explode(
', ',
@@ -984,7 +985,9 @@ EOT;
$html_output .= '<th>'
. htmlspecialchars($this->_columnNames[$column_index]) . '</th>';
$properties = $this->getColumnProperties($column_index, $column_index);
$html_output .= '<td>' . $properties['type'] . '</td>';
$html_output .= '<td>'
. htmlspecialchars($properties['type'])
. '</td>';
$html_output .= '<td>' . $properties['collation'] . '</td>';
$html_output .= '<td>' . $properties['func'] . '</td>';
$html_output .= '<td>' . $properties['value'] . '</td>';
@@ -993,11 +996,13 @@ EOT;
$html_output .= '<tr><td>';
$html_output .= '<input type="hidden"'
. ' name="criteriaColumnNames[' . $column_index . ']"'
. ' value="' . htmlspecialchars($this->_columnNames[$column_index])
. ' value="'
. htmlspecialchars($this->_columnNames[$column_index])
. '" />';
$html_output .= '<input type="hidden"'
. ' name="criteriaColumnTypes[' . $column_index . ']"'
. ' value="' . $this->_columnTypes[$column_index] . '" />';
. ' value="'
. htmlspecialchars($this->_columnTypes[$column_index]) . '" />';
$html_output .= '<input type="hidden"'
. ' name="criteriaColumnCollations[' . $column_index . ']"'
. ' value="' . $this->_columnCollations[$column_index] . '" />';

9
libraries/Util.class.php
View File

@@ -3062,8 +3062,11 @@ class PMA_Util
// for the case ENUM('&#8211;','&ldquo;')
$displayed_type = htmlspecialchars($printtype);
if (strlen($printtype) > $GLOBALS['cfg']['LimitChars']) {
$displayed_type = '<abbr title="' . $printtype . '">';
$displayed_type .= substr($printtype, 0, $GLOBALS['cfg']['LimitChars']);
$displayed_type = '<abbr title="'
. htmlspecialchars($printtype) . '">';
$displayed_type .= htmlspecialchars(
substr($printtype, 0, $GLOBALS['cfg']['LimitChars'])
);
$displayed_type .= '</abbr>';
}
@@ -4363,4 +4366,4 @@ class PMA_Util
}
}
?>
?>