webapp/phpmyadmin
1
0
Fork 0
mirror of https://github.com/phpmyadmin/phpmyadmin.git synced 2026-10-31 10:54:46 +03:00
Code Activity

No longer globalize HTTP_AUTHORIZATION

Browse Source
This commit is contained in:
Marc Delisle
2012-02-26 08:10:30 -05:00
parent 8481a0265d
commit 803e5fcd07
2 changed files with 3 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libraries/auth/http.auth.lib.php
View File

@@ -118,8 +118,8 @@ function PMA_auth_check()
} elseif (PMA_getenv('AUTH_USER')) {
// WebSite Professional
$PHP_AUTH_USER = PMA_getenv('AUTH_USER');
} elseif (PMA_getenv('HTTP_AUTHORIZATION')) {
// IIS, might be encoded, see below
} elseif (PMA_getenv('HTTP_AUTHORIZATION') && false === strpos(PMA_getenv('HTTP_AUTHORIZATION'), '<')) {
// IIS, might be encoded, see below; also prevent XSS
$PHP_AUTH_USER = PMA_getenv('HTTP_AUTHORIZATION');
} elseif (PMA_getenv('Authorization')) {
// FastCGI, might be encoded, see below

18
libraries/grab_globals.lib.php
View File

@@ -85,22 +85,6 @@ if (! empty($_GET)) {
if (! empty($_POST)) {
PMA_recursive_extract($_POST, $GLOBALS);
}
/**
* globalize some environment variables
*/
$server_vars = array('HTTP_AUTHORIZATION');
foreach ($server_vars as $current) {
// it's not important HOW we detect html tags
// it's more important to prevent XSS
// so it's not important if we result in an invalid string,
// it's even better than a XSS capable string
if (PMA_getenv($current) && false === strpos(PMA_getenv($current), '<')) {
$$current = PMA_getenv($current);
// already imported by register_globals?
} elseif (! isset($$current) || false !== strpos($$current, '<')) {
$$current = '';
}
}
unset($server_vars, $current, $_import_blacklist);
unset($_import_blacklist);
?>