From 803e5fcd07e2db7b7e5aa54438bcedf6dea535ba Mon Sep 17 00:00:00 2001
From: Marc Delisle <marc@infomarc.info>
Date: Sun, 26 Feb 2012 08:10:30 -0500
Subject: [PATCH] No longer globalize HTTP_AUTHORIZATION

---
 libraries/auth/http.auth.lib.php |  4 ++--
 libraries/grab_globals.lib.php   | 18 +-----------------
 2 files changed, 3 insertions(+), 19 deletions(-)

diff --git a/libraries/auth/http.auth.lib.php b/libraries/auth/http.auth.lib.php
index 7a84eeac68..96b07c5ac6 100644
--- a/libraries/auth/http.auth.lib.php
+++ b/libraries/auth/http.auth.lib.php
@@ -118,8 +118,8 @@ function PMA_auth_check()
         } elseif (PMA_getenv('AUTH_USER')) {
             // WebSite Professional
             $PHP_AUTH_USER = PMA_getenv('AUTH_USER');
-        } elseif (PMA_getenv('HTTP_AUTHORIZATION')) {
-            // IIS, might be encoded, see below
+        } elseif (PMA_getenv('HTTP_AUTHORIZATION') && false === strpos(PMA_getenv('HTTP_AUTHORIZATION'), '<')) {
+            // IIS, might be encoded, see below; also prevent XSS
             $PHP_AUTH_USER = PMA_getenv('HTTP_AUTHORIZATION');
         } elseif (PMA_getenv('Authorization')) {
             // FastCGI, might be encoded, see below
diff --git a/libraries/grab_globals.lib.php b/libraries/grab_globals.lib.php
index 96e8ef7587..9b85998fb6 100644
--- a/libraries/grab_globals.lib.php
+++ b/libraries/grab_globals.lib.php
@@ -85,22 +85,6 @@ if (! empty($_GET)) {
 if (! empty($_POST)) {
     PMA_recursive_extract($_POST, $GLOBALS);
 }
-/**
- * globalize some environment variables
- */
-$server_vars = array('HTTP_AUTHORIZATION');
-foreach ($server_vars as $current) {
-    // it's not important HOW we detect html tags
-    // it's more important to prevent XSS
-    // so it's not important if we result in an invalid string,
-    // it's even better than a XSS capable string
-    if (PMA_getenv($current) && false === strpos(PMA_getenv($current), '<')) {
-        $$current = PMA_getenv($current);
-    // already imported by register_globals?
-    } elseif (! isset($$current) || false !== strpos($$current, '<')) {
-        $$current = '';
-    }
-}
-unset($server_vars, $current, $_import_blacklist);
+unset($_import_blacklist);
 
 ?>