webapp/phpmyadmin
1
0
Fork 0
mirror of https://github.com/phpmyadmin/phpmyadmin.git synced 2026-10-28 07:41:55 +03:00
Code Activity

Merge branch 'QA_4_6-security' into master-security

Browse Source
This commit is contained in:
Michal Čihař
2016-08-18 09:12:49 +02:00
parent 5072d9a0df 9dbe520e90
commit b2ea7205fb
3 changed files with 22 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
libraries/core.lib.php
View File

@@ -1058,6 +1058,24 @@ function PMA_sanitizeMySQLHost($name)
return $name;
}
/**
* Sanitizes MySQL username
*
* * strips part behind null byte
*
* @param string $name User given username
*
* @return string
*/
function PMA_sanitizeMySQLUser($name)
{
$position = strpos($name, chr(0));
if ($position !== false) {
return substr($name, 0, $position);
}
return $name;
}
/**
* Safe unserializer wrapper
*

2
libraries/plugins/auth/AuthenticationCookie.php
View File

@@ -301,7 +301,7 @@ class AuthenticationCookie extends AuthenticationPlugin
}
// The user just logged in
$GLOBALS['PHP_AUTH_USER'] = $_REQUEST['pma_username'];
$GLOBALS['PHP_AUTH_USER'] = PMA_sanitizeMySQLUser($_REQUEST['pma_username']);
$GLOBALS['PHP_AUTH_PW'] = $_REQUEST['pma_password'];
if ($GLOBALS['cfg']['AllowArbitraryServer']
&& isset($_REQUEST['pma_servername'])

3
libraries/plugins/auth/AuthenticationHttp.php
View File

@@ -163,6 +163,9 @@ class AuthenticationHttp extends AuthenticationPlugin
unset($usr_pass);
}
// sanitize username
$PHP_AUTH_USER = PMA_sanitizeMySQLUser($PHP_AUTH_USER);
// User logged out -> ensure the new username is not the same
$old_usr = isset($_REQUEST['old_usr']) ? $_REQUEST['old_usr'] : '';
if (!empty($old_usr)