diff --git a/ChangeLog b/ChangeLog index f4b9a76977..ea66226ca2 100644 --- a/ChangeLog +++ b/ChangeLog @@ -39,6 +39,8 @@ phpMyAdmin - ChangeLog - issue #12251 Fixed random logouts due to wrong cookie path - issue #12480 Fixed editing of ENUM/SET/DECIMAL fields structure - issue #12497 Missing escaping of configuration used in SQL (hide_db and only_db) +- issue #12476 Add error checking in reading advisory rules file +- issue #12477 Add checking missing elements and confirming element types from json_decode 4.6.4 (2016-08-16) - issue [security] Weaknesses with cookie encryption, see PMASA-2016-29 diff --git a/libraries/Advisor.php b/libraries/Advisor.php index 20cf1dfab3..9817fc43ac 100644 --- a/libraries/Advisor.php +++ b/libraries/Advisor.php @@ -456,10 +456,20 @@ class Advisor */ public static function parseRulesFile() { - $file = file('libraries/advisory_rules.txt', FILE_IGNORE_NEW_LINES); + $filename = 'libraries/advisory_rules.txt'; + $file = file($filename, FILE_IGNORE_NEW_LINES); + $errors = array(); $rules = array(); $lines = array(); + + if ($file === FALSE) { + $errors[] = __( + 'Error in reading file: The file \'' . $filename .'\' does not exist or is not readable' + ); + return array('rules' => $rules, 'lines' => $lines, 'errors' => $errors); + } + $ruleSyntax = array( 'name', 'formula', 'test', 'issue', 'recommendation', 'justification' ); diff --git a/libraries/common.inc.php b/libraries/common.inc.php index a9e522f740..00c1a2b934 100644 --- a/libraries/common.inc.php +++ b/libraries/common.inc.php @@ -440,9 +440,15 @@ PMA_setGlobalDbOrTable('table'); */ if (PMA_isValid($_REQUEST['selected_recent_table'])) { $recent_table = json_decode($_REQUEST['selected_recent_table'], true); - $GLOBALS['db'] = $recent_table['db']; + + $GLOBALS['db'] + = (array_key_exists('db', $recent_table) && is_string($recent_table['db'])) ? + $recent_table['db'] : ''; $GLOBALS['url_params']['db'] = $GLOBALS['db']; - $GLOBALS['table'] = $recent_table['table']; + + $GLOBALS['table'] + = (array_key_exists('table', $recent_table) && is_string($recent_table['table'])) ? + $recent_table['table'] : ''; $GLOBALS['url_params']['table'] = $GLOBALS['table']; }