diff --git a/ChangeLog b/ChangeLog index daef419e1..7ceef6822 100755 --- a/ChangeLog +++ b/ChangeLog @@ -5,6 +5,10 @@ phpMyAdmin - Changelog $Id$ $Source$ +2005-11-24 Michal Čihař + * libraries/header_http.inc.php, libraries/header_meta_style.inc.php: Fix + XSS on some libraries (CVE-2005-3665). + 2005-11-24 Sebastian Mendel * themes/original/*, css/phpmyadmin.css.php: - updated theme diff --git a/libraries/header_http.inc.php b/libraries/header_http.inc.php index 60130012a..7ce4a6190 100644 --- a/libraries/header_http.inc.php +++ b/libraries/header_http.inc.php @@ -2,6 +2,10 @@ /* $Id$ */ // vim: expandtab sw=4 ts=4 sts=4: +if (isset($_REQUEST['GLOBALS']) || isset($_FILES['GLOBALS'])) { + die("GLOBALS overwrite attempt"); +} + /** * Sends http headers */ diff --git a/libraries/header_meta_style.inc.php b/libraries/header_meta_style.inc.php index 962f5616e..1b8859ff7 100644 --- a/libraries/header_meta_style.inc.php +++ b/libraries/header_meta_style.inc.php @@ -2,6 +2,10 @@ /* $Id$ */ // vim: expandtab sw=4 ts=4 sts=4: +if (isset($_REQUEST['GLOBALS']) || isset($_FILES['GLOBALS'])) { + die("GLOBALS overwrite attempt"); +} + /** * Sends the beginning of the html page then returns to the calling script */