nettika/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixed possible code injection incase session variables are compromised, see PMASA-2011-6

Browse Source
This commit is contained in:
Herman van Rink
2011-06-30 13:21:31 +02:00
parent 7ebd958b2b
commit 0fbedaf5fd
2 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
ChangeLog
View File

@@ -3,6 +3,7 @@ phpMyAdmin - ChangeLog
3.4.3.1 (not yet released) 3.4.3.1 (not yet released)
- [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-5 - [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-5
- [security] Fixed possible code injection incase session variables are compromised, see PMASA-2011-6
3.4.3.0 (2011-06-27) 3.4.3.0 (2011-06-27)
- bug #3311170 [sync] Missing helper icons in Synchronize - bug #3311170 [sync] Missing helper icons in Synchronize

2
setup/lib/ConfigGenerator.class.php
View File

@@ -39,7 +39,7 @@ class ConfigGenerator
if ($cf->getServerCount() > 0) { if ($cf->getServerCount() > 0) {
$ret .= "/* Servers configuration */$crlf\$i = 0;" . $crlf . $crlf; $ret .= "/* Servers configuration */$crlf\$i = 0;" . $crlf . $crlf;
foreach ($c['Servers'] as $id => $server) { foreach ($c['Servers'] as $id => $server) {
$ret .= '/* Server: ' . strtr($cf->getServerName($id), '*/', '-') . " [$id] */" . $crlf $ret .= '/* Server: ' . strtr($cf->getServerName($id) . " [$id] ", '*/', '-') . "*/" . $crlf
. '$i++;' . $crlf; . '$i++;' . $crlf;
foreach ($server as $k => $v) { foreach ($server as $k => $v) {
$k = preg_replace('/[^A-Za-z0-9_]/', '_', $k); $k = preg_replace('/[^A-Za-z0-9_]/', '_', $k);