nettika/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bug #1807923 [login] Login with html entities in password fails

Browse Source
This commit is contained in:
Sebastian Mendel
2007-10-05 09:46:30 +00:00
parent e2d2946a06
commit 113b4fbcf7
2 changed files with 8 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
ChangeLog
View File

@@ -16,6 +16,7 @@ $HeadURL: https://phpmyadmin.svn.sourceforge.net/svnroot/phpmyadmin/trunk/phpMyA
- bug #1805773 [relations] browse foreign values: return values not escaped,
thanks to Alex Rambau
- bug #1798786 [import] Wrong error message when a string contains semicolon
- bug #1807923 [login] Login with html entities in password fails
2.11.1.0 (2007-09-20)

19
libraries/cleanup.lib.php
View File

@@ -14,7 +14,8 @@
* @access public
* @author Michal Cihar (michal@cihar.com)
*/
function PMA_remove_request_vars(&$whitelist) {
function PMA_remove_request_vars(&$whitelist)
{
// do not check only $_REQUEST because it could have been overwritten
// and use type casting because the variables could have become
// strings
@@ -26,24 +27,16 @@ function PMA_remove_request_vars(&$whitelist) {
} else {
// allowed stuff could be compromised so escape it
// we require it to be a string
if (isset($_REQUEST[$key]) && is_string($_REQUEST[$key])) {
$_REQUEST[$key] = htmlspecialchars($_REQUEST[$key], ENT_QUOTES);
} else {
if (isset($_REQUEST[$key]) && ! is_string($_REQUEST[$key])) {
unset($_REQUEST[$key]);
}
if (isset($_POST[$key]) && is_string($_POST[$key])) {
$_POST[$key] = htmlspecialchars($_POST[$key], ENT_QUOTES);
} else {
if (isset($_POST[$key]) && ! is_string($_POST[$key])) {
unset($_POST[$key]);
}
if (isset($_COOKIE[$key]) && is_string($_COOKIE[$key])) {
$_COOKIE[$key] = htmlspecialchars($_COOKIE[$key], ENT_QUOTES);
} else {
if (isset($_COOKIE[$key]) && ! is_string($_COOKIE[$key])) {
unset($_COOKIE[$key]);
}
if (isset($_GET[$key]) && is_string($_GET[$key])) {
$_GET[$key] = htmlspecialchars($_GET[$key], ENT_QUOTES);
} else {
if (isset($_GET[$key]) && ! is_string($_GET[$key])) {
unset($_GET[$key]);
}
}