nettika/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

XSS in Tracking page, more

Browse Source
This commit is contained in:
Herman van Rink
2011-05-19 22:39:43 +02:00
parent 452669a174
commit 1300510d36
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
libraries/tbl_links.inc.php
View File

@@ -136,7 +136,7 @@ unset($tabs);
if(PMA_Tracker::isActive() and PMA_Tracker::isTracked($GLOBALS["db"], $GLOBALS["table"])) if(PMA_Tracker::isActive() and PMA_Tracker::isTracked($GLOBALS["db"], $GLOBALS["table"]))
{ {
$msg = PMA_Message::notice('<a href="tbl_tracking.php?'.$url_query.'">'.sprintf($strTrackingActivated, $GLOBALS["db"], $GLOBALS["table"]).'</a>'); $msg = PMA_Message::notice('<a href="tbl_tracking.php?'.$url_query.'">'.sprintf($strTrackingActivated, htmlspecialchars($GLOBALS["db"]), htmlspecialchars($GLOBALS["table"])).'</a>');
$msg->display(); $msg->display();
} }

6
tbl_tracking.php
View File

@@ -185,7 +185,7 @@ if (isset($_REQUEST['submit_create_version'])) {
$tracking_set = rtrim($tracking_set, ','); $tracking_set = rtrim($tracking_set, ',');
if (PMA_Tracker::createVersion($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'], $tracking_set )) { if (PMA_Tracker::createVersion($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'], $tracking_set )) {
$msg = PMA_Message::success(sprintf($strTrackingVersionCreated, $_REQUEST['version'], $GLOBALS['db'], $GLOBALS['table'])); $msg = PMA_Message::success(sprintf($strTrackingVersionCreated, $_REQUEST['version'], htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table'])));
$msg->display(); $msg->display();
} }
} }
@@ -193,7 +193,7 @@ if (isset($_REQUEST['submit_create_version'])) {
// Deactivate tracking // Deactivate tracking
if (isset($_REQUEST['submit_deactivate_now'])) { if (isset($_REQUEST['submit_deactivate_now'])) {
if (PMA_Tracker::deactivateTracking($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])) { if (PMA_Tracker::deactivateTracking($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])) {
$msg = PMA_Message::success(sprintf($strTrackingVersionDeactivated, $GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])); $msg = PMA_Message::success(sprintf($strTrackingVersionDeactivated, htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table']), $_REQUEST['version']));
$msg->display(); $msg->display();
} }
} }
@@ -201,7 +201,7 @@ if (isset($_REQUEST['submit_deactivate_now'])) {
// Activate tracking // Activate tracking
if (isset($_REQUEST['submit_activate_now'])) { if (isset($_REQUEST['submit_activate_now'])) {
if (PMA_Tracker::activateTracking($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])) { if (PMA_Tracker::activateTracking($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])) {
$msg = PMA_Message::success(sprintf($strTrackingVersionActivated, $GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])); $msg = PMA_Message::success(sprintf($strTrackingVersionActivated, htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table']), $_REQUEST['version']));
$msg->display(); $msg->display();
} }
} }