diff --git a/ChangeLog b/ChangeLog
index 1befe1714..43f4f9b5e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -5,6 +5,9 @@ phpMyAdmin - ChangeLog
$Id$
$HeadURL: https://phpmyadmin.svn.sourceforge.net/svnroot/phpmyadmin/trunk/phpMyAdmin/ChangeLog $
+3.2.2.1 (2009-10-12)
+- [security] XSS and SQL injection, thanks to Herman van Rink
+
3.2.2.0 (2009-09-13)
- bug #2825293 [structure] Default value for a BIT column
- bug [display] Red arrows were reversed in the list of tables
@@ -393,6 +396,9 @@ danbarry
- patch #2115966 [GUI] Checkboxes and IE 7, thanks to Martin - maschg
- bug #1914066 [core] ForceSSL generates incorrectly escaped redirections
+2.11.9.6 (2009-10-12)
+- [security] XSS and SQL injection, thanks to Herman van Rink
+
2.11.9.5 (2009-03-24)
- [security] XSS vulnerability on export page
- [security] Insufficient output sanitizing when generating configuration file
diff --git a/db_operations.php b/db_operations.php
index 5edeaa925..fe5a721f9 100644
--- a/db_operations.php
+++ b/db_operations.php
@@ -613,7 +613,7 @@ if ($cfgRelation['pdfwork'] && $num_tables > 0) { ?>
'
- . $pages['page_nr'] . ': ' . $pages['page_descr'] . '' . "\n";
+ . $pages['page_nr'] . ': ' . htmlspecialchars($pages['page_descr']) . '' . "\n";
} // end while
PMA_DBI_free_result($test_rs);
unset($test_rs);
diff --git a/db_structure.php b/db_structure.php
index 4a06801ae..e9fdcfdc3 100644
--- a/db_structure.php
+++ b/db_structure.php
@@ -387,7 +387,7 @@ foreach ($tables as $keyname => $each_table) {
$row_count++;
if ($table_is_view) {
- $hidden_fields[] = '';
+ $hidden_fields[] = '';
}
if ($each_table['TABLE_ROWS'] > 0) {
@@ -433,7 +433,7 @@ foreach ($tables as $keyname => $each_table) {
/> |
diff --git a/pdf_pages.php b/pdf_pages.php
index 8df7329d8..18458ec74 100644
--- a/pdf_pages.php
+++ b/pdf_pages.php
@@ -270,7 +270,7 @@ if ($cfgRelation['pdfwork']) {
if (isset($chpage) && $chpage == $curr_page['page_nr']) {
echo ' selected="selected"';
}
- echo '>' . $curr_page['page_nr'] . ': ' . $curr_page['page_descr'] . '';
+ echo '>' . $curr_page['page_nr'] . ': ' . htmlspecialchars($curr_page['page_descr']) . '';
} // end while
echo "\n";
?>
@@ -429,12 +429,12 @@ function resetDrag() {
echo "\n" . ' | '
. "\n" . ' '
. "\n" . ' | ';
@@ -462,7 +462,7 @@ function resetDrag() {
echo "\n" . ' '
. "\n" . ' '
. "\n" . ' | ';
@@ -493,8 +493,8 @@ function resetDrag() {
if (!empty($tabExist) && is_array($tabExist)) {
foreach ($tabExist AS $key => $value) {
if (!$value) {
- $_strtrans .= '' . "\n";
- $_strname .= '' . $key . '' . "\n";
+ $_strtrans .= '' . "\n";
+ $_strname .= '' . htmlspecialchars($key) . '' . "\n";
$shoot = TRUE;
}
}
diff --git a/pmd_pdf.php b/pmd_pdf.php
index ae72741d9..5f2db6277 100644
--- a/pmd_pdf.php
+++ b/pmd_pdf.php
@@ -23,10 +23,12 @@ if (isset($scale) && ! isset($createpage)) {
$pmd_table = PMA_backquote($GLOBALS['cfgRelation']['db']) . '.' . PMA_backquote($GLOBALS['cfgRelation']['designer_coords']);
$pma_table = PMA_backquote($GLOBALS['cfgRelation']['db']) . '.' . PMA_backquote($cfgRelation['table_coords']);
+ $scale_q = PMA_sqlAddslashes($scale);
+ $pdf_page_number_q = PMA_sqlAddslashes($pdf_page_number);
if (isset($exp)) {
- $sql = "REPLACE INTO " . $pma_table . " (db_name, table_name, pdf_page_number, x, y) SELECT db_name, table_name, " . $pdf_page_number . ", ROUND(x/" . $scale . ") , ROUND(y/" . $scale . ") y FROM " . $pmd_table . " WHERE db_name = '" . $db . "'";
+ $sql = "REPLACE INTO " . $pma_table . " (db_name, table_name, pdf_page_number, x, y) SELECT db_name, table_name, " . $pdf_page_number_q . ", ROUND(x/" . $scale_q . ") , ROUND(y/" . $scale_q . ") y FROM " . $pmd_table . " WHERE db_name = '" . PMA_sqlAddslashes($db) . "'";
PMA_query_as_cu($sql,TRUE,PMA_DBI_QUERY_STORE);
}
@@ -34,15 +36,15 @@ if (isset($scale) && ! isset($createpage)) {
if (isset($imp)) {
PMA_query_as_cu(
'UPDATE ' . $pma_table . ',' . $pmd_table .
- ' SET ' . $pmd_table . '.`x`= ' . $pma_table . '.`x` * '. $scale . ',
- ' . $pmd_table . '.`y`= ' . $pma_table . '.`y` * '.$scale.'
+ ' SET ' . $pmd_table . '.`x`= ' . $pma_table . '.`x` * '. $scale_q . ',
+ ' . $pmd_table . '.`y`= ' . $pma_table . '.`y` * '.$scale_q.'
WHERE
' . $pmd_table . '.`db_name`=' . $pma_table . '.`db_name`
AND
' . $pmd_table . '.`table_name` = ' . $pma_table . '.`table_name`
AND
- ' . $pmd_table . '.`db_name`=\''.$db.'\'
- AND pdf_page_number = '.$pdf_page_number.';',TRUE,PMA_DBI_QUERY_STORE); }
+ ' . $pmd_table . '.`db_name`=\'' . PMA_sqlAddslashes($db) .'\'
+ AND pdf_page_number = ' . $pdf_page_number_q . ';',TRUE,PMA_DBI_QUERY_STORE); }
die("");
}
@@ -79,11 +81,11 @@ require_once './libraries/header_meta_style.inc.php';