nettika/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bugs #1149381 and 1149383

Browse Source
This commit is contained in:
Alexander M. Turek
2005-02-22 23:07:59 +00:00
parent 1edf8c0906
commit 4cbcd96081
2 changed files with 22 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
ChangeLog
View File

@@ -5,6 +5,10 @@ phpMyAdmin - Changelog
$Id$ $Id$
$Source$ $Source$
2005-02-22 Alexander M. Turek <me@derrabus.de>
* libraries/grab_globals.lib.php: Hotfix against bug #1149381 and parts
of bug #1149383.
2005-02-21 Marc Delisle <lem9@users.sourceforge.net> 2005-02-21 Marc Delisle <lem9@users.sourceforge.net>
* pdf_pages.php: patch #1120466 (modified): optional column names * pdf_pages.php: patch #1120466 (modified): optional column names
in visual scratchboard, thanks to Remco Aalbers - remcoa in visual scratchboard, thanks to Remco Aalbers - remcoa
@@ -16,8 +20,8 @@ $Source$
2005-02-16 Alexander M. Turek <me@derrabus.de> 2005-02-16 Alexander M. Turek <me@derrabus.de>
* db_details_export.php: Views are not exportable yet. * db_details_export.php: Views are not exportable yet.
* themes/*/css/theme_right.css.php: Allow to mark a whole row as disabled. * themes/*/css/theme_right.css.php: Allow to mark a whole row as disabled.
* server_engines.php: Use new CSS class 'disabled' for unavailable * server_engines.php: Use new CSS class 'disabled' for unavailable
engines. engines.
2005-02-14 Michal Čihař <michal@cihar.com> 2005-02-14 Michal Čihař <michal@cihar.com>

16
libraries/grab_globals.lib.php
View File

@@ -18,6 +18,22 @@ function PMA_gpc_extract($array, &$target) {
} }
$is_magic_quotes = get_magic_quotes_gpc(); $is_magic_quotes = get_magic_quotes_gpc();
foreach ($array AS $key => $value) { foreach ($array AS $key => $value) {
/**
* 2005-02-22, rabus:
*
* This is just an ugly hotfix to avoid changing internal config
* parameters.
*
* Currently, the following variable names are rejected when found in
* $_GET or $_POST: cfg and str*
*
* Warning: this is also affects array keys:
* Variables like $_GET['harmless']['cfg'] will also be rejected!
*/
if ($key == 'cfg' || substr($key, 0, 3) == 'str') {
continue;
}
if (is_array($value)) { if (is_array($value)) {
// there could be a variable coming from a cookie of // there could be a variable coming from a cookie of
// another application, with the same name as this array // another application, with the same name as this array