diff --git a/ChangeLog b/ChangeLog index 373ef1abe..c5b705a97 100644 --- a/ChangeLog +++ b/ChangeLog @@ -33,6 +33,8 @@ $HeadURL: https://phpmyadmin.svn.sourceforge.net/svnroot/phpmyadmin/trunk/phpMyA - bug #1981043 [export] HTML in exports getting corrupted, thanks to Jason Judge - jasonjudge - bug #1936761 [interface] BINARY not treated as BLOB: update/delete issues +- protection against XSS when register_globals is on and .htaccess has + no effect, thanks to Tim Starling - bug #1996943 [export] Firefox 3 and .sql.gz (corrupted); detect Gecko 1.9, thanks to Jürgen Wind - windkiel diff --git a/libraries/auth/cookie.auth.lib.php b/libraries/auth/cookie.auth.lib.php index 3746fe0e5..653ae1e3c 100644 --- a/libraries/auth/cookie.auth.lib.php +++ b/libraries/auth/cookie.auth.lib.php @@ -8,12 +8,8 @@ * @version $Id$ */ -/** - * @todo replace by constant - * $coming_from_common can be set from outside with register_globals on - */ -if (!isset($coming_from_common)) { - exit; +if (! defined('PHPMYADMIN')) { + exit; } if (function_exists('mcrypt_encrypt') || PMA_dl('mcrypt')) { diff --git a/libraries/charset_conversion.lib.php b/libraries/charset_conversion.lib.php index 8ec0fa3b9..7adeb90ae 100644 --- a/libraries/charset_conversion.lib.php +++ b/libraries/charset_conversion.lib.php @@ -5,7 +5,9 @@ * * @version $Id$ */ - +if (! defined('PHPMYADMIN')) { + exit; +} /** * Loads the recode or iconv extensions if any of it is not loaded yet diff --git a/libraries/check_user_privileges.lib.php b/libraries/check_user_privileges.lib.php index 977d85460..1164e76ef 100644 --- a/libraries/check_user_privileges.lib.php +++ b/libraries/check_user_privileges.lib.php @@ -7,6 +7,9 @@ * * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} /** * diff --git a/libraries/common.inc.php b/libraries/common.inc.php index f602897f2..7bf04a032 100644 --- a/libraries/common.inc.php +++ b/libraries/common.inc.php @@ -52,6 +52,11 @@ if (version_compare(phpversion(), '6', 'lt')) { @ini_set('magic_quotes_runtime', false); } +/** + * for verification in all procedural scripts under libraries + */ +define('PHPMYADMIN', true); + /** * core functions */ @@ -730,9 +735,6 @@ if (! defined('PMA_MINIMUM_COMMON')) { // Gets the authentication library that fits the $cfg['Server'] settings // and run authentication - // (for a quick check of path disclosure in auth/cookies:) - $coming_from_common = true; - // to allow HTTP or http $cfg['Server']['auth_type'] = strtolower($cfg['Server']['auth_type']); if (! file_exists('./libraries/auth/' . $cfg['Server']['auth_type'] . '.auth.lib.php')) { diff --git a/libraries/database_interface.lib.php b/libraries/database_interface.lib.php index 96467074d..b32274c3c 100644 --- a/libraries/database_interface.lib.php +++ b/libraries/database_interface.lib.php @@ -5,6 +5,9 @@ * * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} /** * diff --git a/libraries/db_common.inc.php b/libraries/db_common.inc.php index f21437acb..693d28aec 100644 --- a/libraries/db_common.inc.php +++ b/libraries/db_common.inc.php @@ -4,6 +4,9 @@ * * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} /** * Gets some core libraries diff --git a/libraries/db_info.inc.php b/libraries/db_info.inc.php index 2717bf4d1..adc546527 100644 --- a/libraries/db_info.inc.php +++ b/libraries/db_info.inc.php @@ -34,6 +34,9 @@ * @uses addslashes() * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} /** * requirements diff --git a/libraries/db_links.inc.php b/libraries/db_links.inc.php index d22e59e11..417392d43 100644 --- a/libraries/db_links.inc.php +++ b/libraries/db_links.inc.php @@ -4,6 +4,9 @@ * * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} /** * diff --git a/libraries/db_routines.inc.php b/libraries/db_routines.inc.php index 873d3eb2e..f3d24741f 100644 --- a/libraries/db_routines.inc.php +++ b/libraries/db_routines.inc.php @@ -4,6 +4,9 @@ * * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} /** * @todo Support seeing the "results" of the called procedure or diff --git a/libraries/db_table_exists.lib.php b/libraries/db_table_exists.lib.php index 8486cc7d7..19a5827b9 100644 --- a/libraries/db_table_exists.lib.php +++ b/libraries/db_table_exists.lib.php @@ -6,6 +6,9 @@ * * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} /** * diff --git a/libraries/dbg/setup.php b/libraries/dbg/setup.php index 30d870000..af4f34aa0 100644 --- a/libraries/dbg/setup.php +++ b/libraries/dbg/setup.php @@ -3,6 +3,9 @@ /** * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} /** * checks for DBG extension and trys to load if not loaded @@ -24,4 +27,4 @@ if ($GLOBALS['cfg']['DBG']['enable']) { $GLOBALS['DBG'] = true; } } -?> \ No newline at end of file +?> diff --git a/libraries/dbi/mysql.dbi.lib.php b/libraries/dbi/mysql.dbi.lib.php index bd4bd1227..3ae84b803 100644 --- a/libraries/dbi/mysql.dbi.lib.php +++ b/libraries/dbi/mysql.dbi.lib.php @@ -5,6 +5,9 @@ * * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} /** * diff --git a/libraries/dbi/mysqli.dbi.lib.php b/libraries/dbi/mysqli.dbi.lib.php index 0aa518450..705477ebf 100644 --- a/libraries/dbi/mysqli.dbi.lib.php +++ b/libraries/dbi/mysqli.dbi.lib.php @@ -5,6 +5,9 @@ * * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} // MySQL client API if (!defined('PMA_MYSQL_CLIENT_API')) { diff --git a/libraries/display_change_password.lib.php b/libraries/display_change_password.lib.php index b1fdc3abc..550f271c7 100644 --- a/libraries/display_change_password.lib.php +++ b/libraries/display_change_password.lib.php @@ -5,6 +5,9 @@ * * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} // loic1: autocomplete feature of IE kills the "onchange" event handler and it // must be replaced by the "onpropertychange" one in this case diff --git a/libraries/display_create_database.lib.php b/libraries/display_create_database.lib.php index 65c37d6c8..b5b5ba485 100644 --- a/libraries/display_create_database.lib.php +++ b/libraries/display_create_database.lib.php @@ -5,6 +5,9 @@ * * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} /** * diff --git a/libraries/display_create_table.lib.php b/libraries/display_create_table.lib.php index 62d522b68..f31fcfe8e 100644 --- a/libraries/display_create_table.lib.php +++ b/libraries/display_create_table.lib.php @@ -5,6 +5,9 @@ * * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} /** * diff --git a/libraries/display_export.lib.php b/libraries/display_export.lib.php index 60fe0dd4c..858c26572 100644 --- a/libraries/display_export.lib.php +++ b/libraries/display_export.lib.php @@ -4,6 +4,9 @@ * * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} /** * diff --git a/libraries/display_import.lib.php b/libraries/display_import.lib.php index d77280422..9f1b0eec7 100644 --- a/libraries/display_import.lib.php +++ b/libraries/display_import.lib.php @@ -4,6 +4,9 @@ * * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} /** * diff --git a/libraries/display_select_lang.lib.php b/libraries/display_select_lang.lib.php index e7a48ab47..6f7a5215d 100644 --- a/libraries/display_select_lang.lib.php +++ b/libraries/display_select_lang.lib.php @@ -5,6 +5,9 @@ * * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} /** * Sorts available languages by their true english names diff --git a/libraries/display_tbl_links.lib.php b/libraries/display_tbl_links.lib.php index f9a42ec2f..a851484d0 100644 --- a/libraries/display_tbl_links.lib.php +++ b/libraries/display_tbl_links.lib.php @@ -9,6 +9,9 @@ * * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} /** * diff --git a/libraries/export/csv.php b/libraries/export/csv.php index 0c6f525e5..b1f5a6ef4 100644 --- a/libraries/export/csv.php +++ b/libraries/export/csv.php @@ -3,6 +3,9 @@ /** * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} /** * Set of functions used to build CSV dumps of tables diff --git a/libraries/export/excel.php b/libraries/export/excel.php index efa859871..5df0b3fe3 100644 --- a/libraries/export/excel.php +++ b/libraries/export/excel.php @@ -5,6 +5,9 @@ * * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} /** * diff --git a/libraries/export/htmlexcel.php b/libraries/export/htmlexcel.php index b380cd52e..5edc684b4 100644 --- a/libraries/export/htmlexcel.php +++ b/libraries/export/htmlexcel.php @@ -5,6 +5,9 @@ * * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} /** * diff --git a/libraries/export/htmlword.php b/libraries/export/htmlword.php index 94d0add9c..9141f8192 100644 --- a/libraries/export/htmlword.php +++ b/libraries/export/htmlword.php @@ -5,6 +5,9 @@ * * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} /** * diff --git a/libraries/export/latex.php b/libraries/export/latex.php index 4ea8188d6..3711d37eb 100644 --- a/libraries/export/latex.php +++ b/libraries/export/latex.php @@ -5,6 +5,9 @@ * * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} /** * diff --git a/libraries/export/ods.php b/libraries/export/ods.php index 09ba82505..51cf28eca 100644 --- a/libraries/export/ods.php +++ b/libraries/export/ods.php @@ -5,6 +5,9 @@ * * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} /** * diff --git a/libraries/export/odt.php b/libraries/export/odt.php index c4a106ab0..c4439471f 100644 --- a/libraries/export/odt.php +++ b/libraries/export/odt.php @@ -5,6 +5,9 @@ * * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} /** * diff --git a/libraries/export/pdf.php b/libraries/export/pdf.php index 12bfd7987..6cc2b902f 100644 --- a/libraries/export/pdf.php +++ b/libraries/export/pdf.php @@ -5,6 +5,9 @@ * * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} /** * diff --git a/libraries/export/sql.php b/libraries/export/sql.php index a65ff6a87..e78ac948a 100644 --- a/libraries/export/sql.php +++ b/libraries/export/sql.php @@ -5,6 +5,9 @@ * * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} /** * diff --git a/libraries/export/xls.php b/libraries/export/xls.php index c9ec6ca5b..7f7ef27e6 100644 --- a/libraries/export/xls.php +++ b/libraries/export/xls.php @@ -5,6 +5,9 @@ * * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} /** * diff --git a/libraries/export/xml.php b/libraries/export/xml.php index 9f3da1021..bc99eb006 100644 --- a/libraries/export/xml.php +++ b/libraries/export/xml.php @@ -5,6 +5,9 @@ * * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} /** * diff --git a/libraries/export/yaml.php b/libraries/export/yaml.php index e5850ae9f..f55e9153a 100644 --- a/libraries/export/yaml.php +++ b/libraries/export/yaml.php @@ -5,6 +5,9 @@ * * @version $Id$ */ +if (! defined('PHPMYADMIN')) { + exit; +} /** * diff --git a/libraries/footer.inc.php b/libraries/footer.inc.php index 26fed3756..e02c69ac6 100644 --- a/libraries/footer.inc.php +++ b/libraries/footer.inc.php @@ -1,7 +1,7 @@