protection against XSS when register_globals is on and .htaccess has no effect

ChangeLog

@@ -33,6 +33,8 @@ $HeadURL: https://phpmyadmin.svn.sourceforge.net/svnroot/phpmyadmin/trunk/phpMyA
 - bug #1981043 [export] HTML in exports getting corrupted,
   thanks to Jason Judge - jasonjudge
 - bug #1936761 [interface] BINARY not treated as BLOB: update/delete issues 
+- protection against XSS when register_globals is on and .htaccess has
+  no effect, thanks to Tim Starling
 - bug #1996943 [export] Firefox 3 and .sql.gz (corrupted); detect Gecko 1.9,
   thanks to Jürgen Wind - windkiel
 

libraries/auth/cookie.auth.lib.php

@@ -8,12 +8,8 @@
  * @version $Id$
  */
 
-/**
+if (! defined('PHPMYADMIN')) {
- * @todo replace by constant
+    exit;
- * $coming_from_common can be set from outside with register_globals on
- */
-if (!isset($coming_from_common)) {
-   exit;
 }
 
 if (function_exists('mcrypt_encrypt') || PMA_dl('mcrypt')) {

libraries/charset_conversion.lib.php

@@ -5,7 +5,9 @@
  *
  * @version $Id$
  */
-
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * Loads the recode or iconv extensions if any of it is not loaded yet

libraries/check_user_privileges.lib.php

@@ -7,6 +7,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/common.inc.php

@@ -52,6 +52,11 @@ if (version_compare(phpversion(), '6', 'lt')) {
     @ini_set('magic_quotes_runtime', false);
 }
 
+/**
+ * for verification in all procedural scripts under libraries
+ */
+define('PHPMYADMIN', true);
+
 /**
  * core functions
  */
@@ -730,9 +735,6 @@ if (! defined('PMA_MINIMUM_COMMON')) {
         // Gets the authentication library that fits the $cfg['Server'] settings
         // and run authentication
 
-        // (for a quick check of path disclosure in auth/cookies:)
-        $coming_from_common = true;
-
         // to allow HTTP or http
         $cfg['Server']['auth_type'] = strtolower($cfg['Server']['auth_type']);
         if (! file_exists('./libraries/auth/' . $cfg['Server']['auth_type'] . '.auth.lib.php')) {

libraries/database_interface.lib.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/db_common.inc.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * Gets some core libraries

libraries/db_info.inc.php

@@ -34,6 +34,9 @@
  * @uses    addslashes()
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * requirements

libraries/db_links.inc.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/db_routines.inc.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * @todo Support seeing the "results" of the called procedure or

libraries/db_table_exists.lib.php

@@ -6,6 +6,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/dbg/setup.php

@@ -3,6 +3,9 @@
 /**
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * checks for DBG extension and trys to load if not loaded
@@ -24,4 +27,4 @@ if ($GLOBALS['cfg']['DBG']['enable']) {
         $GLOBALS['DBG'] = true;
     }
 }
-?>
+?>

libraries/dbi/mysql.dbi.lib.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/dbi/mysqli.dbi.lib.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 // MySQL client API
 if (!defined('PMA_MYSQL_CLIENT_API')) {

libraries/display_change_password.lib.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 // loic1: autocomplete feature of IE kills the "onchange" event handler and it
 //        must be replaced by the "onpropertychange" one in this case

libraries/display_create_database.lib.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/display_create_table.lib.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/display_export.lib.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/display_import.lib.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/display_select_lang.lib.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * Sorts available languages by their true english names

libraries/display_tbl_links.lib.php

@@ -9,6 +9,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/export/csv.php

@@ -3,6 +3,9 @@
 /**
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * Set of functions used to build CSV dumps of tables

libraries/export/excel.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/export/htmlexcel.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/export/htmlword.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/export/latex.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/export/ods.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/export/odt.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/export/pdf.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/export/sql.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/export/xls.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/export/xml.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/export/yaml.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/footer.inc.php

@@ -1,7 +1,7 @@
 <?php
 /* vim: set expandtab sw=4 ts=4 sts=4: */
 /**
- * finishs HTML output
+ * finishes HTML output
  *
  * updates javascript variables in index.php for coorect working with querywindow
  * and navigation frame refreshing
@@ -44,6 +44,9 @@
  * @uses    file_exists()
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * for PMA_setHistory()

libraries/get_foreign.lib.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/grab_globals.lib.php

@@ -8,6 +8,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * copy values from one array to another, usally from a superglobal into $GLOBALS

libraries/header.inc.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/header_http.inc.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/header_meta_style.inc.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/header_printview.inc.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * Gets a core script and starts output buffering work

libraries/iconv_wrapper.lib.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/import.lib.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * We need to know something about user

libraries/import/csv.php

@@ -6,6 +6,9 @@
  * @todo    add an option for handling NULL values
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/import/docsql.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 require_once './libraries/relation.lib.php';
 $cfgRelation = PMA_getRelationsParam();

libraries/import/ldi.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/import/sql.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/kanji-encoding.lib.php

@@ -11,6 +11,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * Gets the php internal encoding codes and sets the available encoding

libraries/language.lib.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * lang detection is done here

libraries/mcrypt.lib.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * Initialization

libraries/mult_submits.inc.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * Prepares the work and runs some other scripts if required

libraries/mysql_charsets.lib.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/navigation_header.inc.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/opendocument.lib.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/parse_analyze.lib.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/relation.lib.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/relation_cleanup.lib.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/select_lang.lib.php

@@ -5,9 +5,12 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
- * trys to find the language to use
+ * tries to find the language to use
  *
  * @uses    $GLOBALS['cfg']['lang']
  * @uses    $GLOBALS['cfg']['DefaultLang']

libraries/server_common.inc.php

@@ -9,6 +9,9 @@
  * @uses    $userlink
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * Gets some core libraries

libraries/server_links.inc.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * Check parameters

libraries/session.inc.php

@@ -13,6 +13,9 @@
  * @uses    version_compare()
  * @uses    PHP_VERSION
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 // verify if PHP supports session, die if it does not
 

libraries/sql_query_form.lib.php

@@ -10,6 +10,9 @@
  * @usedby  tbl_structure.php
  * @usedby  querywindow.php
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/sqlparser.data.php

@@ -21,6 +21,9 @@
  *
  * @version$Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * @global array MySQL function names

libraries/sqlparser.lib.php

@@ -29,7 +29,9 @@
  *
  * @version $Id$
  */
-
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * Minimum inclusion? (i.e. for the stylesheet builder)

libraries/sqlvalidator.class.php

@@ -27,6 +27,9 @@
 *
 * @version  $Id$
 */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 @include_once 'SOAP/Client.php';
 

libraries/sqlvalidator.lib.php

@@ -29,6 +29,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * We need the PEAR libraries, so do a minimum version check first

libraries/string.lib.php

@@ -22,6 +22,9 @@
  * @uses    defined()
  * @todo a .lib filename should not have code in main(), split or rename file
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /* Try to load mbstring, unless we're using buggy php version */
 if (PMA_PHP_INT_VERSION != 40203) {

libraries/tbl_common.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * Gets some core libraries

libraries/tbl_info.inc.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/tbl_links.inc.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * Check parameters

libraries/tbl_properties.inc.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * Check parameters

libraries/tbl_replace_fields.inc.php

@@ -29,6 +29,9 @@
  * @uses PMA_NO_VARIABLES_IMPORT
  * @uses PMA_sqlAddslashes()
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * do not import request variable into global scope

libraries/tbl_triggers.lib.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 $url_query .= '&goto=tbl_structure.php';