From 694f7ef519368ee1661dcc6ac5bea262cd9d215d Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Tue, 11 Oct 2005 13:36:37 +0000 Subject: [PATCH] bug #1322871, local file inclusion --- ChangeLog | 9 ++++----- libraries/grab_globals.lib.php | 4 +++- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/ChangeLog b/ChangeLog index 251da7176..06f80e6df 100755 --- a/ChangeLog +++ b/ChangeLog @@ -1,10 +1,13 @@ ----------------------- +---------------------- phpMyAdmin - Changelog ---------------------- $Id$ $Source$ +2005-10-11 Marc Delisle + * libraries/grab_globals.lib.php: bug #1322871, local file inclusion + 2005-10-11 Sebastian Mendel * footer.inc.php, index.php, left.php, queryframe.php, querywindow.php server_databases.php, css/phpmyadmin.css.php, libraries/common.lib.php @@ -13,10 +16,6 @@ $Source$ themes/original/css/theme_left.css.php: XHTML 1.0 trans. compliance and more semantic XHTML output -CVS-Vorgang erfolgreich abgeschlossen - - - 2005-10-09 Marc Delisle * tbl_properties_links.php: invalid js confirmation and operation feedback when dropping a view diff --git a/libraries/grab_globals.lib.php b/libraries/grab_globals.lib.php index 774ebd88a..64b68579e 100644 --- a/libraries/grab_globals.lib.php +++ b/libraries/grab_globals.lib.php @@ -101,7 +101,9 @@ if (isset($goto) && strpos(' ' . $goto, '/') > 0 && substr($goto, 0, 2) != './') } // end if if ( ! empty( $__redirect ) ) { - require('./' . $__redirect); + // TODO: ensure that PMA_securePath() is defined and available + // for this script. Meanwhile we duplicate what this function does: + require('./' . preg_replace('@\.\.*@','.',$__redirect)); exit(); } // end if ( ! empty( $__redirect ) ) ?>