protection against XSS when register_globals is on and .htaccess has no effect

ChangeLog

@@ -89,6 +89,8 @@ danbarry
 - bug #1981043 [export] HTML in exports getting corrupted,
   thanks to Jason Judge - jasonjudge
 - bug #1936761 [interface] BINARY not treated as BLOB: update/delete issues
+- protection against XSS when register_globals is on and .htaccess has
+  no effect, thanks to Tim Starling
 - bug #1996943 [export] Firefox 3 and .sql.gz (corrupted); detect Gecko 1.9,
   thanks to Jürgen Wind - windkiel
 

libraries/auth/cookie.auth.lib.php

@@ -8,8 +8,8 @@
  * @version $Id$
  */
 
-if (! defined('PMA_COMING_FROM_COMMON')) {
-   exit;
+if (! defined('PHPMYADMIN')) {
+    exit;
 }
 
 require './libraries/auth/swekey/swekey.auth.lib.php';

libraries/charset_conversion.lib.php

@@ -5,7 +5,9 @@
  *
  * @version $Id$
  */
-
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * Loads the recode or iconv extensions if any of it is not loaded yet

libraries/check_user_privileges.lib.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/common.inc.php

@@ -54,6 +54,11 @@ if (version_compare(phpversion(), '6', 'lt')) {
     @ini_set('magic_quotes_runtime', false);
 }
 
+/**
+ * for verification in all procedural scripts under libraries
+ */
+define('PHPMYADMIN', true);
+
 /**
  * core functions
  */
@@ -781,9 +786,6 @@ if (! defined('PMA_MINIMUM_COMMON')) {
         // Gets the authentication library that fits the $cfg['Server'] settings
         // and run authentication
 
-        // (for a quick check of path disclosure in auth/cookies:)
-        define('PMA_COMING_FROM_COMMON', true);
-
         // to allow HTTP or http
         $cfg['Server']['auth_type'] = strtolower($cfg['Server']['auth_type']);
         if (! file_exists('./libraries/auth/' . $cfg['Server']['auth_type'] . '.auth.lib.php')) {

libraries/database_interface.lib.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/db_common.inc.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * Gets some core libraries

libraries/db_events.inc.php

@@ -4,6 +4,10 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
+
 $url_query .= '&goto=db_structure.php';
 
 $events = PMA_DBI_fetch_result('SELECT EVENT_NAME, EVENT_TYPE FROM information_schema.EVENTS WHERE EVENT_SCHEMA= \'' . PMA_sqlAddslashes($db,true) . '\';');

libraries/db_info.inc.php

@@ -33,6 +33,9 @@
  * @uses    addslashes()
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * requirements

libraries/db_links.inc.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/db_routines.inc.php

@@ -14,6 +14,10 @@
  *       Also, support DEFINER (like we do in export).
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
+
 $url_query .= '&goto=db_structure.php';
 
 $routines = PMA_DBI_fetch_result('SELECT SPECIFIC_NAME,ROUTINE_NAME,ROUTINE_TYPE,DTD_IDENTIFIER FROM information_schema.ROUTINES WHERE ROUTINE_SCHEMA= \'' . PMA_sqlAddslashes($db,true) . '\';');

libraries/db_table_exists.lib.php

@@ -6,6 +6,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/dbg/setup.php

@@ -3,6 +3,9 @@
 /**
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * checks for DBG extension and trys to load if not loaded

libraries/dbi/mysql.dbi.lib.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * MySQL client API

libraries/dbi/mysqli.dbi.lib.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 // MySQL client API
 if (!defined('PMA_MYSQL_CLIENT_API')) {

libraries/display_change_password.lib.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 // loic1: autocomplete feature of IE kills the "onchange" event handler and it
 //        must be replaced by the "onpropertychange" one in this case

libraries/display_create_database.lib.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/display_create_table.lib.php

@@ -24,6 +24,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/display_export.lib.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/display_import.lib.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/display_select_lang.lib.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * Sorts available languages by their true english names

libraries/display_tbl_links.lib.php

@@ -9,6 +9,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/export/codegen.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 // this gets executed twice so avoid a notice
 if (! defined('CG_FORMAT_NHIBERNATE_CS')) {

libraries/export/csv.php

@@ -3,6 +3,9 @@
 /**
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * Set of functions used to build CSV dumps of tables

libraries/export/excel.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/export/htmlexcel.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/export/htmlword.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/export/latex.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/export/ods.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/export/odt.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/export/pdf.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/export/sql.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/export/texytext.php

@@ -3,6 +3,9 @@
 /**
  * Sample export to Texy! text.
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/export/xls.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/export/xml.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/export/yaml.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/footer.inc.php

@@ -43,6 +43,9 @@
  * @uses    file_exists()
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * for PMA_setHistory()

libraries/grab_globals.lib.php

@@ -8,6 +8,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * copy values from one array to another, usally from a superglobal into $GLOBALS

libraries/header.inc.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/header_http.inc.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/header_meta_style.inc.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/header_printview.inc.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * Gets a core script and starts output buffering work

libraries/header_scripts.inc.php

@@ -4,6 +4,9 @@
  *
  * @version $Id: header.inc.php 10719 2007-10-04 15:03:44Z cybot_tm $
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/iconv_wrapper.lib.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/import.lib.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * We need to know something about user

libraries/import/csv.php

@@ -6,6 +6,9 @@
  * @todo    add an option for handling NULL values
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/import/docsql.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 require_once './libraries/relation.lib.php';
 $cfgRelation = PMA_getRelationsParam();

libraries/import/ldi.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/import/sql.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/kanji-encoding.lib.php

@@ -11,6 +11,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * Gets the php internal encoding codes and sets the available encoding

libraries/mult_submits.inc.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * Prepares the work and runs some other scripts if required

libraries/mysql_charsets.lib.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/navigation_header.inc.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/opendocument.lib.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/parse_analyze.lib.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/relation.lib.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/relation_cleanup.lib.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/select_lang.lib.php

@@ -5,6 +5,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * tries to find the language to use

libraries/server_common.inc.php

@@ -9,6 +9,9 @@
  * @uses    $userlink
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * Gets some core libraries

libraries/server_links.inc.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * Check parameters

libraries/session.inc.php

@@ -11,6 +11,9 @@
  * @uses    session_start()
  * @uses    ini_set()
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 // verify if PHP supports session, die if it does not
 

libraries/sql_query_form.lib.php

@@ -10,6 +10,9 @@
  * @usedby  tbl_structure.php
  * @usedby  querywindow.php
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/sqlparser.data.php

@@ -21,6 +21,9 @@
  *
  * @version$Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * @global array MySQL function names

libraries/sqlparser.lib.php

@@ -29,7 +29,9 @@
  *
  * @version $Id$
  */
-
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * Minimum inclusion? (i.e. for the stylesheet builder)

libraries/sqlvalidator.class.php

@@ -27,6 +27,9 @@
 *
 * @version  $Id$
 */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 @include_once 'SOAP/Client.php';
 

libraries/sqlvalidator.lib.php

@@ -29,6 +29,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * We need the PEAR libraries, so do a minimum version check first

libraries/string.lib.php

@@ -21,6 +21,9 @@
  * @uses    defined()
  * @todo a .lib filename should not have code in main(), split or rename file
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /* Try to load mbstring */
     if (!@extension_loaded('mbstring')) {

libraries/tbl_common.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * Gets some core libraries

libraries/tbl_info.inc.php

@@ -8,6 +8,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  *

libraries/tbl_links.inc.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * Check parameters

libraries/tbl_properties.inc.php

@@ -6,6 +6,9 @@
  * included by tbl_addfield.php, -_alter.php, -_create.php
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * Check parameters

libraries/tbl_replace_fields.inc.php

@@ -29,6 +29,9 @@
  * @uses PMA_NO_VARIABLES_IMPORT
  * @uses PMA_sqlAddslashes()
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 /**
  * do not import request variable into global scope

libraries/tbl_triggers.lib.php

@@ -4,6 +4,9 @@
  *
  * @version $Id$
  */
+if (! defined('PHPMYADMIN')) {
+    exit;
+}
 
 $url_query .= '&goto=tbl_structure.php';