nettika/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

first part of security fixes

Browse Source
This commit is contained in:
Marc Delisle
2006-09-26 19:23:24 +00:00
parent ea998c3766
commit b3906852bb
3 changed files with 21 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
libraries/common.lib.php
View File

@@ -2740,7 +2740,16 @@ if (get_magic_quotes_gpc()) {
PMA_arrayWalkRecursive($_REQUEST, 'stripslashes', true); PMA_arrayWalkRecursive($_REQUEST, 'stripslashes', true);
} }
require_once './libraries/session.inc.php'; /**
* Check for numeric keys
* (if register_globals is on, we'll find a numeric key here)
*/
foreach ($GLOBALS as $key => $dummy) {
if (is_numeric($key)) {
die('numeric key detected');
}
}
/** /**
* include deprecated grab_globals only if required * include deprecated grab_globals only if required
@@ -2749,6 +2758,11 @@ if (empty($__redirect) && !defined('PMA_NO_VARIABLES_IMPORT')) {
require './libraries/grab_globals.lib.php'; require './libraries/grab_globals.lib.php';
} }
/**
* include session handling after the globals, to avoid overwriting
*/
require_once './libraries/session.inc.php';
/** /**
* init some variables LABEL_variables_init * init some variables LABEL_variables_init
*/ */

1
libraries/session.inc.php
View File

@@ -84,6 +84,7 @@ ini_set('session.save_handler', 'files');
/** /**
* Token which is used for authenticating access queries. * Token which is used for authenticating access queries.
* (we use "space PMA_token space" to prevent overwriting)
*/ */
if (!isset($_SESSION[' PMA_token '])) { if (!isset($_SESSION[' PMA_token '])) {
$_SESSION[' PMA_token '] = md5(uniqid(rand(), true)); $_SESSION[' PMA_token '] = md5(uniqid(rand(), true));