From fad722d2f488375f9cc94c0c75326e661c280ecc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@cihar.com>
Date: Tue, 2 May 2006 09:28:42 +0000
Subject: [PATCH] Escape user input (CVE-2006-2031).

---
 ChangeLog                         |  4 ++++
 libraries/Theme_Manager.class.php | 12 ++++++------
 libraries/select_lang.lib.php     |  6 +++---
 3 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index bb4cc76c2..353e83f2f 100755
--- a/ChangeLog
+++ b/ChangeLog
@@ -5,6 +5,10 @@ phpMyAdmin - ChangeLog
 $Id$
 $Source$
 
+2006-05-02 Michal Čihař  <michal@cihar.com>
+    * libraries/select_lang.lib.php, libraries/Theme_Manager.class.php: Escape
+      user input (CVE-2006-2031).
+
 2006-04-28 Michal Čihař  <michal@cihar.com>
     * Documentation.html, main.php, libraries/config.default.php: Possibility
       to hide creating of database from main (RFE #1370100).
diff --git a/libraries/Theme_Manager.class.php b/libraries/Theme_Manager.class.php
index 16813e53d..997668cfa 100644
--- a/libraries/Theme_Manager.class.php
+++ b/libraries/Theme_Manager.class.php
@@ -101,10 +101,10 @@ class PMA_Theme_Manager {
 
         if ( ! $this->checkTheme($GLOBALS['cfg']['ThemeDefault'])) {
             $GLOBALS['PMA_errors'][] = sprintf( $GLOBALS['strThemeDefaultNotFound'],
-                $GLOBALS['cfg']['ThemeDefault'] );
+                htmlspecialchars($GLOBALS['cfg']['ThemeDefault']));
             trigger_error(
                 sprintf($GLOBALS['strThemeDefaultNotFound'],
-                    $GLOBALS['cfg']['ThemeDefault']),
+                    htmlspecialchars($GLOBALS['cfg']['ThemeDefault'])),
                 E_USER_WARNING);
             $GLOBALS['cfg']['ThemeDefault'] = false;
         }
@@ -141,9 +141,9 @@ class PMA_Theme_Manager {
     {
         if ( ! $this->checkTheme($theme)) {
             $GLOBALS['PMA_errors'][] = sprintf($GLOBALS['strThemeNotFound'],
-                PMA_sanitize($theme));
+                htmlspecialchars($theme));
             trigger_error(
-                sprintf($GLOBALS['strThemeNotFound'], PMA_sanitize($theme)),
+                sprintf($GLOBALS['strThemeNotFound'], htmlspecialchars($theme)),
                 E_USER_WARNING);
             return false;
         }
@@ -217,10 +217,10 @@ class PMA_Theme_Manager {
         if (! is_dir($folder)) {
             $GLOBALS['PMA_errors'][] =
                 sprintf($GLOBALS['strThemePathNotFound'],
-                    $folder);
+                    htmlspecialchars($folder));
             trigger_error(
                 sprintf($GLOBALS['strThemePathNotFound'],
-                    $folder),
+                    htmlspecialchars($folder)),
                 E_USER_WARNING);
             return false;
         }
diff --git a/libraries/select_lang.lib.php b/libraries/select_lang.lib.php
index cde0cffa6..f618766e9 100644
--- a/libraries/select_lang.lib.php
+++ b/libraries/select_lang.lib.php
@@ -409,13 +409,13 @@ require_once $lang_file;
 
 // now, that we have loaded the language strings we can send the errors
 if ($lang_failed_cfg) {
-    $GLOBALS['PMA_errors'][] = sprintf($strLanguageUnknown, $lang_failed_cfg);
+    $GLOBALS['PMA_errors'][] = sprintf($strLanguageUnknown, htmlspecialchars($lang_failed_cfg));
 }
 if ($lang_failed_cookie) {
-    $GLOBALS['PMA_errors'][] = sprintf($strLanguageUnknown, $lang_failed_cookie);
+    $GLOBALS['PMA_errors'][] = sprintf($strLanguageUnknown, htmlspecialchars($lang_failed_cookie));
 }
 if ($lang_failed_request) {
-    $GLOBALS['PMA_errors'][] = sprintf($strLanguageUnknown, $lang_failed_request);
+    $GLOBALS['PMA_errors'][] = sprintf($strLanguageUnknown, htmlspecialchars($lang_failed_request));
 }
 
 unset($strLanguageFileNotFound, $line, $fall_back_lang,