diff options
author | ioguix | 2007-05-28 17:30:32 +0000 |
---|---|---|
committer | ioguix | 2007-05-28 17:30:32 +0000 |
commit | c3e9de01d38223ee37cd97f7a936547a27713b95 (patch) | |
tree | 0260aa992701ad10854a95076860014697624edc | |
parent | e1c7117e140c352ce0c49aec6e765b6f2333a621 (diff) |
fix xss vulnerability on PHP_SELF
-rw-r--r-- | aggregates.php | 3 | ||||
-rw-r--r-- | all_db.php | 3 | ||||
-rw-r--r-- | casts.php | 3 | ||||
-rw-r--r-- | colproperties.php | 1 | ||||
-rw-r--r-- | constraints.php | 3 | ||||
-rw-r--r-- | conversions.php | 3 | ||||
-rwxr-xr-x | database.php | 3 | ||||
-rw-r--r-- | display.php | 3 | ||||
-rw-r--r-- | domains.php | 3 | ||||
-rw-r--r-- | functions.php | 3 | ||||
-rw-r--r-- | groups.php | 3 | ||||
-rw-r--r-- | indexes.php | 3 | ||||
-rw-r--r-- | info.php | 3 | ||||
-rw-r--r-- | languages.php | 3 | ||||
-rw-r--r-- | libraries/lib.inc.php | 5 | ||||
-rwxr-xr-x | login.php | 8 | ||||
-rw-r--r-- | operators.php | 3 | ||||
-rwxr-xr-x | plugin_slony.php | 3 | ||||
-rw-r--r-- | privileges.php | 3 | ||||
-rw-r--r-- | reports.php | 3 | ||||
-rw-r--r-- | roles.php | 3 | ||||
-rw-r--r-- | rules.php | 3 | ||||
-rwxr-xr-x | schemas.php | 3 | ||||
-rw-r--r-- | sequences.php | 3 | ||||
-rw-r--r-- | servers.php | 3 | ||||
-rw-r--r-- | sql.php | 4 | ||||
-rw-r--r-- | sqledit.php | 3 | ||||
-rw-r--r-- | tables.php | 3 | ||||
-rwxr-xr-x | tablespaces.php | 3 | ||||
-rw-r--r-- | tblproperties.php | 3 | ||||
-rw-r--r-- | triggers.php | 3 | ||||
-rw-r--r-- | types.php | 3 | ||||
-rw-r--r-- | users.php | 3 | ||||
-rwxr-xr-x | viewproperties.php | 3 | ||||
-rw-r--r-- | views.php | 3 |
35 files changed, 41 insertions, 70 deletions
diff --git a/aggregates.php b/aggregates.php index 09510105..5a4202dd 100644 --- a/aggregates.php +++ b/aggregates.php @@ -3,7 +3,7 @@ /** * Manage aggregates in a database * - * $Id: aggregates.php,v 1.20 2007/05/03 17:01:03 ioguix Exp $ + * $Id: aggregates.php,v 1.21 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; if (!isset($msg)) $msg = ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * Actually creates the new aggregate in the database @@ -3,7 +3,7 @@ /** * Manage databases within a server * - * $Id: all_db.php,v 1.52 2007/05/16 17:03:51 ioguix Exp $ + * $Id: all_db.php,v 1.53 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; if (!isset($msg)) $msg = ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * Display a form for alter and perform actual alter @@ -3,7 +3,7 @@ /** * Manage casts in a database * - * $Id: casts.php,v 1.12 2005/11/25 08:49:08 jollytoad Exp $ + * $Id: casts.php,v 1.13 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; if (!isset($msg)) $msg = ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * Show default list of casts in the database diff --git a/colproperties.php b/colproperties.php index 06b5d121..e51356fa 100644 --- a/colproperties.php +++ b/colproperties.php @@ -16,7 +16,6 @@ $tableName =& $_REQUEST['view']; else die("No table provided!"); - $PHP_SELF = $_SERVER['PHP_SELF']; /** * Displays a screen where they can alter a column diff --git a/constraints.php b/constraints.php index 5eb9ea71..c9cb436b 100644 --- a/constraints.php +++ b/constraints.php @@ -3,7 +3,7 @@ /** * List constraints on a table * - * $Id: constraints.php,v 1.46 2007/05/02 16:12:06 ioguix Exp $ + * $Id: constraints.php,v 1.47 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions @@ -11,7 +11,6 @@ include_once('./classes/class.select.php'); $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * Confirm and then actually add a FOREIGN KEY constraint diff --git a/conversions.php b/conversions.php index 2c2e255f..7c22dd27 100644 --- a/conversions.php +++ b/conversions.php @@ -3,7 +3,7 @@ /** * Manage conversions in a database * - * $Id: conversions.php,v 1.12 2005/11/25 08:49:08 jollytoad Exp $ + * $Id: conversions.php,v 1.13 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; if (!isset($msg)) $msg = ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * Show default list of conversions in the database diff --git a/database.php b/database.php index 5625526e..db5607ba 100755 --- a/database.php +++ b/database.php @@ -3,7 +3,7 @@ /** * Manage schemas within a database * - * $Id: database.php,v 1.96 2007/04/24 15:31:29 soranzo Exp $ + * $Id: database.php,v 1.97 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; if (!isset($msg)) $msg = ''; - $PHP_SELF = $_SERVER['PHP_SELF']; function _highlight($string, $term) { return str_replace($term, "<b>{$term}</b>", $string); diff --git a/display.php b/display.php index 47ebbc7b..a793d752 100644 --- a/display.php +++ b/display.php @@ -9,7 +9,7 @@ * @param $return_desc The return link name * @param $page The current page * - * $Id: display.php,v 1.61 2007/04/22 00:41:58 mr-russ Exp $ + * $Id: display.php,v 1.62 2007/05/28 17:30:32 ioguix Exp $ */ // Prevent timeouts on large exports (non-safe mode only) @@ -21,7 +21,6 @@ global $conf, $lang; $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * Show confirmation of edit and perform actual update diff --git a/domains.php b/domains.php index 5bd88196..45fc06f0 100644 --- a/domains.php +++ b/domains.php @@ -3,7 +3,7 @@ /** * Manage domains in a database * - * $Id: domains.php,v 1.28 2007/05/03 17:01:03 ioguix Exp $ + * $Id: domains.php,v 1.29 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; if (!isset($msg)) $msg = ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * Function to save after altering a domain diff --git a/functions.php b/functions.php index 0e1017f7..67f5334a 100644 --- a/functions.php +++ b/functions.php @@ -3,7 +3,7 @@ /** * Manage functions in a database * - * $Id: functions.php,v 1.63 2007/05/03 17:01:03 ioguix Exp $ + * $Id: functions.php,v 1.64 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; if (!isset($msg)) $msg = ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * Function to save after editing a function @@ -3,7 +3,7 @@ /** * Manage groups in a database cluster * - * $Id: groups.php,v 1.23 2007/05/03 17:01:03 ioguix Exp $ + * $Id: groups.php,v 1.24 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; if (!isset($msg)) $msg = ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * Add user to a group diff --git a/indexes.php b/indexes.php index 4de43c68..d17496cb 100644 --- a/indexes.php +++ b/indexes.php @@ -3,7 +3,7 @@ /** * List indexes on a table * - * $Id: indexes.php,v 1.40 2007/05/02 16:12:07 ioguix Exp $ + * $Id: indexes.php,v 1.41 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions @@ -11,7 +11,6 @@ include_once('./classes/class.select.php'); $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * Show confirmation of cluster index and perform actual cluster @@ -3,14 +3,13 @@ /** * List extra information on a table * - * $Id: info.php,v 1.13 2007/01/26 17:55:42 soranzo Exp $ + * $Id: info.php,v 1.14 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions include_once('./libraries/lib.inc.php'); $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * List all the information on the table diff --git a/languages.php b/languages.php index d692a02f..d5322d18 100644 --- a/languages.php +++ b/languages.php @@ -3,7 +3,7 @@ /** * Manage languages in a database * - * $Id: languages.php,v 1.10 2005/11/25 08:49:08 jollytoad Exp $ + * $Id: languages.php,v 1.11 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; if (!isset($msg)) $msg = ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * Show default list of languages in the database diff --git a/libraries/lib.inc.php b/libraries/lib.inc.php index 01e32a07..8ee8bcbe 100644 --- a/libraries/lib.inc.php +++ b/libraries/lib.inc.php @@ -3,8 +3,11 @@ /** * Function library read in upon startup * - * $Id: lib.inc.php,v 1.113 2007/04/18 14:06:14 mr-russ Exp $ + * $Id: lib.inc.php,v 1.114 2007/05/28 17:30:32 ioguix Exp $ */ + + $PHP_SELF = htmlentities($_SERVER['PHP_SELF']); + include_once('./libraries/decorator.inc.php'); include_once('./lang/translations.php'); @@ -3,14 +3,16 @@ /** * Login screen * - * $Id: login.php,v 1.34 2007/04/24 14:49:00 soranzo Exp $ + * $Id: login.php,v 1.35 2007/05/28 17:30:32 ioguix Exp $ */ global $conf; // This needs to be an include once to prevent lib.inc.php infinite recursive includes. // Check to see if the configuration file exists, if not, explain require_once('./libraries/lib.inc.php'); - + + global $PHP_SELF; + $misc->printHeader($lang['strlogin']); $misc->printBody(); $misc->printTrail('root'); @@ -22,7 +24,7 @@ if (isset($msg)) $misc->printMsg($msg); ?> -<form action="<?php echo $_SERVER['PHP_SELF'] ?>" method="post" name="login_form"> +<form action="<?php echo $PHP_SELF ?>" method="post" name="login_form"> <?php if (!empty($_POST)) $vars =& $_POST; else $vars =& $_GET; diff --git a/operators.php b/operators.php index d9b2d8cd..918c9fee 100644 --- a/operators.php +++ b/operators.php @@ -3,7 +3,7 @@ /** * Manage operators in a database * - * $Id: operators.php,v 1.25 2007/05/03 17:01:03 ioguix Exp $ + * $Id: operators.php,v 1.26 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; if (!isset($msg)) $msg = ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * Show read only properties for an operator diff --git a/plugin_slony.php b/plugin_slony.php index a1813a2b..1993bcc5 100755 --- a/plugin_slony.php +++ b/plugin_slony.php @@ -3,14 +3,13 @@ /** * Slony database tab plugin * - * $Id: plugin_slony.php,v 1.18 2007/05/03 17:01:03 ioguix Exp $ + * $Id: plugin_slony.php,v 1.19 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions include_once('./libraries/lib.inc.php'); $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; - $PHP_SELF = $_SERVER['PHP_SELF']; // Avoid database connections whenever possible switch ($action) { diff --git a/privileges.php b/privileges.php index 76a1992b..baa6b6e8 100644 --- a/privileges.php +++ b/privileges.php @@ -3,7 +3,7 @@ /** * Manage privileges in a database * - * $Id: privileges.php,v 1.41 2007/04/23 18:48:06 soranzo Exp $ + * $Id: privileges.php,v 1.42 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; if (!isset($msg)) $msg = ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * Grant permissions on an object to a user diff --git a/reports.php b/reports.php index e4f4407f..909dc1b6 100644 --- a/reports.php +++ b/reports.php @@ -3,14 +3,13 @@ /** * List reports in a database * - * $Id: reports.php,v 1.28 2007/05/03 17:01:03 ioguix Exp $ + * $Id: reports.php,v 1.29 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions include_once('./libraries/lib.inc.php'); $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * Displays a screen where they can edit a report @@ -3,7 +3,7 @@ /** * Manage roles in a database cluster * - * $Id: roles.php,v 1.6 2007/05/03 17:01:03 ioguix Exp $ + * $Id: roles.php,v 1.7 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; if (!isset($msg)) $msg = ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * Displays a screen for create a new role @@ -3,14 +3,13 @@ /** * List rules on a table OR view * - * $Id: rules.php,v 1.28 2007/05/02 16:12:07 ioguix Exp $ + * $Id: rules.php,v 1.29 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions include_once('./libraries/lib.inc.php'); $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * Confirm and then actually create a rule diff --git a/schemas.php b/schemas.php index 862a23b3..984ccf49 100755 --- a/schemas.php +++ b/schemas.php @@ -3,7 +3,7 @@ /** * Manage schemas in a database * - * $Id: schemas.php,v 1.14 2007/05/03 17:01:03 ioguix Exp $ + * $Id: schemas.php,v 1.15 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; if (!isset($msg)) $msg = ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * Show default list of schemas in the database diff --git a/sequences.php b/sequences.php index f3cd2db5..09effdcd 100644 --- a/sequences.php +++ b/sequences.php @@ -3,7 +3,7 @@ /** * Manage sequences in a database * - * $Id: sequences.php,v 1.39 2007/05/03 17:01:03 ioguix Exp $ + * $Id: sequences.php,v 1.40 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; if (!isset($msg)) $msg = ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * Display list of all sequences in the database/schema diff --git a/servers.php b/servers.php index f966263e..53d59c65 100644 --- a/servers.php +++ b/servers.php @@ -3,7 +3,7 @@ /** * Manage servers * - * $Id: servers.php,v 1.7 2007/05/03 17:01:03 ioguix Exp $ + * $Id: servers.php,v 1.8 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions @@ -12,7 +12,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; if (!isset($msg)) $msg = ''; - $PHP_SELF = $_SERVER['PHP_SELF']; function doLogout() { global $misc, $lang, $_reload_browser; @@ -6,7 +6,7 @@ * how many SQL statements have been strung together with semi-colons * @param $query The SQL query string to execute * - * $Id: sql.php,v 1.35 2007/04/22 00:41:58 mr-russ Exp $ + * $Id: sql.php,v 1.36 2007/05/28 17:30:32 ioguix Exp $ */ // Prevent timeouts on large exports (non-safe mode only) @@ -95,8 +95,6 @@ exit; } - $PHP_SELF = $_SERVER['PHP_SELF']; - $misc->printHeader($lang['strqueryresults']); $misc->printBody(); $misc->printTrail('database'); diff --git a/sqledit.php b/sqledit.php index db916ffb..6be582b5 100644 --- a/sqledit.php +++ b/sqledit.php @@ -3,7 +3,7 @@ /** * Alternative SQL editing window * - * $Id: sqledit.php,v 1.33 2007/04/24 15:31:29 soranzo Exp $ + * $Id: sqledit.php,v 1.34 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; if (!isset($msg)) $msg = ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * Private function to display server and list of databases @@ -3,14 +3,13 @@ /** * List tables in a database * - * $Id: tables.php,v 1.96 2007/05/16 17:03:51 ioguix Exp $ + * $Id: tables.php,v 1.97 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions include_once('./libraries/lib.inc.php'); $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * Displays a screen where they can enter a new table diff --git a/tablespaces.php b/tablespaces.php index cdade039..1b09b9ca 100755 --- a/tablespaces.php +++ b/tablespaces.php @@ -3,7 +3,7 @@ /** * Manage tablespaces in a database cluster * - * $Id: tablespaces.php,v 1.12 2007/01/15 15:48:17 soranzo Exp $ + * $Id: tablespaces.php,v 1.13 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; if (!isset($msg)) $msg = ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * Function to allow altering of a tablespace diff --git a/tblproperties.php b/tblproperties.php index 08cbdb53..a1d9a8ce 100644 --- a/tblproperties.php +++ b/tblproperties.php @@ -3,14 +3,13 @@ /** * List tables in a database * - * $Id: tblproperties.php,v 1.80 2007/05/14 17:59:32 soranzo Exp $ + * $Id: tblproperties.php,v 1.81 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions include_once('./libraries/lib.inc.php'); $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * Function to save after altering a table diff --git a/triggers.php b/triggers.php index e81bdfae..b55e6950 100644 --- a/triggers.php +++ b/triggers.php @@ -3,7 +3,7 @@ /** * List triggers on a table * - * $Id: triggers.php,v 1.32 2007/05/02 16:12:07 ioguix Exp $ + * $Id: triggers.php,v 1.33 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions @@ -11,7 +11,6 @@ include_once('./classes/class.select.php'); $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * Function to save after altering a trigger @@ -3,7 +3,7 @@ /** * Manage types in a database * - * $Id: types.php,v 1.35 2007/05/03 17:01:03 ioguix Exp $ + * $Id: types.php,v 1.36 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; if (!isset($msg)) $msg = ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * Show read only properties for a type @@ -3,7 +3,7 @@ /** * Manage users in a database cluster * - * $Id: users.php,v 1.35 2007/04/23 15:22:29 soranzo Exp $ + * $Id: users.php,v 1.36 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; if (!isset($msg)) $msg = ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * If a user is not a superuser, then we have an 'account management' page diff --git a/viewproperties.php b/viewproperties.php index ab51dd21..18c52d5f 100755 --- a/viewproperties.php +++ b/viewproperties.php @@ -3,14 +3,13 @@ /** * List views in a database * - * $Id: viewproperties.php,v 1.27 2007/05/14 17:59:32 soranzo Exp $ + * $Id: viewproperties.php,v 1.28 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions include_once('./libraries/lib.inc.php'); $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * Function to save after editing a view @@ -3,7 +3,7 @@ /** * Manage views in a database * - * $Id: views.php,v 1.69 2007/05/03 17:01:03 ioguix Exp $ + * $Id: views.php,v 1.70 2007/05/28 17:30:32 ioguix Exp $ */ // Include application functions @@ -12,7 +12,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; if (!isset($msg)) $msg = ''; - $PHP_SELF = $_SERVER['PHP_SELF']; /** * Ask for select parameters and perform select |