Fix XSS vulnerability on PHP_SELF

diff --git a/HISTORY b/HISTORY
index ea541a50797e4dac5ae52618fad6265857dbf924..560c8764e46664450435fedb89bee9db8e19cf0e 100644 (file)
--- a/HISTORY
+++ b/HISTORY
@@ -9,6 +9,9 @@ Bugs
 * Fix PHP5 Strict mode complaints 
 * Fix IN/NOT IN to accept text input lists 'a','b'.
 * Fix bytea doesn't display as NULL when NULL
+* Fix XSS vulnerability:
+   http://www.securityfocus.com/bid/24115/
+  Escape HTML special characters before using $_SERVER['PHP_SELF']
 
 Version 4.1.1
 -------------

diff --git a/dataexport.php b/dataexport.php
index 14e2ceab48a938fe5e914cddcd8bd460c9951f2a..5fc001e998b6e5f1ff5620a1b9d723d83871af9b 100644 (file)
--- a/dataexport.php
+++ b/dataexport.php
@@ -4,7 +4,7 @@
         * Does an export to the screen or as a download.  This checks to
         * see if they have pg_dump set up, and will use it if possible.
         *
-        * $Id: dataexport.php,v 1.24 2007/01/15 15:48:17 soranzo Exp $
+        * $Id: dataexport.php,v 1.23.2.1 2007/05/28 19:30:17 soranzo Exp $
         */
 
        $extensions = array(
@@ -124,7 +124,7 @@
                                echo " FROM stdin;\n";
                                while (!$rs->EOF) {
                                        $first = true;
-                                       while(list($k, $v) = each($rs->fields)) {
+                                       while(list($k, $v) = each($rs->f)) {
                                                // Escape value
                                                $v = $data->escapeBytea($v);
                                                
@@ -154,7 +154,7 @@
                                if (!$rs->EOF) {
                                        // Output header row
                                        $j = 0;
-                                       foreach ($rs->fields as $k => $v) {
+                                       foreach ($rs->f as $k => $v) {
                                                $finfo = $rs->fetchField($j++);
                                                if ($finfo->name == $data->id && !$oids) continue;
                                                echo "\t\t<th>", $misc->printVal($finfo->name, true), "</th>\r\n";
@@ -164,7 +164,7 @@
                                while (!$rs->EOF) {
                                        echo "\t<tr>\r\n";
                                        $j = 0;
-                                       foreach ($rs->fields as $k => $v) {
+                                       foreach ($rs->f as $k => $v) {
                                                $finfo = $rs->fetchField($j++);
                                                if ($finfo->name == $data->id && !$oids) continue;
                                                echo "\t\t<td>", $misc->printVal($v, true, $finfo->type), "</td>\r\n";
@@ -186,7 +186,7 @@
                                        // Output header row
                                        $j = 0;
                                        echo "\t<header>\n";
-                                       foreach ($rs->fields as $k => $v) {
+                                       foreach ($rs->f as $k => $v) {
                                                $finfo = $rs->fetchField($j++);
                                                $name = htmlspecialchars($finfo->name);
                                                $type = htmlspecialchars($finfo->type);
@@ -198,7 +198,7 @@
                                while (!$rs->EOF) {
                                        $j = 0;
                                        echo "\t\t<row>\n";
-                                       foreach ($rs->fields as $k => $v) {
+                                       foreach ($rs->f as $k => $v) {
                                                $finfo = $rs->fetchField($j++);
                                                $name = htmlspecialchars($finfo->name);
                                                if ($v != null) $v = htmlspecialchars($v);
@@ -216,7 +216,7 @@
                                        echo "INSERT INTO \"{$_REQUEST['table']}\" (";
                                        $first = true;
                                        $j = 0;
-                                       foreach ($rs->fields as $k => $v) {
+                                       foreach ($rs->f as $k => $v) {
                                                $finfo = $rs->fetchField($j++);
                                                $k = $finfo->name;
                                                // SQL (INSERT) format cannot handle oids
@@ -259,7 +259,7 @@
                                if (!$rs->EOF) {
                                        // Output header row
                                        $first = true;
-                                       foreach ($rs->fields as $k => $v) {
+                                       foreach ($rs->f as $k => $v) {
                                                $finfo = $rs->fetchField($k);
                                                $v = $finfo->name;
                                                if ($v != null) $v = str_replace('"', '""', $v);
@@ -273,7 +273,7 @@
                                }
                                while (!$rs->EOF) {
                                        $first = true;
-                                       foreach ($rs->fields as $k => $v) {
+                                       foreach ($rs->f as $k => $v) {
                                                if ($v != null) $v = str_replace('"', '""', $v);
                                                if ($first) {
                                                        echo ($v == null) ? "\"\\N\"" : "\"{$v}\"";
@@ -307,7 +307,7 @@
                $misc->printTitle($lang['strexport']);
                if (isset($msg)) $misc->printMsg($msg);
 
-               echo "<form action=\"{$_SERVER['PHP_SELF']}\" method=\"post\">\n";
+               echo "<form action=\"{$PHP_SELF}\" method=\"post\">\n";
                echo "<table>\n";
                echo "<tr><th class=\"data\">{$lang['strformat']}:</th><td><select name=\"d_format\">\n";
                // COPY and SQL require a table

diff --git a/intro.php b/intro.php
index 6f87251ffd3c0af03392f07ff3b28d3a1cc9b615..b462bb00f673b66c9383d576217847705cd9a2ed 100755 (executable)
--- a/intro.php
+++ b/intro.php
@@ -3,7 +3,7 @@
        /**
         * Intro screen
         *
-        * $Id: intro.php,v 1.16 2006/12/31 16:58:59 soranzo Exp $
+        * $Id: intro.php,v 1.15.6.1 2007/05/28 19:30:17 soranzo Exp $
         */
 
        // Include application functions (no db conn)
@@ -19,7 +19,8 @@
 
 <h1><?php echo "$appName $appVersion (PHP ". phpversion() .')' ?></h1>
 
-<form method="get" action="<?php echo $_SERVER['PHP_SELF'] ?>">
+<form method="get" action="<?php echo $PHP_SELF; ?>">
+ <label>
   <select name="language" onchange="this.form.submit()">
 <?php
        $language = isset($_SESSION['webdbLanguage']) ? $_SESSION['webdbLanguage'] : 'english';
@@ -31,6 +32,7 @@
 ?>
   </select>
   <noscript><input type="submit" value="<?php echo $lang['stralter'] ?>" /></noscript>
+ </label>
 </form>
 
 <p><?php echo $lang['strintro'] ?></p>

diff --git a/libraries/lib.inc.php b/libraries/lib.inc.php
index 4d1bc1077d315e07ed98ddf1d244a7f237398ef8..cda3baf5832de96183040566c10ca4860f1b92d0 100644 (file)
--- a/libraries/lib.inc.php
+++ b/libraries/lib.inc.php
@@ -3,10 +3,11 @@
        /**
         * Function library read in upon startup
         *
-        * $Id: lib.inc.php,v 1.111.2.2 2007/05/28 17:21:57 ioguix Exp $
+        * $Id: lib.inc.php,v 1.111.2.3 2007/05/28 19:30:17 soranzo Exp $
         */
 
-       $PHP_SELF = htmlentities($_SERVER['PHP_SELF']);
+       // Prevent XSS attacks
+       $PHP_SELF = htmlspecialchars($_SERVER['PHP_SELF']);
 
        include_once('./libraries/decorator.inc.php');
        include_once('./lang/translations.php');