beenull/adminerevo
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

Disallow connecting to privileged ports (thanks to hyp3rlinx)

Browse source
This commit is contained in:
Jakub Vrana 2018-01-16 11:18:32 +01:00
parent 0e5df34ea8
commit 0fae40fb61
3 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
adminer/include/auth.inc.php
View file

@ -165,6 +165,10 @@ if (isset($_GET["username"])) {
page_footer("auth");
exit;
}
list($host, $port) = explode(":", SERVER, 2);
if (is_numeric($port) && $port < 1024) {
auth_error('Connecting to privileged ports is not allowed.');
}
check_invalid_login();
$connection = connect();
}

1
adminer/lang/cs.inc.php
View file

@ -20,6 +20,7 @@ $translations = array(
'If you did not send this request from Adminer then close this page.' => 'Pokud jste tento požadavek neposlali z Adminera, tak tuto stránku zavřete.',
'No extension' => 'Žádné rozšíření',
'None of the supported PHP extensions (%s) are available.' => 'Není dostupné žádné z podporovaných PHP rozšíření (%s).',
'Connecting to privileged ports is not allowed.' => 'Připojování k privilegovaným portům není povoleno.',
'Session support must be enabled.' => 'Session proměnné musí být povolené.',
'Session expired, please login again.' => 'Session vypršela, přihlašte se prosím znovu.',
'%s version: %s through PHP extension %s' => 'Verze %s: %s přes PHP rozšíření %s',

1
changes.txt
View file

@ -2,6 +2,7 @@ Adminer 4.4.0-dev:
Add Content Security Policy
Disallow scripts without nonce
Rate limit password-less login attempts from the same IP address
Disallow connecting to privileged ports
Add nosniff header
PHP 7.1: Prevent warning when using empty limit
MySQL: Remove dedicated view for replication status (added in 4.3.0)