From 0fae40fb611b5c8167fa2b8d40bf576a8935a380 Mon Sep 17 00:00:00 2001
From: Jakub Vrana <jakub@vrana.cz>
Date: Tue, 16 Jan 2018 11:18:32 +0100
Subject: [PATCH] Disallow connecting to privileged ports (thanks to hyp3rlinx)

---
 adminer/include/auth.inc.php | 4 ++++
 adminer/lang/cs.inc.php      | 1 +
 changes.txt                  | 1 +
 3 files changed, 6 insertions(+)

diff --git a/adminer/include/auth.inc.php b/adminer/include/auth.inc.php
index 7921bc5e..944c929a 100644
--- a/adminer/include/auth.inc.php
+++ b/adminer/include/auth.inc.php
@@ -165,6 +165,10 @@ if (isset($_GET["username"])) {
 		page_footer("auth");
 		exit;
 	}
+	list($host, $port) = explode(":", SERVER, 2);
+	if (is_numeric($port) && $port < 1024) {
+		auth_error('Connecting to privileged ports is not allowed.');
+	}
 	check_invalid_login();
 	$connection = connect();
 }
diff --git a/adminer/lang/cs.inc.php b/adminer/lang/cs.inc.php
index 42ae2810..7944df8d 100644
--- a/adminer/lang/cs.inc.php
+++ b/adminer/lang/cs.inc.php
@@ -20,6 +20,7 @@ $translations = array(
 	'If you did not send this request from Adminer then close this page.' => 'Pokud jste tento požadavek neposlali z Adminera, tak tuto stránku zavřete.',
 	'No extension' => 'Žádné rozšíření',
 	'None of the supported PHP extensions (%s) are available.' => 'Není dostupné žádné z podporovaných PHP rozšíření (%s).',
+	'Connecting to privileged ports is not allowed.' => 'Připojování k privilegovaným portům není povoleno.',
 	'Session support must be enabled.' => 'Session proměnné musí být povolené.',
 	'Session expired, please login again.' => 'Session vypršela, přihlašte se prosím znovu.',
 	'%s version: %s through PHP extension %s' => 'Verze %s: %s přes PHP rozšíření %s',
diff --git a/changes.txt b/changes.txt
index a2964d55..8f728b92 100644
--- a/changes.txt
+++ b/changes.txt
@@ -2,6 +2,7 @@ Adminer 4.4.0-dev:
 Add Content Security Policy
 Disallow scripts without nonce
 Rate limit password-less login attempts from the same IP address
+Disallow connecting to privileged ports
 Add nosniff header
 PHP 7.1: Prevent warning when using empty limit
 MySQL: Remove dedicated view for replication status (added in 4.3.0)