beenull/adminerevo
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

Escape : also in remove_from_param

Browse source
This commit is contained in:
Jakub Vrana 2020-05-11 12:35:19 +02:00
parent ac40be998d
commit 4e2a448e28
4 changed files with 5 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
adminer/include/bootstrap.inc.php
View file

@ -84,7 +84,7 @@ include "../adminer/drivers/mysql.inc.php"; // must be included as last driver
define("SERVER", $_GET[DRIVER]); // read from pgsql=localhost
define("DB", $_GET["db"]); // for the sake of speed and size
define("ME", str_replace(":", "%3a", preg_replace('~\?.*~', '', relative_uri())) . '?'
define("ME", preg_replace('~\?.*~', '', relative_uri()) . '?'
. (sid() ? SID . '&' : '')
. (SERVER !== null ? DRIVER . "=" . urlencode(SERVER) . '&' : '')
. (isset($_GET["username"]) ? "username=" . urlencode($_GET["username"]) . '&' : '')

2
adminer/include/functions.inc.php
View file

@ -725,7 +725,7 @@ function format_time($start) {
* @return string
*/
function relative_uri() {
return preg_replace('~^[^?]*/([^?]*)~', '\1', $_SERVER["REQUEST_URI"]);
return str_replace(":", "%3a", preg_replace('~^[^?]*/([^?]*)~', '\1', $_SERVER["REQUEST_URI"]));
}
/** Remove parameter from query string

2
adminer/include/version.inc.php
View file

@ -1,2 +1,2 @@
<?php
$VERSION = "4.7.7";
$VERSION = "4.7.8-dev";

2
changes.txt
View file

@ -1,3 +1,5 @@
Adminer 4.7.8-dev:
Adminer 4.7.7 (released 2020-05-11):
Fix open redirect if Adminer is accessible at //adminer.php%2F@