beenull/adminerevo
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

Fix XSS in browsers which don't encode URL parameters (bug #775)

Browse source
This commit is contained in:
Jakub Vrana 2021-02-06 19:04:15 +01:00
parent cde988853d
commit 5c395afc09
2 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
adminer/sql.inc.php
View file

@ -222,7 +222,7 @@ if (!isset($_GET["import"])) {
}
echo "<p>";
textarea("query", $q, 20);
echo script(($_POST ? "" : "qs('textarea').focus();\n") . "qs('#form').onsubmit = partial(sqlSubmit, qs('#form'), '" . remove_from_uri("sql|limit|error_stops|only_errors") . "');");
echo script(($_POST ? "" : "qs('textarea').focus();\n") . "qs('#form').onsubmit = partial(sqlSubmit, qs('#form'), '" . js_escape(remove_from_uri("sql|limit|error_stops|only_errors|history")) . "');");
echo "<p>$execute\n";
echo lang('Limit rows') . ": <input type='number' name='limit' class='size' value='" . h($_POST ? $_POST["limit"] : $_GET["limit"]) . "'>\n";

1
changes.txt
View file

@ -1,4 +1,5 @@
Adminer 4.7.9-dev:
Fix XSS in browsers which don't encode URL parameters (bug #775, regression from 4.7.0)
Elasticsearch, ClickHouse: Do not print response if HTTP code is not 200
Don't syntax highlight during IME composition (bug #747)
MySQL: Do not export names in quotes with sql_mode='ANSI_QUOTES' (bug #749)