diff --git a/adminer/include/auth.inc.php b/adminer/include/auth.inc.php index 964f1d90..67a59484 100644 --- a/adminer/include/auth.inc.php +++ b/adminer/include/auth.inc.php @@ -162,7 +162,7 @@ stop_session(true); if (isset($_GET["username"]) && is_string(get_password())) { list($host, $port) = explode(":", SERVER, 2); - if (+$port && ($port < 1024 || $port > 65535)) { + if (preg_match('~^\s*([-+]?\d+)~', $port, $match) && ($match[1] < 1024 || $match[1] > 65535)) { // is_numeric('80#') would still connect to port 80 auth_error(lang('Connecting to privileged ports is not allowed.')); } check_invalid_login(); diff --git a/changes.txt b/changes.txt index 2757183c..3efc970b 100644 --- a/changes.txt +++ b/changes.txt @@ -3,6 +3,7 @@ Fix XSS in browsers which don't encode URL parameters (bug #775, regression from Elasticsearch, ClickHouse: Do not print response if HTTP code is not 200 Don't syntax highlight during IME composition (bug #747) MySQL: Do not export names in quotes with sql_mode='ANSI_QUOTES' (bug #749) +MySQL: Avoid error in PHP 8 when connecting to socket (PR #409) PostgreSQL: Export all FKs after all CREATE TABLE (PR #351) PostgreSQL: Fix dollar-quoted syntax highlighting (bug #738) PostgreSQL: Do not show view definition from other schema (PR #392)