Port content spoofing fix

Signed-off-by: Marc Delisle <marc@infomarc.info>
phpmyadmin · Oct 23, 2015 · cd09765 · cd09765
1 parent 95b5d9a
commit cd09765
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 1 deletion.
diff --git a/ChangeLog b/ChangeLog
@@ -142,6 +142,10 @@ phpMyAdmin - ChangeLog
 - issue #11448 Clarify doc about the MemoryLimit directive
 - issue #11489 Cannot copy a database under certain conditions
 
+4.4.15.1 (2015-10-23)
+- issue #11464 phpMyAdmin suggests upgrading to newer version not usable on that system
+- issue        [security] Content spoofing on url.php
+
 4.4.15.0 (2015-09-20)
 - issue #11411 Undefined "replace" function on numeric scalar
 - issue #11421 Stored-proc / routine - broken parameter parsing

diff --git a/url.php b/url.php
@@ -32,6 +32,7 @@
             }
         </script>";
     // Display redirecting msg on screen.
-    printf(__('Taking you to %s.'), htmlspecialchars($_REQUEST['url']));
+    // Do not display the value of $_REQUEST['url'] to avoid showing injected content
+    echo __('Taking you to the target site.');
 }
 die();