Fix open redirect if Adminer is accessible at //adminer.php%2F@ (thanks to Prakash...

diff --git a/adminer/include/bootstrap.inc.php b/adminer/include/bootstrap.inc.php
index 00baf9191dc01b60bcd7a29ced9708eb5ee692d7..621ec4653a3d61a015ba5fc692718f7e7cc3f106 100644 (file)
--- a/adminer/include/bootstrap.inc.php
+++ b/adminer/include/bootstrap.inc.php
@@ -84,7 +84,7 @@ include "../adminer/drivers/mysql.inc.php"; // must be included as last driver
 
 define("SERVER", $_GET[DRIVER]); // read from pgsql=localhost
 define("DB", $_GET["db"]); // for the sake of speed and size
-define("ME", str_replace(":", "%3a", preg_replace('~^[^?]*/([^?]*).*~', '\1', $_SERVER["REQUEST_URI"])) . '?'
+define("ME", str_replace(":", "%3a", preg_replace('~\?.*~', '', relative_uri())) . '?'
        . (sid() ? SID . '&' : '')
        . (SERVER !== null ? DRIVER . "=" . urlencode(SERVER) . '&' : '')
        . (isset($_GET["username"]) ? "username=" . urlencode($_GET["username"]) . '&' : '')

diff --git a/adminer/include/functions.inc.php b/adminer/include/functions.inc.php
index 787ab79beb68a78e8b0724e20a67efa08f59c72d..adcf1fbd267ebffd4b6dff143404c78c78b170c9 100644 (file)
--- a/adminer/include/functions.inc.php
+++ b/adminer/include/functions.inc.php
@@ -721,12 +721,19 @@ function format_time($start) {
        return lang('%.3f s', max(0, microtime(true) - $start));
 }
 
+/** Get relative REQUEST_URI
+* @return string
+*/
+function relative_uri() {
+       return preg_replace('~^[^?]*/([^?]*)~', '\1', $_SERVER["REQUEST_URI"]);
+}
+
 /** Remove parameter from query string
 * @param string
 * @return string
 */
 function remove_from_uri($param = "") {
-       return substr(preg_replace("~(?<=[?&])($param" . (SID ? "" : "|" . session_name()) . ")=[^&]*&~", '', "$_SERVER[REQUEST_URI]&"), 0, -1);
+       return substr(preg_replace("~(?<=[?&])($param" . (SID ? "" : "|" . session_name()) . ")=[^&]*&~", '', relative_uri() . "&"), 0, -1);
 }
 
 /** Generate page number for pagination

diff --git a/changes.txt b/changes.txt
index 2ff6093df4b9163d0d635ecf1a2fe4ef1d544031..c9028c924bb27d80542d94fc6e40d0e56276e69e 100644 (file)
--- a/changes.txt
+++ b/changes.txt
@@ -1,4 +1,5 @@
 Adminer 4.7.7-dev:
+Fix open redirect if Adminer is accessible at //adminer.php%2F@
 
 Adminer 4.7.6 (released 2020-01-31):
 Speed up alter table form (regression from 4.4.0)