Fix XSS if Adminer is accessible at URL /data:

diff --git a/adminer/include/bootstrap.inc.php b/adminer/include/bootstrap.inc.php
index 9f09b3269875691947177b33d513e281852eb7a2..00baf9191dc01b60bcd7a29ced9708eb5ee692d7 100644 (file)
--- a/adminer/include/bootstrap.inc.php
+++ b/adminer/include/bootstrap.inc.php
@@ -84,7 +84,7 @@ include "../adminer/drivers/mysql.inc.php"; // must be included as last driver
 
 define("SERVER", $_GET[DRIVER]); // read from pgsql=localhost
 define("DB", $_GET["db"]); // for the sake of speed and size
-define("ME", preg_replace('~^[^?]*/([^?]*).*~', '\1', $_SERVER["REQUEST_URI"]) . '?'
+define("ME", str_replace(":", "%3a", preg_replace('~^[^?]*/([^?]*).*~', '\1', $_SERVER["REQUEST_URI"])) . '?'
        . (sid() ? SID . '&' : '')
        . (SERVER !== null ? DRIVER . "=" . urlencode(SERVER) . '&' : '')
        . (isset($_GET["username"]) ? "username=" . urlencode($_GET["username"]) . '&' : '')

diff --git a/changes.txt b/changes.txt
index 6d9f3a53872c53442e2217d6f2f587a342e76706..c07a8df07351f15134b5137146e628db7e1d16ac 100644 (file)
--- a/changes.txt
+++ b/changes.txt
@@ -1,4 +1,5 @@
 Adminer 4.7.4-dev:
+Fix XSS if Adminer is accessible at URL /data:
 
 Adminer 4.7.3 (released 2019-08-27):
 Allow editing foreign keys pointing to tables in other database/schema (bug #694)