From: Jakub Vrana <jakub@vrana.cz>
Date: Tue, 22 Oct 2019 06:30:32 +0000 (+0200)
Subject: Fix XSS if Adminer is accessible at URL /data:
X-Git-Tag: v4.7.4~1
X-Git-Url: https://git.joonet.de/?a=commitdiff_plain;h=789ebc07bdac01ab8b99ad831eba872849eaa7fe;p=adminer.git

Fix XSS if Adminer is accessible at URL /data:
---

diff --git a/adminer/include/bootstrap.inc.php b/adminer/include/bootstrap.inc.php
index 9f09b326..00baf919 100644
--- a/adminer/include/bootstrap.inc.php
+++ b/adminer/include/bootstrap.inc.php
@@ -84,7 +84,7 @@ include "../adminer/drivers/mysql.inc.php"; // must be included as last driver
 
 define("SERVER", $_GET[DRIVER]); // read from pgsql=localhost
 define("DB", $_GET["db"]); // for the sake of speed and size
-define("ME", preg_replace('~^[^?]*/([^?]*).*~', '\1', $_SERVER["REQUEST_URI"]) . '?'
+define("ME", str_replace(":", "%3a", preg_replace('~^[^?]*/([^?]*).*~', '\1', $_SERVER["REQUEST_URI"])) . '?'
 	. (sid() ? SID . '&' : '')
 	. (SERVER !== null ? DRIVER . "=" . urlencode(SERVER) . '&' : '')
 	. (isset($_GET["username"]) ? "username=" . urlencode($_GET["username"]) . '&' : '')
diff --git a/changes.txt b/changes.txt
index 6d9f3a53..c07a8df0 100644
--- a/changes.txt
+++ b/changes.txt
@@ -1,4 +1,5 @@
 Adminer 4.7.4-dev:
+Fix XSS if Adminer is accessible at URL /data:
 
 Adminer 4.7.3 (released 2019-08-27):
 Allow editing foreign keys pointing to tables in other database/schema (bug #694)