From: Jakub Vrana Date: Sat, 13 Jan 2018 21:17:00 +0000 (+0100) Subject: Disallow scripts without nonce X-Git-Tag: v4.4.0~19 X-Git-Url: https://git.joonet.de/?a=commitdiff_plain;h=80d030f51a9323b7ab774641ffdb4d2752e3753d;p=adminer.git Disallow scripts without nonce --- diff --git a/adminer/include/adminer.inc.php b/adminer/include/adminer.inc.php index aed9e0e3..736889eb 100644 --- a/adminer/include/adminer.inc.php +++ b/adminer/include/adminer.inc.php @@ -420,7 +420,7 @@ class Adminer { echo "
" . lang('Action') . "
"; echo ""; echo " "; - echo "$trailing"; + return "$source$trailing"; } /** Return \n"; + return "\n"; +} + +/** Get a nonce="" attribute with CSP nonce +* @return string +*/ +function nonce() { + return ' nonce="' . get_nonce() . '"'; } /** Escape for HTML @@ -1242,7 +1249,7 @@ function slow_query($query) { if (support("kill") && is_object($connection2 = connect()) && ($db == "" || $connection2->select_db($db))) { $kill = $connection2->result(connection_id()); // MySQL and MySQLi can use thread_id but it's not in PDO_MySQL ?> -