Skip to content

Commit 770a6f3

Browse files
SeigerSeiger
committed
[FIX] CVE-2023-43341-Evolution-Reflected-XSS---Installation-Connection- (GHSA-5h47-9rm5-fx3f).
1 parent fe7f44c commit 770a6f3

3 files changed

Lines changed: 28 additions & 38 deletions

File tree

‎install/src/controllers/connection/collation.php‎

Lines changed: 6 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,22 @@
11
<?php
2-
3-
$host = $_POST['host'];
4-
$uid = $_POST['uid'];
5-
$pwd = $_POST['pwd'];
6-
2+
$method = strip_tags($_POST['method']);
3+
$host = strip_tags($_POST['host']);
4+
$uid = strip_tags($_POST['uid']);
5+
$pwd = strip_tags($_POST['pwd']);
76

87
try {
9-
$dbh = new PDO($_POST['method'] . ':host=' . $_POST['host'] , $_POST['uid'], $_POST['pwd']);
8+
$dbh = new PDO($method . ':host=' . $host, $uid, $pwd);
109
$output = '<select id="database_collation" name="database_collation">';
1110

12-
switch ($_POST['method']) {
11+
switch ($method) {
1312
case 'pgsql':
1413
$output = '<select id="database_collation" name="database_collation">';
1514
$output .= '<option value="utf8mb4_general_ci" selected>utf8mb4_general_ci</option>';
1615
$output .= '</optgroup></select>';
17-
1816
break;
1917
case 'mysql':
2018
$output = '<select id="database_collation" name="database_collation">';
21-
2219
$sql = 'SHOW COLLATION';
23-
2420
$_ = array();
2521
foreach ($dbh->query($sql) as $row) {
2622
$_[$row[0]] = '';
@@ -42,7 +38,6 @@
4238

4339
foreach ($_ as $collation => $selected) {
4440
$collation = htmlentities($collation);
45-
// if(substr($collation,0,4)!=='utf8') continue;
4641
if (strpos($collation, 'sjis') === 0) {
4742
continue;
4843
}

‎install/src/controllers/connection/databasetest.php‎

Lines changed: 17 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,26 @@
11
<?php
2-
3-
$host = $_POST['host'];
4-
$uid = $_POST['uid'];
5-
$pwd = $_POST['pwd'];
2+
$method = strip_tags($_POST['method']);
3+
$host = strip_tags($_POST['host']);
4+
$uid = strip_tags($_POST['uid']);
5+
$pwd = strip_tags($_POST['pwd']);
6+
$tableprefix = strip_tags($_POST['tableprefix']);
7+
$database_name = strip_tags($_POST['database_name']);
68
$installMode = $_POST['installMode'];
79

810
$output = $_lang['status_checking_database'];
911
$h = explode(':', $host, 2);
1012
$database_collation = $_POST['database_collation'];
1113
$database_connection_method = $_POST['database_connection_method'];
1214
$database_charset = substr($database_collation, 0, strpos($database_collation, '_'));
13-
$tableprefix = $_POST['tableprefix'];
14-
if ($_POST['method'] == 'pgsql') {
15+
16+
if ($method == 'pgsql') {
1517
if ($database_charset == 'utf8mb4') $database_charset = 'utf8';
1618
$database_charset = mb_strtoupper($database_charset);
1719
}
1820
try {
19-
$dbh = new PDO($_POST['method'] . ':host=' . $_POST['host'] . ';dbname=' . $_POST['database_name'], $_POST['uid'], $_POST['pwd']);
20-
switch ($_POST['method']) {
21+
$dbh = new PDO($method . ':host=' . $host . ';dbname=' . $database_name, $uid, $pwd);
22+
switch ($method) {
2123
case 'pgsql':
22-
2324
$result = $dbh->query("SELECT * FROM pg_settings WHERE name='client_encoding'");
2425
if ($result->errorCode() == 0) {
2526
$data = $result->fetch();
@@ -42,9 +43,7 @@
4243
$result = $dbh->query("show variables like 'collation_database'");
4344
if ($result->errorCode() == 0) {
4445
$data = $result->fetch();
45-
4646
if ($data['Value'] != $database_collation) {
47-
4847
echo $output . '<span id="database_fail" style="color:#FF0000;">' . sprintf($_lang['status_failed_database_collation_does_not_match'], $data['1']) . '</span>';
4948
exit();
5049
}
@@ -57,10 +56,10 @@
5756
}
5857
$result = $dbh->query("SELECT SCHEMA_NAME
5958
FROM INFORMATION_SCHEMA.SCHEMATA
60-
WHERE SCHEMA_NAME = '" . $_POST['database_name'] . "'");
59+
WHERE SCHEMA_NAME = '" . $pwd . "'");
6160
if ($dbh->errorCode() == 0) {
6261
$data = $result->fetch();
63-
if (isset($data['SCHEMA_NAME']) && $data['SCHEMA_NAME'] == $_POST['database_name']) {
62+
if (isset($data['SCHEMA_NAME']) && $data['SCHEMA_NAME'] == $pwd) {
6463
echo $output . '<span id="database_pass" style="color:#80c000;"> ' . $_lang['status_passed'] . '</span>';
6564
exit();
6665
}
@@ -73,34 +72,30 @@
7372
}
7473

7574
} catch (PDOException $e) {
76-
if (!stristr($e->getMessage(), 'database "' . $_POST['database_name'] . '" does not exist') && !stristr($e->getMessage(), 'Unknown database \'' . $_POST['database_name'] . '\'') && !stristr($e->getMessage(), 'Base table or view not found')) {
75+
if (!stristr($e->getMessage(), 'database "' . $pwd . '" does not exist') && !stristr($e->getMessage(), 'Unknown database \'' . $database_name . '\'') && !stristr($e->getMessage(), 'Base table or view not found')) {
7776
echo $output . '<span id="database_fail" style="color:#FF0000;">' . $_lang['status_failed'] . ' ' . $e->getMessage() . '</span>';
7877
exit();
7978
}
8079
}
8180

8281
try {
83-
$dbh = new PDO($_POST['method'] . ':host=' . $_POST['host'] . ';', $_POST['uid'], $_POST['pwd']);
84-
85-
86-
switch ($_POST['method']) {
82+
$dbh = new PDO($method . ':host=' . $host . ';', $uid, $pwd);
83+
switch ($method) {
8784
case 'pgsql':
88-
8985
try {
90-
$dbh->query('CREATE DATABASE "' . $_POST['database_name'] . '" ENCODING \'' . $database_charset . '\';');
86+
$dbh->query('CREATE DATABASE "' . $database_name . '" ENCODING \'' . $database_charset . '\';');
9187
if ($dbh->errorCode() > 0) {
9288
if (stristr($dbh->errorInfo()[2], 'already exists') === false) {
9389
$output .= '<span id="database_fail" style="color:#FF0000;">' . $_lang['status_failed_could_not_create_database'] . ' ' . print_r($dbh->errorInfo(), true) . '</span>';
9490
}
9591
}
96-
9792
} catch (Exception $exception) {
9893
echo $exception->getMessage();
9994
}
10095

10196
break;
10297
case 'mysql':
103-
$query = 'CREATE DATABASE IF NOT EXISTS `' . $_POST['database_name'] . '` CHARACTER SET ' . $database_charset . ' COLLATE ' . $database_collation . ";";
98+
$query = 'CREATE DATABASE IF NOT EXISTS `' . $database_name . '` CHARACTER SET ' . $database_charset . ' COLLATE ' . $database_collation . ";";
10499
if (!$dbh->query($query)) {
105100
$output .= '<span id="database_fail" style="color:#FF0000;">' . $_lang['status_failed_could_not_create_database'] . '</span>';
106101
echo $output;
@@ -116,9 +111,7 @@
116111
echo $output . '<span id="database_pass" style="color:#80c000;"> ' . $_lang['status_passed'] . '</span>';
117112
exit();
118113
} catch (PDOException $e) {
119-
120114
echo $output . '<span id="database_fail" style="color:#FF0000;">' . $_lang['status_failed'] . ' ' . $e->getMessage() . '</span>';
121-
122115
}
123116

124117
echo $output;

‎install/src/controllers/connection/servertest.php‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,14 @@
11
<?php
2-
2+
$method = strip_tags($_POST['method']);
3+
$host = strip_tags($_POST['host']);
4+
$uid = strip_tags($_POST['uid']);
5+
$pwd = strip_tags($_POST['pwd']);
36

47
$output = $_lang['status_connecting'];
58
try {
6-
$dbh = new PDO($_POST['method'] . ':host=' . $_POST['host'] . ';', $_POST['uid'], $_POST['pwd']);
9+
$dbh = new PDO($method . ':host=' . $host . ';', $uid, $pwd);
710
$output .= '<span id="server_pass" style="color:#80c000;"> ' . $_lang['status_passed_server'] . '</span>';
811
} catch (PDOException $e) {
912
$output .= '<span id="server_fail" style="color:#FF0000;"> ' . $_lang['status_failed'] . ' ' . $e->getMessage() . '</span>';
10-
1113
}
1214
echo $output;

0 commit comments

Comments
 (0)