diff --git a/adminer/drivers/oracle.inc.php b/adminer/drivers/oracle.inc.php index 1d920369..fb31f9b4 100644 --- a/adminer/drivers/oracle.inc.php +++ b/adminer/drivers/oracle.inc.php @@ -167,7 +167,14 @@ if (isset($_GET["oracle"])) { } } - + /** + * @param string $hostPath + * @return bool + */ + function is_server_host_valid($hostPath) { + // EasyConnect host+path format: host[/[service_name][:server_type][/instance_name]] + return (bool)preg_match('~^[^/]+(/([^/:]+)?(:[^/:]+)?(/[^/:]+)?)?$~', $hostPath); + } function idf_escape($idf) { return '"' . str_replace('"', '""', $idf) . '"'; diff --git a/adminer/include/auth.inc.php b/adminer/include/auth.inc.php index c907e823..60db3dd5 100644 --- a/adminer/include/auth.inc.php +++ b/adminer/include/auth.inc.php @@ -35,9 +35,11 @@ function validate_server_input() { auth_error(lang('Invalid server or credentials.')); } - // Allow only host without a path. Note that "localhost" is parsed as path. - $host = (isset($parts['host']) ? $parts['host'] : '') . (isset($parts['path']) ? $parts['path'] : ''); - if (strpos(rtrim($host, '/'), '/') !== false) { + // Note that "localhost" and IP address without a scheme is parsed as a path. + $hostPath = (isset($parts['host']) ? $parts['host'] : '') . (isset($parts['path']) ? $parts['path'] : ''); + + // Validate host. + if (!is_server_host_valid($hostPath)) { auth_error(lang('Invalid server or credentials.')); } @@ -47,6 +49,17 @@ function validate_server_input() { } } +if (!function_exists('is_server_host_valid')) { + /** + * @param string $hostPath + * @return bool + */ + function is_server_host_valid($hostPath) + { + return strpos($hostPath, '/') === false; + } +} + /** * @param string $server * @param string $username diff --git a/plugins/drivers/clickhouse.php b/plugins/drivers/clickhouse.php index 251bf155..c9b38486 100644 --- a/plugins/drivers/clickhouse.php +++ b/plugins/drivers/clickhouse.php @@ -240,6 +240,15 @@ if (isset($_GET["clickhouse"])) { return apply_queries("DROP TABLE", $tables); } + /** + * @param string $hostPath + * @return bool + */ + function is_server_host_valid($hostPath) + { + return strpos(rtrim($hostPath, '/'), '/') === false; + } + function connect() { global $adminer; $connection = new Min_DB; diff --git a/plugins/drivers/elastic5.php b/plugins/drivers/elastic5.php index 1fdf79a6..b83f83d8 100644 --- a/plugins/drivers/elastic5.php +++ b/plugins/drivers/elastic5.php @@ -273,6 +273,15 @@ if (isset($_GET["elastic5"])) { } } + /** + * @param string $hostPath + * @return bool + */ + function is_server_host_valid($hostPath) + { + return strpos(rtrim($hostPath, '/'), '/') === false; + } + function connect() { $connection = new Min_DB; diff --git a/plugins/drivers/simpledb.php b/plugins/drivers/simpledb.php index 5decfd5b..6a2cde57 100644 --- a/plugins/drivers/simpledb.php +++ b/plugins/drivers/simpledb.php @@ -280,7 +280,14 @@ if (isset($_GET["simpledb"])) { } - + /** + * @param string $hostPath + * @return bool + */ + function is_server_host_valid($hostPath) + { + return strpos(rtrim($hostPath, '/'), '/') === false; + } function connect() { global $adminer;