mirror of
https://github.com/vrana/adminer.git
synced 2026-02-13 10:07:42 +01:00
Avoid denial-of-service via version check (GHSA-q4f2-39gr-45jh, regression from 4.6.2)
This commit is contained in:
@@ -11,13 +11,12 @@ class AdminerVersionGithub extends Adminer\Plugin {
|
||||
function head($dark = null) {
|
||||
?>
|
||||
<script <?php echo Adminer\nonce(); ?>>
|
||||
verifyVersion = (current, url, token) => {
|
||||
verifyVersion = current => {
|
||||
// dummy value to prevent repeated verifications after AJAX failure
|
||||
cookie('adminer_version=0', 1);
|
||||
ajax('https://api.github.com/repos/vrana/adminer/releases/latest', request => {
|
||||
const response = JSON.parse(request.responseText);
|
||||
const version = response.tag_name.replace(/^v/, '');
|
||||
// we don't save to adminer.version because the response is not signed; also GitHub can handle our volume of requests
|
||||
// we don't display the version here because we don't have version_compare(); design.inc.php will display it on the next load
|
||||
cookie('adminer_version=' + version, 1);
|
||||
}, null, null);
|
||||
|
||||
Reference in New Issue
Block a user