Menu

#4725 (ok 4.4) checks missing before using variables from sessionStorage

4.3.7
fixed
navigation (12)
Low
2015-04-01
2015-01-21
No

From Alexander Kamp's comment on https://sourceforge.net/p/phpmyadmin/bugs/4710/:-

"You can question yourself the way parts of the navigation pane are saved temporary.
Generated HTML can be a risk when you don't verify it the next time you use it. (tested by adjusting variables -> it injects code into page). Maybe rebuilding from JSON data or add hash+check is an option."

Discussion

  • Marc Delisle

    Marc Delisle - 2015-02-15
    • Priority: 5 --> Normal
     
  • Atul Pratap Singh

    Opinions are welcome on how important is this problem and hence on possible fixes?
    Also, if I am not wrong, we decided to store navi tree html in sessionstorage to maintain its state on reload (particularly for non-current database nodes of the tree), we may try to implement this state maintenance some other way?
    More so because on a reload a user actually expects all elements on page to get renewed for any changes on server-side, but currently to actually renew the navigation you need to click on "Reload navigation panel" link, and it doesn't get renewed on browser page reload..

     
  • Atul Pratap Singh

    • labels: --> navigation
    • summary: checks missing before using variables from sessionStorage --> (ok 4.4) checks missing before using variables from sessionStorage
    • status: open --> resolved
    • assigned_to: Atul Pratap Singh
    • Priority: Normal --> Low
     
  • Marc Delisle

    Marc Delisle - 2015-04-01
    • Status: resolved --> fixed