FM / phpmyadmin

/usr/share/phpmyadmin

Name	Size	Mode	Actions
doc/	-	0755	rm
js/	-	0755	rm
libraries/	-	0755	rm
locale/	-	0755	rm
sql/	-	0755	rm
templates/	-	0755	rm
themes/	-	0755	rm
autoload.php	57190	0644	edit dl rm
config.inc.php	4474	0644	edit dl rm
config.sample.inc.php	4474	0644	edit dl rm
favicon.ico	22486	0644	edit dl rm
index.php	413	0644	edit dl rm
print.css	1034	0644	edit dl rm
robots.txt	26	0644	edit dl rm
show_config_errors.php	1354	0644	edit dl rm
url.php	1613	0644	edit dl rm

Edit: /usr/share/phpmyadmin/url.php (1613B)

<?php
/**
 * URL redirector to avoid leaking Referer with some sensitive information.
 */

declare(strict_types=1);

use PhpMyAdmin\Core;
use PhpMyAdmin\DatabaseInterface;
use PhpMyAdmin\Response;
use PhpMyAdmin\Sanitize;

if (! defined('ROOT_PATH')) {
    // phpcs:disable PSR1.Files.SideEffects
    define('ROOT_PATH', __DIR__ . DIRECTORY_SEPARATOR);
    // phpcs:enable
}

global $containerBuilder, $dbi;

// phpcs:disable PSR1.Files.SideEffects
define('PMA_MINIMUM_COMMON', true);
// phpcs:enable

require_once ROOT_PATH . 'libraries/common.inc.php';

// Load database service because services.php is not available here
$dbi = DatabaseInterface::load();
$containerBuilder->set(DatabaseInterface::class, $dbi);

// Only output the http headers
$response = Response::getInstance();
$response->getHeader()->sendHttpHeaders();
$response->disable();

if (! Core::isValid($_GET['url'])
    || ! preg_match('/^https:\/\/[^\n\r]*$/', $_GET['url'])
    || ! Core::isAllowedDomain($_GET['url'])
) {
    Core::sendHeaderLocation('./');
} else {
    // JavaScript redirection is necessary. Because if header() is used
    //  then web browser sometimes does not change the HTTP_REFERER
    //  field and so with old URL as Referer, token also goes to
    //  external site.
    $template = $containerBuilder->get('template');
    echo $template->render('javascript/redirect', [
        'url' => Sanitize::escapeJsString($_GET['url']),
    ]);
    // Display redirecting msg on screen.
    // Do not display the value of $_GET['url'] to avoid showing injected content
    echo __('Taking you to the target site.');
}
die;

set(DatabaseInterface::class, $dbi); // Only output the http headers $response = Response::getInstance(); $response->getHeader()->sendHttpHeaders(); $response->disable(); if (! Core::isValid($_GET['url']) || ! preg_match('/^https:\/\/[^\n\r]*$/', $_GET['url']) || ! Core::isAllowedDomain($_GET['url']) ) { Core::sendHeaderLocation('./'); } else { // JavaScript redirection is necessary. Because if header() is used // then web browser sometimes does not change the HTTP_REFERER // field and so with old URL as Referer, token also goes to // external site. $template = $containerBuilder->get('template'); echo $template->render('javascript/redirect', [ 'url' => Sanitize::escapeJsString($_GET['url']), ]); // Display redirecting msg on screen. // Do not display the value of $_GET['url'] to avoid showing injected content echo __('Taking you to the target site.'); } die;