~ubuntu-branches/ubuntu/hardy/phpmyadmin/hardy-updates

« back to all changes in this revision

Viewing changes to libraries/display_change_password.lib.php

  • Committer: Bazaar Package Importer
  • Author(s): Thijs Kinkhorst
  • Date: 2007-10-17 22:54:41 UTC
  • mfrom: (1.1.14 upstream)
  • Revision ID: james.westby@ubuntu.com-20071017225441-xqwg7f10chaprdoe
Tags: 4:2.11.1.2-1

* New upstream release.
* Addresses two cross site scripting issues:
  PMASA-2007-5, PMASA-2007-6
  (CVE-2007-5386, closes: #446451)

Show diffs side-by-side

added added

removed removed

Lines of Context:
 
1
<?php
 
2
/* vim: set expandtab sw=4 ts=4 sts=4: */
 
3
/**
 
4
 * Displays form for password change 
 
5
 *
 
6
 * @version $Id: display_change_password.lib.php 10796 2007-10-16 07:09:50Z cybot_tm $
 
7
 */
 
8
 
 
9
// loic1: autocomplete feature of IE kills the "onchange" event handler and it
 
10
//        must be replaced by the "onpropertychange" one in this case
 
11
$chg_evt_handler = (PMA_USR_BROWSER_AGENT == 'IE' && PMA_USR_BROWSER_VER >= 5)
 
12
                 ? 'onpropertychange'
 
13
                 : 'onchange';
 
14
 
 
15
// Displays the form
 
16
?>
 
17
<form method="post" action="<?php echo $GLOBALS['PMA_PHP_SELF']; ?>" name="chgPassword" onsubmit="return checkPassword(this)">
 
18
    <?php   echo PMA_generate_common_hidden_inputs();
 
19
            if (strpos($GLOBALS['PMA_PHP_SELF'], 'server_privileges') !== false) {
 
20
                echo '<input type="hidden" name="username" value="' . htmlspecialchars($username) . '" />' . "\n"
 
21
                   . '<input type="hidden" name="hostname" value="' . htmlspecialchars($hostname) . '" />' . "\n";
 
22
            }?>
 
23
    <fieldset id="fieldset_change_password">
 
24
        <legend><?php echo $GLOBALS['strChangePassword']; ?></legend>
 
25
            <table class="data">
 
26
            <tr class="odd noclick">
 
27
                <td colspan="2">
 
28
                    <input type="radio" name="nopass" value="1" onclick="pma_pw.value = ''; pma_pw2.value = ''; this.checked = true" />
 
29
            <?php echo $GLOBALS['strNoPassword'] . "\n"; ?>
 
30
                </td>
 
31
            </tr>
 
32
            <tr class="even noclick">
 
33
                <td>
 
34
                    <input type="radio" name="nopass" value="0" onclick="document.getElementById('pw_pma_pw').focus();" checked="checked " />
 
35
            <?php echo $GLOBALS['strPassword']; ?>:&nbsp;
 
36
                </td>
 
37
                <td>
 
38
                    <input type="password" name="pma_pw" id="pw_pma_pw" size="10" class="textfield" <?php echo $chg_evt_handler; ?>="nopass[1].checked = true" />
 
39
            &nbsp;&nbsp;
 
40
            <?php echo $GLOBALS['strReType']; ?>:&nbsp;
 
41
                    <input type="password" name="pma_pw2" id="pw_pma_pw2" size="10" class="textfield" <?php echo $chg_evt_handler; ?>="nopass[1].checked = true" />
 
42
                </td>
 
43
            </tr>
 
44
    <?php
 
45
 
 
46
if (PMA_MYSQL_INT_VERSION >= 40102) {
 
47
    ?>
 
48
    <tr>
 
49
        <td>
 
50
        <?php echo $strPasswordHashing; ?>:
 
51
    </td>
 
52
    <td>
 
53
        <input type="radio" name="pw_hash" id="radio_pw_hash_new" value="new" checked="checked" />
 
54
        <label for="radio_pw_hash_new">
 
55
            MySQL&nbsp;4.1+
 
56
        </label>
 
57
    </td>
 
58
    </tr>
 
59
    <tr>
 
60
        <td>&nbsp;</td>
 
61
    <td>
 
62
        <input type="radio" name="pw_hash" id="radio_pw_hash_old" value="old" />
 
63
        <label for="radio_pw_hash_old">
 
64
            <?php echo $strCompatibleHashing; ?>
 
65
        </label>
 
66
    </td>
 
67
    </tr>
 
68
    <?php
 
69
}
 
70
    ?>
 
71
        </table>
 
72
    </fieldset>
 
73
    <fieldset id="fieldset_change_password_footer" class="tblFooters">
 
74
            <input type="submit" name="change_pw" value="<?php echo($strGo); ?>" />
 
75
    </fieldset>
 
76
</form>