CVE-2013-3239

@@ -272,10 +272,10 @@ function PMA_exportOutputHandler($line)
                 'Export/file_template_table', $filename_template);
         }
     }
-    // remove dots in template to avoid a remote code execution vulnerability
-    $filename_template = str_replace('.', '', $filename_template);
     $filename = PMA_expandUserString($filename_template);
-    $filename = PMA_sanitize_filename($filename);
+    // remove dots in filename (coming from either the template or already
+    // part of the filename) to avoid a remote code execution vulnerability
+    $filename = PMA_sanitize_filename($filename, $replaceDots = true);
 
     // Grab basic dump extension and mime type
     // Check if the user already added extension; get the substring where the extension would be if it was included

@@ -134,18 +134,29 @@ function PMA_sanitize($message, $escape = false, $safe = false)
 
 
 /**
- * Sanitize a filename by removing anything besides A-Za-z0-9_.-
+ * Sanitize a filename by removing anything besides legit characters 
  *
  * Intended usecase:
- *    When using a filename in a Content-Disposition header the value should not contain ; or "
+ *    When using a filename in a Content-Disposition header the value
+ *    should not contain ; or "
+ *
+ *    When exporting, avoiding generation of an unexpected double-extension file
  *
  * @param   string  The filename
+ * @param   boolean Whether to also replace dots 
  *
  * @return  string  the sanitized filename
  *
  */
-function PMA_sanitize_filename($filename) {
-    $filename = preg_replace('/[^A-Za-z0-9_.-]/', '_', $filename);
+function PMA_sanitize_filename($filename, $replaceDots = false) {
+    $pattern = '/[^A-Za-z0-9_';
+    // if we don't have to replace dots
+    if (! $replaceDots) {
+        // then add the dot to the list of legit characters
+        $pattern .= '.';
+    }
+    $pattern .= '-]/';
+    $filename = preg_replace($pattern, '_', $filename);
     return $filename;
 }
 

@@ -272,6 +272,8 @@ function PMA_exportOutputHandler($line)
                 'Export/file_template_table', $filename_template);
         }
     }
+    // remove dots in template to avoid a remote code execution vulnerability
+    $filename_template = str_replace('.', '', $filename_template);
     $filename = PMA_expandUserString($filename_template);
     $filename = PMA_sanitize_filename($filename);