Merge remote-tracking branch 'origin/pull/12805' into QA_4_6

ChangeLog

@@ -15,6 +15,7 @@ phpMyAdmin - ChangeLog
 - issue #12786 Fixed database searching
 - issue #12792 Fixed javascript error on new version link
 - issue #12785 Add information about required and suggested extensions to composer.json
+- issue #12434 Improve documentation for servers running with Suhosin
 
 4.6.5.2 (2016-12-05)
 - issue #12765 Fixed SQL export with newlines

doc/faq.rst

@@ -521,6 +521,23 @@ parameters:
   php.net/suhosin/configuration.html#logging_configuration>`_ should not
   include :term:`SQL`, otherwise you get big
   slowdown
+* `suhosin.sql.union <https://suhosin.org/stories/configuration.html#suhosin-
+  sql-union>`_ must be disabled (which is the default).
+* `suhosin.sql.multiselect <https://suhosin.org/stories/configuration.html#
+  suhosin-sql-multiselect>`_ must be disabled (which is the default).
+* `suhosin.sql.comment <https://suhosin.org/stories/configuration.html#suhosin-
+  sql-comment>`_ must be disabled (which is the default).
+
+To further improve security, we also recommend these modifications:
+
+* `suhosin.executor.include.max\_traversal <https://suhosin.org/stories/
+  configuration.html#suhosin-executor-include-max-traversal>`_ should be
+  enabled as a mitigation against local file inclusion attacks. We suggest
+  setting this to 2 as ``../`` is used with the ReCaptcha library.
+* `suhosin.cookie.encrypt <https://suhosin.org/stories/configuration.html#
+  suhosin-cookie-encrypt>`_ should be enabled.
+* `suhosin.executor.disable_emodifier <https://suhosin.org/stories/config
+  uration.html#suhosin-executor-disable-emodifier>`_ should be enabled.
 
 You can also disable the warning using the :config:option:`$cfg['SuhosinDisableWarning']`.