gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'QA_4_6' into QA_4_6-security

Browse Source
This commit is contained in:
Michal Čihař 2016-06-17 11:20:18 +02:00
commit 1d2e2be925
3 changed files with 43 additions and 48 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
libraries/DatabaseInterface.php
View File

@ -206,30 +206,9 @@ class DatabaseInterface
// Get and slightly format backtrace, this is used
// in the javascript console.
// Strip call to _dbgQuery
$dbgInfo['trace'] = array_slice(debug_backtrace(), 1);
foreach ($dbgInfo['trace'] as $key => $step) {
if (isset($step['file'])) {
$dbgInfo['trace'][$key]['file'] = Error::relPath($step['file']);
}
// We don't need object value in console and it's too big
if (isset($step['object'])) {
unset($dbgInfo['trace'][$key]['object']);
}
// Convert args to string as that's what the client would do anyway
if (isset($step['args'])) {
$simplified = array();
foreach ($step['args'] as $akey => $aval) {
if (is_object($aval)) {
$simplified[$akey] = '<Class:' . get_class($aval) . '>';
} elseif (is_array($aval)) {
$simplified[$akey] = var_export($aval, true);
} else {
$simplified[$akey] = $aval;
}
}
$dbgInfo['trace'][$key]['args'] = $simplified;
}
}
$dbgInfo['trace'] = Error::processBacktrace(
array_slice(debug_backtrace(), 1)
);
$dbgInfo['hash'] = md5($query);
$_SESSION['debug']['queries'][] = $dbgInfo;

60
libraries/Error.php
View File

@ -106,6 +106,41 @@ class Error extends Message
$this->setBacktrace($backtrace);
}
/**
* Process backtrace to avoid path disclossures, objects and so on
*
* @param array $backtrace backtrace
*
* @return array
*/
public static function processBacktrace($backtrace)
{
$result = array();
$members = array('file', 'line', 'function', 'class', 'type');
foreach ($backtrace as $idx => $step) {
/* Create new backtrace entry */
$result[$idx] = array();
/* Store members we want */
foreach ($members as $name) {
if (isset($step[$name])) {
$result[$idx][$name] = $step[$name];
}
}
/* Store simplified args */
if (isset($step['args'])) {
foreach ($step['args'] as $key => $arg) {
$result[$idx]['args'][$key] = Error::getArg($arg, $step['function']);
}
}
}
return $result;
}
/**
* sets PMA\libraries\Error::$_backtrace
*
@ -117,28 +152,7 @@ class Error extends Message
*/
public function setBacktrace($backtrace)
{
$this->backtrace = array();
$members = array('file', 'line', 'function', 'class', 'type');
foreach ($backtrace as $idx => $step) {
/* Create new backtrace entry */
$this->backtrace[$idx] = array();
/* Store members we want */
foreach ($members as $name) {
if (isset($step[$name])) {
$this->backtrace[$idx][$name] = $step[$name];
}
}
/* Store simplified args */
if (isset($step['args'])) {
foreach ($step['args'] as $key => $arg) {
$this->backtrace[$idx]['args'][$key] = Error::getArg($arg, $step['function']);
}
}
}
$this->backtrace = Error::processBacktrace($backtrace);
}
/**
@ -379,6 +393,8 @@ class Error extends Message
} elseif (is_scalar($arg)) {
$retval .= getType($arg) . ' '
. htmlspecialchars(var_export($arg, true));
} elseif (is_object($arg)) {
$retval .= '<Class:' . get_class($arg) . '>';
} else {
$retval .= getType($arg);
}

4
templates/list/item.phtml
View File

@ -32,10 +32,10 @@
?>>
<?php endif; ?>
<?= $content ?>
<?php if (!empty($url) && is_array($url)): ?>
<?php if (isset($url) && is_array($url) && array_filter($url)) : ?>
</a>
<?php endif; ?>
<?php if (!empty($mysql_help_page)): ?>
<?= PMA\libraries\Util::showMySQLDocu($mysql_help_page) ?>
<?php endif; ?>
</li>
</li>