From a3cff2428808b7635e1b03b3b552a01971c43701 Mon Sep 17 00:00:00 2001 From: monojp Date: Thu, 27 Aug 2015 15:31:26 +0200 Subject: [PATCH 1/3] Avoid caching theme sprites CSS across phpMyAdmin versions analogue to cd76cb6acc1af19331dc543db45aa0f60eaaefe6 Signed-off-by: Martin Herndl --- themes/sprites.css.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/themes/sprites.css.php b/themes/sprites.css.php index 58a33f7edf..f458077eea 100644 --- a/themes/sprites.css.php +++ b/themes/sprites.css.php @@ -11,7 +11,7 @@ if (! defined('PMA_MINIMUM_COMMON')) { exit(); } -$bg = $_SESSION['PMA_Theme']->getImgPath() . 'sprites.png'; +$bg = $_SESSION['PMA_Theme']->getImgPath() . 'sprites.png?v=' . urlencode(PMA_VERSION); /* Check if there is a valid data file for sprites */ if (is_readable($_SESSION['PMA_Theme']->getPath() . '/sprites.lib.php')) { From 95a73626994f6048542b0144cdd6eb9186c968ce Mon Sep 17 00:00:00 2001 From: monojp Date: Thu, 27 Aug 2015 15:32:05 +0200 Subject: [PATCH 2/3] Fix irregular length (different from the inputs) of select element on login form Signed-off-by: Martin Herndl --- themes/pmahomme/css/common.css.php | 1 + 1 file changed, 1 insertion(+) diff --git a/themes/pmahomme/css/common.css.php b/themes/pmahomme/css/common.css.php index 81755cf1b5..07d2540e68 100644 --- a/themes/pmahomme/css/common.css.php +++ b/themes/pmahomme/css/common.css.php @@ -894,6 +894,7 @@ form.login label { form.login input[type=text], form.login input[type=password], form.login select { + box-sizing: border-box; width: 14em; } From 699d55f614a1f05d68f731fdc545f21d0cfb4ad6 Mon Sep 17 00:00:00 2001 From: monojp Date: Thu, 27 Aug 2015 15:32:26 +0200 Subject: [PATCH 3/3] Extended security-related HTTP headers Signed-off-by: Martin Herndl --- libraries/Header.class.php | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/libraries/Header.class.php b/libraries/Header.class.php index bc3de55cea..addf82db60 100644 --- a/libraries/Header.class.php +++ b/libraries/Header.class.php @@ -593,6 +593,22 @@ class PMA_Header . $captcha_url . ";" ); + // Re-enable possible disabled XSS filters + // see https://www.owasp.org/index.php/List_of_useful_HTTP_headers + header( + 'X-XSS-Protection: 1; mode=block' + ); + // "nosniff", prevents Internet Explorer and Google Chrome from MIME-sniffing a + // response away from the declared content-type + /// see https://www.owasp.org/index.php/List_of_useful_HTTP_headers + header( + 'X-Content-Type-Options: nosniff' + ); + // Adobe cross-domain-policies + // see http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html + header( + 'X-Permitted-Cross-Domain-Policies: none' + ); PMA_noCacheHeader(); if (! defined('IS_TRANSFORMATION_WRAPPER')) { // Define the charset to be used