Merge branch 'master' into 12536

2017-01-18 09:51:06 +01:00 · 2017-01-18 09:51:06 +01:00 · 2de8a2d476
commit 2de8a2d476
parent 77c33d0444 eafd5a5d93
20 changed files with 166 additions and 672 deletions
--- a/408
+++ b/408
@ -41,6 +41,7 @@ phpMyAdmin - ChangeLog
 - issue #12799 Allow to configure signon session parameters
 - issue #12854 Drop database is broken
 - issue #12863 Can't toggle Event Scheduler on
+- issue #12742 Finish removing dead code references to xls/xlsx import and export, which was removed some time ago.
 - issue #12536 Rename "Relations" to "Relationships" in many places as it's the more proper term

 4.6.6 (not yet released)
@ -72,412 +73,9 @@ phpMyAdmin - ChangeLog
 - issue #12859 Changed WHERE condition to 0 instead of 1 for SQL query window to avoid accidents
 - issue #12872 Use same query for display and execution when dropping index
 - issue #12868 Fix check for user groups freatures being enabled
+- issue #12831 Fix table formatting on Insert tab, which mostly affected row highlighting
+- issue #12495 Reintroduced phpinfo page with limited capabilities

-4.6.5.2 (2016-12-05)
- issue #12765 Fixed SQL export with newlines
-
-4.6.5.1 (2016-11-25)
- issue #12735 Incorrect parameters to escapeString in Node.php
- issue #12734 Fix PHP error when mbstring is not installed
- issue #12736 Don't force partition count to be specified when creating a new table
-
-4.6.5 (2016-11-24)
- issue        Remove potentionally license problematic sRGB profile
- issue #12459 Display read only fields as read only when editing
- issue #12384 Fix expanding of navigation pane when clicking on database
- issue #12430 Impove partitioning support
- issue #12374 Reintroduced simplified PmaAbsoluteUri configuration directive
- issue        Always use UTC time in HTTP headers
- issue #12479 Simplified validation of external links
- issue #12483 Fix browsing tables with built in transformations
- issue #12485 Do not show warning about short blowfish_secret if none is set
- issue #12251 Fixed random logouts due to wrong cookie path
- issue #12480 Fixed editing of ENUM/SET/DECIMAL fields structure
- issue #12497 Missing escaping of configuration used in SQL (hide_db and only_db)
- issue #12476 Add error checking in reading advisory rules file
- issue #12477 Add checking missing elements and confirming element types from json_decode
- issue #12251 Automatically save SQL query in browser local storage rather than in cookie
- issue #12292 Unable to edit transformations
- issue #12502 Remove unused paramenter when connecting to MySQLi
- issue #12303 Fix number formatting with different settings of precision in PHP
- issue #12405 Use single quotes in PHP code
- issue #12534 Option for the dropped column is not removed from 'after_field' select, after the column is dropped
- issue #12531 Properly detect DROP DATABASE queries
- issue #12470 Fix possible race condition in setting URL hash
- issue #11924 Remove caching of server information
- issue #11628 Proper parsing of INSERT ... ON DUPLICATE KEY queries
- issue #12545 Proper parsing of CREATE TABLE ... PARTITION queries
- issue #12473 Code can throw unhandled exception
- issue #12550 Do not try to keep alive session even after expiry
- issue #12512 Fixed rendering BBCode links in setup
- issue #12518 Fixed copy of table with generated columns
- issue #12221 Fixed export of table with generated columns
- issue #12320 Copying a user does not copy usergroup
- issue #12272 Adding a new row with default enum goes to no selection when you want to add more then 2 rows
- issue #12487 Drag and drop import prevents file dropping to blob column file selector on the insert tab
- issue #12554 Absence of scrolling makes it impossible to read longer text values in grid editing
- issue #12530 "Edit routine" crashes when the current user is not the definer, even if privileges are adequate
- issue #12300 Export selective tables by-default dumps Events also
- issue #12298 Fixed export of view definitions
- issue #12242 Edit routine detail dialog does not fill "Return length" field in mysql functions
- issue #12575 New index Confirm adds whitespace around the field name
- issue #12382 Bug in zoom search
- issue #12321 Assign LIMIT clause only to syntactically correct queries
- issue #12461 Can't Execute SQL With Sub-Query Due To "LIMIT 0,25" Inserted At Wrong Place
- issue #12511 Clarify documentation on ArbitraryServerRegexp
- issue #12508 Remove duplicate code in SQL escaping
- issue #12475 Cleanup code for getting table information
- issue #12579 phpMyAdmin's export of a Select statment without a FROM clause generates Wrong SQL
- issue #12316 Correct export of complex SELECT statements
- issue #12080 Fixed parsing of subselect queries
- issue #11740 Fixed handling DELETE ... USING queries
- issue #12100 Fixed handling of CASE operator
- issue #12455 Query history stores separate entry for every letter typed
- issue #12327 Create PHP code no longer works
- issue #12179 Fixed bookmarking of query with multiple statements
- issue #12419 Wrong description on GRANT OPTION
- issue #12615 Fixed regexp for matching browser versions
- issue #12569 Avoid showing import errors twice
- issue #12362 prefs_manage.php can leave an orphaned temporary file
- issue #12619 Unable to export csv when using union select
- issue #12625 Broken Edit links in query results of JOIN query
- issue #12634 Drop DB error in import if DB doesn't exist
- issue #12338 Designer reverts to first saved ER after EACH relation create or delete
- issue #12639 'Show trace' in Console generates JS error for functions in query's trace called without any arguments
- issue #12366 Fix user creation with certain MariaDB setups
- issue #12616 Refuse to work with mbstring.func_overload enabled
- issue #12472 Properly report connection without password in setup
- issue #12365 Fix records count for large tables
- issue #12533 Fix records count for complex queries
- issue #12454 Query history not updated in console until page refresh
- issue #12344 Fixed parsing of labels in loop
- issue #12228 Fixed parsing of BEGIN labels
- issue #12637 Fixed editing some timestamp values
- issue #12622 Fixed javascript error in designer
- issue #12334 Missing page indicator or VIEWs
- issue #12610 Export of tables with Timestamp/Datetime/Time columns defined with ON UPDATE clause with precision fails
- issue #12661 Error inserting into pma__history after timeout
- issue #12195 Row_format = fixed not visible
- issue #12665 Cannot add a foreign key - non-indexed fields not listed in InnoDB tables
- issue #12674 Allow for proper MySQL-allowed strings as identifiers
- issue #12651 Allow for partial dates on table insert page
- issue #12681 Fixed designer with tables using special chars
- issue #12652 Fixed visual query builder for foreign keys with more fields
- issue #12257 Improved search page performance
- issue #12322 Avoid selecting default function for foreign keys
- issue #12453 Fixed escaping of SQL parts in some corner cases
- issue #12542 Missing table name in account privileges editor
- issue #12691 Remove ksort call on empty array in PMA_getPlugins function
- issue #12443 Check parameter type before processing
- issue #12299 Avoid generating too long URLs in search
- issue #12361 Fix self SQL injection in table-specific privileges
- issue #12698 Add link to release notes and download on new version notification
- issue #12712 Error when trying to setup replication (fatal error in call to an old PMA_DBI_connect function)
- issue        [security] Unsafe generation of $cfg['blowfish_secret'], see PMASA-2016-58
- issue        [security] phpMyAdmin's phpinfo functionality is removed, see PMASA-2016-59
- issue        [security] AllowRoot and allow/deny rule bypass with specially-crafted username, see PMASA-2016-60
- issue        [security] Username matching weaknesses with allow/deny rules, see PMASA-2016-61
- issue        [security] Possible to bypass logout timeout, see PMASA-2016-62
- issue        [security] Full path disclosure (FPD) weaknesses, see PMASA-2016-63
- issue        [security] Multiple XSS weaknesses, see PMASA-2016-64
- issue        [security] Multiple denial-of-service (DOS) vulnerabilities, see PMASA-2016-65
- issue        [security] Possible to bypass white-list protection for URL redirection, see PMASA-2016-66
- issue        [security] BBCode injection to login page, see PMASA-2016-67
- issue        [security] Denial-of-service (DOS) vulnerability in table partitioning, see PMASA-2016-68
- issue        [security] Multiple SQL injection vulnerabilities, see PMASA-2016-69
- issue        [security] Incorrect serialized string parsing, see PMASA-2016-70
- issue        [security] CSRF token not stripped from the URL, see PMASA-2016-71
-
-4.6.4 (2016-08-16)
- issue        [security] Weaknesses with cookie encryption, see PMASA-2016-29
- issue        [security] Improve session cookie code for openid.php and signon.php example files
- issue        [security] Full path disclosure in openid.php and signon.php example files
- issue        [security] Multiple XSS vulnerabilities, see PMASA-2016-30
- issue        [security] Multiple XSS vulnerabilities, see PMASA-2016-31
- issue        [security] Unsafe generation of BlowfishSecret (when not supplied by the user)
- issue        [security] Referrer leak when phpinfo is enabled
- issue        [security] PHP code injection, see PMASA-2016-32
- issue        [security] Full path disclosure, see PMASA-2016-33
- issue        [security] SQL injection attack, see PMASA-2016-34
- issue        [security] Local file exposure through LOAD DATA LOCAL INFILE, see PMASA-2016-35
- issue        [security] Local file exposure through symlinks with UploadDir, see PMASA-2016-36
- issue        [security] Path traversal with SaveDir and UploadDir, see PMASA-2016-37
- issue        [security] Multiple XSS vulnerabilities, see PMASA-2016-38
- issue        [security] SQL injection vulnerability as control user, see PMASA-2016-39
- issue        [security] SQL injection vulnerability, see PMASA-2016-40
- issue        [security] Denial-of-service attack through transformation feature, see PMASA-2016-41
- issue        [security] SQL injection vulnerability as control user, see PMASA-2016-42
- issue        [security] Verify data before unserializing, see PMASA-2016-43
- issue        [security] Use HTTPS for wiki links
- issue        Remove Swekey support
- issue        [security] Denial-of-service attack with $cfg['AllowArbitraryServer'] = true and persistent connections, see PMASA-2016-45
- issue        [security] Improve SSL certificate handling
- issue        [security] Fix full path disclosure in debugging code
- issue        [security] Possible circumvention of IP-based allow/deny rules with IPv6 and proxy server, see PMASA-2016-47
- issue        [security] Detect if user is logged in, see PMASA-2016-48
- issue        [security] Bypass URL redirection protection, see PMASA-2016-49
- issue        [security] Referrer leak, see PMASA-2016-50
- issue        [security] Reflected File Download, see PMASA-2016-51
- issue        [security] ArbitraryServerRegexp bypass, see PMASA-2016-52
- issue        [security] Denial-of-service attack by entering long password, see PMASA-2016-53
- issue        [security] Remote code execution vulnerability when running as CGI, see PMASA-2016-054
- issue        [security] Administrators could trigger SQL injection attack against users
- issue        [security] Denial-of-service attack when PHP uses dbase extension, see PMASA-2016-55
- issue        [security] Remove tode execution vulnerability when PHP uses dbase extension, see PMASA-2016-56
- issue        [security] Denial-of-service attack by using for loops, see PMASA-2016-46
- issue        Include X-Robots-Tag header in responses
- issue        Enforce numeric field length when creating table
- issue        Fixed invalid Content-Length in some HTTP responses
- issue #12394 Create view should require a view name
- issue #12391 Message with 'Change password successfully' displayed, but does not take effect
- issue        Tighten control on PHP sessions and session cookies
- issue #12409 Re-enable overhead on server databases view
- issue #12414 Fixed rendering of Original theme
- issue #12413 Fixed deleting users in non English locales
- issue #12416 Fixed replication status output in Databases listing
- issue #12303 Avoid typecasting to float when not needed
- issue #12425 Duplicate message variable names in messages.inc.php
- issue #12399 Adding index to table shows wrong top navigation
- issue #12424 Fixed password change on MariaDB without auth plugin
- issue #12339 Do not error on unset server port
- issue #12422 Improvements to the original theme
- issue #12395 Do not try to load old transformation plugins
- issue #12423 Fixed replication status in database listing
- issue #12433 Copy table with prefix does not copy the indexes
- issue #12375 Search in database: Window content is not scrolling down when clicking first time on Browse link
- issue #12346 SQL Editor textareas can have their size increased from the top, distorting the page view
-
-4.6.3 (2016-06-23)
- issue #12249 Fixed cookie path on Windows
- issue #12279 Fixed error reporting on connect problems
- issue #12290 Fixed export of tables without explicitly set engine
- issue #12285 Designer JavaScript error: Show/Hide tables list
- issue #12293 Fix MySQL SSL connection with some PHP versions
- issue #12279 Fix MySQL connection error on version mismatch
- issue #12281 Keep user attributes (privileges, authentication mode, etc) when copying a user
- issue #12308 Fix division by zero in case of misconfigured MySQL server
- issue #12317 Fix editing server variables
- issue #12303 Fix table size calculation in some circumstances
- issue #12310 Fix listing routines for non privileged user
- issue        Escape generated query in exporting a database
- issue        Setup script doesn't use input type 'password' in all relevant locations
- issue        [security] BBCode injection in setup script, see PMASA-2016-17
- issue        [security] Cookie attribute injection attack, see PMASA-2016-18
- issue        Redirect loop when directly calling url.php
- issue        [security] SQL injection attack, see PMASA-2016-19
- issue        [security] XSS attack in Table Structure page, see PMASA-2016-20
- issue        [security] XSS attack in Server Privileges page, see PMASA-2016-21
- issue        [security] DOS attack vulnerability, see PMASA-2016-22
- issue        [security] Multiple full path disclosure vulnerabilities, see PMASA-2016-23
- issue        [security] Full path disclosure when running in debug mode
- issue        [security] XSS attack with partition range and table structure, see PMASA-2016-25
- issue        [security] XSS attack when checking database privileges, see PMASA-2016-26
- issue        [security] XSS attack when MySQL server is using a specific payload log_bin directive, see PMASA-2016-26
- issue        [security] XSS vulnerabilities in Transformation feature, see PMASA-2016-26
-
-4.6.2 (2016-05-25)
- issue        [security] User SQL queries can be revealed through URL GET parameters, see PMASA-2016-14
- issue        [security] Self XSS vulneratbility, see PMASA-2016-16
- issue #12225 Use https for documentation links
- issue #12234 Fix schema export with too many tables
- issue #12240 Avoid parsing non JSON responses as JSON
- issue #12244 Avoid using too log URLs when getting javascripts
- issue #12118 Fixed setting mixed case languages
- issue #12229 Avoid storing objects in session when debugging SQL
- issue #12249 Fix cookie path on IIS
- issue #11705 Fix occassional 200 errors on Windows
- issue #12219 Fix locking issues when importing SQL
- issue #12231 Avoid confusing warning when mysql extension is missing
- issue        Improve handling of logout
- issue        Safer handling of sessions during authentication
- issue #12209 Fix server selection on main page
- issue #12192 Avoid storing full error data in session
- issue #12082 Fixed export of ARCHIVE tables with keys
- issue #11565 Add session reload for config authentication
- issue #12229 Do not fail on errors stored in session
- issue #12248 Fix loading of APC based upload progress bar
-
-4.6.1 (2016-05-02)
- issue #12120 PMA_Util not found in insert_edit.lib.php
- issue #12118 Fixed activation of some languages
- issue #12121 Fixed error in 3NF step of normalization
- issue #12135 Fix offering JSON datatype in incompatible MySQL versions
- issue #12132 Can not open table with JSON field
- issue #12125 Cannot highlight a column if I scroll down from the top of the table
- issue #12154 Fixed possible PHP error in SQL parser
- issue #12029 Fixed SQL quoting in SQL export
- issue #12129 Improve performance of database structure page
- issue #12159 Fix PHP error if user did unpack new version over old one
- issue #12165 Fix parsing of expression 0
- issue #12146 Document setup with Google Cloud SQL
- issue #12197 Fix parsing of queries with double \
- issue #12202 Fixed setting of language from user configuration
- issue #12200 Fixed check for ndb version
- issue #12206 Fixed loading of configuration file
- issue #12204 Check if sessions are working and report failures
- issue #12211 non-clickable initial letter for users / and can't modify users with MySQL 5.7.12
- issue #12215 Fixed config tab persistence errors
- issue #12217 Fixed javascript erros on user creation
- issue #12144 Fixed parsing of some AS clauses
- issue #12205 Fixed parsing of FULL OUTER JOIN queries
- issue #12171 Fixed editing of VIEW structure
- issue #12208 Avoid printing executed queries on import
-
-4.6.0.0 (2016-03-22)
-+ issue #11456 Disabled storage engines
-+ issue #11479 Allow setting routine wise privileges
- issue        Hide Insert tab for non-updatable views
-+ issue #11490 UI for defining partitioning in create table window
-+ issue #11438 Support JSON data type
-+ issue        Editing partitions in table Structure
- issue        Tracking does not make sense for information_schema
- issue #11550 Regression in Find and replace
-+ issue #11619 TokuDB Tables Show Size as "unknown"
-+ issue #11654 Use a slider for Internal relations
-+ issue #11641 Ability to disable the navigationhiding Feature
- issue #11647 Restrict configuration NavigationTreeDbSeparator to strings
- issue #11667 Disable the tooltip in the navigation panel's filter box
-+ issue        Copy results to clipboard
-+ issue #11504 Reactivate cut&paste possibility in print view
- issue #11702 Extraneous message after edit + grid-edit
- issue #11668 Table header is empty with browsing an empty table
-+ issue #11701 Allow changing parameter order of routines
- issue #11708 Remove no password warning
-+ issue #11711 Clarify the meaning of "Stand-in structure for view" in SQL export
- issue        HTML line break shown after a MySQL connection error message
- issue #11728 CSV import skip row count after
- issue        Fixed displaying of SQL query on table operations
- issue #6321  Display binary strings as text if they are valid UTF-8
-+ issue #11743 Display routine specific privileges
-+ issue #11538 Copy multiple tables to database
-+ issue        Support Cloudflare Flexible SSL
- issue        Handle empty TABLE_COMMENT
-+ issue #11833 Drop support for old Internet Explorer versions
-+ issue #11796 Use modals for displaying forms in db structure page
-+ issue #11789 Show MySQL error messages in user language
-+ issue        Add 'ssl_verify' configuration directive for self-signed certificates with mysqlnd and PHP >= 5.6
-+ issue #11874 Show more used PHP extensions
- issue #11874 Report when version check and error reporting are disabled
- issue #11849 Fix PDF schema export
- issue #11412 Remove ForceSSL configuration directive
- issue        Remove support for Mozilla Prism
- issue #11412 Remove PmaAbsoluteUri configuration directive
- issue #11914 Fix autoloading of phpseclib
- issue #11880 Fixed rendering of missing extension error
- issue #11923 Errors on Structure tab when user only has select access on certain columns
- issue #11972 Missing documentation for $cfg['Servers'][$i]['favorite'] and $cfg['NumFavoriteTables']
- issue #11907 Avoid displaying UPDATE query twice
- issue #11850 Fixed CSV import
- issue        Fix SQL syntax highlighting in database search page
- issue #12056 Fix error when we can not generate random string
- issue #12055 Fixed PHP syntax error in templates
- issue #12054 Fixed processing of queries with escaped quotes
- issue #12041 Fixed exporting tables with fields DEFAULT and COMMENT
- issue #12073 Hide edit and delete buttons when the results are not related to a table
- issue #12083 Fixed parsing of field definition
- issue #12081 Fixed rendering of table stats
- issue #11705 Fixed problems with PHP on Windows on table structure
- issue #12085 Like search strings being escaped incorrectly
- issue #12092 Rename exported databases/tables doesn't seem to work
- issue #12099 Undefined index: controllink
- issue #12094 PHP Fatal error: Call to undefined function __()
- issue #12098 Fix login after logout with http authentication
- issue #12074 Fixed possible invalid SQL export
- issue #12026 Fixed parsing of UNION SELECT with brackets
- issue #12109 Fixed parsing of CREATE TABLE [AS] SELECT
- issue #12105 Multi-server drap-and-drop import always fails
- issue #12116 Fulltext indexes are not copied when using copy database function
-
-4.5.5.1 (2016-02-29)
- issue #11971 CREATE UNIQUE INDEX index type is not recognized by parser.
- issue #11982 Row count wrong when grouping joined tables.
- issue #12012 Column definition with default value and comment in CREATE TABLE expoerted faulty.
- issue #12020 New statement but no delimiter and unexpected token with REPLACE.
- issue #12029 Fixed incorrect usage of SQL parser context in SQL export
- issue        [security] XSS vulnerability in SQL parser, see PMASA-2016-10.
- issue        [security] Multiple XSS vulnerabilities, see PMASA-2016-11.
- issue        [security] Multiple XSS vulnerabilities, see PMASA-2016-12.
- issue        [security] Vulnerability allowing man-in-the-middle attack on API call to GitHub, see PMASA-2016-13.
- issue #12048 Fixed inclusion of gettext library from SQL parser
-
-4.5.5.0 (2016-02-22)
- issue        Undefined index: is_ajax_request
- issue #11855 Fix password change on MariaDB 10.1 and newer
- issue #11874 Validate version information before further processing it
- issue #11881 Full processlist lost on refresh
- issue #11834 Adjust privileges fails if database name contains underscores
- issue #11906 'Loading...' banner shows on login screen
- issue #11930 Fixed changing of table parameters, eg. AUTO_INCREMENT
- issue #11885 Call to undefined function SqlParser\ctype_alnum()
- issue #11879 4.5.3.1 - NOW() function not recognized by parser
- issue #11867 Gracefully handle the DESC statement
- issue #11843 Fractional timestamp causes corrupted SQL export
- issue #11836 Static analysis error for valid WHERE condition with IF keyword
- issue #11800 Syntax Verifier error using REGEXP in SQL statement
- issue #11799 Backslashes in comments are being interpreted as escape characters
- issue #11909 Can't insert row into table that contains generated column
- issue #11677 sql-parser and php-gettext collide.
- issue #11920 Can't disable backquotes in export
- issue #11911 Inserts via tbl_change.php in VARBINARY columns does not allow using HEX() and MD5()
- issue #11939 Correct content type for uploaded error reports
- issue #11940 Silent errors from checking local documentation
- issue #11944 Fixed error on servers with disabled php_uname
- issue #11946 Correctly store and report file upload errors
- issue #11948 Avoid javascript errors on invalid location hash
- issue #11950 Fix PHP warning on configuration errors
- issue #11951 Silent errors on checking for writable folders
- issue #11952 Silent warning on invalid file upload
- issue #11953 Do not fail getting filename with open_basedir limitations
- issue #11956 unrecognized keyword interval
- issue        Field names and aliases are being correctly parsed now.
- issue #11959 Fix javascript error in setup
- issue #11964 Undefined index: TABLE_COMMENT in database structure page
- issue #11967 Fix PHP error on loading invalid XML or ODS file
- issue #11969 Missing confirmation while dropping a view in view_operations.php
- issue #11968 Fix export of index comments in SQL
- issue #11979 DECLARE not accepted as valid SQL
-
-4.5.4.1 (2016-01-29)
- issue #11892 Error with PMA 4.4.15.3
- issue #11896 Remove hard dependency on phpseclib
-
-4.5.4.0 (2016-01-28)
- issue #11724 live data edit of big sets is not working
- issue        Table list not saved in db QBE bookmarked search
- issue #11777 While 'changing a column', query fails with a syntax error after the 'CHARSET=' keyword
- issue #11783 Avoid syntax error in javascript messages on invalid PHP setting for max_input_vars
- issue #11784 Properly handle errors in upacking zip archive
- issue #11785 Set PHP's internal encoding to UTF-8
- issue #11786 Fixed Kanji encoding in some specific cases
- issue #11787 Check whether iconv works before using it
- issue #11788 Avoid conversion of MySQL error messages
- issue #11792 Undefined index: parameters
- issue #11802 Undefined index: field_name_orig
- issue        Undefined index: host
- issue #11810 'Add to central columns' (per column button) does nothing
- issue #11727 SQL duplicate entry error trying to INSERT in designer_settings table
- issue #11798 Fix handling of databases with dot in a name
- issue #11820 Fix hiding of page content behind menu
- issue #11780 FROM clause not generated after loading search bookmark
- issue #11826 Fix creating/editing VIEW with DEFINER containing special chars
- issue #11828 Do not invoke FLUSH PRIVILEGES when server in --skip-grant-tables
- issue #11804 Misleading message for configuration storage
- issue #11772 Table pagination does nothing when session expired
- issue #11840 Index comments not working properly
- issue #11791 Better handle local storage errors
- issue #11752 Improve detection of privileges for privilege adjusting
- issue #11854 Undefined property: stdClass::$releases at version check when disabled in config
- issue #11814 SQL comment and variable stripped from bookmark on save
- issue        Gracefully handle errors in regex based javascript search
- issue        [security] Multiple full path disclosure vulnerabilities, see PMASA-2016-1
- issue        [security] Unsafe generation of CSRF token, see PMASA-2016-2
- issue        [security] Multiple XSS vulnerabilities, see PMASA-2016-3
- issue        [security] Insecure password generation in JavaScript, see PMASA-2016-4
- issue        [security] Unsafe comparison of CSRF token, see PMASA-2016-5
- issue        [security] Multiple full path disclosure vulnerabilities, see PMASA-2016-6
- issue        [security] XSS vulnerability in normalization page, see PMASA-2016-7
- issue        [security] Full path disclosure vulnerability in SQL parser, see PMASA-2016-8
- issue        [security] XSS vulnerability in SQL editor, see PMASA-2016-9

         --- Older ChangeLogs can be found on our project website ---
                     https://www.phpmyadmin.net/old-stuff/ChangeLogs/
--- a/doc/config.rst
+++ b/doc/config.rst
@ -2038,6 +2038,11 @@ Main panel
    You can additionally hide more information by using
    :config:option:`$cfg['Servers'][$i]['verbose']`.

+.. config:option:: $cfg['ShowPhpInfo']
+
+    :type: boolean
+    :default: false
+
 .. config:option:: $cfg['ShowChgPassword']

    :type: boolean
@ -2048,11 +2053,26 @@ Main panel
    :type: boolean
    :default: true

-    Defines whether to display the 
+    Defines whether to display the :guilabel:`PHP information` and
    :guilabel:`Change password` links and form for creating database or not at
    the starting main (right) frame. This setting does not check MySQL commands
    entered directly.

+    Please note that to block the usage of ``phpinfo()`` in scripts, you have to
+    put this in your :file:`php.ini`:
+
+    .. code-block:: ini
+
+        disable_functions = phpinfo()
+
+    .. warning::
+
+        Enabling phpinfo page will leak quite a lot of information about server
+        setup. Is it not recommended to enable this on shared installations.
+
+        This might also make easier some remote attacks on your installations,
+        so enable this only when needed.
+
    Also note that enabling the :guilabel:`Change password` link has no effect
    with config authentication mode: because of the hard coded password value
    in the configuration file, end users can't be allowed to change their
--- a/export.php
+++ b/export.php
@ -186,9 +186,6 @@ $export_plugin = PMA_getPlugin(
    )
 );

-// Backward compatibility
-$type = $what;
-
 // Check export type
 if (empty($export_plugin)) {
    PMA_fatalError(__('Bad type!'));
@ -318,13 +315,12 @@ if ($what == 'sql') {
    $crlf = PMA\libraries\Util::whichCrlf();
 }

-$output_kanji_conversion = Encoding::canConvertKanji() && $type != 'xls';
+$output_kanji_conversion = Encoding::canConvertKanji();

 // Do we need to convert charset?
 $output_charset_conversion = $asfile
    && Encoding::isSupported()
-    && isset($charset) && $charset != 'utf-8'
-    && $type != 'xls';
+    && isset($charset) && $charset != 'utf-8';

 // Use on the fly compression?
 $GLOBALS['onfly_compression'] = $GLOBALS['cfg']['CompressOnFly']
--- a/index.php
+++ b/index.php
@ -323,7 +323,7 @@ if ($server > 0 && $GLOBALS['cfg']['ShowServerInfo']) {
       . ' </div>';
 }

-if ($GLOBALS['cfg']['ShowServerInfo']) {
+if ($GLOBALS['cfg']['ShowServerInfo'] || $GLOBALS['cfg']['ShowPhpInfo']) {
    echo '<div class="group">';
    echo '<h2>' , __('Web server') , '</h2>';
    echo '<ul>';
@ -363,6 +363,15 @@ if ($GLOBALS['cfg']['ShowServerInfo']) {
        }
    }

+    if ($cfg['ShowPhpInfo']) {
+        PMA_printListItem(
+            __('Show PHP information'),
+            'li_phpinfo',
+            'phpinfo.php' . $common_url_query,
+            null,
+            '_blank'
+        );
+    }
    echo '  </ul>';
    echo ' </div>';
 }
--- a/js/server_status_queries.js
+++ b/js/server_status_queries.js
@ -16,7 +16,7 @@ AJAX.registerOnload('server_status_queries.js', function () {
    // Build query statistics chart
    var cdata = [];
    try {
-        $.each(JSON.parse($('#serverstatusquerieschart_data').text()), function (key, value) {
+        $.each(JSON.parse($('#serverstatusquerieschart').data('chart'))), function (key, value) {
            cdata.push([key, parseInt(value, 10)]);
        });
        $('#serverstatusquerieschart').data(
--- a/js/tbl_zoom_plot_jqplot.js
+++ b/js/tbl_zoom_plot_jqplot.js
@ -96,19 +96,6 @@ function getType(field) {
        return 'text';
    }
 }
-/**
- ** Converts a categorical array into numeric array
- ** @param array categorical values array
- **/
-function getCord(arr) {
-    var newCord = [];
-    var original = $.extend(true, [], arr);
-    arr = jQuery.unique(arr).sort();
-    $.each(original, function (index, value) {
-        newCord.push(jQuery.inArray(value, arr));
-    });
-    return [newCord, arr, original];
-}

 /**
 ** Scrolls the view to the display section
--- a/libraries/common.inc.php
+++ b/libraries/common.inc.php
@ -262,9 +262,6 @@ $GLOBALS['url_params'] = array();
 * @global array $goto_whitelist
 */
 $goto_whitelist = array(
-    //'browse_foreigners.php',
-    //'changelog.php',
-    //'chk_rel.php',
    'db_datadict.php',
    'db_sql.php',
    'db_events.php',
@ -278,9 +275,6 @@ $goto_whitelist = array(
    'db_routines.php',
    'export.php',
    'import.php',
-    //'index.php',
-    //'navigation.php',
-    //'license.php',
    'index.php',
    'pdf_pages.php',
    'pdf_schema.php',
@ -313,7 +307,6 @@ $goto_whitelist = array(
    'tbl_row_action.php',
    'tbl_select.php',
    'tbl_zoom_select.php',
-    //'themes.php',
    'transformation_overview.php',
    'transformation_wrapper.php',
    'user_password.php',
--- a/libraries/config.default.php
+++ b/libraries/config.default.php
@ -1058,6 +1058,13 @@ $cfg['NavigationTreeShowEvents'] = true;
 */
 $cfg['ShowStats'] = true;

+/**
+ * show PHP info link
+ *
+ * @global boolean $cfg['ShowPhpInfo']
+ */
+$cfg['ShowPhpInfo'] = false;
+
 /**
 * show MySQL server and web server information
 *
@ -1393,7 +1400,7 @@ $cfg['RowActionType'] = 'both';
 $cfg['Export'] = array();

 /**
- * codegen/csv/excel/htmlexcel/htmlword/latex/ods/odt/pdf/sql/texytext/xls/xml/yaml
+ * codegen/csv/excel/htmlexcel/htmlword/latex/ods/odt/pdf/sql/texytext/xml/yaml
 *
 * @global string $cfg['Export']['format']
 */
@ -1609,48 +1616,6 @@ $cfg['Export']['texytext_columns'] = false;
 */
 $cfg['Export']['texytext_null'] = 'NULL';

-/**
- *
- *
- * @global boolean $cfg['Export']['xls_columns']
- */
-$cfg['Export']['xls_columns'] = false;
-
-/**
- *
- *
- * @global string $cfg['Export']['xls_structure_or_data']
- */
-$cfg['Export']['xls_structure_or_data'] = 'data';
-
-/**
- *
- *
- * @global string $cfg['Export']['xls_null']
- */
-$cfg['Export']['xls_null'] = 'NULL';
-
-/**
- *
- *
- * @global boolean $cfg['Export']['xlsx_columns']
- */
-$cfg['Export']['xlsx_columns'] = false;
-
-/**
- *
- *
- * @global string $cfg['Export']['xlsx_structure_or_data']
- */
-$cfg['Export']['xlsx_structure_or_data'] = 'data';
-
-/**
- *
- *
- * @global string $cfg['Export']['xlsx_null']
- */
-$cfg['Export']['xlsx_null'] = 'NULL';
-
 /**
 *
 *
@ -2366,27 +2331,6 @@ $cfg['Import']['ods_recognize_percentages'] = true;
 */
 $cfg['Import']['ods_recognize_currency'] = true;

-/**
- *
- *
- * @global string $cfg['Import']['xml_col_names']
- */
-$cfg['Import']['xls_col_names'] = false;
-
-/**
- *
- *
- * @global string $cfg['Import']['xml_empty_rows']
- */
-$cfg['Import']['xls_empty_rows'] = true;
-
-/**
- *
- *
- * @global string $cfg['Import']['xlsx_col_names']
- */
-$cfg['Import']['xlsx_col_names'] = false;
-
 /*******************************************************************************
 * Schema export defaults
 */
--- a/libraries/config.values.php
+++ b/libraries/config.values.php
@ -174,7 +174,7 @@ $cfg_db['Export']['method'] = array(
 );
 $cfg_db['Export']['format'] = array(
    'codegen', 'csv', 'excel', 'htmlexcel','htmlword', 'latex', 'ods',
-    'odt', 'pdf', 'sql', 'texytext', 'xls', 'xml', 'yaml'
+    'odt', 'pdf', 'sql', 'texytext', 'xml', 'yaml'
 );
 $cfg_db['Export']['compression'] = array('none', 'zip', 'gzip');
 $cfg_db['Export']['charset'] = array_merge(
@ -203,8 +203,6 @@ $cfg_db['Export']['sql_insert_syntax'] = array(
    'both'     => __('both of the above'),
    'none'     => __('neither of the above')
 );
-$cfg_db['Export']['xls_null'] = 'short_string';
-$cfg_db['Export']['xlsx_null'] = 'short_string';
 $cfg_db['Export']['htmlword_structure_or_data'] = $cfg_db['Export']['_sod_select'];
 $cfg_db['Export']['htmlword_null'] = 'short_string';
 $cfg_db['Export']['ods_null'] = 'short_string';
--- a/libraries/config/messages.inc.php
+++ b/libraries/config/messages.inc.php
@ -226,10 +226,6 @@ $strConfigExport_sql_utc_time_name = __('Export time in UTC');
 $strConfigExport_texytext_columns_name = __('Put columns names in the first row');
 $strConfigExport_texytext_null_name = __('Replace NULL with');
 $strConfigExport_texytext_structure_or_data_name = __('Dump table');
-$strConfigExport_xls_columns_name = __('Put columns names in the first row');
-$strConfigExport_xls_null_name = __('Replace NULL with');
-$strConfigExport_xlsx_columns_name = __('Put columns names in the first row');
-$strConfigExport_xlsx_null_name = __('Replace NULL with');
 $strConfigForeignKeyDropdownOrder_desc = __(
    'Sort order for items in a foreign-key dropdown box; [kbd]content[/kbd] is '
    . 'the referenced data, [kbd]id[/kbd] is the key value.'
@ -402,8 +398,6 @@ $strConfigImport_sql_compatibility_name = __('SQL compatibility mode');
 $strConfigImport_sql_no_auto_value_on_zero_name
    = __('Do not use AUTO_INCREMENT for zero values');
 $strConfigImport_sql_read_as_multibytes_name = __('Read as multibytes');
-$strConfigImport_xls_col_names_name = __('Column names in first row');
-$strConfigImport_xlsx_col_names_name = __('Column names in first row');
 $strConfigInitialSlidersState_name = __('Initial state for sliders');
 $strConfigInsertRows_desc = __('How many rows can be inserted at one time.');
 $strConfigInsertRows_name = __('Number of inserted rows');
@ -869,6 +863,11 @@ $strConfigShowFunctionFields_desc = __(
 $strConfigShowFunctionFields_name = __('Show function fields');
 $strConfigShowHint_desc = __('Whether to show hint or not.');
 $strConfigShowHint_name = __('Show hint');
+$strConfigShowPhpInfo_desc = __(
+    'Shows link to [a@https://php.net/manual/function.phpinfo.php]phpinfo()[/a] ' .
+    'output.'
+);
+$strConfigShowPhpInfo_name = __('Show phpinfo() link');
 $strConfigShowServerInfo_name = __('Show detailed MySQL server information');
 $strConfigShowSQL_desc = __(
    'Defines whether SQL queries generated by phpMyAdmin should be displayed.'
--- a/libraries/config/setup.forms.php
+++ b/libraries/config/setup.forms.php
@ -203,6 +203,7 @@ $forms['Main_panel']['Startup'] = array(
    'ShowCreateDb',
    'ShowStats',
    'ShowServerInfo',
+    'ShowPhpInfo',
    'ShowChgPassword');
 $forms['Main_panel']['DbStructure'] = array(
    'ShowDbStructureCharset',
--- a/libraries/dbi/DBIMysqli.php
+++ b/libraries/dbi/DBIMysqli.php
@ -57,55 +57,6 @@ if (! defined('MYSQLI_TYPE_JSON')) {
 */
 class DBIMysqli implements DBIExtension
 {
-    /**
-     * Helper function for connecting to the database server
-     *
-     * @param mysqli $link          connection link
-     * @param string $host          mysql hostname
-     * @param string $user          mysql user name
-     * @param string $password      mysql user password
-     * @param int    $server_port   server port
-     * @param string $server_socket server socket
-     * @param int    $client_flags  client flags of connection
-     * @param bool   $persistent    whether to use persistent connection
-     *
-     * @return bool
-     */
-    private function _realConnect(
-        $link, $host, $user, $password, $server_port,
-        $server_socket, $client_flags = null, $persistent = false
-    ) {
-        global $cfg;
-
-        // mysqli persistent connections
-        if ($cfg['PersistentConnections'] || $persistent) {
-            $host = 'p:' . $host;
-        }
-
-        if ($client_flags === null) {
-            return mysqli_real_connect(
-                $link,
-                $host,
-                $user,
-                $password,
-                '',
-                $server_port,
-                $server_socket
-            );
-        } else {
-            return mysqli_real_connect(
-                $link,
-                $host,
-                $user,
-                $password,
-                '',
-                $server_port,
-                $server_socket,
-                $client_flags
-            );
-        }
-    }
-
    /**
     * connects to the database server
     *
@ -174,13 +125,21 @@ class DBIMysqli implements DBIExtension
            }
        }

-        $return_value = $this->_realConnect(
+        if ($GLOBALS['cfg']['PersistentConnections']) {
+            $host = 'p:' . $server['host'];
+        } else {
+            $host = $server['host'];
+        }
+
+        $return_value = mysqli_real_connect(
            $link,
-            $server['host'],
+            $host,
            $user,
            $password,
+            '',
            $server['port'],
-            $server['socket']
+            $server['socket'],
+            $client_flags
        );

        if ($return_value === false || is_null($return_value)) {
--- a/libraries/insert_edit.lib.php
+++ b/libraries/insert_edit.lib.php
@ -585,9 +585,6 @@ function PMA_getValueColumn($column, $backup_field, $column_name_appendix,
    } elseif ($GLOBALS['cfg']['LongtextDoubleTextarea']
        && mb_strstr($column['pma_type'], 'longtext')
    ) {
-        $html_output = '&nbsp;</td>';
-        $html_output .= '</tr>';
-        $html_output .= '<tr>' . '<td colspan="5" class="right">';
        $html_output .= PMA_getTextarea(
            $column, $backup_field, $column_name_appendix, $onChangeClause,
            $tabindex, $tabindex_for_value, $idindex, $text_dir,
@ -2658,14 +2655,8 @@ function PMA_getHtmlForIgnoreOption($row_id, $checked = true)
 */
 function PMA_getHtmlForFunctionOption($column, $column_name_appendix)
 {
-    $longDoubleTextArea = $GLOBALS['cfg']['LongtextDoubleTextarea'];
    return '<tr class="noclick">'
        . '<td '
-        . ($longDoubleTextArea
-            && mb_strstr($column['True_Type'], 'longtext')
-            ? 'rowspan="2"'
-            : ''
-        )
        . 'class="center">'
        . $column['Field_title']
        . '<input type="hidden" name="fields_name' . $column_name_appendix
@ -2939,9 +2930,6 @@ function PMA_getHtmlForInsertEditFormColumn($table_columns, $column_number,
            $no_support_types, $gis_data_types, $extracted_columnspec, $readOnly
        );
    }
-    $html_output .= '</td>'
-        . '</tr>';
-
    return $html_output;
 }

--- a/libraries/server_status_queries.lib.php
+++ b/libraries/server_status_queries.lib.php
@ -134,14 +134,12 @@ function PMA_getHtmlForServerStatusQueriesDetails($ServerStatusData)
    $retval .= '</tbody>';
    $retval .= '</table>';

-    $retval .= '<div id="serverstatusquerieschart"></div>';
-    $retval .= '<div id="serverstatusquerieschart_data" style="display:none;">';
+    $retval .= '<div id="serverstatusquerieschart" data-chart="';
    if ($other_sum > 0) {
        $chart_json[__('Other')] = $other_sum;
    }
-    $retval .= htmlspecialchars(json_encode($chart_json));
-    $retval .= '</div>';
+    $retval .= htmlspecialchars(json_encode($chart_json), ENT_QUOTES);
+    $retval .= '"></div>';

    return $retval;
 }
-
--- a/phpinfo.php
+++ b/phpinfo.php
@ -0,0 +1,22 @@
+<?php
+/* vim: set expandtab sw=4 ts=4 sts=4: */
+/**
+ * phpinfo() wrapper to allow displaying only when configured to do so.
+ *
+ * @package PhpMyAdmin
+ */
+
+/**
+ * Gets core libraries and defines some variables
+ */
+require_once 'libraries/common.inc.php';
+$response = PMA\libraries\Response::getInstance();
+$response->disable();
+$response->getHeader()->sendHttpHeaders();
+
+/**
+ * Displays PHP information
+ */
+if ($GLOBALS['cfg']['ShowPhpInfo']) {
+    phpinfo(INFO_GENERAL | INFO_CONFIGURATION | INFO_MODULES);
+}
--- a/po/az.po
+++ b/po/az.po
@ -4,16 +4,16 @@ msgstr ""
 "Project-Id-Version: phpMyAdmin 4.7.0-dev\n"
 "Report-Msgid-Bugs-To: translators@phpmyadmin.net\n"
 "POT-Creation-Date: 2016-12-13 10:40+0100\n"
-"PO-Revision-Date: 2016-11-18 10:30+0000\n"
-"Last-Translator: Michal Čihař <michal@cihar.com>\n"
-"Language-Team: Azerbaijani <https://hosted.weblate.org/projects/phpmyadmin/"
-"master/az/>\n"
+"PO-Revision-Date: 2017-01-17 17:34+0000\n"
+"Last-Translator: Sevdimali İsa <sevdimaliisayev@mail.ru>\n"
+"Language-Team: Azerbaijani "
+"<https://hosted.weblate.org/projects/phpmyadmin/master/az/>\n"
 "Language: az\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 2.10-dev\n"
+"X-Generator: Weblate 2.11-dev\n"

 #: changelog.php:39 license.php:34
 #, fuzzy, php-format
@ -5920,7 +5920,7 @@ msgstr "Verilənləri daxil edərkən istifadə olunacaq sintaksis"
 #: libraries/config/messages.inc.php:217
 #: libraries/plugins/export/ExportSql.php:437
 msgid "Maximal length of created query"
-msgstr ""
+msgstr "Yaradılan sorğunun maksimal uzunluğu"

 #: libraries/config/messages.inc.php:223
 msgid "Export type"
@ -5929,7 +5929,7 @@ msgstr "Eksport tipi"
 #: libraries/config/messages.inc.php:224
 #: libraries/plugins/export/ExportSql.php:137
 msgid "Enclose export in a transaction"
-msgstr ""
+msgstr "Tranzaksiya içində eksportu daxil et"

 #: libraries/config/messages.inc.php:225
 msgid "Export time in UTC"
@ -5947,7 +5947,7 @@ msgstr ""

 #: libraries/config/messages.inc.php:239
 msgid "A dropdown will be used if fewer items are present."
-msgstr ""
+msgstr "Az olarsa açılan menu istifadə olunacaq."

 #: libraries/config/messages.inc.php:240
 msgid "Foreign key limit"
@ -5966,10 +5966,8 @@ msgid "Browse mode"
 msgstr ""

 #: libraries/config/messages.inc.php:246
-#, fuzzy
-#| msgid "Automatic recovery mode"
 msgid "Customize browse mode."
-msgstr "Avtomatik qurtarma rejimi"
+msgstr "Browse rejimini özəlləşdir."

 #: libraries/config/messages.inc.php:248 libraries/config/messages.inc.php:250
 #: libraries/config/messages.inc.php:268 libraries/config/messages.inc.php:281
@ -5986,7 +5984,7 @@ msgstr "CSV verilenleri"

 #: libraries/config/messages.inc.php:251
 msgid "Developer"
-msgstr ""
+msgstr "Developer"

 #: libraries/config/messages.inc.php:252
 msgid "Settings for phpMyAdmin developers."
--- a/po/ia.po
+++ b/po/ia.po
@ -8,7 +8,7 @@ msgstr ""
 "Project-Id-Version: phpMyAdmin 4.7.0-dev\n"
 "Report-Msgid-Bugs-To: translators@phpmyadmin.net\n"
 "POT-Creation-Date: 2016-12-13 10:40+0100\n"
-"PO-Revision-Date: 2016-12-21 21:16+0000\n"
+"PO-Revision-Date: 2017-01-17 21:58+0000\n"
 "Last-Translator: Giovanni Sora <g.sora@tiscali.it>\n"
 "Language-Team: Interlingua "
 "<https://hosted.weblate.org/projects/phpmyadmin/master/ia/>\n"
@ -17,7 +17,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 2.10\n"
+"X-Generator: Weblate 2.11-dev\n"

 #: changelog.php:39 license.php:34
 #, php-format
@ -2191,12 +2191,16 @@ msgid ""
 "MySQL accepts additional values not selectable by the slider; key in those "
 "values directly if desired"
 msgstr ""
+"MySQL accepta valores additional non selectionabile per le slider; si tu "
+"vole pote insertar directemente celle valores"

 #: js/messages.php:534
 msgid ""
 "MySQL accepts additional values not selectable by the datepicker; key in "
 "those values directly if desired"
 msgstr ""
+"MySQL accepta valores additional non selectionabile per le selector de datas:"
+" si tu vole pote insertar celle valores directemente"

 #: js/messages.php:540
 msgid ""
@ -10329,6 +10333,8 @@ msgid ""
 "Include a timestamp of when databases were created, last updated, and last "
 "checked"
 msgstr ""
+"Include un timestamp (marca de tempore) de quando le base de datos esseva "
+"create, le ultime actualisation e le ultime controlo"

 #: libraries/plugins/export/ExportSql.php:172
 msgid "Export metadata"
@ -10887,7 +10893,7 @@ msgstr "Validation falleva per le catena de ingresso %s."

 #: libraries/plugins/transformations/abs/SQLTransformationsPlugin.php:29
 msgid "Formats text as SQL query with syntax highlighting."
-msgstr ""
+msgstr "Formata texto como query de SQL con evidentia de syntaxe."

 #: libraries/plugins/transformations/abs/SubstringTransformationsPlugin.php:28
 msgid ""
@ -10903,6 +10909,8 @@ msgid ""
 "File upload functionality for TEXT columns. It does not have a textarea for "
 "input."
 msgstr ""
+"Functionalitate de incargamento de file per columnas de TEXT. Il non ha un "
+"textarea per le ingresso."

 #: libraries/plugins/transformations/abs/TextImageLinkTransformationsPlugin.php:33
 msgid ""
@ -10920,19 +10928,19 @@ msgstr ""

 #: libraries/plugins/transformations/input/Text_Plain_Iptobinary.php:29
 msgid "Converts an Internet network address in (IPv4/IPv6) format to binary"
-msgstr ""
+msgstr "Converte un adresse de rete Internet ab formato (IPv4/IPv6) a binari"

 #: libraries/plugins/transformations/input/Text_Plain_JsonEditor.php:29
 msgid "Syntax highlighted CodeMirror editor for JSON."
-msgstr ""
+msgstr "Editor CodeMirror per jSON con evidentia de syntaxe."

 #: libraries/plugins/transformations/input/Text_Plain_SqlEditor.php:29
 msgid "Syntax highlighted CodeMirror editor for SQL."
-msgstr ""
+msgstr "Editor CodeMirror per SQL con evidentia de syntaxe."

 #: libraries/plugins/transformations/input/Text_Plain_XmlEditor.php:29
 msgid "Syntax highlighted CodeMirror editor for XML (and HTML)."
-msgstr ""
+msgstr "Editor CodeMirror per  XML (e HTML) con evidentia de syntaxe."

 #: libraries/plugins/transformations/output/Text_Plain_Binarytoip.php:29
 msgid ""
@ -10942,11 +10950,11 @@ msgstr ""

 #: libraries/plugins/transformations/output/Text_Plain_Json.php:47
 msgid "Formats text as JSON with syntax highlighting."
-msgstr ""
+msgstr "Formata texto como JSON con evidentia de syntaxe."

 #: libraries/plugins/transformations/output/Text_Plain_Xml.php:47
 msgid "Formats text as XML with syntax highlighting."
-msgstr ""
+msgstr "Formata texto como XML con evidentia de syntaxe."

 #: libraries/pmd_common.php:551
 msgid "Error: relation already exists."
@ -10963,7 +10971,7 @@ msgstr ""

 #: libraries/pmd_common.php:608
 msgid "Error: Missing index on column(s)."
-msgstr ""
+msgstr "Error: Il es mancante le indice sur le campo(s)."

 #: libraries/pmd_common.php:613
 msgid "Error: Relational features are disabled!"
@ -11013,7 +11021,7 @@ msgstr "Configuration de pmadb…"

 #: libraries/relation.lib.php:106 libraries/relation.lib.php:142
 msgid "General relation features"
-msgstr ""
+msgstr "Characteristicas general de relation"

 #: libraries/relation.lib.php:153
 msgid "Display Features"
--- a/po/pt.po
+++ b/po/pt.po
@ -4,8 +4,8 @@ msgstr ""
 "Project-Id-Version: phpMyAdmin 4.7.0-dev\n"
 "Report-Msgid-Bugs-To: translators@phpmyadmin.net\n"
 "POT-Creation-Date: 2016-12-13 10:40+0100\n"
-"PO-Revision-Date: 2016-12-29 18:02+0000\n"
-"Last-Translator: Rodrigo Felix <cuca.baratas@hotmail.com>\n"
+"PO-Revision-Date: 2017-01-16 01:58+0000\n"
+"Last-Translator: Manuela Silva <manuela.silva@sky.com>\n"
 "Language-Team: Portuguese "
 "<https://hosted.weblate.org/projects/phpmyadmin/master/pt/>\n"
 "Language: pt\n"
@ -16,16 +16,13 @@ msgstr ""
 "X-Generator: Weblate 2.11-dev\n"

 #: changelog.php:39 license.php:34
-#, fuzzy, php-format
-#| msgid ""
-#| "The %s file is not available on this system, please visit www.phpmyadmin."
-#| "net for more information."
+#, php-format
 msgid ""
 "The %s file is not available on this system, please visit %s for more "
 "information."
 msgstr ""
-"O ficheiro %s não está disponível no sistema. Para mais informações, visite "
-"www.phpmyadmin.net."
+"O ficheiro %s não está disponível no sistema. Por favor, visite %s para mais "
+"informação."

 #: db_central_columns.php:108
 msgid "The central list of columns for the current database is empty."
@ -33,7 +30,7 @@ msgstr "A lista central de colunas para a base de dados atual está vazia."

 #: db_central_columns.php:133
 msgid "Click to sort."
-msgstr "Clique para organizar."
+msgstr "Clique para ordenar."

 #: db_central_columns.php:150
 #, php-format
@ -926,13 +923,12 @@ msgid "Do you really want to delete the selected items?"
 msgstr "Deseja realmente eliminar os itens selecionados?"

 #: js/messages.php:79
-#, fuzzy
 msgid ""
 "Do you really want to DROP the selected partition(s)? This will also DELETE "
 "the data related to the selected partition(s)!"
 msgstr ""
-"Quer realmente abandonar as partição(ões) selecionada(s)? Isso também "
-"apagará os dados relacionados às partição(ões) selecionada(s)!"
+"Deseja realmente ABANDONAR a(s) partição(ões) selecionada(s)? Isso também "
+"irá ELIMINAR os dados relacionados com a(s) partição(ões) selecionada(s)!"

 #: js/messages.php:83
 msgid "Do you really want to TRUNCATE the selected partition(s)?"
@ -943,10 +939,8 @@ msgid "Do you really want to remove partitioning?"
 msgstr "Deseja realmente eliminar o particionamento?"

 #: js/messages.php:86
-#, fuzzy
-#| msgid "Do you really want to execute \"%s\"?"
 msgid "Do you really want to RESET SLAVE?"
-msgstr "Você realmente deseja executar \"%s\"?"
+msgstr "Deseja realmente REINICIAR SERVO?"

 #: js/messages.php:88
 msgid ""
@ -968,7 +962,7 @@ msgstr "Informação Distorcida"

 #: js/messages.php:96
 msgid "Are you sure you wish to change the collation and convert the data?"
-msgstr "Tem a certeza que quer alterar a ordenação e converter os dados ?"
+msgstr "Tem a certeza que deseja alterar os agrupamentos e converter os dados?"

 #: js/messages.php:98
 msgid ""
@ -991,54 +985,50 @@ msgid ""
 "Are you sure you wish to change all the column collations and convert the "
 "data?"
 msgstr ""
-"Você tem certeza que quer mudar todos os agrupamento de colunas e converter "
+"Tem a certeza que deseja alterar todos os agrupamentos de coluna e converter "
 "os dados?"

 #: js/messages.php:111
 msgid "Save & close"
-msgstr "Salvar & Fechar"
+msgstr "Guardar e fechar"

 #: js/messages.php:112 libraries/config/FormDisplay.tpl.php:426
 #: libraries/insert_edit.lib.php:1622 prefs_manage.php:374 prefs_manage.php:385
 msgid "Reset"
-msgstr "Limpa"
+msgstr "Reiniciar"

 #: js/messages.php:113
 msgid "Reset all"
-msgstr "Redefinir Tudo"
+msgstr "Redefinir tudo"

 #: js/messages.php:116
 msgid "Missing value in the form!"
-msgstr "Nº de dados insuficiente!"
+msgstr "Valor em falta no formulário!"

 #: js/messages.php:117
 msgid "Select at least one of the options!"
-msgstr "Selecciona pelo menos uma das opções!"
+msgstr "Selecionar pelo menos uma das opções!"

 #: js/messages.php:118
 msgid "Please enter a valid number!"
-msgstr "Introduza um número válido!"
+msgstr "Por favor, insira um número válido!"

 #: js/messages.php:119
 msgid "Please enter a valid length!"
 msgstr "Introduza um comprimento válido!"

 #: js/messages.php:120
-#, fuzzy
-#| msgid "Add Index"
 msgid "Add index"
-msgstr "Adicionar Índice"
+msgstr "Adicionar índice"

 #: js/messages.php:121
-#, fuzzy
-#| msgid "Edit Index"
 msgid "Edit index"
-msgstr "Editar Índice"
+msgstr "Editar índice"

 #: js/messages.php:122 templates/table/index_form.phtml:235
 #, php-format
 msgid "Add %s column(s) to index"
-msgstr "Adiciona %s coluna(s) ao Índice"
+msgstr "Adicionar %s coluna(s) ao Índice"

 #: js/messages.php:123
 msgid "Create single-column index"
@ -1054,7 +1044,7 @@ msgstr "Composto com:"

 #: js/messages.php:126
 msgid "Please select column(s) for the index."
-msgstr "Seleciona a(s) coluna(s) para o índice."
+msgstr "Por favor, selecione a(s) coluna(s) para o índice."

 #: js/messages.php:129 templates/table/structure/add_column.phtml:1
 msgid "You have to add at least one column."
@ -1065,7 +1055,7 @@ msgstr "Tem que adicionar pelo menos uma coluna."
 #: templates/table/index_form.phtml:240
 #: templates/table/relation/common_form.phtml:131
 msgid "Preview SQL"
-msgstr "Pré-visualização SQL"
+msgstr "Pré-visualizar SQL"

 #: js/messages.php:135
 msgid "Simulate query"
@ -1086,7 +1076,7 @@ msgstr "Valores para Y"

 #: js/messages.php:144
 msgid "The host name is empty!"
-msgstr "O nome da máquina está vazio!"
+msgstr "O nome do hospedeiro está vazio!"

 #: js/messages.php:145
 msgid "The user name is empty!"
@ -1095,7 +1085,7 @@ msgstr "O nome do utilizador está vazio!"
 #: js/messages.php:146 libraries/server_privileges.lib.php:1868
 #: user_password.php:119
 msgid "The password is empty!"
-msgstr "Indique a palavras-passe!"
+msgstr "A palavra-passe está em branco!"

 #: js/messages.php:147 libraries/server_privileges.lib.php:1866
 #: user_password.php:123
@ -1104,7 +1094,7 @@ msgstr "As palavras-passe são diferentes!"

 #: js/messages.php:148
 msgid "Removing Selected Users"
-msgstr "Removendo os utilizadores seleccionados"
+msgstr "Remover Utilizadores Selecionados"

 #: js/messages.php:149 js/messages.php:216 libraries/tracking.lib.php:467
 #: libraries/tracking.lib.php:830
@ -1112,26 +1102,20 @@ msgid "Close"
 msgstr "Fechar"

 #: js/messages.php:152
-#, fuzzy
-#| msgid "Page has been created."
 msgid "Template was created."
-msgstr "A página foi criada."
+msgstr "O modelo foi criado."

 #: js/messages.php:153
 msgid "Template was loaded."
 msgstr "O modelo foi carregado."

 #: js/messages.php:154
-#, fuzzy
-#| msgid "The profile has been updated."
 msgid "Template was updated."
-msgstr "O prefil foi actualizado."
+msgstr "O modelo foi atualizado."

 #: js/messages.php:155
-#, fuzzy
-#| msgid "The row has been deleted."
 msgid "Template was deleted."
-msgstr "Registo eliminado."
+msgstr "O modelo doi eliminado."

 #. l10n: Other, small valued, queries
 #: js/messages.php:158 libraries/ServerStatusData.php:132
@ -1185,7 +1169,7 @@ msgstr "Cache de comandos utilizada"

 #: js/messages.php:180
 msgid "System CPU usage"
-msgstr "Uso da CPU do Sistema"
+msgstr "Utilização da CPU do Sistema"

 #: js/messages.php:181
 msgid "System memory"
@ -1193,7 +1177,7 @@ msgstr "Memória do sistema"

 #: js/messages.php:182
 msgid "System swap"
-msgstr "Swap do sistema"
+msgstr "Troca do sistema"

 #: js/messages.php:184
 msgid "Average load"
@ -1209,7 +1193,7 @@ msgstr "Memória na cache"

 #: js/messages.php:187
 msgid "Buffered memory"
-msgstr "Memória retida"
+msgstr "Memória no buffer"

 #: js/messages.php:188
 msgid "Free memory"
@ -1323,7 +1307,7 @@ msgstr "Adicionar gráfico a grelha"

 #: js/messages.php:218
 msgid "Please add at least one variable to the series!"
-msgstr "Adicione pelo menos uma variável à serie!"
+msgstr "Por favor, adicione pelo menos uma variável às series!"

 #: js/messages.php:219 libraries/DisplayResults.php:1494
 #: libraries/config.values.php:69 libraries/display_export.lib.php:691
@ -1373,7 +1357,7 @@ msgstr "slow_query_log e general_log estão desativados."

 #: js/messages.php:229
 msgid "log_output is not set to TABLE."
-msgstr "log_output não está configurado para TABELA."
+msgstr "log_output não está configurado para a TABELA."

 #: js/messages.php:230
 msgid "log_output is set to TABLE."
@ -1419,7 +1403,7 @@ msgstr "Ativar %s"
 #: js/messages.php:246
 #, php-format
 msgid "Disable %s"
-msgstr "Desactivar %s"
+msgstr "Desativar %s"

 #. l10n: %d seconds
 #: js/messages.php:248
@ -1437,7 +1421,7 @@ msgstr ""

 #: js/messages.php:253
 msgid "Change settings"
-msgstr "Modificar configurações"
+msgstr "Alterar configurações"

 #: js/messages.php:254
 msgid "Current settings"
@ -16258,7 +16242,7 @@ msgstr[1] "%d segundos"
 #: vendor/phpmyadmin/sql-parser/src/Component.php:47
 #: vendor/phpmyadmin/sql-parser/src/Component.php:67
 msgid "Not implemented yet."
-msgstr ""
+msgstr "Ainda não foi implementado."

 #: vendor/phpmyadmin/sql-parser/src/Components/AlterOperation.php:228
 #: vendor/phpmyadmin/sql-parser/src/Statement.php:337
@ -16300,10 +16284,8 @@ msgstr ""
 #: vendor/phpmyadmin/sql-parser/src/Statements/InsertStatement.php:227
 #: vendor/phpmyadmin/sql-parser/src/Statements/ReplaceStatement.php:165
 #: vendor/phpmyadmin/sql-parser/src/Statements/ReplaceStatement.php:193
-#, fuzzy
-#| msgid "Unexpected characters on line %s."
 msgid "Unexpected keyword."
-msgstr "Caracteres inesperados na linha %s."
+msgstr "Palavra-chave inesperada."

 #: vendor/phpmyadmin/sql-parser/src/Components/CaseExpression.php:202
 msgid "Unexpected end of CASE expression"
@ -17421,10 +17403,8 @@ msgid "Slow launch time"
 msgstr "Tempo de inícios lentos"

 #: libraries/advisory_rules.txt:368
-#, fuzzy
-#| msgid "Slow_launch_time is above 2s"
 msgid "Slow_launch_time is above 2s."
-msgstr "Slow_launch_time está acima de 2s"
+msgstr "Slow_launch_time está acima de 2s."

 #: libraries/advisory_rules.txt:369
 #, fuzzy
@ -17445,14 +17425,14 @@ msgstr "slow_launch_time está definido como %s"

 #: libraries/advisory_rules.txt:374
 msgid "Percentage of used connections"
-msgstr "Percentagem de conexões utilizadas"
+msgstr "Percentagem de ligações utilizadas"

 #: libraries/advisory_rules.txt:377
 msgid ""
 "The maximum amount of used connections is getting close to the value of "
 "{max_connections}."
 msgstr ""
-"O número máximo de conexões utilizadas está a aproximar-se do valor do "
+"O número máximo de ligações utilizadas está a aproximar-se do valor de "
 "{max_connections}."

 #: libraries/advisory_rules.txt:378
@ -17476,7 +17456,7 @@ msgstr ""

 #: libraries/advisory_rules.txt:381
 msgid "Percentage of aborted connections"
-msgstr "Percentagem de conexões interrompidas"
+msgstr "Percentagem de ligações interrompidas"

 #: libraries/advisory_rules.txt:384 libraries/advisory_rules.txt:391
 msgid "Too many connections are aborted."
@ -17557,15 +17537,15 @@ msgstr ""

 #: libraries/advisory_rules.txt:411
 msgid "Is InnoDB disabled?"
-msgstr "O InnoDB está desactivado?"
+msgstr "O InnoDB está desativado?"

 #: libraries/advisory_rules.txt:414
 msgid "You do not have InnoDB enabled."
-msgstr "Não possui o InnoDB activo."
+msgstr "Não tem o InnoDB ativado."

 #: libraries/advisory_rules.txt:415
 msgid "InnoDB is usually the better choice for table engines."
-msgstr "InnoDB é normalmente a melhor escolha para motor de tabelas."
+msgstr "InnoDB é normalmente a melhor escolha para motores de tabela."

 #: libraries/advisory_rules.txt:416
 msgid "have_innodb is set to 'value'"
@ -17573,7 +17553,7 @@ msgstr "have_innodb está definido como 'valor'"

 #: libraries/advisory_rules.txt:418
 msgid "InnoDB log size"
-msgstr "Tamanho dos registos do InnoDB"
+msgstr "Tamanho do registo de InnoDB"

 #: libraries/advisory_rules.txt:421
 msgid ""
--- a/po/pt_BR.po
+++ b/po/pt_BR.po
@ -4,8 +4,8 @@ msgstr ""
 "Project-Id-Version: phpMyAdmin 4.7.0-dev\n"
 "Report-Msgid-Bugs-To: translators@phpmyadmin.net\n"
 "POT-Creation-Date: 2016-12-13 10:40+0100\n"
-"PO-Revision-Date: 2017-01-03 16:54+0000\n"
-"Last-Translator: Daniel Palmeira Huanca <daniel46758@hotmail.com>\n"
+"PO-Revision-Date: 2017-01-16 16:13+0000\n"
+"Last-Translator: Ariel Alonso <arielmontessinobarbosa@gmail.com>\n"
 "Language-Team: Portuguese (Brazil) "
 "<https://hosted.weblate.org/projects/phpmyadmin/master/pt_BR/>\n"
 "Language: pt_BR\n"
@ -6152,7 +6152,6 @@ msgid "Set import and export directories and compression options."
 msgstr "Define diretórios de importação e exportação e opções de compressão."

 #: libraries/config/messages.inc.php:267
-#, fuzzy
 msgid "LaTeX"
 msgstr "LaTeX"

--- a/test/libraries/PMA_server_status_queries_test.php
+++ b/test/libraries/PMA_server_status_queries_test.php
@ -219,12 +219,9 @@ class PMA_ServerStatusQueries_Test extends PHPUnit_Framework_TestCase

        //validate 3:serverstatusquerieschart
        $this->assertContains(
-            '<div id="serverstatusquerieschart"></div>',
-            $html
-        );
-        $this->assertContains(
-            '<div id="serverstatusquerieschart_data"',
+            '<div id="serverstatusquerieschart" data-chart="',
            $html
        );
+
    }
 }