Merge branch 'master' of github.com:phpmyadmin/phpmyadmin

ChangeLog

@@ -16,12 +16,22 @@ phpMyAdmin - ChangeLog
 + [interface] Upgraded CodeMirror to 3.x series
 + rfe #1363 Improved query profiler
 
+4.0.4.0 (not yet released)
+- bug #3959 Using DefaultTabDatabase in NavigationTree for Database Click
+- bug #3961 Avoid Suhosin warning when in simulation mode
+- bug #3897 Row Statistics and Space usage bugs
+
 4.0.3.0 (not yet released)
 - bug #3941 Recent tables list always empty
 - bug #3933 Do not translate "Open Document" in export settings
 - bug #3927 List of tables is missing after expanding in the navigation frame
 - bug #3942 Warnings about reserved word for many non reserved words
 - bug #3912 Exporting row selection, resulted by ORDER BY query
+- bug #3957 Cookies must be enabled past this point
+- bug #3956 "Browse foreign values" search filter / page selector not working
+- bug #3579 NOW() function incorrectly selected (partial regression)
+- [security] Javascript execution vulnerability in Create view,
+  reported by Maxim Rupp (see PMASA-2013-6)
 
 4.0.2.0 (2013-05-24)
 - bug #3902 Cannot browse when table name contains keyword "call"

browse_foreigners.php

@@ -9,7 +9,22 @@
 require_once 'libraries/common.inc.php';
 require_once 'libraries/transformations.lib.php';
 
-$field = $_REQUEST['field'];
+/**
+ * Sets globals from $_REQUEST
+ */
+$request_params = array(
+    'field',
+    'fieldkey',
+    'foreign_filter',
+    'pos',
+    'rownumber'
+);
+
+foreach ($request_params as $one_request_param) {
+    if (isset($_REQUEST[$one_request_param])) {
+        $GLOBALS[$one_request_param] = $_REQUEST[$one_request_param];
+    }
+}
 
 PMA_Util::checkParameters(array('db', 'table', 'field'));
 
@@ -66,6 +81,7 @@ if (is_array($foreignData['disp_row'])) {
 
     if ($foreignData['the_total'] > $GLOBALS['cfg']['MaxRows']) {
         $gotopage = PMA_Util::pageselector(
+            'pos',
             $session_max_rows,
             $pageNow,
             $nbTotalPage,

doc/config.rst

@@ -2609,14 +2609,14 @@ SQL parser settings
     :type: string
     :default: ``'html'``
 
-    The main use of the new :term:`SQL` Parser
-    is to pretty-print :term:`SQL` queries. By
-    default we use HTML to format the query, but you can disable this by
+    The main use of the :term:`SQL` Parser
+    is to format and analyze :term:`SQL` queries. By
+    default we use text to format the query, but you can disable this by
     setting this variable to ``'none'``.
 
     Available options:
 
-    * ``'html'``
+    * ``'text'``
     * ``'none'``
 
 .. _cfg_SQP:

index.php

@@ -535,6 +535,8 @@ if (isset($GLOBALS['dbi']) && !PMA_DRIZZLE) {
  */
 if ($cfg['SuhosinDisableWarning'] == false
     && @ini_get('suhosin.request.max_value_length')
+    // warn about Suhosin only if its simulation mode is not enabled
+    && @ini_get('suhosin.simulation') == '0'
 ) {
     trigger_error(
         sprintf(

js/tbl_select.js

@@ -175,7 +175,7 @@ AJAX.registerOnload('tbl_select.js', function () {
         ];
         var outputGeomFunctions = binaryFunctions.concat(tempArray);
 
-        // If the chosen function takes two geomerty objects as parameters
+        // If the chosen function takes two geometry objects as parameters
         var $operator = $geomFuncSelector.parents('tr').find('td:nth-child(5)').find('select');
         if ($.inArray($geomFuncSelector.val(), binaryFunctions) >= 0) {
             $operator.prop('readonly', true);

libraries/Header.class.php

@@ -616,14 +616,6 @@ class PMA_Header
     {
         $retval = '';
         if ($this->_warningsEnabled) {
-            // message of "Cookies required" displayed for auth_type http or config
-            // note: here, the decoration won't work because without cookies,
-            // our standard CSS is not operational
-            if (empty($_COOKIE)) {
-                $retval .= PMA_Message::notice(
-                    __('Cookies must be enabled past this point.')
-                )->getDisplay();
-            }
             $retval .= "<noscript>";
             $retval .= PMA_message::error(
                 __("Javascript must be enabled past this point")

libraries/Table.class.php

@@ -273,6 +273,7 @@ class PMA_Table
             );
             $analyzed_sql = PMA_SQP_analyze(PMA_SQP_parse($show_create_table));
         }
+        return $analyzed_sql;
     }
 
     /**

libraries/Util.class.php

@@ -404,9 +404,6 @@ class PMA_Util
                 $formatted_sql = PMA_SQP_formatNone($parsed_sql);
             }
             break;
-        case 'html':
-            $formatted_sql = PMA_SQP_format($parsed_sql, 'color');
-            break;
         case 'text':
             $formatted_sql = PMA_SQP_format($parsed_sql, 'text');
             break;
@@ -3745,6 +3742,7 @@ class PMA_Util
         // and the column does not have the
         // ON UPDATE DEFAULT TIMESTAMP attribute.
         if (($field['True_Type'] == 'timestamp')
+            && $field['first_timestamp']
             && empty($field['Default'])
             && empty($data)
             && ! isset($analyzed_sql_field_array['on_update_current_timestamp'])
@@ -3753,11 +3751,6 @@ class PMA_Util
             $default_function = $cfg['DefaultFunctions']['first_timestamp'];
         }
 
-        // Default for first timestamp field
-        if ($field['first_timestamp']) {
-            $default_function = $cfg['DefaultFunctions']['first_timestamp'];
-        }
-
         // For primary keys of type char(36) or varchar(36) UUID if the default
         // function
         // Only applies to insert mode, as it would silently trash data on updates.
@@ -4109,18 +4102,18 @@ class PMA_Util
      *
      * @return String Matching regular expression.
      */
-    public static function getFirstOccuringRegularExpression($regex_array, $query)
+    public static function getFirstOccurringRegularExpression($regex_array, $query)
     {
-        $minimum_first_occurance_index = null;
+        $minimum_first_occurence_index = null;
         $regex = null;
 
         for ($i = 0; $i < count($regex_array); $i++) {
             if (preg_match($regex_array[$i], $query, $matches, PREG_OFFSET_CAPTURE)) {
-                if (is_null($minimum_first_occurance_index)
-                    || ($matches[0][1] < $minimum_first_occurance_index)
+                if (is_null($minimum_first_occurence_index)
+                    || ($matches[0][1] < $minimum_first_occurence_index)
                 ) {
                     $regex = $regex_array[$i];
-                    $minimum_first_occurance_index = $matches[0][1];
+                    $minimum_first_occurence_index = $matches[0][1];
                 }
             }
         }

libraries/insert_edit.lib.php

@@ -511,7 +511,7 @@ function PMA_getNullColumn($column, $column_name_appendix, $real_null_value,
     $html_output .= '<input type="checkbox" class="checkbox_null" tabindex="'
         . ($tabindex + $tabindex_for_null) . '"'
         . ' name="fields_null' . $column_name_appendix . '"';
-    if ($real_null_value && !$column['first_timestamp']) {
+    if ($real_null_value) {
         $html_output .= ' checked="checked"';
     }
     $html_output .= ' id="field_' . ($idindex) . '_2" />';

libraries/navigation/Nodes/Node_Database.class.php

@@ -31,7 +31,8 @@ class Node_Database extends Node
         parent::__construct($name, $type, $is_group);
         $this->icon  = PMA_Util::getImage('s_db.png');
         $this->links = array(
-            'text' => 'db_structure.php?server=' . $GLOBALS['server']
+            'text' => $GLOBALS['cfg']['DefaultTabDatabase']
+                    . '?server=' . $GLOBALS['server']
                     . '&db=%1$s&token=' . $GLOBALS['token'],
             'icon' => 'db_operations.php?server=' . $GLOBALS['server']
                     . '&db=%1$s&token=' . $GLOBALS['token']

libraries/plugins/auth/AuthenticationCookie.class.php

@@ -262,14 +262,6 @@ class AuthenticationCookie extends AuthenticationPlugin
         Swekey_login('input_username', 'input_go');
         // END Swekey Integration
 
-        // show the "Cookies required" message only if cookies are disabled
-        // (we previously tried to set some cookies)
-        if (empty($_COOKIE)) {
-            trigger_error(
-                __('Cookies must be enabled past this point.'),
-                E_USER_NOTICE
-            );
-        }
         if ($GLOBALS['error_handler']->hasDisplayErrors()) {
             echo '<div>';
             $GLOBALS['error_handler']->dispErrors();

libraries/session.inc.php

@@ -92,7 +92,8 @@ if (! isset($_COOKIE[$session_name])) {
         PMA_fatalError(
             'Cannot start session without errors, please check errors given '
             . 'in your PHP and/or webserver log file and configure your PHP '
-            . 'installation properly.'
+            . 'installation properly. Also ensure that cookies are enabled '
+            . 'in your browser.'
         );
     }
     unset($orig_error_count);

libraries/sqlparser.lib.php

@@ -1233,7 +1233,6 @@ function PMA_SQP_analyze($arr)
                  * present in the list of forbidden words, for example
                  * "storage" which can be used as an identifier
                  *
-                 * @todo avoid the pretty printing in color in this case
                  */
                 $identifier = $arr[$i]['data'];
                 break;
@@ -2146,33 +2145,6 @@ function PMA_SQP_analyze($arr)
 } // end of the "PMA_SQP_analyze()" function
 
 
-/**
- * Colorizes SQL queries html formatted
- *
- * @param array $arr The SQL queries html formatted
- *
- * @return array   The colorized SQL queries
- *
- * @todo check why adding a "\n" after the </span> would cause extra blanks
- * to be displayed: SELECT p . person_name
- *
- * @access public
- */
-function PMA_SQP_formatHtml_colorize($arr)
-{
-    $i         = PMA_strpos($arr['type'], '_');
-    $class     = '';
-    if ($i > 0) {
-        $class = 'syntax_' . PMA_substr($arr['type'], 0, $i) . ' ';
-    }
-
-    $class     .= 'syntax_' . $arr['type'];
-
-    return '<span class="' . $class . '">'
-        . htmlspecialchars($arr['data']) . '</span>';
-} // end of the "PMA_SQP_formatHtml_colorize()" function
-
-
 /**
  * Formats SQL queries
  *
@@ -2186,7 +2158,7 @@ function PMA_SQP_formatHtml_colorize($arr)
  * @access public
  */
 function PMA_SQP_format(
-    $arr, $mode='color', $start_token=0,
+    $arr, $mode='text', $start_token=0,
     $number_of_tokens=-1
 ) {
     global $PMA_SQPdata_operators_docs, $PMA_SQPdata_functions_docs;
@@ -2202,11 +2174,6 @@ function PMA_SQP_format(
     }
     // else do it properly
     switch ($mode) {
-    case 'color':
-        $str                                = '<span class="syntax">';
-        $html_line_break                    = '<br />';
-        $docu                               = true;
-        break;
     case 'query_only':
         $str                                = '';
         $html_line_break                    = "\n";
@@ -2887,9 +2854,7 @@ function PMA_SQP_format(
         $after                 .= "\n";
         */
         $str .= $before;
-        if ($mode=='color') {
-            $str .= PMA_SQP_formatHtml_colorize($arr[$i]);
-        } elseif ($mode == 'text') {
+        if ($mode == 'text') {
             $str .= htmlspecialchars($arr[$i]['data']);
         } else {
             $str .= $arr[$i]['data'];
@@ -2910,10 +2875,6 @@ function PMA_SQP_format(
         // close inner_sql span
             $str .= '</span>';
     }
-    if ($mode=='color') {
-        // close syntax span
-        $str .= '</span>';
-    }
 
     return $str;
 } // end of the "PMA_SQP_format()" function

libraries/structure.lib.php

@@ -1667,7 +1667,7 @@ function getHtmlForRowStatsTable($showtable, $tbl_collation,
     $odd_row = false;
     $html_output = '<table id="tablerowstats" class="data">';
     $html_output .= '<caption class="tblHeaders">'
-        . __('Row Statistics') . '</caption>';
+        . __('Row statistics') . '</caption>';
     $html_output .= '<tbody>';
 
     if (isset($showtable['Row_format'])) {
@@ -1714,11 +1714,18 @@ function getHtmlForRowStatsTable($showtable, $tbl_collation,
         && isset($showtable['Avg_row_length'])
         && $showtable['Avg_row_length'] > 0
     ) {
+        list($avg_row_length_value, $avg_row_length_unit) 
+            = PMA_Util::formatByteDown(
+                $showtable['Avg_row_length'],
+                6, 
+                1
+            );
         $html_output .= PMA_getHtmlForRowStatsTableRow(
             $odd_row,
             __('Row length'),
-            PMA_Util::formatNumber($showtable['Avg_row_length'], 0)
+            ($avg_row_length_value . ' ' . $avg_row_length_unit)
         );
+        unset($avg_row_length_value, $avg_row_length_unit);
         $odd_row = !$odd_row;
     }
     if (!$is_innodb
@@ -1747,6 +1754,7 @@ function getHtmlForRowStatsTable($showtable, $tbl_collation,
             __('Creation'),
             PMA_Util::localisedDate(strtotime($showtable['Create_time']))
         );
+        $odd_row = !$odd_row;
     }
     if (isset($showtable['Update_time'])) {
         $html_output .= PMA_getHtmlForRowStatsTableRow(

phpunit.xml.dist

@@ -55,6 +55,7 @@
             <exclude>
                 <!-- we don't care about coverage of embedded libraries -->
                 <directory suffix=".php">libraries/tcpdf</directory>
+                <directory suffix=".php">libraries/phpseclib</directory>
                 <directory suffix=".php">libraries/bfShapeFiles</directory>
                 <directory suffix=".php">libraries/php-gettext</directory>
                 <directory suffix=".inc">libraries/php-gettext</directory>

test/libraries/common/PMA_formatSql_test.php

@@ -44,243 +44,6 @@ class PMA_FormatSql_Test extends PHPUnit_Framework_TestCase
         $cfg = $this->tmpCfg;
     }
 
-    function testFormatSQLNotArray()
-    {
-        global $cfg;
-        $cfg['SQP']['fmtType'] = 'html';
-        $sql = "SELECT * FROM tTable;";
-        $this->assertEquals(
-            "<pre>\n$sql\n</pre>",
-            PMA_Util::formatSql($sql)
-        );
-    }
-
-    function testFormatSQLfmTypeHtml_1()
-    {
-        global $cfg;
-        $cfg['SQP']['fmtType'] = 'html';
-        $cfg['MySQLManualType'] = 'none';
-
-        $sql = array (
-          'raw' => 'SELECT 1;',
-          0 =>
-          array (
-            'type' => 'alpha_reservedWord',
-            'data' => 'SELECT',
-            'pos' => 6,
-            'forbidden' => true,
-          ),
-          1 =>
-          array (
-            'type' => 'digit_integer',
-            'data' => '1',
-            'pos' => 8,
-          ),
-          2 =>
-          array (
-            'type' => 'punct_queryend',
-            'data' => ';',
-            'pos' => 0,
-          ),
-          'len' => 3,
-        );
-        $unparsed = "SELECT 1;";
-        $expected = '<span class="syntax"><span class="inner_sql"><span class="syntax_alpha syntax_alpha_reservedWord">SELECT</span></a> <span class="syntax_digit syntax_digit_integer">1</span> <span class="syntax_punct syntax_punct_queryend">;</span><br /><br /></span></span>';
-
-        $this->assertEquals(
-            $expected,
-            PMA_Util::formatSql($sql, $unparsed)
-        );
-    }
-
-    function testFormatSQLfmTypeHtml_2()
-    {
-        global $cfg;
-        $cfg['SQP']['fmtType'] = 'html';
-        $cfg['MySQLManualType'] = 'none';
-
-        $unparsed = "SELECT * from `tTable`;";
-        $sql = array (
-          'raw' => $unparsed,
-          0 =>
-          array (
-            'type' => 'alpha_reservedWord',
-            'data' => 'SELECT',
-            'pos' => 6,
-            'forbidden' => true,
-          ),
-          1 =>
-          array (
-            'type' => 'punct',
-            'data' => '*',
-            'pos' => 0,
-          ),
-          2 =>
-          array (
-            'type' => 'alpha_reservedWord',
-            'data' => 'from',
-            'pos' => 13,
-            'forbidden' => true,
-          ),
-          3 =>
-          array (
-            'type' => 'quote_backtick',
-            'data' => '`tTable`',
-            'pos' => 0,
-          ),
-          4 =>
-          array (
-            'type' => 'punct_queryend',
-            'data' => ';',
-            'pos' => 0,
-          ),
-          'len' => 5,
-        );
-        $expected = '<span class="syntax"><span class="inner_sql"><span class="syntax_alpha syntax_alpha_reservedWord">SELECT</span></a>  <span class="syntax_punct">*</span> <br /><span class="syntax_alpha syntax_alpha_reservedWord">FROM</span>  <span class="syntax_quote syntax_quote_backtick">`tTable`</span> <span class="syntax_punct syntax_punct_queryend">;</span><br /><br /></span></span>';
-
-        $this->assertEquals(
-            $expected, PMA_Util::formatSql($sql, $unparsed)
-        );
-    }
-
-    function testFormatSQLfmTypeHtml_3()
-    {
-        global $cfg;
-        $cfg['SQP']['fmtType'] = 'html';
-        $cfg['MySQLManualType'] = 'none';
-
-        $unparsed = 'SELECT * FROM `tTable_A` A INNER JOIN `tTable_B` B ON B.ID = A.ID;';
-        $sql = array (
-          'raw' => $unparsed,
-          0 =>
-          array (
-            'type' => 'alpha_reservedWord',
-            'data' => 'SELECT',
-            'pos' => 6,
-            'forbidden' => true,
-          ),
-          1 =>
-          array (
-            'type' => 'punct',
-            'data' => '*',
-            'pos' => 0,
-          ),
-          2 =>
-          array (
-            'type' => 'alpha_reservedWord',
-            'data' => 'FROM',
-            'pos' => 13,
-            'forbidden' => true,
-          ),
-          3 =>
-          array (
-            'type' => 'quote_backtick',
-            'data' => '`tTable_A`',
-            'pos' => 0,
-          ),
-          4 =>
-          array (
-            'type' => 'alpha_identifier',
-            'data' => 'A',
-            'pos' => 26,
-            'forbidden' => false,
-          ),
-          5 =>
-          array (
-            'type' => 'alpha_reservedWord',
-            'data' => 'INNER',
-            'pos' => 32,
-            'forbidden' => true,
-          ),
-          6 =>
-          array (
-            'type' => 'alpha_reservedWord',
-            'data' => 'JOIN',
-            'pos' => 37,
-            'forbidden' => true,
-          ),
-          7 =>
-          array (
-            'type' => 'quote_backtick',
-            'data' => '`tTable_B`',
-            'pos' => 0,
-          ),
-          8 =>
-          array (
-            'type' => 'alpha_identifier',
-            'data' => 'B',
-            'pos' => 50,
-            'forbidden' => false,
-          ),
-          9 =>
-          array (
-            'type' => 'alpha_reservedWord',
-            'data' => 'ON',
-            'pos' => 53,
-            'forbidden' => true,
-          ),
-          10 =>
-          array (
-            'type' => 'alpha_identifier',
-            'data' => 'B',
-            'pos' => 55,
-            'forbidden' => false,
-          ),
-          11 =>
-          array (
-            'type' => 'punct_qualifier',
-            'data' => '.',
-            'pos' => 0,
-          ),
-          12 =>
-          array (
-            'type' => 'alpha_identifier',
-            'data' => 'ID',
-            'pos' => 58,
-            'forbidden' => false,
-          ),
-          13 =>
-          array (
-            'type' => 'punct',
-            'data' => '=',
-            'pos' => 0,
-          ),
-          14 =>
-          array (
-            'type' => 'alpha_identifier',
-            'data' => 'A',
-            'pos' => 62,
-            'forbidden' => false,
-          ),
-          15 =>
-          array (
-            'type' => 'punct_qualifier',
-            'data' => '.',
-            'pos' => 0,
-          ),
-          16 =>
-          array (
-            'type' => 'alpha_identifier',
-            'data' => 'ID',
-            'pos' => 65,
-            'forbidden' => false,
-          ),
-          17 =>
-          array (
-            'type' => 'punct_queryend',
-            'data' => ';',
-            'pos' => 0,
-          ),
-          'len' => 18,
-        );
-
-        $expected = '<span class="syntax"><span class="inner_sql"><span class="syntax_alpha syntax_alpha_reservedWord">SELECT</span></a>  <span class="syntax_punct">*</span> <br /><span class="syntax_alpha syntax_alpha_reservedWord">FROM</span>  <span class="syntax_quote syntax_quote_backtick">`tTable_A`</span> <span class="syntax_alpha syntax_alpha_identifier">A</span><br /><span class="syntax_alpha syntax_alpha_reservedWord">INNER</span>  <span class="syntax_alpha syntax_alpha_reservedWord">JOIN</span>  <span class="syntax_quote syntax_quote_backtick">`tTable_B`</span> <span class="syntax_alpha syntax_alpha_identifier">B</span> <span class="syntax_alpha syntax_alpha_reservedWord">ON</span> <span class="syntax_alpha syntax_alpha_identifier">B</span><span class="syntax_punct syntax_punct_qualifier">.</span><span class="syntax_alpha syntax_alpha_identifier">ID</span> <span class="syntax_punct">=</span></a> <span class="syntax_alpha syntax_alpha_identifier">A</span><span class="syntax_punct syntax_punct_qualifier">.</span><span class="syntax_alpha syntax_alpha_identifier">ID</span><span class="syntax_punct syntax_punct_queryend">;</span><br /><br /></span></span>';
-
-        $this->assertEquals(
-            $expected, PMA_Util::formatSql($sql, $unparsed)
-        );
-    }
-
     function testFormatSQLfmTypeText_1()
     {
         global $cfg;
@@ -744,37 +507,6 @@ class PMA_FormatSql_Test extends PHPUnit_Framework_TestCase
         );
     }
 
-    function testFormatSQLWithoutType()
-    {
-        global $cfg;
-        $cfg['SQP']['fmtType'] = '';
-        $cfg['MySQLManualType'] = 'none';
-        $sql = array (
-          'raw' => 'SELECT 1;',
-          0 =>
-          array (
-            'type' => 'alpha_reservedWord',
-            'data' => 'SELECT',
-            'pos' => 6,
-            'forbidden' => true,
-          ),
-          1 =>
-          array (
-            'type' => 'digit_integer',
-            'data' => '1',
-            'pos' => 8,
-          ),
-          2 =>
-          array (
-            'type' => 'punct_queryend',
-            'data' => ';',
-            'pos' => 0,
-          ),
-          'len' => 3,
-        );
-        $this->assertEmpty(PMA_Util::formatSql($sql));
-    }
-
     function testFormatSQLError()
     {
         global $SQP_errorString;

view_create.php

@@ -114,7 +114,8 @@ if (isset($_REQUEST['createview'])) {
             $response->addJSON(
                 'message',
                 PMA_Message::error(
-                    "<i>$sql_query</i><br /><br />" . $GLOBALS['dbi']->getError()
+                    "<i>" . htmlspecialchars($sql_query) . "</i><br /><br />"
+                    . $GLOBALS['dbi']->getError()
                 )
             );
             $response->isSuccess(false);