From e9e3998949adbacf82b90e9d2061bf56e609a373 Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Sun, 30 Nov 2014 06:41:57 -0500 Subject: [PATCH 1/6] 4.2.13 release Signed-off-by: Marc Delisle --- ChangeLog | 2 +- README | 2 +- doc/conf.py | 2 +- libraries/Config.class.php | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/ChangeLog b/ChangeLog index 8e035849bd..a26b9709ac 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,7 +1,7 @@ phpMyAdmin - ChangeLog ====================== -4.2.13.0 (not yet released) +4.2.13.0 (2014-11-30) - bug #4604 Query history not being deleted - bug #4057 db/table query string parameters no longer work - bug #4605 Unseen messages in tracking diff --git a/README b/README index a05b15900a..284cdc2173 100644 --- a/README +++ b/README @@ -1,7 +1,7 @@ phpMyAdmin - Readme =================== -Version 4.2.13-dev +Version 4.2.13 A set of PHP-scripts to manage MySQL over the web. diff --git a/doc/conf.py b/doc/conf.py index 466872beec..595dcabd66 100644 --- a/doc/conf.py +++ b/doc/conf.py @@ -51,7 +51,7 @@ copyright = u'2012 - 2014, The phpMyAdmin devel team' # built documents. # # The short X.Y version. -version = '4.2.13-dev' +version = '4.2.13' # The full version, including alpha/beta/rc tags. release = version diff --git a/libraries/Config.class.php b/libraries/Config.class.php index f6b66204d2..be7c1c600c 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -114,7 +114,7 @@ class PMA_Config */ function checkSystem() { - $this->set('PMA_VERSION', '4.2.13-dev'); + $this->set('PMA_VERSION', '4.2.13'); /** * @deprecated */ From 9b2479b7216dd91a6cc2f231c0fd6b85d457f6e2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Mon, 1 Dec 2014 21:51:59 +0530 Subject: [PATCH 2/6] bug #4612 [security] XSS vulnerability in redirection mechanism Signed-off-by: Madhura Jayaratne --- ChangeLog | 3 +++ url.php | 6 +++++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index a26b9709ac..77219f5786 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,9 @@ phpMyAdmin - ChangeLog ====================== +4.2.13.1 (not yet released) +- bug #4612 [security] XSS vulnerability in redirection mechanism + 4.2.13.0 (2014-11-30) - bug #4604 Query history not being deleted - bug #4057 db/table query string parameters no longer work diff --git a/url.php b/url.php index 71efc9fb6b..82b224311b 100644 --- a/url.php +++ b/url.php @@ -11,6 +11,10 @@ */ define('PMA_MINIMUM_COMMON', true); require_once './libraries/common.inc.php'; +/** + * JavaScript escaping. + */ +require_once './libraries/js_escape.lib.php'; if (! PMA_isValid($_GET['url']) || ! preg_match('/^https?:\/\/[^\n\r]*$/', $_GET['url']) @@ -24,7 +28,7 @@ if (! PMA_isValid($_GET['url']) // external site. echo ""; // Display redirecting msg on screen. From 1ac863c7573d12012374d5d41e5c7dc5505ea6e1 Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Tue, 2 Dec 2014 21:20:59 +0530 Subject: [PATCH 3/6] bug #4611 [security] DOS attack with long passwords Signed-off-by: Madhura Jayaratne --- ChangeLog | 1 + libraries/common.inc.php | 5 +++++ libraries/plugins/AuthenticationPlugin.class.php | 9 +++++++++ libraries/plugins/auth/AuthenticationCookie.class.php | 10 ++++++++++ 4 files changed, 25 insertions(+) diff --git a/ChangeLog b/ChangeLog index 77219f5786..c78b40a24f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -3,6 +3,7 @@ phpMyAdmin - ChangeLog 4.2.13.1 (not yet released) - bug #4612 [security] XSS vulnerability in redirection mechanism +- bug #4611 [security] DOS attack with long passwords 4.2.13.0 (2014-11-30) - bug #4604 Query history not being deleted diff --git a/libraries/common.inc.php b/libraries/common.inc.php index 2227c1e466..5cea823605 100644 --- a/libraries/common.inc.php +++ b/libraries/common.inc.php @@ -859,6 +859,9 @@ if (! defined('PMA_MINIMUM_COMMON')) { . ' ' . $cfg['Server']['auth_type'] ); } + if (isset($_REQUEST['pma_password'])) { + $_REQUEST['pma_password'] = substr($_REQUEST['pma_password'], 0, 256); + } include_once './libraries/plugins/auth/' . $auth_class . '.class.php'; // todo: add plugin manager $plugin_manager = null; @@ -988,6 +991,8 @@ if (! defined('PMA_MINIMUM_COMMON')) { $controllink = $userlink; } + $auth_plugin->storeUserCredentials(); + /* Log success */ PMA_logUser($cfg['Server']['user']); diff --git a/libraries/plugins/AuthenticationPlugin.class.php b/libraries/plugins/AuthenticationPlugin.class.php index 3ddf55ee20..7943d2cb15 100644 --- a/libraries/plugins/AuthenticationPlugin.class.php +++ b/libraries/plugins/AuthenticationPlugin.class.php @@ -41,6 +41,15 @@ abstract class AuthenticationPlugin extends PluginObserver */ abstract public function authSetUser(); + /** + * Stores user credentials after successful login. + * + * @return void + */ + public function storeUserCredentials() + { + } + /** * User is not allowed to login to MySQL -> authentication failed * diff --git a/libraries/plugins/auth/AuthenticationCookie.class.php b/libraries/plugins/auth/AuthenticationCookie.class.php index e21471c5eb..68cb5d4b35 100644 --- a/libraries/plugins/auth/AuthenticationCookie.class.php +++ b/libraries/plugins/auth/AuthenticationCookie.class.php @@ -557,6 +557,16 @@ class AuthenticationCookie extends AuthenticationPlugin unset($_SERVER['PHP_AUTH_PW']); $_SESSION['last_access_time'] = time(); + } + + /** + * Stores user credentials after successful login. + * + * @return void + */ + public function storeUserCredentials() + { + global $cfg; $this->createBlowfishIV(); From a59ef664974c20b688261fcd4d77554fd1050cdf Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Wed, 3 Dec 2014 08:13:36 -0500 Subject: [PATCH 4/6] 4.2.13.1 release Signed-off-by: Marc Delisle --- ChangeLog | 2 +- README | 2 +- doc/conf.py | 2 +- libraries/Config.class.php | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/ChangeLog b/ChangeLog index c78b40a24f..55769bc88c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,7 +1,7 @@ phpMyAdmin - ChangeLog ====================== -4.2.13.1 (not yet released) +4.2.13.1 (2014-12-03) - bug #4612 [security] XSS vulnerability in redirection mechanism - bug #4611 [security] DOS attack with long passwords diff --git a/README b/README index 284cdc2173..03485075f4 100644 --- a/README +++ b/README @@ -1,7 +1,7 @@ phpMyAdmin - Readme =================== -Version 4.2.13 +Version 4.2.13.1 A set of PHP-scripts to manage MySQL over the web. diff --git a/doc/conf.py b/doc/conf.py index 595dcabd66..b369db359c 100644 --- a/doc/conf.py +++ b/doc/conf.py @@ -51,7 +51,7 @@ copyright = u'2012 - 2014, The phpMyAdmin devel team' # built documents. # # The short X.Y version. -version = '4.2.13' +version = '4.2.13.1' # The full version, including alpha/beta/rc tags. release = version diff --git a/libraries/Config.class.php b/libraries/Config.class.php index be7c1c600c..fca662415b 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -114,7 +114,7 @@ class PMA_Config */ function checkSystem() { - $this->set('PMA_VERSION', '4.2.13'); + $this->set('PMA_VERSION', '4.2.13.1'); /** * @deprecated */ From 94952f52dad9490b4260067b68183a6d8c893869 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Mon, 1 Dec 2014 10:42:11 +0100 Subject: [PATCH 5/6] Adjust testcase to new split methods MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- test/classes/plugin/auth/PMA_AuthenticationCookie_test.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/test/classes/plugin/auth/PMA_AuthenticationCookie_test.php b/test/classes/plugin/auth/PMA_AuthenticationCookie_test.php index ca09a8d7b7..fcfdb1eb2e 100644 --- a/test/classes/plugin/auth/PMA_AuthenticationCookie_test.php +++ b/test/classes/plugin/auth/PMA_AuthenticationCookie_test.php @@ -797,6 +797,8 @@ class PMA_AuthenticationCookie_Test extends PHPUnit_Framework_TestCase isset($_SERVER['PHP_AUTH_PW']) ); + $this->object->storeUserCredentials(); + $this->assertTrue( isset($_COOKIE['pmaUser-1']) ); From f2a4b56afe4291513434db2f7b5541774d13f48b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Mon, 1 Dec 2014 11:56:03 +0100 Subject: [PATCH 6/6] Add missing call to test MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- test/classes/plugin/auth/PMA_AuthenticationCookie_test.php | 1 + 1 file changed, 1 insertion(+) diff --git a/test/classes/plugin/auth/PMA_AuthenticationCookie_test.php b/test/classes/plugin/auth/PMA_AuthenticationCookie_test.php index fcfdb1eb2e..38620970eb 100644 --- a/test/classes/plugin/auth/PMA_AuthenticationCookie_test.php +++ b/test/classes/plugin/auth/PMA_AuthenticationCookie_test.php @@ -868,6 +868,7 @@ class PMA_AuthenticationCookie_Test extends PHPUnit_Framework_TestCase $attrInstance->setValue(null, $mockResponse); $this->object->authSetUser(); + $this->object->storeUserCredentials(); $this->assertTrue( isset($_COOKIE['pmaServer-2'])