From 9b2479b7216dd91a6cc2f231c0fd6b85d457f6e2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Mon, 1 Dec 2014 21:51:59 +0530 Subject: [PATCH 1/9] bug #4612 [security] XSS vulnerability in redirection mechanism Signed-off-by: Madhura Jayaratne --- ChangeLog | 3 +++ url.php | 6 +++++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index a26b9709ac..77219f5786 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,9 @@ phpMyAdmin - ChangeLog ====================== +4.2.13.1 (not yet released) +- bug #4612 [security] XSS vulnerability in redirection mechanism + 4.2.13.0 (2014-11-30) - bug #4604 Query history not being deleted - bug #4057 db/table query string parameters no longer work diff --git a/url.php b/url.php index 71efc9fb6b..82b224311b 100644 --- a/url.php +++ b/url.php @@ -11,6 +11,10 @@ */ define('PMA_MINIMUM_COMMON', true); require_once './libraries/common.inc.php'; +/** + * JavaScript escaping. + */ +require_once './libraries/js_escape.lib.php'; if (! PMA_isValid($_GET['url']) || ! preg_match('/^https?:\/\/[^\n\r]*$/', $_GET['url']) @@ -24,7 +28,7 @@ if (! PMA_isValid($_GET['url']) // external site. echo ""; // Display redirecting msg on screen. From 1ac863c7573d12012374d5d41e5c7dc5505ea6e1 Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Tue, 2 Dec 2014 21:20:59 +0530 Subject: [PATCH 2/9] bug #4611 [security] DOS attack with long passwords Signed-off-by: Madhura Jayaratne --- ChangeLog | 1 + libraries/common.inc.php | 5 +++++ libraries/plugins/AuthenticationPlugin.class.php | 9 +++++++++ libraries/plugins/auth/AuthenticationCookie.class.php | 10 ++++++++++ 4 files changed, 25 insertions(+) diff --git a/ChangeLog b/ChangeLog index 77219f5786..c78b40a24f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -3,6 +3,7 @@ phpMyAdmin - ChangeLog 4.2.13.1 (not yet released) - bug #4612 [security] XSS vulnerability in redirection mechanism +- bug #4611 [security] DOS attack with long passwords 4.2.13.0 (2014-11-30) - bug #4604 Query history not being deleted diff --git a/libraries/common.inc.php b/libraries/common.inc.php index 2227c1e466..5cea823605 100644 --- a/libraries/common.inc.php +++ b/libraries/common.inc.php @@ -859,6 +859,9 @@ if (! defined('PMA_MINIMUM_COMMON')) { . ' ' . $cfg['Server']['auth_type'] ); } + if (isset($_REQUEST['pma_password'])) { + $_REQUEST['pma_password'] = substr($_REQUEST['pma_password'], 0, 256); + } include_once './libraries/plugins/auth/' . $auth_class . '.class.php'; // todo: add plugin manager $plugin_manager = null; @@ -988,6 +991,8 @@ if (! defined('PMA_MINIMUM_COMMON')) { $controllink = $userlink; } + $auth_plugin->storeUserCredentials(); + /* Log success */ PMA_logUser($cfg['Server']['user']); diff --git a/libraries/plugins/AuthenticationPlugin.class.php b/libraries/plugins/AuthenticationPlugin.class.php index 3ddf55ee20..7943d2cb15 100644 --- a/libraries/plugins/AuthenticationPlugin.class.php +++ b/libraries/plugins/AuthenticationPlugin.class.php @@ -41,6 +41,15 @@ abstract class AuthenticationPlugin extends PluginObserver */ abstract public function authSetUser(); + /** + * Stores user credentials after successful login. + * + * @return void + */ + public function storeUserCredentials() + { + } + /** * User is not allowed to login to MySQL -> authentication failed * diff --git a/libraries/plugins/auth/AuthenticationCookie.class.php b/libraries/plugins/auth/AuthenticationCookie.class.php index e21471c5eb..68cb5d4b35 100644 --- a/libraries/plugins/auth/AuthenticationCookie.class.php +++ b/libraries/plugins/auth/AuthenticationCookie.class.php @@ -557,6 +557,16 @@ class AuthenticationCookie extends AuthenticationPlugin unset($_SERVER['PHP_AUTH_PW']); $_SESSION['last_access_time'] = time(); + } + + /** + * Stores user credentials after successful login. + * + * @return void + */ + public function storeUserCredentials() + { + global $cfg; $this->createBlowfishIV(); From a59ef664974c20b688261fcd4d77554fd1050cdf Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Wed, 3 Dec 2014 08:13:36 -0500 Subject: [PATCH 3/9] 4.2.13.1 release Signed-off-by: Marc Delisle --- ChangeLog | 2 +- README | 2 +- doc/conf.py | 2 +- libraries/Config.class.php | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/ChangeLog b/ChangeLog index c78b40a24f..55769bc88c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,7 +1,7 @@ phpMyAdmin - ChangeLog ====================== -4.2.13.1 (not yet released) +4.2.13.1 (2014-12-03) - bug #4612 [security] XSS vulnerability in redirection mechanism - bug #4611 [security] DOS attack with long passwords diff --git a/README b/README index 284cdc2173..03485075f4 100644 --- a/README +++ b/README @@ -1,7 +1,7 @@ phpMyAdmin - Readme =================== -Version 4.2.13 +Version 4.2.13.1 A set of PHP-scripts to manage MySQL over the web. diff --git a/doc/conf.py b/doc/conf.py index 595dcabd66..b369db359c 100644 --- a/doc/conf.py +++ b/doc/conf.py @@ -51,7 +51,7 @@ copyright = u'2012 - 2014, The phpMyAdmin devel team' # built documents. # # The short X.Y version. -version = '4.2.13' +version = '4.2.13.1' # The full version, including alpha/beta/rc tags. release = version diff --git a/libraries/Config.class.php b/libraries/Config.class.php index be7c1c600c..fca662415b 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -114,7 +114,7 @@ class PMA_Config */ function checkSystem() { - $this->set('PMA_VERSION', '4.2.13'); + $this->set('PMA_VERSION', '4.2.13.1'); /** * @deprecated */ From 94952f52dad9490b4260067b68183a6d8c893869 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Mon, 1 Dec 2014 10:42:11 +0100 Subject: [PATCH 4/9] Adjust testcase to new split methods MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- test/classes/plugin/auth/PMA_AuthenticationCookie_test.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/test/classes/plugin/auth/PMA_AuthenticationCookie_test.php b/test/classes/plugin/auth/PMA_AuthenticationCookie_test.php index ca09a8d7b7..fcfdb1eb2e 100644 --- a/test/classes/plugin/auth/PMA_AuthenticationCookie_test.php +++ b/test/classes/plugin/auth/PMA_AuthenticationCookie_test.php @@ -797,6 +797,8 @@ class PMA_AuthenticationCookie_Test extends PHPUnit_Framework_TestCase isset($_SERVER['PHP_AUTH_PW']) ); + $this->object->storeUserCredentials(); + $this->assertTrue( isset($_COOKIE['pmaUser-1']) ); From f2a4b56afe4291513434db2f7b5541774d13f48b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Mon, 1 Dec 2014 11:56:03 +0100 Subject: [PATCH 5/9] Add missing call to test MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- test/classes/plugin/auth/PMA_AuthenticationCookie_test.php | 1 + 1 file changed, 1 insertion(+) diff --git a/test/classes/plugin/auth/PMA_AuthenticationCookie_test.php b/test/classes/plugin/auth/PMA_AuthenticationCookie_test.php index fcfdb1eb2e..38620970eb 100644 --- a/test/classes/plugin/auth/PMA_AuthenticationCookie_test.php +++ b/test/classes/plugin/auth/PMA_AuthenticationCookie_test.php @@ -868,6 +868,7 @@ class PMA_AuthenticationCookie_Test extends PHPUnit_Framework_TestCase $attrInstance->setValue(null, $mockResponse); $this->object->authSetUser(); + $this->object->storeUserCredentials(); $this->assertTrue( isset($_COOKIE['pmaServer-2']) From 72d2741f37c27a3e73aa36827fe5f8e73d351c4b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Thu, 4 Dec 2014 10:03:35 +0100 Subject: [PATCH 6/9] Adjust plurals equation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- po/hy.po | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/po/hy.po b/po/hy.po index 8a4a72ecb2..c29a5ffe18 100644 --- a/po/hy.po +++ b/po/hy.po @@ -16,7 +16,7 @@ msgstr "" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" -"Plural-Forms: nplurals=2; plural=(n != 1);\n" +"Plural-Forms: nplurals=1; plural=0;\n" "X-Generator: Weblate 2.0-dev\n" #: changelog.php:36 license.php:28 From d7b0f0d4f9e0ac78a3a83aeee7cbf91c389d275d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Thu, 4 Dec 2014 10:12:05 +0100 Subject: [PATCH 7/9] Install phpunit using composer MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The pear channel is now disabled so our test fail. Signed-off-by: Michal Čihař --- .travis.yml | 11 +++++++---- build.xml | 12 +++++++----- composer.json | 4 +++- 3 files changed, 17 insertions(+), 10 deletions(-) diff --git a/.travis.yml b/.travis.yml index 2281541f7f..990ed14863 100644 --- a/.travis.yml +++ b/.travis.yml @@ -9,6 +9,9 @@ php: - "5.4" - "5.3" - hhvm + +sudo: false + env: matrix: - PHPUNIT_ARGS="--exclude-group selenium" @@ -20,8 +23,12 @@ env: - TESTSUITE_PASSWORD=root - TESTSUITE_SELENIUM_COVERAGE=http://127.0.0.1:8000/phpunit_coverage.php before_script: + - export PATH=~/.composer/vendor/bin/:$PATH - mysql -uroot -e "SET PASSWORD = PASSWORD('$TESTSUITE_PASSWORD')" ; - set -e ; if [[ -z "$LINT" ]] ; then + + composer install --dev --no-interaction ; + if [[ $TRAVIS_PHP_VERSION != "hhvm" ]] ; then git clone --depth=1 git://github.com/zenovich/runkit.git ; @@ -34,10 +41,6 @@ before_script: phpenv config-add test/travis.php.ini ; - pear channel-discover pear.phpunit.de ; - pear install phpunit/PHPUnit_Selenium ; - - composer install --dev --no-interaction ; fi ; diff --git a/build.xml b/build.xml index 1f42fce3d4..cbd3e2827d 100644 --- a/build.xml +++ b/build.xml @@ -24,19 +24,19 @@ - + - + - + @@ -55,7 +55,7 @@ @@ -66,6 +66,7 @@ --exclude test --exclude PMAStandard --exclude build + --exclude vendor --exclude libraries/tcpdf --exclude libraries/php-gettext --exclude libraries/bfShapeFiles @@ -82,6 +83,7 @@ --exclude test --exclude PMAStandard --exclude build + --exclude vendor --exclude libraries/tcpdf --exclude libraries/php-gettext --exclude libraries/bfShapeFiles @@ -95,7 +97,7 @@ =5.3.0" }, "require-dev": { - "satooshi/php-coveralls": ">=0.6" + "satooshi/php-coveralls": ">=0.6", + "phpunit/phpunit": "<4.2", + "phpunit/phpunit-selenium": ">=1.2" } } From f8ed8422e64dfa153aded6c782db15d9e0cb383b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Thu, 4 Dec 2014 10:19:44 +0100 Subject: [PATCH 8/9] Revert "Adjust plurals equation" This reverts commit 72d2741f37c27a3e73aa36827fe5f8e73d351c4b. --- po/hy.po | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/po/hy.po b/po/hy.po index c29a5ffe18..8a4a72ecb2 100644 --- a/po/hy.po +++ b/po/hy.po @@ -16,7 +16,7 @@ msgstr "" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" -"Plural-Forms: nplurals=1; plural=0;\n" +"Plural-Forms: nplurals=2; plural=(n != 1);\n" "X-Generator: Weblate 2.0-dev\n" #: changelog.php:36 license.php:28 From 7a41a4f325264b04fd11e28f975e0199cb5e95d2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Thu, 4 Dec 2014 10:21:11 +0100 Subject: [PATCH 9/9] Fix syntax errors in po files MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- po/hy.po | 4 ++++ po/uz.po | 6 ++++++ 2 files changed, 10 insertions(+) diff --git a/po/hy.po b/po/hy.po index 8a4a72ecb2..9f01d21b63 100644 --- a/po/hy.po +++ b/po/hy.po @@ -302,6 +302,7 @@ msgstr "Վերջին ստուգումը" msgid "%s table" msgid_plural "%s tables" msgstr[0] "%s աղյուսակ" +msgstr[1] "%s աղյուսակ" #: db_qbe.php:102 msgid "You have to choose at least one column to display!" @@ -2447,6 +2448,7 @@ msgstr[1] "Ընդհանուր՝ %s համընկնում" msgid "%1$s match in %2$s" msgid_plural "%1$s matches in %2$s" msgstr[0] "" +msgstr[1] "" #: libraries/DbSearch.class.php:351 libraries/Menu.class.php:297 #: libraries/Util.class.php:3161 libraries/Util.class.php:3377 @@ -7624,6 +7626,7 @@ msgstr "Աղյուսակի մեկնաբանությունը" msgid "%s other result found" msgid_plural "%s other results found" msgstr[0] "" +msgstr[1] "" #: libraries/navigation/NavigationTree.class.php:877 msgid "Expand/Collapse" @@ -9314,6 +9317,7 @@ msgstr "" msgid "%d row affected by the last statement inside the procedure." msgid_plural "%d rows affected by the last statement inside the procedure." msgstr[0] "" +msgstr[1] "" #: libraries/rte/rte_routines.lib.php:1535 #: libraries/rte/rte_routines.lib.php:1543 diff --git a/po/uz.po b/po/uz.po index 5d30ab83bb..d65070183a 100644 --- a/po/uz.po +++ b/po/uz.po @@ -290,6 +290,7 @@ msgstr "Охирги текширув:" msgid "%s table" msgid_plural "%s tables" msgstr[0] "%s та жадвал" +msgstr[1] "%s та жадвал" #: db_qbe.php:102 #, fuzzy @@ -9060,6 +9061,7 @@ msgstr "Навигация ойнасини қайта юклаш" msgid "%s other result found" msgid_plural "%s other results found" msgstr[0] "" +msgstr[1] "" #: libraries/navigation/NavigationTree.class.php:877 msgid "Expand/Collapse" @@ -11061,6 +11063,7 @@ msgstr "Сақланадиган муолажаларни бажаришга р msgid "%d row affected by the last statement inside the procedure." msgid_plural "%d rows affected by the last statement inside the procedure." msgstr[0] "" +msgstr[1] "" #: libraries/rte/rte_routines.lib.php:1535 #: libraries/rte/rte_routines.lib.php:1543 @@ -11485,6 +11488,7 @@ msgstr "Статискани ёқиш" msgid "%1$d database has been dropped successfully." msgid_plural "%1$d databases have been dropped successfully." msgstr[0] "\"%s\" маълумотлар базаси муваффақиятли ўчирилди." +msgstr[1] "\"%s\" маълумотлар базаси муваффақиятли ўчирилди." #: libraries/server_plugins.lib.php:32 msgid "Modules" @@ -12182,6 +12186,7 @@ msgstr "" msgid "%d second" msgid_plural "%d seconds" msgstr[0] "секундига" +msgstr[1] "секундига" #: libraries/server_status_monitor.lib.php:80 #, fuzzy, php-format @@ -12189,6 +12194,7 @@ msgstr[0] "секундига" msgid "%d minute" msgid_plural "%d minutes" msgstr[0] "ишлатилмоқда" +msgstr[1] "ишлатилмоқда" #: libraries/server_status_monitor.lib.php:96 #, fuzzy