gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'MAINT_4_5_4' into STABLE

Browse Source
This commit is contained in:
Isaac Bennetch 2016-01-29 11:40:09 -05:00
commit 67745c67f2
6 changed files with 31 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
ChangeLog
View File

@ -1,7 +1,11 @@
phpMyAdmin - ChangeLog
======================
4.5.4.0 (not yet released)
4.5.4.1 (2016-01-29)
- issue #11892 Error with PMA 4.4.15.3
- issue #11896 Remove hard dependency on phpseclib
4.5.4.0 (2016-01-28)
- issue #11724 live data edit of big sets is not working
- issue Table list not saved in db QBE bookmarked search
- issue #11777 While 'changing a column', query fails with a syntax error after the 'CHARSET=' keyword
@ -29,6 +33,15 @@ phpMyAdmin - ChangeLog
- issue #11854 Undefined property: stdClass::$releases at version check when disabled in config
- issue #11814 SQL comment and variable stripped from bookmark on save
- issue Gracefully handle errors in regex based javascript search
- issue [Security] Multiple full path disclosure vulnerabilities, see PMASA-2016-1
- issue [Security] Unsafe generation of CSRF token, see PMASA-2016-2
- issue [Security] Multiple XSS vulnerabilities, see PMASA-2016-3
- issue [Security] Insecure password generation in JavaScript, see PMASA-2016-4
- issue [Security] Unsafe comparison of CSRF token, see PMASA-2016-5
- issue [Security] Multiple full path disclosure vulnerabilities, see PMASA-2016-6
- issue [Security] XSS vulnerability in normalization page, see PMASA-2016-7
- issue [Security] Full path disclosure vulnerability in SQL parser, see PMASA-2016-8
- issue [Security] XSS vulnerability in SQL editor, see PMASA-2016-9
4.5.3.1 (2015-12-25)
- issue #11774 Undefined offset 2

2
README
View File

@ -1,7 +1,7 @@
phpMyAdmin - Readme
===================
Version 4.5.4
Version 4.5.4.1
A set of PHP-scripts to manage MySQL over the web.

2
doc/conf.py
View File

@ -51,7 +51,7 @@ copyright = u'2012 - 2014, The phpMyAdmin devel team'
# built documents.
#
# The short X.Y version.
version = '4.5.4'
version = '4.5.4.1'
# The full version, including alpha/beta/rc tags.
release = version

2
libraries/Config.class.php
View File

@ -114,7 +114,7 @@ class PMA_Config
*/
public function checkSystem()
{
$this->set('PMA_VERSION', '4.5.4');
$this->set('PMA_VERSION', '4.5.4.1');
/**
* @deprecated
*/

2
libraries/plugins/auth/AuthenticationCookie.class.php
View File

@ -41,7 +41,7 @@ if (! function_exists('openssl_encrypt')
require PHPSECLIB_INC_DIR . '/Crypt/Base.php';
require PHPSECLIB_INC_DIR . '/Crypt/Rijndael.php';
require PHPSECLIB_INC_DIR . '/Crypt/AES.php';
require PHPSECLIB_INC_DIR . '/Crypt/Random.php';
require_once PHPSECLIB_INC_DIR . '/Crypt/Random.php';
}
/**

16
libraries/session.inc.php
View File

@ -13,7 +13,9 @@ if (! defined('PHPMYADMIN')) {
exit;
}
require PHPSECLIB_INC_DIR . '/Crypt/Random.php';
if (! function_exists('openssl_random_pseudo_bytes')) {
require_once PHPSECLIB_INC_DIR . '/Crypt/Random.php';
}
// verify if PHP supports session, die if it does not
@ -113,7 +115,11 @@ if (! isset($_COOKIE[$session_name])) {
* (we use "space PMA_token space" to prevent overwriting)
*/
if (! isset($_SESSION[' PMA_token '])) {
$_SESSION[' PMA_token '] = bin2hex(phpseclib\Crypt\Random::string(16));
if (! function_exists('openssl_random_pseudo_bytes')) {
$_SESSION[' PMA_token '] = bin2hex(phpseclib\Crypt\Random::string(16));
} else {
$_SESSION[' PMA_token '] = bin2hex(openssl_random_pseudo_bytes(16));
}
}
/**
@ -132,5 +138,9 @@ function PMA_secureSession()
) {
session_regenerate_id(true);
}
$_SESSION[' PMA_token '] = bin2hex(phpseclib\Crypt\Random::string(16));
if (! function_exists('openssl_random_pseudo_bytes')) {
$_SESSION[' PMA_token '] = bin2hex(phpseclib\Crypt\Random::string(16));
} else {
$_SESSION[' PMA_token '] = bin2hex(openssl_random_pseudo_bytes(16));
}
}