From 0fe7438a05692f2fe305b3a89e55904902a3b562 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Thu, 28 Jan 2016 09:31:14 +0100 Subject: [PATCH 1/5] Document last release MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- ChangeLog | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 544d1f9038..75e2b8f634 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,7 +1,7 @@ phpMyAdmin - ChangeLog ====================== -4.5.4.0 (not yet released) +4.5.4.0 (2016-01-28) - issue #11724 live data edit of big sets is not working - issue Table list not saved in db QBE bookmarked search - issue #11777 While 'changing a column', query fails with a syntax error after the 'CHARSET=' keyword @@ -29,6 +29,7 @@ phpMyAdmin - ChangeLog - issue #11854 Undefined property: stdClass::$releases at version check when disabled in config - issue #11814 SQL comment and variable stripped from bookmark on save - issue Gracefully handle errors in regex based javascript search +- issue [Security] PMASA-2016-1, PMASA-2016-2, PMASA-2016-3, PMASA-2016-4, PMASA-2016-5, PMASA-2016-6, PMASA-2016-7, PMASA-2016-8, PMASA-2016-9 4.5.3.1 (2015-12-25) - issue #11774 Undefined offset 2 From 8b83e0de27e7074f3c1cb30f22c5e277a7a83a95 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Thu, 28 Jan 2016 10:10:41 +0100 Subject: [PATCH 2/5] Use changelog from release notes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- ChangeLog | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 75e2b8f634..c04c6096d0 100644 --- a/ChangeLog +++ b/ChangeLog @@ -29,7 +29,15 @@ phpMyAdmin - ChangeLog - issue #11854 Undefined property: stdClass::$releases at version check when disabled in config - issue #11814 SQL comment and variable stripped from bookmark on save - issue Gracefully handle errors in regex based javascript search -- issue [Security] PMASA-2016-1, PMASA-2016-2, PMASA-2016-3, PMASA-2016-4, PMASA-2016-5, PMASA-2016-6, PMASA-2016-7, PMASA-2016-8, PMASA-2016-9 +- issue [Security] Multiple full path disclosure vulnerabilities, see PMASA-2016-1 +- issue [Security] Unsafe generation of CSRF token, see PMASA-2016-2 +- issue [Security] Multiple XSS vulnerabilities, see PMASA-2016-3 +- issue [Security] Insecure password generation in JavaScript, see PMASA-2016-4 +- issue [Security] Unsafe comparison of CSRF token, see PMASA-2016-5 +- issue [Security] Multiple full path disclosure vulnerabilities, see PMASA-2016-6 +- issue [Security] XSS vulnerability in normalization page, see PMASA-2016-7 +- issue [Security] Full path disclosure vulnerability in SQL parser, see PMASA-2016-8 +- issue [Security] XSS vulnerability in SQL editor, see PMASA-2016-9 4.5.3.1 (2015-12-25) - issue #11774 Undefined offset 2 From 30ac5b6094910051e0092f21d4abce1c0838aa95 Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Fri, 29 Jan 2016 08:33:42 +1100 Subject: [PATCH 3/5] Fix #11892 Error with PMA 4.4.15.3 Signed-off-by: Madhura Jayaratne --- ChangeLog | 3 +++ libraries/plugins/auth/AuthenticationCookie.class.php | 2 +- libraries/session.inc.php | 2 +- 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index c04c6096d0..f69847f62c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,9 @@ phpMyAdmin - ChangeLog ====================== +4.5.4.1 (2016-01-28) +- issue #11892 Error with PMA 4.4.15.3 + 4.5.4.0 (2016-01-28) - issue #11724 live data edit of big sets is not working - issue Table list not saved in db QBE bookmarked search diff --git a/libraries/plugins/auth/AuthenticationCookie.class.php b/libraries/plugins/auth/AuthenticationCookie.class.php index 4318502709..9033c6b557 100644 --- a/libraries/plugins/auth/AuthenticationCookie.class.php +++ b/libraries/plugins/auth/AuthenticationCookie.class.php @@ -41,7 +41,7 @@ if (! function_exists('openssl_encrypt') require PHPSECLIB_INC_DIR . '/Crypt/Base.php'; require PHPSECLIB_INC_DIR . '/Crypt/Rijndael.php'; require PHPSECLIB_INC_DIR . '/Crypt/AES.php'; - require PHPSECLIB_INC_DIR . '/Crypt/Random.php'; + require_once PHPSECLIB_INC_DIR . '/Crypt/Random.php'; } /** diff --git a/libraries/session.inc.php b/libraries/session.inc.php index 4413c968f4..cacddf7a7b 100644 --- a/libraries/session.inc.php +++ b/libraries/session.inc.php @@ -13,7 +13,7 @@ if (! defined('PHPMYADMIN')) { exit; } -require PHPSECLIB_INC_DIR . '/Crypt/Random.php'; +require_once PHPSECLIB_INC_DIR . '/Crypt/Random.php'; // verify if PHP supports session, die if it does not From 0b3ac5b557511285c7df1d02746469f239914cba Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Fri, 29 Jan 2016 08:36:55 +1100 Subject: [PATCH 4/5] Fix #11896 Remove hard dependency on phpseclib Signed-off-by: Madhura Jayaratne --- ChangeLog | 1 + libraries/session.inc.php | 16 +++++++++++++--- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index f69847f62c..984b38b8ba 100644 --- a/ChangeLog +++ b/ChangeLog @@ -3,6 +3,7 @@ phpMyAdmin - ChangeLog 4.5.4.1 (2016-01-28) - issue #11892 Error with PMA 4.4.15.3 +- issue #11896 Remove hard dependency on phpseclib 4.5.4.0 (2016-01-28) - issue #11724 live data edit of big sets is not working diff --git a/libraries/session.inc.php b/libraries/session.inc.php index cacddf7a7b..964a103578 100644 --- a/libraries/session.inc.php +++ b/libraries/session.inc.php @@ -13,7 +13,9 @@ if (! defined('PHPMYADMIN')) { exit; } -require_once PHPSECLIB_INC_DIR . '/Crypt/Random.php'; +if (! function_exists('openssl_random_pseudo_bytes')) { + require_once PHPSECLIB_INC_DIR . '/Crypt/Random.php'; +} // verify if PHP supports session, die if it does not @@ -113,7 +115,11 @@ if (! isset($_COOKIE[$session_name])) { * (we use "space PMA_token space" to prevent overwriting) */ if (! isset($_SESSION[' PMA_token '])) { - $_SESSION[' PMA_token '] = bin2hex(phpseclib\Crypt\Random::string(16)); + if (! function_exists('openssl_random_pseudo_bytes')) { + $_SESSION[' PMA_token '] = bin2hex(phpseclib\Crypt\Random::string(16)); + } else { + $_SESSION[' PMA_token '] = bin2hex(openssl_random_pseudo_bytes(16)); + } } /** @@ -132,5 +138,9 @@ function PMA_secureSession() ) { session_regenerate_id(true); } - $_SESSION[' PMA_token '] = bin2hex(phpseclib\Crypt\Random::string(16)); + if (! function_exists('openssl_random_pseudo_bytes')) { + $_SESSION[' PMA_token '] = bin2hex(phpseclib\Crypt\Random::string(16)); + } else { + $_SESSION[' PMA_token '] = bin2hex(openssl_random_pseudo_bytes(16)); + } } From 1cb223f320dbf29fd4ae00a21f5d6bb2e3f43524 Mon Sep 17 00:00:00 2001 From: Isaac Bennetch Date: Fri, 29 Jan 2016 07:47:22 -0500 Subject: [PATCH 5/5] Release 4.5.4.1 Signed-off-by: Isaac Bennetch --- ChangeLog | 2 +- README | 2 +- doc/conf.py | 2 +- libraries/Config.class.php | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/ChangeLog b/ChangeLog index 984b38b8ba..17f3e6ad18 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,7 +1,7 @@ phpMyAdmin - ChangeLog ====================== -4.5.4.1 (2016-01-28) +4.5.4.1 (2016-01-29) - issue #11892 Error with PMA 4.4.15.3 - issue #11896 Remove hard dependency on phpseclib diff --git a/README b/README index 02a210adcf..1c77549b88 100644 --- a/README +++ b/README @@ -1,7 +1,7 @@ phpMyAdmin - Readme =================== -Version 4.5.4 +Version 4.5.4.1 A set of PHP-scripts to manage MySQL over the web. diff --git a/doc/conf.py b/doc/conf.py index 7a8ce0af02..6ba577ab12 100644 --- a/doc/conf.py +++ b/doc/conf.py @@ -51,7 +51,7 @@ copyright = u'2012 - 2014, The phpMyAdmin devel team' # built documents. # # The short X.Y version. -version = '4.5.4' +version = '4.5.4.1' # The full version, including alpha/beta/rc tags. release = version diff --git a/libraries/Config.class.php b/libraries/Config.class.php index 7065bc04b8..262791f117 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -114,7 +114,7 @@ class PMA_Config */ public function checkSystem() { - $this->set('PMA_VERSION', '4.5.4'); + $this->set('PMA_VERSION', '4.5.4.1'); /** * @deprecated */