From 01724139b26884a22deca270f23d18dc32225cb3 Mon Sep 17 00:00:00 2001 From: William Desportes Date: Sat, 10 Sep 2022 21:45:24 +0200 Subject: [PATCH 1/6] Add the version to composer.json at release build time Ref: https://github.com/Roave/SecurityAdvisories/issues/76 Fixes: https://github.com/phpmyadmin/phpmyadmin/issues/17661 Signed-off-by: William Desportes --- scripts/create-release.sh | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/scripts/create-release.sh b/scripts/create-release.sh index 14222674db..0f9bcd9b46 100755 --- a/scripts/create-release.sh +++ b/scripts/create-release.sh @@ -449,6 +449,10 @@ if [ -z "$PHP_REQ" ] ; then echo "Failed to figure out required PHP version from composer.json" exit 2 fi + +echo "* Writing the version to composer.json (version: $version)" +composer config version "$version" + # Okay, there is no way to tell composer to install # suggested package. Let's require it and then revert # composer.json to original state. From 2fff5f48bc700115c544d9fa8be264557fa2fb7a Mon Sep 17 00:00:00 2001 From: William Desportes Date: Mon, 5 Sep 2022 01:01:51 +0200 Subject: [PATCH 2/6] Add a security to check if all files present in the autoload class map can be found and re-generate the class map Signed-off-by: William Desportes --- composer.json | 5 +++- scripts/create-release.sh | 49 +++++++++++++++++++++++++++++++++++++-- 2 files changed, 51 insertions(+), 3 deletions(-) diff --git a/composer.json b/composer.json index b156cd7fdf..b8426b825d 100644 --- a/composer.json +++ b/composer.json @@ -24,7 +24,10 @@ "psr-4": { "PhpMyAdmin\\": "libraries/classes" }, - "files": ["vendor/phpmyadmin/motranslator/src/functions.php"] + "files": ["vendor/phpmyadmin/motranslator/src/functions.php"], + "exclude-from-classmap": [ + "/test/" + ] }, "autoload-dev": { "psr-4": { diff --git a/scripts/create-release.sh b/scripts/create-release.sh index 0f9bcd9b46..0567079944 100755 --- a/scripts/create-release.sh +++ b/scripts/create-release.sh @@ -302,6 +302,42 @@ security_checkup() { fi } +autoload_checkup() { + php <<'CODE' + 0) { + echo '[autoload class map checkup] There is some missing files documented in the class map' . PHP_EOL; + exit(1); +} +echo '[autoload class map checkup] The autoload class map seems okay' . PHP_EOL; +CODE + +} + # Ensure we have tracking branch ensure_local_branch $branch @@ -460,7 +496,7 @@ cp composer.json composer.json.backup COMPOSER_VERSION="$(composer --version)" echo "* Running composer (version: $COMPOSER_VERSION)" composer config platform.php "$PHP_REQ" -composer update --no-interaction --no-dev --optimize-autoloader +composer update --no-interaction --no-dev # Parse the required versions from composer.json PACKAGES_VERSIONS='' @@ -474,7 +510,7 @@ done echo "* Installing composer packages '$PACKAGES_VERSIONS'" -composer require --no-interaction --optimize-autoloader --update-no-dev $PACKAGES_VERSIONS +composer require --no-interaction --update-no-dev $PACKAGES_VERSIONS echo "* Running a security checkup" security_checkup @@ -483,6 +519,15 @@ echo "* Cleaning up vendor folders" mv composer.json.backup composer.json cleanup_composer_vendors +echo "* Re-generating the autoload class map" +# https://getcomposer.org/doc/articles/autoloader-optimization.md#what-does-it-do- +# We removed some files, we also need that composer removes them from autoload class maps +# If the class is in the class map (as explained in the link above) then it is assumed to exist as a file +composer dump-autoload --no-interaction --optimize --dev + +echo "* Running an autoload checkup" +autoload_checkup + echo "* Running a security checkup" security_checkup if [ $do_tag -eq 1 ] ; then From 278eb797bce73740c5862141156035e78bff090a Mon Sep 17 00:00:00 2001 From: William Desportes Date: Thu, 29 Sep 2022 13:21:25 +0200 Subject: [PATCH 3/6] Remove tcpdf autoloaded files Signed-off-by: William Desportes --- composer.json | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/composer.json b/composer.json index b8426b825d..95e6de0090 100644 --- a/composer.json +++ b/composer.json @@ -26,7 +26,12 @@ }, "files": ["vendor/phpmyadmin/motranslator/src/functions.php"], "exclude-from-classmap": [ - "/test/" + "/test/", + "/vendor/tecnickcom/tcpdf/tcpdf_barcodes_*.php", + "/vendor/tecnickcom/tcpdf/tcpdf_import.php", + "/vendor/tecnickcom/tcpdf/tcpdf_parser.php", + "/vendor/tecnickcom/tcpdf/include/tcpdf_filters.php", + "/vendor/tecnickcom/tcpdf/include/barcodes" ] }, "autoload-dev": { From 050c5682af143c870f960a8d11e6b1e34e35b2be Mon Sep 17 00:00:00 2001 From: William Desportes Date: Sat, 10 Sep 2022 13:44:27 +0200 Subject: [PATCH 4/6] Update FAQ 1.44 Signed-off-by: William Desportes --- doc/faq.rst | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/doc/faq.rst b/doc/faq.rst index ff1e928f0d..78be8c44f8 100644 --- a/doc/faq.rst +++ b/doc/faq.rst @@ -686,16 +686,20 @@ Some users have requested to be able to reduce the size of the phpMyAdmin instal This is not recommended and could lead to confusion over missing features, but can be done. A list of files and corresponding functionality which degrade gracefully when removed include: -* :file:`./vendor/tecnickcom/tcpdf` folder (exporting to PDF) * :file:`./locale/` folder, or unused subfolders (interface translations) -* Any unused themes in :file:`./themes/` -* :file:`./js/vendor/jquery/src/` (included for licensing reasons) -* :file:`./js/line_counts.php` (removed in phpMyAdmin 4.8) +* Any unused themes in :file:`./themes/` except the default theme `pmahomme`. +* :file:`./libraries/language_stats.inc.php` (translation statistics) * :file:`./doc/` (documentation) * :file:`./setup/` (setup script) -* :file:`./examples/` -* :file:`./sql/` (SQL scripts to configure advanced functionality) -* :file:`./js/vendor/openlayers/` (GIS visualization) +* :file:`./examples/` (configuration examples) +* :file:`./sql/` (SQL scripts to configure advanced functionalities) +* :file:`./js/src/` (Source files to re-build `./js/dist/`) +* :file:`./js/config/` (Configuration files to re-build `./js/dist/`) +* Run `rm -rv vendor/tecnickcom/tcpdf && composer dump-autoload --no-interaction --optimize --dev` (exporting to PDF) +* Run `rm -rv vendor/williamdes/mariadb-mysql-kbs && composer dump-autoload --no-interaction --optimize --dev` (external links to MariaDB and MySQL documentations) +* Run `rm -rv vendor/code-lts/u2f-php-server && composer dump-autoload --no-interaction --optimize --dev` (U2F second factor authentication) +* Run `rm -rv vendor/pragmarx/* && composer dump-autoload --no-interaction --optimize --dev` (2FA second factor authentication) +* Run `rm -rv vendor/bacon/bacon-qr-code && composer dump-autoload --no-interaction --optimize --dev` (QRcode generation for 2FA second factor authentication) .. _faq1_45: From 3d6a198598fe7f9504cf57e39c9423b045a5eaa7 Mon Sep 17 00:00:00 2001 From: William Desportes Date: Thu, 29 Sep 2022 13:56:09 +0200 Subject: [PATCH 5/6] Fix CI version to have a valid composer.json ``` Failed to update composer.json with a valid format, reverting to the original content. Please report an issue to us with details (command you run and a copy of your composer.json). version : Does not match the regex pattern ^v?\d+(\.\d+){0,3}|^dev- ``` Signed-off-by: William Desportes --- scripts/create-release.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/create-release.sh b/scripts/create-release.sh index 0567079944..0213c445e6 100755 --- a/scripts/create-release.sh +++ b/scripts/create-release.sh @@ -58,7 +58,7 @@ while [ $# -gt 0 ] ; do git branch ci branch="ci" fi - version="ci" + version="${VERSION_SERIES}+ci" ;; --help) echo "Usages:" From bc9b43ebe021f22c9ced10ee8a9fca35ad68bb1d Mon Sep 17 00:00:00 2001 From: William Desportes Date: Thu, 29 Sep 2022 14:03:29 +0200 Subject: [PATCH 6/6] Remove non needed yarn install on build release step modules are not needed to launch the create release script Signed-off-by: William Desportes --- .github/workflows/other-tools.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/other-tools.yml b/.github/workflows/other-tools.yml index 493fd35990..7b255f8393 100644 --- a/.github/workflows/other-tools.yml +++ b/.github/workflows/other-tools.yml @@ -70,9 +70,6 @@ jobs: restore-keys: | ${{ runner.os }}-yarn- - - name: Install modules - run: yarn install --non-interactive - - name: Set up Python uses: actions/setup-python@v2 with: