From 51a0d2f25a71432570f59dd9053b9dbbc93733b3 Mon Sep 17 00:00:00 2001 From: Isaac Bennetch Date: Mon, 29 Feb 2016 08:45:21 -0500 Subject: [PATCH 1/7] 4.5.5.1 release Signed-off-by: Isaac Bennetch --- ChangeLog | 2 +- README | 2 +- doc/conf.py | 2 +- libraries/Config.class.php | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/ChangeLog b/ChangeLog index 66ab2cf625..2ae6ca654c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,7 +1,7 @@ phpMyAdmin - ChangeLog ====================== -4.5.5.1 (not yet released) +4.5.5.1 (2016-02-29) - issue #11971 CREATE UNIQUE INDEX index type is not recognized by parser. - issue #11982 Row count wrong when grouping joined tables. - issue #12012 Column definition with default value and comment in CREATE TABLE expoerted faulty. diff --git a/README b/README index 52d35d8a75..12c3431601 100644 --- a/README +++ b/README @@ -1,7 +1,7 @@ phpMyAdmin - Readme =================== -Version 4.5.5 +Version 4.5.5.1 A set of PHP-scripts to manage MySQL over the web. diff --git a/doc/conf.py b/doc/conf.py index 12ea522e99..f40d1c32c2 100644 --- a/doc/conf.py +++ b/doc/conf.py @@ -51,7 +51,7 @@ copyright = u'2012 - 2014, The phpMyAdmin devel team' # built documents. # # The short X.Y version. -version = '4.5.5' +version = '4.5.5.1' # The full version, including alpha/beta/rc tags. release = version diff --git a/libraries/Config.class.php b/libraries/Config.class.php index acaa46203b..12844d24a6 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -114,7 +114,7 @@ class PMA_Config */ public function checkSystem() { - $this->set('PMA_VERSION', '4.5.5'); + $this->set('PMA_VERSION', '4.5.5.1'); /** * @deprecated */ From a6b3a9ce5132af6000d204760b9bfd51cd3e0ac8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Tue, 1 Mar 2016 15:35:46 +0100 Subject: [PATCH 2/7] Fix error when we can not generate random string MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes #12056 Signed-off-by: Michal Čihař --- ChangeLog | 1 + libraries/session.inc.php | 8 ++++++++ 2 files changed, 9 insertions(+) diff --git a/ChangeLog b/ChangeLog index e864303563..6b999d45d5 100644 --- a/ChangeLog +++ b/ChangeLog @@ -47,6 +47,7 @@ phpMyAdmin - ChangeLog - issue #11907 Avoid displaying UPDATE query twice - issue #11850 Fixed CSV import - issue Fix SQL syntax highlighting in database search page +- issue #12056 Fix error when we can not generate random string 4.5.5.1 (not yet released) - issue #11971 CREATE UNIQUE INDEX index type is not recognized by parser. diff --git a/libraries/session.inc.php b/libraries/session.inc.php index 7e45ce117f..4b81d3e2e1 100644 --- a/libraries/session.inc.php +++ b/libraries/session.inc.php @@ -117,5 +117,13 @@ if (! isset($_SESSION[' PMA_token '])) { $_SESSION[' PMA_token '] = bin2hex(openssl_random_pseudo_bytes(16)); } } +/** + * Check if token is properly generated (both above functions can return false). + */ +if (empty($_SESSION[' PMA_token '])) { + PMA_fatalError( + 'Failed to generate random CSRF token!' + ); +} require_once 'libraries/session.lib.php'; From 02aa0729dcb876e0c87f6744309b6e5880f4e663 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Tue, 1 Mar 2016 15:36:05 +0100 Subject: [PATCH 3/7] Make PMA_fatalError work even early MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The messaging framework can not make assumptions about available objects as this doesn't have to be satisfied in early PMA_fatalError case. Issue #12056 Signed-off-by: Michal Čihař --- libraries/Util.php | 14 +++++++------- libraries/core.lib.php | 4 ++-- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/libraries/Util.php b/libraries/Util.php index 527662c667..a3274d5a77 100644 --- a/libraries/Util.php +++ b/libraries/Util.php @@ -191,14 +191,14 @@ class Util // If it's the first time this function is called if (! isset($sprites)) { + $sprites = array(); // Try to load the list of sprites - $sprite_file = $_SESSION['PMA_Theme']->getPath() . '/sprites.lib.php'; - if (is_readable($sprite_file)) { - include_once $sprite_file; - $sprites = PMA_sprites(); - } else { - // No sprites are available for this theme - $sprites = array(); + if (isset($_SESSION['PMA_Theme'])) { + $sprite_file = $_SESSION['PMA_Theme']->getPath() . '/sprites.lib.php'; + if (is_readable($sprite_file)) { + include_once $sprite_file; + $sprites = PMA_sprites(); + } } } diff --git a/libraries/core.lib.php b/libraries/core.lib.php index be4db6e505..a2de9a6574 100644 --- a/libraries/core.lib.php +++ b/libraries/core.lib.php @@ -246,8 +246,8 @@ function PMA_fatalError( } else { $error_header = 'Error'; } - $lang = $GLOBALS['lang']; - $dir = $GLOBALS['text_dir']; + $lang = isset($GLOBALS['lang']) ? $GLOBALS['lang'] : 'en'; + $dir = isset($GLOBALS['text_dir']) ? $GLOBALS['text_dir'] : 'ltr'; // on fatal errors it cannot hurt to always delete the current session if ($delete_session From 12bf06e0166a6779b88e2c6f1a28edde546f9682 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Tue, 1 Mar 2016 15:41:19 +0100 Subject: [PATCH 4/7] Add changelog for issue #12055 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 6b999d45d5..3747853332 100644 --- a/ChangeLog +++ b/ChangeLog @@ -48,6 +48,7 @@ phpMyAdmin - ChangeLog - issue #11850 Fixed CSV import - issue Fix SQL syntax highlighting in database search page - issue #12056 Fix error when we can not generate random string +- issue #12055 Fixed PHP syntax error in templates 4.5.5.1 (not yet released) - issue #11971 CREATE UNIQUE INDEX index type is not recognized by parser. From 380deb4f3956cba4a6f5e3781cc0c0d14752556d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Tue, 1 Mar 2016 15:47:20 +0100 Subject: [PATCH 5/7] Share code for generating token MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit There is no need to have two copies of that. Signed-off-by: Michal Čihař --- libraries/session.inc.php | 10 +++------- libraries/session.lib.php | 11 +++++++++++ 2 files changed, 14 insertions(+), 7 deletions(-) diff --git a/libraries/session.inc.php b/libraries/session.inc.php index 4b81d3e2e1..90d97fd073 100644 --- a/libraries/session.inc.php +++ b/libraries/session.inc.php @@ -13,6 +13,8 @@ if (! defined('PHPMYADMIN')) { exit; } +require_once 'libraries/session.lib.php'; + // verify if PHP supports session, die if it does not if (!@function_exists('session_name')) { @@ -111,11 +113,7 @@ if (! isset($_COOKIE[$session_name])) { * (we use "space PMA_token space" to prevent overwriting) */ if (! isset($_SESSION[' PMA_token '])) { - if (! function_exists('openssl_random_pseudo_bytes')) { - $_SESSION[' PMA_token '] = bin2hex(phpseclib\Crypt\Random::string(16)); - } else { - $_SESSION[' PMA_token '] = bin2hex(openssl_random_pseudo_bytes(16)); - } + PMA_generateToken(); } /** * Check if token is properly generated (both above functions can return false). @@ -125,5 +123,3 @@ if (empty($_SESSION[' PMA_token '])) { 'Failed to generate random CSRF token!' ); } - -require_once 'libraries/session.lib.php'; diff --git a/libraries/session.lib.php b/libraries/session.lib.php index dd57acc74f..7c873bbafe 100644 --- a/libraries/session.lib.php +++ b/libraries/session.lib.php @@ -19,6 +19,17 @@ function PMA_secureSession() if (session_status() === PHP_SESSION_ACTIVE) { session_regenerate_id(true); } + PMA_generateToken(); +} + + +/** + * Generates PMA_token session variable. + * + * @return void + */ +function PMA_generateToken() +{ if (! function_exists('openssl_random_pseudo_bytes')) { $_SESSION[' PMA_token '] = bin2hex(phpseclib\Crypt\Random::string(16)); } else { From b856502d6443a41b1772661ad9f33da01758d7e9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Tue, 1 Mar 2016 15:49:05 +0100 Subject: [PATCH 6/7] Prefer phpseclib if avaible MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It does better decisions about which backend to use than simply using openssl. Signed-off-by: Michal Čihař --- libraries/plugins/auth/AuthenticationCookie.php | 6 +----- libraries/session.lib.php | 2 +- 2 files changed, 2 insertions(+), 6 deletions(-) diff --git a/libraries/plugins/auth/AuthenticationCookie.php b/libraries/plugins/auth/AuthenticationCookie.php index 9e0c70eac0..d75d2fb78e 100644 --- a/libraries/plugins/auth/AuthenticationCookie.php +++ b/libraries/plugins/auth/AuthenticationCookie.php @@ -692,11 +692,7 @@ class AuthenticationCookie extends AuthenticationPlugin */ public static function useOpenSSL() { - return ( - function_exists('openssl_encrypt') - && function_exists('openssl_decrypt') - && function_exists('openssl_random_pseudo_bytes') - ); + return ! class_exists('phpseclib\Crypt\Random'); } /** diff --git a/libraries/session.lib.php b/libraries/session.lib.php index 7c873bbafe..1574c2d0cd 100644 --- a/libraries/session.lib.php +++ b/libraries/session.lib.php @@ -30,7 +30,7 @@ function PMA_secureSession() */ function PMA_generateToken() { - if (! function_exists('openssl_random_pseudo_bytes')) { + if (class_exists('phpseclib\Crypt\Random')) { $_SESSION[' PMA_token '] = bin2hex(phpseclib\Crypt\Random::string(16)); } else { $_SESSION[' PMA_token '] = bin2hex(openssl_random_pseudo_bytes(16)); From b71aeefa3abb70e379daf4b801ec4a542403b4fb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Tue, 1 Mar 2016 16:08:46 +0100 Subject: [PATCH 7/7] Disable sending referer MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit We don't use it and this can help us get rid of url.php once the browser support is good enough (as usual, there is no support in IE and broken support in Edge right now). Signed-off-by: Michal Čihař --- libraries/Header.php | 1 + 1 file changed, 1 insertion(+) diff --git a/libraries/Header.php b/libraries/Header.php index e96831bdff..a9970387bc 100644 --- a/libraries/Header.php +++ b/libraries/Header.php @@ -639,6 +639,7 @@ class Header private function _getMetaTags() { $retval = ''; + $retval .= ''; $retval .= ''; $retval .= ''; if (! $GLOBALS['cfg']['AllowThirdPartyFraming']) {