From 319aac3c761142ab00e3e6016e594d4b84079efc Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Sat, 11 Oct 2014 07:57:20 -0400 Subject: [PATCH 1/4] 4.2.10 release Signed-off-by: Marc Delisle --- ChangeLog | 2 +- README | 2 +- doc/conf.py | 2 +- libraries/Config.class.php | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/ChangeLog b/ChangeLog index 7eedad5e20..975b173306 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,7 +1,7 @@ phpMyAdmin - ChangeLog ====================== -4.2.10.0 (not yet released) +4.2.10.0 (2014-10-11) - bug #4361 Can't change font size (when config.inc.php not present) - bug #4542 Tab key in column name not shown - bug PDF export: title not present in PDF diff --git a/README b/README index 16267d601f..2b3ea5e8c1 100644 --- a/README +++ b/README @@ -1,7 +1,7 @@ phpMyAdmin - Readme =================== -Version 4.2.10-dev +Version 4.2.10 A set of PHP-scripts to manage MySQL over the web. diff --git a/doc/conf.py b/doc/conf.py index b308f0078f..c28b6e7e3f 100644 --- a/doc/conf.py +++ b/doc/conf.py @@ -51,7 +51,7 @@ copyright = u'2012 - 2014, The phpMyAdmin devel team' # built documents. # # The short X.Y version. -version = '4.2.10-dev' +version = '4.2.10' # The full version, including alpha/beta/rc tags. release = version diff --git a/libraries/Config.class.php b/libraries/Config.class.php index d06bba8585..4807f47d3a 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -114,7 +114,7 @@ class PMA_Config */ function checkSystem() { - $this->set('PMA_VERSION', '4.2.10-dev'); + $this->set('PMA_VERSION', '4.2.10'); /** * @deprecated */ From bd68c54d1beeef79d237e8bfda44690834012a76 Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Tue, 21 Oct 2014 08:42:02 +0530 Subject: [PATCH 2/4] bug #4562 [security] XSS in debug SQL output Signed-off-by: Madhura Jayaratne --- ChangeLog | 3 +++ libraries/DatabaseInterface.class.php | 5 +++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 975b173306..02d02217d0 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,9 @@ phpMyAdmin - ChangeLog ====================== +4.2.10.1 (not yet released) +- bug #4562 [security] XSS in debug SQL output + 4.2.10.0 (2014-10-11) - bug #4361 Can't change font size (when config.inc.php not present) - bug #4542 Tab key in column name not shown diff --git a/libraries/DatabaseInterface.class.php b/libraries/DatabaseInterface.class.php index c126c17d5d..c7c5171420 100644 --- a/libraries/DatabaseInterface.class.php +++ b/libraries/DatabaseInterface.class.php @@ -139,10 +139,11 @@ class PMA_DatabaseInterface $_SESSION['debug']['queries'][$hash] = array(); if ($result == false) { $_SESSION['debug']['queries'][$hash]['error'] - = '' . mysqli_error($link) . ''; + = '' + . htmlspecialchars(mysqli_error($link)) . ''; } $_SESSION['debug']['queries'][$hash]['count'] = 1; - $_SESSION['debug']['queries'][$hash]['query'] = $query; + $_SESSION['debug']['queries'][$hash]['query'] = htmlspecialchars($query); $_SESSION['debug']['queries'][$hash]['time'] = $time; } From 7b8962dede7631298c81e2c1cd267b81f1e08a8c Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Tue, 21 Oct 2014 08:45:09 +0530 Subject: [PATCH 3/4] bug #4563 [security] XSS in monitor query analyzer Signed-off-by: Madhura Jayaratne --- ChangeLog | 1 + js/server_status_monitor.js | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 02d02217d0..c0597da6e9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -3,6 +3,7 @@ phpMyAdmin - ChangeLog 4.2.10.1 (not yet released) - bug #4562 [security] XSS in debug SQL output +- bug #4563 [security] XSS in monitor query analyzer 4.2.10.0 (2014-10-11) - bug #4361 Can't change font size (when config.inc.php not present) diff --git a/js/server_status_monitor.js b/js/server_status_monitor.js index 4432cafdc6..97684d8ced 100644 --- a/js/server_status_monitor.js +++ b/js/server_status_monitor.js @@ -1855,7 +1855,7 @@ AJAX.registerOnload('server_status_monitor.js', function () { if (name == 'user_host') { return value.replace(/(\[.*?\])+/g, ''); } - return value; + return escapeHtml(value); }; for (var i = 0, l = rows.length; i < l; i++) { @@ -2011,7 +2011,7 @@ AJAX.registerOnload('server_status_monitor.js', function () { for (i = 0, l = data.explain.length; i < l; i++) { explain += '
0 ? 'style="display:none;"' : '') + '>'; $.each(data.explain[i], function (key, value) { - value = (value === null) ? 'null' : value; + value = (value === null) ? 'null' : escapeHtml(value); if (key == 'type' && value.toLowerCase() == 'all') { value = '' + value + ''; From d0e3ab3bc9da5a4ed24e485632471fef65cdb556 Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Tue, 21 Oct 2014 10:26:58 -0400 Subject: [PATCH 4/4] 4.2.10.1 release Signed-off-by: Marc Delisle --- ChangeLog | 2 +- README | 2 +- doc/conf.py | 2 +- libraries/Config.class.php | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/ChangeLog b/ChangeLog index c0597da6e9..dbf4de3830 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,7 +1,7 @@ phpMyAdmin - ChangeLog ====================== -4.2.10.1 (not yet released) +4.2.10.1 (2014-10-21) - bug #4562 [security] XSS in debug SQL output - bug #4563 [security] XSS in monitor query analyzer diff --git a/README b/README index 2b3ea5e8c1..097573345a 100644 --- a/README +++ b/README @@ -1,7 +1,7 @@ phpMyAdmin - Readme =================== -Version 4.2.10 +Version 4.2.10.1 A set of PHP-scripts to manage MySQL over the web. diff --git a/doc/conf.py b/doc/conf.py index c28b6e7e3f..dcd3436e39 100644 --- a/doc/conf.py +++ b/doc/conf.py @@ -51,7 +51,7 @@ copyright = u'2012 - 2014, The phpMyAdmin devel team' # built documents. # # The short X.Y version. -version = '4.2.10' +version = '4.2.10.1' # The full version, including alpha/beta/rc tags. release = version diff --git a/libraries/Config.class.php b/libraries/Config.class.php index 4807f47d3a..8708b1aae8 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -114,7 +114,7 @@ class PMA_Config */ function checkSystem() { - $this->set('PMA_VERSION', '4.2.10'); + $this->set('PMA_VERSION', '4.2.10.1'); /** * @deprecated */