Merge branch 'QA_4_7' into STABLE

ChangeLog

@@ -1,6 +1,12 @@
 phpMyAdmin - ChangeLog
 ======================
 
+4.7.8 (2018-02-20)
+- issue #13914 Fixed resetting default setting values.
+- issue #13758 Fixed fallback value for collation connection.
+- issue #13938 Fixed error handling in PHP 7.2
+- issue        [security] Fix XSS in Central Columns Feature, See PMASA-2018-01
+
 4.7.7 (2017-12-23)
 - issue #13865 Fixed displaying of formatted numeric values for some locales
 - issue #13856 Ensure datetimepicker is always loaded for datetime fields

README

@@ -1,7 +1,7 @@
 phpMyAdmin - Readme
 ===================
 
-Version 4.7.7
+Version 4.7.8
 
 A web interface for MySQL and MariaDB.
 

README.rst

@@ -26,6 +26,10 @@ Code status
     :alt: CII Best Practices
     :target: https://bestpractices.coreinfrastructure.org/projects/213
 
+.. image:: https://www.browserstack.com/automate/badge.svg?badge_key=V1ppZHdzTThicjY4Ujk5akxYT2xYUT09LS1PVncrNCtkUW9BZXE1Q2xCQkdTMFZRPT0=--91913a0e155fda6f7c942e9dd2da64b3da571c30
+    :alt: BrowserStack
+    :target: https://www.browserstack.com/automate/public-build/V1ppZHdzTThicjY4Ujk5akxYT2xYUT09LS1PVncrNCtkUW9BZXE1Q2xCQkdTMFZRPT0=--91913a0e155fda6f7c942e9dd2da64b3da571c30
+
 
 Download
 --------

composer.json

@@ -11,7 +11,7 @@
         "docs": "https://docs.phpmyadmin.net/",
         "source": "https://github.com/phpmyadmin/phpmyadmin"
     },
-    "license": "GPL-2.0",
+    "license": "GPL-2.0-only",
     "authors": [
         {
             "name": "The phpMyAdmin Team",
@@ -39,7 +39,7 @@
         "ext-pcre": "*",
         "ext-json": "*",
         "phpmyadmin/sql-parser": "^4.2.3",
-        "phpmyadmin/motranslator": "^3.4",
+        "phpmyadmin/motranslator": "^4.0",
         "phpmyadmin/shapefile": "^2.0",
         "tecnickcom/tcpdf": "^6.2",
         "phpseclib/phpseclib": "^2.0",

db_central_columns.php

@@ -90,7 +90,9 @@ if (isset($_POST['delete_save'])) {
     parse_str($_POST['col_name'], $col_name);
     $tmp_msg = PMA_deleteColumnsFromList($col_name['selected_fld'], false);
 }
-if (isset($_REQUEST['total_rows']) && $_REQUEST['total_rows']) {
+if (!empty($_REQUEST['total_rows'])
+    && PMA_isValid($_REQUEST['total_rows'], 'integer')
+) {
     $total_rows = $_REQUEST['total_rows'];
 } else {
     $total_rows = PMA_getCentralColumnsCount($db);

doc/conf.py

@@ -51,7 +51,7 @@ copyright = u'2012 - 2017, The phpMyAdmin devel team'
 # built documents.
 #
 # The short X.Y version.
-version = '4.7.7'
+version = '4.7.8'
 # The full version, including alpha/beta/rc tags.
 release = version
 

js/config.js

@@ -110,7 +110,7 @@ function markField(field)
  *
  * @param {Element} field
  * @param {String}  field_type  see {@link #getFieldType}
- * @param {String|Boolean}  [value]
+ * @param {String|Boolean}  value
  */
 function setFieldValue(field, field_type, value)
 {
@@ -118,22 +118,16 @@ function setFieldValue(field, field_type, value)
     switch (field_type) {
     case 'text':
     case 'number':
-        $field.val(value !== undefined ? value : $field.attr('defaultValue'));
+        $field.val(value);
         break;
     case 'checkbox':
-        $field.prop('checked', (value !== undefined ? value : $field.attr('defaultChecked')));
+        $field.prop('checked', value);
         break;
     case 'select':
         var options = $field.prop('options');
         var i, imax = options.length;
-        if (value === undefined) {
-            for (i = 0; i < imax; i++) {
-                options[i].selected = options[i].defaultSelected;
-            }
-        } else {
-            for (i = 0; i < imax; i++) {
-                options[i].selected = (value.indexOf(options[i].value) != -1);
-            }
+        for (i = 0; i < imax; i++) {
+            options[i].selected = (value.indexOf(options[i].value) != -1);
         }
         break;
     }
@@ -652,7 +646,7 @@ AJAX.registerOnload('config.js', function () {
     $('.optbox input[type=button][name=submit_reset]').click(function () {
         var fields = $(this).closest('fieldset').find('input, select, textarea');
         for (var i = 0, imax = fields.length; i < imax; i++) {
-            setFieldValue(fields[i], getFieldType(fields[i]));
+            setFieldValue(fields[i], getFieldType(fields[i]), defaultValues[fields[i].id]);
         }
     });
 });

libraries/Config.php

@@ -103,7 +103,7 @@ class Config
      */
     public function checkSystem()
     {
-        $this->set('PMA_VERSION', '4.7.7');
+        $this->set('PMA_VERSION', '4.7.8');
         /**
          * @deprecated
          */

libraries/DatabaseInterface.php

@@ -1420,7 +1420,7 @@ class DatabaseInterface
                 );
                 $this->query(
                     "SET collation_connection = '"
-                    . $this->escapeString($collation_connection, $link)
+                    . $this->escapeString($default_collation, $link)
                     . "';",
                     $link,
                     self::QUERY_STORE

libraries/Language.php

@@ -174,6 +174,10 @@ class Language
         _setlocale(0, $this->code);
         _bindtextdomain('phpmyadmin', LOCALE_PATH);
         _textdomain('phpmyadmin');
+        // Set PHP locale as well
+        if (function_exists('setlocale')) {
+            setlocale(0, $this->code);
+        }
 
         /* Text direction for language */
         if ($this->isRTL()) {

libraries/plugins/auth/AuthenticationCookie.php

@@ -136,6 +136,20 @@ class AuthenticationCookie extends AuthenticationPlugin
         );
         echo "</h1>";
 
+        if ($GLOBALS['cfg']['DBG']['demo']) {
+            echo '<fieldset>';
+            echo '<legend>' , __('phpMyAdmin Demo Server') , '</legend>';
+            printf(
+                __(
+                    'You are using the demo server. You can do anything here, but '
+                    . 'please do not change root, debian-sys-maint and pma users. '
+                    . 'More information is available at %s.'
+                ),
+                '<a href="url.php?url=https://demo.phpmyadmin.net/" target="_blank" rel="noopener noreferrer">demo.phpmyadmin.net</a>'
+            );
+            echo '</fieldset>';
+        }
+
         // Show error message
         if (! empty($conn_error)) {
             Message::rawError($conn_error)->display();

libraries/pmd_common.php

@@ -363,7 +363,7 @@ function PMA_getDefaultPage($db)
         PMA\libraries\DatabaseInterface::QUERY_STORE
     );
 
-    if (count($default_page_no)) {
+    if (isset($default_page_no) && count($default_page_no)) {
         return intval($default_page_no[0]);
     }
     return -1;
@@ -402,7 +402,7 @@ function PMA_getLoadingPage($db)
             $GLOBALS['controllink'],
             PMA\libraries\DatabaseInterface::QUERY_STORE
         );
-        if (count($min_page_no[0])) {
+        if (isset($min_page_no[0]) && count($min_page_no[0])) {
             $page_no = $min_page_no[0];
         }
     }

libraries/sql.lib.php

@@ -611,6 +611,8 @@ function PMA_isRememberSortingOrder($analyzed_sql_results)
             || $analyzed_sql_results['is_func']
             || $analyzed_sql_results['is_analyse'])
         && $analyzed_sql_results['select_from']
+        && isset($analyzed_sql_results['select_expr'])
+        && isset($analyzed_sql_results['select_tables'])
         && ((empty($analyzed_sql_results['select_expr']))
             || ((count($analyzed_sql_results['select_expr']) == 1)
                 && ($analyzed_sql_results['select_expr'][0] == '*')))
@@ -1662,7 +1664,11 @@ function PMA_getHtmlForSqlQueryResultsTable($displayResultsObject,
     } else {
         if (isset($result) && $result !== false) {
             $fields_meta = $GLOBALS['dbi']->getFieldsMeta($result);
-            $fields_cnt  = count($fields_meta);
+            if (! is_array($fields_meta)) {
+                $fields_cnt  = 0;
+            } else {
+                $fields_cnt  = count($fields_meta);
+            }
         }
         $_SESSION['is_multi_query'] = false;
         $displayResultsObject->setProperties(

scripts/create-release.sh

@@ -220,12 +220,18 @@ rm -f .travis.yml .coveralls.yml .scrutinizer.yml .jshintrc .weblate codecov.yml
 rm -f README.rst
 
 if [ ! -d libraries/tcpdf ] ; then
-    echo "* Running composer"
-    composer update --no-dev
+    PHP_REQ=`sed -n '/"php"/ s/.*">=\([0-9]\.[0-9]\).*/\1/p' composer.json`
+    if [ -z "$PHP_REQ" ] ; then
+        echo "Failed to figure out required PHP version from composer.json"
+        exit 2
+    fi
     # Okay, there is no way to tell composer to install
     # suggested package. Let's require it and then revert
     # composer.json to original state.
     cp composer.json composer.json.backup
+    echo "* Running composer"
+    composer config platform.php "$PHP_REQ"
+    composer update --no-dev
     composer require --update-no-dev tecnickcom/tcpdf
     mv composer.json.backup composer.json
     echo "* Cleanup of composer packages"
@@ -370,7 +376,7 @@ git worktree prune
 
 # Signing of files with default GPG key
 echo "* Signing files"
-for file in *.gz *.zip *.xz ; do
+for file in phpMyAdmin-$version-*.gz phpMyAdmin-$version-*.zip phpMyAdmin-$version-*.xz ; do
     if [ $do_sign -eq 1 ] ; then
         gpg --detach-sign --armor $file
     fi