From a3bff8819950072c5a8ff338697a732cb6a7cc0a Mon Sep 17 00:00:00 2001 From: Isaac Bennetch Date: Tue, 28 Mar 2017 20:56:18 -0400 Subject: [PATCH 1/5] Add ChangeLog for PMASA-2017-08 Signed-off-by: Isaac Bennetch --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index a683fc85b2..c24fab25d9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -108,6 +108,7 @@ phpMyAdmin - ChangeLog - issue #12757 Fixed setting password on recent MariaDB with non working plugins - issue #12349 Fixed undefined variable on import from some formats - issue #13103 Do not offer default names for copying/renaming databases +- issue [security] Possible to bypass $cfg['Servers'][$i]['AllowNoPassword'], see PMASA-2017-08 4.6.6 (2017-01-23) - issue #12759 Fix Notice regarding 'Undefined index: old_usergroup' From 08bbf7bdbdde5c4bd69c0010d8e0a5af8e4a079d Mon Sep 17 00:00:00 2001 From: Isaac Bennetch Date: Tue, 28 Mar 2017 20:58:44 -0400 Subject: [PATCH 2/5] Prepare for 4.7.0 Signed-off-by: Isaac Bennetch --- ChangeLog | 2 +- README | 2 +- doc/conf.py | 2 +- libraries/Config.php | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/ChangeLog b/ChangeLog index c24fab25d9..1123543d78 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,7 +1,7 @@ phpMyAdmin - ChangeLog ====================== -4.7.0.0 (not yet released) +4.7.0 (2017-03-28) - patch #12233 [Display] Improve message when renaming database to same name - issue #6146 Log authentication attempts to syslog - issue #11981 Remove support for Swekey authentication diff --git a/README b/README index 65708eb01b..f23e316929 100644 --- a/README +++ b/README @@ -1,7 +1,7 @@ phpMyAdmin - Readme =================== -Version 4.7.0-rc1 +Version 4.7.0 A web interface for MySQL and MariaDB. diff --git a/doc/conf.py b/doc/conf.py index af82eb0c15..d1294594d2 100644 --- a/doc/conf.py +++ b/doc/conf.py @@ -51,7 +51,7 @@ copyright = u'2012 - 2017, The phpMyAdmin devel team' # built documents. # # The short X.Y version. -version = '4.7.0-rc1' +version = '4.7.0' # The full version, including alpha/beta/rc tags. release = version diff --git a/libraries/Config.php b/libraries/Config.php index 38b548e56f..9f4c0e6005 100644 --- a/libraries/Config.php +++ b/libraries/Config.php @@ -103,7 +103,7 @@ class Config */ public function checkSystem() { - $this->set('PMA_VERSION', '4.7.0-rc1'); + $this->set('PMA_VERSION', '4.7.0'); /** * @deprecated */ From 5538c22c142fb735fb0a3f7b5dd5c9f016f0709a Mon Sep 17 00:00:00 2001 From: Isaac Bennetch Date: Wed, 29 Mar 2017 08:15:30 -0400 Subject: [PATCH 3/5] Adding composer lock for 4.7.0 Signed-off-by: Isaac Bennetch --- composer.lock | 112 +++++++++++++++++++++++++------------------------- 1 file changed, 56 insertions(+), 56 deletions(-) diff --git a/composer.lock b/composer.lock index caf54ffc18..4f426de38a 100644 --- a/composer.lock +++ b/composer.lock @@ -9,23 +9,23 @@ "packages": [ { "name": "google/recaptcha", - "version": "1.1.2", + "version": "1.1.3", "source": { "type": "git", "url": "https://github.com/google/recaptcha.git", - "reference": "2b7e00566afca82a38a1d3adb8e42c118006296e" + "reference": "5a56d15ca10a7b75158178752b2ad8f755eb4f78" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/google/recaptcha/zipball/2b7e00566afca82a38a1d3adb8e42c118006296e", - "reference": "2b7e00566afca82a38a1d3adb8e42c118006296e", + "url": "https://api.github.com/repos/google/recaptcha/zipball/5a56d15ca10a7b75158178752b2ad8f755eb4f78", + "reference": "5a56d15ca10a7b75158178752b2ad8f755eb4f78", "shasum": "" }, "require": { - "php": ">=5.3.2" + "php": ">=5.5" }, "require-dev": { - "phpunit/phpunit": "4.5.*" + "phpunit/phpunit": "^4.8" }, "type": "library", "extra": { @@ -50,7 +50,7 @@ "recaptcha", "spam" ], - "time": "2015-09-02 17:23:59" + "time": "2017-03-09 18:44:34" }, { "name": "phpmyadmin/motranslator", @@ -399,16 +399,16 @@ }, { "name": "symfony/cache", - "version": "v3.2.4", + "version": "v3.2.6", "source": { "type": "git", "url": "https://github.com/symfony/cache.git", - "reference": "167d11ab127c7a998b855b8d1bcb7bc6bf5d3afa" + "reference": "38ead350d7c27b08b8da9401cbdbea8121f929a4" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/cache/zipball/167d11ab127c7a998b855b8d1bcb7bc6bf5d3afa", - "reference": "167d11ab127c7a998b855b8d1bcb7bc6bf5d3afa", + "url": "https://api.github.com/repos/symfony/cache/zipball/38ead350d7c27b08b8da9401cbdbea8121f929a4", + "reference": "38ead350d7c27b08b8da9401cbdbea8121f929a4", "shasum": "" }, "require": { @@ -462,20 +462,20 @@ "caching", "psr6" ], - "time": "2017-02-04 08:30:23" + "time": "2017-03-08 12:16:26" }, { "name": "symfony/expression-language", - "version": "v3.2.4", + "version": "v3.2.6", "source": { "type": "git", "url": "https://github.com/symfony/expression-language.git", - "reference": "e0a7b0c58e0dac3a382d4234e33f6344a5ba69d1" + "reference": "8f7d3a35015831dc661713f403b0a0dd34a51baf" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/expression-language/zipball/e0a7b0c58e0dac3a382d4234e33f6344a5ba69d1", - "reference": "e0a7b0c58e0dac3a382d4234e33f6344a5ba69d1", + "url": "https://api.github.com/repos/symfony/expression-language/zipball/8f7d3a35015831dc661713f403b0a0dd34a51baf", + "reference": "8f7d3a35015831dc661713f403b0a0dd34a51baf", "shasum": "" }, "require": { @@ -512,7 +512,7 @@ ], "description": "Symfony ExpressionLanguage Component", "homepage": "https://symfony.com", - "time": "2017-01-02 20:32:22" + "time": "2017-02-24 13:58:52" }, { "name": "tecnickcom/tcpdf", @@ -585,12 +585,12 @@ "source": { "type": "git", "url": "https://github.com/codacy/php-codacy-coverage.git", - "reference": "2c80784a95f844e6988700e7373225284b713dd2" + "reference": "c0b3a02883bd80f0955c2478193304ddbef23e56" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/codacy/php-codacy-coverage/zipball/2c80784a95f844e6988700e7373225284b713dd2", - "reference": "2c80784a95f844e6988700e7373225284b713dd2", + "url": "https://api.github.com/repos/codacy/php-codacy-coverage/zipball/c0b3a02883bd80f0955c2478193304ddbef23e56", + "reference": "c0b3a02883bd80f0955c2478193304ddbef23e56", "shasum": "" }, "require": { @@ -622,7 +622,7 @@ ], "description": "Sends PHP test coverage information to Codacy.", "homepage": "https://github.com/codacy/php-codacy-coverage", - "time": "2016-10-14 09:44:29" + "time": "2017-03-09 18:29:51" }, { "name": "doctrine/instantiator", @@ -2015,16 +2015,16 @@ }, { "name": "symfony/config", - "version": "v3.2.4", + "version": "v3.2.6", "source": { "type": "git", "url": "https://github.com/symfony/config.git", - "reference": "9f99453e77771e629af8a25eeb0a6c4ed1e19da2" + "reference": "741d6d4cd1414d67d48eb71aba6072b46ba740c2" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/config/zipball/9f99453e77771e629af8a25eeb0a6c4ed1e19da2", - "reference": "9f99453e77771e629af8a25eeb0a6c4ed1e19da2", + "url": "https://api.github.com/repos/symfony/config/zipball/741d6d4cd1414d67d48eb71aba6072b46ba740c2", + "reference": "741d6d4cd1414d67d48eb71aba6072b46ba740c2", "shasum": "" }, "require": { @@ -2067,20 +2067,20 @@ ], "description": "Symfony Config Component", "homepage": "https://symfony.com", - "time": "2017-02-14 16:27:43" + "time": "2017-03-01 18:18:25" }, { "name": "symfony/console", - "version": "v3.2.4", + "version": "v3.2.6", "source": { "type": "git", "url": "https://github.com/symfony/console.git", - "reference": "0e5e6899f82230fcb1153bcaf0e106ffaa44b870" + "reference": "28fb243a2b5727774ca309ec2d92da240f1af0dd" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/console/zipball/0e5e6899f82230fcb1153bcaf0e106ffaa44b870", - "reference": "0e5e6899f82230fcb1153bcaf0e106ffaa44b870", + "url": "https://api.github.com/repos/symfony/console/zipball/28fb243a2b5727774ca309ec2d92da240f1af0dd", + "reference": "28fb243a2b5727774ca309ec2d92da240f1af0dd", "shasum": "" }, "require": { @@ -2130,20 +2130,20 @@ ], "description": "Symfony Console Component", "homepage": "https://symfony.com", - "time": "2017-02-16 14:07:22" + "time": "2017-03-06 19:30:27" }, { "name": "symfony/debug", - "version": "v3.2.4", + "version": "v3.2.6", "source": { "type": "git", "url": "https://github.com/symfony/debug.git", - "reference": "9b98854cb45bc59d100b7d4cc4cf9e05f21026b9" + "reference": "b90c9f91ad8ac37d9f114e369042d3226b34dc1a" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/debug/zipball/9b98854cb45bc59d100b7d4cc4cf9e05f21026b9", - "reference": "9b98854cb45bc59d100b7d4cc4cf9e05f21026b9", + "url": "https://api.github.com/repos/symfony/debug/zipball/b90c9f91ad8ac37d9f114e369042d3226b34dc1a", + "reference": "b90c9f91ad8ac37d9f114e369042d3226b34dc1a", "shasum": "" }, "require": { @@ -2187,7 +2187,7 @@ ], "description": "Symfony Debug Component", "homepage": "https://symfony.com", - "time": "2017-02-16 16:34:18" + "time": "2017-02-18 17:28:00" }, { "name": "symfony/event-dispatcher", @@ -2251,16 +2251,16 @@ }, { "name": "symfony/filesystem", - "version": "v3.2.4", + "version": "v3.2.6", "source": { "type": "git", "url": "https://github.com/symfony/filesystem.git", - "reference": "a0c6ef2dc78d33b58d91d3a49f49797a184d06f4" + "reference": "bc0f17bed914df2cceb989972c3b996043c4da4a" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/filesystem/zipball/a0c6ef2dc78d33b58d91d3a49f49797a184d06f4", - "reference": "a0c6ef2dc78d33b58d91d3a49f49797a184d06f4", + "url": "https://api.github.com/repos/symfony/filesystem/zipball/bc0f17bed914df2cceb989972c3b996043c4da4a", + "reference": "bc0f17bed914df2cceb989972c3b996043c4da4a", "shasum": "" }, "require": { @@ -2296,7 +2296,7 @@ ], "description": "Symfony Filesystem Component", "homepage": "https://symfony.com", - "time": "2017-01-08 20:47:33" + "time": "2017-03-06 19:30:27" }, { "name": "symfony/polyfill-mbstring", @@ -2359,16 +2359,16 @@ }, { "name": "symfony/process", - "version": "v3.2.4", + "version": "v3.2.6", "source": { "type": "git", "url": "https://github.com/symfony/process.git", - "reference": "0ab87c1e7570b3534a6e51eb4ca8e9f6d7327856" + "reference": "68bfa8c83f24c0ac04ea7193bcdcda4519f41892" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/process/zipball/0ab87c1e7570b3534a6e51eb4ca8e9f6d7327856", - "reference": "0ab87c1e7570b3534a6e51eb4ca8e9f6d7327856", + "url": "https://api.github.com/repos/symfony/process/zipball/68bfa8c83f24c0ac04ea7193bcdcda4519f41892", + "reference": "68bfa8c83f24c0ac04ea7193bcdcda4519f41892", "shasum": "" }, "require": { @@ -2404,20 +2404,20 @@ ], "description": "Symfony Process Component", "homepage": "https://symfony.com", - "time": "2017-02-16 14:07:22" + "time": "2017-03-04 12:23:14" }, { "name": "symfony/stopwatch", - "version": "v3.2.4", + "version": "v3.2.6", "source": { "type": "git", "url": "https://github.com/symfony/stopwatch.git", - "reference": "9aa0b51889c01bca474853ef76e9394b02264464" + "reference": "c5ee0f8650c84b4d36a5f76b3b504233feaabf75" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/stopwatch/zipball/9aa0b51889c01bca474853ef76e9394b02264464", - "reference": "9aa0b51889c01bca474853ef76e9394b02264464", + "url": "https://api.github.com/repos/symfony/stopwatch/zipball/c5ee0f8650c84b4d36a5f76b3b504233feaabf75", + "reference": "c5ee0f8650c84b4d36a5f76b3b504233feaabf75", "shasum": "" }, "require": { @@ -2453,20 +2453,20 @@ ], "description": "Symfony Stopwatch Component", "homepage": "https://symfony.com", - "time": "2017-01-02 20:32:22" + "time": "2017-02-18 17:28:00" }, { "name": "symfony/yaml", - "version": "v3.2.4", + "version": "v3.2.6", "source": { "type": "git", "url": "https://github.com/symfony/yaml.git", - "reference": "9724c684646fcb5387d579b4bfaa63ee0b0c64c8" + "reference": "093e416ad096355149e265ea2e4cc1f9ee40ab1a" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/yaml/zipball/9724c684646fcb5387d579b4bfaa63ee0b0c64c8", - "reference": "9724c684646fcb5387d579b4bfaa63ee0b0c64c8", + "url": "https://api.github.com/repos/symfony/yaml/zipball/093e416ad096355149e265ea2e4cc1f9ee40ab1a", + "reference": "093e416ad096355149e265ea2e4cc1f9ee40ab1a", "shasum": "" }, "require": { @@ -2508,7 +2508,7 @@ ], "description": "Symfony Yaml Component", "homepage": "https://symfony.com", - "time": "2017-02-16 22:46:52" + "time": "2017-03-07 16:47:02" }, { "name": "webmozart/assert", From 2f0b6c41693e3225e4d0dc36d2d4d86d370ede5c Mon Sep 17 00:00:00 2001 From: Isaac Bennetch Date: Wed, 29 Mar 2017 14:39:15 -0400 Subject: [PATCH 4/5] Prepare for 4.7.1-dev Signed-off-by: Isaac Bennetch --- ChangeLog | 2 ++ README | 2 +- doc/conf.py | 2 +- libraries/Config.php | 2 +- 4 files changed, 5 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 1123543d78..637cb9f47a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,8 @@ phpMyAdmin - ChangeLog ====================== +4.7.1 (not yet released) + 4.7.0 (2017-03-28) - patch #12233 [Display] Improve message when renaming database to same name - issue #6146 Log authentication attempts to syslog diff --git a/README b/README index f23e316929..7477b35dda 100644 --- a/README +++ b/README @@ -1,7 +1,7 @@ phpMyAdmin - Readme =================== -Version 4.7.0 +Version 4.7.1-dev A web interface for MySQL and MariaDB. diff --git a/doc/conf.py b/doc/conf.py index d1294594d2..a912d87376 100644 --- a/doc/conf.py +++ b/doc/conf.py @@ -51,7 +51,7 @@ copyright = u'2012 - 2017, The phpMyAdmin devel team' # built documents. # # The short X.Y version. -version = '4.7.0' +version = '4.7.1-dev' # The full version, including alpha/beta/rc tags. release = version diff --git a/libraries/Config.php b/libraries/Config.php index 9f4c0e6005..cedd74ef3d 100644 --- a/libraries/Config.php +++ b/libraries/Config.php @@ -103,7 +103,7 @@ class Config */ public function checkSystem() { - $this->set('PMA_VERSION', '4.7.0'); + $this->set('PMA_VERSION', '4.7.1-dev'); /** * @deprecated */ From cf525c78761e4a984163c975a418580a5a024043 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Thu, 30 Mar 2017 13:09:08 +0200 Subject: [PATCH 5/5] Always execute tracking queries as controluser MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes #13132 Signed-off-by: Michal Čihař --- ChangeLog | 1 + libraries/Tracker.php | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 637cb9f47a..ff9cc4e3d9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -2,6 +2,7 @@ phpMyAdmin - ChangeLog ====================== 4.7.1 (not yet released) +- issue #13132 Always execute tracking queries as controluser 4.7.0 (2017-03-28) - patch #12233 [Display] Improve message when renaming database to same name diff --git a/libraries/Tracker.php b/libraries/Tracker.php index d37ba35372..6e698522b1 100644 --- a/libraries/Tracker.php +++ b/libraries/Tracker.php @@ -127,7 +127,7 @@ class Tracker " AND table_name = '" . $GLOBALS['dbi']->escapeString($tablename) . "' " . " ORDER BY version DESC LIMIT 1"; - $result = $GLOBALS['dbi']->fetchValue($sql_query); + $result = $GLOBALS['dbi']->fetchValue($sql_query, 0, 0, $GLOBALS['controllink']); return ($result == 1); }