gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'security/QA_4_7-security' into QA_4_7

Browse Source
This commit is contained in:
Isaac Bennetch 2017-12-23 08:31:25 -05:00
commit c178ff6911
37 changed files with 177 additions and 103 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libraries/URL.php
View File

@ -223,6 +223,10 @@ class URL
$params['collation_connection'] = $GLOBALS['collation_connection'];
}
if (isset($_SESSION[' PMA_token '])) {
$params['token'] = $_SESSION[' PMA_token '];
}
$query = http_build_query($params, null, $separator);
if ($divider != '?' || strlen($query) > 0) {

59
libraries/common.inc.php
View File

@ -361,31 +361,56 @@ if (PMA_checkPageValidity($_REQUEST['back'], $goto_whitelist)) {
* could access this variables before we reach this point
* f.e. PMA\libraries\Config: fontsize
*
* Check for token mismatch only if the Request method is POST
* GET Requests would never have token and therefore checking
* mis-match does not make sense
*
* @todo variables should be handled by their respective owners (objects)
* f.e. lang, server, collation_connection in PMA\libraries\Config
*/
$token_mismatch = true;
$token_provided = false;
if (PMA_isValid($_REQUEST['token'])) {
$token_provided = true;
$token_mismatch = ! hash_equals($_SESSION[' PMA_token '], $_REQUEST['token']);
}
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
if (PMA_isValid($_POST['token'])) {
$token_provided = true;
$token_mismatch = ! @hash_equals($_SESSION[' PMA_token '], $_POST['token']);
}
if ($token_mismatch) {
/**
* We don't allow any POST operation parameters if the token is mismatched
* or is not provided
if ($token_mismatch) {
/**
* List of parameters which are allowed from unsafe source
*/
$allow_list = array(
/* needed for direct access, see FAQ 1.34
* also, server needed for cookie login screen (multi-server)
*/
$whitelist = array('ajax_request');
PMA\libraries\Sanitize::removeRequestVars($whitelist);
'server', 'db', 'table', 'target', 'lang',
/* Session ID */
'phpMyAdmin',
/* Cookie preferences */
'pma_lang', 'pma_collation_connection',
/* Possible login form */
'pma_servername', 'pma_username', 'pma_password',
'g-recaptcha-response',
/* Needed to send the correct reply */
'ajax_request',
/* Permit to log out even if there is a token mismatch */
'old_usr',
/* Permit redirection with token-mismatch in url.php */
'url',
/* Permit session expiry flag */
'session_expired',
/* JS loading */
'scripts', 'call_done',
/* Navigation panel */
'aPath', 'vPath', 'pos', 'pos2_name', 'pos2_value', 'searchClause', 'searchClause2'
);
/**
* Allow changing themes in test/theme.php
*/
if (defined('PMA_TEST_THEME')) {
$allow_list[] = 'set_theme';
}
/**
* Do actual cleanup
*/
PMA\libraries\Sanitize::removeRequestVars($allow_list);
}

1
libraries/navigation/NavigationTree.php
View File

@ -1264,6 +1264,7 @@ class NavigationTree
);
$children = $this->_tree->children;
$url_params = array(
'token' => $_SESSION[' PMA_token '],
'server' => $GLOBALS['server'],
);
$retval .= '<div id="pma_navigation_db_select">';

6
libraries/navigation/nodes/NodeColumn.php
View File

@ -31,10 +31,12 @@ class NodeColumn extends Node
$this->links = array(
'text' => 'tbl_structure.php?server=' . $GLOBALS['server']
. '&amp;db=%3$s&amp;table=%2$s&amp;field=%1$s'
. '&amp;change_column=1',
. '&amp;change_column=1'
. '&amp;token=' . $_SESSION[' PMA_token '],
'icon' => 'tbl_structure.php?server=' . $GLOBALS['server']
. '&amp;db=%3$s&amp;table=%2$s&amp;field=%1$s'
. '&amp;change_column=1',
. '&amp;change_column=1'
. '&amp;token=' . $_SESSION[' PMA_token '],
'title' => __('Structure'),
);
}

12
libraries/navigation/nodes/NodeColumnContainer.php
View File

@ -27,9 +27,11 @@ class NodeColumnContainer extends Node
$this->icon = Util::getImage('pause.png', __('Columns'));
$this->links = array(
'text' => 'tbl_structure.php?server=' . $GLOBALS['server']
. '&amp;db=%2$s&amp;table=%1$s',
. '&amp;db=%2$s&amp;table=%1$s'
. '&amp;token=' . $_SESSION[' PMA_token '],
'icon' => 'tbl_structure.php?server=' . $GLOBALS['server']
. '&amp;db=%2$s&amp;table=%1$s',
. '&amp;db=%2$s&amp;table=%1$s'
. '&amp;token=' . $_SESSION[' PMA_token '],
);
$this->real_name = 'columns';
@ -43,10 +45,12 @@ class NodeColumnContainer extends Node
$new->links = array(
'text' => 'tbl_addfield.php?server=' . $GLOBALS['server']
. '&amp;db=%3$s&amp;table=%2$s'
. '&amp;field_where=last&after_field=',
. '&amp;field_where=last&after_field='
. '&amp;token=' . $_SESSION[' PMA_token '],
'icon' => 'tbl_addfield.php?server=' . $GLOBALS['server']
. '&amp;db=%3$s&amp;table=%2$s'
. '&amp;field_where=last&after_field=',
. '&amp;field_where=last&after_field='
. '&amp;token=' . $_SESSION[' PMA_token '],
);
$new->classes = 'new_column italics';
$this->addChild($new);

4
libraries/navigation/nodes/NodeDatabase.php
View File

@ -47,9 +47,9 @@ class NodeDatabase extends Node
$this->links = array(
'text' => $script_name
. '?server=' . $GLOBALS['server']
. '&amp;db=%1$s',
. '&amp;db=%1$s&amp;token=' . $_SESSION[' PMA_token '],
'icon' => 'db_operations.php?server=' . $GLOBALS['server']
. '&amp;db=%1$s&amp;',
. '&amp;db=%1$s&amp;token=' . $_SESSION[' PMA_token '],
'title' => __('Structure'),
);
$this->classes = 'database';

6
libraries/navigation/nodes/NodeDatabaseContainer.php
View File

@ -38,8 +38,10 @@ class NodeDatabaseContainer extends Node
$new->isNew = true;
$new->icon = PMA\libraries\Util::getImage('b_newdb.png', '');
$new->links = array(
'text' => 'server_databases.php?server=' . $GLOBALS['server'],
'icon' => 'server_databases.php?server=' . $GLOBALS['server'],
'text' => 'server_databases.php?server=' . $GLOBALS['server']
. '&amp;token=' . $_SESSION[' PMA_token '],
'icon' => 'server_databases.php?server=' . $GLOBALS['server']
. '&amp;token=' . $_SESSION[' PMA_token '],
);
$new->classes = 'new_database italics';
$this->addChild($new);

6
libraries/navigation/nodes/NodeEvent.php
View File

@ -30,9 +30,11 @@ class NodeEvent extends NodeDatabaseChild
$this->icon = PMA\libraries\Util::getImage('b_events.png');
$this->links = array(
'text' => 'db_events.php?server=' . $GLOBALS['server']
. '&amp;db=%2$s&amp;item_name=%1$s&amp;edit_item=1',
. '&amp;db=%2$s&amp;item_name=%1$s&amp;edit_item=1'
. '&amp;token=' . $_SESSION[' PMA_token '],
'icon' => 'db_events.php?server=' . $GLOBALS['server']
. '&amp;db=%2$s&amp;item_name=%1$s&amp;export_item=1',
. '&amp;db=%2$s&amp;item_name=%1$s&amp;export_item=1'
. '&amp;token=' . $_SESSION[' PMA_token '],
);
$this->classes = 'event';
}

10
libraries/navigation/nodes/NodeEventContainer.php
View File

@ -26,9 +26,9 @@ class NodeEventContainer extends NodeDatabaseChildContainer
$this->icon = PMA\libraries\Util::getImage('b_events.png', '');
$this->links = array(
'text' => 'db_events.php?server=' . $GLOBALS['server']
. '&amp;db=%1$s',
. '&amp;db=%1$s&amp;token=' . $_SESSION[' PMA_token '],
'icon' => 'db_events.php?server=' . $GLOBALS['server']
. '&amp;db=%1$s',
. '&amp;db=%1$s&amp;token=' . $_SESSION[' PMA_token '],
);
$this->real_name = 'events';
@ -40,9 +40,11 @@ class NodeEventContainer extends NodeDatabaseChildContainer
$new->icon = PMA\libraries\Util::getImage('b_event_add.png', '');
$new->links = array(
'text' => 'db_events.php?server=' . $GLOBALS['server']
. '&amp;db=%2$s&add_item=1',
. '&amp;db=%2$s&amp;token=' . $_SESSION[' PMA_token ']
. '&add_item=1',
'icon' => 'db_events.php?server=' . $GLOBALS['server']
. '&amp;db=%2$s&add_item=1',
. '&amp;db=%2$s&amp;token=' . $_SESSION[' PMA_token ']
. '&add_item=1',
);
$new->classes = 'new_event italics';
$this->addChild($new);

4
libraries/navigation/nodes/NodeFunction.php
View File

@ -31,10 +31,10 @@ class NodeFunction extends NodeDatabaseChild
$this->links = array(
'text' => 'db_routines.php?server=' . $GLOBALS['server']
. '&amp;db=%2$s&amp;item_name=%1$s&amp;item_type=FUNCTION'
. '&amp;edit_item=1',
. '&amp;edit_item=1&amp;token=' . $_SESSION[' PMA_token '],
'icon' => 'db_routines.php?server=' . $GLOBALS['server']
. '&amp;db=%2$s&amp;item_name=%1$s&amp;item_type=FUNCTION'
. '&amp;execute_dialog=1',
. '&amp;execute_dialog=1&amp;token=' . $_SESSION[' PMA_token '],
);
$this->classes = 'function';
}

12
libraries/navigation/nodes/NodeFunctionContainer.php
View File

@ -29,9 +29,11 @@ class NodeFunctionContainer extends NodeDatabaseChildContainer
);
$this->links = array(
'text' => 'db_routines.php?server=' . $GLOBALS['server']
. '&amp;db=%1$s&amp;type=FUNCTION',
. '&amp;db=%1$s&amp;token=' . $_SESSION[' PMA_token ']
. '&amp;type=FUNCTION',
'icon' => 'db_routines.php?server=' . $GLOBALS['server']
. '&amp;db=%1$s&amp;type=FUNCTION',
. '&amp;db=%1$s&amp;token=' . $_SESSION[' PMA_token ']
. '&amp;type=FUNCTION',
);
$this->real_name = 'functions';
@ -44,9 +46,11 @@ class NodeFunctionContainer extends NodeDatabaseChildContainer
$new->icon = PMA\libraries\Util::getImage('b_routine_add.png', $new_label);
$new->links = array(
'text' => 'db_routines.php?server=' . $GLOBALS['server']
. '&amp;db=%2$s&add_item=1&amp;item_type=FUNCTION',
. '&amp;db=%2$s&amp;token=' . $_SESSION[' PMA_token ']
. '&add_item=1&amp;item_type=FUNCTION',
'icon' => 'db_routines.php?server=' . $GLOBALS['server']
. '&amp;db=%2$s&add_item=1&amp;item_type=FUNCTION',
. '&amp;db=%2$s&amp;token=' . $_SESSION[' PMA_token ']
. '&add_item=1&amp;item_type=FUNCTION',
);
$new->classes = 'new_function italics';
$this->addChild($new);

6
libraries/navigation/nodes/NodeIndex.php
View File

@ -30,9 +30,11 @@ class NodeIndex extends Node
$this->icon = PMA\libraries\Util::getImage('b_index.png', __('Index'));
$this->links = array(
'text' => 'tbl_indexes.php?server=' . $GLOBALS['server']
. '&amp;db=%3$s&amp;table=%2$s&amp;index=%1$s',
. '&amp;db=%3$s&amp;table=%2$s&amp;index=%1$s'
. '&amp;token=' . $_SESSION[' PMA_token '],
'icon' => 'tbl_indexes.php?server=' . $GLOBALS['server']
. '&amp;db=%3$s&amp;table=%2$s&amp;index=%1$s',
. '&amp;db=%3$s&amp;table=%2$s&amp;index=%1$s'
. '&amp;token=' . $_SESSION[' PMA_token '],
);
$this->classes = 'index';
}

12
libraries/navigation/nodes/NodeIndexContainer.php
View File

@ -26,9 +26,11 @@ class NodeIndexContainer extends Node
$this->icon = PMA\libraries\Util::getImage('b_index.png', __('Indexes'));
$this->links = array(
'text' => 'tbl_structure.php?server=' . $GLOBALS['server']
. '&amp;db=%2$s&amp;table=%1$s',
. '&amp;db=%2$s&amp;table=%1$s'
. '&amp;token=' . $_SESSION[' PMA_token '],
'icon' => 'tbl_structure.php?server=' . $GLOBALS['server']
. '&amp;db=%2$s&amp;table=%1$s',
. '&amp;db=%2$s&amp;table=%1$s'
. '&amp;token=' . $_SESSION[' PMA_token '],
);
$this->real_name = 'indexes';
@ -42,10 +44,12 @@ class NodeIndexContainer extends Node
$new->links = array(
'text' => 'tbl_indexes.php?server=' . $GLOBALS['server']
. '&amp;create_index=1&amp;added_fields=2'
. '&amp;db=%3$s&amp;table=%2$s',
. '&amp;db=%3$s&amp;table=%2$s&amp;token='
. $_SESSION[' PMA_token '],
'icon' => 'tbl_indexes.php?server=' . $GLOBALS['server']
. '&amp;create_index=1&amp;added_fields=2'
. '&amp;db=%3$s&amp;table=%2$s',
. '&amp;db=%3$s&amp;table=%2$s&amp;token='
. $_SESSION[' PMA_token '],
);
$new->classes = 'new_index italics';
$this->addChild($new);

4
libraries/navigation/nodes/NodeProcedure.php
View File

@ -34,10 +34,10 @@ class NodeProcedure extends NodeDatabaseChild
$this->links = array(
'text' => 'db_routines.php?server=' . $GLOBALS['server']
. '&amp;db=%2$s&amp;item_name=%1$s&amp;item_type=PROCEDURE'
. '&amp;edit_item=1',
. '&amp;edit_item=1&amp;token=' . $_SESSION[' PMA_token '],
'icon' => 'db_routines.php?server=' . $GLOBALS['server']
. '&amp;db=%2$s&amp;item_name=%1$s&amp;item_type=PROCEDURE'
. '&amp;execute_dialog=1',
. '&amp;execute_dialog=1&amp;token=' . $_SESSION[' PMA_token '],
);
$this->classes = 'procedure';
}

12
libraries/navigation/nodes/NodeProcedureContainer.php
View File

@ -29,9 +29,11 @@ class NodeProcedureContainer extends NodeDatabaseChildContainer
);
$this->links = array(
'text' => 'db_routines.php?server=' . $GLOBALS['server']
. '&amp;db=%1$s&amp;type=PROCEDURE',
. '&amp;db=%1$s&amp;token=' . $_SESSION[' PMA_token ']
. '&amp;type=PROCEDURE',
'icon' => 'db_routines.php?server=' . $GLOBALS['server']
. '&amp;db=%1$s&amp;type=PROCEDURE',
. '&amp;db=%1$s&amp;token=' . $_SESSION[' PMA_token ']
. '&amp;type=PROCEDURE',
);
$this->real_name = 'procedures';
@ -44,9 +46,11 @@ class NodeProcedureContainer extends NodeDatabaseChildContainer
$new->icon = PMA\libraries\Util::getImage('b_routine_add.png', $new_label);
$new->links = array(
'text' => 'db_routines.php?server=' . $GLOBALS['server']
. '&amp;db=%2$s&add_item=1',
. '&amp;db=%2$s&amp;token=' . $_SESSION[' PMA_token ']
. '&add_item=1',
'icon' => 'db_routines.php?server=' . $GLOBALS['server']
. '&amp;db=%2$s&add_item=1',
. '&amp;db=%2$s&amp;token=' . $_SESSION[' PMA_token ']
. '&add_item=1',
);
$new->classes = 'new_procedure italics';
$this->addChild($new);

8
libraries/navigation/nodes/NodeTable.php
View File

@ -53,20 +53,22 @@ class NodeTable extends NodeDatabaseChild
'text' => $script_name
. '?server=' . $GLOBALS['server']
. '&amp;db=%2$s&amp;table=%1$s'
. '&amp;pos=0',
. '&amp;pos=0&amp;token=' . $_SESSION[' PMA_token '],
'icon' => array(
Util::getScriptNameForOption(
$GLOBALS['cfg']['NavigationTreeDefaultTabTable'],
'table'
)
. '?server=' . $GLOBALS['server']
. '&amp;db=%2$s&amp;table=%1$s',
. '&amp;db=%2$s&amp;table=%1$s&amp;token='
. $_SESSION[' PMA_token '],
Util::getScriptNameForOption(
$GLOBALS['cfg']['NavigationTreeDefaultTabTable2'],
'table'
)
. '?server=' . $GLOBALS['server']
. '&amp;db=%2$s&amp;table=%1$s',
. '&amp;db=%2$s&amp;table=%1$s&amp;token='
. $_SESSION[' PMA_token '],
),
'title' => $this->title,
);

10
libraries/navigation/nodes/NodeTableContainer.php
View File

@ -26,9 +26,11 @@ class NodeTableContainer extends NodeDatabaseChildContainer
$this->icon = PMA\libraries\Util::getImage('b_browse.png', __('Tables'));
$this->links = array(
'text' => 'db_structure.php?server=' . $GLOBALS['server']
. '&amp;db=%1$s&amp;tbl_type=table',
. '&amp;db=%1$s&amp;tbl_type=table'
. '&amp;token=' . $_SESSION[' PMA_token '],
'icon' => 'db_structure.php?server=' . $GLOBALS['server']
. '&amp;db=%1$s&amp;tbl_type=table',
. '&amp;db=%1$s&amp;tbl_type=table'
. '&amp;token=' . $_SESSION[' PMA_token '],
);
$this->real_name = 'tables';
$this->classes = 'tableContainer subContainer';
@ -42,9 +44,9 @@ class NodeTableContainer extends NodeDatabaseChildContainer
$new->icon = PMA\libraries\Util::getImage('b_table_add.png', $new_label);
$new->links = array(
'text' => 'tbl_create.php?server=' . $GLOBALS['server']
. '&amp;db=%2$s',
. '&amp;db=%2$s&amp;token=' . $_SESSION[' PMA_token '],
'icon' => 'tbl_create.php?server=' . $GLOBALS['server']
. '&amp;db=%2$s',
. '&amp;db=%2$s&amp;token=' . $_SESSION[' PMA_token '],
);
$new->classes = 'new_table italics';
$this->addChild($new);

6
libraries/navigation/nodes/NodeTrigger.php
View File

@ -30,9 +30,11 @@ class NodeTrigger extends Node
$this->icon = PMA\libraries\Util::getImage('b_triggers.png');
$this->links = array(
'text' => 'db_triggers.php?server=' . $GLOBALS['server']
. '&amp;db=%3$s&amp;item_name=%1$s&amp;edit_item=1',
. '&amp;db=%3$s&amp;item_name=%1$s&amp;edit_item=1'
. '&amp;token=' . $_SESSION[' PMA_token '],
'icon' => 'db_triggers.php?server=' . $GLOBALS['server']
. '&amp;db=%3$s&amp;item_name=%1$s&amp;export_item=1',
. '&amp;db=%3$s&amp;item_name=%1$s&amp;export_item=1'
. '&amp;token=' . $_SESSION[' PMA_token '],
);
$this->classes = 'trigger';
}

12
libraries/navigation/nodes/NodeTriggerContainer.php
View File

@ -26,9 +26,11 @@ class NodeTriggerContainer extends Node
$this->icon = PMA\libraries\Util::getImage('b_triggers.png');
$this->links = array(
'text' => 'db_triggers.php?server=' . $GLOBALS['server']
. '&amp;db=%2$s&amp;table=%1$s',
. '&amp;db=%2$s&amp;table=%1$s&amp;token='
. $_SESSION[' PMA_token '],
'icon' => 'db_triggers.php?server=' . $GLOBALS['server']
. '&amp;db=%2$s&amp;table=%1$s',
. '&amp;db=%2$s&amp;table=%1$s&amp;token='
. $_SESSION[' PMA_token '],
);
$this->real_name = 'triggers';
@ -40,9 +42,11 @@ class NodeTriggerContainer extends Node
$new->icon = PMA\libraries\Util::getImage('b_trigger_add.png', '');
$new->links = array(
'text' => 'db_triggers.php?server=' . $GLOBALS['server']
. '&amp;db=%3$s&amp;add_item=1',
. '&amp;db=%3$s&amp;token=' . $_SESSION[' PMA_token ']
. '&amp;add_item=1',
'icon' => 'db_triggers.php?server=' . $GLOBALS['server']
. '&amp;db=%3$s&amp;add_item=1',
. '&amp;db=%3$s&amp;token=' . $_SESSION[' PMA_token ']
. '&amp;add_item=1',
);
$new->classes = 'new_trigger italics';
$this->addChild($new);

6
libraries/navigation/nodes/NodeView.php
View File

@ -30,9 +30,11 @@ class NodeView extends NodeDatabaseChild
$this->icon = PMA\libraries\Util::getImage('b_props.png', __('View'));
$this->links = array(
'text' => 'sql.php?server=' . $GLOBALS['server']
. '&amp;db=%2$s&amp;table=%1$s&amp;pos=0',
. '&amp;db=%2$s&amp;table=%1$s&amp;pos=0'
. '&amp;token=' . $_SESSION[' PMA_token '],
'icon' => 'tbl_structure.php?server=' . $GLOBALS['server']
. '&amp;db=%2$s&amp;table=%1$s',
. '&amp;db=%2$s&amp;table=%1$s'
. '&amp;token=' . $_SESSION[' PMA_token '],
);
$this->classes = 'view';
}

10
libraries/navigation/nodes/NodeViewContainer.php
View File

@ -26,9 +26,11 @@ class NodeViewContainer extends NodeDatabaseChildContainer
$this->icon = PMA\libraries\Util::getImage('b_views.png', __('Views'));
$this->links = array(
'text' => 'db_structure.php?server=' . $GLOBALS['server']
. '&amp;db=%1$s&amp;tbl_type=view',
. '&amp;db=%1$s&amp;tbl_type=view'
. '&amp;token=' . $_SESSION[' PMA_token '],
'icon' => 'db_structure.php?server=' . $GLOBALS['server']
. '&amp;db=%1$s&amp;tbl_type=view',
. '&amp;db=%1$s&amp;tbl_type=view'
. '&amp;token=' . $_SESSION[' PMA_token '],
);
$this->classes = 'viewContainer subContainer';
$this->real_name = 'views';
@ -42,9 +44,9 @@ class NodeViewContainer extends NodeDatabaseChildContainer
$new->icon = PMA\libraries\Util::getImage('b_view_add.png', $new_label);
$new->links = array(
'text' => 'view_create.php?server=' . $GLOBALS['server']
. '&amp;db=%2$s',
. '&amp;db=%2$s&amp;token=' . $_SESSION[' PMA_token '],
'icon' => 'view_create.php?server=' . $GLOBALS['server']
. '&amp;db=%2$s',
. '&amp;db=%2$s&amp;token=' . $_SESSION[' PMA_token '],
);
$new->classes = 'new_view italics';
$this->addChild($new);

2
test/classes/AdvisorTest.php
View File

@ -171,7 +171,7 @@ class AdvisorTest extends PMATestCase
'name' => 'Variable',
'issue' => 'issue',
'recommendation' => 'Recommend <a href="server_variables.php?' .
'filter=status_var&amp;lang=en">status_var</a>'
'filter=status_var&amp;lang=en&amp;token=token">status_var</a>'
),
null,
),

4
test/classes/DbSearchTest.php
View File

@ -167,13 +167,13 @@ class DbSearchTest extends PMATestCase
. 'href="sql.php?db=pma&amp;table'
. '=table1&amp;goto=db_sql.php&amp;pos=0&amp;is_js_confirmed=0&amp;'
. 'server=0&amp;lang=en&amp;'
. 'collation_connection=utf-8" '
. 'collation_connection=utf-8&amp;token=token" '
. 'data-browse-sql="column1" data-table-name="table1" '
. '>Browse</a></td><td>'
. '<a name="delete_search" class="ajax delete_results" href'
. '="sql.php?db=pma&amp;table=table1&amp;goto=db_sql.php&amp;pos=0'
. '&amp;is_js_confirmed=0&amp;server=0&amp;'
. 'lang=en&amp;collation_connection=utf-8" '
. 'lang=en&amp;collation_connection=utf-8&amp;token=token" '
. 'data-delete-sql="column2" '
. 'data-table-name="table1" '
. '>Delete</a></td></tr>'

14
test/classes/DisplayResultsTest.php
View File

@ -889,7 +889,7 @@ class DisplayResultsTest extends PMATestCase
'routine_name',
'db_routines.php?item_name=circumference&db=data'
. '&item_type=FUNCTION&server=0&lang=en'
. '&collation_connection=utf-8'
. '&collation_connection=utf-8&token=token'
),
array(
'information_schema',
@ -903,7 +903,7 @@ class DisplayResultsTest extends PMATestCase
'routine_name',
'db_routines.php?item_name=area&db=data'
. '&item_type=PROCEDURE&server=0&lang=en'
. '&collation_connection=utf-8'
. '&collation_connection=utf-8&token=token'
),
array(
'information_schema',
@ -917,7 +917,7 @@ class DisplayResultsTest extends PMATestCase
'index.php?sql_query=SELECT+%60CHARACTER_SET_NAME%60+FROM+%60info'
. 'rmation_schema%60.%60CHARACTER_SETS%60&db=information_schema'
. '&test_name=value&server=0&lang=en'
. '&collation_connection=utf-8'
. '&collation_connection=utf-8&token=token'
)
);
}
@ -1246,7 +1246,7 @@ class DisplayResultsTest extends PMATestCase
$url_params,
null,
'<a href="tbl_get_field.php?db=foo&amp;table=bar&amp;server=0'
. '&amp;lang=en&amp;collation_connection=utf-8'
. '&amp;lang=en&amp;collation_connection=utf-8&amp;token=token'
. '" class="disableAjax">1001</a>'
),
array(
@ -1261,7 +1261,7 @@ class DisplayResultsTest extends PMATestCase
$url_params,
null,
'<a href="tbl_get_field.php?db=foo&amp;table=bar&amp;server=0'
. '&amp;lang=en&amp;collation_connection=utf-8'
. '&amp;lang=en&amp;collation_connection=utf-8&amp;token=token'
. '" class="disableAjax">0x123456</a>'
),
array(
@ -1276,7 +1276,7 @@ class DisplayResultsTest extends PMATestCase
$url_params,
null,
'<a href="tbl_get_field.php?db=foo&amp;table=bar&amp;server=0'
. '&amp;lang=en&amp;collation_connection=utf-8'
. '&amp;lang=en&amp;collation_connection=utf-8&amp;token=token'
. '" class="disableAjax">[BLOB - 4 B]</a>'
),
array(
@ -1399,7 +1399,7 @@ class DisplayResultsTest extends PMATestCase
'binary',
'<td class="left hex"><a href="tbl_get_field.php?'
. 'db=foo&amp;table=tbl&amp;server=0&amp;lang=en'
. '&amp;collation_connection=utf-8'
. '&amp;collation_connection=utf-8&amp;token=token'
. '" '
. 'class="disableAjax">[BLOB - 4 B]</a></td>'
),

4
test/classes/FooterTest.php
View File

@ -157,7 +157,7 @@ class FooterTest extends PMATestCase
$this->assertEquals(
'<div id="selflink" class="print_ignore"><a href="index.php?db=&amp;'
. 'table=&amp;server=1&amp;target=&amp;lang=en&amp;collation_connection='
. 'utf8_general_ci" title="Open new phpMyAdmin window" '
. 'utf8_general_ci&amp;token=token" title="Open new phpMyAdmin window" '
. 'target="_blank" rel="noopener noreferrer">Open new phpMyAdmin window</a></div>',
$this->_callPrivateFunction(
'_getSelfLink',
@ -182,7 +182,7 @@ class FooterTest extends PMATestCase
$this->assertEquals(
'<div id="selflink" class="print_ignore"><a href="index.php?db=&amp;'
. 'table=&amp;server=1&amp;target=&amp;lang=en&amp;collation_connection='
. 'utf8_general_ci" title="Open new phpMyAdmin window" '
. 'utf8_general_ci&amp;token=token" title="Open new phpMyAdmin window" '
. 'target="_blank" rel="noopener noreferrer"><img src="themes/dot.gif" title="Open new '
. 'phpMyAdmin window" alt="Open new phpMyAdmin window" '
. 'class="icon ic_window-new" /></a></div>',

2
test/classes/ThemeTest.php
View File

@ -292,7 +292,7 @@ class ThemeTest extends PMATestCase
$this->object->getPrintPreview(),
'<div class="theme_preview"><h2> (0.0.0.0) </h2><p><a class="take_'
. 'theme" name="" href="index.php?set_theme=&amp;server=99&amp;lang=en'
. '&amp;collation_connection=utf-8'
. '&amp;collation_connection=utf-8&amp;token=token'
. '">No preview available.[ <strong>take it</strong> ]'
. '</a></p></div>'
);

4
test/classes/URLTest.php
View File

@ -45,6 +45,7 @@ class URLTest extends PHPUnit_Framework_TestCase
$expected = 'server=x' . htmlentities($separator)
. 'lang=en' . htmlentities($separator)
. 'collation_connection=x'
. htmlentities($separator) . 'token=token'
;
$expected = '?db=db'
@ -68,6 +69,7 @@ class URLTest extends PHPUnit_Framework_TestCase
$expected = 'server=x' . htmlentities($separator)
. 'lang=en' . htmlentities($separator)
. 'collation_connection=x'
. htmlentities($separator) . 'token=token'
;
$expected = '?db=db'
@ -92,6 +94,7 @@ class URLTest extends PHPUnit_Framework_TestCase
$expected = 'server=x' . $separator
. 'lang=en' . $separator
. 'collation_connection=x'
. $separator . 'token=token'
;
$expected = '#ABC#db=db' . $separator . 'table=table' . $separator
@ -119,6 +122,7 @@ class URLTest extends PHPUnit_Framework_TestCase
$expected = '?server=x' . htmlentities($separator)
. 'lang=en' . htmlentities($separator)
. 'collation_connection=x'
. htmlentities($separator) . 'token=token'
;
$this->assertEquals($expected, URL::getCommon());
}

2
test/classes/config/PageSettingsTest.php
View File

@ -57,7 +57,7 @@ class PageSettingsTest extends PMATestCase
'<div id="page_settings_modal">'
. '<div class="page_settings">'
. '<form method="post" '
. 'action="phpunit?db=db&amp;table=&amp;server=1&amp;target=&amp;lang=en" '
. 'action="phpunit?db=db&amp;table=&amp;server=1&amp;target=&amp;lang=en&amp;token=token" '
. 'class="config-form disableAjax">',
$html
);

2
test/classes/navigation/NavigationTest.php
View File

@ -156,7 +156,7 @@ class NavigationTest extends PMATestCase
$this->assertContains(
'<a href="navigation.php?'
. 'unhideNavItem=1&amp;itemType=table&amp;'
. 'itemName=tableName&amp;dbName=db&amp;lang=en"'
. 'itemName=tableName&amp;dbName=db&amp;lang=en&amp;token=token"'
. ' class="unhideNavItem ajax">',
$html
);

2
test/classes/navigation/NodeDatabaseChildTest.php
View File

@ -83,7 +83,7 @@ class NodeDatabaseChildTest extends PMATestCase
$this->assertContains(
'<a href="navigation.php?'
. 'hideNavItem=1&amp;itemType=itemType&amp;itemName=child'
. '&amp;dbName=parent&amp;lang=en" class="hideNavItem ajax">',
. '&amp;dbName=parent&amp;lang=en&amp;token=token" class="hideNavItem ajax">',
$html
);
}

2
test/classes/plugin/auth/AuthenticationConfigTest.php
View File

@ -138,7 +138,7 @@ class AuthenticationConfigTest extends PMATestCase
$this->assertContains(
'<a href="index.php?server=0&amp;lang=en'
. '&amp;collation_connection=utf-8" '
. '&amp;collation_connection=utf-8&amp;token=token" '
. 'class="button disableAjax">Retry to connect</a>',
$html
);

2
test/classes/plugin/auth/AuthenticationCookieTest.php
View File

@ -372,7 +372,7 @@ class AuthenticationCookieTest extends PMATestCase
$_COOKIE['pmaAuth-2'] = '';
$this->mockResponse('Location: /phpmyadmin/index.php?server=2&lang=en&collation_connection=utf-8');
$this->mockResponse('Location: /phpmyadmin/index.php?server=2&lang=en&collation_connection=utf-8&token=token');
$this->object->logOut();
}

2
test/libraries/PMA_Form_Processing_test.php
View File

@ -39,7 +39,7 @@ class PMA_Form_Processing_Test extends PMATestCase
{
$this->mockResponse(
array('HTTP/1.1 303 See Other'),
array('Location: index.php?lang=en')
array('Location: index.php?lang=en&token=token')
);
// case 1

16
test/libraries/PMA_insert_edit_test.php
View File

@ -293,7 +293,7 @@ class PMA_InsertEditTest extends PHPUnit_Framework_TestCase
$this->assertEquals(
' : <a href="tbl_change.php?ShowFunctionFields=1&amp;ShowFieldTypesIn'
. 'DataEditView=1&amp;goto=sql.php&amp;lang=en">'
. 'DataEditView=1&amp;goto=sql.php&amp;lang=en&amp;token=token">'
. 'Function</a>',
$result
);
@ -303,7 +303,7 @@ class PMA_InsertEditTest extends PHPUnit_Framework_TestCase
$this->assertEquals(
'<th><a href="tbl_change.php?ShowFunctionFields=0&amp;ShowFieldTypesIn'
. 'DataEditView=1&amp;goto=sql.php&amp;lang=en" title='
. 'DataEditView=1&amp;goto=sql.php&amp;lang=en&amp;token=token" title='
. '"Hide">Function</a></th>',
$result
);
@ -313,7 +313,7 @@ class PMA_InsertEditTest extends PHPUnit_Framework_TestCase
$this->assertEquals(
' : <a href="tbl_change.php?ShowFunctionFields=1&amp;ShowFieldTypesIn'
. 'DataEditView=1&amp;goto=sql.php&amp;lang=en">'
. 'DataEditView=1&amp;goto=sql.php&amp;lang=en&amp;token=token">'
. 'Type</a>',
$result
);
@ -323,7 +323,7 @@ class PMA_InsertEditTest extends PHPUnit_Framework_TestCase
$this->assertEquals(
'<th><a href="tbl_change.php?ShowFunctionFields=1&amp;ShowFieldTypesIn'
. 'DataEditView=0&amp;goto=sql.php&amp;lang=en" title='
. 'DataEditView=0&amp;goto=sql.php&amp;lang=en&amp;token=token" title='
. '"Hide">Type</a></th>',
$result
);
@ -746,7 +746,7 @@ class PMA_InsertEditTest extends PHPUnit_Framework_TestCase
$this->assertContains(
'<a class="ajax browse_foreign" href="browse_'
. 'foreigners.php?db=db&amp;table=tbl&amp;field=f&amp;rownumber=8'
. '&amp;data=abc&amp;server=1&amp;lang=en">',
. '&amp;data=abc&amp;server=1&amp;lang=en&amp;token=token">',
$result
);
@ -1977,7 +1977,7 @@ class PMA_InsertEditTest extends PHPUnit_Framework_TestCase
{
$GLOBALS['cfg']['ServerDefault'] = 1;
$this->assertEquals(
'tbl_change.php?lang=en',
'tbl_change.php?lang=en&amp;token=token',
PMA_getErrorUrl(array())
);
@ -2278,7 +2278,7 @@ class PMA_InsertEditTest extends PHPUnit_Framework_TestCase
$this->assertEquals(
'<a href="sql.php?db=information_schema&amp;table=TABLES&amp;pos=0&amp;'
. 'sql_query=SELECT+%2A+FROM+%60information_schema%60.%60TABLES%60+WHERE'
. '+%60f%60%3D1&amp;lang=en" title="a&gt;">b&lt;</a>',
. '+%60f%60%3D1&amp;lang=en&amp;token=token" title="a&gt;">b&lt;</a>',
$result
);
@ -2288,7 +2288,7 @@ class PMA_InsertEditTest extends PHPUnit_Framework_TestCase
$this->assertEquals(
'<a href="sql.php?db=information_schema&amp;table=TABLES&amp;pos=0&amp;'
. 'sql_query=SELECT+%2A+FROM+%60information_schema%60.%60TABLES%60+WHERE'
. '+%60f%60%3D1&amp;lang=en" title="b&lt;">a&gt;</a>',
. '+%60f%60%3D1&amp;lang=en&amp;token=token" title="b&lt;">a&gt;</a>',
$result
);
}

4
test/libraries/PMA_server_privileges_test.php
View File

@ -2427,13 +2427,13 @@ class PMA_ServerPrivileges_Test extends PHPUnit_Framework_TestCase
$this->assertContains(
'<a class="ajax" href="server_privileges.php?initial=-&amp;'
. 'server=1&amp;lang=en&amp;collation_connection='
. 'collation_connection">-</a>',
. 'collation_connection&amp;token=token">-</a>',
$actual
);
$this->assertContains(
'<a class="ajax" href="server_privileges.php?initial=%22&amp;'
. 'server=1&amp;lang=en&amp;collation_connection='
. 'collation_connection">"</a>',
. 'collation_connection&amp;token=token">"</a>',
$actual
);
$this->assertContains('Show all', $actual);

2
test/libraries/PMA_user_preferences_test.php
View File

@ -368,7 +368,7 @@ class PMA_User_Preferences_Test extends PMATestCase
{
$GLOBALS['lang'] = '';
$this->mockResponse('Location: /phpmyadmin/file.html?a=b&saved=1&server=0#h+ash');
$this->mockResponse('Location: /phpmyadmin/file.html?a=b&saved=1&server=0&token=token#h+ash');
$GLOBALS['PMA_Config']->set('PmaAbsoluteUri', '');
$GLOBALS['PMA_Config']->set('PMA_IS_IIS', false);

6
test/libraries/common/PMA_getDbLink_test.php
View File

@ -58,7 +58,7 @@ class PMA_GetDbLink_Test extends PHPUnit_Framework_TestCase
$GLOBALS['cfg']['DefaultTabDatabase'], 'database'
)
. '?db=' . $database
. '&amp;server=99&amp;lang=en" '
. '&amp;server=99&amp;lang=en&amp;token=token" '
. 'title="Jump to database &quot;'
. htmlspecialchars($database) . '&quot;.">'
. htmlspecialchars($database) . '</a>',
@ -80,7 +80,7 @@ class PMA_GetDbLink_Test extends PHPUnit_Framework_TestCase
$GLOBALS['cfg']['DefaultTabDatabase'], 'database'
)
. '?db=' . $database
. '&amp;server=99&amp;lang=en" title="Jump to database &quot;'
. '&amp;server=99&amp;lang=en&amp;token=token" title="Jump to database &quot;'
. htmlspecialchars($database) . '&quot;.">'
. htmlspecialchars($database) . '</a>',
PMA\libraries\Util::getDbLink($database)
@ -103,7 +103,7 @@ class PMA_GetDbLink_Test extends PHPUnit_Framework_TestCase
)
. '?db='
. htmlspecialchars(urlencode($database))
. '&amp;server=99&amp;lang=en" title="Jump to database &quot;'
. '&amp;server=99&amp;lang=en&amp;token=token" title="Jump to database &quot;'
. htmlspecialchars($database) . '&quot;.">'
. htmlspecialchars($database) . '</a>',
PMA\libraries\Util::getDbLink($database)