From 7dc42d93af685393ed6a0f0dc435ae8388991b00 Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Sat, 20 Sep 2014 06:56:30 -0400 Subject: [PATCH 1/4] 4.2.9 release Signed-off-by: Marc Delisle --- ChangeLog | 2 +- README | 2 +- doc/conf.py | 2 +- libraries/Config.class.php | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/ChangeLog b/ChangeLog index 8777086cd5..18aa741c12 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,7 +1,7 @@ phpMyAdmin - ChangeLog ====================== -4.2.9.0 (not yet released) +4.2.9.0 (2014-09-20) - bug ajax.js responseHandler: cannot read property of null - bug sql.js: str is undefined - bug #4524 Allow for direct selection of "0" on the "user overview" page diff --git a/README b/README index f046f8172c..744ea627b2 100644 --- a/README +++ b/README @@ -1,7 +1,7 @@ phpMyAdmin - Readme =================== -Version 4.2.9-dev +Version 4.2.9 A set of PHP-scripts to manage MySQL over the web. diff --git a/doc/conf.py b/doc/conf.py index af38824237..81cd260535 100644 --- a/doc/conf.py +++ b/doc/conf.py @@ -51,7 +51,7 @@ copyright = u'2012 - 2014, The phpMyAdmin devel team' # built documents. # # The short X.Y version. -version = '4.2.9-dev' +version = '4.2.9' # The full version, including alpha/beta/rc tags. release = version diff --git a/libraries/Config.class.php b/libraries/Config.class.php index aafa795c7f..4b761c8bec 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -114,7 +114,7 @@ class PMA_Config */ function checkSystem() { - $this->set('PMA_VERSION', '4.2.9-dev'); + $this->set('PMA_VERSION', '4.2.9'); /** * @deprecated */ From c1a3f85fbd1a9569646e7cf1b791325ae82c7961 Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Sun, 28 Sep 2014 09:48:13 -0400 Subject: [PATCH 2/4] [security] XSS with malicious ENUM values Signed-off-by: Marc Delisle Conflicts: libraries/Util.class.php --- libraries/TableSearch.class.php | 11 ++++++++--- libraries/Util.class.php | 9 ++++++--- 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/libraries/TableSearch.class.php b/libraries/TableSearch.class.php index d77cce1470..a0b3fa4924 100644 --- a/libraries/TableSearch.class.php +++ b/libraries/TableSearch.class.php @@ -316,6 +316,7 @@ EOT; private function _getEnumSetInputBox($column_index, $criteriaValues, $column_type, $column_id, $in_zoom_search_edit = false ) { + $column_type = htmlspecialchars($column_type); $html_output = ''; $value = explode( ', ', @@ -985,7 +986,9 @@ EOT; $html_output .= '' . htmlspecialchars($this->_columnNames[$column_index]) . ''; $properties = $this->getColumnProperties($column_index, $column_index); - $html_output .= '' . $properties['type'] . ''; + $html_output .= '' + . htmlspecialchars($properties['type']) + . ''; $html_output .= '' . $properties['collation'] . ''; $html_output .= '' . $properties['func'] . ''; // here, the data-type attribute is needed for a date/time picker @@ -996,11 +999,13 @@ EOT; $html_output .= ''; $html_output .= '_columnNames[$column_index]) . '" />'; $html_output .= ''; + . ' value="' + . htmlspecialchars($this->_columnTypes[$column_index]) . '" />'; $html_output .= ''; diff --git a/libraries/Util.class.php b/libraries/Util.class.php index 3154c3edc8..44c1a04820 100644 --- a/libraries/Util.class.php +++ b/libraries/Util.class.php @@ -3029,9 +3029,12 @@ class PMA_Util // for the case ENUM('–','“') $displayed_type = htmlspecialchars($printtype); if (strlen($printtype) > $GLOBALS['cfg']['LimitChars']) { - $displayed_type = ''; - $displayed_type .= $GLOBALS['PMA_String']->substr( - $printtype, 0, $GLOBALS['cfg']['LimitChars'] + $displayed_type = ''; + $displayed_type .= htmlspecialchars( + $GLOBALS['PMA_String']->substr( + $printtype, 0, $GLOBALS['cfg']['LimitChars'] + ) ); $displayed_type .= ''; } From 304fb2b645b36a39e03b954fdbd567173ebe6448 Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Wed, 1 Oct 2014 08:09:12 -0400 Subject: [PATCH 3/4] Bug 4544: additional fix for 4.2.x Signed-off-by: Marc Delisle --- libraries/TableSearch.class.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libraries/TableSearch.class.php b/libraries/TableSearch.class.php index a0b3fa4924..b7eb42f176 100644 --- a/libraries/TableSearch.class.php +++ b/libraries/TableSearch.class.php @@ -992,7 +992,8 @@ EOT; $html_output .= '' . $properties['collation'] . ''; $html_output .= '' . $properties['func'] . ''; // here, the data-type attribute is needed for a date/time picker - $html_output .= '' . $properties['value'] . ''; $html_output .= ''; //Displays hidden fields From 822ac52395442ac1472901e4a73b6f2cbcef39b7 Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Wed, 1 Oct 2014 08:11:20 -0400 Subject: [PATCH 4/4] 4.2.9.1 release Signed-off-by: Marc Delisle --- ChangeLog | 3 +++ README | 2 +- doc/conf.py | 2 +- libraries/Config.class.php | 2 +- 4 files changed, 6 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 18aa741c12..36db9485f1 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,9 @@ phpMyAdmin - ChangeLog ====================== +4.2.9.1 (2014-10-01) +- bug #4544 [security] XSS vulnerabilities in table search and table structure pages + 4.2.9.0 (2014-09-20) - bug ajax.js responseHandler: cannot read property of null - bug sql.js: str is undefined diff --git a/README b/README index 744ea627b2..ced219dd23 100644 --- a/README +++ b/README @@ -1,7 +1,7 @@ phpMyAdmin - Readme =================== -Version 4.2.9 +Version 4.2.9.1 A set of PHP-scripts to manage MySQL over the web. diff --git a/doc/conf.py b/doc/conf.py index 81cd260535..5898973507 100644 --- a/doc/conf.py +++ b/doc/conf.py @@ -51,7 +51,7 @@ copyright = u'2012 - 2014, The phpMyAdmin devel team' # built documents. # # The short X.Y version. -version = '4.2.9' +version = '4.2.9.1' # The full version, including alpha/beta/rc tags. release = version diff --git a/libraries/Config.class.php b/libraries/Config.class.php index 4b761c8bec..ad4b964433 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -114,7 +114,7 @@ class PMA_Config */ function checkSystem() { - $this->set('PMA_VERSION', '4.2.9'); + $this->set('PMA_VERSION', '4.2.9.1'); /** * @deprecated */