From 3a6a9a807d99371ee126635e1a505fc1fe0df32c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Thu, 25 Feb 2016 09:06:52 +0100 Subject: [PATCH 01/17] Escape query when displaying MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- libraries/sql-parser/src/Utils/Error.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libraries/sql-parser/src/Utils/Error.php b/libraries/sql-parser/src/Utils/Error.php index a9c0814fcf..f0ad5afbb2 100644 --- a/libraries/sql-parser/src/Utils/Error.php +++ b/libraries/sql-parser/src/Utils/Error.php @@ -90,7 +90,7 @@ class Error ++$i, $err[0], $err[1], - $err[2], + htmlspecialchars($err[2]), $err[3] ); } From 7877a9c0084bf8ae15cbd8d2729b126271f682cc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Thu, 25 Feb 2016 09:13:09 +0100 Subject: [PATCH 02/17] Escape SQL query for inline editing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- js/functions.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/js/functions.js b/js/functions.js index edf8f457eb..13b81468d6 100644 --- a/js/functions.js +++ b/js/functions.js @@ -1840,7 +1840,7 @@ AJAX.registerOnload('functions.js', function () { var $inner_sql = $(this).parent().prev().find('code.sql'); var old_text = $inner_sql.html(); - var new_content = "\n"; + var new_content = "\n"; new_content += getForeignKeyCheckboxLoader(); new_content += "\n"; new_content += "\n"; From 16a6a02fca663264de9b034f4acad9c92295586f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Thu, 25 Feb 2016 10:32:29 +0100 Subject: [PATCH 03/17] Avoid skipping the SSL certificate check in TCPDF MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This code is never used in phpMyAdmin, but we fix it just to avoid potential security reports. Signed-off-by: Michal Čihař --- libraries/tcpdf/include/tcpdf_static.php | 2 -- 1 file changed, 2 deletions(-) diff --git a/libraries/tcpdf/include/tcpdf_static.php b/libraries/tcpdf/include/tcpdf_static.php index 4ab18b6c4d..a1915d640b 100644 --- a/libraries/tcpdf/include/tcpdf_static.php +++ b/libraries/tcpdf/include/tcpdf_static.php @@ -2508,8 +2508,6 @@ class TCPDF_STATIC { } curl_setopt($cs, CURLOPT_CONNECTTIMEOUT, 5); curl_setopt($cs, CURLOPT_TIMEOUT, 30); - curl_setopt($cs, CURLOPT_SSL_VERIFYPEER, false); - curl_setopt($cs, CURLOPT_SSL_VERIFYHOST, false); curl_setopt($cs, CURLOPT_USERAGENT, 'TCPDF'); $ret = curl_exec($cs); curl_close($cs); From e42b7e3aedd29dd0f7a48575f20bfc5aca0ff976 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Thu, 25 Feb 2016 10:41:03 +0100 Subject: [PATCH 04/17] Bring back SSL certificate validation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- libraries/Config.class.php | 4 ++-- test/classes/PMA_Config_test.php | 12 +++++++++--- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/libraries/Config.class.php b/libraries/Config.class.php index 5819673249..f254091dde 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -774,8 +774,8 @@ class PMA_Config PMA_Util::configureCurl($handle); curl_setopt($handle, CURLOPT_FOLLOWLOCATION, 0); curl_setopt($handle, CURLOPT_RETURNTRANSFER, 1); - curl_setopt($handle, CURLOPT_SSL_VERIFYHOST, 0); - curl_setopt($handle, CURLOPT_SSL_VERIFYPEER, 0); + curl_setopt($handle, CURLOPT_SSL_VERIFYHOST, '2'); + curl_setopt($handle, CURLOPT_SSL_VERIFYPEER, '1'); curl_setopt($handle, CURLOPT_CONNECTTIMEOUT, 5); curl_setopt($handle, CURLOPT_TIMEOUT, 5); curl_setopt($handle, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V4); diff --git a/test/classes/PMA_Config_test.php b/test/classes/PMA_Config_test.php index 42df76193a..773ee78409 100644 --- a/test/classes/PMA_Config_test.php +++ b/test/classes/PMA_Config_test.php @@ -53,6 +53,7 @@ class PMA_ConfigTest extends PHPUnit_Framework_TestCase $GLOBALS['server'] = 0; $_SESSION['is_git_revision'] = true; $GLOBALS['PMA_Config'] = new PMA_Config(CONFIG_FILE); + $GLOBALS['cfg']['ProxyUrl'] = ''; //for testing file permissions $this->permTestObj = new PMA_Config("./config.sample.inc.php"); @@ -1038,14 +1039,19 @@ class PMA_ConfigTest extends PHPUnit_Framework_TestCase $this->markTestSkipped('Missing curl extension!'); } $this->assertTrue( - $this->object->checkHTTP("http://www.phpmyadmin.net/test/data") + $this->object->checkHTTP("https://www.phpmyadmin.net/test/data") ); $this->assertContains( "TEST DATA", - $this->object->checkHTTP("http://www.phpmyadmin.net/test/data", true) + $this->object->checkHTTP("https://www.phpmyadmin.net/test/data", true) ); $this->assertFalse( - $this->object->checkHTTP("http://www.phpmyadmin.net/test/nothing") + $this->object->checkHTTP("https://www.phpmyadmin.net/test/nothing") + ); + // Use rate limit API as it's not subject to rate limiting + $this->assertContains( + '"resources"', + $this->object->checkHTTP("https://api.github.com/rate_limit", true) ); } From 983faa94f161df3623ecd371d3696a1b3f91c15f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Thu, 25 Feb 2016 11:30:14 +0100 Subject: [PATCH 05/17] Fix XSS in database structure page MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Forward ported commit 90df124797175688a63be0d0a311210e92f09895 Signed-off-by: Michal Čihař --- .../database/structure/sortable_header.phtml | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/templates/database/structure/sortable_header.phtml b/templates/database/structure/sortable_header.phtml index d3cec6fd63..044647158d 100644 --- a/templates/database/structure/sortable_header.phtml +++ b/templates/database/structure/sortable_header.phtml @@ -51,16 +51,20 @@ if ($requested_sort == $sort) { } $_url_params = array( 'db' => $_REQUEST['db'], + 'pos' => 0, // We set the position back to 0 every time they sort. + 'sort' => $sort, + 'sort_order' => $future_sort_order, ); -$url = 'db_structure.php' . PMA_URL_getCommon($_url_params); -// We set the position back to 0 every time they sort. -$url .= "&pos=0&sort=$sort&sort_order=$future_sort_order"; -if (! empty($_REQUEST['tbl_type'])) { - $url .= "&tbl_type=" . $_REQUEST['tbl_type']; + +if (PMA_isValid($_REQUEST['tbl_type'], array('view', 'table'))) { + $_url_params['tbl_type'] = $_REQUEST['tbl_type']; } if (! empty($_REQUEST['tbl_group'])) { - $url .= "&tbl_group=" . $_REQUEST['tbl_group']; + $_url_params['tbl_group'] = $_REQUEST['tbl_group']; } + +$url = 'db_structure.php' . PMA_URL_getCommon($_url_params); + echo PMA_Util::linkOrButton( $url, $title . $order_img, $order_link_params -); \ No newline at end of file +); From 38fa1191049ac0c626a6684eea52068dfbbb5078 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Thu, 25 Feb 2016 09:57:29 +0100 Subject: [PATCH 06/17] Urlencode hostname MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This can come from the HTTP header, so we need to be sure to sanitize it. Signed-off-by: Michal Čihař --- libraries/Config.class.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libraries/Config.class.php b/libraries/Config.class.php index 5819673249..4a134042e8 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -1370,7 +1370,7 @@ class PMA_Config $pma_absolute_uri .= '@'; } // Add hostname - $pma_absolute_uri .= $url['host']; + $pma_absolute_uri .= urlencode($url['host']); // Add port, if it not the default one // (or 80 for https which is most likely a bug) if (! empty($url['port']) From 746240bd13b62b5956fc34389cfbdc09e1e67775 Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Thu, 25 Feb 2016 20:08:38 +1100 Subject: [PATCH 07/17] Fix XSS in normalization Signed-off-by: Madhura Jayaratne --- normalization.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/normalization.php b/normalization.php index 4cb9569181..069dabbc0f 100644 --- a/normalization.php +++ b/normalization.php @@ -72,7 +72,7 @@ $scripts = $header->getScripts(); $scripts->addFile('normalization.js'); $scripts->addFile('jquery/jquery.uitablefilter.js'); $normalForm = '1nf'; -if (isset($_REQUEST['normalizeTo'])) { +if (PMA_isValid($_REQUEST['normalizeTo'], array('1nf', '2nf', '3nf'))) { $normalForm = $_REQUEST['normalizeTo']; } if (isset($_REQUEST['createNewTables2NF'])) { From c842a0de9288033d25404d1d6eb22dd83033675f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Thu, 25 Feb 2016 10:23:23 +0100 Subject: [PATCH 08/17] Use correct headers for json data MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It was previously not marked as such what could potentially lead to browsers doing some autodetection. Signed-off-by: Michal Čihař --- file_echo.php | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/file_echo.php b/file_echo.php index 1f27bb019b..0bc976d44b 100644 --- a/file_echo.php +++ b/file_echo.php @@ -67,12 +67,16 @@ if (isset($_REQUEST['filename']) && isset($_REQUEST['image'])) { } else if (isset($_REQUEST['monitorconfig'])) { /* For monitor chart config export */ - PMA_downloadHeader('monitor.cfg', 'application/force-download'); + PMA_downloadHeader('monitor.cfg', 'application/json; charset=UTF-8'); + header('X-Content-Type-Options: nosniff'); + echo urldecode($_REQUEST['monitorconfig']); } else if (isset($_REQUEST['import'])) { /* For monitor chart config import */ - header('Content-type: text/plain'); + header('Content-Type: application/json; charset=UTF-8'); + header('X-Content-Type-Options: nosniff'); + if (!file_exists($_FILES['file']['tmp_name'])) { exit(); } From f33a42f1da9db943a67bda7d29f7dd91957a8e7e Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Thu, 25 Feb 2016 21:38:32 +1100 Subject: [PATCH 09/17] Fix XSS in normalization.js Signed-off-by: Madhura Jayaratne --- js/functions.js | 18 ++++++++++++++++++ js/normalization.js | 2 +- 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/js/functions.js b/js/functions.js index 13b81468d6..b6a46a39c2 100644 --- a/js/functions.js +++ b/js/functions.js @@ -243,6 +243,24 @@ function escapeHtml(unsafe) { } } +function escapeJsString(unsafe) { + if (typeof(unsafe) != 'undefined') { + return unsafe + .toString() + .replace("\000", '') + .replace('\\', '\\\\') + .replace('\'', '\\\'') + .replace("'", "\\\'") + .replace('"', '\"') + .replace(""", "\"") + .replace("\n", '\n') + .replace("\r", '\r') + .replace(/<\/script/gi, ''; $("#newCols").html(confirmStr); $('.tblFooters').html('' + - ''); + ''); } }); $("#mainContent p").on("click", "#createPrimaryKey", function(event) { From 37c34d089aa19f30d11203bb0c7f85b486424372 Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Thu, 25 Feb 2016 21:51:27 +1100 Subject: [PATCH 10/17] Escape selectors Signed-off-by: Madhura Jayaratne --- js/normalization.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/js/normalization.js b/js/normalization.js index 50ad3ed39f..606ab89913 100644 --- a/js/normalization.js +++ b/js/normalization.js @@ -128,7 +128,7 @@ function goToStep4() $("#mainContent #newCols").html(''); $('.tblFooters').html(''); for(var pk in primary_key) { - $("#extra input[value='" + primary_key[pk] + "']").attr("disabled","disabled"); + $("#extra input[value='" + escapeJsString(primary_key[pk]) + "']").attr("disabled","disabled"); } } ); @@ -153,7 +153,7 @@ function goToStep3() $('.tblFooters').html(''); primary_key = $.parseJSON(data.primary_key); for(var pk in primary_key) { - $("#extra input[value='" + primary_key[pk] + "']").attr("disabled","disabled"); + $("#extra input[value='" + escapeJsString(primary_key[pk]) + "']").attr("disabled","disabled"); } } ); From 9bce7dafaf746559c617f674e27b9c0f75ae97a2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Thu, 25 Feb 2016 13:34:02 +0100 Subject: [PATCH 11/17] Add changes for security issues MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- ChangeLog | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ChangeLog b/ChangeLog index 505b62b2c3..39d157f6ce 100644 --- a/ChangeLog +++ b/ChangeLog @@ -7,6 +7,10 @@ phpMyAdmin - ChangeLog - issue #12012 Column definition with default value and comment in CREATE TABLE expoerted faulty. - issue #12020 New statement but no delimiter and unexpected token with REPLACE. - issue #12029 Fixed incorrect usage of SQL parser context in SQL export +- issue [security] XSS vulnerability in SQL parser, see PMASA-2016-10. +- issue [security] Multiple XSS vulnerabilities, see PMASA-2016-11. +- issue [security] Multiple XSS vulnerabilities, see PMASA-2016-12. +- issue [security] Vulnerability allowing man-in-the-middle attack on API call to GitHub, see PMASA-2016-13. 4.5.5.0 (2016-02-22) - issue Undefined index: is_ajax_request From bcd4ce8cba1272fca52f2331c08f2e3ac19cbbef Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Sat, 27 Feb 2016 09:56:12 +1100 Subject: [PATCH 12/17] Fix XSS in normalization.js Signed-off-by: Madhura Jayaratne --- js/normalization.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/js/normalization.js b/js/normalization.js index 606ab89913..5e2b8802f6 100644 --- a/js/normalization.js +++ b/js/normalization.js @@ -82,7 +82,7 @@ function goTo2NFStep1() { $("#mainContent #extra").html(data.extra); $("#mainContent #newCols").html(''); if (data.subText !== '') { - $('.tblFooters').html(''); + $('.tblFooters').html(''); } else { if (normalizeto === '3nf') { $("#mainContent #newCols").html(PMA_messages.strToNextStep); From ab1283e8366c97a155d4e9ae58628a248458ea32 Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Mon, 29 Feb 2016 11:08:38 +1100 Subject: [PATCH 13/17] Fix XSS in User accounts page Signed-off-by: Madhura Jayaratne --- libraries/server_privileges.lib.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libraries/server_privileges.lib.php b/libraries/server_privileges.lib.php index 9ad749a177..a60c999875 100644 --- a/libraries/server_privileges.lib.php +++ b/libraries/server_privileges.lib.php @@ -3499,7 +3499,7 @@ function PMA_getUsersOverview($result, $db_rights, $pmaThemeImage, $text_dir) __('Export'), 'b_tblexport.png', 'export' ); $html_output .= ''; + . 'value="' . (isset($_GET['initial']) ? htmlspecialchars($_GET['initial']) : '') . '" />'; $html_output .= '' . '
'; From cc55f44a4a90147a007dee1aefa1cb529e23798b Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Mon, 29 Feb 2016 11:12:07 +1100 Subject: [PATCH 14/17] Fix XSS in Central columns page Signed-off-by: Madhura Jayaratne --- db_central_columns.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/db_central_columns.php b/db_central_columns.php index 2e9aac73bb..4c78eba255 100644 --- a/db_central_columns.php +++ b/db_central_columns.php @@ -92,7 +92,7 @@ if (isset($_REQUEST['total_rows']) && $_REQUEST['total_rows']) { } else { $total_rows = PMA_getCentralColumnsCount($db); } -if (isset($_REQUEST['pos'])) { +if (PMA_isValid($_REQUEST['pos'], 'integer')) { $pos = $_REQUEST['pos']; } else { $pos = 0; From 4650ad7fbde189678d180b8f294af3591f50b829 Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Mon, 29 Feb 2016 12:14:46 +1100 Subject: [PATCH 15/17] A better way of escaping Signed-off-by: Madhura Jayaratne --- templates/table/search/input_box.phtml | 12 ++++++------ templates/table/search/rows_zoom.phtml | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/templates/table/search/input_box.phtml b/templates/table/search/input_box.phtml index e9e09b9914..e5bcba1d2c 100644 --- a/templates/table/search/input_box.phtml +++ b/templates/table/search/input_box.phtml @@ -20,7 +20,7 @@ if ($_foreigners - value="" + value="" /> " + - @@ -129,7 +129,7 @@ if ($_foreigners - value="" + value="" /> \ No newline at end of file diff --git a/templates/table/search/rows_zoom.phtml b/templates/table/search/rows_zoom.phtml index 1964eefbd0..fb9d83dfb7 100644 --- a/templates/table/search/rows_zoom.phtml +++ b/templates/table/search/rows_zoom.phtml @@ -68,7 +68,7 @@ for ($i = 0; $i < 4; $i++): ?> - + From 41c4e0214c286f28830cca54423b5db57e7c0ce4 Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Mon, 29 Feb 2016 12:26:44 +1100 Subject: [PATCH 16/17] Fix XSS in zoom search Signed-off-by: Madhura Jayaratne --- libraries/controllers/TableSearchController.class.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libraries/controllers/TableSearchController.class.php b/libraries/controllers/TableSearchController.class.php index 12de6d2367..ddd6d56c4b 100644 --- a/libraries/controllers/TableSearchController.class.php +++ b/libraries/controllers/TableSearchController.class.php @@ -471,7 +471,11 @@ class TableSearchController extends TableController return; } $key = array_search($field, $this->_columnNames); - $properties = $this->getColumnProperties($_REQUEST['it'], $key); + $search_index = 0; + if (PMA_isValid($_REQUEST['it'], 'integer')) { + $search_index = $_REQUEST['it']; + } + $properties = $this->getColumnProperties($search_index, $key); $this->response->addJSON( 'field_type', htmlspecialchars($properties['type']) ); From 73fd0dc2a8f5471c717a887aae22bde97bc5498f Mon Sep 17 00:00:00 2001 From: Isaac Bennetch Date: Mon, 29 Feb 2016 08:56:32 -0500 Subject: [PATCH 17/17] 4.6.0-rc1 pre-release Signed-off-by: Isaac Bennetch --- README | 2 +- doc/conf.py | 2 +- libraries/Config.php | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/README b/README index fbae5a8947..610f452ea4 100644 --- a/README +++ b/README @@ -1,7 +1,7 @@ phpMyAdmin - Readme =================== -Version 4.6.0-alpha1 +Version 4.6.0-rc1 A web interface for MySQL and MariaDB. diff --git a/doc/conf.py b/doc/conf.py index c65f080ec6..34d89d8162 100644 --- a/doc/conf.py +++ b/doc/conf.py @@ -51,7 +51,7 @@ copyright = u'2012 - 2014, The phpMyAdmin devel team' # built documents. # # The short X.Y version. -version = '4.6.0-alpha1' +version = '4.6.0-rc1' # The full version, including alpha/beta/rc tags. release = version diff --git a/libraries/Config.php b/libraries/Config.php index 1a5f9d4bb2..3e04962d92 100644 --- a/libraries/Config.php +++ b/libraries/Config.php @@ -101,7 +101,7 @@ class Config */ public function checkSystem() { - $this->set('PMA_VERSION', '4.6.0-alpha1'); + $this->set('PMA_VERSION', '4.6.0-rc1'); /** * @deprecated */