diff --git a/ChangeLog b/ChangeLog index fc6044931e..3bd6bd4834 100644 --- a/ChangeLog +++ b/ChangeLog @@ -49,10 +49,11 @@ VerboseMultiSubmit, ReplaceHelpImg - bug #3577443 [edit] "Browse foreign values" does not show on ajax edit + rfe #3522109 [browse] Grid editing: action to trigger it (or disable) - bug #3526598 [interface] SQL query not shown when creating table ++ Dropped configuration directive: AllowThirdPartyFraming 3.5.4.0 (not yet released) - bug #3570212 [edit] uuid_short() is a no-arguments function -- bug #3569577 [edit] Add routine parameter headers not valid for "function" +- bug #3569577 [edit] Add routine parameter headers not valid for "function" - bug #3575799 [search] Various search operators not working as expected - bug #3576322 [search] Invalid select query generated for tables with ENUM fields - bug #3577468 [display] Incorrect imagejpeg Syntax Breaks Image Transformation @@ -79,7 +80,7 @@ VerboseMultiSubmit, ReplaceHelpImg - bug #3559955 [edit] current_date from function drop down fails on update - bug #3562472 add support for Solaris and FreeBSD system load and memory display in server status - bug #3553068 [import] Table import from XML file fails -- replace Highcharts with jqplot for Display chart +- replace Highcharts with jqplot for Display chart - bug #3567684 [edit] Pasting value doesn't clear null checkbox - bug #3570786 [edit] Datepicker for date and datetime fields is broken diff --git a/Documentation.html b/Documentation.html index 29263d25cd..f593692d86 100644 --- a/Documentation.html +++ b/Documentation.html @@ -633,11 +633,6 @@ since this link provides funding for phpMyAdmin.
$cfg['TranslationWarningThreshold'] integer
Show warning about incomplete translations on certain threshold.
-
$cfg['AllowThirdPartyFraming'] boolean
-
Setting this to true allows a page located on a different - domain to call phpMyAdmin inside a frame, and is a potential security - hole allowing cross-frame scripting attacks.
-
$cfg['blowfish_secret'] string
The "cookie" auth_type uses blowfish algorithm to encrypt the password.
diff --git a/js/cross_framing_protection.js b/js/cross_framing_protection.js deleted file mode 100644 index fbe96fd9d0..0000000000 --- a/js/cross_framing_protection.js +++ /dev/null @@ -1,18 +0,0 @@ -/* vim: set expandtab sw=4 ts=4 sts=4: */ -/** - * Conditionally included if third-party framing is not allowed - * - */ - -try { - // can't access this if on a different domain - var topdomain = top.document.domain; - // double-check just for sure - if (topdomain != self.document.domain) { - alert("Redirecting..."); - top.location.replace(self.document.URL.substring(0, self.document.URL.lastIndexOf("/")+1)); - } -} catch(e) { - alert("Redirecting... (error: " + e); - top.location.replace(self.document.URL.substring(0, self.document.URL.lastIndexOf("/")+1)); -} diff --git a/libraries/Header.class.php b/libraries/Header.class.php index bffd3c8d4b..4f00f0ff2a 100644 --- a/libraries/Header.class.php +++ b/libraries/Header.class.php @@ -158,11 +158,6 @@ class PMA_Header $this->_scripts->addFile('codemirror/mode/mysql/mysql.js'); } - // Cross-framing protection - if ($GLOBALS['cfg']['AllowThirdPartyFraming'] === false) { - $this->_scripts->addFile('cross_framing_protection.js'); - } - $this->_scripts->addFile('rte.js'); // Localised strings @@ -373,15 +368,11 @@ class PMA_Header * Sends http headers */ $GLOBALS['now'] = gmdate('D, d M Y H:i:s') . ' GMT'; - /* Prevent against ClickJacking by allowing frames only from same origin */ - if (! $GLOBALS['cfg']['AllowThirdPartyFraming'] && ! defined('TESTSUITE')) { - header( - 'X-Frame-Options: SAMEORIGIN' - ); + if (! defined('TESTSUITE')) { header( "X-Content-Security-Policy: allow 'self' http://www.phpmyadmin.net; " . "options inline-script eval-script; " - . "frame-ancestors 'self'; img-src 'self' data:; " + . "img-src 'self' data:; " ); header( "X-WebKit-CSP: allow 'self' http://www.phpmyadmin.net; " diff --git a/libraries/Scripts.class.php b/libraries/Scripts.class.php index f8bdb84d2d..90b0413a94 100644 --- a/libraries/Scripts.class.php +++ b/libraries/Scripts.class.php @@ -127,7 +127,6 @@ class PMA_Scripts || strpos($filename, 'ajax.js') !== false || strpos($filename, 'navigation.js') !== false || strpos($filename, 'get_image.js.php') !== false - || strpos($filename, 'cross_framing_protection.js') !== false ) { return 0; } else { diff --git a/libraries/config.default.php b/libraries/config.default.php index 9d34eee86c..cc0e849789 100644 --- a/libraries/config.default.php +++ b/libraries/config.default.php @@ -76,14 +76,6 @@ $cfg['ServerLibraryDifference_DisableWarning'] = false; */ $cfg['TranslationWarningThreshold'] = 80; -/** - * Allows phpMyAdmin to be included from a document located on - * another domain; setting this to true is a potential security hole - * - * @global boolean $cfg['AllowThirdPartyFraming'] - */ -$cfg['AllowThirdPartyFraming'] = false; - /** * The 'cookie' auth_type uses blowfish algorithm to encrypt the password. If * at least one server configuration uses 'cookie' auth_type, enter here a diff --git a/libraries/config/messages.inc.php b/libraries/config/messages.inc.php index f2a9cfca58..6f10ed2771 100644 --- a/libraries/config/messages.inc.php +++ b/libraries/config/messages.inc.php @@ -18,8 +18,6 @@ $strConfigAjaxEnable_desc = __('Improves efficiency of screen refresh'); $strConfigAjaxEnable_name = __('Enable Ajax'); $strConfigAllowArbitraryServer_desc = __('If enabled user can enter any MySQL server in login form for cookie auth'); $strConfigAllowArbitraryServer_name = __('Allow login to any MySQL server'); -$strConfigAllowThirdPartyFraming_desc = __('Enabling this allows a page located on a different domain to call phpMyAdmin inside a frame, and is a potential [strong]security hole[/strong] allowing cross-frame scripting attacks'); -$strConfigAllowThirdPartyFraming_name = __('Allow third party framing'); $strConfigAllowUserDropDatabase_name = __('Show "Drop database" link to normal users'); $strConfigblowfish_secret_desc = __('Secret passphrase used for encrypting cookies in [kbd]cookie[/kbd] authentication'); $strConfigblowfish_secret_name = __('Blowfish secret'); diff --git a/libraries/config/setup.forms.php b/libraries/config/setup.forms.php index 70a99a64b4..929a186acb 100644 --- a/libraries/config/setup.forms.php +++ b/libraries/config/setup.forms.php @@ -137,8 +137,7 @@ $forms['Features']['Other_core_settings'] = array( 'MemoryLimit', 'SkipLockedTables', 'DisableMultiTableMaintenance', - 'UseDbSearch', - 'AllowThirdPartyFraming'); + 'UseDbSearch'); $forms['Sql_queries']['Sql_queries'] = array( 'ShowSQL', 'Confirm',