Merge branch 'master' into master-security

ChangeLog

@@ -31,6 +31,7 @@ phpMyAdmin - ChangeLog
 - issue #12302 Improved usage of number_format
 - issue #12656 Server selection not working
 - issue #12543 NULL results in dataset are colored grey
+- issue #12664 Create Bookmark broken
 
 4.6.5 (not yet released)
 - issue        Remove potentionally license problematic sRGB profile
@@ -106,6 +107,13 @@ phpMyAdmin - ChangeLog
 - issue #12637 Fixed editing some timestamp values
 - issue #12622 Fixed javascript error in designer
 - issue #12334 Missing page indicator or VIEWs
+- issue #12610 Export of tables with Timestamp/Datetime/Time columns defined with ON UPDATE clause with precision fails
+- issue #12661 Error inserting into pma__history after timeout
+- issue #12195 Row_format = fixed not visible
+- issue #12665 Cannot add a foreign key - non-indexed fields not listed in InnoDB tables
+- issue #12674 Allow for proper MySQL-allowed strings as identifiers
+- issue #12651 Allow for partial dates on table insert page
+- issue #12681 Fixed designer with tables using special chars
 
 4.6.4 (2016-08-16)
 - issue        [security] Weaknesses with cookie encryption, see PMASA-2016-29

doc/faq.rst

@@ -1465,6 +1465,9 @@ re–written, if possible it is suggested that you upgrade to take
 advantage of the new features.  For additional help on this subject,
 look for the word "upload" in this document.
 
+Note: For errors while importing of dumps exported from older MySQL versions to newer MySQL versions,
+please check :ref:`faq6_41`.
+
 .. _faq6_6:
 
 6.6 How can I use the relation table in Query-by-example?
@@ -2130,6 +2133,31 @@ Parameters should be prefixed with a colon(:) and when the "Bind parameters" che
 these parameters will be identified and input fields for these parameters will be presented.
 Values entered in these field will be substituted in the query before being executed.
 
+.. _faq6_41:
+
+6.41 I get import errors while importing the dumps exported from older MySQL versions (pre-5.7.6) into newer MySQL versions (5.7.7+), but they work fine when imported back on same older versions ?
+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
+
+If you get errors like *#1031 - Table storage engine for 'table_name' doesn't have this option*
+while importing the dumps exported from pre-5.7.7 MySQL servers into new MySQL server versions 5.7.7+,
+it might be because ROW_FORMAT=FIXED is not supported with InnoDB tables. Moreover, the value of
+`innodb_strict_mode <http://dev.mysql.com/doc/refman/5.7/en/innodb-parameters.html#sysvar_innodb_strict_mode>`_ would define if this would be reported as a warning or as an error.
+
+Since MySQL version 5.7.9, the default value for `innodb_strict_mode` is `ON` and thus would generate
+an error when such a CREATE TABLE or ALTER TABLE statement is encountered.
+
+There are two ways of preventing such errors while importing:
+
+* Change the value of `innodb_strict_mode` to `OFF` before starting the import and turn it `ON` after
+  the import is successfully completed.
+* This can be achieved in two ways:
+
+  * Go to 'Variables' page and edit the value of `innodb_strict_mode`
+  * Run the query : `SET GLOBAL `innodb_strict_mode` = '[value]'`
+
+After the import is done, it is suggested that the value of `innodb_strict_mode` should be reset to the
+original value.
+
 .. _faqproject:
 
 phpMyAdmin project

import.php

@@ -738,7 +738,7 @@ if ($go_sql) {
     // since only one bookmark has to be added for all the queries submitted through
     // the SQL tab
     if (! empty($_POST['bkm_label']) && ! empty($import_text)) {
-        $cfgBookmark = PMA_Bookmark_getParams();
+        $cfgBookmark = Bookmark::getParams();
         PMA_storeTheQueryAsBookmark(
             $db, $cfgBookmark['user'],
             $_REQUEST['sql_query'], $_POST['bkm_label'],

index.php

@@ -10,6 +10,7 @@ use PMA\libraries\URL;
 use PMA\libraries\Sanitize;
 use PMA\libraries\Charsets;
 use PMA\libraries\ThemeManager;
+use PMA\libraries\LanguageManager;
 
 /**
  * Gets some core libraries and displays a top message if required
@@ -236,9 +237,9 @@ echo '  <ul>';
 // Displays language selection combo
 if (empty($cfg['Lang'])) {
     echo '<li id="li_select_lang" class="no_bullets">';
-    include_once 'libraries/display_select_lang.lib.php';
+
     echo PMA\libraries\Util::getImage('s_lang.png') , " "
-        , PMA_getLanguageSelectorHtml();
+        , LanguageManager::getInstance()->getSelectorDisplay();
     echo '</li>';
 }
 

js/functions.js

@@ -188,9 +188,12 @@ function addDateTimePicker() {
                 timeFormat: timeFormat
             });
 
-            // Add a tip regarding entering MySQL allowed-values for TIME data-type
+            // Add a tip regarding entering MySQL allowed-values
+            // for TIME and DATE data-type
             if ($(this).hasClass('timefield')) {
-                PMA_tooltip($(this), 'input', PMA_messages.strMysqlAllowedValuesTip);
+                PMA_tooltip($(this), 'input', PMA_messages.strMysqlAllowedValuesTipTime);
+            } else if ($(this).hasClass('datefield')) {
+                PMA_tooltip($(this), 'input', PMA_messages.strMysqlAllowedValuesTipDate);
             }
         });
     }
@@ -4961,6 +4964,30 @@ function PMA_ignorePhpErrors(clearPrevErrors){
     $pmaErrors.remove();
 }
 
+/**
+ * Toggle the Datetimepicker UI if the date value entered
+ * by the user in the 'text box' is not going to be accepted
+ * by the Datetimepicker plugin (but is accepted by MySQL)
+ */
+function toggleDatepickerIfInvalid($td, $input_field) {
+    // Regex allowed by the Datetimepicker UI
+    var dtexpDate = new RegExp(['^([0-9]{4})',
+        '-(((01|03|05|07|08|10|12)-((0[1-9])|([1-2][0-9])|(3[0-1])))|((02|04|06|09|11)',
+        '-((0[1-9])|([1-2][0-9])|30)))$'].join(''));
+    var dtexpTime = new RegExp(['^(([0-1][0-9])|(2[0-3]))',
+        ':((0[0-9])|([1-5][0-9]))',
+        ':((0[0-9])|([1-5][0-9]))(\.[0-9]{1,6}){0,1}$'].join(''));
+
+    // If key-ed in Time or Date values are unsupported by the UI, close it
+    if ($td.attr('data-type') === 'date' && ! dtexpDate.test($input_field.val())) {
+        $input_field.datepicker('hide');
+    } else if ($td.attr('data-type') === 'time' && ! dtexpTime.test($input_field.val())) {
+        $input_field.datepicker('hide');
+    } else {
+        $input_field.datepicker('show');
+    }
+}
+
 /**
  * Unbind all event handlers before tearing down a page
  */

js/makegrid.js

@@ -1051,7 +1051,21 @@ function PMA_makegrid(t, enableResize, enableReorder, enableVisib, enableGridEdi
                         timeFormat: timeFormat
                     });
 
+                    $input_field.on('keyup', function (e) {
+                        if (e.which == 13) {
+                            // post on pressing "Enter"
+                            e.preventDefault();
+                            e.stopPropagation();
+                            g.saveOrPostEditedCell();
+                        } else if (e.which == 27) {
+                        } else {
+                            toggleDatepickerIfInvalid($td, $input_field);
+                        }
+                    });
+
                     $input_field.datepicker("show");
+                    toggleDatepickerIfInvalid($td, $input_field);
+
                     // unbind the mousedown event to prevent the problem of
                     // datepicker getting closed, needs to be checked for any
                     // change in names when updating

js/messages.php

@@ -523,11 +523,17 @@ $js_messages['strCopyEncryptionKey'] = __('Do you want to copy encryption key?')
 $js_messages['strEncryptionKey'] = __('Encryption key');
 
 /* For Tip to be shown on Time field */
-$js_messages['strMysqlAllowedValuesTip'] = __(
+$js_messages['strMysqlAllowedValuesTipTime'] = __(
     'MySQL accepts additional values not selectable by the slider;'
     . ' key in those values directly if desired'
 );
 
+/* For Tip to be shown on Date field */
+$js_messages['strMysqlAllowedValuesTipDate'] = __(
+    'MySQL accepts additional values not selectable by the datepicker;'
+    . ' key in those values directly if desired'
+);
+
 /* For Lock symbol Tooltip */
 $js_messages['strLockToolTip'] = __(
     'Indicates that you have made changes to this page;'

js/tbl_change.js

@@ -100,7 +100,7 @@ function isDate(val, tmstmp)
     }
     val = arrayVal.join("-");
     var pos = 2;
-    var dtexp = new RegExp(/^([0-9]{4})-(((01|03|05|07|08|10|12)-((0[1-9])|([1-2][0-9])|(3[0-1])))|((02|04|06|09|11)-((0[1-9])|([1-2][0-9])|30)))$/);
+    var dtexp = new RegExp(/^([0-9]{4})-(((01|03|05|07|08|10|12)-((0[0-9])|([1-2][0-9])|(3[0-1])))|((02|04|06|09|11)-((0[0-9])|([1-2][0-9])|30))|((00)-(00)))$/);
     if (val.length == 8) {
         pos = 0;
     }

libraries/Footer.php

@@ -237,6 +237,10 @@ class Footer
         if (! PMA_isValid($_REQUEST['no_history'])
             && empty($GLOBALS['error_message'])
             && ! empty($GLOBALS['sql_query'])
+            && (isset($GLOBALS['dbi'])
+            && ($GLOBALS['dbi']->getLink()
+            || isset($GLOBALS['controllink'])
+            && $GLOBALS['controllink']))
         ) {
             PMA_setHistory(
                 PMA_ifSetOr($GLOBALS['db'], ''),

libraries/LanguageManager.php

@@ -8,6 +8,7 @@
 namespace PMA\libraries;
 
 use PMA\libraries\Language;
+use PMA\libraries\URL;
 
 /**
  * Language selection manager
@@ -890,4 +891,43 @@ class LanguageManager
             );
         }
     }
+
+
+    /**
+     * Returns HTML code for the language selector
+     *
+     * @param boolean $use_fieldset whether to use fieldset for selection
+     * @param boolean $show_doc     whether to show documentation links
+     *
+     * @return string
+     *
+     * @access  public
+     */
+    public function getSelectorDisplay($use_fieldset = false, $show_doc = true)
+    {
+        $_form_params = array(
+            'db' => $GLOBALS['db'],
+            'table' => $GLOBALS['table'],
+        );
+
+        // For non-English, display "Language" with emphasis because it's
+        // not a proper word in the current language; we show it to help
+        // people recognize the dialog
+        $language_title = __('Language')
+            . (__('Language') != 'Language' ? ' - <em>Language</em>' : '');
+        if ($show_doc) {
+            $language_title .= Util::showDocu('faq', 'faq7-2');
+        }
+
+        $available_languages = $this->sortedLanguages();
+
+        return Template::get('select_lang')->render(
+            array(
+                'language_title' => $language_title,
+                'use_fieldset' => $use_fieldset,
+                'available_languages' => $available_languages,
+                '_form_params' => $_form_params,
+            )
+        );
+    }
 }

libraries/Table.php

@@ -1213,22 +1213,28 @@ class Table
             // trailing spaces not allowed even in backquotes
             return false;
         }
-        if (! $is_backquoted && $table_name !== trim($table_name)) {
-            // spaces at the start or in between
-            return false;
-        }
 
         if (strlen($table_name) === 0) {
             // zero length
             return false;
         }
 
-        if (preg_match('/[.\/\\\\]+/i', $table_name)) {
-            // illegal char . / \
+        if (! $is_backquoted && $table_name !== trim($table_name)) {
+            // spaces at the start or in between only allowed inside backquotes
             return false;
         }
 
-        return true;
+        if (! $is_backquoted && preg_match('/^[a-zA-Z0-9_$]+$/', $table_name)) {
+            // only allow the above regex in unquoted identifiers
+            // see : http://dev.mysql.com/doc/refman/5.7/en/identifiers.html
+            return true;
+        } else if ($is_backquoted) {
+            // If backquoted, all characters should be allowed (except w/ trailing spaces)
+            return true;
+        }
+
+        // If not backquoted and doesn't follow the above regex
+        return false;
     }
 
     /**

libraries/cleanup.lib.php

@@ -1,7 +0,0 @@
-<?php
-/* vim: set expandtab sw=4 ts=4 sts=4: */
-/**
- * Functions for cleanup of user input.
- *
- * @package PhpMyAdmin
- */

libraries/display_select_lang.lib.php

@@ -1,78 +0,0 @@
-<?php
-/* vim: set expandtab sw=4 ts=4 sts=4: */
-/**
- * Code for displaying language selection
- *
- * @package PhpMyAdmin
- */
-use PMA\libraries\LanguageManager;
-use PMA\libraries\URL;
-
-/**
- * Returns HTML code for the language selector
- *
- * @param boolean $use_fieldset whether to use fieldset for selection
- * @param boolean $show_doc     whether to show documentation links
- *
- * @return string
- *
- * @access  public
- */
-function PMA_getLanguageSelectorHtml($use_fieldset = false, $show_doc = true)
-{
-    $retval = '';
-    $available_languages = LanguageManager::getInstance()->sortedLanguages();
-
-    // Display language selection only if there
-    // is more than one language to choose from
-    if (count($available_languages) > 1) {
-        $retval .= '<form method="get" action="index.php" class="disableAjax">';
-
-        $_form_params = array(
-            'db' => $GLOBALS['db'],
-            'table' => $GLOBALS['table'],
-        );
-        $retval .= URL::getHiddenInputs($_form_params);
-
-        // For non-English, display "Language" with emphasis because it's
-        // not a proper word in the current language; we show it to help
-        // people recognize the dialog
-        $language_title = __('Language')
-            . (__('Language') != 'Language' ? ' - <em>Language</em>' : '');
-        if ($show_doc) {
-            $language_title .= PMA\libraries\Util::showDocu('faq', 'faq7-2');
-        }
-        if ($use_fieldset) {
-            $retval .= '<fieldset><legend lang="en" dir="ltr">'
-                . $language_title . '</legend>';
-        } else {
-            $retval .= '<bdo lang="en" dir="ltr"><label for="sel-lang">'
-                . $language_title . ': </label></bdo>';
-        }
-
-        $retval .= '<select name="lang" class="autosubmit" lang="en"'
-            . ' dir="ltr" id="sel-lang">';
-
-        foreach ($available_languages as $language) {
-            //Is current one active?
-            if ($language->isActive()) {
-                $selected = ' selected="selected"';
-            } else {
-                $selected = '';
-            }
-            $retval .= '<option value="' . strtolower($language->getCode()) . '"' . $selected . '>';
-            $retval .= $language->getName();
-            $retval .= '</option>';
-        }
-
-        $retval .= '</select>';
-
-        if ($use_fieldset) {
-            $retval .= '</fieldset>';
-        }
-
-        $retval .= '</form>';
-    }
-    return $retval;
-}
-

libraries/plugins/auth/AuthenticationCookie.php

@@ -9,6 +9,7 @@
 namespace PMA\libraries\plugins\auth;
 
 use phpseclib\Crypt;
+use PMA\libraries\LanguageManager;
 use PMA\libraries\Message;
 use PMA\libraries\plugins\AuthenticationPlugin;
 use PMA\libraries\Response;
@@ -132,9 +133,8 @@ class AuthenticationCookie extends AuthenticationPlugin
         echo "<div class='hide js-show'>";
         // Displays the languages form
         if (empty($GLOBALS['cfg']['Lang'])) {
-            include_once './libraries/display_select_lang.lib.php';
             // use fieldset, don't show doc link
-            echo PMA_getLanguageSelectorHtml(true, false);
+            echo LanguageManager::getInstance()->getSelectorDisplay(true, false);
         }
         echo '</div>
     <br />

libraries/pmd_common.php

@@ -42,10 +42,10 @@ function PMA_getTablesInfo()
         $GLOBALS['PMD']['TABLE_NAME_SMALL'][$i] = $one_table['TABLE_NAME'];
 
         $GLOBALS['PMD_URL']['TABLE_NAME'][$i]
-            = urlencode($GLOBALS['db'] . "." . $one_table['TABLE_NAME']);
-        $GLOBALS['PMD_URL']['OWNER'][$i] = urlencode($GLOBALS['db']);
+            = $GLOBALS['db'] . "." . $one_table['TABLE_NAME'];
+        $GLOBALS['PMD_URL']['OWNER'][$i] = $GLOBALS['db'];
         $GLOBALS['PMD_URL']['TABLE_NAME_SMALL'][$i]
-            = urlencode($one_table['TABLE_NAME']);
+            = $one_table['TABLE_NAME'];
 
         $GLOBALS['PMD_OUT']['TABLE_NAME'][$i] = htmlspecialchars(
             $GLOBALS['db'] . "." . $one_table['TABLE_NAME'], ENT_QUOTES
@@ -63,7 +63,7 @@ function PMA_getTablesInfo()
 
         $DF = PMA_getDisplayField($GLOBALS['db'], $one_table['TABLE_NAME']);
         if ($DF != '') {
-            $retval[$GLOBALS['PMD_URL']["TABLE_NAME_SMALL"][$i]] = urlencode($DF);
+            $retval[$GLOBALS['PMD_URL']["TABLE_NAME_SMALL"][$i]] = $DF;
         }
 
         $i++;
@@ -123,8 +123,7 @@ function PMA_getScriptContr()
     );
     while ($val = @$GLOBALS['dbi']->fetchRow($alltab_rs)) {
         $row = PMA_getForeigners($GLOBALS['db'], $val[0], '', 'internal');
-        //echo "<br> internal ".$GLOBALS['db']." - ".$val[0]." - ";
-        //print_r($row);
+
         if ($row !== false) {
             foreach ($row as $field => $value) {
                 $con['C_NAME'][$i] = '';
@@ -138,8 +137,7 @@ function PMA_getScriptContr()
             }
         }
         $row = PMA_getForeigners($GLOBALS['db'], $val[0], '', 'foreign');
-        //echo "<br> INNO ";
-        //print_r($row);
+
         if ($row !== false) {
             foreach ($row['foreign_keys_data'] as $one_key) {
                 foreach ($one_key['index_list'] as $index => $one_field) {