From 4612247ac1c42233119d83fe3a66735cff16f212 Mon Sep 17 00:00:00 2001 From: Nathan Wu Date: Fri, 10 Aug 2012 09:39:38 +0200 Subject: [PATCH 1/7] Translated using Weblate. --- po/zh_TW.po | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/po/zh_TW.po b/po/zh_TW.po index 7d974a319a..274c5d451c 100644 --- a/po/zh_TW.po +++ b/po/zh_TW.po @@ -4,15 +4,16 @@ msgstr "" "Project-Id-Version: phpMyAdmin 3.5.2-dev\n" "Report-Msgid-Bugs-To: phpmyadmin-devel@lists.sourceforge.net\n" "POT-Creation-Date: 2012-06-04 13:42+0200\n" -"PO-Revision-Date: 2012-05-23 10:16+0200\n" -"Last-Translator: MoA Chung \n" -"Language-Team: chinese_traditional \n" +"PO-Revision-Date: 2012-08-10 09:38+0200\n" +"Last-Translator: Nathan Wu \n" +"Language-Team: Chinese (Taiwan) " +"\n" "Language: zh_TW\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" "Plural-Forms: nplurals=1; plural=0;\n" -"X-Generator: Weblate 1.0\n" +"X-Generator: Weblate 1.2\n" #: browse_foreigners.php:35 browse_foreigners.php:53 js/messages.php:353 #: libraries/display_tbl.lib.php:359 server_privileges.php:1677 @@ -246,7 +247,7 @@ msgstr "查看資料庫的轉存(大綱)" #: db_export.php:30 db_printview.php:94 db_qbe.php:101 db_tracking.php:48 #: export.php:354 navigation.php:296 msgid "No tables found in database." -msgstr "資料庫中沒有表" +msgstr "資料庫中沒有資料。" #: db_export.php:40 db_search.php:319 server_export.php:26 msgid "Select All" @@ -281,7 +282,7 @@ msgstr "刪除資料庫" #: db_operations.php:450 #, php-format msgid "Database %s has been dropped." -msgstr "已被刪除資料庫 %s" +msgstr "資料庫 %s 已被刪除。" #: db_operations.php:455 msgid "Drop the database (DROP)" From e084583f4e6b89eed2b83eead6a8b09b26fa168c Mon Sep 17 00:00:00 2001 From: Ashiyane Digital Security Team Date: Sat, 11 Aug 2012 04:26:49 +0200 Subject: [PATCH 2/7] Translated using Weblate. --- po/fa.po | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/po/fa.po b/po/fa.po index c2bdf28804..626667b539 100644 --- a/po/fa.po +++ b/po/fa.po @@ -4,7 +4,7 @@ msgstr "" "Project-Id-Version: phpMyAdmin 3.5.2-dev\n" "Report-Msgid-Bugs-To: phpmyadmin-devel@lists.sourceforge.net\n" "POT-Creation-Date: 2012-06-04 13:42+0200\n" -"PO-Revision-Date: 2012-08-03 00:13+0200\n" +"PO-Revision-Date: 2012-08-11 04:26+0200\n" "Last-Translator: Ashiyane Digital Security Team \n" "Language-Team: Persian \n" "Language: fa\n" @@ -2454,7 +2454,7 @@ msgstr "" #: libraries/File.class.php:284 msgid "The uploaded file was only partially uploaded." -msgstr "" +msgstr "فایل آپلود شده کاملا آپلود نشده." #: libraries/File.class.php:287 msgid "Missing a temporary folder." @@ -2480,7 +2480,7 @@ msgstr "" #: libraries/File.class.php:508 msgid "Error while moving uploaded file." -msgstr "" +msgstr "خطا در موقع جابجا کردن فایل آپلود شده." #: libraries/File.class.php:516 msgid "Cannot read (moved) upload file." @@ -2567,11 +2567,11 @@ msgstr[1] "" #: libraries/PDF.class.php:81 msgid "Error while creating PDF:" -msgstr "" +msgstr " PDF خطا در موقع درست کردن " #: libraries/RecentTable.class.php:107 msgid "Could not save recent table" -msgstr "" +msgstr "جدول اخیر ذخیره نشد" #: libraries/RecentTable.class.php:142 msgid "Recent tables" @@ -2579,7 +2579,7 @@ msgstr "جدول های اخیر" #: libraries/RecentTable.class.php:149 msgid "There are no recent tables" -msgstr "" +msgstr "جدول های اخیری وجود ندارد." #: libraries/StorageEngine.class.php:203 msgid "" @@ -2603,11 +2603,11 @@ msgstr "" #: libraries/Table.class.php:329 msgid "unknown table status: " -msgstr "" +msgstr " :وضعیت جدول ناشناس" #: libraries/Table.class.php:1120 msgid "Invalid database" -msgstr "" +msgstr " پایگاه داده نامعتبر " #: libraries/Table.class.php:1134 tbl_get_field.php:25 msgid "Invalid table name" From 7444b78a45aab4e7e158042a2d0811ba3e522d63 Mon Sep 17 00:00:00 2001 From: Anusuk Sangubon Date: Wed, 8 Aug 2012 08:31:03 +0200 Subject: [PATCH 3/7] Translated using Weblate. --- po/th.po | 80 +++++++++++++++++++++++++++++++------------------------- 1 file changed, 45 insertions(+), 35 deletions(-) diff --git a/po/th.po b/po/th.po index 915adb022a..00c2668d5d 100644 --- a/po/th.po +++ b/po/th.po @@ -4,15 +4,15 @@ msgstr "" "Project-Id-Version: phpMyAdmin 3.5.2-dev\n" "Report-Msgid-Bugs-To: phpmyadmin-devel@lists.sourceforge.net\n" "POT-Creation-Date: 2012-06-04 13:42+0200\n" -"PO-Revision-Date: 2012-04-21 15:20+0200\n" -"Last-Translator: Setthawut Sawaengkit \n" -"Language-Team: thai \n" +"PO-Revision-Date: 2012-08-08 08:31+0200\n" +"Last-Translator: Anusuk Sangubon \n" +"Language-Team: Thai \n" "Language: th\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" "Plural-Forms: nplurals=1; plural=0;\n" -"X-Generator: Weblate 0.10\n" +"X-Generator: Weblate 1.2\n" #: browse_foreigners.php:35 browse_foreigners.php:53 js/messages.php:353 #: libraries/display_tbl.lib.php:359 server_privileges.php:1677 @@ -1844,7 +1844,7 @@ msgstr "เวลาที่ทำคำสั่ง" #: js/messages.php:288 libraries/display_tbl.lib.php:423 #, php-format msgid "%d is not valid row number." -msgstr "" +msgstr "%d ไม่ใช่หมายเลขแถวที่ถูกต้อง" #: js/messages.php:291 libraries/config/FormDisplay.tpl.php:355 #: libraries/schema/User_Schema.class.php:352 @@ -1875,8 +1875,9 @@ msgid "Hovering over a point will show its label." msgstr "นำตัวชี้วางเพื่อแสดงคำกำกับ" #: js/messages.php:304 +#, fuzzy msgid "To zoom in, select a section of the plot with the mouse." -msgstr "" +msgstr "เมื่อต้องการย่อ/ขยาย เลือกส่วนของจุดโดยใช้เมาส์" #: js/messages.php:306 msgid "Click reset zoom link to come back to original state." @@ -1887,8 +1888,9 @@ msgid "Click a data point to view and possibly edit the data row." msgstr "คลิก จุดข้อมูล เพื่อดูหรือแก้ไขแถวข้อมูล" #: js/messages.php:310 +#, fuzzy msgid "The plot can be resized by dragging it along the bottom right corner." -msgstr "ขนาดจุดสามารถเปลี่ยนได้ที่ขวาล่าง" +msgstr "จุดสามารถปรับขนาดได้ โดยการลากไปมุมขวาด้านล่าง" #: js/messages.php:312 msgid "Select two columns" @@ -2363,8 +2365,8 @@ msgid "" "Error moving the uploaded file, see [a@./Documentation." "html#faq1_11@Documentation]FAQ 1.11[/a]" msgstr "" -"มีข้อผิดพลาดขนาดย้ายไฟล์อัพหลด กรุณาดู [a@./Documentation.html#faq1_11@Documentation]" -"FAQ 1.11[/a]" +"มีข้อผิดพลาดระหว่างการอัพโหลด กรุณาดู " +"[a@./Documentation.html#faq1_11@Documentation]FAQ 1.11[/a]" #: libraries/File.class.php:508 msgid "Error while moving uploaded file." @@ -2522,17 +2524,19 @@ msgstr "" "['MaxTableUiprefs'] %s)" #: libraries/Table.class.php:1533 -#, php-format +#, fuzzy, php-format msgid "" "Cannot save UI property \"%s\". The changes made will not be persistent " "after you refresh this page. Please check if the table structure has been " "changed." msgstr "" +"ไม่สามารถบันทึกคุณสมบัติ UI \"% s\" ได้ การเปลี่ยนแปลงจะมีผล " +"หลังจากคุณรีเฟรชหน้านี้ โปรดตรวจสอบหากมีการเปลี่ยนโครงสร้างของตาราง" #: libraries/Theme.class.php:145 #, php-format msgid "No valid image path for theme %s found!" -msgstr "" +msgstr "ไม่มีเส้นทางรูปภาพที่ถูกต้องสำหรับชุดรูปแบบ %s ที่พบ" #: libraries/Theme.class.php:352 msgid "No preview available." @@ -2540,30 +2544,30 @@ msgstr "ไม่สามารถแสดงตัวอย่างได้ #: libraries/Theme.class.php:355 msgid "take it" -msgstr "" +msgstr "ลงมือ" #: libraries/Theme_Manager.class.php:110 -#, php-format +#, fuzzy, php-format msgid "Default theme %s not found!" -msgstr "" +msgstr "เริ่มต้นชุดรูปแบบ %s ไม่พบ" #: libraries/Theme_Manager.class.php:151 #, php-format msgid "Theme %s not found!" -msgstr "" +msgstr "ชุดรูปแบบ %s ไม่พบ" #: libraries/Theme_Manager.class.php:217 -#, php-format +#, fuzzy, php-format msgid "Theme path not found for theme %s!" -msgstr "" +msgstr "เส้นทางของชุดรูปแบบ %s ไม่พบ" #: libraries/Theme_Manager.class.php:296 themes.php:20 themes.php:27 msgid "Theme" -msgstr "" +msgstr "ชุดรูปแบบ" #: libraries/auth/config.auth.lib.php:71 msgid "Cannot connect: invalid settings." -msgstr "" +msgstr "ไม่สามารถเชื่อมต่อ: ตั้งค่าไม่ถูกต้อง" #: libraries/auth/config.auth.lib.php:87 #: libraries/auth/cookie.auth.lib.php:172 libraries/auth/http.auth.lib.php:64 @@ -2577,6 +2581,8 @@ msgid "" "You probably did not create a configuration file. You might want to use the " "%1$ssetup script%2$s to create one." msgstr "" +"คุณคงไม่ได้สร้างแฟ้มการกำหนดค่า คุณอาจต้องการใช้ %1$ssetup script%2$s " +"เพื่อสร้างอย่างใดอย่างหนึ่ง" #: libraries/auth/config.auth.lib.php:111 msgid "" @@ -2585,6 +2591,10 @@ msgid "" "configuration and make sure that they correspond to the information given by " "the administrator of the MySQL server." msgstr "" +"phpMyAdmin พยายามเชื่อมต่อไปยังเซิร์ฟเวอร์ MySQL " +"และเซิร์ฟเวอร์ได้ปฏิเสธการเชื่อมต่อดังกล่าว คุณควรตรวจสอบโฮสต์ " +"ชื่อผู้ใช้และรหัสผ่านในการกำหนดค่าของคุณ และให้แน่ใจว่าค่าต่างๆ " +"สอดคล้องกับข้อมูลที่กำหนดไว้ โดยผู้ดูแลระบบของเซิร์ฟเวอร์ MySQL แล้ว" #: libraries/auth/cookie.auth.lib.php:35 msgid "Failed to use Blowfish from mcrypt!" @@ -2631,13 +2641,13 @@ msgstr "ต้องอนุญาตใช้ใช้ 'คุ๊กกี้' #: libraries/auth/signon.auth.lib.php:235 msgid "" "Login without a password is forbidden by configuration (see AllowNoPassword)" -msgstr "" +msgstr "ห้ามกำหนดค่า สำหรับการเข้าสู่ระบบโดยไม่มีรหัสผ่าน (ดู AllowNoPassword)" #: libraries/auth/cookie.auth.lib.php:572 #: libraries/auth/signon.auth.lib.php:239 #, php-format msgid "No activity within %s seconds; please log in again" -msgstr "" +msgstr "ไม่มีกิจกรรมภายใน %s วินาที กรุณาล็อกอินอีกครั้ง" #: libraries/auth/cookie.auth.lib.php:582 #: libraries/auth/cookie.auth.lib.php:584 @@ -2651,25 +2661,25 @@ msgstr "อนุญาตให้เข้าใช้ไม่ได้ ช #: libraries/auth/signon.auth.lib.php:88 msgid "Can not find signon authentication script:" -msgstr "" +msgstr "สามารถค้นหา signon สำหรับตรวจสอบสคริปต์:" #: libraries/auth/swekey/swekey.auth.lib.php:116 #, php-format msgid "File %s does not contain any key id" -msgstr "" +msgstr "แฟ้ม %s ไม่ควรประกอบไปด้วยรหัสคีย์ใดๆ" #: libraries/auth/swekey/swekey.auth.lib.php:156 #: libraries/auth/swekey/swekey.auth.lib.php:176 msgid "Hardware authentication failed" -msgstr "" +msgstr "ตรวจสอบฮาร์ดแวร์ล้มเหลว" #: libraries/auth/swekey/swekey.auth.lib.php:163 msgid "No valid authentication key plugged" -msgstr "" +msgstr "ไม่มีคีย์รับรองความถูกต้อง" #: libraries/auth/swekey/swekey.auth.lib.php:195 msgid "Authenticating..." -msgstr "" +msgstr "กำลังตรวจสอบ..." #: libraries/blobstreaming.lib.php:272 msgid "PBMS error" @@ -2677,15 +2687,15 @@ msgstr "" #: libraries/blobstreaming.lib.php:306 msgid "PBMS connection failed:" -msgstr "" +msgstr "การเชื่อมต่อล้มเหลว PBMS:" #: libraries/blobstreaming.lib.php:361 msgid "PBMS get BLOB info failed:" -msgstr "" +msgstr "PBMS รับข้อมูล BLOB ล้มเหลว:" #: libraries/blobstreaming.lib.php:373 msgid "PBMS get BLOB Content-Type failed" -msgstr "" +msgstr "PBMS รับรูปแบบ Content-Type ล้มเหลว" #: libraries/blobstreaming.lib.php:401 msgid "View image" @@ -2693,24 +2703,24 @@ msgstr "" #: libraries/blobstreaming.lib.php:408 msgid "Play audio" -msgstr "" +msgstr "เล่นเสียง" #: libraries/blobstreaming.lib.php:417 msgid "View video" -msgstr "" +msgstr "ดูวิดีโอ" #: libraries/blobstreaming.lib.php:423 msgid "Download file" -msgstr "" +msgstr "ดาวน์โหลดไฟล์" #: libraries/blobstreaming.lib.php:494 #, php-format msgid "Could not open file: %s" -msgstr "" +msgstr "ไม่สามารถเปิดแฟ้ม: %s" #: libraries/bookmark.lib.php:73 msgid "shared" -msgstr "" +msgstr "ใช้ร่วมกัน" #: libraries/build_html_for_db.lib.php:26 #: libraries/config/messages.inc.php:185 libraries/export/xml.php:51 @@ -2761,7 +2771,7 @@ msgstr "ตรวจสอบสิทธิ" #: libraries/common.inc.php:151 msgid "possible exploit" -msgstr "" +msgstr "ใช้ประโยชน์ได้" #: libraries/common.inc.php:160 msgid "numeric key detected" From d84b98d34012cc5986fe84f1871b0396990391ef Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Thu, 9 Aug 2012 13:13:08 -0400 Subject: [PATCH 4/7] Fix for Empty and Drop vulnerabilities on db Structure and Operations, see PMASA-2012-4 --- js/db_structure.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/js/db_structure.js b/js/db_structure.js index 4affd75bd2..5938ae40cc 100644 --- a/js/db_structure.js +++ b/js/db_structure.js @@ -75,7 +75,7 @@ $(document).ready(function() { /** * @var question String containing the question to be asked for confirmation */ - var question = 'TRUNCATE ' + curr_table_name; + var question = 'TRUNCATE ' + escapeHtml(curr_table_name); $this_anchor.PMA_confirm(question, $this_anchor.attr('href'), function(url) { @@ -125,7 +125,7 @@ $(document).ready(function() { /** * @var question String containing the question to be asked for confirmation */ - var question = 'DROP TABLE ' + curr_table_name; + var question = 'DROP TABLE ' + escapeHtml(curr_table_name); $this_anchor.PMA_confirm(question, $this_anchor.attr('href'), function(url) { From e094f34bed5ef3fd9a4a3cd08e01ff59a260c730 Mon Sep 17 00:00:00 2001 From: Dieter Adriaenssens Date: Fri, 10 Aug 2012 16:04:54 +0200 Subject: [PATCH 5/7] [security] properly escape name of newly created table, see PMASA-2012-4 --- tbl_create.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/tbl_create.php b/tbl_create.php index 4d3171ad99..c402386583 100644 --- a/tbl_create.php +++ b/tbl_create.php @@ -287,7 +287,9 @@ if (isset($_REQUEST['do_save_data'])) { $new_table_string .= ' ' . "\n"; $new_table_string .= ''; - $new_table_string .= ''. $table . ''; + $new_table_string .= '' + . htmlspecialchars($table) . ''; if (PMA_Tracker::isActive()) { $truename = str_replace(' ', ' ', htmlspecialchars($table)); From cc97d82fd15771dfee07445323db3473c2e2da60 Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Sun, 12 Aug 2012 09:14:23 -0400 Subject: [PATCH 6/7] 3.4.11.1 release --- ChangeLog | 3 +++ Documentation.html | 4 ++-- README | 2 +- libraries/Config.class.php | 2 +- 4 files changed, 7 insertions(+), 4 deletions(-) diff --git a/ChangeLog b/ChangeLog index f7d873a5c7..6ad3a07025 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,9 @@ phpMyAdmin - ChangeLog ====================== +3.4.11.1 (2012-08-12) +- [security] Fixed XSS vulnerabilities, see PMASA-2012-4 + 3.4.11.0 (2012-04-14) - bug #3486970 [import] Exception on XML import - bug #3488777 [navi] $cfg['ShowTooltipAliasTB'] and blank names in navigation diff --git a/Documentation.html b/Documentation.html index 30568fc3c7..461b2eae2b 100644 --- a/Documentation.html +++ b/Documentation.html @@ -9,7 +9,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 - phpMyAdmin 3.4.11 - Documentation + phpMyAdmin 3.4.11.1 - Documentation @@ -17,7 +17,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 diff --git a/README b/README index b6ff898fb0..33d529a98a 100644 --- a/README +++ b/README @@ -1,7 +1,7 @@ phpMyAdmin - Readme =================== -Version 3.4.11 +Version 3.4.11.1 A set of PHP-scripts to manage MySQL over the web. diff --git a/libraries/Config.class.php b/libraries/Config.class.php index 8f815b83b5..fe6528800f 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -96,7 +96,7 @@ class PMA_Config */ function checkSystem() { - $this->set('PMA_VERSION', '3.4.11'); + $this->set('PMA_VERSION', '3.4.11.1'); /** * @deprecated */ From 6f200703a3f9e16126822b6add2138f93cec2aac Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Sun, 12 Aug 2012 09:17:02 -0400 Subject: [PATCH 7/7] Fix merge conflicts --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 059c87e895..c00a0e0479 100644 --- a/ChangeLog +++ b/ChangeLog @@ -116,6 +116,9 @@ phpMyAdmin - ChangeLog - bug #3497151 [interface] Duplicate inline query edit box - bug #3504567 [mime] Description of the transformation missing in the tooltip +3.4.11.1 (2012-08-12) +- [security] Fixed XSS vulnerabilities, see PMASA-2012-4 + 3.4.11.0 (2012-04-14) - bug #3486970 [import] Exception on XML import - bug #3488777 [navi] $cfg['ShowTooltipAliasTB'] and blank names in navigation