gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/QA_4_6' into QA_4_6

Browse Source
This commit is contained in:
Weblate 2016-08-17 15:38:55 +02:00
commit df5099459d
13 changed files with 102 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
ChangeLog
View File

@ -6,6 +6,7 @@ phpMyAdmin - ChangeLog
- issue #12459 Display read only fields as read only when editing
- issue #12384 Fix expanding of navigation pane when clicking on database
- issue #12430 Impove partitioning support
- issue #12374 Reintroduced simplified PmaAbsoluteUri configuration directive
4.6.4 (2016-08-16)
- issue [security] Weaknesses with cookie encryption, see PMASA-2016-29

7
doc/config.rst
View File

@ -41,10 +41,9 @@ Basic settings
:type: string
:default: ``''``
.. deprecated:: 4.6.0
.. versionchanged:: 4.6.5
This setting is no longer available since phpMyAdmin 4.6.0. Please
adjust your webserver instead.
This setting was not available in phpMyAdmin 4.6.0 - 4.6.4.
Sets here the complete :term:`URL` (with full path) to your phpMyAdmin
installation's directory. E.g.
@ -63,7 +62,7 @@ Basic settings
fails to detect your path, please post a bug report on our bug tracker so
we can improve the code.
.. seealso:: :ref:`faq1_40`
.. seealso:: :ref:`faq1_40`, :ref:`faq2_5`, :ref:`faq4_7`, :ref:`faq5_16`
.. config:option:: $cfg['PmaNoRelation_DisableWarning']

8
doc/faq.rst
View File

@ -561,7 +561,7 @@ This is not specific to phpmyadmin, it's just the behavior of Apache.
ProxyPassReverse /mirror/foo/ http://backend.example.com/%7Euser/phpmyadmin
ProxyPassReverseCookiePath /%7Euser/phpmyadmin /mirror/foo
.. seealso:: <https://httpd.apache.org/docs/2.2/mod/mod_proxy.html>
.. seealso:: <https://httpd.apache.org/docs/2.2/mod/mod_proxy.html>, :config:option:`$cfg['PmaAbsoluteUri']`
.. _faq1_41:
@ -714,9 +714,9 @@ revision.
Check your webserver setup if it correctly fills in either PHP_SELF or REQUEST_URI variables.
If you are running phpMyAdmin older than 4.6.0, you can also check the value
you set for the :config:option:`$cfg['PmaAbsoluteUri']` directive in the
phpMyAdmin configuration file.
If you are running phpMyAdmin behind reverse proxy, please set the
:config:option:`$cfg['PmaAbsoluteUri']` directive in the phpMyAdmin
configuration file to match your setup.
.. _faq2_6:

2
js/functions.js
View File

@ -299,7 +299,7 @@ function PMA_clearSelection() {
*
* @param $elements jQuery object representing the elements
* @param item the item
* (see http://api.jqueryui.com/tooltip/#option-items)
* (see https://api.jqueryui.com/tooltip/#option-items)
* @param myContent content of the tooltip
* @param additionalOptions to override the default options
*

26
libraries/Config.php
View File

@ -1357,8 +1357,12 @@ class Config
return $this->get('is_https');
}
$url = $this->get('PmaAbsoluteUri');
$is_https = false;
if (strtolower(PMA_getenv('HTTP_SCHEME')) == 'https') {
if (! empty($url) && parse_url($url, PHP_URL_SCHEME) === 'https') {
$is_https = true;
} elseif (strtolower(PMA_getenv('HTTP_SCHEME')) == 'https') {
$is_https = true;
} elseif (strtolower(PMA_getenv('HTTPS')) == 'on') {
$is_https = true;
@ -1381,11 +1385,11 @@ class Config
}
/**
* Get cookie path
* Get phpMyAdmin root path
*
* @return string
*/
public function getCookiePath()
public function getRootPath()
{
static $cookie_path = null;
@ -1393,6 +1397,18 @@ class Config
return $cookie_path;
}
$url = $this->get('PmaAbsoluteUri');
if (! empty($url)) {
$path = parse_url($url, PHP_URL_PATH);
if (! empty($path)) {
if (substr($path, -1) != '/') {
return $path . '/';
}
return $path;
}
}
$parsed_url = parse_url($GLOBALS['PMA_PHP_SELF']);
$parts = explode(
@ -1577,7 +1593,7 @@ class Config
$cookie,
'',
time() - 3600,
$this->getCookiePath(),
$this->getRootPath(),
'',
$this->isHttps()
);
@ -1631,7 +1647,7 @@ class Config
$cookie,
$value,
$validity,
$this->getCookiePath(),
$this->getRootPath(),
'',
$this->isHttps(),
$httponly

19
libraries/config.default.php
View File

@ -19,6 +19,25 @@
* @package PhpMyAdmin
*/
/**
* Your phpMyAdmin URL.
*
* Complete the variable below with the full URL ie
* http://www.your_web.net/path_to_your_phpMyAdmin_directory/
*
* It must contain characters that are valid for a URL, and the path is
* case sensitive on some Web servers, for example Unix-based servers.
*
* In most cases you can leave this variable empty, as the correct value
* will be detected automatically. However, we recommend that you do
* test to see that the auto-detection code works in your system. A good
* test is to browse a table, then edit a row and save it. There will be
* an error message if phpMyAdmin cannot auto-detect the correct value.
*
* @global string $cfg['PmaAbsoluteUri']
*/
$cfg['PmaAbsoluteUri'] = '';
/**
* Disable the default warning that is displayed on the DB Details Structure page if
* any of the required Tables for the configuration storage could not be found

4
libraries/core.lib.php
View File

@ -356,7 +356,7 @@ function PMA_getTableCount($db)
/**
* Converts numbers like 10M into bytes
* Used with permission from Moodle (http://moodle.org) by Martin Dougiamas
* Used with permission from Moodle (https://moodle.org) by Martin Dougiamas
* (renamed with PMA prefix to avoid double definition when embedded
* in Moodle)
*
@ -503,7 +503,7 @@ function PMA_sendHeaderLocation($uri, $use_refresh = false)
* like /phpmyadmin/index.php/ which some web servers happily accept.
*/
if ($uri[0] == '.') {
$uri = $GLOBALS['PMA_Config']->getCookiePath() . substr($uri, 2);
$uri = $GLOBALS['PMA_Config']->getRootPath() . substr($uri, 2);
}
$response = PMA\libraries\Response::getInstance();

2
libraries/session.inc.php
View File

@ -28,7 +28,7 @@ if (!@function_exists('session_name')) {
// session cookie settings
session_set_cookie_params(
0, $GLOBALS['PMA_Config']->getCookiePath(),
0, $GLOBALS['PMA_Config']->getRootPath(),
'', $GLOBALS['PMA_Config']->isHttps(), true
);

2
test/.htaccess
View File

@ -2,5 +2,5 @@
# In most cases the tests included here will be run from a command line interface.
# (the following directive denies access by default)
# For more information see: http://httpd.apache.org/docs/current/mod/mod_authz_host.html#allow
# For more information see: https://httpd.apache.org/docs/current/mod/mod_authz_host.html#allow
Order allow,deny

54
test/classes/ConfigTest.php
View File

@ -641,76 +641,110 @@ class ConfigTest extends PMATestCase
}
/**
* Test for getting cookie path
* Test for getting root path
*
* @param string $request The request URL used for phpMyAdmin
* @param string $absolute The absolute URL used for phpMyAdmin
* @param string $expected Expected cookie path
* @param string $expected Expected root path
*
* @return void
*
* @dataProvider cookieUris
* @dataProvider rootUris
*/
public function testGetCookiePath($absolute, $expected)
public function testGetRootPath($request, $absolute, $expected)
{
$GLOBALS['PMA_PHP_SELF'] = $absolute;
$this->assertEquals($expected, $this->object->getCookiePath());
$GLOBALS['PMA_PHP_SELF'] = $request;
$this->object->set('PmaAbsoluteUri', $absolute);
$this->assertEquals($expected, $this->object->getRootPath());
}
/**
* Data provider for testGetCookiePath
* Data provider for testGetRootPath
*
* @return array data for testGetCookiePath
* @return array data for testGetRootPath
*/
public function cookieUris()
public function rootUris()
{
return array(
array(
'',
'',
'/',
),
array(
'/',
'',
'/',
),
array(
'/index.php',
'',
'/',
),
array(
'\\index.php',
'',
'/',
),
array(
'\\',
'',
'/',
),
array(
'\\path\\to\\index.php',
'',
'/path/to/',
),
array(
'/foo/bar/phpmyadmin/index.php',
'',
'/foo/bar/phpmyadmin/',
),
array(
'/foo/bar/phpmyadmin/',
'',
'/foo/bar/phpmyadmin/',
),
array(
'https://example.net/baz/phpmyadmin/',
'',
'/baz/phpmyadmin/',
),
array(
'http://example.net/baz/phpmyadmin/',
'',
'/baz/phpmyadmin/',
),
array(
'http://example.net/phpmyadmin/',
'',
'/phpmyadmin/',
),
array(
'http://example.net/',
'',
'/',
),
array(
'http://example.net/',
'http://example.net/phpmyadmin/',
'/phpmyadmin/',
),
array(
'http://example.net/',
'/',
'http://example.net/phpmyadmin',
'/phpmyadmin/',
),
array(
'http://example.net/',
'/phpmyadmin2',
'/phpmyadmin2/',
),
array(
'http://example.net/',
'/phpmyadmin3/',
'/phpmyadmin3/',
),
);
}

2
test/classes/plugin/auth/AuthenticationCookieTest.php
View File

@ -456,6 +456,7 @@ class AuthenticationCookieTest extends PMATestCase
$GLOBALS['cfg']['CaptchaLoginPrivateKey'] = '';
$GLOBALS['cfg']['CaptchaLoginPublicKey'] = '';
$GLOBALS['cfg']['LoginCookieDeleteAll'] = true;
$GLOBALS['PMA_Config']->set('PmaAbsoluteUri', '');
$GLOBALS['cfg']['Servers'] = array(1);
$_COOKIE['pmaAuth-0'] = 'test';
@ -497,6 +498,7 @@ class AuthenticationCookieTest extends PMATestCase
$GLOBALS['cfg']['CaptchaLoginPrivateKey'] = '';
$GLOBALS['cfg']['CaptchaLoginPublicKey'] = '';
$GLOBALS['cfg']['LoginCookieDeleteAll'] = false;
$GLOBALS['PMA_Config']->set('PmaAbsoluteUri', '');
$GLOBALS['cfg']['Servers'] = array(1);
$GLOBALS['server'] = 1;

1
test/libraries/PMA_user_preferences_test.php
View File

@ -360,6 +360,7 @@ class PMA_User_Preferences_Test extends PHPUnit_Framework_TestCase
'Cannot redefine constant/function - missing runkit extension'
);
}
$GLOBALS['PMA_Config']->set('PmaAbsoluteUri', '');
$GLOBALS['cfg']['ServerDefault'] = 1;
$GLOBALS['lang'] = '';

4
user_password.php
View File

@ -112,10 +112,10 @@ function PMA_setChangePasswordMsg()
$message = PMA\libraries\Message::success(__('The profile has been updated.'));
if (($_REQUEST['nopass'] != '1')) {
if (empty($_REQUEST['pma_pw']) || empty($_REQUEST['pma_pw2'])) {
if (strlen($_REQUEST['pma_pw']) === 0 || strlen($_REQUEST['pma_pw2']) === 0) {
$message = PMA\libraries\Message::error(__('The password is empty!'));
$error = true;
} elseif ($_REQUEST['pma_pw'] != $_REQUEST['pma_pw2']) {
} elseif ($_REQUEST['pma_pw'] !== $_REQUEST['pma_pw2']) {
$message = PMA\libraries\Message::error(
__('The passwords aren\'t the same!')
);