Merge branch 'QA_5_0'

Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>

ChangeLog

@@ -45,7 +45,9 @@ phpMyAdmin - ChangeLog
 - issue #15350 Change MIME type references to Media (MIME) type
 - issue        Fixed url.php crashing because it's not loading the DatabaseInterface service
 
-4.9.1 (not yet released)
+4.9.2 (not yet released)
+
+4.9.1 (2019-09-20)
 - issue #15313 Added support for Twig 2
 - issue #15315 Fix cannot edit or export column with default CURRENT_TIMESTAMP in MySQL >= 8.0.13
 - issue        Fix a TypeError in Import class with PHP 8
@@ -82,6 +84,8 @@ phpMyAdmin - ChangeLog
 - issue #15440 Fix page number is not being updated in the URL after saving a designer's page
 - issue        Fix reloading a designer's page
 - issue        Fix designer full screen mode button and text stuck when exiting full-screen mode
+- issue        Reduced possibility of causing heavy server traffic between the database and web servers
+- issue        Fix a situation where a server could be deleted while an administator is using the setup script
 
 4.9.0.1 (2019-06-04)
 - issue #14478 phpMyAdmin no longer streams the export data

js/setup/scripts.js

@@ -217,3 +217,13 @@ $(function () {
 //
 // END: User preferences allow/disallow UI
 // ------------------------------------------------------------------
+
+$(function () {
+    $('.delete-server').on('click', function (e) {
+        e.preventDefault();
+        var $this = $(this);
+        $.post($this.attr('href'), $this.attr('data-post'), function () {
+            window.location.replace('index.php');
+        });
+    });
+});

libraries/classes/Controllers/Setup/HomeController.php

@@ -140,6 +140,7 @@ class HomeController extends AbstractController
                     'auth_type' => $this->config->getValue("Servers/$id/auth_type"),
                     'dsn' => $this->config->getServerDSN($id),
                     'params' => [
+                        'token' => $_SESSION[' PMA_token '],
                         'edit' => [
                             'page' => 'servers',
                             'mode' => 'edit',

setup/index.php

@@ -48,7 +48,7 @@ if ($page === 'form') {
     ]);
 } elseif ($page === 'servers') {
     $controller = new ServersController($GLOBALS['ConfigFile'], new Template());
-    if (isset($_GET['mode']) && $_GET['mode'] === 'remove') {
+    if (isset($_GET['mode']) && $_GET['mode'] === 'remove' && $_SERVER['REQUEST_METHOD'] == 'POST') {
         $controller->destroy([
             'id' => $_GET['id'] ?? null,
         ]);

templates/server/databases/index.twig

@@ -312,22 +312,17 @@
       {# Enable statistics #}
       {% if not has_statistics %}
         <div class="row">
-        {{ 'Note: Enabling the database statistics here might cause heavy traffic between the web server and the MySQL server.'|trans|notice }}
+          {{ 'Note: Enabling the database statistics here might cause heavy traffic between the web server and the MySQL server.'|trans|notice }}
         </div>
 
         <div class="row">
-        {% set content %}
-          <strong>{% trans 'Enable statistics' %}</strong>
-        {% endset %}
-        {% set items = [{
-          'content': content,
-          'class': 'li_switch_dbstats',
-          'url': {
-            'href': url('/server/databases', {'statistics': '1'}),
-            'title': 'Enable statistics'|trans
-          }
-        }] %}
-        {% include 'list/unordered.twig' with {'items': items} only %}
+          <ul>
+            <li class="li_switch_dbstats">
+              <a href="{{ url('/server/databases') }}" data-post="{{ get_common({'statistics': '1'}, '') }}" title="{% trans 'Enable statistics' %}">
+                <strong>{% trans 'Enable statistics' %}</strong>
+              </a>
+            </li>
+          </ul>
         </div>
       {% endif %}
     </form>

templates/setup/home/index.twig

@@ -57,7 +57,8 @@
                   {% trans 'Edit' %}
                 </a>
                 |
-                <a href="{{ get_common(server.params.remove) }}">
+                <a class="delete-server" href="{{ get_common(server.params.remove) }}" data-post="
+                  {{- get_common(server.params.token, '') }}">
                   {% trans 'Delete' %}
                 </a>
               </small>