Merge branch 'QA_4_8'

Signed-off-by: Maurício Meneghini Fauth <mauriciofauth@gmail.com>

ChangeLog

@@ -27,20 +27,23 @@ phpMyAdmin - ChangeLog
 - issue #14765 Add initial support for Bootstrap 4
 - issue #14829 Change table column comment field from input to textarea
 
-4.8.5 (not yet released)
+4.8.6 (not yet released)
+- issue #14478 phpMyAdmin no longer streams the export data
+
+4.8.5 (2019-01-25)
 - issue        Developer debug data was saved to the PHP error log
 - issue #14217 Fix issue when adding user on MySQL 8.0.11
 - issue #13788 Exporting a view structure based on another view with a sub-query throws no database selected error
 - issue #14635 Fix PHP error in GitRevision, error in processing request, error code 200
 - issue #14787 Cannot execute stored procedure
 - issue        Add Burmese language
-
-4.8.4.1 (not yet released)
 - issue #14794 Not responding to click, frozen interface, plugin Text_Plain_Sql error
 - issue #14786 Table level Operations functions missing
 - issue #14791 PHP warning, db_export.php#L91 urldecode()
 - issue #14775 Export to SQL format not available for tables
 - issue #14782 Error message shown instead of two-factor QR code when adding 2fa to a user
+- issue        [security] Arbitrary file read/delete relating to MySQL LOAD DATA LOCAL INFILE and an evil server instance (PMASA-2019-1)
+- issue        [security] SQL injection in Designer (PMASA-2019-2)
 
 4.8.4 (2018-12-11)
 - issue #14452 Remove hash param in edit query URL

export.php

@@ -274,6 +274,8 @@ if ($_POST['output_format'] == 'astext') {
  */
 if (isset($_POST['output_format']) && $_POST['output_format'] == 'sendit' && ! $save_on_server) {
     $response->disable();
+    //Disable all active buffers (see: ob_get_status(true) at this point)
+    while (@ob_end_clean());
 }
 
 $tables = [];

libraries/classes/Database/Designer.php

@@ -163,7 +163,8 @@ class Designer
                 . Util::backquote($cfgRelation['db']) . '.'
                 . Util::backquote($cfgRelation['designer_settings'])
                 . ' WHERE ' . Util::backquote('username') . ' = "'
-                . $GLOBALS['cfg']['Server']['user'] . '";';
+                . $GLOBALS['dbi']->escapeString($GLOBALS['cfg']['Server']['user'])
+                . '";';
 
             $result = $this->dbi->fetchSingleRow($query);
 

libraries/classes/Database/Designer/Common.php

@@ -827,8 +827,8 @@ class Common
                     . Util::backquote($cfgDesigner['db'])
                     . "." . Util::backquote($cfgDesigner['table'])
                     . " (username, settings_data)"
-                    . " VALUES('" . $cfgDesigner['user'] . "',"
-                    . " '" . json_encode($save_data) . "');";
+                    . " VALUES('" . $GLOBALS['dbi']->escapeString($cfgDesigner['user'])
+                    . "', '" . json_encode($save_data) . "');";
 
                 $success = $this->relation->queryAsControlUser($query);
             }

libraries/classes/OutputBuffering.php

@@ -112,7 +112,9 @@ class OutputBuffering
         if ($buffer->_on) {
             $buffer->_on = false;
             $buffer->_content = ob_get_contents();
-            ob_end_clean();
+            if (ob_get_length() > 0) {
+                ob_end_clean();
+            }
         }
     }