Merge branch 'master' into master-security

ChangeLog

@@ -52,6 +52,9 @@ phpMyAdmin - ChangeLog
 - issue #12786 Fixed database searching
 - issue #12792 Fixed javascript error on new version link
 - issue #12785 Add information about required and suggested extensions to composer.json
+- issue #12434 Improve documentation for servers running with Suhosin
+- issue #12800 Updated embedded phpSecLib to 2.0.4
+- issue #12800 Fixed various issues with PHP 7.1
 
 4.6.5.2 (2016-12-05)
 - issue #12765 Fixed SQL export with newlines

doc/config.rst

@@ -1748,7 +1748,7 @@ Cookie authentication options
     :default: ``''``
 
     The public key for the reCaptcha service that can be obtained from
-    https://www.google.com/recaptcha.
+    https://www.google.com/recaptcha/intro/.
 
     reCaptcha will be then used in :ref:`cookie`.
 
@@ -1758,7 +1758,7 @@ Cookie authentication options
     :default: ``''``
 
     The private key for the reCaptcha service that can be obtain from
-    https://www.google.com/recaptcha.
+    https://www.google.com/recaptcha/intro/.
 
     reCaptcha will be then used in :ref:`cookie`.
 
@@ -3116,7 +3116,7 @@ Developer
     :default: false
 
     Enable to let server present itself as demo server.
-    This is used for `phpMyAdmin demo server <https://www.phpmyadmin.net/try>`_.
+    This is used for `phpMyAdmin demo server <https://www.phpmyadmin.net/try/>`_.
 
 .. _config-examples:
 

doc/faq.rst

@@ -555,6 +555,23 @@ parameters:
 * `suhosin.log.\* <https://suhosin.org/stories/configuration.html#logging-configuration>`_ should not
   include :term:`SQL`, otherwise you get big
   slowdown
+* `suhosin.sql.union <https://suhosin.org/stories/configuration.html#suhosin-
+  sql-union>`_ must be disabled (which is the default).
+* `suhosin.sql.multiselect <https://suhosin.org/stories/configuration.html#
+  suhosin-sql-multiselect>`_ must be disabled (which is the default).
+* `suhosin.sql.comment <https://suhosin.org/stories/configuration.html#suhosin-
+  sql-comment>`_ must be disabled (which is the default).
+
+To further improve security, we also recommend these modifications:
+
+* `suhosin.executor.include.max\_traversal <https://suhosin.org/stories/
+  configuration.html#suhosin-executor-include-max-traversal>`_ should be
+  enabled as a mitigation against local file inclusion attacks. We suggest
+  setting this to 2 as ``../`` is used with the ReCaptcha library.
+* `suhosin.cookie.encrypt <https://suhosin.org/stories/configuration.html#
+  suhosin-cookie-encrypt>`_ should be enabled.
+* `suhosin.executor.disable_emodifier <https://suhosin.org/stories/config
+  uration.html#suhosin-executor-disable-emodifier>`_ should be enabled.
 
 You can also disable the warning using the :config:option:`$cfg['SuhosinDisableWarning']`.
 

libraries/Util.php

@@ -2790,7 +2790,7 @@ class Util
      */
     public static function cacheExists($var)
     {
-        return isset($_SESSION['cache']['server_' . $GLOBALS['server']][$var]);
+        return isset($_SESSION['cache']['server_' . $GLOBALS['server'] . '_' . $GLOBALS['cfg']['Server']['user']][$var]);
     }
 
     /**
@@ -2804,7 +2804,7 @@ class Util
     public static function cacheGet($var, $callback = null)
     {
         if (self::cacheExists($var)) {
-            return $_SESSION['cache']['server_' . $GLOBALS['server']][$var];
+            return $_SESSION['cache']['server_' . $GLOBALS['server'] . '_' . $GLOBALS['cfg']['Server']['user']][$var];
         } else {
             if ($callback) {
                 $val = $callback();
@@ -2825,7 +2825,7 @@ class Util
      */
     public static function cacheSet($var, $val = null)
     {
-        $_SESSION['cache']['server_' . $GLOBALS['server']][$var] = $val;
+        $_SESSION['cache']['server_' . $GLOBALS['server'] . '_' . $GLOBALS['cfg']['Server']['user']][$var] = $val;
     }
 
     /**
@@ -2837,7 +2837,7 @@ class Util
      */
     public static function cacheUnset($var)
     {
-        unset($_SESSION['cache']['server_' . $GLOBALS['server']][$var]);
+        unset($_SESSION['cache']['server_' . $GLOBALS['server'] . '_' . $GLOBALS['cfg']['Server']['user']][$var]);
     }
 
     /**

libraries/core.lib.php

@@ -363,36 +363,22 @@ function PMA_getRealSize($size = 0)
         return 0;
     }
 
-    $scan = array(
-        'gb' => 1073741824, //1024 * 1024 * 1024,
-        'g'  => 1073741824, //1024 * 1024 * 1024,
-        'mb' =>    1048576,
-        'm'  =>    1048576,
-        'kb' =>       1024,
-        'k'  =>       1024,
-        'b'  =>          1,
+    $binaryprefixes = array(
+        'T' => 1099511627776,
+        't' => 1099511627776,
+        'G' =>    1073741824,
+        'g' =>    1073741824,
+        'M' =>       1048576,
+        'm' =>       1048576,
+        'K' =>          1024,
+        'k' =>          1024,
     );
 
-    foreach ($scan as $unit => $factor) {
-        $sizeLength = strlen($size);
-        $unitLength = strlen($unit);
-        if ($sizeLength > $unitLength
-            && strtolower(
-                substr(
-                    $size,
-                    $sizeLength - $unitLength
-                )
-            ) == $unit
-        ) {
-            return substr(
-                $size,
-                0,
-                $sizeLength - $unitLength
-            ) * $factor;
-        }
+    if (preg_match('/^([0-9]+)([KMGT])/i', $size, $matches)) {
+        return $matches[1] * $binaryprefixes[$matches[2]];
     }
 
-    return $size;
+    return (int) $size;
 } // end function PMA_getRealSize()
 
 /**

scripts/upload-release

@@ -24,8 +24,8 @@ if [ $# -gt 1 ] ; then
     cd "$2"
 fi
 
-# Upload to our file server
-sftp -P 11022 files@klutz.phpmyadmin.net -f -b - <<EOT
+BATCH=`mktemp`
+cat > $BATCH <<EOT
 cd /mnt/storage/files/phpMyAdmin
 mkdir $REL
 cd $REL
@@ -72,5 +72,10 @@ put phpMyAdmin-$REL-english.7z.sha1
 put phpMyAdmin-$REL-notes.html
 EOT
 
+# Upload to our file server
+sftp -P 11022 -f -b $BATCH files@klutz.phpmyadmin.net
+
+rm $BATCH
+
 # Sync files to CDN
 ssh -xka2 -p 11022 files@klutz.phpmyadmin.net ./bin/sync-files-cdn

setup/frames/index.inc.php

@@ -67,30 +67,19 @@ if (!$config_writable || !$config_readable) {
     );
 }
 //
-// Check https connection
+// Https connection warning (check done on the client side)
 //
-$is_https = !empty($_SERVER['HTTPS'])
-    && mb_strtolower($_SERVER['HTTPS']) == 'on';
-if (!$is_https) {
-    $text = __(
-        'You are not using a secure connection; all data (including potentially '
-        . 'sensitive information, like passwords) is transferred unencrypted!'
-    );
-
-    $text .= ' <a href="#" onclick="window.location.href = \'https:\' + window.location.href.substring(window.location.protocol.length);">';
-
-    // Temporary workaround to use tranlated message in older releases
-    $text .= str_replace(
-        array('[a@%s]', '[/a]'),
-        array('', ''),
-        __(
-            'If your server is also configured to accept HTTPS requests '
-            . 'follow [a@%s]this link[/a] to use a secure connection.'
-        )
-    );
-    $text .= '</a>';
-    PMA_messagesSet('notice', 'no_https', __('Insecure connection'), $text);
-}
+$text = __(
+    'You are not using a secure connection; all data (including potentially '
+    . 'sensitive information, like passwords) is transferred unencrypted!'
+);
+$text .= ' <a href="#">';
+$text .= __(
+    'If your server is also configured to accept HTTPS requests '
+    . 'follow this link to use a secure connection.'
+);
+$text .= '</a>';
+PMA_messagesSet('notice', 'no_https', __('Insecure connection'), $text);
 
 echo '<form id="select_lang" method="post">';
 echo URL::getHiddenInputs();

setup/lib/index.lib.php

@@ -80,23 +80,18 @@ function PMA_messagesEnd()
  */
 function PMA_messagesShowHtml()
 {
-    $old_ids = array();
     foreach ($_SESSION['messages'] as $type => $messages) {
         foreach ($messages as $id => $msg) {
-            echo '<div class="' , $type , '" id="' , $id , '">'
+            if (! $msg['fresh'] && $type != 'error') {
+                $extra = ' hiddenmessage';
+            } else {
+                $extra = '';
+            }
+            echo '<div class="' , $type, $extra , '" id="' , $id , '">'
                 , '<h4>' , $msg['title'] , '</h4>'
                 , $msg['message'] , '</div>';
-            if (!$msg['fresh'] && $type != 'error') {
-                $old_ids[] = $id;
-            }
         }
     }
-
-    echo "\n" , '<script type="text/javascript">';
-    foreach ($old_ids as $id) {
-        echo "\nhiddenMessages.push('$id');";
-    }
-    echo "\n</script>\n";
 }
 
 /**

setup/scripts.js

@@ -12,24 +12,29 @@ if (top != self) {
 // Messages
 //
 
-// stores hidden message ids
-var hiddenMessages = [];
-
 $(function () {
-    var hidden = hiddenMessages.length;
-    for (var i = 0; i < hidden; i++) {
-        $('#' + hiddenMessages[i]).css('display', 'none');
+
+    if (window.location.protocol === 'https:') {
+        $('#no_https').remove();
+    } else {
+        $('#no_https a').click(function () {
+            var old_location = window.location;
+            window.location.href = 'https:' + old_location.href.substring(old_location.protocol.length);
+            return false;
+        });
     }
-    if (hidden > 0) {
+
+    var hiddenmessages = $('.hiddenmessage');
+
+    if (hiddenmessages.length > 0) {
+        hiddenmessages.hide();
         var link = $('#show_hidden_messages');
         link.click(function (e) {
             e.preventDefault();
-            for (var i = 0; i < hidden; i++) {
-                $('#' + hiddenMessages[i]).show(500);
-            }
+            hiddenmessages.show();
             $(this).remove();
         });
-        link.html(link.html().replace('#MSG_COUNT', hidden));
+        link.html(link.html().replace('#MSG_COUNT', hiddenmessages.length));
         link.css('display', '');
     }
 });

test/libraries/PMA_SetupIndex_test.php

@@ -147,7 +147,7 @@ class PMA_SetupIndex_Test extends PHPUnit_Framework_TestCase
         $result = ob_get_clean();
 
         $this->assertContains(
-            '<div class="type" id="0"><h4>foo</h4>123</div>',
+            '<div class="type hiddenmessage" id="0"><h4>foo</h4>123</div>',
             $result
         );
 
@@ -155,21 +155,6 @@ class PMA_SetupIndex_Test extends PHPUnit_Framework_TestCase
             '<div class="type" id="1"><h4>bar</h4>321</div>',
             $result
         );
-
-        $this->assertContains(
-            '<script type="text/javascript">',
-            $result
-        );
-
-        $this->assertContains(
-            "hiddenMessages.push('0');",
-            $result
-        );
-
-        $this->assertContains(
-            "</script>",
-            $result
-        );
     }
 
     /**