gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
109,918 Commits 12 Branches 481 Tags 2.4 GiB
QA_4_7
Commit Graph

337 Commits

Author SHA1 Message Date
Michal Čihař
6e7c6aed7d Avoid breakage if set_time_limit is disabled 
Fixs #13468

Signed-off-by: Michal Čihař <michal@cihar.com>
 2017-07-18 11:57:59 +02:00
Michal Čihař
58a6d50f6a Rewrite URL constructing during import 
- Share most of the code
- Correctly generate URL in corner cases

Fixes #13189

Signed-off-by: Michal Čihař <michal@cihar.com>
 2017-06-06 14:25:31 +02:00
Fenn-CS
297aec9ab1 Added definitions for result and message variable-update methods still missing 
Fixes #12349

Signed-off-by: Fenn-CS <fenn25.fn@gmail.com>
Signed-off-by: Michal Čihař <michal@cihar.com>
 2017-03-21 09:46:57 +01:00
Michal Čihař
308c9d7951 Simplify Response object handling 
- always use use and short name
- avoid calling getInstance() several times in one script

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-07 18:17:59 +01:00
Michal Čihař
b56f101039 Remove is_ajax_request global 
We already have the same information on Response object, so let's use it
from there.

Issue #11731

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-07 17:54:34 +01:00
Michal Čihař
df0d8a06d3 Merge branch 'master' into master-security 2016-11-10 11:09:32 +01:00
Michal Čihař
dad93483c1 Merge branch 'QA_4_6' 2016-11-10 11:08:36 +01:00
Michal Čihař
daae30499f Merge branch 'master' into master-security 2016-11-08 15:59:39 +01:00
Deven Bansod
f14cffdbe7 Properly escape strings in MySQL statement values 
Use *_real_escape string functions provided by connectors to escape strings while exporting

Fix #12453

Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>

Conflicts:
	libraries/server_privileges.lib.php
 2016-10-29 10:45:12 +05:30
Deven Bansod
9de4ad2b0d Fix call to old and now undefined functions 
Fix #12664

Occurred due to a merge issue in 54c81312

Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-10-25 16:36:34 +05:30
Michal Čihař
d753aaaa9b Merge branch 'master' into master-security 2016-10-04 17:25:00 +02:00
Michal Čihař
3f0122b6f4 Merge branch 'QA_4_6' 2016-10-04 12:17:21 +02:00
Michal Čihař
686db2039d Merge pull request #12582 from devenbansod/fix_12569 
Use Response instead of Message's display method to print error
 2016-10-04 12:16:06 +02:00
Michal Čihař
fc5bb4a278 Merge branch 'QA_4_6' 2016-10-03 19:38:40 +02:00
Deven Bansod
54c81312a9 If multiple queries are submitted, save the commulative bookmark only once 
Fix #12179

Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-09-23 12:20:53 +05:30
Deven Bansod
e2bd783f57 Use Response instead of Message's display method to print error 
Fix #12569

Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-09-22 18:00:38 +05:30
Michal Čihař
19c24a8c6c Merge branch 'master' into master-security 2016-09-16 10:30:28 +02:00
Michal Čihař
3546bed47e Avoid using mb_strlen for checking whether string is empty 
Using strlen produces same results here, just way faster.

Fixes #12397

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-09-16 10:29:21 +02:00
Michal Čihař
809a75eb92 Merge branch 'master' into master-security 2016-09-16 09:49:28 +02:00
Michal Čihař
3debfa5d1f Merge branch 'QA_4_6' 2016-09-06 11:33:32 +02:00
Deven Bansod
715403c0e7 Fix #12531 : Properly flag queries as DROP DATABASE 
Parser recognizes various DROP statements correctly, but the flags set by SQL Parser are incorrectly used.
In js/functions.js, removed the Regex-based matching, rather handle it in PHP as we have correct flags available from SQL Parser

Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-09-06 14:20:19 +05:30
Michal Čihař
ce278cd3eb Merge branch 'QA_4_6-security' into master-security 2016-09-02 13:47:31 +02:00
Michal Čihař
283f5d10ce Fix possible DOS on too big skip value 
- loop only as long as long we have data to skip
- convert skip parameter to integer

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-09-02 13:44:43 +02:00
Michal Čihař
7ef6fecb87 Merge branch 'master' into master-security 2016-08-01 11:07:33 +02:00
Michal Čihař
d621855169 Merge branch 'QA_4_6' into QA_4_6-security 2016-08-01 11:06:57 +02:00
Michal Čihař
3bcd45f87f Merge commit '2ee0e4ed0e86572f15764fea6ef37bdaf546e6ee' 2016-08-01 11:05:39 +02:00
Deven Bansod
2c5541a94b Fix #12399: Adding index to table shows wrong top navigation 
If the SQL query analyzing sets the $table value to '',
don't update the original value

Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-08-01 11:41:44 +05:30
Michal Čihař
fce934bdb4 Merge branch 'QA_4_6-security' into master-security 2016-07-23 09:40:39 +02:00
Michal Čihař
1e6b740e6f Enable LOAD DATA LOCAL INFILE only when needed 
There is no need to have this feature allowed for normal SQL queries, it
can lead to leaking sensitive files from the web server. It's enough to
enable it only in LDI import plugin, where we control what queries are
executed.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 09:02:31 +02:00
Michal Čihař
c3401ec878 Merge branch 'QA_4_6-security' into master-security 2016-07-12 12:50:54 +02:00
Michal Čihař
0d57c09bd5 Do not allow symlinks in UploadDir 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 12:50:36 +02:00
Michal Čihař
637d4eb4de Merge branch 'QA_4_6-security' into master-security 2016-06-20 17:35:46 +02:00
Michal Čihař
1cc7466db3 Quote delimiter before using preg_replace 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-20 12:16:03 +02:00
Michal Čihař
9869a95641 Simplify Message adding methods 
The methods are now called based on added type:

- addHtml adds HTML code as is
- addText adds text after escaping it
- addMessage adds Message instance

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 15:23:45 +02:00
Michal Čihař
54a76de3d8 'Replace addString calls with correct method based on content 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 15:20:30 +02:00
Michal Čihař
9348d0cb16 Separate adding HTML markup to message from others 
We really want this to be explicit for easier review and hiding this in
second parameter of addParam doesn't make it.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 13:41:35 +02:00
Michal Čihař
5bb7349e0d Merge branch 'QA_4_6' 2016-05-23 09:21:33 +02:00
Michal Čihař
6d4bd77745 Avoid not needed urlencode/urldecode for bookmarked SQL query 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 09:12:52 +02:00
Michal Čihař
f90ca55a57 Add missing error check 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-04-11 17:10:38 +02:00
Michal Čihař
b54e5b0c4b Use File class for file imports 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-04-11 17:09:40 +02:00
Deven Bansod
3b227209a1 Make phpcs happy 
Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-03-22 11:50:22 +05:30
Madhura Jayaratne
ccc17ae112 Merge branch 'bookmark' 2016-03-10 00:58:49 +11:00
Madhura Jayaratne
5c4c0c242c Pass bookmark variables as method parameters 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-03-10 00:28:00 +11:00
Madhura Jayaratne
b55ddd09b5 Use as non-static methods 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-03-10 00:25:06 +11:00
Madhura Jayaratne
263bd601e6 Remove bookmark library includes 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-03-09 23:57:09 +11:00
Madhura Jayaratne
b47256cad2 Check whether valid bookmark was returned 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-03-09 23:52:09 +11:00
Madhura Jayaratne
43cfba9f24 Refactor bookmarking 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-03-09 23:39:29 +11:00
Michal Čihař
28d15ebb8c Add method for checking if encoding conversion is supported 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-03-08 14:26:49 +01:00
Durgesh
0b64827930 Refactored url parmeters generating, Issue #11990 
Signed-off-by: Durgesh <007durgesh219@gmail.com>
 2016-02-22 14:36:41 +05:30
Michal Čihař
4de7b648d2 Merge branch 'QA_4_6' 2016-02-17 12:04:03 +01:00