Commit Graph

17 Commits

Author SHA1 Message Date
Michal Čihař
19c24a8c6c Merge branch 'master' into master-security 2016-09-16 10:30:28 +02:00
Michal Čihař
3546bed47e Avoid using mb_strlen for checking whether string is empty
Using strlen produces same results here, just way faster.

Fixes #12397

Signed-off-by: Michal Čihař <michal@cihar.com>
2016-09-16 10:29:21 +02:00
Michal Čihař
3ba11212a3 Merge branch 'QA_4_6-security' into master-security 2016-09-02 14:41:33 +02:00
Michal Čihař
733a5d5821 Avoid rendering BB code when showing PHP/MySQL errors
Signed-off-by: Michal Čihař <michal@cihar.com>
2016-09-02 14:36:23 +02:00
Michal Čihař
d3aa8c5fb6 Call htmlspecialchars as we do not need to process complex types here
Signed-off-by: Michal Čihař <michal@cihar.com>
2016-06-16 15:39:39 +02:00
Michal Čihař
9869a95641 Simplify Message adding methods
The methods are now called based on added type:

- addHtml adds HTML code as is
- addText adds text after escaping it
- addMessage adds Message instance

Signed-off-by: Michal Čihař <michal@cihar.com>
2016-06-16 15:23:45 +02:00
Michal Čihař
54a76de3d8 'Replace addString calls with correct method based on content
Signed-off-by: Michal Čihař <michal@cihar.com>
2016-06-16 15:20:30 +02:00
Michal Čihař
19f76066f2 Separate adding string and Message objects to Message
This way we can rely on type checking and avoid potential problems with
escaping.

Signed-off-by: Michal Čihař <michal@cihar.com>
2016-06-16 15:16:29 +02:00
Michal Čihař
a7cd193554 Make it clear whether addMessages expects string or Message object
With this, it's way easier to anaylize code for potential problems with
escaping.

Signed-off-by: Michal Čihař <michal@cihar.com>
2016-06-16 14:56:41 +02:00
Michal Čihař
efac710526 The Html methods accept strings only
Signed-off-by: Michal Čihař <michal@cihar.com>
2016-06-16 14:39:32 +02:00
Michal Čihař
18c0786eae Improve addMessage calls
- add call which accepts HTML markup
- use separator where applicable
- extend testcase to see HTML markup handling

Signed-off-by: Michal Čihař <michal@cihar.com>
2016-06-16 14:25:33 +02:00
Michal Čihař
9348d0cb16 Separate adding HTML markup to message from others
We really want this to be explicit for easier review and hiding this in
second parameter of addParam doesn't make it.

Signed-off-by: Michal Čihař <michal@cihar.com>
2016-06-16 13:41:35 +02:00
Michal Čihař
8574aa4496 Remove documentatoin for no longer supported use cases
Signed-off-by: Michal Čihař <michal@cihar.com>
2016-06-16 13:15:52 +02:00
Michal Čihař
fe18b9477f Remove possibility to use global name as message string
This is really confusing and can cause surprising effects when parameter
(eg. table name) matches some global.

Also I think this is really not used anywhere.

Signed-off-by: Michal Čihař <michal@cihar.com>
2016-06-16 11:35:58 +02:00
Durgesh
6650f7b07d Refactor text sanitization and javascript escaping, Issue #11989, #11988
Signed-off-by: Durgesh <007durgesh219@gmail.com>
2016-02-22 14:45:19 +05:30
Michal Čihař
55b317c699 Remove /*overload*/ prefix from mb_* calls
I believe this was temporary flagging to see which code is migrated and
can be safely removed now.

Signed-off-by: Michal Čihař <michal@cihar.com>
2016-01-04 16:35:28 +01:00
Hugues Peccatte
f0ba28fc1d Set namespace on Advisor, Config, Console and Util classes.
Set namespace on DbQbe.
Set namespace to 'DbSearch'.
Split Advisor.class.php file.
Change Advisor namespace.
Rename DbQbe class and file.
Set namespace on DisplayResults.
Set namespace on Error.
Use namespace for ErrorHandler.
Add class autoloader.
Change ErrorHandler filename.
Remove some require.
Update Config namespace path.
Update PMA_Util to PMA\libraries\Util.
Rename Font and File classes files.
Use namespace for Footer.
Set namespace in all libraries classes.
Namespace OutputBuffering.
Export SubPartition.
Rename Partition file.
Namespace PDF.
Namespace RecentFavoriteTable.
Replace PMA_Response by Response and PMA_Message by Message.
Update uses and calls.
Fix unit tests.
Fix SqlParser autoload.

Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
2015-09-01 21:22:52 +02:00