gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
115,271 Commits 12 Branches 481 Tags 2.4 GiB
QA_4_9
Commit Graph

1017 Commits

Author SHA1 Message Date
William Desportes
eb7682b8fd
Add Icelandic language 
Ref: 8f21835811

Signed-off-by: William Desportes <williamdes@wdes.fr>
 2024-03-04 22:25:50 +01:00
Isaac Bennetch
f1047bc018 Prepare for 4.9.11 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2023-02-07 14:08:26 -05:00
Isaac Bennetch
a8c0d62285 Prepare for 4.9.10 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2022-02-10 22:01:50 -05:00
Maurício Meneghini Fauth
8258e1f45e
Fix broken pagination links in the navigation sidebar 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2022-01-27 16:53:51 -03:00
Isaac Bennetch
1e8f8121fd Prepare for version 4.9.9 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2022-01-22 23:25:15 -05:00
Maurício Meneghini Fauth
16c833fe06
Fix CoreTest failing tests 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2022-01-22 15:19:41 -03:00
Maurício Meneghini Fauth
fd692ca382
Fix hide_connection_errors being undefined when a controluser is set 
Fixes #17307
Closes #17304

Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2022-01-22 12:21:57 -03:00
Maurício Meneghini Fauth
e2b4dda2e9
Fix syntax error for PHP 5 
Fixes #17305
Fixes #17306

Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2022-01-22 11:37:03 -03:00
Isaac Bennetch
51f96694a0 Prepare for version 4.9.8 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2022-01-20 10:34:55 -05:00
William Desportes
ca54f1db05
security - Fix - 2FA/U2F can be disabled without any code change 
Signed-off-by: William Desportes <williamdes@wdes.fr>
 2022-01-13 19:07:34 +01:00
Maurício Meneghini Fauth
ae11d5260b
Merge pull request #334 from phpmyadmin/security/315 
Encrypt the URL query when sensitive data is present
 2022-01-10 13:33:03 -03:00
Maurício Meneghini Fauth
4fd7aa7a2c
Use POST for Navigation's aPath and vPath 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2022-01-10 12:19:44 -03:00
Maurício Meneghini Fauth
68c1ef8581
Populate POST with decrypted params 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2022-01-10 12:19:44 -03:00
Maurício Meneghini Fauth
0b575ff2e9
Fix URL encryption for Util::linkOrButton method 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2022-01-10 12:19:44 -03:00
Maurício Meneghini Fauth
6f0d19f394
Do not encrypt params if used in data-post attribute 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2022-01-10 12:19:43 -03:00
Maurício Meneghini Fauth
d057b68aa1
Add unit tests 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2022-01-10 12:19:43 -03:00
Maurício Meneghini Fauth
3095181bb3
Encrypt query params of Navigation links 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2022-01-10 12:19:43 -03:00
Maurício Meneghini Fauth
f1aaec1a5a
Add PhpMyAdmin\Url::buildHttpQuery method 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2022-01-10 12:19:42 -03:00
Maurício Meneghini Fauth
3c11d62b31
Add support for Sodium encryption 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2022-01-10 12:19:42 -03:00
Maurício Meneghini Fauth
28ad63c969
Create PhpMyAdmin\Crypto\Crypto class to handle encryptions 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2022-01-10 12:19:42 -03:00
Maurício Meneghini Fauth
eb9bcbc040
Encrypt the URL query when sensitive data is present 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2022-01-10 12:19:42 -03:00
Maurício Meneghini Fauth
a059cdba47
Add config directive to show/hide connection errors 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2022-01-10 12:12:07 -03:00
Maurício Meneghini Fauth
b2bfa1ffc6
Add missing languages (ar_ly, rcf, tzm) 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2021-10-13 17:47:17 -03:00
William Desportes
e3f4a57aa6
Fix #14321 - leaked HTML on auth_type=signon before redirect occurs and on error page when SignonURL is not set 
This fix also fixes the display when SignonURL is empty at configuration time.

When the user was redirected there was HTML in the output that could leak some interesting details about the server or the user.

Signed-off-by: William Desportes <williamdes@wdes.fr>
 2021-08-25 01:36:36 +02:00
Isaac Bennetch
aadbf8e0e3 Prepare for 4.9.7 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2020-10-15 13:41:27 -04:00
Maurício Meneghini Fauth
9ac1dfb611 Prepare for 4.9.7-dev 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2020-10-10 13:30:38 -03:00
Isaac Bennetch
1ef607e887 Prepare for 4.9.6 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2020-10-09 21:36:34 -04:00
Isaac Bennetch
b47a5d992d
Merge pull request #317 from phpmyadmin/fix/314-transformation-wrapper 
Fix #314 - make sure where_clause is not modified
 2020-10-08 23:06:21 -04:00
Isaac Bennetch
deb2dce644
Merge pull request #319 from phpmyadmin/sec/318 
Check where clause signature in TableSearchController
 2020-10-08 23:06:08 -04:00
Maurício Meneghini Fauth
f1c3ea03a0 Add support for Berber languages 
Fixes #16300

Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2020-08-09 12:51:40 -03:00
Maurício Meneghini Fauth
d09ab9bc9d Check where clause signature in TableSearchController 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2020-07-03 17:45:58 -03:00
William Desportes
19df63b036
Fix #314 - make sure where_clause is not modified 
Signed-off-by: William Desportes <williamdes@wdes.fr>
 2020-05-17 12:27:39 +02:00
Isaac Bennetch
28a79c9d09 Prepare for version 4.9.5 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2020-03-20 22:02:51 -04:00
Isaac Bennetch
1aee403733
Merge pull request #307 from phpmyadmin/security/302 
Fix External Transformation RCE
 2020-03-20 19:07:35 -04:00
Isaac Bennetch
163f05cac1 Improve warning message for external transformation 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2020-03-20 18:58:15 -04:00
Isaac Bennetch
155f3b2b41
Merge pull request #297 from phpmyadmin/security/296 
SQL Injection in SearchController
 2020-03-20 18:21:05 -04:00
Isaac Bennetch
9ce61ea0e5
Merge pull request #306 from phpmyadmin/security/295 
Fix SQL Injection and Data Extraction with XS-Search
 2020-03-19 22:38:27 -04:00
Isaac Bennetch
1a1f00bad4 Corrected documentation for External Transformation 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2020-03-19 22:34:35 -04:00
Isaac Bennetch
3258978c38 More escaping of username and password. 
Improves upon 89fbcd7c39

Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2020-03-18 22:16:53 -04:00
Maurício Meneghini Fauth
799ce5e3a6 Add warning for external transformations option usage 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2020-03-17 19:46:20 -03:00
Maurício Meneghini Fauth
13e6a01838 Add support for E_USER_DEPRECATED in the error handler 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2020-03-17 19:37:31 -03:00
Maurício Meneghini Fauth
89fbcd7c39 Escape user and hostname when getting auth plugin 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2020-03-05 20:10:13 -03:00
Maurício Meneghini Fauth
6b9b2601d8 Add where_clause check in tbl_get_field.php 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2020-03-05 17:34:49 -03:00
Maurício Meneghini Fauth
a8acd7a42c Use Util::backquote in getDataRowAction 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2020-01-18 22:13:03 -03:00
William Desportes
2ab95fc47c
Fix CI after sql-parser version 4.5.0 
Signed-off-by: William Desportes <williamdes@wdes.fr>
 2020-01-09 20:04:39 +01:00
Isaac Bennetch
fa53b374ad Prepare for version 4.9.4 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2020-01-07 14:10:45 -05:00
Isaac Bennetch
ce10567b74 Merge remote-tracking branch 'security/fix/293-sql-injection' into QA_4_9 2020-01-07 14:07:17 -05:00
William Desportes
156231d5bf
Fix not isset $GLOBALS['dblist'] 
Signed-off-by: William Desportes <williamdes@wdes.fr>
 2020-01-06 15:22:35 +01:00
William Desportes
6c35ea3be7
Fix #15724 - Fix 2FA disabled 
Signed-off-by: William Desportes <williamdes@wdes.fr>
 2020-01-06 14:17:03 +01:00
William Desportes
c86acbf3ed
Fix sql injection in user exists request 
Signed-off-by: William Desportes <williamdes@wdes.fr>
 2020-01-01 13:55:06 +01:00