gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
83,420 Commits 12 Branches 481 Tags 2.4 GiB
00607e6041
Commit Graph

83420 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michal Čihař
00607e6041 Whitespace cleanup 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-08 11:19:12 +01:00
Michal Čihař
3d230b6ab7 Avoid infinite recursion on goto 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-08 11:18:51 +01:00
Michal Čihař
7fe97a1f3c Avoid using REQUEST_URI in form action 
It's really not necessary here and might cause redirection issues.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-08 10:51:48 +01:00
Michal Čihař
afe84645f2 Quote table name for use in regexp 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-08 10:30:17 +01:00
Michal Čihař
69b4b5c7f5 Remove wrong changelog entry 
This was not yet fixed.

Issue #12481

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-01 10:54:31 +01:00
Isaac Bennetch
8783113cec 4.0.10.18 release and ChangeLog 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-11-24 10:54:44 -05:00
Deven Bansod
6703597772 Handle multiple :p while sanitizing MySQL hosts 
Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-11-08 10:14:23 +05:30
Deven Bansod
337b38044d Manage new-lines and extra whitespaces properly 
Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-10-11 10:43:22 +05:30
Deven Bansod
54875fffc1 Manage new-lines and extra whitespaces properly 
Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-10-11 10:35:47 +05:30
Michal Čihař
be5196ba44 Merge branch 'MAINT_4_0_10-security' of github.com:phpmyadmin/phpmyadmin-security into MAINT_4_0_10-security 2016-10-04 13:18:42 +02:00
Michal Čihař
5e108a340f Correctly parse string length when checking serialized data 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-10-04 13:17:07 +02:00
Deven Bansod
773f126c89 Don't assume the default arg_separator in URL 
Respect the value for arg_separator.input too.

Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-10-02 10:43:40 +05:30
Michal Čihař
63b7f6c0a9 Use hash_equals when comparing IPv6 allow rules 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-09-02 15:09:29 +02:00
Michal Čihař
af7c589391 Stricter URL validation 
- do not use empty() as empty('0') is true
- do not lowercase the strings, use them as they are
- lowercase all domains in our codebase
- do not allow to specify port

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-09-02 15:02:44 +02:00
Michal Čihař
0c3dfd186c Fix possible DOS on too big skip value 
- loop only as long as long we have data to skip
- convert skip parameter to integer

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-09-02 13:42:15 +02:00
Michal Čihař
d37abc38da Do not show warning about short blowfish_secret if none is set 
With empty blowfish_secret user would always get both warnings...

Fixes #12485

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-24 12:04:45 +02:00
Michal Čihař
67700620db Limit maximal number of rows in QBE 
User would be lost in them anyway by that count and it prevents DOS.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 16:55:48 +02:00
Michal Čihař
b2605ebba6 Fix hash validation 
- use copy of hash to avoid race condition
- stricter regex to match whole string

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 11:25:21 +02:00
Michal Čihař
096856c70c Stricter validation of NavigationLogoLink 
It now has to be URL including scheme. Otherwise it's not really
possible to validate it for being just http/https.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 11:18:21 +02:00
Michal Čihař
c2f7a898dd Store copy of hash instead of working on live object 
This avoids possible race conditions when doing the checks.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 11:05:56 +02:00
Michal Čihař
f2add98bd9 Strip path even if openbasedir restrictions apply 
This really should not be the case here as what we get here is code
executed by PHP, so it should have already passed openbasedir
restrictions.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 10:14:01 +02:00
Michal Čihař
6117ad5cef Use hash_equals for checking username 
This makes the comparison happen in constant time and makes it
impossible to use it to guess stored usernames.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 09:39:22 +02:00
Michal Čihař
58245cb1cc Use hash_equals for comparing username in allow/deny rules 
The comparison should happen in constant time to avoid possible leak of
usernames in rules.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 09:15:34 +02:00
Michal Čihař
285e5623b6 Strip null bytes from MySQL username 
In old PHP versions this could lead to allow/deny rules bypass.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 09:10:55 +02:00
Isaac Bennetch
5ba96c8804 Release 4.0.10.17 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-08-16 16:33:47 -04:00
Michal Čihař
12db0baeae Move hostname sanitization to correct place 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-29 14:10:07 +02:00
Michal Čihař
2922cb7c70 Do not try to wrap output in case response handling is disabled 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-28 10:53:37 +02:00
Michal Čihař
533ffa4942 Add login and token validation to version_check 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-28 10:53:31 +02:00
Michal Čihař
126321da37 Escape string when showing confirmation message 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-28 10:31:30 +02:00
Michal Čihař
b0e66715ba Do not allow to set too long password 
We do not accept password longer than 256 chars, so do not accept it on
password change as well.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 17:03:00 +02:00
Michal Čihař
262aa8ec73 Fix password change with cookie auth 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 17:02:13 +02:00
Michal Čihař
47d00af08a Move generator scripts out of the code 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:38:30 +02:00
Michal Čihař
eec14404a7 Remove option to show phpinfo() ($cfg['ShowPhpInfo']) 
This is really more a PHP debugging feature than anything related to
phpMyAdmin. If user wants to debug, it's as simple a creating file with
one line of php code.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 11:03:53 +02:00
Michal Čihař
ac703223e9 Ensure GIS point coordinates are numeric 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 10:24:35 +02:00
Michal Čihař
4d15f6b131 Fix random invocation 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 09:05:12 +02:00
Michal Čihař
d03954bf9c Enable LOAD DATA LOCAL INFILE only when needed 
There is no need to have this feature allowed for normal SQL queries, it
can lead to leaking sensitive files from the web server. It's enough to
enable it only in LDI import plugin, where we control what queries are
executed.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 08:59:02 +02:00
Michal Čihař
f261abbdf9 Remove no longer used code 
It was used by old charts code to download charts.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 16:46:32 +02:00
Michal Čihař
5a28b63f9c Limit maximal numver of fields to 4096 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 16:00:23 +02:00
Michal Čihař
ae8693db68 Backport cookie encryption from 4.6 branch 
- Use hash_hmac for MAC rather than plain SHA1
- Use different secret for MAC than encryption
- Merge pmaServer and pmaPass cookies
- Document 32 chars length for blowfish_secret

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:40:02 +02:00
Michal Čihař
85e1d6ec80 Send standard set of HTTP headers on redirect 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 12:22:53 +02:00
Michal Čihař
378c3820bf Sanitize filename on SHP import 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 11:49:35 +02:00
Michal Čihař
6f8eb0993d Delete temporary file before reporting error 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 11:31:09 +02:00
Michal Čihař
e8c5cab3c1 Improve URL filtering in url.php 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:41:04 +02:00
Michal Čihař
714818f3ad Use https to access phpmyadmin.net 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:20:34 +02:00
Michal Čihař
ab26a8fe97 Fix exporting multiline comments 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 12:13:28 +02:00
Michal Čihař
0f87b73ae2 HML encode embedded JSON data 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 11:31:55 +02:00
Michal Čihař
04156efeb0 Ensure widht and height are integers 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:53:51 +02:00
Michal Čihař
31546255f3 Ensure widht and height are integers 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:51:53 +02:00
Michal Čihař
09a427b288 Escape HTML markup in transformation wrapper 
...in case content type is html.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:34:19 +02:00
Michal Čihař
8f3ee9f9db Do not use empty MIME type 
This will turn on content sniffing in browser leading to unwanted
results.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:27:43 +02:00