gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
105,876 Commits 12 Branches 481 Tags 2.4 GiB
14616cbcdf
Commit Graph

1326 Commits

Author SHA1 Message Date
Michal Čihař
cbd6137c03 Avoid double escaping of built in transformation URLs 
We do already escape them in the tranformation, so avoid doing that
before.

Issue #12483

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-24 11:48:48 +02:00
Michal Čihař
6faa1fe46a Add rel="noopener noreferrer" to all external target="_blank" links 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 17:35:20 +02:00
Michal Čihař
7898060916 Ensure PmaAbsoluteUri ends with / 
This was probably most frequest user error we want to fix.

Issue #12374

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-17 15:37:20 +02:00
Michal Čihař
01b9db6b1c Rename getCookiePath() to getRootPath() 
It is not used only for cookies, so generic name makes more sense.

Issue #12374

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-17 15:35:15 +02:00
Michal Čihař
83476322ba Use PmaAbsolueUri for cookie path 
Issue #12374

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-17 15:35:15 +02:00
Isaac Bennetch
0f6b76b578 Merge remote-tracking branch 'security/QA_4_6-security' into QA_4_6 2016-08-16 16:34:37 -04:00
Michal Čihař
d09e5438c1 Remove unsued code for generating events 
This is no longer used, so there is no need to support it.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-03 11:36:41 +02:00
Michal Čihař
1221b5ea4a Merge branch 'QA_4_6' into QA_4_6-security 2016-07-29 14:05:48 +02:00
Michal Čihař
263318850c Merge pull request #12409 from rpv-tomsk/restore-overhead-column 
Restore Overhead column in Server > Databases > Enable Statistics.
 2016-07-28 11:05:47 +02:00
Michal Čihař
d31ff5a1e7 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-28 09:43:26 +02:00
Michal Čihař
4072c1d29a Use example.com for sample test urls 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-28 09:12:01 +02:00
Pavel Rochnyack
c310304712 Restore Overhead column in Server > Databases > Enable Statistics. 
(Was removed in 582b02262b)

Signed-off-by: Pavel Rochnyack <pavel2000@ngs.ru>
 2016-07-27 19:56:43 +01:00
Michal Čihař
af337d2054 Use https to access phpmyadmin.net 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-27 16:29:08 +02:00
Michal Čihař
99492bf42a Merge branch 'QA_4_6' into QA_4_6-security 2016-07-26 16:29:07 +02:00
Michal Čihař
6c95b73f90 Do not append session IDs to all URLs in redirect 
There is no need to do that as we rely on session cookies anyway. Also
appending sesson ID to external URLs is not a good idea.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:20:04 +02:00
Michal Čihař
9106b33933 Improve secrets splitting 
- ensure it has 16 bytes
- extends it by copying content if original is too short
- correctly handle corner cases (eg. 1 byte secret)

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:10:28 +02:00
Michal Čihař
643681ee68 Use consistent iv and encrypted text concatenation as other libs 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 13:46:51 +02:00
Michal Čihař
5d1a6af96f Merge branch 'QA_4_6' into QA_4_6-security 2016-07-22 12:12:32 +02:00
Michal Čihař
1d70a1ba64 Allow only https outgoing links 
We no longer produce http links, so it's better to filter out these at
all levels.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 12:10:11 +02:00
Michal Čihař
3ee65fc8bf Use MAC to verify IV as well 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:29:46 +02:00
Michal Čihař
ef03daf658 Remove hashing of blowfish secret 
New code doesn't have problems with longer secrets.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:59:02 +02:00
Michal Čihař
d29df46b3a Do not generate too long session secret 
We need 16+16 bytes, generating 256 is not really needed.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:58:39 +02:00
Michal Čihař
e2a25d773d Merge pmaServer and pmaPass cookies 
This addresses several issues:

- makes server name encrypted and authenticated, so that it can not be
  tampered
- reduces cookie usage
- reduces overhead of encryption/authentication

The pmaUser cookie is still separate to avoid different lifetime
(pmaUser has month lifetime, while pmaAuth is session only by default).

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
2a2d865d50 Validate input data from cookies 
We expect strings only, so not accept anything else.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
3ba8a026fc Use hash_hmac for MAC rather than plain SHA1 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:56:52 +02:00
Michal Čihař
1543be7138 Use https to access phpmyadmin.net 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:22:33 +02:00
Michal Čihař
af8385dc87 Fix tests for transformations 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 12:16:45 +02:00
Michal Čihař
2ef4fe3d84 Use iframe sandbox for rendering HTML in transformation 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 14:15:30 +02:00
Michal Čihař
2ea0b722d7 Use _blank target instead of invalid _new 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 11:22:23 +02:00
Michal Čihař
3b0115a321 Adjust tests to recent changes 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 11:17:47 +02:00
Michal Čihař
fc6ef261eb Remove Swekey support 
It is buggy and their servers are no longer working.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-11 09:02:58 +02:00
Michal Čihař
a97be3a604 Improve cookie encryption 
- use MAC to validate content before decryption
- create unique IV for every cookie

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-08 17:40:05 +02:00
Michal Čihař
7de139b90c Properly escape generated XML export 
Many fields could contain XML markup, so we need to ensure the generated
XML is valid.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-30 10:54:05 +02:00
Michal Čihař
bd2080c40a Adjust test to not use HTML escaping layer 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-30 10:52:49 +02:00
Michal Čihař
99d7407aa2 Fix PHP export tests 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-30 10:30:35 +02:00
Michal Čihař
be3ecbb4cc Simplify and cleanup transformation plugins 
Remove PMA_transformation_global_html_replace which makes the code only
more confusing.

Also add escaping to browse transformations.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 16:18:13 +02:00
Michal Čihař
4a9da1df40 Adjust tests to new error reporting handling of objects 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 11:23:20 +02:00
Michal Čihař
8a142aba73 Adjust tests to new behavior 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-15 11:45:16 +02:00
Michal Čihař
79a34ff94c Calculate table size as integer 
It should be big enough on 64-bit systems, so avoid rounding issues
which double calculations can bring.

Fixes #12303

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-14 08:28:26 +02:00
Michal Čihař
763683b4fe Fix test expectations 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-09 09:40:16 +02:00
Michal Čihař
4fd2709650 Avoid rewriting PHP stack frames 
Surprisingly PHP stack frames are passed as references to the error
handling code, thus changing value there leads to changing value in the
executed code.

With MySQL issuing warning about incompatible version (different runtime
library than compile time), handling this warning rewrites current stack
frame and the mysql_real_connect later sees parameters as processed by
Error class for display.

We now create copy of the stacktrace to avoid this.

Fixes #12279

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-06 13:52:32 +02:00
Michal Čihař
d78e173b34 Do not use dirname for calculating cookie path 
It is wrong for this purpose as on Windows this uses \ for both
separating parts and generating result. This fixed calculation of cookie
path on Windows.

Fixes #12249

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-27 11:11:56 +02:00
Michal Čihař
e72c1d4da9 Add more tests for getCookiePath (issue #12249) 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-26 18:04:23 +02:00
Michal Čihař
adfd5a22b9 Avoid double redirects in signon auth on logout 
Also adjusts tests to no longer rely on runkit.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 13:23:16 +02:00
Michal Čihař
11eb574242 Improve handling of logout 
- add separate script for handling logout
- no longer require old_usr for all authentication methods
  (this avoids potential information leak)
- require valid token for logout

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 13:02:21 +02:00
Michal Čihař
381c80dda4 Split test cases to avoid huge test methods 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 12:35:13 +02:00
Michal Čihař
21db724c85 Remove need for having define for test 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 12:09:36 +02:00
Michal Čihař
1c081f9087 Fix test to not depend on variables set elsewhere 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 11:47:40 +02:00
Michal Čihař
ec1c32fd09 Fix tested url 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-17 11:59:04 +02:00
Michal Čihař
574fee04f7 Fix test failures after changing links 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-17 10:44:54 +02:00