gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
107,484 Commits 12 Branches 481 Tags 2.4 GiB
1aee86a4fe
Commit Graph

323 Commits

Author SHA1 Message Date
Michal Čihař
e6abff8a7f Be consistent in filename sanitization 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-10-10 17:20:13 +02:00
Michal Čihař
3546bed47e Avoid using mb_strlen for checking whether string is empty 
Using strlen produces same results here, just way faster.

Fixes #12397

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-09-16 10:29:21 +02:00
Sudheesh Singanamalla
2833c6b324 Fixes #12509 Removes unused function PMA_addJSVar 
Signed-off-by: Sudheesh Singanamalla <sudheesh1995@outlook.com>
 2016-09-01 12:28:16 +05:30
Michal Čihař
9c5528b4cb Merge branch 'QA_4_6' 2016-08-18 17:09:24 +02:00
Michal Čihař
c44f5ab080 Always use UTC time in HTTP headers 
Using timezones in this context can cause problem when DST changes
apply.

Also this can be information leak of server timezone.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 17:07:00 +02:00
Michal Čihař
23e01d306a Merge branch 'QA_4_6' 2016-08-17 15:38:22 +02:00
Michal Čihař
01b9db6b1c Rename getCookiePath() to getRootPath() 
It is not used only for cookies, so generic name makes more sense.

Issue #12374

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-17 15:35:15 +02:00
Michal Čihař
311be7515c Use https when available 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-17 13:17:41 +02:00
Michal Čihař
aebbb31aad Merge branch 'master' into master-security 2016-07-29 14:08:23 +02:00
Michal Čihař
f5015c2ea3 Merge branch 'QA_4_6-security' into master-security 2016-07-26 16:31:21 +02:00
Michal Čihař
99492bf42a Merge branch 'QA_4_6' into QA_4_6-security 2016-07-26 16:29:07 +02:00
Michal Čihař
22c4ede46d Merge branch 'QA_4_6' 2016-07-26 16:26:57 +02:00
Michal Čihař
6c95b73f90 Do not append session IDs to all URLs in redirect 
There is no need to do that as we rely on session cookies anyway. Also
appending sesson ID to external URLs is not a good idea.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:20:04 +02:00
Michal Čihař
2adf1ca83e Merge branch 'QA_4_6-security' into master-security 2016-07-22 11:35:14 +02:00
Michal Čihař
3ba8a026fc Use hash_hmac for MAC rather than plain SHA1 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:56:52 +02:00
Michal Čihař
67d6eeac42 Improve URL filtering in url.php 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:39:25 +02:00
Michal Čihař
dfa389aa5a Merge branch 'QA_4_6-security' into master-security 2016-07-12 16:29:26 +02:00
Michal Čihař
ba072e42dc Validate serialized data before unserializing 
We need only strings, integers or arrays, so there is no need to
unserialize strings containing any complex types.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 16:29:11 +02:00
Michal Čihař
5299b36983 Merge branch 'QA_4_6-security' into master-security 2016-07-12 15:15:15 +02:00
Michal Čihař
767195e197 Sanitize MySQL host name before connecting 
It can contain p: prefix which we don't want to honor.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 15:14:57 +02:00
Michal Čihař
152386627a Merge branch 'QA_4_6-security' into master-security 2016-07-11 09:34:05 +02:00
Michal Čihař
660e3a177f Remove debugging code 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-11 09:33:13 +02:00
Michal Čihař
23c011df36 Move PMA_getIp to core 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-11 08:36:55 +02:00
Michal Čihař
791bdafcdd Merge branch 'QA_4_6-security' into master-security 2016-06-17 16:24:39 +02:00
Michal Čihař
27caf5b46b Improve detection of script name 
In case PHP_SELF was not set by server, we used REQUEST_URI, which might
embed PATH_INFO as well. However we really need to know the path without
it, so let's strip it as well.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 09:35:56 +02:00
Michal Čihař
a6af9fb407 Merge branch 'QA_4_6' 2016-06-15 11:43:18 +02:00
Michal Čihař
9e0a321551 Canonicalize redirect URL 
We provide absolute path now to avoid problems with URLs like
/phpmyadmin/index.php/.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-15 11:42:45 +02:00
Michal Čihař
e3d650a2bb Merge branch 'QA_4_6' 2016-05-23 13:05:01 +02:00
Michal Čihař
cf97a33ffb Ignore args in the debug backtrace 
This heavily reduces memory usage and also avoids potential information
leak.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 12:01:02 +02:00
Michal Čihař
42f94b05e2 Merge branch 'QA_4_6' 2016-05-23 09:40:56 +02:00
Michal Čihař
5fc8020c5b Ensure links from setup go through url.php 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 09:40:17 +02:00
Michal Čihař
98ad7d1ba4 Merge branch 'QA_4_6' 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-17 10:42:37 +02:00
Michal Čihař
0982a6a424 Better laben Percona 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-17 10:39:33 +02:00
Michal Čihař
b25d847b3b Remove not used oubbound URLs 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-17 10:38:58 +02:00
Michal Čihař
d248d8d83d Remove link to no longer maintained blog 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-17 10:35:56 +02:00
Michal Čihař
521b79d0d7 Replace non working pbxt link with link to MariaDB knowledgebase 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-17 10:34:52 +02:00
Michal Čihař
02c7df74bf Add mariadb.com domain to whitelist 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-17 10:33:53 +02:00
Michal Čihař
95f2d15b4f Merge branch 'QA_4_6' 2016-05-17 10:12:04 +02:00
Michal Čihař
3771852471 Use https when linking to php.net 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-17 10:10:13 +02:00
Michal Čihař
5231649343 Merge commit 'cda4290749f10ed686bfb466b415e5e3a1c04fea' 2016-05-09 20:09:36 +02:00
Michal Čihař
59e56bd63a Pass link to demo server through url.php 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-04-29 15:36:54 +02:00
Michal Čihař
8326aaebe5 Pass links to external sites in changelog through url.php 
This avoids possible information disclossure in the links (token).

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-04-29 15:35:02 +02:00
Michal Čihař
4dce6ec2db Merge branch 'QA_4_6' 2016-03-01 15:39:45 +01:00
Michal Čihař
02aa0729dc Make PMA_fatalError work even early 
The messaging framework can not make assumptions about available objects
as this doesn't have to be satisfied in early PMA_fatalError case.

Issue #12056

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-03-01 15:36:05 +01:00
Durgesh
6650f7b07d Refactor text sanitization and javascript escaping, Issue #11989, #11988 
Signed-off-by: Durgesh <007durgesh219@gmail.com>
 2016-02-22 14:45:19 +05:30
Durgesh
0b64827930 Refactored url parmeters generating, Issue #11990 
Signed-off-by: Durgesh <007durgesh219@gmail.com>
 2016-02-22 14:36:41 +05:30
Michal Čihař
9a9586515b Merge branch 'composer' 2016-02-22 08:29:57 +01:00
Michal Čihař
559e5a0f16 Remove no loger second loading of gettext 
We now load it very early.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-22 08:05:49 +01:00
Piyush
1d3f8ed037 remove_msie9 (fix_11987) 
Signed-off-by: Piyush Agrawal <poush12@gmail.com>
 2016-02-20 12:26:54 +05:30
Madhura Jayaratne
af6dc40d30 Add missing doc comments 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-02-19 22:51:14 +11:00