gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
107,484 Commits 12 Branches 481 Tags 2.4 GiB
1aee86a4fe
Commit Graph

1084 Commits

Author SHA1 Message Date
Deven Bansod
6ed1da5a45 Merge branch 'QA_4_6' 2016-10-14 09:59:32 +05:30
Deven Bansod
41b07b2009 Use IF EXISTS with DROP Database to prevent error while importing 
Fix #12634

Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-10-14 09:54:50 +05:30
Michal Čihař
6cbcc319b1 Fix function name 
Fixes #12505

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-09-26 13:41:33 +02:00
Michal Čihař
a2ab6a04af Define namespace as constant 
Also use PHP 5.5 compatible way of defining static variable.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-09-16 13:21:20 +02:00
Michal Čihař
1d09172f14 Turn OpenDocument wrapper to a class 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-09-16 11:49:53 +02:00
Michal Čihař
3546bed47e Avoid using mb_strlen for checking whether string is empty 
Using strlen produces same results here, just way faster.

Fixes #12397

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-09-16 10:29:21 +02:00
Michal Čihař
6e3d38a1d3 Use strlen for calculating string index 
Issue #12397

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-09-16 10:18:46 +02:00
Michal Čihař
e52ceecb3d Ensure font size is integer, we do further calculations with it 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-09-05 18:46:01 +02:00
Michal Čihař
31f6d76405 Merge branch 'QA_4_6' 2016-08-24 11:55:10 +02:00
Michal Čihař
48b6dd58d8 Use one code to check external links 
There is no good reason to duplicate the check in several places.

Fixes #12479

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-24 11:38:03 +02:00
Michal Čihař
46b329c32b Merge branch 'QA_4_6' 2016-08-18 17:37:34 +02:00
Michal Čihař
6faa1fe46a Add rel="noopener noreferrer" to all external target="_blank" links 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 17:35:20 +02:00
Michal Čihař
1cd7b757bf Merge branch 'master' into master-security 2016-08-02 08:45:23 +02:00
Michal Čihař
493ece49ee Merge branch 'QA_4_6' into QA_4_6-security 2016-08-02 08:45:16 +02:00
Michal Čihař
696eeb463d Merge branch 'QA_4_6' 2016-08-02 08:43:22 +02:00
Michal Čihař
38b73180fd Fix password change in cookie auth 
We can not set same cookie twice, so we have to avoid sending auth
cookie when we're about to change the password.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-02 08:42:44 +02:00
Michal Čihař
360b8e8a11 Merge branch 'master' into master-security 2016-07-28 09:44:08 +02:00
Michal Čihař
d31ff5a1e7 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-28 09:43:26 +02:00
Michal Čihař
a2e6c78fb7 Use https for outbound links where applicable 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-28 09:41:52 +02:00
Michal Čihař
6d8e1d7935 Merge branch 'QA_4_6' 2016-07-28 09:38:08 +02:00
Michal Čihař
257e65ba9f Use https for outbound links where applicable 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-28 09:19:13 +02:00
Michal Čihař
4072c1d29a Use example.com for sample test urls 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-28 09:12:01 +02:00
Michal Čihař
d15490088c Merge branch 'QA_4_6' 2016-07-27 16:30:47 +02:00
Michal Čihař
af337d2054 Use https to access phpmyadmin.net 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-27 16:29:08 +02:00
Michal Čihař
870ca1cc7a Use https for wiki links 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-27 16:28:07 +02:00
Michal Čihař
690202368b Merge branch 'QA_4_6-security' into master-security 2016-07-26 16:47:52 +02:00
Michal Čihař
cc9d0f128c Merge branch 'QA_4_6' into QA_4_6-security 2016-07-26 16:47:44 +02:00
Michal Čihař
e14c334d7a Merge branch 'QA_4_6' 2016-07-26 16:47:33 +02:00
Michal Čihař
16c4ca0daa Properly escape configuration parameters when rendering 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:47:01 +02:00
Michal Čihař
0aa3b23b41 Merge branch 'QA_4_6-security' into master-security 2016-07-26 16:39:59 +02:00
Michal Čihař
77a4d6ed95 Move generator scripts out of the code 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:39:40 +02:00
Michal Čihař
ec7a4cfc82 Merge branches 'QA_4_6-security' and 'master' into master-security 2016-07-22 16:51:22 +02:00
Michal Čihař
835958af31 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-22 16:50:12 +02:00
Michal Čihař
7de035439d Merge branch 'QA_4_6' 2016-07-22 16:42:58 +02:00
Michal Čihař
61150656df Fixed invalid Content-Length in some HTTP responses 
Use strlen for calculating HTTP response size, we're interested in bytes
not utf-8 chars.

Issue #12397

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 16:41:51 +02:00
Michal Čihař
76e87c3e33 Do not use mb_strlen on data we know are bytes 
Issue #12397

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 16:39:12 +02:00
Michal Čihař
f72572708f Merge branch 'QA_4_6-security' into master-security 2016-07-22 14:42:09 +02:00
Michal Čihař
024a924b38 Avoid calculating strlen twice 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:12:45 +02:00
Michal Čihař
9106b33933 Improve secrets splitting 
- ensure it has 16 bytes
- extends it by copying content if original is too short
- correctly handle corner cases (eg. 1 byte secret)

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:10:28 +02:00
Michal Čihař
643681ee68 Use consistent iv and encrypted text concatenation as other libs 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 13:46:51 +02:00
Michal Čihař
52586bd949 Merge branch 'QA_4_6-security' into master-security 2016-07-22 11:53:23 +02:00
Michal Čihař
ddeab2a11f Sanitize filename on SHP import 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 11:52:49 +02:00
Michal Čihař
2adf1ca83e Merge branch 'QA_4_6-security' into master-security 2016-07-22 11:35:14 +02:00
Michal Čihař
48764f2260 Delete temporary file before reporting error 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 11:31:56 +02:00
Michal Čihař
3ee65fc8bf Use MAC to verify IV as well 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:29:46 +02:00
Michal Čihař
ef03daf658 Remove hashing of blowfish secret 
New code doesn't have problems with longer secrets.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:59:02 +02:00
Michal Čihař
d29df46b3a Do not generate too long session secret 
We need 16+16 bytes, generating 256 is not really needed.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:58:39 +02:00
Michal Čihař
e2a25d773d Merge pmaServer and pmaPass cookies 
This addresses several issues:

- makes server name encrypted and authenticated, so that it can not be
  tampered
- reduces cookie usage
- reduces overhead of encryption/authentication

The pmaUser cookie is still separate to avoid different lifetime
(pmaUser has month lifetime, while pmaAuth is session only by default).

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
2a2d865d50 Validate input data from cookies 
We expect strings only, so not accept anything else.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
f45b8cd49c Use different secret for MAC than encryption 
Generated using string splitting.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:29 +02:00