gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
83,430 Commits 12 Branches 481 Tags 2.4 GiB
1f859b1b15
Commit Graph

83430 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michal Čihař
1f859b1b15 Merge pull request #13098 from schoonc/fix-search-new-php-gettext 
Fix database search with newer php-gettext
 2017-03-20 16:38:13 +01:00
Michal Čihař
ebb97a3960 Remove no longer working test 
We no longer directly process value from cookie here, so the test can no
longer work.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2017-03-20 16:37:04 +01:00
Сорокин Александр
f9a74deeb6 Fix database search with newer php-gettext 
Backport from 4.6.6 (see #12881)

Signed-off-by: Сорокин Александр <ale10059@yandex.ru>
 2017-03-18 14:21:36 +03:00
Isaac Bennetch
3d8b97b255 ChangeLog for 4.0.10.19 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2017-01-23 12:59:50 -05:00
Michal Čihař
567b27487e Prepare changelog for 4.0.10.19 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2017-01-21 16:42:07 +01:00
Michal Čihař
4b5f3f9a12 Merge changes from php-gettext 1.0.12 
This ensures that parameter to select_string is numeric, avoiding code
injection through it.

Our code is not vulnerable as we do not pass user supplied values to
this function, this fix is included only to be closer to upstream.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2017-01-17 13:34:53 +01:00
Michal Čihař
88cc11ab13 Disable setup if configuration already exists 
The setup allows to figure out quite a lot about system and network, so
it's safer to block access to it once phpMyAdmin has been configured.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2017-01-07 11:00:16 +01:00
Michal Čihař
801485a7f4 Remove setup download/load/delete features 
This removes risk of third party manipulating with the configuration as
there was race condition between editing and using the file.

Downloading the file should not be big hassle and this really makes the
whole setup a bit simpler.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2017-01-07 10:59:39 +01:00
Michal Čihař
f8ad5bd759 Do not allow arbitrary connection in replication setup without AllowArbitraryServer 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-21 11:07:00 +01:00
Michal Čihař
8a0816266c Do not provide fallback to cookie for font size 
* This should be already handled by Config class
* Injecting cookie value to CSS could be security risk

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-08 11:26:51 +01:00
Michal Čihař
00607e6041 Whitespace cleanup 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-08 11:19:12 +01:00
Michal Čihař
3d230b6ab7 Avoid infinite recursion on goto 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-08 11:18:51 +01:00
Michal Čihař
7fe97a1f3c Avoid using REQUEST_URI in form action 
It's really not necessary here and might cause redirection issues.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-08 10:51:48 +01:00
Michal Čihař
afe84645f2 Quote table name for use in regexp 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-08 10:30:17 +01:00
Michal Čihař
69b4b5c7f5 Remove wrong changelog entry 
This was not yet fixed.

Issue #12481

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-01 10:54:31 +01:00
Isaac Bennetch
8783113cec 4.0.10.18 release and ChangeLog 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-11-24 10:54:44 -05:00
Deven Bansod
6703597772 Handle multiple :p while sanitizing MySQL hosts 
Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-11-08 10:14:23 +05:30
Deven Bansod
337b38044d Manage new-lines and extra whitespaces properly 
Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-10-11 10:43:22 +05:30
Deven Bansod
54875fffc1 Manage new-lines and extra whitespaces properly 
Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-10-11 10:35:47 +05:30
Michal Čihař
be5196ba44 Merge branch 'MAINT_4_0_10-security' of github.com:phpmyadmin/phpmyadmin-security into MAINT_4_0_10-security 2016-10-04 13:18:42 +02:00
Michal Čihař
5e108a340f Correctly parse string length when checking serialized data 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-10-04 13:17:07 +02:00
Deven Bansod
773f126c89 Don't assume the default arg_separator in URL 
Respect the value for arg_separator.input too.

Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-10-02 10:43:40 +05:30
Michal Čihař
63b7f6c0a9 Use hash_equals when comparing IPv6 allow rules 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-09-02 15:09:29 +02:00
Michal Čihař
af7c589391 Stricter URL validation 
- do not use empty() as empty('0') is true
- do not lowercase the strings, use them as they are
- lowercase all domains in our codebase
- do not allow to specify port

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-09-02 15:02:44 +02:00
Michal Čihař
0c3dfd186c Fix possible DOS on too big skip value 
- loop only as long as long we have data to skip
- convert skip parameter to integer

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-09-02 13:42:15 +02:00
Michal Čihař
d37abc38da Do not show warning about short blowfish_secret if none is set 
With empty blowfish_secret user would always get both warnings...

Fixes #12485

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-24 12:04:45 +02:00
Michal Čihař
67700620db Limit maximal number of rows in QBE 
User would be lost in them anyway by that count and it prevents DOS.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 16:55:48 +02:00
Michal Čihař
b2605ebba6 Fix hash validation 
- use copy of hash to avoid race condition
- stricter regex to match whole string

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 11:25:21 +02:00
Michal Čihař
096856c70c Stricter validation of NavigationLogoLink 
It now has to be URL including scheme. Otherwise it's not really
possible to validate it for being just http/https.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 11:18:21 +02:00
Michal Čihař
c2f7a898dd Store copy of hash instead of working on live object 
This avoids possible race conditions when doing the checks.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 11:05:56 +02:00
Michal Čihař
f2add98bd9 Strip path even if openbasedir restrictions apply 
This really should not be the case here as what we get here is code
executed by PHP, so it should have already passed openbasedir
restrictions.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 10:14:01 +02:00
Michal Čihař
6117ad5cef Use hash_equals for checking username 
This makes the comparison happen in constant time and makes it
impossible to use it to guess stored usernames.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 09:39:22 +02:00
Michal Čihař
58245cb1cc Use hash_equals for comparing username in allow/deny rules 
The comparison should happen in constant time to avoid possible leak of
usernames in rules.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 09:15:34 +02:00
Michal Čihař
285e5623b6 Strip null bytes from MySQL username 
In old PHP versions this could lead to allow/deny rules bypass.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 09:10:55 +02:00
Isaac Bennetch
5ba96c8804 Release 4.0.10.17 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-08-16 16:33:47 -04:00
Michal Čihař
12db0baeae Move hostname sanitization to correct place 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-29 14:10:07 +02:00
Michal Čihař
2922cb7c70 Do not try to wrap output in case response handling is disabled 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-28 10:53:37 +02:00
Michal Čihař
533ffa4942 Add login and token validation to version_check 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-28 10:53:31 +02:00
Michal Čihař
126321da37 Escape string when showing confirmation message 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-28 10:31:30 +02:00
Michal Čihař
b0e66715ba Do not allow to set too long password 
We do not accept password longer than 256 chars, so do not accept it on
password change as well.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 17:03:00 +02:00
Michal Čihař
262aa8ec73 Fix password change with cookie auth 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 17:02:13 +02:00
Michal Čihař
47d00af08a Move generator scripts out of the code 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:38:30 +02:00
Michal Čihař
eec14404a7 Remove option to show phpinfo() ($cfg['ShowPhpInfo']) 
This is really more a PHP debugging feature than anything related to
phpMyAdmin. If user wants to debug, it's as simple a creating file with
one line of php code.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 11:03:53 +02:00
Michal Čihař
ac703223e9 Ensure GIS point coordinates are numeric 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 10:24:35 +02:00
Michal Čihař
4d15f6b131 Fix random invocation 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 09:05:12 +02:00
Michal Čihař
d03954bf9c Enable LOAD DATA LOCAL INFILE only when needed 
There is no need to have this feature allowed for normal SQL queries, it
can lead to leaking sensitive files from the web server. It's enough to
enable it only in LDI import plugin, where we control what queries are
executed.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 08:59:02 +02:00
Michal Čihař
f261abbdf9 Remove no longer used code 
It was used by old charts code to download charts.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 16:46:32 +02:00
Michal Čihař
5a28b63f9c Limit maximal numver of fields to 4096 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 16:00:23 +02:00
Michal Čihař
ae8693db68 Backport cookie encryption from 4.6 branch 
- Use hash_hmac for MAC rather than plain SHA1
- Use different secret for MAC than encryption
- Merge pmaServer and pmaPass cookies
- Document 32 chars length for blowfish_secret

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:40:02 +02:00
Michal Čihař
85e1d6ec80 Send standard set of HTTP headers on redirect 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 12:22:53 +02:00