gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
136,386 Commits 12 Branches 481 Tags 2.4 GiB
26d7ba4417
Commit Graph

33 Commits

Author SHA1 Message Date
XananasX7
26d7ba4417
security: add allowed_classes => false to Core::safeUnserialize() as defence-in-depth 
Core::safeUnserialize() validates the serialized string with a custom parser
before calling unserialize(). The parser only permits scalar types (s, b, i,
d, N) and plain arrays (a), blocking object tokens ('O:' / 'C:'). However,
the final unserialize() call does not pass allowed_classes, which means a
parser bypass or edge-case in the manual tokeniser could still allow object
instantiation.

Adding allowed_classes => false ensures that even if the manual validator is
somehow bypassed (e.g., by a future PHP serialization format change or a
subtle parser bug), unserialize() itself will refuse to instantiate PHP
objects — providing a second layer of protection.

Signed-off-by: El Mehdi Abenhazou <mehdiananas007@gmail.com>
 2026-06-03 10:41:11 -03:00
William Desportes
bc057eb914
Merge #20127 - Replace getRealSize with ini_parse_quantity 
Pull-request: #20127
Fixes: #20115
Signed-off-by: William Desportes <williamdes@wdes.fr>
 2026-02-21 15:02:50 +01:00
Kamil Tekiela
bb384a2274 Replace getRealSize with ini_parse_quantity 
Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>
 2026-02-18 00:04:49 +00:00
Maurício Meneghini Fauth
ce3db158d7
Remove method Core::previewSQL() 
Inlines it to remove the ResponseRenderer dependency.

Signed-off-by: Maurício Meneghini Fauth <mauricio@mfauth.net>
 2026-02-13 21:22:15 -03:00
Moaead Yahya
ceb905f70c
Fix deprecated DateTimeInterface::RFC7231 constant for PHP 8.5 
Replace the deprecated DateTimeInterface::RFC7231 constant with its
equivalent format string 'D, d M Y H:i:s \G\M\T' to avoid deprecation
warnings on PHP 8.5.

Fixes #20037

Signed-off-by: moaead <165377585+moaead@users.noreply.github.com>
Signed-off-by: Moaead Yahya <moaead@gmail.com>
 2026-01-21 09:54:36 -03:00
Maurício Meneghini Fauth
efa8ce431b
Introduce support for PSR-20 ClockInterface 
Related to https://github.com/phpmyadmin/phpmyadmin/pull/20030

Signed-off-by: Maurício Meneghini Fauth <mauricio@mfauth.net>
 2026-01-19 19:22:53 -03:00
Maurício Meneghini Fauth
d152e71161
Test Core::getNoCacheHeaders() with a frozen clock 
This avoids the tests randomly failing when current time differs.

Also changes the format from RFC 1123 to RFC 7231.

Signed-off-by: Maurício Meneghini Fauth <mauricio@mfauth.net>
 2026-01-18 22:16:52 -03:00
Kamil Tekiela
eba21b4558 Merge switch cases 
Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>
 2026-01-14 14:24:16 +00:00
Kamil Tekiela
45a0d4725e In AuthenticationCookie 
Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>
 2026-01-09 00:16:37 +00:00
Maurício Meneghini Fauth
9c576fcc9c
Refactor Twig extensions to use Twig's AttributeExtension 
This allows to remove most extensions.

Signed-off-by: Maurício Meneghini Fauth <mauricio@mfauth.net>
 2025-07-08 13:23:34 -03:00
Kamil Tekiela
a687b114cc Create addNotice and addUserError 
Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>
 2025-01-29 18:33:36 +00:00
Maurício Meneghini Fauth
8a6f2ea4ca
Merge branch 'QA_5_2' 
Signed-off-by: Maurício Meneghini Fauth <mauricio@mfauth.net>
 2025-01-27 17:08:29 -03:00
Kamil Tekiela
bfb5838b4e Remove $GLOBALS['query'] 
Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>
 2024-12-29 15:03:42 +00:00
Maurício Meneghini Fauth
5548f8fe5b
Replace lang global var with Current::$lang prop 
Signed-off-by: Maurício Meneghini Fauth <mauricio@mfauth.net>
 2024-12-24 12:01:03 -03:00
Kamil Tekiela
2756f27249 Add dedicated methods for is_setup 
Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>
 2024-12-04 23:16:15 +00:00
Maurício Meneghini Fauth
dc1bd60dd1
Fix boolean usage of the return value of preg_match() 
preg_match() and preg_match_all() returns the number of pattern matches
(which might be zero), or false on failure. However, preg_match() always
returns 1 when a pattern is matched as it stops searching after the
first match.

- https://www.php.net/manual/en/function.preg-match.php
- https://www.php.net/manual/en/function.preg-match-all.php

Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2024-07-13 14:43:05 -03:00
Kamil Tekiela
ae239083e2 Remove last of register globals 
Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>
 2024-03-15 21:10:32 +01:00
Kamil Tekiela
54b5464ec2 Replace function casts with normal casts 
Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>
 2024-03-03 15:07:57 +01:00
Kamil Tekiela
8e4443b17b
Applying suggestions from static analysis tools (#19013) 
* Drop array keys from lists

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>

* Import UrlTest

When it doesn't exist in Prod, the code will still work the same.
Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>

* Drop redundant return [];

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>

* Fix object access checks

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>

* Use strict comparison

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>

* Int keys should be specified as integers

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>

* Use empty string check instead of strlen

Potential null deprecations are replaced with loose condition.

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>

* Use stripos instead of *substr

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>

* Simplify substr's 3rd param

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>

* Remove unnecessary defaults

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>

* Replace isZeroBasedArray with array_is_list

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>

* Simplify texEscape()

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>

* Simplify exportZeroBasedArray()

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>

* Replace for loop with array_diff

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>

* Replace for with foreach

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>

* Remove nullable param in backquoteCompat

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>

* Use null-coalescing operator

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>

* Inline $result variable

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>

* Turn $event into a constant

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>

* Move selectDb outside the loop

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>

* Fix code style order of operation

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>

* Remove unnecessary isset argument

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>

* Remove line break

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>

* Use foreach instead of for

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>

---------

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>
 2024-02-27 12:29:02 -03:00
Maurício Meneghini Fauth
a858f08fec Move error related classes to the Error namespace 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2024-01-05 13:28:23 -03:00
Maurício Meneghini Fauth
74054cb4d3
Extract container builder logic to ContainerBuilder class 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2023-12-22 19:22:18 -03:00
Maurício Meneghini Fauth
033dcf21e0
Change Core::getContainerBuilder return to ContainerInterface 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2023-12-21 16:46:11 -03:00
Kamil Tekiela
2ab75067f8 Simplify checkPageValidity() 
Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>
 2023-12-07 17:11:49 +01:00
Kamil Tekiela
4fb335e960 Make in_array strict 
Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>
 2023-12-07 17:11:48 +01:00
Kamil Tekiela
e90cfe584f Change method name 
This method doesn't sanitize anything. While it does format the message into HTML, it doesn't remove or clean anything. What it does is replace BB codes into HTML.

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>
 2023-12-02 00:10:16 +01:00
Maurício Meneghini Fauth
54631fa63b
Merge pull request #18809 from kamil-tekiela/Simplify-code 
Simplify code
 2023-11-28 13:41:33 -03:00
Kamil Tekiela
51f9c749ad Simplify code 
Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>
 2023-11-28 14:42:37 +01:00
Kamil Tekiela
d3ee2d07b8 Remove dead code 
Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>
 2023-11-28 13:17:01 +01:00
Maurício Meneghini Fauth
09e7604754
Remove containerBuilder global variable 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2023-11-03 19:37:14 -03:00
Maurício Meneghini Fauth
1514117a47
Remove ContainerBuilder::setParameter() calls 
These parameters are only written, but never used.

Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2023-11-03 18:56:40 -03:00
Maurício Meneghini Fauth
87c494fa5f
Rename ./libraries directory to ./app 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2023-10-24 16:58:48 -03:00
Maurício Meneghini Fauth
1ae995b9f1
Refactor the Core::getenv() method 
Renames it to getEnv() and adds unit tests for it.

Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2023-09-28 16:09:46 -03:00
Maurício Meneghini Fauth
c2955cc2b2
Rename the directory libraries/classes/ to src/ 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
 2023-08-30 15:59:28 -03:00