gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
105,642 Commits 12 Branches 481 Tags 2.4 GiB
28eb84ef43
Commit Graph

105642 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michal Čihař
28eb84ef43 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-22 15:48:09 +02:00
Michal Čihař
99903101d9 Enfornce numeric field length when creating table 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 15:47:38 +02:00
Michal Čihař
fd324e583e Revert "Move return to correct place" 
This reverts commit d93b873637.
 2016-07-22 14:44:39 +02:00
Michal Čihař
d93b873637 Move return to correct place 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:42:02 +02:00
Michal Čihař
024a924b38 Avoid calculating strlen twice 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:12:45 +02:00
Michal Čihař
9106b33933 Improve secrets splitting 
- ensure it has 16 bytes
- extends it by copying content if original is too short
- correctly handle corner cases (eg. 1 byte secret)

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:10:28 +02:00
Michal Čihař
643681ee68 Use consistent iv and encrypted text concatenation as other libs 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 13:46:51 +02:00
Michal Čihař
67b538efc3 Send standard set of HTTP headers on redirect 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 12:19:35 +02:00
Michal Čihař
5d1a6af96f Merge branch 'QA_4_6' into QA_4_6-security 2016-07-22 12:12:32 +02:00
Michal Čihař
1d70a1ba64 Allow only https outgoing links 
We no longer produce http links, so it's better to filter out these at
all levels.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 12:10:11 +02:00
Michal Čihař
23695db151 Change advisory rules links to https 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 12:08:00 +02:00
Michal Čihař
41e3db158f Properly escape NavigationTreeDbSeparator in queries 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 12:02:11 +02:00
Michal Čihař
ddeab2a11f Sanitize filename on SHP import 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 11:52:49 +02:00
Michal Čihař
d9f918c365 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-22 11:32:17 +02:00
Michal Čihař
48764f2260 Delete temporary file before reporting error 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 11:31:56 +02:00
Michal Čihař
bc6fbbe032 Update documentation copyright 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:38:38 +02:00
Michal Čihař
a32b3ceb6e Use single quotes 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:38:19 +02:00
Michal Čihař
3ee65fc8bf Use MAC to verify IV as well 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:29:46 +02:00
Michal Čihař
f693c103be Document 32 chars length for blowfish_secret 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:23:43 +02:00
Michal Čihař
2b7be93829 Improve Blowfish secret generation in setup script 
Now generates secret containing all printable ASCII chars, making it way
more random than with hex encoded random string.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:19:31 +02:00
Michal Čihař
f07fd90ee9 Document recommended length of 32 for blowfish_secret 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:14:02 +02:00
Michal Čihař
ef03daf658 Remove hashing of blowfish secret 
New code doesn't have problems with longer secrets.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:59:02 +02:00
Michal Čihař
d29df46b3a Do not generate too long session secret 
We need 16+16 bytes, generating 256 is not really needed.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:58:39 +02:00
Michal Čihař
e2a25d773d Merge pmaServer and pmaPass cookies 
This addresses several issues:

- makes server name encrypted and authenticated, so that it can not be
  tampered
- reduces cookie usage
- reduces overhead of encryption/authentication

The pmaUser cookie is still separate to avoid different lifetime
(pmaUser has month lifetime, while pmaAuth is session only by default).

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
2a2d865d50 Validate input data from cookies 
We expect strings only, so not accept anything else.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
f45b8cd49c Use different secret for MAC than encryption 
Generated using string splitting.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:29 +02:00
Kamyar Sec
69c38579f6 Translated using Weblate (Kurdish Sorani) 
Currently translated at 18.1% (582 of 3209 strings)

[CI skip]
 2016-07-22 09:45:21 +02:00
Michal Čihař
0fad7290c9 Escape database name in SQL query 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-19 09:20:15 +02:00
Michal Čihař
3ba8a026fc Use hash_hmac for MAC rather than plain SHA1 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:56:52 +02:00
Michal Čihař
67d6eeac42 Improve URL filtering in url.php 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:39:25 +02:00
Michal Čihař
7e6edaf756 Add tests for PMA_isAllowedDomain 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:36:55 +02:00
Michal Čihař
1543be7138 Use https to access phpmyadmin.net 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:22:33 +02:00
Michal Čihař
c0a05eced4 Merge branch 'QA_4_6-security' of github.com:phpmyadmin/phpmyadmin-security into QA_4_6-security 2016-07-18 15:57:22 +02:00
Michal Čihař
3a4172525f Merge branch 'QA_4_6' into QA_4_6-security 2016-07-18 15:56:38 +02:00
Michal Čihař
ff9291964c Update TCPDF to 6.2.12 
Changelog:

6.2.12 (2015-09-12)
	- fix composer package name to tecnickcom/tcpdf

6.2.11 (2015-08-02)
	- "PNG regression in 6.2.9 (they appear as their alpha channel)" was fixed.
	- "Encoded SRC URLs in <img> tags don't work anymore" was fixed.

6.2.10 (2015-07-28)
	- Minor mod to PNG parsing.
	- Make dependency on mcrypt optional.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 15:54:39 +02:00
Michal Čihař
d35c3d9ed5 Update ReCaptcha library to 1.1.2 
There should be no functional changes.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 15:51:44 +02:00
‫حمودي الجيلاني‬‎
0f1d629043 Translated using Weblate (Arabic) 
Currently translated at 34.2% (1098 of 3209 strings)

[CI skip]
 2016-07-16 18:44:09 +02:00
Isaac Bennetch
306c148098 Add missing escaping in navigation pane 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-07-13 15:33:48 -04:00
Michal Čihař
205694982b Fix exporting multiline comments 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 12:16:50 +02:00
Michal Čihař
af8385dc87 Fix tests for transformations 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 12:16:45 +02:00
Michal Čihař
42c868b691 HML encode embedded JSON data 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 11:33:35 +02:00
Michal Čihař
987cce0bcf Properly escape foreign key selection 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 11:10:44 +02:00
Michal Čihař
e4be768781 Ensure widht and height are integers 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:55:07 +02:00
Michal Čihař
dc899d8e75 Ensure widht and height are integers 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:52:28 +02:00
Michal Čihař
c3310536b2 Ensure widht and height are integers 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:49:47 +02:00
Michal Čihař
cc6853538c Properly escape error input in the message 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:46:14 +02:00
Michal Čihař
9f11a0e811 Add missing escaping in user group queries 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:40:13 +02:00
Michal Čihař
c3a3531b61 Escape HTML markup in transformation wrapper 
...in case content type is html.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:32:55 +02:00
Michal Čihař
9e3492730e Do not use empty MIME type 
This will turn on content sniffing in browser leading to unwanted
results.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:28:38 +02:00
Michal Čihař
7e510e8e92 Properly escape partition removal query 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:21:24 +02:00