gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
103,105 Commits 12 Branches 481 Tags 2.4 GiB
2925d6468b
Commit Graph

103105 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michal Čihař
2925d6468b Merge pull request #29 from phpmyadmin/escape 
A better way of escaping
 2016-02-29 10:32:56 +01:00
Madhura Jayaratne
41c4e0214c Fix XSS in zoom search 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-02-29 12:26:44 +11:00
Madhura Jayaratne
4650ad7fbd A better way of escaping 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-02-29 12:14:46 +11:00
Madhura Jayaratne
cc55f44a4a Fix XSS in Central columns page 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-02-29 11:12:07 +11:00
Madhura Jayaratne
ab1283e836 Fix XSS in User accounts page 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-02-29 11:08:38 +11:00
Madhura Jayaratne
bcd4ce8cba Fix XSS in normalization.js 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-02-27 09:56:12 +11:00
Michal Čihař
9bce7dafaf Add changes for security issues 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-25 13:34:02 +01:00
Madhura Jayaratne
37c34d089a Escape selectors 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-02-25 13:09:32 +01:00
Madhura Jayaratne
f33a42f1da Fix XSS in normalization.js 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-02-25 13:08:43 +01:00
Michal Čihař
b3d36dc836 Merge pull request #23 from phpmyadmin/ssl-cert 
Bring back SSL certificate validation
 2016-02-25 13:03:30 +01:00
Michal Čihař
c842a0de92 Use correct headers for json data 
It was previously not marked as such what could potentially lead to
browsers doing some autodetection.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-25 12:33:56 +01:00
Michal Čihař
e65f375918 Merge branch 'MAINT_4_5_5' into MAINT_4_5_5-security 2016-02-25 12:31:50 +01:00
Michal Čihař
1297747a65 Fixed incorrect usage of SQL parser context in SQL export 
Fixes #12029

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-25 12:29:34 +01:00
Michal Čihař
57607e062b Add changelog for SQL parser update 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-25 12:28:24 +01:00
Michal Čihař
5fb33a7af4 Merge commit '2b1a68cc4eb935ef3df5c7401d0d1338df09bc72' into MAINT_4_5_5 2016-02-25 12:25:07 +01:00
Madhura Jayaratne
746240bd13 Fix XSS in normalization 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-02-25 12:19:26 +01:00
Michal Čihař
38fa119104 Urlencode hostname 
This can come from the HTTP header, so we need to be sure to sanitize
it.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-25 12:09:56 +01:00
Michal Čihař
983faa94f1 Fix XSS in database structure page 
Forward ported commit 90df124797

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-25 11:30:14 +01:00
Michal Čihař
e42b7e3aed Bring back SSL certificate validation 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-25 11:08:44 +01:00
Michal Čihař
16a6a02fca Avoid skipping the SSL certificate check in TCPDF 
This code is never used in phpMyAdmin, but we fix it just to avoid
potential security reports.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-25 10:34:01 +01:00
Michal Čihař
7877a9c008 Escape SQL query for inline editing 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-25 09:14:32 +01:00
Michal Čihař
3a6a9a807d Escape query when displaying 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-25 09:06:52 +01:00
Michal Čihař
9702259f81 Merge remote-tracking branch 'security/MAINT_4_5_4-security' into MAINT_4_5_5 2016-02-25 08:55:45 +01:00
Michal Čihař
67c5514e65 Merge branch 'MAINT_4_5_4' into MAINT_4_5_4-security 2016-02-25 08:53:52 +01:00
Dan Ungureanu
2b1a68cc4e Updates sql-parser to phpmyadmin/sql-parser@5c489d91f5 (v3.4.0). 
Fixes #11971. CREATE UNIQUE INDEX index type is not recognized by parser.
Fixes #11982. Row count wrong when grouping joined tables.
Fixes #12012. Column definition with default value and comment in CREATE TABLE expoerted faulty.
Fixes #12020. New statement but no delimiter and unexpected token with REPLACE.

Signed-off-by: Dan Ungureanu <udan1107@gmail.com>
 2016-02-24 20:41:54 +02:00
Isaac Bennetch
4b3c91b0f5 Version 4.5.5 release 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-02-22 09:56:51 -05:00
Isaac Bennetch
2e26e33671 Archive old changelog entries 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-02-22 09:53:25 -05:00
Isaac Bennetch
386c4bef20 Document Isaac as the new release manager 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-02-22 09:50:14 -05:00
Isaac Bennetch
fe5c54fadf Improve GPG examples using Isaac's key 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-02-19 21:30:11 -05:00
Michal Čihař
47ff669fdc Changelog entry for #11979 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-19 13:33:14 +01:00
Michal Čihař
968232a19d Merge pull request #11980 from madhuracj/bug11979 
Fix #11979 DECLARE not accepted as valid SQL
 2016-02-19 13:32:31 +01:00
Madhura Jayaratne
176d63f108 Fix #11979 DECLARE not accepted as valid SQL 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-02-18 15:55:56 +11:00
Atul Pratap Singh
2fdd232873 navigation.js registeronload getting fired on all node clicks, causing reload on all clicks 
Signed-off-by: Atul Pratap Singh <atulpratapsingh05@gmail.com>
 2016-02-16 23:58:21 +05:30
Michal Čihař
50af85cf34 Fix export of index comments in SQL 
Fixes #11968

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-16 10:20:09 +01:00
Madhura Jayaratne
36e3b337de ChangeLog entry for #11969 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-02-16 19:51:46 +11:00
Madhura Jayaratne
7881a461a3 Fix #11969 Missing confirmation while dropping a view in view_operations.php 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-02-16 19:47:12 +11:00
Michal Čihař
310fd4b2c1 Fix PHP error on loading invalid XML or ODS file 
Fixes #11967

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-16 09:00:32 +01:00
Madhura Jayaratne
a80124d6fd Merge branch 'QA_4_5' of github.com:phpmyadmin/phpmyadmin into QA_4_5 
Conflicts:
	ChangeLog
 2016-02-16 15:26:05 +11:00
Madhura Jayaratne
6e6e40a775 Fix #11964 Undefined index: TABLE_COMMENT in database structure page 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-02-16 15:24:12 +11:00
Michal Čihař
9204b85fa5 Move isStorageSupported to config.js 
This way it's included in the setup as well where it's used.

Fixes #11959

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-15 08:50:53 +01:00
Dan Ungureanu
85dd699364 Updated sql-parser to phpmyadmin/sql-parser@66b528dc0f (v3.3.1). 
Fixes #11956. unrecognized keyword interval
Fixes issues regarding field names and aliases.

Signed-off-by: Dan Ungureanu <udan1107@gmail.com>
 2016-02-12 23:45:41 +02:00
Michal Čihař
3bacb68305 Make sure format is always defined 
Fixes #11955

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-12 15:53:50 +01:00
Michal Čihař
073b85e1ee Avoid matching of date 
This causes random failures as time can be one second further when
generating output.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-12 15:43:43 +01:00
Michal Čihař
2b3ef7ad99 Improve test coverage for getting relative path 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-12 14:24:49 +01:00
Michal Čihař
9d1a5997cb Correctly handle failing case 
Issue #11953

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-12 14:24:42 +01:00
Michal Čihař
38aba0406f Use DIRECTORY_SEPARATOR 
The PATH_SEPARATOR is not the right variable...

Issue #11944

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-12 14:24:36 +01:00
Michal Čihař
387331ff34 Do not fail getting filename with open_basedir limitations 
The realpath() can also return FALSE, handle it gracefully.

Fixes #11953

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-12 13:58:44 +01:00
Michal Čihař
aebd3e11d9 Use PATH_SEPARATOR instead of own one 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-12 13:55:43 +01:00
Michal Čihař
53b1f9adcc Silent errors on checking for files and folders 
Fixes #11951
Fixes #11952

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-12 13:45:04 +01:00
Michal Čihař
e50a445d17 Define is_ajax_request earlier 
This fixes PHP warning on configuration errors.

Fixes #11950

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-12 12:43:30 +01:00