gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
105,580 Commits 12 Branches 481 Tags 2.4 GiB
2f79bacefa
Commit Graph

15807 Commits

Author SHA1 Message Date
Michal Čihař
2f79bacefa Use phpseclib's Crypt module to generate encryption keys 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 14:06:39 +02:00
Michal Čihař
0d57c09bd5 Do not allow symlinks in UploadDir 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 12:50:36 +02:00
Michal Čihař
78bed3c444 Ensure last version is numeric 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 12:34:18 +02:00
Michal Čihař
6da13e2a1c Escape HTML in Mediawiki comments 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 12:30:58 +02:00
Michal Čihař
2ea0b722d7 Use _blank target instead of invalid _new 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 11:22:23 +02:00
Michal Čihař
3c06eede3f Add rel="noopener noreferrer" to all target="_blank" links 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 11:02:53 +02:00
Michal Čihař
0bf21ebf72 Use whitelist rather than blacklist for URL filtering 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 10:37:25 +02:00
Michal Čihař
5873af7d75 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-12 10:32:52 +02:00
Michal Čihař
b8b1bdd77e Include X-Robots-Tag header in responses 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 10:28:03 +02:00
Madhura Jayaratne
cbba4f4fdb Fix XSS in server_replication.php 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-07-12 11:49:53 +10:00
Michal Čihař
660e3a177f Remove debugging code 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-11 09:33:13 +02:00
Michal Čihař
de3181277e Include only relative path in backtrace 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-11 09:18:19 +02:00
Michal Čihař
fc6ef261eb Remove Swekey support 
It is buggy and their servers are no longer working.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-11 09:02:58 +02:00
Michal Čihař
6aacd7dcfe Make proxy IP parsing aware of multiple proxies 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-11 08:22:58 +02:00
Michal Čihař
1ed4007689 Properly escape MySQL status variables 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-10 18:07:59 +02:00
Michal Čihař
c0b2d56ac0 Use https for wiki links 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-09 09:12:43 +02:00
Michal Čihař
a97be3a604 Improve cookie encryption 
- use MAC to validate content before decryption
- create unique IV for every cookie

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-08 17:40:05 +02:00
Michal Čihař
7de139b90c Properly escape generated XML export 
Many fields could contain XML markup, so we need to ensure the generated
XML is valid.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-30 10:54:05 +02:00
Michal Čihař
2b5915ce7b Use phpMyAdmin version in PHP export header 
Using fixed 0.2b really makes no sense.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-30 10:27:26 +02:00
Michal Čihař
a82835cf09 Generate valid PHP code even when table/database name contains PHP markup 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-30 10:22:39 +02:00
Michal Čihař
5491d67fb5 Avoid possible path traversal using MySQL username 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-30 10:05:46 +02:00
Michal Čihař
f204208540 Move count() call outside loop 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-24 12:58:35 +02:00
Michal Čihař
52a01c4bfb Fix type conversion for numeric values 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-24 12:55:04 +02:00
Isaac Bennetch
58534ce2fc Prepare for 4.6.4-dev 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-06-23 02:40:42 -04:00
Isaac Bennetch
f2db92434b Fix merge conflicts 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-06-23 00:28:35 -04:00
Isaac Bennetch
4f57305eab Release 4.6.3 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-06-23 00:27:15 -04:00
Michal Čihař
615212a14d Do not allow javascript: links in transformation 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-22 13:28:07 +02:00
Michal Čihař
519e634a8d Merge branch 'QA_4_6' into QA_4_6-security 2016-06-22 13:10:55 +02:00
Michal Čihař
301e1b0f7d Fix adjusting privileges for tables/databases with quote in name 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-22 11:58:05 +02:00
Michal Čihař
e50e37b51d Properly escape database name when listing privileges 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-22 11:35:04 +02:00
Michal Čihař
36df83a97a Escape saved search name 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-22 11:00:14 +02:00
Michal Čihař
d95a4a2f96 Avoid undefined index in case of incomplete bookmark 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-22 10:57:11 +02:00
Michal Čihař
0b7416c5f4 Escape user group when displaying 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-22 10:53:46 +02:00
Michal Čihař
1cc7466db3 Quote delimiter before using preg_replace 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-20 12:16:03 +02:00
Michal Čihař
2674e503f2 Assign helperFunctions before doing extract 
This way we avoid possiblity of rewriting it from within the context.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-20 12:07:13 +02:00
Michal Čihař
4bcc606225 Always use delimiter not present in search expression 
This avoids need to figure out correct escaping in case delimiter is
present in the expression.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-20 12:03:44 +02:00
Michal Čihař
2f4950828e Update referrer <meta> to match current standards 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-20 10:47:30 +02:00
Michal Čihař
80cd2f448c Merge branch 'QA_4_6' into QA_4_6-security 2016-06-20 10:42:29 +02:00
Michal Čihař
1e5716cb96 Add referrer CSP and <meta> tag 
This avoids leaking Referer header in modern browsers.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-20 09:41:06 +02:00
Madhura Jayaratne
e7003792d9 Escape generated query 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-06-18 09:13:02 +10:00
Michal Čihař
be3ecbb4cc Simplify and cleanup transformation plugins 
Remove PMA_transformation_global_html_replace which makes the code only
more confusing.

Also add escaping to browse transformations.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 16:18:13 +02:00
Michal Čihař
1363ce5749 Merge branch 'QA_4_6' into QA_4_6-security 2016-06-17 14:27:02 +02:00
Michal Čihař
07216c9b8e Ensure that connection collation contains no HTML 
There is currently no MySQL collation which would do that, but just to
be safe.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:58:26 +02:00
Michal Čihař
04a72687f8 Add missing escaping 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:54:26 +02:00
Michal Čihař
58da975117 Add missing URL encoding 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:22:01 +02:00
Michal Čihař
a5950f9ecd Fix link to mariadb explain analyzer 
- avoid double urlencoding of the query
- properly escape html entities

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:05:11 +02:00
Michal Čihař
d1ec59f05f Ensure we have integer as offset 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:01:56 +02:00
Michal Čihař
009148075f PMA_jsFormat accepts only strings 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 11:43:51 +02:00
Michal Čihař
1d2e2be925 Merge branch 'QA_4_6' into QA_4_6-security 2016-06-17 11:20:18 +02:00
Michal Čihař
f5e8953356 Share backtrace processing for debugging and error reporting 
We want to achieve same thing in both cases - backtrace which is
stripped from sensitive information, has reasonable size and can be
read. Sharing the code will make it easier to fix possible problems and
also will make both cases behave consistent.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 11:18:39 +02:00