gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
105,675 Commits 12 Branches 481 Tags 2.4 GiB
471c3377c1
Commit Graph

105675 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michal Čihař
471c3377c1 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-27 16:31:43 +02:00
Michal Čihař
af337d2054 Use https to access phpmyadmin.net 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-27 16:29:08 +02:00
Michal Čihař
870ca1cc7a Use https for wiki links 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-27 16:28:07 +02:00
Michal Čihař
774f0c1fef Merge branch 'QA_4_6' into QA_4_6-security 2016-07-27 16:26:57 +02:00
Michal Čihař
a39b9909bb Change url to https 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-27 16:25:48 +02:00
Michal Čihař
94f4a5439c Remove confusing mentions about InnoDB plugin 
It is integrated in MySQL for years.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-27 16:22:12 +02:00
Michal Čihař
f727695dd3 Use new URL for phpsysinfo 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-27 16:21:00 +02:00
Michal Čihař
c90967071a Do not allow to set too long password 
We do not accept password longer than 256 chars, so do not accept it on
password change as well.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 17:04:26 +02:00
Michal Čihař
cc9d0f128c Merge branch 'QA_4_6' into QA_4_6-security 2016-07-26 16:47:44 +02:00
Michal Čihař
16c4ca0daa Properly escape configuration parameters when rendering 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:47:01 +02:00
Michal Čihař
77a4d6ed95 Move generator scripts out of the code 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:39:40 +02:00
Michal Čihař
9f64b31fcc Merge branch 'QA_4_6' into QA_4_6-security 2016-07-26 16:33:39 +02:00
Michal Čihař
5f0267979f Fix typos in changelog 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:33:20 +02:00
Michal Čihař
99492bf42a Merge branch 'QA_4_6' into QA_4_6-security 2016-07-26 16:29:07 +02:00
Michal Čihař
64f033d3b9 Tighthen control on PHP sessions and session cookies 
- use only cookies for session
- use http only cookies
- disable transparent session IDs

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:23:51 +02:00
Michal Čihař
6c95b73f90 Do not append session IDs to all URLs in redirect 
There is no need to do that as we rely on session cookies anyway. Also
appending sesson ID to external URLs is not a good idea.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:20:04 +02:00
Michal Čihař
c868852ae4 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-26 16:06:29 +02:00
Michal Čihař
53af6a5699 Simplify session handling on possibly long requests 
We really do not have to reconfigure sessions on restarting them.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:04:56 +02:00
Michal Čihař
3ec8ba8693 Merge pull request #179 from phpmyadmin/remove-phpinfo 
Remove option to show phpinfo() ($cfg['ShowPhpInfo'])
 2016-07-26 11:01:11 +02:00
Deven Bansod
25182fb6c3 Fix #12391 : Message with 'Change password successfully' displayed, but does not take effect 
Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-07-26 00:25:08 +05:30
Deven Bansod
7d0ce4bb8b ChangeLog entry for #12394 
Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-07-23 15:42:08 +05:30
Deven Bansod
622a6f2389 Fix #12394 : Create view should require a view name 
Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-07-23 15:07:54 +05:30
Michal Čihař
e67e69229a Remove option to show phpinfo() ($cfg['ShowPhpInfo']) 
This is really more a PHP debugging feature than anything related to
phpMyAdmin. If user wants to debug, it's as simple a creating file with
one line of php code.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 11:31:46 +02:00
Michal Čihař
754c1c987b Properly mark requests to lint as AJAX request 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 11:26:10 +02:00
Michal Čihař
d3a91549be Remove file path from the session error message 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 10:55:25 +02:00
Michal Čihař
b932b94577 Ensure GIS point coordinates are numeric 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 10:22:56 +02:00
Michal Čihař
f0f8f2b65e Escape routine privileges listing 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 09:38:44 +02:00
Michal Čihař
1e6b740e6f Enable LOAD DATA LOCAL INFILE only when needed 
There is no need to have this feature allowed for normal SQL queries, it
can lead to leaking sensitive files from the web server. It's enough to
enable it only in LDI import plugin, where we control what queries are
executed.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 09:02:31 +02:00
Michal Čihař
835958af31 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-22 16:50:12 +02:00
Michal Čihař
623f5b4621 Remove no longer used code 
It was used by old charts code to download charts.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 16:48:33 +02:00
Michal Čihař
61150656df Fixed invalid Content-Length in some HTTP responses 
Use strlen for calculating HTTP response size, we're interested in bytes
not utf-8 chars.

Issue #12397

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 16:41:51 +02:00
Michal Čihař
76e87c3e33 Do not use mb_strlen on data we know are bytes 
Issue #12397

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 16:39:12 +02:00
Michal Čihař
ff1016e504 Limit maximal numver of fields to 4096 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 16:02:58 +02:00
Michal Čihař
28eb84ef43 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-22 15:48:09 +02:00
Michal Čihař
99903101d9 Enfornce numeric field length when creating table 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 15:47:38 +02:00
Michal Čihař
fd324e583e Revert "Move return to correct place" 
This reverts commit d93b873637.
 2016-07-22 14:44:39 +02:00
Michal Čihař
d93b873637 Move return to correct place 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:42:02 +02:00
Michal Čihař
024a924b38 Avoid calculating strlen twice 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:12:45 +02:00
Michal Čihař
9106b33933 Improve secrets splitting 
- ensure it has 16 bytes
- extends it by copying content if original is too short
- correctly handle corner cases (eg. 1 byte secret)

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:10:28 +02:00
Michal Čihař
643681ee68 Use consistent iv and encrypted text concatenation as other libs 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 13:46:51 +02:00
Michal Čihař
67b538efc3 Send standard set of HTTP headers on redirect 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 12:19:35 +02:00
Michal Čihař
5d1a6af96f Merge branch 'QA_4_6' into QA_4_6-security 2016-07-22 12:12:32 +02:00
Michal Čihař
1d70a1ba64 Allow only https outgoing links 
We no longer produce http links, so it's better to filter out these at
all levels.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 12:10:11 +02:00
Michal Čihař
23695db151 Change advisory rules links to https 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 12:08:00 +02:00
Michal Čihař
41e3db158f Properly escape NavigationTreeDbSeparator in queries 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 12:02:11 +02:00
Michal Čihař
ddeab2a11f Sanitize filename on SHP import 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 11:52:49 +02:00
Michal Čihař
d9f918c365 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-22 11:32:17 +02:00
Michal Čihař
48764f2260 Delete temporary file before reporting error 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 11:31:56 +02:00
Michal Čihař
bc6fbbe032 Update documentation copyright 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:38:38 +02:00
Michal Čihař
a32b3ceb6e Use single quotes 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:38:19 +02:00