gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
83,389 Commits 12 Branches 481 Tags 2.4 GiB
47d00af08a
Commit Graph

9205 Commits

Author SHA1 Message Date
Michal Čihař
47d00af08a Move generator scripts out of the code 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:38:30 +02:00
Michal Čihař
eec14404a7 Remove option to show phpinfo() ($cfg['ShowPhpInfo']) 
This is really more a PHP debugging feature than anything related to
phpMyAdmin. If user wants to debug, it's as simple a creating file with
one line of php code.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 11:03:53 +02:00
Michal Čihař
ac703223e9 Ensure GIS point coordinates are numeric 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 10:24:35 +02:00
Michal Čihař
4d15f6b131 Fix random invocation 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 09:05:12 +02:00
Michal Čihař
d03954bf9c Enable LOAD DATA LOCAL INFILE only when needed 
There is no need to have this feature allowed for normal SQL queries, it
can lead to leaking sensitive files from the web server. It's enough to
enable it only in LDI import plugin, where we control what queries are
executed.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 08:59:02 +02:00
Michal Čihař
ae8693db68 Backport cookie encryption from 4.6 branch 
- Use hash_hmac for MAC rather than plain SHA1
- Use different secret for MAC than encryption
- Merge pmaServer and pmaPass cookies
- Document 32 chars length for blowfish_secret

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:40:02 +02:00
Michal Čihař
85e1d6ec80 Send standard set of HTTP headers on redirect 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 12:22:53 +02:00
Michal Čihař
378c3820bf Sanitize filename on SHP import 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 11:49:35 +02:00
Michal Čihař
6f8eb0993d Delete temporary file before reporting error 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 11:31:09 +02:00
Michal Čihař
e8c5cab3c1 Improve URL filtering in url.php 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:41:04 +02:00
Michal Čihař
714818f3ad Use https to access phpmyadmin.net 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:20:34 +02:00
Michal Čihař
ab26a8fe97 Fix exporting multiline comments 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 12:13:28 +02:00
Michal Čihař
0f87b73ae2 HML encode embedded JSON data 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 11:31:55 +02:00
Michal Čihař
04156efeb0 Ensure widht and height are integers 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:53:51 +02:00
Michal Čihař
31546255f3 Ensure widht and height are integers 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:51:53 +02:00
Michal Čihař
56e1350118 Properly handle newlines in SQL comments 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 09:58:14 +02:00
Michal Čihař
7f7a8ac467 Do not try to create non existing classes 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 09:48:21 +02:00
Michal Čihař
8ac57b1281 Correctly escape MySQL username in queries 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 17:35:56 +02:00
Michal Čihař
fec9b98a22 Ensure page number is integer 
Even if somebody decides to change configuration storage structure.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 16:49:15 +02:00
Michal Čihař
a3953f88ef Escape suggested database name 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 16:40:36 +02:00
Michal Čihař
80c93025a7 Validate serialized data before unserializing 
We need only strings, integers or arrays, so there is no need to
unserialize strings containing any complex types.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 16:25:20 +02:00
Michal Čihař
8e0918cc41 Sanitize MySQL host name before connecting 
It can contain p: prefix which we don't want to honor.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 15:10:59 +02:00
Michal Čihař
14fd275811 Use iframe sandbox for rendering HTML in transformation 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 14:13:14 +02:00
Michal Čihař
c8297b4718 Use phpseclib's Crypt module to generate encryption keys 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 14:02:26 +02:00
Michal Čihař
ab05803a42 Do not allow symlinks in UploadDir 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 12:47:35 +02:00
Michal Čihař
e9a4de70a7 Escape HTML in Mediawiki comments 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 12:29:35 +02:00
Michal Čihař
0a4cdc25f1 Use _blank target instead of invalid _new 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 11:20:16 +02:00
Michal Čihař
63a5fdaa21 Add rel="noopener noreferrer" to all target="_blank" links 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 10:59:38 +02:00
Michal Čihař
a416cbe6c7 Use whitelist rather than blacklist for URL filtering 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 10:36:33 +02:00
Madhura Jayaratne
6cbbcdb719 Fix XSS in server_replication.php 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-07-12 12:05:07 +10:00
Michal Čihař
dc25189741 Fix syntax error in older PHP versions 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-11 09:36:56 +02:00
Michal Čihař
ee6557a689 Remove debugging code 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-11 09:31:55 +02:00
Michal Čihař
ec2bd5d84c Remove Swekey support 
It is buggy and their servers are no longer working.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-11 08:57:21 +02:00
Michal Čihař
4440790902 Make proxy IP parsing aware of multiple proxies 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-11 08:22:32 +02:00
Michal Čihař
a9005b20bc Properly escape MySQL status variables 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-10 18:06:25 +02:00
Michal Čihař
cf2e0afdb7 Use https for wiki links 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-09 09:10:57 +02:00
Michal Čihař
95b7b7d6dd Improve cookie encryption 
- use MAC to validate content before decryption
- create unique IV for every cookie

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-08 17:54:25 +02:00
Michal Čihař
59e0f3dee4 Properly escape generated XML export 
Many fields could contain XML markup, so we need to ensure the generated
XML is valid.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-30 10:59:44 +02:00
Michal Čihař
34a1cebf76 Generate valid PHP code even when table/database name contains PHP markup 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-30 10:26:29 +02:00
Michal Čihař
c6cfb58834 Avoid possible path traversal using MySQL username 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-30 10:04:46 +02:00
Michal Čihař
01673e94dd Fix type conversion for numeric values 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-24 12:53:39 +02:00
Isaac Bennetch
83416df64f Release 4.0.10.16 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-06-23 00:01:11 -04:00
Michal Čihař
b04150e30e Do not allow javascript: links in transformation 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-22 13:26:03 +02:00
Michal Čihař
9b6f64b8b9 Properly escape zoom search column type 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-22 11:11:47 +02:00
Michal Čihař
351019c074 Quote delimiter before using preg_replace 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-20 12:13:24 +02:00
Michal Čihař
8c336ba285 Update referrer <meta> to match current standards 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-20 10:46:51 +02:00
Michal Čihař
e13f9862ef Backport Content-Security-Policy from latest release 
This way it will work well on current browsers.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-20 09:44:52 +02:00
Michal Čihař
32875196f9 Add referrer CSP and <meta> tag 
This avoids leaking Referer header in modern browsers.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-20 09:38:52 +02:00
Michal Čihař
288efea5b4 Simplify and cleanup transformation plugins 
Remove PMA_transformation_global_html_replace which makes the code only
more confusing.

Also add escaping to browse transformations.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 16:19:31 +02:00
Michal Čihař
975089b8c3 Properly escape translated string 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:48:05 +02:00