gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
105,721 Commits 12 Branches 481 Tags 2.4 GiB
493ece49ee
Commit Graph

15895 Commits

Author SHA1 Message Date
Michal Čihař
493ece49ee Merge branch 'QA_4_6' into QA_4_6-security 2016-08-02 08:45:16 +02:00
Michal Čihař
38b73180fd Fix password change in cookie auth 
We can not set same cookie twice, so we have to avoid sending auth
cookie when we're about to change the password.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-02 08:42:44 +02:00
Michal Čihař
d621855169 Merge branch 'QA_4_6' into QA_4_6-security 2016-08-01 11:06:57 +02:00
Deven Bansod
2c5541a94b Fix #12399: Adding index to table shows wrong top navigation 
If the SQL query analyzing sets the $table value to '',
don't update the original value

Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-08-01 11:41:44 +05:30
Deven Bansod
9f1f055177 Fix #12425 : Removed double usage of same var name; Fix typo introduced in 545db4a4 
Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-08-01 09:42:56 +05:30
Michal Čihař
1f595e37e0 Move hostname sanitization to correct place 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-29 14:09:37 +02:00
Michal Čihař
1221b5ea4a Merge branch 'QA_4_6' into QA_4_6-security 2016-07-29 14:05:48 +02:00
Michal Čihař
b27020f108 Avoid typecasting to float when not needed 
Fixes #12303

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-29 14:03:13 +02:00
Michal Čihař
74016bceea Merge pull request #12416 from rpv-tomsk/fix-replication-status 
Fix replication status output in Server > Databases
 2016-07-29 10:46:11 +02:00
Pavel Rochnyack
b705dc5f67 Fix replication status output in Server > Databases 
Broken by 829a84b46e refactoring.
Incorrectly fixed in c4710c3e1d

Signed-off-by: Pavel Rochnyack <pavel2000@ngs.ru>
 2016-07-29 04:43:08 +01:00
Michal Čihař
263318850c Merge pull request #12409 from rpv-tomsk/restore-overhead-column 
Restore Overhead column in Server > Databases > Enable Statistics.
 2016-07-28 11:05:47 +02:00
Michal Čihař
8dcaae5f83 Do not try to wrap output in case response handling is disabled 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-28 10:50:35 +02:00
Michal Čihař
4caa90a832 Escape string when showing confirmation message 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-28 10:30:49 +02:00
Michal Čihař
d31ff5a1e7 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-28 09:43:26 +02:00
Michal Čihař
257e65ba9f Use https for outbound links where applicable 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-28 09:19:13 +02:00
Michal Čihař
4072c1d29a Use example.com for sample test urls 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-28 09:12:01 +02:00
Pavel Rochnyack
c310304712 Restore Overhead column in Server > Databases > Enable Statistics. 
(Was removed in 582b02262b)

Signed-off-by: Pavel Rochnyack <pavel2000@ngs.ru>
 2016-07-27 19:56:43 +01:00
Michal Čihař
af337d2054 Use https to access phpmyadmin.net 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-27 16:29:08 +02:00
Michal Čihař
870ca1cc7a Use https for wiki links 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-27 16:28:07 +02:00
Michal Čihař
774f0c1fef Merge branch 'QA_4_6' into QA_4_6-security 2016-07-27 16:26:57 +02:00
Michal Čihař
a39b9909bb Change url to https 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-27 16:25:48 +02:00
Michal Čihař
94f4a5439c Remove confusing mentions about InnoDB plugin 
It is integrated in MySQL for years.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-27 16:22:12 +02:00
Michal Čihař
f727695dd3 Use new URL for phpsysinfo 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-27 16:21:00 +02:00
Michal Čihař
cc9d0f128c Merge branch 'QA_4_6' into QA_4_6-security 2016-07-26 16:47:44 +02:00
Michal Čihař
16c4ca0daa Properly escape configuration parameters when rendering 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:47:01 +02:00
Michal Čihař
77a4d6ed95 Move generator scripts out of the code 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:39:40 +02:00
Michal Čihař
99492bf42a Merge branch 'QA_4_6' into QA_4_6-security 2016-07-26 16:29:07 +02:00
Michal Čihař
64f033d3b9 Tighthen control on PHP sessions and session cookies 
- use only cookies for session
- use http only cookies
- disable transparent session IDs

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:23:51 +02:00
Michal Čihař
6c95b73f90 Do not append session IDs to all URLs in redirect 
There is no need to do that as we rely on session cookies anyway. Also
appending sesson ID to external URLs is not a good idea.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:20:04 +02:00
Michal Čihař
c868852ae4 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-26 16:06:29 +02:00
Michal Čihař
53af6a5699 Simplify session handling on possibly long requests 
We really do not have to reconfigure sessions on restarting them.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:04:56 +02:00
Deven Bansod
25182fb6c3 Fix #12391 : Message with 'Change password successfully' displayed, but does not take effect 
Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-07-26 00:25:08 +05:30
Michal Čihař
e67e69229a Remove option to show phpinfo() ($cfg['ShowPhpInfo']) 
This is really more a PHP debugging feature than anything related to
phpMyAdmin. If user wants to debug, it's as simple a creating file with
one line of php code.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 11:31:46 +02:00
Michal Čihař
d3a91549be Remove file path from the session error message 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 10:55:25 +02:00
Michal Čihař
b932b94577 Ensure GIS point coordinates are numeric 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 10:22:56 +02:00
Michal Čihař
f0f8f2b65e Escape routine privileges listing 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 09:38:44 +02:00
Michal Čihař
1e6b740e6f Enable LOAD DATA LOCAL INFILE only when needed 
There is no need to have this feature allowed for normal SQL queries, it
can lead to leaking sensitive files from the web server. It's enough to
enable it only in LDI import plugin, where we control what queries are
executed.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 09:02:31 +02:00
Michal Čihař
835958af31 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-22 16:50:12 +02:00
Michal Čihař
61150656df Fixed invalid Content-Length in some HTTP responses 
Use strlen for calculating HTTP response size, we're interested in bytes
not utf-8 chars.

Issue #12397

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 16:41:51 +02:00
Michal Čihař
76e87c3e33 Do not use mb_strlen on data we know are bytes 
Issue #12397

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 16:39:12 +02:00
Michal Čihař
ff1016e504 Limit maximal numver of fields to 4096 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 16:02:58 +02:00
Michal Čihař
28eb84ef43 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-22 15:48:09 +02:00
Michal Čihař
99903101d9 Enfornce numeric field length when creating table 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 15:47:38 +02:00
Michal Čihař
fd324e583e Revert "Move return to correct place" 
This reverts commit d93b873637.
 2016-07-22 14:44:39 +02:00
Michal Čihař
d93b873637 Move return to correct place 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:42:02 +02:00
Michal Čihař
024a924b38 Avoid calculating strlen twice 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:12:45 +02:00
Michal Čihař
9106b33933 Improve secrets splitting 
- ensure it has 16 bytes
- extends it by copying content if original is too short
- correctly handle corner cases (eg. 1 byte secret)

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:10:28 +02:00
Michal Čihař
643681ee68 Use consistent iv and encrypted text concatenation as other libs 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 13:46:51 +02:00
Michal Čihař
5d1a6af96f Merge branch 'QA_4_6' into QA_4_6-security 2016-07-22 12:12:32 +02:00
Michal Čihař
1d70a1ba64 Allow only https outgoing links 
We no longer produce http links, so it's better to filter out these at
all levels.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 12:10:11 +02:00