gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
105,721 Commits 12 Branches 481 Tags 2.4 GiB
493ece49ee
Commit Graph

992 Commits

Author SHA1 Message Date
Michal Čihař
493ece49ee Merge branch 'QA_4_6' into QA_4_6-security 2016-08-02 08:45:16 +02:00
Michal Čihař
38b73180fd Fix password change in cookie auth 
We can not set same cookie twice, so we have to avoid sending auth
cookie when we're about to change the password.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-02 08:42:44 +02:00
Michal Čihař
d31ff5a1e7 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-28 09:43:26 +02:00
Michal Čihař
257e65ba9f Use https for outbound links where applicable 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-28 09:19:13 +02:00
Michal Čihař
4072c1d29a Use example.com for sample test urls 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-28 09:12:01 +02:00
Michal Čihař
af337d2054 Use https to access phpmyadmin.net 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-27 16:29:08 +02:00
Michal Čihař
870ca1cc7a Use https for wiki links 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-27 16:28:07 +02:00
Michal Čihař
cc9d0f128c Merge branch 'QA_4_6' into QA_4_6-security 2016-07-26 16:47:44 +02:00
Michal Čihař
16c4ca0daa Properly escape configuration parameters when rendering 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:47:01 +02:00
Michal Čihař
77a4d6ed95 Move generator scripts out of the code 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:39:40 +02:00
Michal Čihař
835958af31 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-22 16:50:12 +02:00
Michal Čihař
61150656df Fixed invalid Content-Length in some HTTP responses 
Use strlen for calculating HTTP response size, we're interested in bytes
not utf-8 chars.

Issue #12397

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 16:41:51 +02:00
Michal Čihař
76e87c3e33 Do not use mb_strlen on data we know are bytes 
Issue #12397

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 16:39:12 +02:00
Michal Čihař
024a924b38 Avoid calculating strlen twice 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:12:45 +02:00
Michal Čihař
9106b33933 Improve secrets splitting 
- ensure it has 16 bytes
- extends it by copying content if original is too short
- correctly handle corner cases (eg. 1 byte secret)

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:10:28 +02:00
Michal Čihař
643681ee68 Use consistent iv and encrypted text concatenation as other libs 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 13:46:51 +02:00
Michal Čihař
ddeab2a11f Sanitize filename on SHP import 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 11:52:49 +02:00
Michal Čihař
48764f2260 Delete temporary file before reporting error 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 11:31:56 +02:00
Michal Čihař
3ee65fc8bf Use MAC to verify IV as well 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:29:46 +02:00
Michal Čihař
ef03daf658 Remove hashing of blowfish secret 
New code doesn't have problems with longer secrets.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:59:02 +02:00
Michal Čihař
d29df46b3a Do not generate too long session secret 
We need 16+16 bytes, generating 256 is not really needed.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:58:39 +02:00
Michal Čihař
e2a25d773d Merge pmaServer and pmaPass cookies 
This addresses several issues:

- makes server name encrypted and authenticated, so that it can not be
  tampered
- reduces cookie usage
- reduces overhead of encryption/authentication

The pmaUser cookie is still separate to avoid different lifetime
(pmaUser has month lifetime, while pmaAuth is session only by default).

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
2a2d865d50 Validate input data from cookies 
We expect strings only, so not accept anything else.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
f45b8cd49c Use different secret for MAC than encryption 
Generated using string splitting.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:29 +02:00
Michal Čihař
3ba8a026fc Use hash_hmac for MAC rather than plain SHA1 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:56:52 +02:00
Michal Čihař
1543be7138 Use https to access phpmyadmin.net 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:22:33 +02:00
Michal Čihař
3a4172525f Merge branch 'QA_4_6' into QA_4_6-security 2016-07-18 15:56:38 +02:00
Michal Čihař
d35c3d9ed5 Update ReCaptcha library to 1.1.2 
There should be no functional changes.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 15:51:44 +02:00
Michal Čihař
205694982b Fix exporting multiline comments 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 12:16:50 +02:00
Michal Čihař
e4be768781 Ensure widht and height are integers 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:55:07 +02:00
Michal Čihař
dc899d8e75 Ensure widht and height are integers 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:52:28 +02:00
Michal Čihař
c3310536b2 Ensure widht and height are integers 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:49:47 +02:00
Michal Čihař
cc6853538c Properly escape error input in the message 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:46:14 +02:00
Michal Čihař
dc52930bba Properly handle newlines in SQL comments 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 09:59:39 +02:00
Michal Čihař
80b03a4f16 Ensure page number is integer 
Even if somebody decides to change configuration storage structure.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 16:57:35 +02:00
Michal Čihař
767195e197 Sanitize MySQL host name before connecting 
It can contain p: prefix which we don't want to honor.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 15:14:57 +02:00
Michal Čihař
2ef4fe3d84 Use iframe sandbox for rendering HTML in transformation 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 14:15:30 +02:00
Michal Čihař
6da13e2a1c Escape HTML in Mediawiki comments 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 12:30:58 +02:00
Michal Čihař
2ea0b722d7 Use _blank target instead of invalid _new 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 11:22:23 +02:00
Michal Čihař
3c06eede3f Add rel="noopener noreferrer" to all target="_blank" links 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 11:02:53 +02:00
Michal Čihař
0bf21ebf72 Use whitelist rather than blacklist for URL filtering 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 10:37:25 +02:00
Michal Čihař
fc6ef261eb Remove Swekey support 
It is buggy and their servers are no longer working.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-11 09:02:58 +02:00
Michal Čihař
c0b2d56ac0 Use https for wiki links 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-09 09:12:43 +02:00
Michal Čihař
a97be3a604 Improve cookie encryption 
- use MAC to validate content before decryption
- create unique IV for every cookie

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-08 17:40:05 +02:00
Michal Čihař
7de139b90c Properly escape generated XML export 
Many fields could contain XML markup, so we need to ensure the generated
XML is valid.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-30 10:54:05 +02:00
Michal Čihař
2b5915ce7b Use phpMyAdmin version in PHP export header 
Using fixed 0.2b really makes no sense.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-30 10:27:26 +02:00
Michal Čihař
a82835cf09 Generate valid PHP code even when table/database name contains PHP markup 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-30 10:22:39 +02:00
Michal Čihař
615212a14d Do not allow javascript: links in transformation 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-22 13:28:07 +02:00
Michal Čihař
1cc7466db3 Quote delimiter before using preg_replace 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-20 12:16:03 +02:00
Michal Čihař
be3ecbb4cc Simplify and cleanup transformation plugins 
Remove PMA_transformation_global_html_replace which makes the code only
more confusing.

Also add escaping to browse transformations.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 16:18:13 +02:00