gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
106,566 Commits 12 Branches 481 Tags 2.4 GiB
52586bd949
Commit Graph

106566 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michal Čihař
52586bd949 Merge branch 'QA_4_6-security' into master-security 2016-07-22 11:53:23 +02:00
Michal Čihař
ddeab2a11f Sanitize filename on SHP import 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 11:52:49 +02:00
Michal Čihař
2adf1ca83e Merge branch 'QA_4_6-security' into master-security 2016-07-22 11:35:14 +02:00
Michal Čihař
0b60b78e9d Merge branch 'master' into master-security 2016-07-22 11:32:25 +02:00
Michal Čihař
d9f918c365 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-22 11:32:17 +02:00
Michal Čihař
48764f2260 Delete temporary file before reporting error 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 11:31:56 +02:00
Michal Čihař
377ab3bddf Merge branch 'QA_4_6' 2016-07-22 10:39:26 +02:00
Michal Čihař
eb2735f9a9 Merge remote-tracking branch 'origin/QA_4_6' 2016-07-22 10:39:23 +02:00
Michal Čihař
7dcfe246ea Merge commit '0fad7290c90f9b192aff4e4946b3276803946a70' 2016-07-22 10:39:18 +02:00
Michal Čihař
bc6fbbe032 Update documentation copyright 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:38:38 +02:00
Michal Čihař
a32b3ceb6e Use single quotes 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:38:19 +02:00
Michal Čihař
3ee65fc8bf Use MAC to verify IV as well 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:29:46 +02:00
Michal Čihař
f693c103be Document 32 chars length for blowfish_secret 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:23:43 +02:00
Michal Čihař
2b7be93829 Improve Blowfish secret generation in setup script 
Now generates secret containing all printable ASCII chars, making it way
more random than with hex encoded random string.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:19:31 +02:00
Michal Čihař
f07fd90ee9 Document recommended length of 32 for blowfish_secret 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:14:02 +02:00
Michal Čihař
ef03daf658 Remove hashing of blowfish secret 
New code doesn't have problems with longer secrets.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:59:02 +02:00
Michal Čihař
d29df46b3a Do not generate too long session secret 
We need 16+16 bytes, generating 256 is not really needed.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:58:39 +02:00
Michal Čihař
e2a25d773d Merge pmaServer and pmaPass cookies 
This addresses several issues:

- makes server name encrypted and authenticated, so that it can not be
  tampered
- reduces cookie usage
- reduces overhead of encryption/authentication

The pmaUser cookie is still separate to avoid different lifetime
(pmaUser has month lifetime, while pmaAuth is session only by default).

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
2a2d865d50 Validate input data from cookies 
We expect strings only, so not accept anything else.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
f45b8cd49c Use different secret for MAC than encryption 
Generated using string splitting.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:29 +02:00
Kamyar Sec
69c38579f6 Translated using Weblate (Kurdish Sorani) 
Currently translated at 18.1% (582 of 3209 strings)

[CI skip]
 2016-07-22 09:45:21 +02:00
Kamyar Sec
428604fcdd Translated using Weblate (Kurdish Sorani) 
Currently translated at 18.0% (580 of 3208 strings)

[CI skip]
 2016-07-22 09:45:17 +02:00
Michal Čihař
0fad7290c9 Escape database name in SQL query 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-19 09:20:15 +02:00
Michal Čihař
3ba8a026fc Use hash_hmac for MAC rather than plain SHA1 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:56:52 +02:00
Michal Čihař
67d6eeac42 Improve URL filtering in url.php 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:39:25 +02:00
Michal Čihař
7e6edaf756 Add tests for PMA_isAllowedDomain 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:36:55 +02:00
Michal Čihař
3f98ad5414 Merge branch 'QA_4_6-security' into master-security 2016-07-18 16:24:12 +02:00
Michal Čihař
1543be7138 Use https to access phpmyadmin.net 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:22:33 +02:00
Michal Čihař
c0a05eced4 Merge branch 'QA_4_6-security' of github.com:phpmyadmin/phpmyadmin-security into QA_4_6-security 2016-07-18 15:57:22 +02:00
Michal Čihař
2610daed9d Merge branch 'master-security' of github.com:phpmyadmin/phpmyadmin-security into master-security 2016-07-18 15:57:14 +02:00
Michal Čihař
3ca72e9c73 Merge branch 'QA_4_6-security' into master-security 2016-07-18 15:56:58 +02:00
Michal Čihař
7913196d21 Merge branch 'master' into master-security 2016-07-18 15:56:50 +02:00
Michal Čihař
3a4172525f Merge branch 'QA_4_6' into QA_4_6-security 2016-07-18 15:56:38 +02:00
Michal Čihař
c1c7fb794b Merge branch 'QA_4_6' 2016-07-18 15:56:27 +02:00
Michal Čihař
1e1d0ed069 Merge remote-tracking branch 'origin/QA_4_6' 2016-07-18 15:55:37 +02:00
Michal Čihař
ff9291964c Update TCPDF to 6.2.12 
Changelog:

6.2.12 (2015-09-12)
	- fix composer package name to tecnickcom/tcpdf

6.2.11 (2015-08-02)
	- "PNG regression in 6.2.9 (they appear as their alpha channel)" was fixed.
	- "Encoded SRC URLs in <img> tags don't work anymore" was fixed.

6.2.10 (2015-07-28)
	- Minor mod to PNG parsing.
	- Make dependency on mcrypt optional.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 15:54:39 +02:00
Michal Čihař
d35c3d9ed5 Update ReCaptcha library to 1.1.2 
There should be no functional changes.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 15:51:44 +02:00
‫حمودي الجيلاني‬‎
0f1d629043 Translated using Weblate (Arabic) 
Currently translated at 34.2% (1098 of 3209 strings)

[CI skip]
 2016-07-16 18:44:09 +02:00
‫حمودي الجيلاني‬‎
14e55164a9 Translated using Weblate (Arabic) 
Currently translated at 34.0% (1092 of 3208 strings)

[CI skip]
 2016-07-16 18:44:06 +02:00
Michal Čihař
aa3c3452d4 Skip anchors verification for now 
Skip until new Sphinx will be released as it better handles HTTP thanks
to requests library.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-14 09:24:52 +02:00
Isaac Bennetch
f1a910bb7d Merge branch 'QA_4_6-security' into master-security 2016-07-13 15:36:18 -04:00
Isaac Bennetch
306c148098 Add missing escaping in navigation pane 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-07-13 15:33:48 -04:00
Michal Čihař
f0100b81ec Merge branch 'QA_4_6-security' into master-security 2016-07-13 12:17:21 +02:00
Michal Čihař
205694982b Fix exporting multiline comments 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 12:16:50 +02:00
Michal Čihař
af8385dc87 Fix tests for transformations 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 12:16:45 +02:00
Michal Čihař
7b3dc673d2 Fix exporting multiline comments 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 12:12:26 +02:00
Michal Čihař
97ff98bc62 Fix tests for transformations 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 12:12:10 +02:00
Michal Čihař
52978a57ad Merge branch 'QA_4_6-security' into master-security 2016-07-13 11:33:53 +02:00
Michal Čihař
42c868b691 HML encode embedded JSON data 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 11:33:35 +02:00
Michal Čihař
a7333d7cc7 Merge branch 'QA_4_6-security' into master-security 2016-07-13 11:12:48 +02:00