gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
83,408 Commits 12 Branches 481 Tags 2.4 GiB
63b7f6c0a9
Commit Graph

83408 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michal Čihař
63b7f6c0a9 Use hash_equals when comparing IPv6 allow rules 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-09-02 15:09:29 +02:00
Michal Čihař
af7c589391 Stricter URL validation 
- do not use empty() as empty('0') is true
- do not lowercase the strings, use them as they are
- lowercase all domains in our codebase
- do not allow to specify port

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-09-02 15:02:44 +02:00
Michal Čihař
0c3dfd186c Fix possible DOS on too big skip value 
- loop only as long as long we have data to skip
- convert skip parameter to integer

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-09-02 13:42:15 +02:00
Michal Čihař
d37abc38da Do not show warning about short blowfish_secret if none is set 
With empty blowfish_secret user would always get both warnings...

Fixes #12485

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-24 12:04:45 +02:00
Michal Čihař
67700620db Limit maximal number of rows in QBE 
User would be lost in them anyway by that count and it prevents DOS.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 16:55:48 +02:00
Michal Čihař
b2605ebba6 Fix hash validation 
- use copy of hash to avoid race condition
- stricter regex to match whole string

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 11:25:21 +02:00
Michal Čihař
096856c70c Stricter validation of NavigationLogoLink 
It now has to be URL including scheme. Otherwise it's not really
possible to validate it for being just http/https.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 11:18:21 +02:00
Michal Čihař
c2f7a898dd Store copy of hash instead of working on live object 
This avoids possible race conditions when doing the checks.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 11:05:56 +02:00
Michal Čihař
f2add98bd9 Strip path even if openbasedir restrictions apply 
This really should not be the case here as what we get here is code
executed by PHP, so it should have already passed openbasedir
restrictions.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 10:14:01 +02:00
Michal Čihař
6117ad5cef Use hash_equals for checking username 
This makes the comparison happen in constant time and makes it
impossible to use it to guess stored usernames.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 09:39:22 +02:00
Michal Čihař
58245cb1cc Use hash_equals for comparing username in allow/deny rules 
The comparison should happen in constant time to avoid possible leak of
usernames in rules.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 09:15:34 +02:00
Michal Čihař
285e5623b6 Strip null bytes from MySQL username 
In old PHP versions this could lead to allow/deny rules bypass.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 09:10:55 +02:00
Isaac Bennetch
5ba96c8804 Release 4.0.10.17 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-08-16 16:33:47 -04:00
Michal Čihař
12db0baeae Move hostname sanitization to correct place 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-29 14:10:07 +02:00
Michal Čihař
2922cb7c70 Do not try to wrap output in case response handling is disabled 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-28 10:53:37 +02:00
Michal Čihař
533ffa4942 Add login and token validation to version_check 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-28 10:53:31 +02:00
Michal Čihař
126321da37 Escape string when showing confirmation message 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-28 10:31:30 +02:00
Michal Čihař
b0e66715ba Do not allow to set too long password 
We do not accept password longer than 256 chars, so do not accept it on
password change as well.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 17:03:00 +02:00
Michal Čihař
262aa8ec73 Fix password change with cookie auth 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 17:02:13 +02:00
Michal Čihař
47d00af08a Move generator scripts out of the code 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:38:30 +02:00
Michal Čihař
eec14404a7 Remove option to show phpinfo() ($cfg['ShowPhpInfo']) 
This is really more a PHP debugging feature than anything related to
phpMyAdmin. If user wants to debug, it's as simple a creating file with
one line of php code.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 11:03:53 +02:00
Michal Čihař
ac703223e9 Ensure GIS point coordinates are numeric 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 10:24:35 +02:00
Michal Čihař
4d15f6b131 Fix random invocation 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 09:05:12 +02:00
Michal Čihař
d03954bf9c Enable LOAD DATA LOCAL INFILE only when needed 
There is no need to have this feature allowed for normal SQL queries, it
can lead to leaking sensitive files from the web server. It's enough to
enable it only in LDI import plugin, where we control what queries are
executed.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 08:59:02 +02:00
Michal Čihař
f261abbdf9 Remove no longer used code 
It was used by old charts code to download charts.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 16:46:32 +02:00
Michal Čihař
5a28b63f9c Limit maximal numver of fields to 4096 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 16:00:23 +02:00
Michal Čihař
ae8693db68 Backport cookie encryption from 4.6 branch 
- Use hash_hmac for MAC rather than plain SHA1
- Use different secret for MAC than encryption
- Merge pmaServer and pmaPass cookies
- Document 32 chars length for blowfish_secret

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:40:02 +02:00
Michal Čihař
85e1d6ec80 Send standard set of HTTP headers on redirect 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 12:22:53 +02:00
Michal Čihař
378c3820bf Sanitize filename on SHP import 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 11:49:35 +02:00
Michal Čihař
6f8eb0993d Delete temporary file before reporting error 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 11:31:09 +02:00
Michal Čihař
e8c5cab3c1 Improve URL filtering in url.php 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:41:04 +02:00
Michal Čihař
714818f3ad Use https to access phpmyadmin.net 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:20:34 +02:00
Michal Čihař
ab26a8fe97 Fix exporting multiline comments 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 12:13:28 +02:00
Michal Čihař
0f87b73ae2 HML encode embedded JSON data 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 11:31:55 +02:00
Michal Čihař
04156efeb0 Ensure widht and height are integers 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:53:51 +02:00
Michal Čihař
31546255f3 Ensure widht and height are integers 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:51:53 +02:00
Michal Čihař
09a427b288 Escape HTML markup in transformation wrapper 
...in case content type is html.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:34:19 +02:00
Michal Čihař
8f3ee9f9db Do not use empty MIME type 
This will turn on content sniffing in browser leading to unwanted
results.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:27:43 +02:00
Michal Čihař
56e1350118 Properly handle newlines in SQL comments 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 09:58:14 +02:00
Michal Čihař
7f7a8ac467 Do not try to create non existing classes 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 09:48:21 +02:00
Michal Čihař
ff88cdbed2 Validate image scaling dimensions 
Ensure we pass only integers and they are not too big.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 09:39:30 +02:00
Michal Čihař
8ac57b1281 Correctly escape MySQL username in queries 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 17:35:56 +02:00
Michal Čihař
fec9b98a22 Ensure page number is integer 
Even if somebody decides to change configuration storage structure.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 16:49:15 +02:00
Michal Čihař
a3953f88ef Escape suggested database name 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 16:40:36 +02:00
Michal Čihař
80c93025a7 Validate serialized data before unserializing 
We need only strings, integers or arrays, so there is no need to
unserialize strings containing any complex types.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 16:25:20 +02:00
Michal Čihař
8e0918cc41 Sanitize MySQL host name before connecting 
It can contain p: prefix which we don't want to honor.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 15:10:59 +02:00
Michal Čihař
bdc7436c77 Prefer curl over file_get_contents 
Curl is better in SSL certificate verification.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 14:32:32 +02:00
Michal Čihař
14fd275811 Use iframe sandbox for rendering HTML in transformation 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 14:13:14 +02:00
Michal Čihař
c8297b4718 Use phpseclib's Crypt module to generate encryption keys 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 14:02:26 +02:00
Michal Čihař
ab05803a42 Do not allow symlinks in UploadDir 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 12:47:35 +02:00