gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
105,483 Commits 12 Branches 481 Tags 2.4 GiB
6c5d5ffc7f
Commit Graph

105483 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michal Čihař
6c5d5ffc7f Merge branch 'QA_4_6' into QA_4_6-security 2016-06-17 09:02:13 +02:00
Michal Čihař
c00fe2cbfd Fix listing routines for non privileged user 
We first need to check if we can read the definition before parsing it.

Fixes #12310

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 08:55:04 +02:00
Michal Čihař
80c7b8a561 Add missing escaping 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 16:17:36 +02:00
Michal Čihař
1b0fde1b59 Remove duplicated code 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 14:05:20 +02:00
Michal Čihař
69cfcc6abd Ensure width and height are integers 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 13:51:22 +02:00
Michal Čihař
9d6157fda7 Ensure we use escaped version of type 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 13:47:15 +02:00
Michal Čihař
a1f69b4c80 Fix syntax error 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 13:17:36 +02:00
Michal Čihař
5b05665ff0 Ensure kill ID is integer 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 13:07:13 +02:00
Michal Čihař
53cc34b374 Fix handing of GIS data 
* Force geometry count to be integer
* Ensure proper escaping of GIS data

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 13:02:48 +02:00
Jocelyn Flament
35b2624296 Translated using Weblate (French) 
Currently translated at 100.0% (3209 of 3209 strings)

[CI skip]
 2016-06-16 13:02:27 +02:00
Michal Čihař
27caf5b46b Improve detection of script name 
In case PHP_SELF was not set by server, we used REQUEST_URI, which might
embed PATH_INFO as well. However we really need to know the path without
it, so let's strip it as well.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 09:35:56 +02:00
Michal Čihař
4767f24ea4 Limit number of included scripts in get_scripts.js.php 
This avoids potential DOS, the limit is same as we use for generating
the URLs.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-15 18:07:12 +02:00
Michal Čihař
5633b1d57b Use javascript for redirection to https 
The current approach is broken since whitelisting is active in url.php
and also allows potential bbcode injection.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-15 17:51:27 +02:00
Michal Čihař
19eef4eebb Merge branch 'QA_4_6' into QA_4_6-security 2016-06-15 13:03:21 +02:00
Michal Čihař
73d067a540 Fix test for new redirect code 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-15 13:02:59 +02:00
Michal Čihař
55db1256c5 Merge pull request #48 from phpmyadmin/security-45 
Fix issue #45 input types in setup script
 2016-06-15 12:51:38 +02:00
Michal Čihař
03f73d4836 Fix XSS on server privileges 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-15 12:50:20 +02:00
Michal Čihař
7221357318 Fix XSS on table structure 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-15 12:40:44 +02:00
Michal Čihař
8a142aba73 Adjust tests to new behavior 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-15 11:45:16 +02:00
Michal Čihař
9e0a321551 Canonicalize redirect URL 
We provide absolute path now to avoid problems with URLs like
/phpmyadmin/index.php/.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-15 11:42:45 +02:00
Michal Čihař
47f918f3fe Use standard redirect function 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-15 11:38:00 +02:00
Michal Čihař
ef6c66dca1 Properly escape database name in central column queries 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-15 11:29:31 +02:00
Isaac Bennetch
d76496ba1d Setup script did not properly use input type password in all cases 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-06-14 22:53:31 -04:00
Michal Čihař
79a34ff94c Calculate table size as integer 
It should be big enough on 64-bit systems, so avoid rounding issues
which double calculations can bring.

Fixes #12303

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-14 08:28:26 +02:00
Michal Čihař
b5faeb3c27 Fixed editing of server variable 
We now store verbatim variable name in HTML to avoid need to do some
magical transformations when parsing it.

Fixes #12317

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-13 12:53:34 +02:00
Michal Čihař
0caecf5fc8 Correct error handling when editing variable fails 
Issue #12317

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-13 12:46:29 +02:00
Bruno Henrique
2d7d2d2e8b Translated using Weblate (Portuguese (Brazil)) 
Currently translated at 93.3% (2996 of 3209 strings)

[CI skip]
 2016-06-13 00:45:21 +02:00
Xavier Navarro
c8823e24e7 Translated using Weblate (Catalan) 
Currently translated at 100.0% (3209 of 3209 strings)

[CI skip]
 2016-06-13 00:44:14 +02:00
Jocelyn Flament
baaa6c63be Translated using Weblate (French) 
Currently translated at 99.8% (3203 of 3209 strings)

[CI skip]
 2016-06-12 18:44:35 +02:00
Michal Čihař
3c6675b3f9 Fix division by zero in case of misconfigured MySQL server 
Fixes #12308

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-09 09:49:13 +02:00
Michal Čihař
763683b4fe Fix test expectations 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-09 09:40:16 +02:00
Michal Čihař
b261ecae25 Add test for possible rounding issues 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-09 09:19:55 +02:00
Michal Čihař
43fdcb67ee Include phpMyAdmin version in JSON dump 
This provides useful information, the 0.1 string was not really helpful.

Issue #12304

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-09 09:19:55 +02:00
Gergő Felföldi
99f17c107e Translated using Weblate (Hungarian) 
Currently translated at 95.8% (3075 of 3209 strings)

[CI skip]
 2016-06-09 09:19:47 +02:00
Michal Čihař
d7fcbab1cd Ensure we parse query for views as well 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-08 14:00:04 +02:00
Satnam S Virdi
f801914944 Translated using Weblate (Punjabi) 
Currently translated at 3.1% (101 of 3209 strings)

[CI skip]
 2016-06-08 13:02:32 +02:00
Madhura Jayaratne
c2322a637d Merge pull request #12296 from madhuracj/bug12281 
Fix #12281 Copying a user resets SSL to None
 2016-06-06 23:55:19 +10:00
Madhura Jayaratne
c4e7447a96 Merge branch 'QA_4_6' of github.com:phpmyadmin/phpmyadmin into bug12281 
Conflicts:
	ChangeLog
 2016-06-06 23:23:07 +10:00
Madhura Jayaratne
1c77a4ef0d Fix #12281 Copying a user resets SSL to None 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-06-06 23:17:20 +10:00
Michal Čihař
4fd2709650 Avoid rewriting PHP stack frames 
Surprisingly PHP stack frames are passed as references to the error
handling code, thus changing value there leads to changing value in the
executed code.

With MySQL issuing warning about incompatible version (different runtime
library than compile time), handling this warning rewrites current stack
frame and the mysql_real_connect later sees parameters as processed by
Error class for display.

We now create copy of the stacktrace to avoid this.

Fixes #12279

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-06 13:52:32 +02:00
Michal Čihař
5e536ab5f9 Do not set key if not set in config 
Issue #12293

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-06 11:47:16 +02:00
Michal Čihař
171bcb9a85 Fix MySQL SSL connection with some PHP versions 
It seems that for some PHP versions this flag is needed even though it's
not documented like this. Anyway this flag doesn't cause any harm, so
lets keep it enabled.

Issue #12293

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-06 09:32:47 +02:00
Guilherme Rocha
f4ac05762f Translated using Weblate (Portuguese (Brazil)) 
Currently translated at 93.3% (2995 of 3209 strings)

[CI skip]
 2016-06-06 09:32:39 +02:00
Deven Bansod
7fb046e207 Merge pull request #12294 from devenbansod/fix_designer_save_state 
Fix error in Designer saved default state of all tables
 2016-06-05 14:48:57 +05:30
Deven Bansod
73ce508712 Fix error in Designer saved default state of all tables 
Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-06-05 13:56:01 +05:30
Madhura Jayaratne
aec1f4b3c5 Fix #12285 Designer JavaScript error: Show/Hide tables list 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-06-05 11:12:05 +10:00
Michal Čihař
2ae8b9248e Simplify server port handling 
The intval function does return 0 for empty string, so we really do not
have to special case here.

Issue #12279

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-03 15:21:48 +02:00
Michal Čihař
b49030528f Fixed export of tables without explicitly set engine 
Fixes #12290

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-03 14:41:55 +02:00
Michal Čihař
d11185f5de Fixed error reporting on connect problems 
The mysqli_real_connect seems to return NULL on invalid parameters, so
we need to handle it as well. This doesn't seem to be documented
anywhere.

Issue #12279

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-03 14:24:45 +02:00
Charles Kane
4822552604 Translated using Weblate (Chinese (China)) 
Currently translated at 88.0% (2824 of 3209 strings)

[CI skip]
 2016-06-02 18:44:17 +02:00