gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
106,346 Commits 12 Branches 481 Tags 2.4 GiB
791bdafcdd
Commit Graph

106346 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michal Čihař
791bdafcdd Merge branch 'QA_4_6-security' into master-security 2016-06-17 16:24:39 +02:00
Michal Čihař
be3ecbb4cc Simplify and cleanup transformation plugins 
Remove PMA_transformation_global_html_replace which makes the code only
more confusing.

Also add escaping to browse transformations.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 16:18:13 +02:00
Michal Čihař
bdfaaa4f40 Fix generated redirect response 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 15:00:44 +02:00
Michal Čihař
d648ade18d Escape binary log name 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:51:15 +02:00
Michal Čihař
8716855b30 Properly escape translated string 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:45:29 +02:00
Michal Čihař
0815af37f4 Add missing escaping to partition listing 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:37:37 +02:00
Michal Čihař
418aeea3d8 Add error handling to constructing openid message 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:34:50 +02:00
Michal Čihař
94cf386425 Escape error messages from OpenID 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:30:36 +02:00
Michal Čihař
1363ce5749 Merge branch 'QA_4_6' into QA_4_6-security 2016-06-17 14:27:02 +02:00
Michal Čihař
27664605b9 Improve error handling in OpenID example 
- properly check parameter types
- catch all exceptions (eg. network error)

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:26:59 +02:00
Michal Čihař
a6a78a2517 Merge branch 'QA_4_6' 2016-06-17 14:22:51 +02:00
Michal Čihař
61b4e28faf Sanitize page and formset before using 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:21:53 +02:00
Michal Čihař
8552da5842 Do not ignore error here 
The previous fetchAssoc would also fail in case of invalid resource.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:19:42 +02:00
Michal Čihař
8ac8ca1a02 Share code for parsing Proc_priv 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:17:31 +02:00
Michal Čihař
e25ab25d5f Define array before using it 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:13:32 +02:00
Michal Čihař
cc6fd10b28 Add separator 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:04:21 +02:00
Michal Čihař
81e72439b6 Merge branch 'QA_4_6' 2016-06-17 14:00:15 +02:00
Michal Čihař
07216c9b8e Ensure that connection collation contains no HTML 
There is currently no MySQL collation which would do that, but just to
be safe.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:58:26 +02:00
Michal Čihař
04a72687f8 Add missing escaping 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:54:26 +02:00
Michal Čihař
dbd848d595 Fix wrong redirection tests 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:36:58 +02:00
Michal Čihař
e531526bc5 Merge branch 'QA_4_6' 2016-06-17 13:22:06 +02:00
Michal Čihař
58da975117 Add missing URL encoding 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:22:01 +02:00
Michal Čihař
170c045507 Simplify code for processing SQL query to display 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:21:01 +02:00
Michal Čihař
84507dfeb6 Merge branch 'QA_4_6' 2016-06-17 13:10:28 +02:00
Michal Čihař
a5950f9ecd Fix link to mariadb explain analyzer 
- avoid double urlencoding of the query
- properly escape html entities

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:05:11 +02:00
Michal Čihař
d1ec59f05f Ensure we have integer as offset 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:01:56 +02:00
Michal Čihař
aef5df7e13 Ensure we have integer as position 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:00:45 +02:00
Michal Čihař
325122658a Fix parameter type documentation 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 12:59:37 +02:00
Michal Čihař
8bf3cf6578 Use URL::getCommon to construct complete URL 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 12:58:14 +02:00
Michal Čihař
dce94f229f More consistency for URL::getCommon 
Now URL::getCommon always returns HTML encoded string, if you want
unencded one, use URL::getCommonRaw. This makes it easier to review the
code if uses correct variant.

Also I've fixed several wrong uses of the HTML encoded variant in
Location header.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 12:44:29 +02:00
Michal Čihař
41d5c1e127 Merge branch 'QA_4_6' 2016-06-17 11:44:30 +02:00
Michal Čihař
009148075f PMA_jsFormat accepts only strings 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 11:43:51 +02:00
Michal Čihař
00b9be9c4a Merge branch 'QA_4_6' into QA_4_6-security 2016-06-17 11:23:36 +02:00
Michal Čihař
cdc7a6c6bf Merge branch 'QA_4_6' 2016-06-17 11:23:25 +02:00
Michal Čihař
4a9da1df40 Adjust tests to new error reporting handling of objects 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 11:23:20 +02:00
Michal Čihař
1d2e2be925 Merge branch 'QA_4_6' into QA_4_6-security 2016-06-17 11:20:18 +02:00
Michal Čihař
3847cee0a4 Merge branch 'QA_4_6' 2016-06-17 11:20:05 +02:00
Michal Čihař
f5e8953356 Share backtrace processing for debugging and error reporting 
We want to achieve same thing in both cases - backtrace which is
stripped from sensitive information, has reasonable size and can be
read. Sharing the code will make it easier to fix possible problems and
also will make both cases behave consistent.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 11:18:39 +02:00
Michal Čihař
aea7654804 Merge branch 'QA_4_6' 2016-06-17 11:04:35 +02:00
Michal Čihař
ee0955b30b Use same condition for link start as for link end 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 11:04:28 +02:00
Michal Čihař
331c560fbf Improve error handling in setup in case config dir is not present 
We do not show these options in UI, but the scripts should handle it
gracefully.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 10:54:11 +02:00
Michal Čihař
cd229d718e Validate input of validator 
We can not trust the input here, so we can expect anything and deal with
missing parameters or invalid values.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 10:14:13 +02:00
Michal Čihař
96e0aa3565 Fix error reporting on invalid request data 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 09:35:57 +02:00
Michal Čihař
ef1493d9b4 Move request conversion to generic code 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 09:35:57 +02:00
Michal Čihař
b0180f18c8 Properly convert POST parameters 
We can get array instead of single parameter, so handle this gracefully.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 09:12:28 +02:00
Michal Čihař
6c5d5ffc7f Merge branch 'QA_4_6' into QA_4_6-security 2016-06-17 09:02:13 +02:00
Michal Čihař
c3ae85b2e1 Merge branch 'QA_4_6' 2016-06-17 08:55:48 +02:00
Michal Čihař
c00fe2cbfd Fix listing routines for non privileged user 
We first need to check if we can read the definition before parsing it.

Fixes #12310

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 08:55:04 +02:00
Michal Čihař
eb942e68b9 Merge branch 'QA_4_6' 2016-06-16 16:18:02 +02:00
Michal Čihař
80c7b8a561 Add missing escaping 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 16:17:36 +02:00