gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
105,517 Commits 12 Branches 481 Tags 2.4 GiB
80cd2f448c
Commit Graph

105517 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michal Čihař
80cd2f448c Merge branch 'QA_4_6' into QA_4_6-security 2016-06-20 10:42:29 +02:00
Michal Čihař
364732e309 Escape error message from server 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-20 10:11:25 +02:00
Michal Čihař
895a131d2e Escape HTML when rendering AJAX error 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-20 10:07:52 +02:00
Michal Čihař
79661610f6 Escape attributes when showing images in javascript 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-20 10:04:16 +02:00
Michal Čihař
1e5716cb96 Add referrer CSP and <meta> tag 
This avoids leaking Referer header in modern browsers.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-20 09:41:06 +02:00
Madhura Jayaratne
040822fe5a ChangeLog entry for e7003792d9 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-06-18 09:19:00 +10:00
Madhura Jayaratne
e7003792d9 Escape generated query 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-06-18 09:13:02 +10:00
Michal Čihař
1a558a4190 Ensure id is numeric 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 17:12:41 +02:00
Michal Čihař
be3ecbb4cc Simplify and cleanup transformation plugins 
Remove PMA_transformation_global_html_replace which makes the code only
more confusing.

Also add escaping to browse transformations.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 16:18:13 +02:00
Michal Čihař
d648ade18d Escape binary log name 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:51:15 +02:00
Michal Čihař
8716855b30 Properly escape translated string 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:45:29 +02:00
Michal Čihař
0815af37f4 Add missing escaping to partition listing 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:37:37 +02:00
Michal Čihař
418aeea3d8 Add error handling to constructing openid message 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:34:50 +02:00
Michal Čihař
94cf386425 Escape error messages from OpenID 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:30:36 +02:00
Michal Čihař
1363ce5749 Merge branch 'QA_4_6' into QA_4_6-security 2016-06-17 14:27:02 +02:00
Michal Čihař
27664605b9 Improve error handling in OpenID example 
- properly check parameter types
- catch all exceptions (eg. network error)

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:26:59 +02:00
Michal Čihař
61b4e28faf Sanitize page and formset before using 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:21:53 +02:00
Michal Čihař
07216c9b8e Ensure that connection collation contains no HTML 
There is currently no MySQL collation which would do that, but just to
be safe.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:58:26 +02:00
Michal Čihař
04a72687f8 Add missing escaping 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:54:26 +02:00
Michal Čihař
58da975117 Add missing URL encoding 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:22:01 +02:00
Michal Čihař
a5950f9ecd Fix link to mariadb explain analyzer 
- avoid double urlencoding of the query
- properly escape html entities

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:05:11 +02:00
Michal Čihař
d1ec59f05f Ensure we have integer as offset 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:01:56 +02:00
Michal Čihař
aef5df7e13 Ensure we have integer as position 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:00:45 +02:00
Michal Čihař
009148075f PMA_jsFormat accepts only strings 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 11:43:51 +02:00
Michal Čihař
00b9be9c4a Merge branch 'QA_4_6' into QA_4_6-security 2016-06-17 11:23:36 +02:00
Michal Čihař
4a9da1df40 Adjust tests to new error reporting handling of objects 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 11:23:20 +02:00
Michal Čihař
1d2e2be925 Merge branch 'QA_4_6' into QA_4_6-security 2016-06-17 11:20:18 +02:00
Michal Čihař
f5e8953356 Share backtrace processing for debugging and error reporting 
We want to achieve same thing in both cases - backtrace which is
stripped from sensitive information, has reasonable size and can be
read. Sharing the code will make it easier to fix possible problems and
also will make both cases behave consistent.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 11:18:39 +02:00
Michal Čihař
ee0955b30b Use same condition for link start as for link end 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 11:04:28 +02:00
Michal Čihař
331c560fbf Improve error handling in setup in case config dir is not present 
We do not show these options in UI, but the scripts should handle it
gracefully.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 10:54:11 +02:00
Michal Čihař
cd229d718e Validate input of validator 
We can not trust the input here, so we can expect anything and deal with
missing parameters or invalid values.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 10:14:13 +02:00
Michal Čihař
96e0aa3565 Fix error reporting on invalid request data 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 09:35:57 +02:00
Michal Čihař
ef1493d9b4 Move request conversion to generic code 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 09:35:57 +02:00
Michal Čihař
b0180f18c8 Properly convert POST parameters 
We can get array instead of single parameter, so handle this gracefully.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 09:12:28 +02:00
Michal Čihař
6c5d5ffc7f Merge branch 'QA_4_6' into QA_4_6-security 2016-06-17 09:02:13 +02:00
Michal Čihař
c00fe2cbfd Fix listing routines for non privileged user 
We first need to check if we can read the definition before parsing it.

Fixes #12310

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 08:55:04 +02:00
Michal Čihař
80c7b8a561 Add missing escaping 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 16:17:36 +02:00
Michal Čihař
1b0fde1b59 Remove duplicated code 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 14:05:20 +02:00
Michal Čihař
69cfcc6abd Ensure width and height are integers 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 13:51:22 +02:00
Michal Čihař
9d6157fda7 Ensure we use escaped version of type 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 13:47:15 +02:00
Michal Čihař
a1f69b4c80 Fix syntax error 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 13:17:36 +02:00
Michal Čihař
5b05665ff0 Ensure kill ID is integer 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 13:07:13 +02:00
Michal Čihař
53cc34b374 Fix handing of GIS data 
* Force geometry count to be integer
* Ensure proper escaping of GIS data

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 13:02:48 +02:00
Jocelyn Flament
35b2624296 Translated using Weblate (French) 
Currently translated at 100.0% (3209 of 3209 strings)

[CI skip]
 2016-06-16 13:02:27 +02:00
Michal Čihař
27caf5b46b Improve detection of script name 
In case PHP_SELF was not set by server, we used REQUEST_URI, which might
embed PATH_INFO as well. However we really need to know the path without
it, so let's strip it as well.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 09:35:56 +02:00
Michal Čihař
4767f24ea4 Limit number of included scripts in get_scripts.js.php 
This avoids potential DOS, the limit is same as we use for generating
the URLs.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-15 18:07:12 +02:00
Michal Čihař
5633b1d57b Use javascript for redirection to https 
The current approach is broken since whitelisting is active in url.php
and also allows potential bbcode injection.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-15 17:51:27 +02:00
Michal Čihař
19eef4eebb Merge branch 'QA_4_6' into QA_4_6-security 2016-06-15 13:03:21 +02:00
Michal Čihař
73d067a540 Fix test for new redirect code 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-15 13:02:59 +02:00
Michal Čihař
55db1256c5 Merge pull request #48 from phpmyadmin/security-45 
Fix issue #45 input types in setup script
 2016-06-15 12:51:38 +02:00