gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
83,363 Commits 12 Branches 481 Tags 2.4 GiB
8e0918cc41
Commit Graph

83363 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michal Čihař
8e0918cc41 Sanitize MySQL host name before connecting 
It can contain p: prefix which we don't want to honor.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 15:10:59 +02:00
Michal Čihař
bdc7436c77 Prefer curl over file_get_contents 
Curl is better in SSL certificate verification.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 14:32:32 +02:00
Michal Čihař
14fd275811 Use iframe sandbox for rendering HTML in transformation 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 14:13:14 +02:00
Michal Čihař
c8297b4718 Use phpseclib's Crypt module to generate encryption keys 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 14:02:26 +02:00
Michal Čihař
ab05803a42 Do not allow symlinks in UploadDir 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 12:47:35 +02:00
Michal Čihař
41684ff1a1 Hide session error messages to avoid FPD 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 12:37:19 +02:00
Michal Čihař
e9a4de70a7 Escape HTML in Mediawiki comments 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 12:29:35 +02:00
Michal Čihař
0a4cdc25f1 Use _blank target instead of invalid _new 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 11:20:16 +02:00
Michal Čihař
63a5fdaa21 Add rel="noopener noreferrer" to all target="_blank" links 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 10:59:38 +02:00
Michal Čihař
a416cbe6c7 Use whitelist rather than blacklist for URL filtering 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 10:36:33 +02:00
Madhura Jayaratne
6cbbcdb719 Fix XSS in server_replication.php 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-07-12 12:05:07 +10:00
Michal Čihař
dc25189741 Fix syntax error in older PHP versions 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-11 09:36:56 +02:00
Michal Čihař
ee6557a689 Remove debugging code 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-11 09:31:55 +02:00
Michal Čihař
ec2bd5d84c Remove Swekey support 
It is buggy and their servers are no longer working.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-11 08:57:21 +02:00
Michal Čihař
4440790902 Make proxy IP parsing aware of multiple proxies 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-11 08:22:32 +02:00
Isaac Bennetch
eb2c702ab2 Add Secure and HttpOnly flags for session cookie setup in examples 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-07-10 22:30:49 -04:00
Michal Čihař
a9005b20bc Properly escape MySQL status variables 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-10 18:06:25 +02:00
Michal Čihař
cf2e0afdb7 Use https for wiki links 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-09 09:10:57 +02:00
Michal Čihař
95b7b7d6dd Improve cookie encryption 
- use MAC to validate content before decryption
- create unique IV for every cookie

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-08 17:54:25 +02:00
Michal Čihař
59e0f3dee4 Properly escape generated XML export 
Many fields could contain XML markup, so we need to ensure the generated
XML is valid.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-30 10:59:44 +02:00
Michal Čihař
34a1cebf76 Generate valid PHP code even when table/database name contains PHP markup 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-30 10:26:29 +02:00
Michal Čihař
c6cfb58834 Avoid possible path traversal using MySQL username 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-30 10:04:46 +02:00
Michal Čihař
e46fdb8e5e Sent CSP headers for phpinfo 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-30 09:51:38 +02:00
Michal Čihař
01673e94dd Fix type conversion for numeric values 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-24 12:53:39 +02:00
Isaac Bennetch
83416df64f Release 4.0.10.16 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-06-23 00:01:11 -04:00
Isaac Bennetch
c3d22bee08 Changelog entries for security release 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-06-22 13:29:21 -04:00
Michal Čihař
b04150e30e Do not allow javascript: links in transformation 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-22 13:26:03 +02:00
Michal Čihař
b974b56781 Fixed rendering of chart of columns with HTML inside 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-22 13:10:37 +02:00
Michal Čihař
9b6f64b8b9 Properly escape zoom search column type 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-22 11:11:47 +02:00
Michal Čihař
351019c074 Quote delimiter before using preg_replace 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-20 12:13:24 +02:00
Michal Čihař
8c336ba285 Update referrer <meta> to match current standards 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-20 10:46:51 +02:00
Michal Čihař
02971f754f Escape HTML when rendering AJAX error 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-20 10:06:42 +02:00
Michal Čihař
abfd97983a Escape attributes when showing images in javascript 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-20 10:03:40 +02:00
Michal Čihař
e13f9862ef Backport Content-Security-Policy from latest release 
This way it will work well on current browsers.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-20 09:44:52 +02:00
Michal Čihař
32875196f9 Add referrer CSP and <meta> tag 
This avoids leaking Referer header in modern browsers.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-20 09:38:52 +02:00
Michal Čihař
288efea5b4 Simplify and cleanup transformation plugins 
Remove PMA_transformation_global_html_replace which makes the code only
more confusing.

Also add escaping to browse transformations.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 16:19:31 +02:00
Michal Čihař
f662d591c5 Escape binary log name 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:53:31 +02:00
Michal Čihař
975089b8c3 Properly escape translated string 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:48:05 +02:00
Michal Čihař
78f6c54f1b Add error handling to constructing openid message 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:33:33 +02:00
Michal Čihař
5fefa51139 Escape error messages from OpenID 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:29:57 +02:00
Michal Čihař
c795a395ba Improve error handling in OpenID example 
- properly check parameter types
- catch all exceptions (eg. network error)

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:26:05 +02:00
Michal Čihař
c93c82ee9c Fix typo in validator 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 10:59:03 +02:00
Michal Čihař
fa7a9b787b Improve error handling in setup in case config dir is not present 
We do not show these options in UI, but the scripts should handle it
gracefully.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 10:58:53 +02:00
Michal Čihař
96c6a7c0a2 Validate input of validator 
We can not trust the input here, so we can expect anything and deal with
missing parameters or invalid values.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 10:13:12 +02:00
Michal Čihař
e1eb5e8e89 Fix error reporting on invalid request data 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 09:52:12 +02:00
Michal Čihař
8451a7a5d2 Move request conversion to generic code 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 09:35:02 +02:00
Michal Čihař
c9faf855a0 Properly convert POST parameters 
We can get array instead of single parameter, so handle this gracefully.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 09:10:30 +02:00
Michal Čihař
6b52ae4d19 Adjust test expectations to match new code 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 08:55:39 +02:00
Michal Čihař
805225a28c Limit number of included scripts in get_scripts.js.php 
This avoids potential DOS, the limit is same as we use for generating
the URLs.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-15 18:04:43 +02:00
Madhura Jayaratne
75724a361b Fix #11457 414 Request-URI Too Large 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-15 18:04:16 +02:00