gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
83,326 Commits 12 Branches 481 Tags 2.4 GiB
975089b8c3
Commit Graph

83326 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michal Čihař
975089b8c3 Properly escape translated string 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:48:05 +02:00
Michal Čihař
78f6c54f1b Add error handling to constructing openid message 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:33:33 +02:00
Michal Čihař
5fefa51139 Escape error messages from OpenID 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:29:57 +02:00
Michal Čihař
c795a395ba Improve error handling in OpenID example 
- properly check parameter types
- catch all exceptions (eg. network error)

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:26:05 +02:00
Michal Čihař
c93c82ee9c Fix typo in validator 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 10:59:03 +02:00
Michal Čihař
fa7a9b787b Improve error handling in setup in case config dir is not present 
We do not show these options in UI, but the scripts should handle it
gracefully.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 10:58:53 +02:00
Michal Čihař
96c6a7c0a2 Validate input of validator 
We can not trust the input here, so we can expect anything and deal with
missing parameters or invalid values.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 10:13:12 +02:00
Michal Čihař
e1eb5e8e89 Fix error reporting on invalid request data 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 09:52:12 +02:00
Michal Čihař
8451a7a5d2 Move request conversion to generic code 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 09:35:02 +02:00
Michal Čihař
c9faf855a0 Properly convert POST parameters 
We can get array instead of single parameter, so handle this gracefully.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 09:10:30 +02:00
Michal Čihař
6b52ae4d19 Adjust test expectations to match new code 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 08:55:39 +02:00
Michal Čihař
805225a28c Limit number of included scripts in get_scripts.js.php 
This avoids potential DOS, the limit is same as we use for generating
the URLs.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-15 18:04:43 +02:00
Madhura Jayaratne
75724a361b Fix #11457 414 Request-URI Too Large 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-15 18:04:16 +02:00
Michal Čihař
bf7379771f Use javascript for redirection to https 
The current approach is broken since whitelisting is active in url.php
and also allows potential bbcode injection.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-15 17:48:43 +02:00
Michal Čihař
ee10ed1306 Document changes 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-30 09:37:33 +02:00
Michal Čihař
d26422eae5 Pass links from changelog through url.php 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-30 09:31:27 +02:00
Michal Čihař
b2054a1834 Allow url.php to be used without valid token 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-30 09:28:35 +02:00
Michal Čihař
82fc97b15e Pass external links from setup via url.php 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-30 09:23:36 +02:00
Michal Čihař
b19c426726 Extend url whitelist to match master 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-30 09:22:25 +02:00
Michal Čihař
27505e1c2d Use url.php even in the setup script 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-30 09:19:59 +02:00
Michal Čihař
6f413680b1 Backport URL redirection from later releases 
- fixes token leak for browsers which do not change referer on
  Location header
- adds whitelist to avoid redirection to any domain

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 09:48:53 +02:00
Isaac Bennetch
b1cc43ee7f 4.0.10.15 release 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-02-29 08:13:06 -05:00
Madhura Jayaratne
fe3be9f4b9 Fix XSS in zoom search 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-02-29 12:33:47 +11:00
Madhura Jayaratne
7ddce5e39a Fix XSS in User accounts page 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-02-29 11:24:04 +11:00
Michal Čihař
e795141fba Add changes for security issues 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-25 13:35:26 +01:00
Michal Čihař
25a632a9f4 Merge pull request #22 from phpmyadmin/json-response 
Use correct headers for json data
 2016-02-25 12:32:45 +01:00
Michal Čihař
155876b48f Merge pull request #20 from phpmyadmin/xss-host 
Urlencode hostname
 2016-02-25 11:57:24 +01:00
Michal Čihař
45ecc10d18 Avoid skipping the SSL certificate check in TCPDF 
This code is never used in phpMyAdmin, but we fix it just to avoid
potential security reports.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-25 10:29:26 +01:00
Michal Čihař
0667ea8ac7 Use correct headers for json data 
It was previously not marked as such what could potentially lead to
browsers doing some autodetection.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-25 10:23:23 +01:00
Michal Čihař
73c8245a3d Urlencode hostname 
This can come from the HTTP header, so we need to be sure to sanitize
it.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-25 09:57:29 +01:00
Michal Čihař
b8f1e0f325 Escape SQL query for inline editing 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-25 09:13:09 +01:00
Isaac Bennetch
945c58b9d2 Release 4.0.10.14 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-01-29 09:49:22 -05:00
Michal Čihař
04a20d5435 Fix syntax error in disabled test 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-28 15:10:10 +01:00
Michal Čihař
bf2fde282e Merge pull request #11893 from madhuracj/bug11891 
Fix #11891 Error with PMA 4.0.10.13 with PHP 5.2
 2016-01-28 15:04:19 +01:00
Michal Čihař
3f9c1680c0 Skip PDO test on PHP 5.2 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-28 15:03:11 +01:00
Michal Čihař
f9b36a377a Use syntax compatible with older PHP versions 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-28 14:59:46 +01:00
Michal Čihař
d4447a53fa Include more verbose error message 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-28 14:57:27 +01:00
Michal Čihař
7ca28f105b Skip not supported test on PHP 5.2 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-28 14:50:34 +01:00
Michal Čihař
1e5d12abcd Revert "Make test check compatible with PHP 5.2" 
This reverts commit 6babab9874.
 2016-01-28 14:46:34 +01:00
Michal Čihař
6babab9874 Make test check compatible with PHP 5.2 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-28 14:43:19 +01:00
Michal Čihař
9b5c64e14d Correctly place expected result 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-28 14:40:58 +01:00
Michal Čihař
ed9e2b474d Remove non working break 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-28 14:38:25 +01:00
Michal Čihař
c1377f30a2 Define missing queries in the dummy driver 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-28 14:33:37 +01:00
Michal Čihař
e167f5ade9 Make the test skip without pdo_mysql 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-28 14:30:05 +01:00
Michal Čihař
2cc9f56559 Remove mistakenly pasted filename 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-28 14:19:58 +01:00
Michal Čihař
00c64c6dde Skip tests if ReflectionClass::setAccessible is not available 
This is the case on PHP 5.2.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-28 14:17:37 +01:00
Michal Čihař
16e2f464ff Try to run Travis own phpunit 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-28 14:12:37 +01:00
Michal Čihař
f1ceadaa46 Run php lint on all files 
Also avoid trying to use composer on PHP 5.2, it simply doesn't work
there.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-28 14:11:40 +01:00
Michal Čihař
10dd46fca4 Use PHP 5.4 for running composer 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-28 14:04:28 +01:00
Michal Čihař
632380d3d9 Test with PHP 5.2 to ensure we don't again release something broken 
Issue #11891

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-28 14:00:27 +01:00