gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
105,662 Commits 12 Branches 481 Tags 2.4 GiB
99492bf42a
Commit Graph

105662 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michal Čihař
99492bf42a Merge branch 'QA_4_6' into QA_4_6-security 2016-07-26 16:29:07 +02:00
Michal Čihař
64f033d3b9 Tighthen control on PHP sessions and session cookies 
- use only cookies for session
- use http only cookies
- disable transparent session IDs

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:23:51 +02:00
Michal Čihař
6c95b73f90 Do not append session IDs to all URLs in redirect 
There is no need to do that as we rely on session cookies anyway. Also
appending sesson ID to external URLs is not a good idea.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:20:04 +02:00
Michal Čihař
c868852ae4 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-26 16:06:29 +02:00
Michal Čihař
53af6a5699 Simplify session handling on possibly long requests 
We really do not have to reconfigure sessions on restarting them.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:04:56 +02:00
Michal Čihař
3ec8ba8693 Merge pull request #179 from phpmyadmin/remove-phpinfo 
Remove option to show phpinfo() ($cfg['ShowPhpInfo'])
 2016-07-26 11:01:11 +02:00
Deven Bansod
25182fb6c3 Fix #12391 : Message with 'Change password successfully' displayed, but does not take effect 
Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-07-26 00:25:08 +05:30
Deven Bansod
7d0ce4bb8b ChangeLog entry for #12394 
Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-07-23 15:42:08 +05:30
Deven Bansod
622a6f2389 Fix #12394 : Create view should require a view name 
Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-07-23 15:07:54 +05:30
Michal Čihař
e67e69229a Remove option to show phpinfo() ($cfg['ShowPhpInfo']) 
This is really more a PHP debugging feature than anything related to
phpMyAdmin. If user wants to debug, it's as simple a creating file with
one line of php code.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 11:31:46 +02:00
Michal Čihař
754c1c987b Properly mark requests to lint as AJAX request 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 11:26:10 +02:00
Michal Čihař
d3a91549be Remove file path from the session error message 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 10:55:25 +02:00
Michal Čihař
b932b94577 Ensure GIS point coordinates are numeric 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 10:22:56 +02:00
Michal Čihař
f0f8f2b65e Escape routine privileges listing 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 09:38:44 +02:00
Michal Čihař
1e6b740e6f Enable LOAD DATA LOCAL INFILE only when needed 
There is no need to have this feature allowed for normal SQL queries, it
can lead to leaking sensitive files from the web server. It's enough to
enable it only in LDI import plugin, where we control what queries are
executed.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 09:02:31 +02:00
Michal Čihař
835958af31 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-22 16:50:12 +02:00
Michal Čihař
623f5b4621 Remove no longer used code 
It was used by old charts code to download charts.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 16:48:33 +02:00
Michal Čihař
61150656df Fixed invalid Content-Length in some HTTP responses 
Use strlen for calculating HTTP response size, we're interested in bytes
not utf-8 chars.

Issue #12397

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 16:41:51 +02:00
Michal Čihař
76e87c3e33 Do not use mb_strlen on data we know are bytes 
Issue #12397

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 16:39:12 +02:00
Michal Čihař
ff1016e504 Limit maximal numver of fields to 4096 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 16:02:58 +02:00
Michal Čihař
28eb84ef43 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-22 15:48:09 +02:00
Michal Čihař
99903101d9 Enfornce numeric field length when creating table 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 15:47:38 +02:00
Michal Čihař
fd324e583e Revert "Move return to correct place" 
This reverts commit d93b873637.
 2016-07-22 14:44:39 +02:00
Michal Čihař
d93b873637 Move return to correct place 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:42:02 +02:00
Michal Čihař
024a924b38 Avoid calculating strlen twice 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:12:45 +02:00
Michal Čihař
9106b33933 Improve secrets splitting 
- ensure it has 16 bytes
- extends it by copying content if original is too short
- correctly handle corner cases (eg. 1 byte secret)

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:10:28 +02:00
Michal Čihař
643681ee68 Use consistent iv and encrypted text concatenation as other libs 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 13:46:51 +02:00
Michal Čihař
67b538efc3 Send standard set of HTTP headers on redirect 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 12:19:35 +02:00
Michal Čihař
5d1a6af96f Merge branch 'QA_4_6' into QA_4_6-security 2016-07-22 12:12:32 +02:00
Michal Čihař
1d70a1ba64 Allow only https outgoing links 
We no longer produce http links, so it's better to filter out these at
all levels.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 12:10:11 +02:00
Michal Čihař
23695db151 Change advisory rules links to https 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 12:08:00 +02:00
Michal Čihař
41e3db158f Properly escape NavigationTreeDbSeparator in queries 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 12:02:11 +02:00
Michal Čihař
ddeab2a11f Sanitize filename on SHP import 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 11:52:49 +02:00
Michal Čihař
d9f918c365 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-22 11:32:17 +02:00
Michal Čihař
48764f2260 Delete temporary file before reporting error 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 11:31:56 +02:00
Michal Čihař
bc6fbbe032 Update documentation copyright 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:38:38 +02:00
Michal Čihař
a32b3ceb6e Use single quotes 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:38:19 +02:00
Michal Čihař
3ee65fc8bf Use MAC to verify IV as well 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:29:46 +02:00
Michal Čihař
f693c103be Document 32 chars length for blowfish_secret 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:23:43 +02:00
Michal Čihař
2b7be93829 Improve Blowfish secret generation in setup script 
Now generates secret containing all printable ASCII chars, making it way
more random than with hex encoded random string.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:19:31 +02:00
Michal Čihař
f07fd90ee9 Document recommended length of 32 for blowfish_secret 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:14:02 +02:00
Michal Čihař
ef03daf658 Remove hashing of blowfish secret 
New code doesn't have problems with longer secrets.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:59:02 +02:00
Michal Čihař
d29df46b3a Do not generate too long session secret 
We need 16+16 bytes, generating 256 is not really needed.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:58:39 +02:00
Michal Čihař
e2a25d773d Merge pmaServer and pmaPass cookies 
This addresses several issues:

- makes server name encrypted and authenticated, so that it can not be
  tampered
- reduces cookie usage
- reduces overhead of encryption/authentication

The pmaUser cookie is still separate to avoid different lifetime
(pmaUser has month lifetime, while pmaAuth is session only by default).

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
2a2d865d50 Validate input data from cookies 
We expect strings only, so not accept anything else.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
f45b8cd49c Use different secret for MAC than encryption 
Generated using string splitting.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:29 +02:00
Kamyar Sec
69c38579f6 Translated using Weblate (Kurdish Sorani) 
Currently translated at 18.1% (582 of 3209 strings)

[CI skip]
 2016-07-22 09:45:21 +02:00
Michal Čihař
0fad7290c9 Escape database name in SQL query 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-19 09:20:15 +02:00
Michal Čihař
3ba8a026fc Use hash_hmac for MAC rather than plain SHA1 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:56:52 +02:00
Michal Čihař
67d6eeac42 Improve URL filtering in url.php 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:39:25 +02:00