gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
106,435 Commits 12 Branches 481 Tags 2.4 GiB
a6eaffe11c
Commit Graph

106435 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michal Čihař
61b4e28faf Sanitize page and formset before using 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:21:53 +02:00
Michal Čihař
8552da5842 Do not ignore error here 
The previous fetchAssoc would also fail in case of invalid resource.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:19:42 +02:00
Michal Čihař
8ac8ca1a02 Share code for parsing Proc_priv 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:17:31 +02:00
Michal Čihař
e25ab25d5f Define array before using it 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:13:32 +02:00
Michal Čihař
cc6fd10b28 Add separator 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:04:21 +02:00
Michal Čihař
81e72439b6 Merge branch 'QA_4_6' 2016-06-17 14:00:15 +02:00
Michal Čihař
07216c9b8e Ensure that connection collation contains no HTML 
There is currently no MySQL collation which would do that, but just to
be safe.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:58:26 +02:00
Michal Čihař
04a72687f8 Add missing escaping 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:54:26 +02:00
Michal Čihař
dbd848d595 Fix wrong redirection tests 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:36:58 +02:00
Michal Čihař
e531526bc5 Merge branch 'QA_4_6' 2016-06-17 13:22:06 +02:00
Michal Čihař
58da975117 Add missing URL encoding 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:22:01 +02:00
Michal Čihař
170c045507 Simplify code for processing SQL query to display 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:21:01 +02:00
Michal Čihař
84507dfeb6 Merge branch 'QA_4_6' 2016-06-17 13:10:28 +02:00
Michal Čihař
a5950f9ecd Fix link to mariadb explain analyzer 
- avoid double urlencoding of the query
- properly escape html entities

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:05:11 +02:00
Michal Čihař
d1ec59f05f Ensure we have integer as offset 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:01:56 +02:00
Michal Čihař
aef5df7e13 Ensure we have integer as position 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:00:45 +02:00
Michal Čihař
325122658a Fix parameter type documentation 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 12:59:37 +02:00
Michal Čihař
8bf3cf6578 Use URL::getCommon to construct complete URL 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 12:58:14 +02:00
Michal Čihař
dce94f229f More consistency for URL::getCommon 
Now URL::getCommon always returns HTML encoded string, if you want
unencded one, use URL::getCommonRaw. This makes it easier to review the
code if uses correct variant.

Also I've fixed several wrong uses of the HTML encoded variant in
Location header.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 12:44:29 +02:00
Michal Čihař
41d5c1e127 Merge branch 'QA_4_6' 2016-06-17 11:44:30 +02:00
Michal Čihař
009148075f PMA_jsFormat accepts only strings 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 11:43:51 +02:00
Michal Čihař
00b9be9c4a Merge branch 'QA_4_6' into QA_4_6-security 2016-06-17 11:23:36 +02:00
Michal Čihař
cdc7a6c6bf Merge branch 'QA_4_6' 2016-06-17 11:23:25 +02:00
Michal Čihař
4a9da1df40 Adjust tests to new error reporting handling of objects 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 11:23:20 +02:00
Michal Čihař
1d2e2be925 Merge branch 'QA_4_6' into QA_4_6-security 2016-06-17 11:20:18 +02:00
Michal Čihař
3847cee0a4 Merge branch 'QA_4_6' 2016-06-17 11:20:05 +02:00
Michal Čihař
f5e8953356 Share backtrace processing for debugging and error reporting 
We want to achieve same thing in both cases - backtrace which is
stripped from sensitive information, has reasonable size and can be
read. Sharing the code will make it easier to fix possible problems and
also will make both cases behave consistent.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 11:18:39 +02:00
Michal Čihař
aea7654804 Merge branch 'QA_4_6' 2016-06-17 11:04:35 +02:00
Michal Čihař
ee0955b30b Use same condition for link start as for link end 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 11:04:28 +02:00
Michal Čihař
331c560fbf Improve error handling in setup in case config dir is not present 
We do not show these options in UI, but the scripts should handle it
gracefully.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 10:54:11 +02:00
Michal Čihař
cd229d718e Validate input of validator 
We can not trust the input here, so we can expect anything and deal with
missing parameters or invalid values.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 10:14:13 +02:00
Michal Čihař
96e0aa3565 Fix error reporting on invalid request data 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 09:35:57 +02:00
Michal Čihař
ef1493d9b4 Move request conversion to generic code 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 09:35:57 +02:00
Michal Čihař
b0180f18c8 Properly convert POST parameters 
We can get array instead of single parameter, so handle this gracefully.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 09:12:28 +02:00
Michal Čihař
6c5d5ffc7f Merge branch 'QA_4_6' into QA_4_6-security 2016-06-17 09:02:13 +02:00
Michal Čihař
c3ae85b2e1 Merge branch 'QA_4_6' 2016-06-17 08:55:48 +02:00
Michal Čihař
c00fe2cbfd Fix listing routines for non privileged user 
We first need to check if we can read the definition before parsing it.

Fixes #12310

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 08:55:04 +02:00
Michal Čihař
eb942e68b9 Merge branch 'QA_4_6' 2016-06-16 16:18:02 +02:00
Michal Čihař
80c7b8a561 Add missing escaping 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 16:17:36 +02:00
Michal Čihař
bc339b55f0 These are strings, handle them according to that 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 15:54:19 +02:00
Michal Čihař
2a4a073650 Simplify Index::isPackaged 
We really do not use most of the functionality, so let it do only what
we need.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 15:43:53 +02:00
Michal Čihař
d3aa8c5fb6 Call htmlspecialchars as we do not need to process complex types here 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 15:39:39 +02:00
Michal Čihař
9869a95641 Simplify Message adding methods 
The methods are now called based on added type:

- addHtml adds HTML code as is
- addText adds text after escaping it
- addMessage adds Message instance

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 15:23:45 +02:00
Michal Čihař
54a76de3d8 'Replace addString calls with correct method based on content 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 15:20:30 +02:00
Michal Čihař
19f76066f2 Separate adding string and Message objects to Message 
This way we can rely on type checking and avoid potential problems with
escaping.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 15:16:29 +02:00
Michal Čihař
a7cd193554 Make it clear whether addMessages expects string or Message object 
With this, it's way easier to anaylize code for potential problems with
escaping.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 14:56:41 +02:00
Michal Čihař
a87c164435 Actually get warning messages to display 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 14:50:46 +02:00
Michal Čihař
efac710526 The Html methods accept strings only 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 14:39:32 +02:00
Michal Čihař
c6a6bbfb2f Fix test expectations to match current code 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 14:30:29 +02:00
Michal Čihař
bba718fa7a Fix type comment 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-16 14:28:51 +02:00