gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
109,640 Commits 12 Branches 481 Tags 2.4 GiB
d3d5b994fc
Commit Graph

358 Commits

Author SHA1 Message Date
Michal Čihař
f4ae5f0d25 Gracefully handle early fatal errors in AJAX requests 
Generate response manually when Response object is not yet ready to be
used but we need AJAX response.

Fixes #13092

Signed-off-by: Michal Čihař <michal@cihar.com>
 2017-06-08 15:47:07 +02:00
Michal Čihař
bcc7c7af35 Allow secure.php.net in url redirector 
Fixes #12993

Signed-off-by: Michal Čihař <michal@cihar.com>
 2017-02-13 11:30:42 +01:00
Michal Čihař
cbd2c17a1d Merge branch 'master' into master-security 2017-01-17 13:37:08 +01:00
Michal Čihař
8633f44db0 Remove code for PMA_TEST_HEADERS 
It's no longer necessary.

Issue #12079

Signed-off-by: Michal Čihař <michal@cihar.com>
 2017-01-08 10:58:19 +01:00
Michal Čihař
3f4487f985 Merge branch 'master' into master-security 2016-12-21 11:11:25 +01:00
Michal Čihař
3a7eaf8538 Merge branch 'QA_4_6' 2016-12-19 15:28:25 +01:00
Michal Čihař
71e0c4bb67 Fix early fatal errors 
We can not rely on whole stack being ready.

Fixes #12810

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-14 16:07:55 +01:00
Michal Čihař
73499a5e56 Do not delete session on fatal error 
I see no reason why this should be done, the fatal error is used
in following cases:

* Very early when there is no session (eg. missing extension)
* Invalid value for parameters
* Invalid invocation like too big request

In neither case session removal will do any good.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-13 11:51:43 +01:00
Michal Čihař
ea065f54d5 Merge branch 'master' into master-security 2016-12-13 10:55:17 +01:00
jrchamp
e52bbde39b PMA_getRealSize - Performance and Readability 
The "upstream" Moodle code was updated in MDL-39524; rather than looping through the options, preg_match allows us to directly select the correct multiplication factor with a single function call. Note that the default behavior (integer coercion) handles both bare integers and numbers of bytes (factor 1).

Signed-off-by: Jonathan Champ <jrchamp@ncsu.edu>
 2016-12-09 15:13:20 -05:00
Michal Čihař
c1cc04c298 Merge branch 'QA_4_6' 2016-12-08 13:17:56 +01:00
Michal Čihař
9693522a86 Revert "Use unserialize without objects if available" 
This reverts commit d61dbc1d6f.

Honestly I don't think this work as documented:

PHP Warning:  unserialize() expects parameter 2 to be array, boolean given
 2016-12-08 13:17:03 +01:00
Michal Čihař
0079d9a940 Merge branch 'QA_4_6' 2016-12-08 12:04:26 +01:00
Michal Čihař
d61dbc1d6f Use unserialize without objects if available 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-08 12:04:05 +01:00
Michal Čihař
b40ada1974 Merge branch 'QA_4_6-security' into master-security 2016-12-08 11:58:04 +01:00
Michal Čihař
3b6ed1f9ec Improve PHP path cleanup 
- properly handle situation when query string contains PATH_INFO
- cleanup path from any relative parts

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-08 11:56:46 +01:00
Michal Čihař
308c9d7951 Simplify Response object handling 
- always use use and short name
- avoid calling getInstance() several times in one script

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-07 18:17:59 +01:00
Michal Čihař
b56f101039 Remove is_ajax_request global 
We already have the same information on Response object, so let's use it
from there.

Issue #11731

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-07 17:54:34 +01:00
Madhura Jayaratne
93e9ef04f7 Fix #12783 Remove unused PMA_addJSCode function 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-12-05 20:35:13 +11:00
Michal Čihař
ef1f3b5cf7 Merge branch 'QA_4_6' 2016-11-28 12:07:19 +01:00
Michal Čihař
ad55a6eba8 Avoid listing demo.phpmyadmin.net twice 
Fixes #12744

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-11-28 11:39:21 +01:00
Michal Čihař
cad75c95c4 Merge branch 'QA_4_6-security' into master-security 2016-11-08 15:58:47 +01:00
Deven Bansod
8119464150 Handle multiple :p while sanitizing MySQL hosts 
Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-11-08 10:11:09 +05:30
Michal Čihař
2ed64c3c6a Merge branch 'master' into master-security 2016-10-24 13:55:39 +02:00
Michal Čihař
75a5fde46d Use secure.php.net for PHP documentation links 
This avoids unnecessary redirect on the way (I still think this website
setup is weird, but that's all I can do about it).

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-10-18 11:13:24 +02:00
Michal Čihař
e6abff8a7f Be consistent in filename sanitization 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-10-10 17:20:13 +02:00
Michal Čihař
ad39140c86 Merge branch 'QA_4_6-security' into master-security 2016-10-04 13:18:16 +02:00
Michal Čihař
17b34be04f Correctly parse string length when checking serialized data 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-10-04 13:17:59 +02:00
Michal Čihař
19c24a8c6c Merge branch 'master' into master-security 2016-09-16 10:30:28 +02:00
Michal Čihař
3546bed47e Avoid using mb_strlen for checking whether string is empty 
Using strlen produces same results here, just way faster.

Fixes #12397

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-09-16 10:29:21 +02:00
Michal Čihař
5ee95b3615 Merge branch 'QA_4_6-security' into master-security 2016-09-02 15:04:55 +02:00
Michal Čihař
dac36c3cd8 Stricter URL validation 
- do not use empty() as empty('0') is true
- do not lowercase the strings, use them as they are
- lowercase all domains in our codebase
- do not allow to specify port

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-09-02 15:00:43 +02:00
Michal Čihař
50f48aa629 Merge branch 'master' into master-security 2016-09-02 14:41:13 +02:00
Sudheesh Singanamalla
2833c6b324 Fixes #12509 Removes unused function PMA_addJSVar 
Signed-off-by: Sudheesh Singanamalla <sudheesh1995@outlook.com>
 2016-09-01 12:28:16 +05:30
Michal Čihař
16da93378b Merge branch 'master' into master-security 2016-08-18 17:09:54 +02:00
Michal Čihař
d62494cd8c Merge branch 'QA_4_6' into QA_4_6-security 2016-08-18 17:09:37 +02:00
Michal Čihař
9c5528b4cb Merge branch 'QA_4_6' 2016-08-18 17:09:24 +02:00
Michal Čihař
c44f5ab080 Always use UTC time in HTTP headers 
Using timezones in this context can cause problem when DST changes
apply.

Also this can be information leak of server timezone.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 17:07:00 +02:00
Michal Čihař
b2ea7205fb Merge branch 'QA_4_6-security' into master-security 2016-08-18 09:12:49 +02:00
Michal Čihař
9dbe520e90 Strip null bytes from MySQL username 
In old PHP versions this could lead to allow/deny rules bypass.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 09:11:45 +02:00
Michal Čihař
23e01d306a Merge branch 'QA_4_6' 2016-08-17 15:38:22 +02:00
Michal Čihař
01b9db6b1c Rename getCookiePath() to getRootPath() 
It is not used only for cookies, so generic name makes more sense.

Issue #12374

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-17 15:35:15 +02:00
Michal Čihař
311be7515c Use https when available 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-17 13:17:41 +02:00
Michal Čihař
aebbb31aad Merge branch 'master' into master-security 2016-07-29 14:08:23 +02:00
Michal Čihař
f5015c2ea3 Merge branch 'QA_4_6-security' into master-security 2016-07-26 16:31:21 +02:00
Michal Čihař
99492bf42a Merge branch 'QA_4_6' into QA_4_6-security 2016-07-26 16:29:07 +02:00
Michal Čihař
22c4ede46d Merge branch 'QA_4_6' 2016-07-26 16:26:57 +02:00
Michal Čihař
6c95b73f90 Do not append session IDs to all URLs in redirect 
There is no need to do that as we rely on session cookies anyway. Also
appending sesson ID to external URLs is not a good idea.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:20:04 +02:00
Michal Čihař
2adf1ca83e Merge branch 'QA_4_6-security' into master-security 2016-07-22 11:35:14 +02:00
Michal Čihař
3ba8a026fc Use hash_hmac for MAC rather than plain SHA1 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:56:52 +02:00