gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
105,630 Commits 12 Branches 481 Tags 2.4 GiB
ddeab2a11f
Commit Graph

976 Commits

Author SHA1 Message Date
Michal Čihař
ddeab2a11f Sanitize filename on SHP import 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 11:52:49 +02:00
Michal Čihař
48764f2260 Delete temporary file before reporting error 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 11:31:56 +02:00
Michal Čihař
3ee65fc8bf Use MAC to verify IV as well 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:29:46 +02:00
Michal Čihař
ef03daf658 Remove hashing of blowfish secret 
New code doesn't have problems with longer secrets.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:59:02 +02:00
Michal Čihař
d29df46b3a Do not generate too long session secret 
We need 16+16 bytes, generating 256 is not really needed.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:58:39 +02:00
Michal Čihař
e2a25d773d Merge pmaServer and pmaPass cookies 
This addresses several issues:

- makes server name encrypted and authenticated, so that it can not be
  tampered
- reduces cookie usage
- reduces overhead of encryption/authentication

The pmaUser cookie is still separate to avoid different lifetime
(pmaUser has month lifetime, while pmaAuth is session only by default).

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
2a2d865d50 Validate input data from cookies 
We expect strings only, so not accept anything else.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
f45b8cd49c Use different secret for MAC than encryption 
Generated using string splitting.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:29 +02:00
Michal Čihař
3ba8a026fc Use hash_hmac for MAC rather than plain SHA1 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:56:52 +02:00
Michal Čihař
1543be7138 Use https to access phpmyadmin.net 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:22:33 +02:00
Michal Čihař
3a4172525f Merge branch 'QA_4_6' into QA_4_6-security 2016-07-18 15:56:38 +02:00
Michal Čihař
d35c3d9ed5 Update ReCaptcha library to 1.1.2 
There should be no functional changes.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 15:51:44 +02:00
Michal Čihař
205694982b Fix exporting multiline comments 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 12:16:50 +02:00
Michal Čihař
e4be768781 Ensure widht and height are integers 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:55:07 +02:00
Michal Čihař
dc899d8e75 Ensure widht and height are integers 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:52:28 +02:00
Michal Čihař
c3310536b2 Ensure widht and height are integers 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:49:47 +02:00
Michal Čihař
cc6853538c Properly escape error input in the message 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:46:14 +02:00
Michal Čihař
dc52930bba Properly handle newlines in SQL comments 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 09:59:39 +02:00
Michal Čihař
80b03a4f16 Ensure page number is integer 
Even if somebody decides to change configuration storage structure.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 16:57:35 +02:00
Michal Čihař
767195e197 Sanitize MySQL host name before connecting 
It can contain p: prefix which we don't want to honor.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 15:14:57 +02:00
Michal Čihař
2ef4fe3d84 Use iframe sandbox for rendering HTML in transformation 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 14:15:30 +02:00
Michal Čihař
6da13e2a1c Escape HTML in Mediawiki comments 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 12:30:58 +02:00
Michal Čihař
2ea0b722d7 Use _blank target instead of invalid _new 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 11:22:23 +02:00
Michal Čihař
3c06eede3f Add rel="noopener noreferrer" to all target="_blank" links 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 11:02:53 +02:00
Michal Čihař
0bf21ebf72 Use whitelist rather than blacklist for URL filtering 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 10:37:25 +02:00
Michal Čihař
fc6ef261eb Remove Swekey support 
It is buggy and their servers are no longer working.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-11 09:02:58 +02:00
Michal Čihař
c0b2d56ac0 Use https for wiki links 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-09 09:12:43 +02:00
Michal Čihař
a97be3a604 Improve cookie encryption 
- use MAC to validate content before decryption
- create unique IV for every cookie

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-08 17:40:05 +02:00
Michal Čihař
7de139b90c Properly escape generated XML export 
Many fields could contain XML markup, so we need to ensure the generated
XML is valid.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-30 10:54:05 +02:00
Michal Čihař
2b5915ce7b Use phpMyAdmin version in PHP export header 
Using fixed 0.2b really makes no sense.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-30 10:27:26 +02:00
Michal Čihař
a82835cf09 Generate valid PHP code even when table/database name contains PHP markup 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-30 10:22:39 +02:00
Michal Čihař
615212a14d Do not allow javascript: links in transformation 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-22 13:28:07 +02:00
Michal Čihař
1cc7466db3 Quote delimiter before using preg_replace 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-20 12:16:03 +02:00
Michal Čihař
be3ecbb4cc Simplify and cleanup transformation plugins 
Remove PMA_transformation_global_html_replace which makes the code only
more confusing.

Also add escaping to browse transformations.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 16:18:13 +02:00
Michal Čihař
43fdcb67ee Include phpMyAdmin version in JSON dump 
This provides useful information, the 0.1 string was not really helpful.

Issue #12304

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-09 09:19:55 +02:00
Michal Čihař
d7fcbab1cd Ensure we parse query for views as well 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-08 14:00:04 +02:00
Michal Čihař
b49030528f Fixed export of tables without explicitly set engine 
Fixes #12290

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-03 14:41:55 +02:00
Michal Čihař
e1f8c36c79 Fix class namespace 
Fixes loading of APC based upload progress bar

Fixes #12248

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 17:37:38 +02:00
Michal Čihař
3b374237d6 Fixed export of ARCHIVE tables with keys 
We can not rewrite the ARCHIVE table as it can not be altered.

Fixes #12082

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 15:54:26 +02:00
Michal Čihař
f978e347fb Add missing requie once for testsuite 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 14:28:28 +02:00
Michal Čihař
f9d6c40939 Safer handling of sessions during authentication 
- always generate new session for login form
- always generate new session when authenticated using cookie auth

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 13:48:25 +02:00
Michal Čihař
adfd5a22b9 Avoid double redirects in signon auth on logout 
Also adjusts tests to no longer rely on runkit.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 13:23:16 +02:00
Michal Čihař
11eb574242 Improve handling of logout 
- add separate script for handling logout
- no longer require old_usr for all authentication methods
  (this avoids potential information leak)
- require valid token for logout

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 13:02:21 +02:00
Michal Čihař
21db724c85 Remove need for having define for test 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 12:09:36 +02:00
Michal Čihař
b0f8511e60 Use https for links to www.phpmyadmin.net 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-17 10:49:21 +02:00
Michal Čihař
11089cbe41 Use https for links to dev.mysql.com 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-17 10:16:44 +02:00
Michal Čihař
3771852471 Use https when linking to php.net 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-17 10:10:13 +02:00
Michal Čihař
1580d2fa4d Fixed SQL quoting in SQL export 
The fix for 4.5 branch was wrongly merged here.

Fixes #12029

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-04-05 10:05:22 +02:00
Michal Čihař
1b43606a48 Fixed possible invalid SQL export 
We should emit the charset restoration only if we have emitted its
setting in the header. As the condition was slightly different in both
cases it was possible that only one part of these two was emitted in
past.

Fixes #12074

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-03-18 10:34:17 +01:00
Michal Čihař
1523985bce Fix login after logout with http authentication 
We can not check token here as it's always there (in the URL) after
logout.

Fixes #12098

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-03-17 11:31:06 +01:00