gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
105,649 Commits 12 Branches 481 Tags 2.4 GiB
f0f8f2b65e
Commit Graph

105649 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michal Čihař
f0f8f2b65e Escape routine privileges listing 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 09:38:44 +02:00
Michal Čihař
1e6b740e6f Enable LOAD DATA LOCAL INFILE only when needed 
There is no need to have this feature allowed for normal SQL queries, it
can lead to leaking sensitive files from the web server. It's enough to
enable it only in LDI import plugin, where we control what queries are
executed.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 09:02:31 +02:00
Michal Čihař
835958af31 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-22 16:50:12 +02:00
Michal Čihař
623f5b4621 Remove no longer used code 
It was used by old charts code to download charts.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 16:48:33 +02:00
Michal Čihař
61150656df Fixed invalid Content-Length in some HTTP responses 
Use strlen for calculating HTTP response size, we're interested in bytes
not utf-8 chars.

Issue #12397

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 16:41:51 +02:00
Michal Čihař
76e87c3e33 Do not use mb_strlen on data we know are bytes 
Issue #12397

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 16:39:12 +02:00
Michal Čihař
ff1016e504 Limit maximal numver of fields to 4096 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 16:02:58 +02:00
Michal Čihař
28eb84ef43 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-22 15:48:09 +02:00
Michal Čihař
99903101d9 Enfornce numeric field length when creating table 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 15:47:38 +02:00
Michal Čihař
fd324e583e Revert "Move return to correct place" 
This reverts commit d93b873637.
 2016-07-22 14:44:39 +02:00
Michal Čihař
d93b873637 Move return to correct place 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:42:02 +02:00
Michal Čihař
024a924b38 Avoid calculating strlen twice 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:12:45 +02:00
Michal Čihař
9106b33933 Improve secrets splitting 
- ensure it has 16 bytes
- extends it by copying content if original is too short
- correctly handle corner cases (eg. 1 byte secret)

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:10:28 +02:00
Michal Čihař
643681ee68 Use consistent iv and encrypted text concatenation as other libs 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 13:46:51 +02:00
Michal Čihař
67b538efc3 Send standard set of HTTP headers on redirect 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 12:19:35 +02:00
Michal Čihař
5d1a6af96f Merge branch 'QA_4_6' into QA_4_6-security 2016-07-22 12:12:32 +02:00
Michal Čihař
1d70a1ba64 Allow only https outgoing links 
We no longer produce http links, so it's better to filter out these at
all levels.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 12:10:11 +02:00
Michal Čihař
23695db151 Change advisory rules links to https 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 12:08:00 +02:00
Michal Čihař
41e3db158f Properly escape NavigationTreeDbSeparator in queries 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 12:02:11 +02:00
Michal Čihař
ddeab2a11f Sanitize filename on SHP import 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 11:52:49 +02:00
Michal Čihař
d9f918c365 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-22 11:32:17 +02:00
Michal Čihař
48764f2260 Delete temporary file before reporting error 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 11:31:56 +02:00
Michal Čihař
bc6fbbe032 Update documentation copyright 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:38:38 +02:00
Michal Čihař
a32b3ceb6e Use single quotes 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:38:19 +02:00
Michal Čihař
3ee65fc8bf Use MAC to verify IV as well 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:29:46 +02:00
Michal Čihař
f693c103be Document 32 chars length for blowfish_secret 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:23:43 +02:00
Michal Čihař
2b7be93829 Improve Blowfish secret generation in setup script 
Now generates secret containing all printable ASCII chars, making it way
more random than with hex encoded random string.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:19:31 +02:00
Michal Čihař
f07fd90ee9 Document recommended length of 32 for blowfish_secret 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:14:02 +02:00
Michal Čihař
ef03daf658 Remove hashing of blowfish secret 
New code doesn't have problems with longer secrets.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:59:02 +02:00
Michal Čihař
d29df46b3a Do not generate too long session secret 
We need 16+16 bytes, generating 256 is not really needed.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:58:39 +02:00
Michal Čihař
e2a25d773d Merge pmaServer and pmaPass cookies 
This addresses several issues:

- makes server name encrypted and authenticated, so that it can not be
  tampered
- reduces cookie usage
- reduces overhead of encryption/authentication

The pmaUser cookie is still separate to avoid different lifetime
(pmaUser has month lifetime, while pmaAuth is session only by default).

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
2a2d865d50 Validate input data from cookies 
We expect strings only, so not accept anything else.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
f45b8cd49c Use different secret for MAC than encryption 
Generated using string splitting.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:29 +02:00
Kamyar Sec
69c38579f6 Translated using Weblate (Kurdish Sorani) 
Currently translated at 18.1% (582 of 3209 strings)

[CI skip]
 2016-07-22 09:45:21 +02:00
Michal Čihař
0fad7290c9 Escape database name in SQL query 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-19 09:20:15 +02:00
Michal Čihař
3ba8a026fc Use hash_hmac for MAC rather than plain SHA1 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:56:52 +02:00
Michal Čihař
67d6eeac42 Improve URL filtering in url.php 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:39:25 +02:00
Michal Čihař
7e6edaf756 Add tests for PMA_isAllowedDomain 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:36:55 +02:00
Michal Čihař
1543be7138 Use https to access phpmyadmin.net 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:22:33 +02:00
Michal Čihař
c0a05eced4 Merge branch 'QA_4_6-security' of github.com:phpmyadmin/phpmyadmin-security into QA_4_6-security 2016-07-18 15:57:22 +02:00
Michal Čihař
3a4172525f Merge branch 'QA_4_6' into QA_4_6-security 2016-07-18 15:56:38 +02:00
Michal Čihař
ff9291964c Update TCPDF to 6.2.12 
Changelog:

6.2.12 (2015-09-12)
	- fix composer package name to tecnickcom/tcpdf

6.2.11 (2015-08-02)
	- "PNG regression in 6.2.9 (they appear as their alpha channel)" was fixed.
	- "Encoded SRC URLs in <img> tags don't work anymore" was fixed.

6.2.10 (2015-07-28)
	- Minor mod to PNG parsing.
	- Make dependency on mcrypt optional.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 15:54:39 +02:00
Michal Čihař
d35c3d9ed5 Update ReCaptcha library to 1.1.2 
There should be no functional changes.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 15:51:44 +02:00
‫حمودي الجيلاني‬‎
0f1d629043 Translated using Weblate (Arabic) 
Currently translated at 34.2% (1098 of 3209 strings)

[CI skip]
 2016-07-16 18:44:09 +02:00
Isaac Bennetch
306c148098 Add missing escaping in navigation pane 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-07-13 15:33:48 -04:00
Michal Čihař
205694982b Fix exporting multiline comments 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 12:16:50 +02:00
Michal Čihař
af8385dc87 Fix tests for transformations 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 12:16:45 +02:00
Michal Čihař
42c868b691 HML encode embedded JSON data 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 11:33:35 +02:00
Michal Čihař
987cce0bcf Properly escape foreign key selection 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 11:10:44 +02:00
Michal Čihař
e4be768781 Ensure widht and height are integers 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:55:07 +02:00