gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
106,362 Commits 12 Branches 481 Tags 2.4 GiB
f77612dfe7
Commit Graph

106362 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michal Čihař
f77612dfe7 Merge branch 'QA_4_6-security' into master-security 2016-06-20 10:47:38 +02:00
Michal Čihař
2f4950828e Update referrer <meta> to match current standards 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-20 10:47:30 +02:00
Michal Čihař
22b19b5d69 Merge branch 'QA_4_6-security' into master-security 2016-06-20 10:45:26 +02:00
Michal Čihař
b73175ed12 Merge branch 'master' into master-security 2016-06-20 10:43:21 +02:00
Michal Čihař
80cd2f448c Merge branch 'QA_4_6' into QA_4_6-security 2016-06-20 10:42:29 +02:00
Michal Čihař
364732e309 Escape error message from server 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-20 10:11:25 +02:00
Michal Čihař
895a131d2e Escape HTML when rendering AJAX error 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-20 10:07:52 +02:00
Michal Čihař
79661610f6 Escape attributes when showing images in javascript 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-20 10:04:16 +02:00
Michal Čihař
1e5716cb96 Add referrer CSP and <meta> tag 
This avoids leaking Referer header in modern browsers.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-20 09:41:06 +02:00
Madhura Jayaratne
221c5f9246 Merge branch 'QA_4_6' 2016-06-18 09:20:44 +10:00
Madhura Jayaratne
040822fe5a ChangeLog entry for e7003792d9 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-06-18 09:19:00 +10:00
Madhura Jayaratne
e7003792d9 Escape generated query 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-06-18 09:13:02 +10:00
Michal Čihař
6897a5df53 Fix messages handling 
The first two messages were not used at all, now we concatenate them
all.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 17:21:31 +02:00
Michal Čihař
ef6b9e8120 Merge branch 'QA_4_6' 2016-06-17 17:13:08 +02:00
Michal Čihař
1a558a4190 Ensure id is numeric 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 17:12:41 +02:00
Michal Čihař
045046a1dc Document task to do 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 17:09:21 +02:00
Michal Čihař
791bdafcdd Merge branch 'QA_4_6-security' into master-security 2016-06-17 16:24:39 +02:00
Michal Čihař
be3ecbb4cc Simplify and cleanup transformation plugins 
Remove PMA_transformation_global_html_replace which makes the code only
more confusing.

Also add escaping to browse transformations.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 16:18:13 +02:00
Michal Čihař
bdfaaa4f40 Fix generated redirect response 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 15:00:44 +02:00
Michal Čihař
d648ade18d Escape binary log name 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:51:15 +02:00
Michal Čihař
8716855b30 Properly escape translated string 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:45:29 +02:00
Michal Čihař
0815af37f4 Add missing escaping to partition listing 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:37:37 +02:00
Michal Čihař
418aeea3d8 Add error handling to constructing openid message 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:34:50 +02:00
Michal Čihař
94cf386425 Escape error messages from OpenID 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:30:36 +02:00
Michal Čihař
1363ce5749 Merge branch 'QA_4_6' into QA_4_6-security 2016-06-17 14:27:02 +02:00
Michal Čihař
27664605b9 Improve error handling in OpenID example 
- properly check parameter types
- catch all exceptions (eg. network error)

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:26:59 +02:00
Michal Čihař
a6a78a2517 Merge branch 'QA_4_6' 2016-06-17 14:22:51 +02:00
Michal Čihař
61b4e28faf Sanitize page and formset before using 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:21:53 +02:00
Michal Čihař
8552da5842 Do not ignore error here 
The previous fetchAssoc would also fail in case of invalid resource.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:19:42 +02:00
Michal Čihař
8ac8ca1a02 Share code for parsing Proc_priv 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:17:31 +02:00
Michal Čihař
e25ab25d5f Define array before using it 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:13:32 +02:00
Michal Čihař
cc6fd10b28 Add separator 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 14:04:21 +02:00
Michal Čihař
81e72439b6 Merge branch 'QA_4_6' 2016-06-17 14:00:15 +02:00
Michal Čihař
07216c9b8e Ensure that connection collation contains no HTML 
There is currently no MySQL collation which would do that, but just to
be safe.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:58:26 +02:00
Michal Čihař
04a72687f8 Add missing escaping 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:54:26 +02:00
Michal Čihař
dbd848d595 Fix wrong redirection tests 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:36:58 +02:00
Michal Čihař
e531526bc5 Merge branch 'QA_4_6' 2016-06-17 13:22:06 +02:00
Michal Čihař
58da975117 Add missing URL encoding 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:22:01 +02:00
Michal Čihař
170c045507 Simplify code for processing SQL query to display 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:21:01 +02:00
Michal Čihař
84507dfeb6 Merge branch 'QA_4_6' 2016-06-17 13:10:28 +02:00
Michal Čihař
a5950f9ecd Fix link to mariadb explain analyzer 
- avoid double urlencoding of the query
- properly escape html entities

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:05:11 +02:00
Michal Čihař
d1ec59f05f Ensure we have integer as offset 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:01:56 +02:00
Michal Čihař
aef5df7e13 Ensure we have integer as position 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 13:00:45 +02:00
Michal Čihař
325122658a Fix parameter type documentation 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 12:59:37 +02:00
Michal Čihař
8bf3cf6578 Use URL::getCommon to construct complete URL 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 12:58:14 +02:00
Michal Čihař
dce94f229f More consistency for URL::getCommon 
Now URL::getCommon always returns HTML encoded string, if you want
unencded one, use URL::getCommonRaw. This makes it easier to review the
code if uses correct variant.

Also I've fixed several wrong uses of the HTML encoded variant in
Location header.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 12:44:29 +02:00
Michal Čihař
41d5c1e127 Merge branch 'QA_4_6' 2016-06-17 11:44:30 +02:00
Michal Čihař
009148075f PMA_jsFormat accepts only strings 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 11:43:51 +02:00
Michal Čihař
00b9be9c4a Merge branch 'QA_4_6' into QA_4_6-security 2016-06-17 11:23:36 +02:00
Michal Čihař
cdc7a6c6bf Merge branch 'QA_4_6' 2016-06-17 11:23:25 +02:00