webapp/phpmyadmin
1
0
Fork 0
mirror of https://github.com/phpmyadmin/phpmyadmin.git synced 2026-10-28 07:41:55 +03:00
Code Activity

Merge branch 'QA_4_6' into QA_4_6-security

Browse Source
This commit is contained in:
Michal Čihař
2016-09-02 13:45:00 +02:00
parent 283f5d10ce f3ca367efa
commit dcc9f8585c
15 changed files with 126 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
.gitignore vendored
View File

@@ -7,6 +7,7 @@
# Upload/save dirs
/upload/
/save/
/tmp/
# For setup script
/config/
# ctags
@@ -22,8 +23,9 @@ phpmyadmin.wpj
.idea
.netbeans
*.sw[op]
# IIS files
# Web server files
web.config
.htaccess
# Locales
/locale/
# Backups

7
ChangeLog
View File

@@ -13,6 +13,13 @@ phpMyAdmin - ChangeLog
- issue #12485 Do not show warning about short blowfish_secret if none is set
- issue #12251 Fixed random logouts due to wrong cookie path
- issue #12480 Fixed editing of ENUM/SET/DECIMAL fields structure
- issue #12497 Missing escaping of configuration used in SQL (hide_db and only_db)
- issue #12476 Add error checking in reading advisory rules file
- issue #12477 Add checking missing elements and confirming element types from json_decode
- issue #12251 Automatically save SQL query in browser local storage rather than in cookie
- issue #12292 Unable to edit transformations
- issue #12502 Remove unused paramenter when connecting to MySQLi
- issue #12303 Fix number formatting with different settings of precision in PHP
4.6.4 (2016-08-16)
- issue [security] Weaknesses with cookie encryption, see PMASA-2016-29

4
js/functions.js
View File

@@ -1164,7 +1164,9 @@ function insertQuery(queryType)
}
return;
} else if (queryType == "saved") {
if ($.cookie('auto_saved_sql')) {
if (isStorageSupported('localStorage') && typeof window.localStorage.auto_saved_sql != 'undefined') {
setQuery(window.localStorage.auto_saved_sql);
} else if ($.cookie('auto_saved_sql')) {
setQuery($.cookie('auto_saved_sql'));
} else {
PMA_ajaxShowMessage(PMA_messages.strNoAutoSavedQuery);

27
js/sql.js
View File

@@ -36,6 +36,23 @@ function PMA_urlencode(str)
}
}
/**
* Saves SQL query in local storage or cooie
*
* @param string SQL query
* @return void
*/
function PMA_autosaveSQL(query)
{
if (query) {
if (isStorageSupported('localStorage')) {
window.localStorage.auto_saved_sql = query;
} else {
$.cookie('auto_saved_sql', query);
}
}
}
/**
* Get the field name for the current field. Required to construct the query
* for grid editing
@@ -135,17 +152,11 @@ AJAX.registerOnload('sql.js', function () {
$(function () {
if (codemirror_editor) {
codemirror_editor.on('change', function () {
var query = codemirror_editor.getValue();
if (query) {
$.cookie('auto_saved_sql', query);
}
PMA_autosaveSQL(codemirror_editor.getValue());
});
} else {
$('#sqlquery').on('input propertychange', function () {
var query = $('#sqlquery').val();
if (query) {
$.cookie('auto_saved_sql', query);
}
PMA_autosaveSQL($('#sqlquery').val());
});
}
});

12
libraries/Advisor.php
View File

@@ -455,10 +455,20 @@ class Advisor
*/
public static function parseRulesFile()
{
$file = file('libraries/advisory_rules.txt', FILE_IGNORE_NEW_LINES);
$filename = 'libraries/advisory_rules.txt';
$file = file($filename, FILE_IGNORE_NEW_LINES);
$errors = array();
$rules = array();
$lines = array();
if ($file === FALSE) {
$errors[] = __(
'Error in reading file: The file \'' . $filename .'\' does not exist or is not readable'
);
return array('rules' => $rules, 'lines' => $lines, 'errors' => $errors);
}
$ruleSyntax = array(
'name', 'formula', 'test', 'issue', 'recommendation', 'justification'
);

2
libraries/Linter.php
View File

@@ -51,7 +51,7 @@ class Linter
// (which is actually a new line) aren't going to be processed at
// all.
$len = ($str instanceof UtfString) ?
$str->length() : strlen($len);
$str->length() : strlen($str);
$lines = array(0);
for ($i = 0; $i < $len; ++$i) {

18
libraries/Util.php
View File

@@ -1604,17 +1604,13 @@ class Util
$value = round($value / (self::pow(1000, $d, 'pow') / $dh)) /$dh;
$unit = $units[$d];
// If we don't want any zeros after the comma just add the thousand separator
if ($noTrailingZero) {
$localizedValue = self::localizeNumber(
preg_replace('/(?<=\d)(?=(\d{3})+(?!\d))/', ',', $value)
);
} else {
//number_format is not multibyte safe, str_replace is safe
$localizedValue = self::localizeNumber(
number_format($value, $digits_right)
);
// number_format is not multibyte safe, str_replace is safe
$formattedValue = number_format($value, $digits_right);
// If we don't want any zeros, remove them now
if ($noTrailingZero && strpos($formattedValue, '.') !== false) {
$formattedValue = preg_replace('/\.?0+$/', '', $formattedValue);
}
$localizedValue = self::localizeNumber($formattedValue);
if ($originalValue != 0 && floatval($value) == 0) {
return ' <' . self::localizeNumber((1 / self::pow(10, $digits_right)))
@@ -4672,7 +4668,7 @@ class Util
->render(
array(
'pos' => $pos,
'unlim_num_rows' => $_REQUEST['unlim_num_rows'],
'unlim_num_rows' => intval($_REQUEST['unlim_num_rows']),
'rows' => $rows,
'sql_query' => $sql_query,
)

17
libraries/common.inc.php
View File

@@ -107,6 +107,13 @@ PMA_checkExtensions();
ini_set('default_charset', 'utf-8');
mb_internal_encoding('utf-8');
/**
* Set precision to sane value, with higher values
* things behave slightly unexpectedly, for example
* round(1.2, 2) returns 1.199999999999999956.
*/
ini_set('precision', 14);
/**
* the relation lib, tracker needs it
*/
@@ -455,9 +462,15 @@ PMA_setGlobalDbOrTable('table');
*/
if (PMA_isValid($_REQUEST['selected_recent_table'])) {
$recent_table = json_decode($_REQUEST['selected_recent_table'], true);
$GLOBALS['db'] = $recent_table['db'];
$GLOBALS['db']
= (array_key_exists('db', $recent_table) && is_string($recent_table['db'])) ?
$recent_table['db'] : '';
$GLOBALS['url_params']['db'] = $GLOBALS['db'];
$GLOBALS['table'] = $recent_table['table'];
$GLOBALS['table']
= (array_key_exists('table', $recent_table) && is_string($recent_table['table'])) ?
$recent_table['table'] : '';
$GLOBALS['url_params']['table'] = $GLOBALS['table'];
}

10
libraries/dbi/DBIMysqli.php
View File

@@ -64,7 +64,6 @@ class DBIMysqli implements DBIExtension
* @param string $host mysql hostname
* @param string $user mysql user name
* @param string $password mysql user password
* @param string $dbname database name
* @param int $server_port server port
* @param string $server_socket server socket
* @param int $client_flags client flags of connection
@@ -73,7 +72,7 @@ class DBIMysqli implements DBIExtension
* @return bool
*/
private function _realConnect(
$link, $host, $user, $password, $dbname, $server_port,
$link, $host, $user, $password, $server_port,
$server_socket, $client_flags = null, $persistent = false
) {
global $cfg;
@@ -89,7 +88,7 @@ class DBIMysqli implements DBIExtension
$host,
$user,
$password,
$dbname,
'',
$server_port,
$server_socket
);
@@ -99,7 +98,7 @@ class DBIMysqli implements DBIExtension
$host,
$user,
$password,
$dbname,
'',
$server_port,
$server_socket,
$client_flags
@@ -185,7 +184,6 @@ class DBIMysqli implements DBIExtension
$cfg['Server']['host'],
$user,
$password,
false,
$server_port,
$server_socket,
$client_flags
@@ -201,7 +199,6 @@ class DBIMysqli implements DBIExtension
$cfg['Server']['host'],
$user,
'',
false,
$server_port,
$server_socket,
$client_flags
@@ -213,7 +210,6 @@ class DBIMysqli implements DBIExtension
$server['host'],
$user,
$password,
false,
$server_port,
$server_socket
);

6
libraries/navigation/nodes/Node.php
View File

@@ -721,7 +721,9 @@ class Node
if (!empty($GLOBALS['cfg']['Server']['hide_db'])) {
$whereClause .= "AND " . Util::backquote($columnName)
. " NOT REGEXP '" . $GLOBALS['cfg']['Server']['hide_db'] . "' ";
. " NOT REGEXP '"
. Util::sqlAddSlashes($GLOBALS['cfg']['Server']['hide_db'], true)
. "' ";
}
if (!empty($GLOBALS['cfg']['Server']['only_db'])) {
@@ -735,7 +737,7 @@ class Node
foreach ($GLOBALS['cfg']['Server']['only_db'] as $each_only_db) {
$subClauses[] = " " . Util::backquote($columnName)
. " LIKE '"
. $each_only_db . "' ";
. Util::sqlAddSlashes($each_only_db, true) . "' ";
}
$whereClause .= implode("OR", $subClauses) . ") ";
}

2
libraries/sanitizing.lib.php
View File

@@ -166,7 +166,7 @@ function PMA_sanitize($message, $escape = false, $safe = false)
'[sup]' => '<sup>',
'[/sup]' => '</sup>',
// used in common.inc.php:
'[conferr]' => '<iframe src="show_config_errors.php" />',
'[conferr]' => '<iframe src="show_config_errors.php"><a href="show_config_errors.php">show_config_errors.php</a></iframe>',
// used in libraries/Util.php
'[dochelpicon]' => PMA\libraries\Util::getImage('b_help.png', __('Documentation')),
);

7
po/pt_BR.po
View File

@@ -4,8 +4,8 @@ msgstr ""
"Project-Id-Version: phpMyAdmin 4.6.5-dev\n"
"Report-Msgid-Bugs-To: translators@phpmyadmin.net\n"
"POT-Creation-Date: 2016-08-17 11:29+0200\n"
"PO-Revision-Date: 2016-08-22 02:16+0000\n"
"Last-Translator: Lucius Gaitán <luciuspgc@gmail.com>\n"
"PO-Revision-Date: 2016-08-29 00:24+0000\n"
"Last-Translator: Diego Bemquerer Castro <dbc_5@yahoo.com.br>\n"
"Language-Team: Portuguese (Brazil) "
"<https://hosted.weblate.org/projects/phpmyadmin/4-6/pt_BR/>\n"
"Language: pt_BR\n"
@@ -3694,8 +3694,9 @@ msgid "Unknown error in file upload."
msgstr "Erro desconhecido no carregamento do arquivo."
#: libraries/File.php:424
#, fuzzy
msgid "File is a symbolic link"
msgstr ""
msgstr "O arquivo é um link simbólico"
#: libraries/File.php:470
msgid "Error moving the uploaded file, see [doc@faq1-11]FAQ 1.11[/doc]."

4
templates/columns_definitions/transformation_option.phtml
View File

@@ -5,5 +5,5 @@
size="16"
class="textfield"
value="<?= (isset($columnMeta['Field']) && isset($mime_map[$columnMeta['Field']][$options_key])) ?
htmlspecialchars($mime_map[$columnMeta['Field']], [$options_key])
: '' ?>" />
htmlspecialchars($mime_map[$columnMeta['Field']][$options_key])
: '' ?>" />

7
test/bootstrap-dist.php
View File

@@ -6,6 +6,13 @@
* @package PhpMyAdmin-test
*/
/**
* Set precision to sane value, with higher values
* things behave slightly unexpectedly, for example
* round(1.2, 2) returns 1.199999999999999956.
*/
ini_set('precision', 14);
// Let PHP complain about all errors
error_reporting(E_ALL);

45
test/libraries/common/PMA_formatNumberByteDown_test.php
View File

@@ -70,6 +70,30 @@ class PMA_FormatNumberByteDown_Test extends PHPUnit_Framework_TestCase
array(0.003, 3, 3, '3 m'),
array(-0.003, 6, 0, '-3,000 &micro;'),
array(100.98, 0, 2, '100.98'),
array(21010101, 0, 2, '21,010,101.00'),
array(20000, 2, 2, '20 k'),
array(20011, 2, 2, '20.01 k'),
);
}
/**
* Core test for formatNumber
*
*
* @param float $a Value to format
* @param int $b Sensitiveness
* @param int $c Number of decimals to retain
* @param array $d Expected value
*
* @return void
*/
private function assertFormatNumber($a, $b, $c, $d)
{
$this->assertEquals(
$d,
(string) PMA\libraries\Util::formatNumber(
$a, $b, $c, false
)
);
}
@@ -87,12 +111,21 @@ class PMA_FormatNumberByteDown_Test extends PHPUnit_Framework_TestCase
*/
public function testFormatNumber($a, $b, $c, $d)
{
$this->assertEquals(
$d,
(string) PMA\libraries\Util::formatNumber(
$a, $b, $c, false
)
);
$this->assertFormatNumber($a, $b, $c, $d);
// Test with various precisions
$old_precision = ini_get('precision');
ini_set('precision', 20);
$this->assertFormatNumber($a, $b, $c, $d);
ini_set('precision', 14);
$this->assertFormatNumber($a, $b, $c, $d);
ini_set('precision', 10);
$this->assertFormatNumber($a, $b, $c, $d);
ini_set('precision', 5);
$this->assertFormatNumber($a, $b, $c, $d);
ini_set('precision', -1);
$this->assertFormatNumber($a, $b, $c, $d);
ini_set('precision', $old_precision);
}
/**