diff --git a/ChangeLog b/ChangeLog index dc2f709b0e..feefa80c1a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -39,6 +39,7 @@ phpMyAdmin - ChangeLog + [interface] Improved support for events + [interface] Improved support for triggers + [interface] Improved server monitoring ++ AJAX for table Structure column Add 3.4.4.0 (not yet released) - bug #3323060 [parser] SQL parser breaks AJAX requests if query has unclosed quotes @@ -54,6 +55,15 @@ phpMyAdmin - ChangeLog - bug #3363221 [display] Missing Server Parameter on inline sql query - bug #3367986 [navi] Drop field -> lost active table - remove misleading comment on the "Rename database" interface +- bug #3374374 [interface] Fix footnote for inexact count while browsing +- bug #3372807 [interface] Fix security warning link in setup +- bug #3374347 [display] Backquotes in normal text on import page + +3.4.3.2 (2011-07-23) +- [security] Fixed XSS vulnerability, see PMASA-2011-9 +- [security] Fixed local file inclusion vulnerability, see PMASA-2011-10 +- [security] Fixed local file inclusion vulnerability and code execution, see PMASA-2011-11 +- [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-12 3.4.3.1 (2011-07-02) - [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-5 @@ -149,7 +159,7 @@ phpMyAdmin - ChangeLog + patch #2974341 [structure] Clicking on table name in db Structure should Browse the table if possible, thanks to bhdouglass - dougboybhd + patch #2975533 [search] New search operators, thanks to - Martynas Mickevičius + Martynas Mickevičius + patch #2967320 [designer] Colored relations based on the primary key, thanks to GreenRover - greenrover - [core] Provide way for vendors to easily change paths to config files. @@ -303,7 +313,7 @@ phpMyAdmin - ChangeLog 3.3.7.0 (2010-09-07) - patch #3050492 [PDF scratchboard] Cannot drag table box to the edge after - a page size increase, thanks to Martin Schönberger - mad05 + a page size increase, thanks to Martin Schönberger - mad05 3.3.6.0 (2010-08-28) - bug #3033063 [core] Navi gets wrong db name @@ -324,7 +334,7 @@ phpMyAdmin - ChangeLog 3.3.5.0 (2010-07-26) - patch #2932113 [information_schema] Slow export when having lots of - databases, thanks to Stéphane Pontier - shadow_walker + databases, thanks to Stéphane Pontier - shadow_walker - bug #3022705 [import] Import button does not work in Catalan when there is no progress bar possible - bug [replication] Do not offer information_schema in the list of databases @@ -364,9 +374,9 @@ phpMyAdmin - ChangeLog - patch #2984893 [engines] InnoDB storage page emits a warning, thanks to Madhura Jayaratne - madhuracj - bug #2974687, bug #2974692 [compatibility] PHPExcel : IBM AIX iconv() does not work, - thanks to Björn Wiberg - bwiberg + thanks to Björn Wiberg - bwiberg - bug #2983066 [interface] Flush table on table operations shows the query twice, - thanks to Martynas Mickevičius - BlinK_ + thanks to Martynas Mickevičius - BlinK_ - bug #2983060, patch #2987900 [interface] Fix initial state of tables in designer, thanks to Sutharshan Balachandren. - bug #2983062, patch #2989408 [engines] Fix warnings when changing table @@ -445,7 +455,7 @@ phpMyAdmin - ChangeLog + rfe #2839504 [engines] Support InnoDB plugin's new row formats + [core] Added ability for synchronizing databases among servers. + [lang] #2843101 Dutch update, thanks to scavenger2008 -+ [lang] Galician update, thanks to Xosé Calvo - xosecalvo ++ [lang] Galician update, thanks to Xosé Calvo - xosecalvo + [export] Added MediaWiki export module, thanks to Derek Schaefer - drummingds1 + [lang] Turkish update, thanks to Burak Yavuz diff --git a/js/functions.js b/js/functions.js index 1e2cced85c..7b36e516ad 100644 --- a/js/functions.js +++ b/js/functions.js @@ -1836,12 +1836,12 @@ $(document).ready(function() { }, 'top.frame_content'); //end $(document).ready for 'Create Table' /** - * jQuery coding for 'Change Table'. Used on tbl_structure.php * + * jQuery coding for 'Change Table' and 'Add Column'. Used on tbl_structure.php * * Attach Ajax Event handlers for Change Table */ $(document).ready(function() { /** - *Ajax action for submitting the column change form + *Ajax action for submitting the "Column Change" and "Add Column" form **/ $("#append_fields_form input[name=do_save_data]").live('click', function(event) { event.preventDefault(); @@ -1876,16 +1876,20 @@ $(document).ready(function() { $("#result_query").prepend((data.message)); if ($("#change_column_dialog").length > 0) { $("#change_column_dialog").dialog("close").remove(); + } else if ($("#add_columns").length > 0) { + $("#add_columns").dialog("close").remove(); } /*Reload the field form*/ $.post($("#fieldsForm").attr('action'), $("#fieldsForm").serialize()+"&ajax_request=true", function(form_data) { $("#fieldsForm").remove(); + $("#addColumns").remove(); var $temp_div = $("
").append(form_data); if ($("#sqlqueryresults").length != 0) { $temp_div.find("#fieldsForm").insertAfter("#sqlqueryresults"); } else { $temp_div.find("#fieldsForm").insertAfter(".error"); } + $temp_div.find("#addColumns").insertBefore("iframe.IE_hack"); /*Call the function to display the more options in table*/ displayMoreTableOpts(); }); @@ -2107,6 +2111,10 @@ $(document).ready(function() { $("#popup_background").css({"opacity":"0.7"}); $("#popup_background").fadeIn("fast"); $("#enum_editor").fadeIn("fast"); + /**Replacing the column name in the enum editor header*/ + var column_name = $("#append_fields_form").find("input[id=field_0_1]").attr("value"); + var h3_text = $("#enum_editor h3").html(); + $("#enum_editor h3").html(h3_text.split('"')[0]+'"'+column_name+'"'); // Get the values var values = $(this).parent().prev("input").attr("value").split(","); diff --git a/js/messages.php b/js/messages.php index 5b91d791d9..4cfa7e7e44 100644 --- a/js/messages.php +++ b/js/messages.php @@ -207,6 +207,9 @@ $js_messages['strShowSearchCriteria'] = __('Show search criteria'); /* For tbl_change.js */ $js_messages['strIgnore'] = __('Ignore'); +/* For tbl_structure.js */ +$js_messages['strAddColumns'] = __('Add columns'); + /* Designer (pmd/scripts/move.js) */ $js_messages['strSelectReferencedKey'] = __('Select referenced key'); $js_messages['strSelectForeignKey'] = __('Select Foreign Key'); diff --git a/js/tbl_structure.js b/js/tbl_structure.js index 69f872d8ad..897cad8ade 100644 --- a/js/tbl_structure.js +++ b/js/tbl_structure.js @@ -336,6 +336,70 @@ $(document).ready(function() { }); } //end show/hide table index + /** + *Ajax event handler for Add column(s) + **/ + $("#addColumns.ajax input[value=Go]").live('click', function(event){ + event.preventDefault(); + + /*Remove the hidden dialogs if there are*/ + if ($('#add_columns').length != 0) { + $('#add_columns').remove(); + } + var $div = $('
'); + + var $form = $("#addColumns"); + + /** + * @var button_options Object that stores the options passed to jQueryUI + * dialog + */ + var button_options = {}; + // in the following function we need to use $(this) + button_options[PMA_messages['strCancel']] = function() {$(this).dialog('close').remove();} + + var button_options_error = {}; + button_options_error[PMA_messages['strOK']] = function() {$(this).dialog('close').remove();} + var $msgbox = PMA_ajaxShowMessage(); + + $.get( $form.attr('action') , $form.serialize()+"&ajax_request=true" , function(data) { + //in the case of an error, show the error message returned. + if (data.success != undefined && data.success == false) { + $div + .append(data.error) + .dialog({ + title: PMA_messages['strAddColumns'], + height: 230, + width: 900, + open: PMA_verifyTypeOfAllColumns, + modal: true, + buttons : button_options_error + })// end dialog options + } else { + $div + .append(data) + .dialog({ + title: PMA_messages['strAddColumns'], + height: 600, + width: 900, + open: PMA_verifyTypeOfAllColumns, + modal: true, + buttons : button_options + }) + //Remove the top menu container from the dialog + .find("#topmenucontainer").hide() + ; // end dialog options + + $div = $("#add_columns"); + /*changed the z-index of the enum editor to allow the edit*/ + $("#enum_editor").css("z-index", "1100"); + PMA_convertFootnotesToTooltips($div); + } + PMA_ajaxRemoveMessage($msgbox); + }) // end $.get() + }); + + }) // end $(document).ready() @@ -396,6 +460,8 @@ function changeColumns(action,url) { $("#append_fields_form input[name=do_save_data]").addClass("ajax"); /*changed the z-index of the enum editor to allow the edit*/ $("#enum_editor").css("z-index", "1100"); + $div = $("#change_column_dialog"); + PMA_convertFootnotesToTooltips($div); } PMA_ajaxRemoveMessage($msgbox); }) // end $.get() diff --git a/libraries/auth/swekey/swekey.auth.lib.php b/libraries/auth/swekey/swekey.auth.lib.php index 184c845d89..fae3531e93 100644 --- a/libraries/auth/swekey/swekey.auth.lib.php +++ b/libraries/auth/swekey/swekey.auth.lib.php @@ -143,7 +143,9 @@ function Swekey_auth_error() return "Internal Error: CA File $caFile not found"; $result = null; - parse_str($_SERVER['QUERY_STRING']); + $swekey_id = $_GET['swekey_id']; + $swekey_otp = $_GET['swekey_otp']; + if (isset($swekey_id)) { unset($_SESSION['SWEKEY']['AUTHENTICATED_SWEKEY']); if (! isset($_SESSION['SWEKEY']['RND_TOKEN'])) { @@ -166,7 +168,7 @@ function Swekey_auth_error() $result = __('No valid authentication key plugged'); if ($_SESSION['SWEKEY']['CONF_DEBUG']) { - $result .= "
".$swekey_id; + $result .= "
" . htmlspecialchars($swekey_id); } unset($_SESSION['SWEKEY']['CONF_LOADED']); // reload the conf file } @@ -184,19 +186,19 @@ function Swekey_auth_error() if (! isset($swekey_id)) { ?> ajax_clock_small.gif" alt="ajax clock" /> '); + $('#upload_form_status_info').html('ajax clock '); $('#upload_form_status').css("display", "none"); } else { $('#upload_form_status_info').html(' '+Math.round(percent)+'%, '+complete+'/'+total); @@ -73,7 +73,7 @@ if ($_SESSION[$SESSION_KEY]["handler"]!="noplugin") { if (finished==true) { $('#importmain').css('display', 'none'); $('#import_form_status').css('display', 'inline'); - $('#import_form_status').html('ajax clock '); + $('#import_form_status').html('ajax clock '); $('#import_form_status').load('import_status.php?message=true&'); // loads the message, either success or mysql error - $('#upload_form_status_info').html('ajax clock '); + $('#upload_form_status_info').html('ajax clock '); $('#upload_form_status').css("display", "none"); esse campo pode não ser editável" #: tbl_change.php:800 msgid "Remove BLOB Repository Reference" -msgstr "" +msgstr "Remover referência a repositório BLOB" #: tbl_change.php:806 msgid "Binary - do not edit" @@ -10635,7 +10640,7 @@ msgstr "Mar" #: tbl_chart.php:87 msgid "Line" -msgstr "" +msgstr "Linhas" #: tbl_chart.php:88 #, fuzzy @@ -10663,7 +10668,7 @@ msgstr "Título do Relatório" #: tbl_chart.php:99 msgid "X-Axis:" -msgstr "" +msgstr "Eixo X" #: tbl_chart.php:113 #, fuzzy @@ -10717,7 +10722,7 @@ msgstr "Ver o esquema da tabela" #: tbl_gis_visualization.php:111 msgid "Display GIS Visualization" -msgstr "" +msgstr "Mostrar visualização GIS" #: tbl_gis_visualization.php:157 msgid "Width" @@ -10978,7 +10983,8 @@ msgstr "Relações internas" msgid "" "An internal relation is not necessary when a corresponding FOREIGN KEY " "relation exists." -msgstr "" +msgstr "Uma relação interna é desnecessária quando uma CHAVE ESTRANGEIRA " +"correspondente existe." #: tbl_relation.php:410 msgid "Foreign key constraint" @@ -10996,7 +11002,7 @@ msgstr "Selecionar os campos (no mínimo 1)" #: tbl_select.php:278 msgid "Add search conditions (body of the \"where\" clause):" -msgstr "Condição de Pesquisa (complemento da cláusula \"onde\"):" +msgstr "Condição de pesquisa (complemento da cláusula \"onde\"):" #: tbl_select.php:285 msgid "Number of rows per page" @@ -11008,7 +11014,7 @@ msgstr "Ordenado por:" #: tbl_structure.php:158 tbl_structure.php:163 tbl_structure.php:611 msgid "Spatial" -msgstr "" +msgstr "Espacial" #: tbl_structure.php:165 tbl_structure.php:169 msgid "Browse distinct values" @@ -11106,22 +11112,22 @@ msgstr "particionado" #: tbl_tracking.php:109 #, php-format msgid "Tracking report for table `%s`" -msgstr "" +msgstr "Relatório de rastreamento para tabela `%s`" #: tbl_tracking.php:182 #, php-format msgid "Version %s is created, tracking for %s.%s is activated." -msgstr "" +msgstr "Versão %s criada, rastreamento para %s. %s ativado(a)." #: tbl_tracking.php:190 #, php-format msgid "Tracking for %s.%s , version %s is deactivated." -msgstr "" +msgstr "Rastreamento para %s.%s, versão %s desativado(a)." #: tbl_tracking.php:198 #, php-format msgid "Tracking for %s.%s , version %s is activated." -msgstr "" +msgstr "Rastreamento para %s.%s, versão %s ativado(a)." #: tbl_tracking.php:208 msgid "SQL statements executed." @@ -11131,7 +11137,8 @@ msgstr "Instruções SQL executadas." msgid "" "You can execute the dump by creating and using a temporary database. Please " "ensure that you have the privileges to do so." -msgstr "" +msgstr "Você pode executar o dump criando e usando uma tabela temporária." +"Por favor, certifique-se de ter os privilégios necessários." #: tbl_tracking.php:215 msgid "Comment out these two lines if you do not need them." @@ -11145,11 +11152,7 @@ msgstr "Instruções SQL exportadas. Por favor copie a saída ou execute." #: tbl_tracking.php:255 #, php-format msgid "Version %s snapshot (SQL code)" -msgstr "" - -#: tbl_tracking.php:382 -msgid "Tracking data definition successfully deleted" -msgstr "" +msgstr "Instantâneo (código SQL) da versão %s" #: tbl_tracking.php:384 tbl_tracking.php:401 #, fuzzy @@ -11157,9 +11160,9 @@ msgstr "" msgid "Query error" msgstr "Reunir erros" -#: tbl_tracking.php:399 +#: tbl_tracking.php:399 tbl_tracking.php:382 msgid "Tracking data manipulation successfully deleted" -msgstr "" +msgstr "Rastreamento de manipulação de dados removidos com sucesso" #: tbl_tracking.php:411 msgid "Tracking statements" @@ -11168,7 +11171,7 @@ msgstr "Rastreando instruções" #: tbl_tracking.php:427 tbl_tracking.php:555 #, php-format msgid "Show %s with dates from %s to %s by user %s %s" -msgstr "" +msgstr "Mostrar %s com datas desde %s até %s pelo usuário %s %s" #: tbl_tracking.php:432 #, fuzzy @@ -11300,7 +11303,7 @@ msgstr "Você não tem direitos suficientes para estar aqui agora!" #: user_password.php:96 msgid "The profile has been updated." -msgstr "O perfíl foi atualizado." +msgstr "O perfil foi atualizado." #: view_create.php:141 msgid "VIEW name" diff --git a/schema_export.php b/schema_export.php index 0a21d3296c..3e1067d55e 100644 --- a/schema_export.php +++ b/schema_export.php @@ -37,7 +37,9 @@ include_once("./libraries/schema/Export_Relation_Schema.class.php"); * default is PDF */ global $db,$export_type; -$export_type = isset($export_type) ? $export_type : 'pdf'; +if (!isset($export_type) || !preg_match('/^[a-zA-Z]+$/', $export_type)) { + $export_type = 'pdf'; +} PMA_DBI_select_db($db); $path = PMA_securePath(ucfirst($export_type)); diff --git a/setup/lib/index.lib.php b/setup/lib/index.lib.php index 04fdfd1465..9823cbd31e 100644 --- a/setup/lib/index.lib.php +++ b/setup/lib/index.lib.php @@ -264,7 +264,7 @@ function perform_config_checks() $strLoginCookieValidityWarning3 = __('If using cookie authentication and %sLogin cookie store%s is not 0, %sLogin cookie validity%s must be set to a value less or equal to it.'); $strLoginCookieValidityWarning3 = sprintf($strLoginCookieValidityWarning3, '[a@?page=form&formset=Features#tab_Security]', '[/a]', '[a@?page=form&formset=Features#tab_Security]', '[/a]'); $strSecurityInfoMsg = __('If you feel this is necessary, use additional protection settings - %shost authentication%s settings and %strusted proxies list%s. However, IP-based protection may not be reliable if your IP belongs to an ISP where thousands of users, including you, are connected to.'); - $strSecurityInfoMsg = sprintf($strSecurityInfoMsg, '[a@?page=servers&mode=edit&id=%1$d#tab_Server_config]', '[/a]', '[a@?page=form&formset=Features#tab_Security]', '%s'); + $strSecurityInfoMsg = sprintf($strSecurityInfoMsg, '[a@?page=servers&mode=edit&id=%1$d#tab_Server_config]', '[/a]', '[a@?page=form&formset=Features#tab_Security]', '[/a]'); $strServerAuthConfigMsg = __('You set the [kbd]config[/kbd] authentication type and included username and password for auto-login, which is not a desirable option for live hosts. Anyone who knows or guesses your phpMyAdmin URL can directly access your phpMyAdmin panel. Set %sauthentication type%s to [kbd]cookie[/kbd] or [kbd]http[/kbd].'); $strServerAuthConfigMsg = sprintf($strServerAuthConfigMsg, '[a@?page=servers&mode=edit&id=%1$d#tab_Server]', '[/a]'); $strZipDumpExportWarning = __('%sZip compression%s requires functions (%s) which are unavailable on this system.'); diff --git a/sql.php b/sql.php index fbf97be74d..8717aa2561 100644 --- a/sql.php +++ b/sql.php @@ -779,8 +779,8 @@ if (0 == $num_rows || $is_affected) { $edited_values = array(); parse_str($_REQUEST['transform_fields_list'], $edited_values); - foreach ($mime_map as $transformation) { - $include_file = $transformation['transformation']; + foreach($mime_map as $transformation) { + $include_file = PMA_securePath($transformation['transformation']); $column_name = $transformation['column_name']; $column_data = $edited_values[$column_name]; diff --git a/tbl_addfield.php b/tbl_addfield.php index ec910fdf4b..a866fef7a9 100644 --- a/tbl_addfield.php +++ b/tbl_addfield.php @@ -184,6 +184,12 @@ if (isset($_REQUEST['do_save_data'])) { // Go back to the structure sub-page $message = PMA_Message::success(__('Table %1$s has been altered successfully')); $message->addParam($table); + + if( $GLOBALS['is_ajax_request'] == true) { + $extra_data['sql_query'] = PMA_showMessage(NULL, $sql_query); + PMA_ajaxResponse($message, $message->isSuccess(),$extra_data); + } + $active_page = 'tbl_structure.php'; require './tbl_structure.php'; } else { diff --git a/tbl_printview.php b/tbl_printview.php index 0c237ab97b..1e138588bb 100644 --- a/tbl_printview.php +++ b/tbl_printview.php @@ -69,7 +69,7 @@ if ($multi_tables) { $tbl_list .= (empty($tbl_list) ? '' : ', ') . PMA_backquote($table); } - echo ''. __('Show tables') . ': ' . $tbl_list . '' . "\n"; + echo ''. __('Show tables') . ': ' . htmlspecialchars($tbl_list) . '' . "\n"; echo '
' . "\n"; } // end if @@ -84,7 +84,7 @@ foreach ($the_tables as $key => $table) { } $counter++; echo '' . "\n"; - echo '

' . $table . '

' . "\n"; + echo '

' . htmlspecialchars($table) . '

' . "\n"; /** * Gets table informations diff --git a/tbl_structure.php b/tbl_structure.php index 50aa93d6b4..6d1d0ca8ba 100644 --- a/tbl_structure.php +++ b/tbl_structure.php @@ -670,7 +670,7 @@ if (! $tbl_is_view && ! $db_is_information_schema) { ?>
-
onsubmit="return checkFormElementInRange(this, 'num_fields', '', 1)">