From d7cffc5dbde68342d46e891ea2c8bd72de134f43 Mon Sep 17 00:00:00 2001 From: Herman van Rink Date: Sat, 2 Jul 2011 23:43:25 +0200 Subject: [PATCH 01/22] Reverted some missing special chars in Changelog --- ChangeLog | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/ChangeLog b/ChangeLog index fe7103128a..350b7ab299 100644 --- a/ChangeLog +++ b/ChangeLog @@ -95,7 +95,7 @@ phpMyAdmin - ChangeLog + patch #2974341 [structure] Clicking on table name in db Structure should Browse the table if possible, thanks to bhdouglass - dougboybhd + patch #2975533 [search] New search operators, thanks to - Martynas Mickevičius + Martynas Mickevičius + patch #2967320 [designer] Colored relations based on the primary key, thanks to GreenRover - greenrover - [core] Provide way for vendors to easily change paths to config files. @@ -249,7 +249,7 @@ phpMyAdmin - ChangeLog 3.3.7.0 (2010-09-07) - patch #3050492 [PDF scratchboard] Cannot drag table box to the edge after - a page size increase, thanks to Martin Schönberger - mad05 + a page size increase, thanks to Martin Schönberger - mad05 3.3.6.0 (2010-08-28) - bug #3033063 [core] Navi gets wrong db name @@ -270,7 +270,7 @@ phpMyAdmin - ChangeLog 3.3.5.0 (2010-07-26) - patch #2932113 [information_schema] Slow export when having lots of - databases, thanks to Stéphane Pontier - shadow_walker + databases, thanks to Stéphane Pontier - shadow_walker - bug #3022705 [import] Import button does not work in Catalan when there is no progress bar possible - bug [replication] Do not offer information_schema in the list of databases @@ -310,9 +310,9 @@ phpMyAdmin - ChangeLog - patch #2984893 [engines] InnoDB storage page emits a warning, thanks to Madhura Jayaratne - madhuracj - bug #2974687, bug #2974692 [compatibility] PHPExcel : IBM AIX iconv() does not work, - thanks to Björn Wiberg - bwiberg + thanks to Björn Wiberg - bwiberg - bug #2983066 [interface] Flush table on table operations shows the query twice, - thanks to Martynas Mickevičius - BlinK_ + thanks to Martynas Mickevičius - BlinK_ - bug #2983060, patch #2987900 [interface] Fix initial state of tables in designer, thanks to Sutharshan Balachandren. - bug #2983062, patch #2989408 [engines] Fix warnings when changing table @@ -391,7 +391,7 @@ phpMyAdmin - ChangeLog + rfe #2839504 [engines] Support InnoDB plugin's new row formats + [core] Added ability for synchronizing databases among servers. + [lang] #2843101 Dutch update, thanks to scavenger2008 -+ [lang] Galician update, thanks to Xosé Calvo - xosecalvo ++ [lang] Galician update, thanks to Xosé Calvo - xosecalvo + [export] Added MediaWiki export module, thanks to Derek Schaefer - drummingds1 + [lang] Turkish update, thanks to Burak Yavuz From a0823be05aa5835f207c0838b9cca67d2d9a050a Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Thu, 7 Jul 2011 14:39:09 -0400 Subject: [PATCH 02/22] XSS on table Print view --- tbl_printview.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tbl_printview.php b/tbl_printview.php index 74b6818e4b..8e8ce24d47 100644 --- a/tbl_printview.php +++ b/tbl_printview.php @@ -84,7 +84,7 @@ foreach ($the_tables as $key => $table) { } $counter++; echo '' . "\n"; - echo '

' . $table . '

' . "\n"; + echo '

' . htmlspecialchars($table) . '

' . "\n"; /** * Gets table informations From 4bd27166c314faa37cada91533b86377f4d4d214 Mon Sep 17 00:00:00 2001 From: Herman van Rink Date: Thu, 7 Jul 2011 14:43:45 -0400 Subject: [PATCH 03/22] Another case of XSS --- tbl_printview.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tbl_printview.php b/tbl_printview.php index 8e8ce24d47..ce007d1632 100644 --- a/tbl_printview.php +++ b/tbl_printview.php @@ -69,7 +69,7 @@ if ($multi_tables) { $tbl_list .= (empty($tbl_list) ? '' : ', ') . PMA_backquote($table); } - echo ''. __('Show tables') . ': ' . $tbl_list . '' . "\n"; + echo ''. __('Show tables') . ': ' . htmlspecialchars($tbl_list) . '' . "\n"; echo '
' . "\n"; } // end if From 951fb4dd79253a3aca8b6e386db77c1affcfc3a9 Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Thu, 7 Jul 2011 14:46:33 -0400 Subject: [PATCH 04/22] ChangeLog for PMASA-2011-9 --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index fe7103128a..49bb8947fb 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,9 @@ phpMyAdmin - ChangeLog ====================== +3.4.3.2 (2011-07-XX) +- [security] Fixed XSS vulnerability, see PMASA-2011-9 + 3.4.3.1 (2011-07-02) - [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-5 - [security] Fixed possible code injection incase session variables are compromised, see PMASA-2011-6 From f63e1bb42a37401b2fdfcd2e66cce92b7ea2025c Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Thu, 7 Jul 2011 14:50:37 -0400 Subject: [PATCH 05/22] Local file inclusion vulnerability --- ChangeLog | 1 + sql.php | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 49bb8947fb..065f8411b1 100644 --- a/ChangeLog +++ b/ChangeLog @@ -3,6 +3,7 @@ phpMyAdmin - ChangeLog 3.4.3.2 (2011-07-XX) - [security] Fixed XSS vulnerability, see PMASA-2011-9 +- [security] Fixed local file inclusion vulnerability, see PMASA-2011-10 3.4.3.1 (2011-07-02) - [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-5 diff --git a/sql.php b/sql.php index 9b19174a44..eb9254ffdd 100644 --- a/sql.php +++ b/sql.php @@ -719,7 +719,7 @@ if (0 == $num_rows || $is_affected) { parse_str($_REQUEST['transform_fields_list'], $edited_values); foreach($mime_map as $transformation) { - $include_file = $transformation['transformation']; + $include_file = PMA_securePath($transformation['transformation']); $column_name = $transformation['column_name']; $column_data = $edited_values[$column_name]; From 3ae58f0cd6b89ad4767920f9b214c38d3f6d4393 Mon Sep 17 00:00:00 2001 From: Herman van Rink Date: Fri, 8 Jul 2011 21:41:05 +0200 Subject: [PATCH 06/22] [security] Fixed local file inclusion vulnerability and code execution, see PMASA-2011-11 --- ChangeLog | 13 +++++++------ libraries/schema/User_Schema.class.php | 7 +++++-- schema_export.php | 4 +++- 3 files changed, 15 insertions(+), 9 deletions(-) diff --git a/ChangeLog b/ChangeLog index d4d4f1bf4b..232d499451 100644 --- a/ChangeLog +++ b/ChangeLog @@ -4,6 +4,7 @@ phpMyAdmin - ChangeLog 3.4.3.2 (2011-07-XX) - [security] Fixed XSS vulnerability, see PMASA-2011-9 - [security] Fixed local file inclusion vulnerability, see PMASA-2011-10 +- [security] Fixed local file inclusion vulnerability and code execution, see PMASA-2011-11 3.4.3.1 (2011-07-02) - [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-5 @@ -99,7 +100,7 @@ phpMyAdmin - ChangeLog + patch #2974341 [structure] Clicking on table name in db Structure should Browse the table if possible, thanks to bhdouglass - dougboybhd + patch #2975533 [search] New search operators, thanks to - Martynas Mickevičius + Martynas Mickevičius + patch #2967320 [designer] Colored relations based on the primary key, thanks to GreenRover - greenrover - [core] Provide way for vendors to easily change paths to config files. @@ -253,7 +254,7 @@ phpMyAdmin - ChangeLog 3.3.7.0 (2010-09-07) - patch #3050492 [PDF scratchboard] Cannot drag table box to the edge after - a page size increase, thanks to Martin Schönberger - mad05 + a page size increase, thanks to Martin Schönberger - mad05 3.3.6.0 (2010-08-28) - bug #3033063 [core] Navi gets wrong db name @@ -274,7 +275,7 @@ phpMyAdmin - ChangeLog 3.3.5.0 (2010-07-26) - patch #2932113 [information_schema] Slow export when having lots of - databases, thanks to Stéphane Pontier - shadow_walker + databases, thanks to Stéphane Pontier - shadow_walker - bug #3022705 [import] Import button does not work in Catalan when there is no progress bar possible - bug [replication] Do not offer information_schema in the list of databases @@ -314,9 +315,9 @@ phpMyAdmin - ChangeLog - patch #2984893 [engines] InnoDB storage page emits a warning, thanks to Madhura Jayaratne - madhuracj - bug #2974687, bug #2974692 [compatibility] PHPExcel : IBM AIX iconv() does not work, - thanks to Björn Wiberg - bwiberg + thanks to Björn Wiberg - bwiberg - bug #2983066 [interface] Flush table on table operations shows the query twice, - thanks to Martynas Mickevičius - BlinK_ + thanks to Martynas Mickevičius - BlinK_ - bug #2983060, patch #2987900 [interface] Fix initial state of tables in designer, thanks to Sutharshan Balachandren. - bug #2983062, patch #2989408 [engines] Fix warnings when changing table @@ -395,7 +396,7 @@ phpMyAdmin - ChangeLog + rfe #2839504 [engines] Support InnoDB plugin's new row formats + [core] Added ability for synchronizing databases among servers. + [lang] #2843101 Dutch update, thanks to scavenger2008 -+ [lang] Galician update, thanks to Xosé Calvo - xosecalvo ++ [lang] Galician update, thanks to Xosé Calvo - xosecalvo + [export] Added MediaWiki export module, thanks to Derek Schaefer - drummingds1 + [lang] Turkish update, thanks to Burak Yavuz diff --git a/libraries/schema/User_Schema.class.php b/libraries/schema/User_Schema.class.php index fbec138de0..cb42dde2c2 100644 --- a/libraries/schema/User_Schema.class.php +++ b/libraries/schema/User_Schema.class.php @@ -567,10 +567,13 @@ class PMA_User_Schema require_once './libraries/transformations.lib.php'; require_once './libraries/Index.class.php'; /** - * default is PDF + * default is PDF, otherwise validate it's only letters a-z */ global $db,$export_type; - $export_type = isset($export_type) ? $export_type : 'pdf'; + if (!isset($export_type) || !preg_match('/^[a-zA-Z]+$/', $export_type)) { + $export_type = 'pdf'; + } + PMA_DBI_select_db($db); include("./libraries/schema/".ucfirst($export_type)."_Relation_Schema.class.php"); diff --git a/schema_export.php b/schema_export.php index 0a21d3296c..3e1067d55e 100644 --- a/schema_export.php +++ b/schema_export.php @@ -37,7 +37,9 @@ include_once("./libraries/schema/Export_Relation_Schema.class.php"); * default is PDF */ global $db,$export_type; -$export_type = isset($export_type) ? $export_type : 'pdf'; +if (!isset($export_type) || !preg_match('/^[a-zA-Z]+$/', $export_type)) { + $export_type = 'pdf'; +} PMA_DBI_select_db($db); $path = PMA_securePath(ucfirst($export_type)); From e7bb42c002885c2aca7aba4d431b8c63ae4de9b7 Mon Sep 17 00:00:00 2001 From: Herman van Rink Date: Sat, 9 Jul 2011 23:10:23 +0200 Subject: [PATCH 07/22] [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-12 --- ChangeLog | 1 + libraries/auth/swekey/swekey.auth.lib.php | 6 ++++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 232d499451..c076772bb2 100644 --- a/ChangeLog +++ b/ChangeLog @@ -5,6 +5,7 @@ phpMyAdmin - ChangeLog - [security] Fixed XSS vulnerability, see PMASA-2011-9 - [security] Fixed local file inclusion vulnerability, see PMASA-2011-10 - [security] Fixed local file inclusion vulnerability and code execution, see PMASA-2011-11 +- [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-12 3.4.3.1 (2011-07-02) - [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-5 diff --git a/libraries/auth/swekey/swekey.auth.lib.php b/libraries/auth/swekey/swekey.auth.lib.php index c5f613bbd3..01f2dcc4c4 100644 --- a/libraries/auth/swekey/swekey.auth.lib.php +++ b/libraries/auth/swekey/swekey.auth.lib.php @@ -143,7 +143,9 @@ function Swekey_auth_error() return "Internal Error: CA File $caFile not found"; $result = null; - parse_str($_SERVER['QUERY_STRING']); + $swekey_id = $_GET['swekey_id']; + $swekey_otp = $_GET['swekey_otp']; + if (isset($swekey_id)) { unset($_SESSION['SWEKEY']['AUTHENTICATED_SWEKEY']); if (! isset($_SESSION['SWEKEY']['RND_TOKEN'])) { @@ -166,7 +168,7 @@ function Swekey_auth_error() $result = __('No valid authentication key plugged'); if ($_SESSION['SWEKEY']['CONF_DEBUG']) { - $result .= "
".$swekey_id; + $result .= "
" . htmlspecialchars($swekey_id); } unset($_SESSION['SWEKEY']['CONF_LOADED']); // reload the conf file } From 571cdc6ff4bf375871b594f4e06f8ad3159d1754 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Mon, 11 Jul 2011 14:15:19 +0200 Subject: [PATCH 08/22] Pass token along with swekey auth requests --- libraries/auth/swekey/swekey.auth.lib.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libraries/auth/swekey/swekey.auth.lib.php b/libraries/auth/swekey/swekey.auth.lib.php index 01f2dcc4c4..8ec5ab4f14 100644 --- a/libraries/auth/swekey/swekey.auth.lib.php +++ b/libraries/auth/swekey/swekey.auth.lib.php @@ -188,16 +188,16 @@ function Swekey_auth_error() Date: Mon, 11 Jul 2011 21:24:06 -0400 Subject: [PATCH 09/22] Fix broken characters --- ChangeLog | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/ChangeLog b/ChangeLog index c076772bb2..dc2956f208 100644 --- a/ChangeLog +++ b/ChangeLog @@ -101,7 +101,7 @@ phpMyAdmin - ChangeLog + patch #2974341 [structure] Clicking on table name in db Structure should Browse the table if possible, thanks to bhdouglass - dougboybhd + patch #2975533 [search] New search operators, thanks to - Martynas Mickevičius + Martynas Mickevičius + patch #2967320 [designer] Colored relations based on the primary key, thanks to GreenRover - greenrover - [core] Provide way for vendors to easily change paths to config files. @@ -255,7 +255,7 @@ phpMyAdmin - ChangeLog 3.3.7.0 (2010-09-07) - patch #3050492 [PDF scratchboard] Cannot drag table box to the edge after - a page size increase, thanks to Martin Schönberger - mad05 + a page size increase, thanks to Martin Schönberger - mad05 3.3.6.0 (2010-08-28) - bug #3033063 [core] Navi gets wrong db name @@ -276,7 +276,7 @@ phpMyAdmin - ChangeLog 3.3.5.0 (2010-07-26) - patch #2932113 [information_schema] Slow export when having lots of - databases, thanks to Stéphane Pontier - shadow_walker + databases, thanks to Stéphane Pontier - shadow_walker - bug #3022705 [import] Import button does not work in Catalan when there is no progress bar possible - bug [replication] Do not offer information_schema in the list of databases @@ -316,9 +316,9 @@ phpMyAdmin - ChangeLog - patch #2984893 [engines] InnoDB storage page emits a warning, thanks to Madhura Jayaratne - madhuracj - bug #2974687, bug #2974692 [compatibility] PHPExcel : IBM AIX iconv() does not work, - thanks to Björn Wiberg - bwiberg + thanks to Björn Wiberg - bwiberg - bug #2983066 [interface] Flush table on table operations shows the query twice, - thanks to Martynas Mickevičius - BlinK_ + thanks to Martynas Mickevičius - BlinK_ - bug #2983060, patch #2987900 [interface] Fix initial state of tables in designer, thanks to Sutharshan Balachandren. - bug #2983062, patch #2989408 [engines] Fix warnings when changing table @@ -397,7 +397,7 @@ phpMyAdmin - ChangeLog + rfe #2839504 [engines] Support InnoDB plugin's new row formats + [core] Added ability for synchronizing databases among servers. + [lang] #2843101 Dutch update, thanks to scavenger2008 -+ [lang] Galician update, thanks to Xosé Calvo - xosecalvo ++ [lang] Galician update, thanks to Xosé Calvo - xosecalvo + [export] Added MediaWiki export module, thanks to Derek Schaefer - drummingds1 + [lang] Turkish update, thanks to Burak Yavuz From 3a2d3e3c4eab717140526ca8ba5e6a234244c7d5 Mon Sep 17 00:00:00 2001 From: Thilanka Kaushalya Date: Thu, 21 Jul 2011 23:53:37 +0530 Subject: [PATCH 10/22] Ajaxified add columns option in table structure --- js/functions.js | 4 +++ js/messages.php | 3 +++ js/tbl_structure.js | 63 +++++++++++++++++++++++++++++++++++++++++++++ tbl_addfield.php | 6 +++++ tbl_structure.php | 2 +- 5 files changed, 77 insertions(+), 1 deletion(-) diff --git a/js/functions.js b/js/functions.js index 045296d181..ab43c0eaea 100644 --- a/js/functions.js +++ b/js/functions.js @@ -1870,16 +1870,20 @@ $(document).ready(function() { $("#result_query").prepend((data.message)); if ($("#change_column_dialog").length > 0) { $("#change_column_dialog").dialog("close").remove(); + } else if ($("#add_columns").length > 0) { + $("#add_columns").dialog("close").remove(); } /*Reload the field form*/ $.post($("#fieldsForm").attr('action'), $("#fieldsForm").serialize()+"&ajax_request=true", function(form_data) { $("#fieldsForm").remove(); + $("#addColumns").remove(); var $temp_div = $("
").append(form_data); if ($("#sqlqueryresults").length != 0) { $temp_div.find("#fieldsForm").insertAfter("#sqlqueryresults"); } else { $temp_div.find("#fieldsForm").insertAfter(".error"); } + $temp_div.find("#addColumns").insertBefore("iframe.IE_hack"); /*Call the function to display the more options in table*/ displayMoreTableOpts(); }); diff --git a/js/messages.php b/js/messages.php index 5b91d791d9..4cfa7e7e44 100644 --- a/js/messages.php +++ b/js/messages.php @@ -207,6 +207,9 @@ $js_messages['strShowSearchCriteria'] = __('Show search criteria'); /* For tbl_change.js */ $js_messages['strIgnore'] = __('Ignore'); +/* For tbl_structure.js */ +$js_messages['strAddColumns'] = __('Add columns'); + /* Designer (pmd/scripts/move.js) */ $js_messages['strSelectReferencedKey'] = __('Select referenced key'); $js_messages['strSelectForeignKey'] = __('Select Foreign Key'); diff --git a/js/tbl_structure.js b/js/tbl_structure.js index a9b9adae77..38503892cc 100644 --- a/js/tbl_structure.js +++ b/js/tbl_structure.js @@ -336,6 +336,67 @@ $(document).ready(function() { }); } //end show/hide table index + /** + *Ajax event handler for Add column(s) + **/ + $("#addColumns.ajax input[value=Go]").live('click', function(event){ + event.preventDefault(); + + /*Remove the hidden dialogs if there are*/ + if ($('#add_columns').length != 0) { + $('#add_columns').remove(); + } + var $div = $('
'); + + var $form = $("#addColumns"); + + /** + * @var button_options Object that stores the options passed to jQueryUI + * dialog + */ + var button_options = {}; + // in the following function we need to use $(this) + button_options[PMA_messages['strCancel']] = function() {$(this).dialog('close').remove();} + + var button_options_error = {}; + button_options_error[PMA_messages['strOK']] = function() {$(this).dialog('close').remove();} + var $msgbox = PMA_ajaxShowMessage(); + + $.get( $form.attr('action') , $form.serialize()+"&ajax_request=true" , function(data) { + //in the case of an error, show the error message returned. + if (data.success != undefined && data.success == false) { + $div + .append(data.error) + .dialog({ + title: PMA_messages['strAddColumns'], + height: 230, + width: 900, + open: PMA_verifyTypeOfAllColumns, + modal: true, + buttons : button_options_error + })// end dialog options + } else { + $div + .append(data) + .dialog({ + title: PMA_messages['strAddColumns'], + height: 600, + width: 900, + open: PMA_verifyTypeOfAllColumns, + modal: true, + buttons : button_options + }) + //Remove the top menu container from the dialog + .find("#topmenucontainer").hide() + ; // end dialog options + $div = $("#add_columns"); + PMA_convertFootnotesToTooltips($div); + } + PMA_ajaxRemoveMessage($msgbox); + }) // end $.get() + }); + + }) // end $(document).ready() @@ -396,6 +457,8 @@ function changeColumns(action,url) { $("#append_fields_form input[name=do_save_data]").addClass("ajax"); /*changed the z-index of the enum editor to allow the edit*/ $("#enum_editor").css("z-index", "1100"); + $div = $("#change_column_dialog"); + PMA_convertFootnotesToTooltips($div); } PMA_ajaxRemoveMessage($msgbox); }) // end $.get() diff --git a/tbl_addfield.php b/tbl_addfield.php index ec910fdf4b..a866fef7a9 100644 --- a/tbl_addfield.php +++ b/tbl_addfield.php @@ -184,6 +184,12 @@ if (isset($_REQUEST['do_save_data'])) { // Go back to the structure sub-page $message = PMA_Message::success(__('Table %1$s has been altered successfully')); $message->addParam($table); + + if( $GLOBALS['is_ajax_request'] == true) { + $extra_data['sql_query'] = PMA_showMessage(NULL, $sql_query); + PMA_ajaxResponse($message, $message->isSuccess(),$extra_data); + } + $active_page = 'tbl_structure.php'; require './tbl_structure.php'; } else { diff --git a/tbl_structure.php b/tbl_structure.php index afca2ea36e..6c5a778049 100644 --- a/tbl_structure.php +++ b/tbl_structure.php @@ -668,7 +668,7 @@ if (! $tbl_is_view && ! $db_is_information_schema) { ?>
-
onsubmit="return checkFormElementInRange(this, 'num_fields', '', 1)"> Date: Fri, 22 Jul 2011 07:40:14 +0530 Subject: [PATCH 11/22] Fixed issues of Add Columns --- js/functions.js | 4 ++-- js/tbl_structure.js | 3 +++ 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/js/functions.js b/js/functions.js index c08dbf2f6d..7c76b0fc25 100644 --- a/js/functions.js +++ b/js/functions.js @@ -1836,12 +1836,12 @@ $(document).ready(function() { }, 'top.frame_content'); //end $(document).ready for 'Create Table' /** - * jQuery coding for 'Change Table'. Used on tbl_structure.php * + * jQuery coding for 'Change Table' and 'Add Column'. Used on tbl_structure.php * * Attach Ajax Event handlers for Change Table */ $(document).ready(function() { /** - *Ajax action for submitting the column change form + *Ajax action for submitting the "Column Change" and "Add Column" form **/ $("#append_fields_form input[name=do_save_data]").live('click', function(event) { event.preventDefault(); diff --git a/js/tbl_structure.js b/js/tbl_structure.js index 0d2f051c01..a453e3281c 100644 --- a/js/tbl_structure.js +++ b/js/tbl_structure.js @@ -389,7 +389,10 @@ $(document).ready(function() { //Remove the top menu container from the dialog .find("#topmenucontainer").hide() ; // end dialog options + $div = $("#add_columns"); + /*changed the z-index of the enum editor to allow the edit*/ + $("#enum_editor").css("z-index", "1100"); PMA_convertFootnotesToTooltips($div); } PMA_ajaxRemoveMessage($msgbox); From c8967b62309eb6df7042fd44848042cd7f9d8d40 Mon Sep 17 00:00:00 2001 From: "M. Quasar" Date: Wed, 20 Jul 2011 16:08:01 -0300 Subject: [PATCH 12/22] added translation strings for missing values --- po/pt_BR.po | 69 ++++++++++++++++++++++++++++------------------------- 1 file changed, 36 insertions(+), 33 deletions(-) diff --git a/po/pt_BR.po b/po/pt_BR.po index 20fc437e45..a3d4cb1507 100644 --- a/po/pt_BR.po +++ b/po/pt_BR.po @@ -10194,7 +10194,7 @@ msgstr "Aplicar mudanças selecionadas" #: server_synchronize.php:446 server_synchronize.php:891 msgid "Synchronize Databases" -msgstr "" +msgstr "Sincronizar Bando de Dados" #: server_synchronize.php:459 msgid "Selected target tables have been synchronized with source tables." @@ -10234,7 +10234,7 @@ msgstr "" #: server_variables.php:58 msgid "Setting variable failed" -msgstr "" +msgstr "Erro na atribuição da variável" #: server_variables.php:77 msgid "Server variables and settings" @@ -10268,18 +10268,20 @@ msgstr "" msgid "" "You are not using a secure connection; all data (including potentially " "sensitive information, like passwords) is transferred unencrypted!" -msgstr "" +msgstr "Você não está usando conexão segura; todos dados (incluindo " +possíveis informações sensíveis, como senhas) são transferidos sem criptografia." #: setup/frames/index.inc.php:60 #, php-format msgid "" "If your server is also configured to accept HTTPS requests follow [a@%s]this " "link[/a] to use a secure connection." -msgstr "" +msgstr "Se o seu servidor também está configurado para aceitar requisições HTTPS " +siga [a@%s]este link[/a] para usar uma conexão segura." #: setup/frames/index.inc.php:64 msgid "Insecure connection" -msgstr "Conexão insegura" +msgstr "Conexão vulnerável" #: setup/frames/index.inc.php:92 #, fuzzy @@ -10383,7 +10385,8 @@ msgstr "" msgid "" "Reading of version failed. Maybe you're offline or the upgrade server does " "not respond." -msgstr "" +msgstr "Leitura de versão falhou. Você pode estar offline ou o servidor " +"de atualização não responde." #: setup/lib/index.lib.php:143 msgid "Got invalid version string from server" @@ -10398,11 +10401,12 @@ msgstr "" msgid "" "You are using Git version, run [kbd]git pull[/kbd] :-)[br]The latest stable " "version is %s, released on %s." -msgstr "" +msgstr "Se você estiver usando versão do Gir, execute [kbd]git pull[/kbd] :-)[br]" +"A versão estável mais nova é %s, lançada em %s." #: setup/lib/index.lib.php:165 msgid "No newer stable version is available" -msgstr "" +msgstr "Não existe nenhuma versão estável mais nova." #: setup/lib/index.lib.php:250 #, php-format @@ -10431,12 +10435,13 @@ msgstr "" msgid "" "This value should be double checked to ensure that this directory is neither " "world accessible nor readable or writable by other users on your server." -msgstr "" +msgstr "Este valor deve ser verificado com atenção para garantir que " +"este diretório não seja acessado ou escrito por outros usuários no seu servidor." #: setup/lib/index.lib.php:256 #, php-format msgid "This %soption%s should be enabled if your web server supports it." -msgstr "" +msgstr "Esta %sopção%s deveria estar habilitada se seu navegador tem suporter." #: setup/lib/index.lib.php:258 #, php-format @@ -10518,7 +10523,7 @@ msgstr "Você permite a conexão com o servidor sem uma senha." #: setup/lib/index.lib.php:351 msgid "Key is too short, it should have at least 8 characters." -msgstr "A chave é muito curta, você deveria ter pelo menos 8 caracteres." +msgstr "A chave é muito curta, deveria ter pelo menos 8 caracteres." #: setup/lib/index.lib.php:358 msgid "Key should contain letters, numbers [em]and[/em] special characters." @@ -10532,7 +10537,7 @@ msgstr "Visualizar valores estrangeiros" #: sql.php:189 #, php-format msgid "Using bookmark \"%s\" as default browse query." -msgstr "" +msgstr "Usando marcador \"%s\" como padrão." #: sql.php:661 tbl_replace.php:369 #, php-format @@ -10571,7 +10576,7 @@ msgstr "Por causa da sua largura,
esse campo pode não ser editável" #: tbl_change.php:800 msgid "Remove BLOB Repository Reference" -msgstr "" +msgstr "Remover referência a repositório BLOB" #: tbl_change.php:806 msgid "Binary - do not edit" @@ -10635,7 +10640,7 @@ msgstr "Mar" #: tbl_chart.php:87 msgid "Line" -msgstr "" +msgstr "Linhas" #: tbl_chart.php:88 #, fuzzy @@ -10663,7 +10668,7 @@ msgstr "Título do Relatório" #: tbl_chart.php:99 msgid "X-Axis:" -msgstr "" +msgstr "Eixo X" #: tbl_chart.php:113 #, fuzzy @@ -10717,7 +10722,7 @@ msgstr "Ver o esquema da tabela" #: tbl_gis_visualization.php:111 msgid "Display GIS Visualization" -msgstr "" +msgstr "Mostrar visualização GIS" #: tbl_gis_visualization.php:157 msgid "Width" @@ -10978,7 +10983,8 @@ msgstr "Relações internas" msgid "" "An internal relation is not necessary when a corresponding FOREIGN KEY " "relation exists." -msgstr "" +msgstr "Uma relação interna é desnecessária quando uma CHAVE ESTRANGEIRA " +"correspondente existe." #: tbl_relation.php:410 msgid "Foreign key constraint" @@ -10996,7 +11002,7 @@ msgstr "Selecionar os campos (no mínimo 1)" #: tbl_select.php:278 msgid "Add search conditions (body of the \"where\" clause):" -msgstr "Condição de Pesquisa (complemento da cláusula \"onde\"):" +msgstr "Condição de pesquisa (complemento da cláusula \"onde\"):" #: tbl_select.php:285 msgid "Number of rows per page" @@ -11008,7 +11014,7 @@ msgstr "Ordenado por:" #: tbl_structure.php:158 tbl_structure.php:163 tbl_structure.php:611 msgid "Spatial" -msgstr "" +msgstr "Espacial" #: tbl_structure.php:165 tbl_structure.php:169 msgid "Browse distinct values" @@ -11106,22 +11112,22 @@ msgstr "particionado" #: tbl_tracking.php:109 #, php-format msgid "Tracking report for table `%s`" -msgstr "" +msgstr "Relatório de rastreamento para tabela `%s`" #: tbl_tracking.php:182 #, php-format msgid "Version %s is created, tracking for %s.%s is activated." -msgstr "" +msgstr "Versão %s criada, rastreamento para %s. %s ativado(a)." #: tbl_tracking.php:190 #, php-format msgid "Tracking for %s.%s , version %s is deactivated." -msgstr "" +msgstr "Rastreamento para %s.%s, versão %s desativado(a)." #: tbl_tracking.php:198 #, php-format msgid "Tracking for %s.%s , version %s is activated." -msgstr "" +msgstr "Rastreamento para %s.%s, versão %s ativado(a)." #: tbl_tracking.php:208 msgid "SQL statements executed." @@ -11131,7 +11137,8 @@ msgstr "Instruções SQL executadas." msgid "" "You can execute the dump by creating and using a temporary database. Please " "ensure that you have the privileges to do so." -msgstr "" +msgstr "Você pode executar o dump criando e usando uma tabela temporária." +"Por favor, certifique-se de ter os privilégios necessários." #: tbl_tracking.php:215 msgid "Comment out these two lines if you do not need them." @@ -11145,11 +11152,7 @@ msgstr "Instruções SQL exportadas. Por favor copie a saída ou execute." #: tbl_tracking.php:255 #, php-format msgid "Version %s snapshot (SQL code)" -msgstr "" - -#: tbl_tracking.php:382 -msgid "Tracking data definition successfully deleted" -msgstr "" +msgstr "Instantâneo (código SQL) da versão %s" #: tbl_tracking.php:384 tbl_tracking.php:401 #, fuzzy @@ -11157,9 +11160,9 @@ msgstr "" msgid "Query error" msgstr "Reunir erros" -#: tbl_tracking.php:399 +#: tbl_tracking.php:399 tbl_tracking.php:382 msgid "Tracking data manipulation successfully deleted" -msgstr "" +msgstr "Rastreamento de manipulação de dados removidos com sucesso" #: tbl_tracking.php:411 msgid "Tracking statements" @@ -11168,7 +11171,7 @@ msgstr "Rastreando instruções" #: tbl_tracking.php:427 tbl_tracking.php:555 #, php-format msgid "Show %s with dates from %s to %s by user %s %s" -msgstr "" +msgstr "Mostrar %s com datas desde %s até %s pelo usuário %s %s" #: tbl_tracking.php:432 #, fuzzy @@ -11300,7 +11303,7 @@ msgstr "Você não tem direitos suficientes para estar aqui agora!" #: user_password.php:96 msgid "The profile has been updated." -msgstr "O perfíl foi atualizado." +msgstr "O perfil foi atualizado." #: view_create.php:141 msgid "VIEW name" From 54398f8a124702e30820bc4636040dda1db6b71b Mon Sep 17 00:00:00 2001 From: Sven Strickroth Date: Fri, 22 Jul 2011 02:01:17 +0200 Subject: [PATCH 13/22] Do not call PMA_showHint with bbcode=true in display_tbl.lib.php This fixes an issue with an InnoDB-table on sql.php with "select * from tbl" showing that "total ~ N 1" rows are displayed and with a JavaScript enabled browser the footnote gets hidden and it's impossible to find out what the 1 means. Signed-off-by: Sven Strickroth --- libraries/display_tbl.lib.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libraries/display_tbl.lib.php b/libraries/display_tbl.lib.php index c7d74ef44b..c871612143 100644 --- a/libraries/display_tbl.lib.php +++ b/libraries/display_tbl.lib.php @@ -1937,7 +1937,7 @@ function PMA_displayTable(&$dt_result, &$the_disp_mode, $analyzed_sql) || $analyzed_sql[0]['where_clause'] == '1 ')) { // "j u s t b r o w s i n g" $pre_count = '~'; - $after_count = PMA_showHint(PMA_sanitize(__('May be approximate. See [a@./Documentation.html#faq3_11@Documentation]FAQ 3.11[/a]')), true); + $after_count = PMA_showHint(PMA_sanitize(__('May be approximate. See [a@./Documentation.html#faq3_11@Documentation]FAQ 3.11[/a]'))); } else { $pre_count = ''; $after_count = ''; From 5f9c187010dcf2b51bf3dee516789b6fae9f2363 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B8rgen=20Thomsen?= Date: Fri, 22 Jul 2011 15:19:31 +0200 Subject: [PATCH 14/22] Fix format parameters --- setup/lib/index.lib.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup/lib/index.lib.php b/setup/lib/index.lib.php index aa0d0448c8..149918c76a 100644 --- a/setup/lib/index.lib.php +++ b/setup/lib/index.lib.php @@ -264,7 +264,7 @@ function perform_config_checks() $strLoginCookieValidityWarning3 = __('If using cookie authentication and %sLogin cookie store%s is not 0, %sLogin cookie validity%s must be set to a value less or equal to it.'); $strLoginCookieValidityWarning3 = sprintf($strLoginCookieValidityWarning3, '[a@?page=form&formset=Features#tab_Security]', '[/a]', '[a@?page=form&formset=Features#tab_Security]', '[/a]'); $strSecurityInfoMsg = __('If you feel this is necessary, use additional protection settings - %shost authentication%s settings and %strusted proxies list%s. However, IP-based protection may not be reliable if your IP belongs to an ISP where thousands of users, including you, are connected to.'); - $strSecurityInfoMsg = sprintf($strSecurityInfoMsg, '[a@?page=servers&mode=edit&id=%1$d#tab_Server_config]', '[/a]', '[a@?page=form&formset=Features#tab_Security]', '%s'); + $strSecurityInfoMsg = sprintf($strSecurityInfoMsg, '[a@?page=servers&mode=edit&id=%1$d#tab_Server_config]', '[/a]', '[a@?page=form&formset=Features#tab_Security]', '[/a]'); $strServerAuthConfigMsg = __('You set the [kbd]config[/kbd] authentication type and included username and password for auto-login, which is not a desirable option for live hosts. Anyone who knows or guesses your phpMyAdmin URL can directly access your phpMyAdmin panel. Set %sauthentication type%s to [kbd]cookie[/kbd] or [kbd]http[/kbd].'); $strServerAuthConfigMsg = sprintf($strServerAuthConfigMsg, '[a@?page=servers&mode=edit&id=%1$d#tab_Server]', '[/a]'); $strZipDumpExportWarning = __('%sZip compression%s requires functions (%s) which are unavailable on this system.'); From 3024f1e8672b63d8f88db70db4943acebfa16420 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Fri, 22 Jul 2011 15:21:57 +0200 Subject: [PATCH 15/22] Fix syntax errors in translation --- po/pt_BR.po | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/po/pt_BR.po b/po/pt_BR.po index a3d4cb1507..b2479ada26 100644 --- a/po/pt_BR.po +++ b/po/pt_BR.po @@ -10269,7 +10269,7 @@ msgid "" "You are not using a secure connection; all data (including potentially " "sensitive information, like passwords) is transferred unencrypted!" msgstr "Você não está usando conexão segura; todos dados (incluindo " -possíveis informações sensíveis, como senhas) são transferidos sem criptografia." +"possíveis informações sensíveis, como senhas) são transferidos sem criptografia." #: setup/frames/index.inc.php:60 #, php-format @@ -10277,7 +10277,7 @@ msgid "" "If your server is also configured to accept HTTPS requests follow [a@%s]this " "link[/a] to use a secure connection." msgstr "Se o seu servidor também está configurado para aceitar requisições HTTPS " -siga [a@%s]este link[/a] para usar uma conexão segura." +"siga [a@%s]este link[/a] para usar uma conexão segura." #: setup/frames/index.inc.php:64 msgid "Insecure connection" From 201ad07ea8883fc8c3a18227a656ea56fe7b18fc Mon Sep 17 00:00:00 2001 From: Sven Strickroth Date: Fri, 22 Jul 2011 00:52:06 +0200 Subject: [PATCH 16/22] Do not add backquotes for normal displayed text Signed-off-by: Sven Strickroth --- libraries/display_import.lib.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libraries/display_import.lib.php b/libraries/display_import.lib.php index 3a9c2eaa48..c56c46190a 100644 --- a/libraries/display_import.lib.php +++ b/libraries/display_import.lib.php @@ -63,7 +63,7 @@ if ($_SESSION[$SESSION_KEY]["handler"]!="noplugin") { complete = response.complete; if (total==0 && complete==0 && percent==0) { - $('#upload_form_status_info').html('ajax clock '); + $('#upload_form_status_info').html('ajax clock '); $('#upload_form_status').css("display", "none"); } else { $('#upload_form_status_info').html(' '+Math.round(percent)+'%, '+complete+'/'+total); @@ -73,7 +73,7 @@ if ($_SESSION[$SESSION_KEY]["handler"]!="noplugin") { if (finished==true) { $('#importmain').css('display', 'none'); $('#import_form_status').css('display', 'inline'); - $('#import_form_status').html('ajax clock '); + $('#import_form_status').html('ajax clock '); $('#import_form_status').load('import_status.php?message=true&'); // loads the message, either success or mysql error - $('#upload_form_status_info').html('ajax clock '); + $('#upload_form_status_info').html('ajax clock '); $('#upload_form_status').css("display", "none"); Date: Fri, 22 Jul 2011 09:34:42 -0400 Subject: [PATCH 17/22] ChangeLog entry for bug #3374347 --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 250bd1af5c..76f3514397 100644 --- a/ChangeLog +++ b/ChangeLog @@ -15,6 +15,7 @@ phpMyAdmin - ChangeLog - bug #3363221 [display] Missing Server Parameter on inline sql query - bug #3367986 [navi] Drop field -> lost active table - remove misleading comment on the "Rename database" interface +- bug #3374347 [display] Backquotes in normal text on import page 3.4.3.1 (2011-07-02) - [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-5 From 06bfdd7ca6d76335f45d53134770979d7d25d739 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Fri, 22 Jul 2011 15:52:01 +0200 Subject: [PATCH 18/22] Add changelog entries --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index 76f3514397..021c2ccc8b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -15,6 +15,8 @@ phpMyAdmin - ChangeLog - bug #3363221 [display] Missing Server Parameter on inline sql query - bug #3367986 [navi] Drop field -> lost active table - remove misleading comment on the "Rename database" interface +- bug #3374374 [interface] Fix footnote for inexact count while browsing +- bug #3372807 [interface] Fix security warning link in setup - bug #3374347 [display] Backquotes in normal text on import page 3.4.3.1 (2011-07-02) From 710362f869da38590ae507ee86c11c49c49387fa Mon Sep 17 00:00:00 2001 From: Thilanka Kaushalya Date: Fri, 22 Jul 2011 23:31:44 +0530 Subject: [PATCH 19/22] Fixed issues in enum editor in table insert column option --- js/functions.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/js/functions.js b/js/functions.js index 7c76b0fc25..c5ace1b34a 100644 --- a/js/functions.js +++ b/js/functions.js @@ -2111,6 +2111,10 @@ $(document).ready(function() { $("#popup_background").css({"opacity":"0.7"}); $("#popup_background").fadeIn("fast"); $("#enum_editor").fadeIn("fast"); + /**Replacing the column name in the enum editor hearder*/ + var column_name = $("#append_fields_form").find("input[id=field_0_1]").attr("value"); + var h3_text = $("#enum_editor h3").html(); + $("#enum_editor h3").html(h3_text.split('"')[0]+'"'+column_name+'"'); // Get the values var values = $(this).parent().prev("input").attr("value").split(","); From 97055ad6fe4f13dccdf2288050e8c433a0db2be6 Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Fri, 22 Jul 2011 14:33:28 -0400 Subject: [PATCH 20/22] Typo --- js/functions.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/js/functions.js b/js/functions.js index 295996ac1f..7b36e516ad 100644 --- a/js/functions.js +++ b/js/functions.js @@ -2111,7 +2111,7 @@ $(document).ready(function() { $("#popup_background").css({"opacity":"0.7"}); $("#popup_background").fadeIn("fast"); $("#enum_editor").fadeIn("fast"); - /**Replacing the column name in the enum editor hearder*/ + /**Replacing the column name in the enum editor header*/ var column_name = $("#append_fields_form").find("input[id=field_0_1]").attr("value"); var h3_text = $("#enum_editor h3").html(); $("#enum_editor h3").html(h3_text.split('"')[0]+'"'+column_name+'"'); From 5bc41ef1dc31019daaa0933bec967ebff63b55e0 Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Fri, 22 Jul 2011 14:34:46 -0400 Subject: [PATCH 21/22] ChangeLog for "AJAX for table Structure column Add" --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 38ac1e8af1..16e3cac510 100644 --- a/ChangeLog +++ b/ChangeLog @@ -39,6 +39,7 @@ phpMyAdmin - ChangeLog + [interface] Improved support for events + [interface] Improved support for triggers + [interface] Improved server monitoring ++ AJAX for table Structure column Add 3.4.4.0 (not yet released) - bug #3323060 [parser] SQL parser breaks AJAX requests if query has unclosed quotes From bd63726ee3daf32799f499b61d7cde973d8e8660 Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Sat, 23 Jul 2011 08:12:06 -0400 Subject: [PATCH 22/22] 3.4.3.2 release date --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index dc2956f208..05d5fe505f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,7 +1,7 @@ phpMyAdmin - ChangeLog ====================== -3.4.3.2 (2011-07-XX) +3.4.3.2 (2011-07-23) - [security] Fixed XSS vulnerability, see PMASA-2011-9 - [security] Fixed local file inclusion vulnerability, see PMASA-2011-10 - [security] Fixed local file inclusion vulnerability and code execution, see PMASA-2011-11