webapp/phpmyadmin
1
0
Fork 0
mirror of https://github.com/phpmyadmin/phpmyadmin.git synced 2026-10-28 07:41:55 +03:00
Code Activity
83,437 Commits 12 Branches 481 Tags
MAINT_4_0_10
Commit Graph

233 Commits

Author SHA1 Message Date
Michal Čihař
6117ad5cef Use hash_equals for checking username 
This makes the comparison happen in constant time and makes it
impossible to use it to guess stored usernames.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 09:39:22 +02:00
Michal Čihař
285e5623b6 Strip null bytes from MySQL username 
In old PHP versions this could lead to allow/deny rules bypass.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 09:10:55 +02:00
Michal Čihař
47d00af08a Move generator scripts out of the code 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:38:30 +02:00
Michal Čihař
4d15f6b131 Fix random invocation 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 09:05:12 +02:00
Michal Čihař
ae8693db68 Backport cookie encryption from 4.6 branch 
- Use hash_hmac for MAC rather than plain SHA1
- Use different secret for MAC than encryption
- Merge pmaServer and pmaPass cookies
- Document 32 chars length for blowfish_secret

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:40:02 +02:00
Michal Čihař
378c3820bf Sanitize filename on SHP import 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 11:49:35 +02:00
Michal Čihař
6f8eb0993d Delete temporary file before reporting error 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 11:31:09 +02:00
Michal Čihař
714818f3ad Use https to access phpmyadmin.net 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:20:34 +02:00
Michal Čihař
ab26a8fe97 Fix exporting multiline comments 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 12:13:28 +02:00
Michal Čihař
04156efeb0 Ensure widht and height are integers 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:53:51 +02:00
Michal Čihař
31546255f3 Ensure widht and height are integers 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 10:51:53 +02:00
Michal Čihař
56e1350118 Properly handle newlines in SQL comments 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-13 09:58:14 +02:00
Michal Čihař
8e0918cc41 Sanitize MySQL host name before connecting 
It can contain p: prefix which we don't want to honor.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 15:10:59 +02:00
Michal Čihař
14fd275811 Use iframe sandbox for rendering HTML in transformation 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 14:13:14 +02:00
Michal Čihař
c8297b4718 Use phpseclib's Crypt module to generate encryption keys 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 14:02:26 +02:00
Michal Čihař
e9a4de70a7 Escape HTML in Mediawiki comments 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 12:29:35 +02:00
Michal Čihař
0a4cdc25f1 Use _blank target instead of invalid _new 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 11:20:16 +02:00
Michal Čihař
63a5fdaa21 Add rel="noopener noreferrer" to all target="_blank" links 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 10:59:38 +02:00
Michal Čihař
a416cbe6c7 Use whitelist rather than blacklist for URL filtering 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 10:36:33 +02:00
Michal Čihař
ec2bd5d84c Remove Swekey support 
It is buggy and their servers are no longer working.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-11 08:57:21 +02:00
Michal Čihař
95b7b7d6dd Improve cookie encryption 
- use MAC to validate content before decryption
- create unique IV for every cookie

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-08 17:54:25 +02:00
Michal Čihař
59e0f3dee4 Properly escape generated XML export 
Many fields could contain XML markup, so we need to ensure the generated
XML is valid.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-30 10:59:44 +02:00
Michal Čihař
34a1cebf76 Generate valid PHP code even when table/database name contains PHP markup 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-30 10:26:29 +02:00
Michal Čihař
b04150e30e Do not allow javascript: links in transformation 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-22 13:26:03 +02:00
Michal Čihař
288efea5b4 Simplify and cleanup transformation plugins 
Remove PMA_transformation_global_html_replace which makes the code only
more confusing.

Also add escaping to browse transformations.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 16:19:31 +02:00
Madhura Jayaratne
095729d812 bug #4611 [security] DOS attack with long passwords 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2014-12-01 20:49:45 +05:30
Madhura Jayaratne
f9300c7b07 bug #4001 Import error: Class 'ImportOds' not found 2013-09-17 16:49:06 +05:30
Marc Delisle
836529be42 Fix merge conflicts 2013-07-28 05:55:40 -04:00
Dieter Adriaenssens
e0c8704f72 [security] Fix stored XSS in link transformation plugin, see PMASA-2013-13 2013-07-28 02:26:26 +02:00
Marc Delisle
77e67c3f2c - bug #4019 Create database if not exists (export): add an option to the 
interface to enable generating CREATE DATABASE and USE (false by default)
 2013-07-19 09:09:24 -04:00
Marc Delisle
90d968b447 Fix merge conflicts 2013-07-17 15:18:09 -04:00
Dieter Adriaenssens
d0c0d0d207 fix typo 2013-06-24 13:29:36 +02:00
Michal Čihař
85e5a3b5ce bug #3645 Better handling of invalid ODS documents 2013-06-11 14:58:02 +02:00
Kari Söderholm
0181fa9400 Fix regression: Missing removeCRLF option in ExportCsv and ExportExcel plugins. 2013-06-10 12:57:27 -04:00
Marc Delisle
ec6a47d8a0 bug #3957 Cookies must be enabled past this point 2013-05-28 08:46:04 -04:00
Marc Delisle
078da8d57f bug #3933 Do not translate "Open Document" in export settings 2013-05-23 02:54:47 -04:00
Madhura Jayaratne
b3e6f8cee7 bug #3924 Show warning when CSV file does not contain data for all columns 2013-05-20 17:50:19 +05:30
Marc Delisle
e72f1a0daa Merge pull request #395 from ayusun/exportsqlupdate 
creating database while exporting at database level
 2013-05-20 05:08:21 -07:00
Marc Delisle
9b61212b48 bug #3946 Missing CSV import option "Do not abort on INSERT error" 2013-05-19 08:44:45 -04:00
ayusun
d8b9a0b28c creating database while exporting at database level 2013-05-16 20:52:50 +05:30
Marc Delisle
920d827c37 Merge pull request #379 from mynetx/bug-3907 
Fix most analysis results discovered in bug 3907
 2013-05-15 09:52:03 -07:00
ayusun
25e71b71da Bug fix #3910 with updated code indentation 2013-05-14 22:40:39 +05:30
ayusun
44dd0e8405 Bug fix 3910. Updated Export plugin to support zero rows 2013-05-13 15:16:46 +05:30
J.M
529903e0dd Fix bug #3907 undefined variables, function parameter problems 
Thanks Rasmus Lerdorf for analyzing!
 2013-05-13 11:27:56 +02:00
Marc Delisle
4113d9e98b bug #3915 Import of CSV file (Replace table data with file) with duplicate values 2013-05-12 08:09:02 -04:00
J.M
e25bba8bcc Fix notice Undefined index: old_usr in AuthenticationHttp.class.php:162 2013-04-28 17:29:50 +02:00
J.M
4fa8633474 Add rfe #1421 Add retry button on connection failure with config auth 2013-04-28 12:31:21 +02:00
J.M
459b2807fd Correct welcome message horizontal alignment for config auth 2013-04-28 12:00:11 +02:00
Madhura Jayaratne
5ff9e989b7 Merge pull request #267 from kasunchathuranga/Bug3879 
Fix bug #3879 Import broken for CSV using LOAD DATA
 2013-04-25 08:14:45 -07:00
Marc Delisle
ac65210a28 Typo in input field name 2013-04-24 14:41:57 -04:00