Remove PMA_transformation_global_html_replace which makes the code only
more confusing.
Also add escaping to browse transformations.
Signed-off-by: Michal Čihař <michal@cihar.com>
Now URL::getCommon always returns HTML encoded string, if you want
unencded one, use URL::getCommonRaw. This makes it easier to review the
code if uses correct variant.
Also I've fixed several wrong uses of the HTML encoded variant in
Location header.
Signed-off-by: Michal Čihař <michal@cihar.com>
The methods are now called based on added type:
- addHtml adds HTML code as is
- addText adds text after escaping it
- addMessage adds Message instance
Signed-off-by: Michal Čihař <michal@cihar.com>
- add call which accepts HTML markup
- use separator where applicable
- extend testcase to see HTML markup handling
Signed-off-by: Michal Čihař <michal@cihar.com>
We really want this to be explicit for easier review and hiding this in
second parameter of addParam doesn't make it.
Signed-off-by: Michal Čihař <michal@cihar.com>
This is really confusing and can cause surprising effects when parameter
(eg. table name) matches some global.
Also I think this is really not used anywhere.
Signed-off-by: Michal Čihař <michal@cihar.com>
In case PHP_SELF was not set by server, we used REQUEST_URI, which might
embed PATH_INFO as well. However we really need to know the path without
it, so let's strip it as well.
Signed-off-by: Michal Čihař <michal@cihar.com>
The JSON export now generates valid JSON data, but this means that the
resulting JSON format has changed.
Fixes#12307
Signed-off-by: Michal Čihař <michal@cihar.com>
It should be big enough on 64-bit systems, so avoid rounding issues
which double calculations can bring.
Fixes#12303
Signed-off-by: Michal Čihař <michal@cihar.com>
Surprisingly PHP stack frames are passed as references to the error
handling code, thus changing value there leads to changing value in the
executed code.
With MySQL issuing warning about incompatible version (different runtime
library than compile time), handling this warning rewrites current stack
frame and the mysql_real_connect later sees parameters as processed by
Error class for display.
We now create copy of the stacktrace to avoid this.
Fixes#12279
Signed-off-by: Michal Čihař <michal@cihar.com>
It is wrong for this purpose as on Windows this uses \ for both
separating parts and generating result. This fixed calculation of cookie
path on Windows.
Fixes#12249
Signed-off-by: Michal Čihař <michal@cihar.com>
- add separate script for handling logout
- no longer require old_usr for all authentication methods
(this avoids potential information leak)
- require valid token for logout
Signed-off-by: Michal Čihař <michal@cihar.com>
