webapp/phpmyadmin
1
0
Fork 0
mirror of https://github.com/phpmyadmin/phpmyadmin.git synced 2026-10-31 10:54:46 +03:00
Code Activity
107,360 Commits 12 Branches 481 Tags
db4a2e11f473d169b41d00a6668dfd2742e8bd71
Commit Graph

447 Commits

Author SHA1 Message Date
Deven Bansod
f797a8d87d Variables must be defined even if it's a GET Request 
Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-09-09 20:25:12 +05:30
Deven Bansod
3179594220 Variable to be passed by reference should be explicitly defined 
Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-09-02 19:05:10 +05:30
Deven Bansod
9c1cfc8553 Check for Token mismatches only if it's a POST request 
Checking for Token mismatches for GET requests does not make sense
because they don't contain the Token parameter

We remove all parameters from POST request in case of token mismatch

Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-09-02 16:46:28 +05:30
Michal Čihař
2148df85f1 Merge branch 'QA_4_6' 2016-08-30 15:53:06 +02:00
Michal Čihař
f3ca367efa Fix number formatting with different settings of precision in PHP 
- fixed Util::formatNumber to avoid rounding issues to mess up display
- force precision = 14 to ensure we get sane behavior

With precision set to higher value many things do not behave as expected
producing strange numbers in various places.

For example with precision=19 you get:

php > echo round(1.2, 2);
1.199999999999999956

Fixes #12303

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-30 15:51:18 +02:00
Michal Čihař
7b244494b4 Fix call to Sanitize 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-29 14:43:05 +02:00
Michal Čihař
89bea5fff1 Move request cleanup to Sanitize class and add tests 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-29 13:48:17 +02:00
Deven Bansod
dd34ca8512 Merge branch 'QA_4_6' 2016-08-26 00:08:02 +05:30
Deven Bansod
b3e7f10f2e Check if the indices are present and map to a string value 
Fix #12477

The indices may not be present in the json_decode result, or might not be strings

Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
 2016-08-26 00:02:21 +05:30
Michal Čihař
7ef6fecb87 Merge branch 'master' into master-security 2016-08-01 11:07:33 +02:00
Madhura Jayaratne
238713b452 Fix menu items and navigation panel links 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-08-01 08:55:02 +10:00
Michal Čihař
aebbb31aad Merge branch 'master' into master-security 2016-07-29 14:08:23 +02:00
Michal Čihař
95064ed9fb Move control user connection calculation to DatabaseInterface 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-29 11:58:02 +02:00
Michal Čihař
25a38b2067 Determine correct user/password for connect in DatabaseInterface 
The API only specifies what kind of link we want and we will get it.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-29 11:51:09 +02:00
Michal Čihař
f30f65c67a Indentify connection type by one flag 
Use integer values rather than set of boolean flags. This makes it
easier to make decision and makes the code more readable. Also removes
confusion what should happen in case both boolean flags are set.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-29 11:36:07 +02:00
Michal Čihař
f5015c2ea3 Merge branch 'QA_4_6-security' into master-security 2016-07-26 16:31:21 +02:00
Michal Čihař
e67e69229a Remove option to show phpinfo() ($cfg['ShowPhpInfo']) 
This is really more a PHP debugging feature than anything related to
phpMyAdmin. If user wants to debug, it's as simple a creating file with
one line of php code.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-23 11:31:46 +02:00
Michal Čihař
b52bd77987 Merge branch 'QA_4_6' 2016-05-23 13:49:00 +02:00
Michal Čihař
f9d6c40939 Safer handling of sessions during authentication 
- always generate new session for login form
- always generate new session when authenticated using cookie auth

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 13:48:25 +02:00
Michal Čihař
49a1db045e Merge branch 'QA_4_6' 2016-05-23 08:43:51 +02:00
Michal Čihař
24bb12793d Fix locking issues when importing SQL 
When running import (or generally any SQL query), some tables might be
locked. This will cause queries to not locked tables to fail. And this
is exacly what we do with control user link.

So let's have separate link for control queries even if we're using same
credentials as for main link.

Fixes #12219

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 08:42:08 +02:00
Michal Čihař
ca5eb903b0 Make ThemeManager a singleton instead of storing it in the session 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-11 15:34:25 +02:00
Michal Čihař
9182a4d3a1 Move error checking to the Config class 
Also fix not working checking error on the defaults.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-04-11 16:17:02 +02:00
Michal Čihař
3e2029e750 Move MySQL charsets handling to the Charsets class 
Issue #11731

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-04-11 12:55:42 +02:00
Michal Čihař
cd4008b3d7 Move MySQL charset maps to separate class 
This allows us to load it only when needed

Issue #11731

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-04-11 10:33:40 +02:00
Michal Čihař
3e8145a4a5 Remove unused variable mysql_collations_flat 
Issue #11731

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-04-11 10:21:53 +02:00
Michal Čihař
f4e16addb7 Merge remote-tracking branch 'origin/pull/12147' into tmp 2016-04-07 09:39:21 +02:00
Michal Čihař
f58349481d Avoid destroying already initalized gettext variables 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-04-06 10:13:40 +02:00
Michal Čihař
a65a4213d7 Load gettext before autoloader 
This fixes possible PHP error in SQL parser as it tries to define __()
if it's not existing. Later loading of gettext just breaks this.

Fixes #12154

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-04-05 09:24:15 +02:00
Madhura Jayaratne
e6a3e76cfb Fix #12143 Cannot login with certain password 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-03-31 21:00:59 +11:00
Michal Čihař
f5393eff61 Remove code mentioning register_globals 
This was removed in PHP 5.4.0 so we really do not have to care anymore.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-03-08 15:30:24 +01:00
Michal Čihař
3bda9a03b9 Move Kanji encoding handling to Encoding class 
Issue #11731

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-03-08 14:55:41 +01:00
Michal Čihař
4ed47fc4b4 Move charset conversion to a class 
Also removes ancient support for AIX iconv.

Issue #11731

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-03-08 14:05:59 +01:00
Michal Čihař
1b9ea10f11 Move logging helpers to class 
Issue #11731

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-03-08 11:14:28 +01:00
Michal Čihař
912bf964c7 Replace embedded php-gettext library with motranslator 
Fixes #12018

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-24 11:49:43 +01:00
Durgesh
6650f7b07d Refactor text sanitization and javascript escaping, Issue #11989, #11988 
Signed-off-by: Durgesh <007durgesh219@gmail.com>
 2016-02-22 14:45:19 +05:30
Durgesh
0b64827930 Refactored url parmeters generating, Issue #11990 
Signed-off-by: Durgesh <007durgesh219@gmail.com>
 2016-02-22 14:36:41 +05:30
Michal Čihař
cec39a3d77 Do not destroy gettext global variables 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-22 08:05:49 +01:00
Michal Čihař
faa87a31c8 Load gettext earlier 
It's used by SQLParser, so it should be included before autloader.

See #11677

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-22 08:05:49 +01:00
Michal Čihař
38482bfa9f Use Componser autloader for external libraries 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-22 08:03:19 +01:00
Michal Čihař
1894e33753 Merge branch 'QA_4_5' into QA_4_6 2016-02-12 12:44:06 +01:00
Michal Čihař
e50a445d17 Define is_ajax_request earlier 
This fixes PHP warning on configuration errors.

Fixes #11950

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-12 12:43:30 +01:00
Michal Čihař
3ebacb0025 Simplify loading of vendor configuration 
Do it just once and very early, so that all scripts can rely on it being
available.

Fixes autoloading of phpseclib.

Fixes #11914

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-09 11:00:54 +01:00
Michal Čihař
ae1ccf3e6a Remove PmaAbsoluteUri configuration directive 
Fixes #11412

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-03 17:41:29 +01:00
Michal Čihař
1e9e14d23b Remove ForceSSL configuration directive 
In most setups we simply do not have enough information to decide
whether user has come through HTTPS or not leading to infinite
redirects.

Anyway this is better to handle at web server side together with setting
HSTS headers.

Issue #11412, #11883

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-03 14:20:11 +01:00
Michal Čihař
ed96969ff9 Merge branch 'QA_4_5' 2016-01-28 09:23:27 +01:00
Michal Čihař
d4b9c22c1f Enable localization before redirect 
This is needed in case of IIS which needs full HTML response.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-27 08:56:24 +01:00
Michal Čihař
f83b52737e Do not process subforms with PMA_MINIMUM_COMMON 
In such case needed infrastructure is not loaded, so related code won't
work anyway.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-26 14:35:08 +01:00
Michal Čihař
85ccdbb5b9 Include common libraries in setup 
We use PMA_fatalError which in turn needs Response and related objects.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-26 14:27:38 +01:00
Michal Čihař
ec0e88e37e Use hash_equals for comparing token 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-19 08:32:07 +01:00