December 2005 - Developers - lists.phpmyadmin.net

[Phpmyadmin-devel] Removing of grab_globals
by Michal Čihař 08 Dec '05

08 Dec '05

Hi all I thing we all agree on removal of this security evil script. Me and Marc already had non public discussion on this topic, however I thing it should go on this list, so lets start it again :-). Basically there is need for some function to grab required parameters from request and clean up GLOBALS array in case of register_globals is on. I suggested to create some function like: PMA_grabParameter($name, $request, $sanitizing = 'none', $required = TRUE) The request parameter might not be needed, but it's up to discussion. While Marc came with way how Moodle does it: Moodle does this (I did not pasted the full clean_param() function) $id = optional_param('id', 0, PARAM_INT); $name = optional_param('name'); $edit = optional_param('edit'); $idnumber = optional_param('idnumber'); function optional_param($varname, $default=NULL, $options=PARAM_CLEAN) { if (isset($_POST[$varname])) { // POST has precedence $param = $_POST[$varname]; } else if (isset($_GET[$varname])) { $param = $_GET[$varname]; } else { return $default; } return clean_param($param, $options); } Comments? I do not thing it is good idea to have optional parameters in most of code. -- Michal Čihař | http://cihar.com

4 23

[Phpmyadmin-devel] On line translating system
by Michal Čihař 07 Dec '05

07 Dec '05

Hi all I have an idea of on line system, that would allow (easier) updating translations. However before putting any effort into actual implementation, I need to know whether it will be used by translators and how to handle some specific situations. This is why I cross-posted this message. So first question is basically for translators: Would you prefer manual file editing or web based system? The rest are implementation details: Should be access allowed to anyone or limit it to current translators? In case of unrestricted access, there should be some kind of review of translated texts by translator? Would it be good to automatically commit updated messages to CVS (after possible approval) or just provide way to generate updated file to commit? -- Michal Čihař | http://cihar.com

1 0

[Phpmyadmin-devel] PMA_show/print/display
by Sebastian Mendel 07 Dec '05

07 Dec '05

Hi, can we agree to prefix all functions sending output direct to stdout (to browser, f.e. with echo print ...) with the same prefix? i would suggest print -- Sebastian Mendel www.sebastianmendel.de www.sf.net/projects/phpdatetime | www.sf.net/projects/phptimesheet

3 2

[Phpmyadmin-devel] 2.7.1 config.inc.php issue
by Marc Delisle 07 Dec '05

07 Dec '05

Hi, For 2.7.1, there is at least one case where I cannot just reemploy my previous version of config.inc.php. Those new lines $cfg['Export']['file_template_table'] = '__TABLE__'; $cfg['Export']['file_template_database'] = '__DB__'; $cfg['Export']['file_template_server'] = '__SERVER__'; present in config.default.php are not used, if I have a config.inc.php with some other $cfg['Export'] parameters. Marc

3 8

[Phpmyadmin-devel] phpMyAdmin 2.7.0-pl1 has been released
by Marc Delisle 07 Dec '05

07 Dec '05

Hi, We have to inform you that phpMyAdmin 2.7.0 has a newly introduced vulnerability in it, which was reported to us two days after the release, and fixed immediately. A formal security alert will be posted on http://www.phpmyadmin.net in the next few hours. Marc Delisle, for the team

1 0

[Phpmyadmin-devel] Cleanup Items
by Cyber Dog 06 Dec '05

06 Dec '05

Hi All, As you've probably noticed, I've been submitting some small cleanup items for the CVS code. While Sebastian was kind enough to merge a couple of them, some others have gone without responses. I'm not trying to spam the list with these little issues, but I do rather enjoy going through and validating code which has a tendancy to produce lots of little patches like this. Before I move forward I figured I would ask the real devs what the best course of submission is. I'm very happy to continue cleaning up code, but I don't want to become a nuisence in the process. Please let me know your thoughts. Thanks, Matt "Cyber Dog" LaPlante

3 2

[Phpmyadmin-devel] Empty <option> in mysql_charsets.lib.php
by Cyber Dog 06 Dec '05

06 Dec '05

There is an empty <option> tag used as a spacer in mysql_charsets.lib.php. It's considered poor form to leave a tag completely empty, and the same effect can be achieved more correctly by coding in a blank space between the start and end tags. Diff is attached. - Matt "Cyber Dog" LaPlante

2 1

[Phpmyadmin-devel] Extra quotation mark in common.lib.php
by Cyber Dog 06 Dec '05

06 Dec '05

PMA_linkOrButton already quotations $edit_link, so the end quote in the variable is extra. [see attached diff] - Matt "Cyber Dog" LaPlante

2 1

[Phpmyadmin-devel] trigger_error
by Michal Čihař 05 Dec '05

05 Dec '05

Hi all I just noticed, that new class uses trigger_error. Should we use this function? We got security report about path disclosures and this introduces another way to disclose path information. -- Michal Čihař | http://cihar.com

3 5

[Phpmyadmin-devel] PDF export (again)
by Marc Delisle 05 Dec '05

05 Dec '05

Another point: at the beginning of libraries/export/pdf.php, I have commented out the lines that call fpdf.php, so I'm just using ufpdf.php. I had some problems but I'll try to work on this. Marc

2 1