Developers April 2008

developers@phpmyadmin.net

5 participants
14 discussions

[Phpmyadmin-devel] secure session through hash_bits_per_character?

by Thijs Kinkhorst

Hi, At Debian we've gotten a bug report which I'm quoting below. Basically, the user has hashing of his sessions dir, but this is appearently broken by the following bit of code that phpMyAdmin employs in session.php: // use more secure session ids (with PHP 5) if (version_compare(PHP_VERSION, '5.0.0', 'ge') && substr(PHP_OS, 0, 3) != 'WIN') { ini_set('session.hash_function', 1); ini_set('session.hash_bits_per_character', 6); } As I understand it, only the first option actually changes the security, as it increases the number of bits in the algorithm. Changing the hash_bits_per_character option only changes the style of the session hash names, not their security. Yet, "hard" overriding this second option causes trouble for sysadmins that have enabled hashing of their session dir as in the quoted bug report. I see no real reason to hardcode the bits_per_character option, as the only thing it does is make te ID's a bit shorter, but they're not human readable anyway... Is there a reason why bits_per_character is hardcoded, or could it be removed? thanks, Thijs === begin quote === Enabling hashing session files to directories[1] with default php configuration requires creating a directory hierarchy[2] for them. Phpmyadmin enforces different session names[3] than configured by sysadmin, but does use default directory and hashing depth. So if sysadmin creates hierarchy for his session naming scheme, phpmyadmin will fail creating (some) of the session files because no directories [G-Zg-z] (and maybe more?) exist in the directory tree. IMO phpmyadmin should honor session settings in the main php.ini or allow this behaviour to be configured by debconf (along with its own session directory). [1] accomplished by setting session.save_path="2;/var/lib/php5" in /etc/php5/apache2/php.ini - session name: sess_a1765f9b22bc2e2c2b672f4ab34a3199 - is stored as /var/lib/php5/a/1/sess_a1765f9b22bc2e2c2b672f4ab34a3199 [2] with default php setting sessions are hashed to hex-digit directories (session.hash_bits_per_character = 4) [3] /usr/share/phpmyadmin/libraries/session.inc.php:66 [in 2.9.1.1 -TK] === end quote ===

16 years

[Phpmyadmin-devel] phpMyAdmin 2.11.6 is released

by Marc Delisle

Welcome to phpMyAdmin 2.11.6, a bugfix-only version. The release notes and download info are available on http://www.phpmyadmin.net. Marc Delisle, for the team.

16 years

Re: [Phpmyadmin-devel] [Phpmyadmin-cvs] DisableIS in

by Sebastian Mendel

Rekrutacja schrieb: > Marc Delisle wrote: >> Sebastian Mendel a écrit : >>> Hi, >>> >>> Rekrutacja schrieb: >>>> i've tested latest pma (phpMyAdmin-trunk-20080424-022001), and it seems >>>> it has DisableIS set to true as default, but when i log in and click any >>>> of the tables from database, i can see this on the server: >>>> >>>> SELECT TRIGGER_SCHEMA, TRIGGER_NAME, EVENT_MANIPULATION, ACTION_TIMING, >>>> ACTION_STATEMENT, EVENT_OBJECT_SCHEMA, EVENT_OBJECT_TABLE FROM >>>> information_schema.TRIGGERS WHERE EVENT_OBJECT_SCHEMA= 'test99_db' and >>>> EVENT_OBJECT_TABLE = 'phpbb2_bookmarks' >>>> >>>> and is taking very long time, same as without DisableIS. >>>> >>>> does DisableIS is not yet fully implemented or is it a bug? >>> 1. not fully implemented >>> 2. IMHO sooner, later or already SHOW will mapped to I_S >>> 3. the above statement should include TRIGGER_SCHEMA in WHERE >>> >>> Marc? >>> >>> was there any reason not including TRIGGER_SCHEMA in WHERE? >> >> The EVENT_OBJECT_SCHEMA seems to always have the same content as >> TRIGGER_SCHEMA, but I just noticed that in the MySQL manual they suggest >> using TRIGGER_SCHEMA in the WHERE clause as you suggested, so I merged >> the change and the doc reference (for version 2.11.7) >> >> http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/ph… >> >> Rekrutacja, is it faster this way on your server? > > i've tried latest 3.0-dev version, from svn (did checkout just few > minutes ago), and it is still slow. > > Query | 30 | checking permissions | SELECT TRIGGER_SCHEMA, > TRIGGER_NAME, EVENT_MANIPULATION, ACTION_TIMING, ACTION_STATEMENT, > EVENT_OBJECT_SCHEMA, EVENT_OBJECT_TABLE FROM information_schema.TRIGGERS > WHERE TRIGGER_SCHEMA= 'test99' and EVENT_OBJECT_TABLE = 'phpbb2_confirm' whats your MySQL server version? -- Sebastian Mendel

16 years

Re: [Phpmyadmin-devel] [Phpmyadmin-cvs] DisableIS in phpMyAdmin-trunk-20080424-022001 doesn't work

by Sebastian Mendel

Hi, Rekrutacja schrieb: > i've tested latest pma (phpMyAdmin-trunk-20080424-022001), and it seems > it has DisableIS set to true as default, but when i log in and click any > of the tables from database, i can see this on the server: > > SELECT TRIGGER_SCHEMA, TRIGGER_NAME, EVENT_MANIPULATION, ACTION_TIMING, > ACTION_STATEMENT, EVENT_OBJECT_SCHEMA, EVENT_OBJECT_TABLE FROM > information_schema.TRIGGERS WHERE EVENT_OBJECT_SCHEMA= 'test99_db' and > EVENT_OBJECT_TABLE = 'phpbb2_bookmarks' > > and is taking very long time, same as without DisableIS. > > does DisableIS is not yet fully implemented or is it a bug? 1. not fully implemented 2. IMHO sooner, later or already SHOW will mapped to I_S 3. the above statement should include TRIGGER_SCHEMA in WHERE Marc? was there any reason not including TRIGGER_SCHEMA in WHERE? -- Sebastian Mendel

16 years

Re: [Phpmyadmin-devel] Sandra!!

by elf2000＠users.sourceforge.net

Grande Oportunidade veja os detalhes !!!. -------------------------------------------- Sandra!!.zip: Nao Tem Virus! Norton AntiVirus Procura Progressiva Mais detalhes: www.symantec.com

16 years

[Phpmyadmin-devel] participation to MySQL Conference and Expo

by Marc Delisle

Hi, Just a short report here. Robin Johnson and I were present at the phpMyAdmin booth this year. I had not seen Robin since the first developer meeting in 2005. http://flickr.com/photos/lenzgr/2416227949/ We received many visitors, sometimes both of us were busy at the same time! The majority of visitors did not know about features like the Designer or inline display of photos in Browse mode. It seems that only a few visitors were not already users of phpMyAdmin so we got a fair number of "Thank you" for the product. Marc Delisle

16 years

[Phpmyadmin-devel] Two projects in Google Summer of Code

by Marc Delisle

Two projects for phpMyAdmin improvement have been accepted in GSoC 2008. Thanks to Google for this initiative, Colin Charles (MySQL/Sun) for the offer of external mentorship and to Raj Kissu Rajandran and Piotr Przybylski, the two students who will work on these projects. http://code.google.com/soc/2008/mysql/about.html

16 years

[Phpmyadmin-devel] phpMyAdmin 2.11.5.2 is released

by Marc Delisle

Welcome to phpMyAdmin 2.11.5.2, a security fix version. Security announcement: http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3 The release notes and download info are available on http://www.phpmyadmin.net. Marc Delisle, for the team.

16 years

[Phpmyadmin-devel] phpMyAdmin 2.11.6-rc1 is released

by Marc Delisle

Welcome to the first release candidate for phpMyAdmin 2.11.6, a bugfix-only version. The release notes and download info are available on http://www.phpmyadmin.net. Marc Delisle, for the team.

16 years

[Phpmyadmin-devel] phpMinAdmin

by Michal Čihař

Hi all just in case you don't know this project yet. Take a look at phpMinAdmin[1], small competitor to phpMyAdmin. [1]: http://phpminadmin.sourceforge.net/ -- Michal Čihař | http://cihar.com | http://phpmyadmin.cz

16 years, 1 month

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

Developers April 2008