July 2011 - Developers - lists.phpmyadmin.net

[Phpmyadmin-devel] pma plugins
by Tyron Madlener 08 Jul '11

08 Jul '11

Just saw a new js library in master called openlayers which is 1 MiB minified - I guess its for OpenGIS? Since I am a great fan of small and minimal software and knowing that probably many of the pma userbase won't be needing certain features such as opengis, wouldn't it be worth considering to build some of the gsoc projects as a pluggable module?

3 2

[Phpmyadmin-devel] Bug ID: 3340151 - Working SQL query exports error page
by Madhura Jayaratne 07 Jul '11

07 Jul '11

Hi all, While looking into a bug, I came across this piece of code in display_export.lib.php. // If the form data is being loaded from GET data, decode it foreach($_GET as $name => $value) { if(is_string($value)) { $_GET[urldecode($name)] = urldecode($value); } } Due to this $_GET is urldecoded twice and + signs in the sql query (which is passed inside $_GET) are replaced with spaces making it malformed. Any clue why this piece of code got in here? Or am I not seeing anything? -- Thanks and Regards, Madhura Jayaratne

3 3

[Phpmyadmin-devel] Better table navigation
by Aris Feryanto 07 Jul '11

07 Jul '11

Hi all, Current table navigation seems to be little messy, so I tried to make the table navigation tidier and more compact. You may see the screenshot at [0] or try the demo at usual location [1]. Feel free to give any comment or suggestion on this. [0] https://picasaweb.google.com/lh/photo/Xs_dOR1F0WoXW4_dTB1CLhOTKK2V2rX6_OFfH… [1] http://demo.phpmyadmin.net/gsoc-aris -- Aris Feryanto

3 17

[Phpmyadmin-devel] Create table dialog
by Tyron Madlener 07 Jul '11

07 Jul '11

I apologize for my directness but the newly implemented 'Create table' Dialog has an awful usability. Especially once you've added 2 more columns. The idea of AJAXifying pma is to increase the usability, but with a small dialog where I have to scroll horizontally and vertically several time to create the table, it will take me way way longer compared to the old create-table interface. I don't know if its just me, but I see so many things gone wrong with this dialog. Some things I would change globally (taking the create table dialog as example) : - Decrease the massive amounts of padding/margin of the jquery ui dialogs. - I don't need a 40 pixel high title telling me that I'm currently creating a table. - Did you notice that there's is a 900 x 60 pixel (!) area that only performs a single function: Containing the cancel button. This should be either drastically reduced in size or removed altogether (and put the cancel button inside the content) - Decrease those massive margins and paddings around input fields. Those should be made big only where it actually improves the usability/readability. I would reduce the margin/padding from 6/4 to 2/2 And for the create table dialog: - Display always in horizontal mode! Hardly any tables contain just 2 columns. - Start always with 4 fields - Bug: You can actually open the dialog several times, cause the enum/set editor to be in the background - Make all selects and text inputs way shorter. I'd reduce them by ~30% (selects as well!). The length/value field I would reduce by 50-70% or so. - The null and A_I checkbox waste big amounts of space. I would put them together in the form of " [ ] Null [ ] A_I " in a column called "Options" - Remove the "Table name:" title, instead put 'Table name' into the input field that disappears once the user focuses it - Instead of "Add x tables [Go]" which does it's own ajax request I would place a link "Add column" that adds one single column, but therefore adds it immediately (no ajax here!), allowing users to just spam click the link if they need a lot. Or alternatively use a select list that contains the numbers from 1 to 10 which adds columns immediately on the onchange event. - Display the input field for the default value only after "As defined:" is selected, and also focus it automatically once its selected so the user can type immediately - Why do we have these footnotes at the bottom of the dialog when we got PMA_showHint()? (Forgot to initialize them in js?) - For all the form fields below the columns: Remove all the gradient backgrounds on the titles. What are they there for? - In whatever way, put the Save and Cancel button side by side - The enum/set editor I find so bad, I don't even know how you could improve that: - If my table would be having 3 enums, I get 3 times this sentenced thrown onto my screen causing the columns table to get even bigger. - The dialog itself has a completely different style than everything else in PMA and really badly implemented. Just some bugs: - Values for column "" - wheres the column name? - Why is "Go" a button and "Cancel" a link? - Single quotes are not escaped (put a \' into the value field) - Breaks if a user accidently enters a space - The background is grayed out, yet you can still interact with it (e.g. select text) - You can actually scroll away the content of the dialog by selecting text downwards - Visual bug: One can see all input fields disappear if you press ok/cancel - Why not just a simple textfield where you let the user write one value per line? I would build the enum/set like this: - if set/enum is selected and the user focuses on the input field, pop out a bigger textarea (that is placed like a datepicker) - let the user write one element per line - extend the textarea row height with every line written so the user doesn't have to scroll. (up to a certain limit of course, like 15-20 lines - also it should not force the to scroll the page) - with every line written or on lost focus, automatically parse the text and update the value field correctly formatted Now lets say my enum has 5 elements. With the current enum/set editor that would require me to perform 13 mouse clicks and 5 interruptions (where my hands need to switch between mouse and keyboard), whereas with a textarea that pops up like a datepicker requires 2 mouse clicks and 0 interruptions. Why build things so complicated? ;-) Sorry again if I sounded too unpolite :<

4 13

[Phpmyadmin-devel] Zoom-search suggestions
by Marc Delisle 06 Jul '11

06 Jul '11

Ammar, it works well so far! Suggestions: - As the default data label, use the display field if it exists (from libraries/relation.lib.php, PMA_getDisplayField() ) - For the title, instead of "Scatter Plot", give some indications (how to zoom, how to click, etc) or give a link to get such indications - Is it possible to enlarge the size of the working zone? ideally, to drag it by one of its corners? - You seem to prefetch the whole table and I'm concerned about response time and memory issues for big tables (try it with the payment table and no data restriction). When hovering over a dot, maybe fetch the rows one by one with Ajax? Or use Ajax if there are more than a certain number of rows. - Clicking on a point shows the whole row; is it possible to show a pencil icon which would permit to bring another panel to edit the row? - Still thinking about a panning mechanism? - Any possibility of this feature for multi-tables? -- Marc Delisle http://infomarc.info

4 13

[Phpmyadmin-devel] $cfg - Functions and RestrictFunctions
by Piotr Przybylski 06 Jul '11

06 Jul '11

Hi, Which functions were chosen to be in these two arrays and for what reasons? Are these the functions that look like most used, or should these lists contain everything that can be used on Insert tab (functions that can take string arguments)? -- Regards, Piotr Przybylski

3 18

[Phpmyadmin-devel] zoom-search / position of the edit panel
by Marc Delisle 05 Jul '11

05 Jul '11

Ammar, It's difficult to see the effect of clicking on a data point (I have to scroll vertically to notice that the row has been brought in the editing section). Possible solutions to this (you can implement at least one of them but all would be better): - display the edit panel in a separate dialog that would appear over the current one (and would be movable) - add sliding sections to hide/show the search criteria (and maybe the data points) the same way as what's implemented in db search -- Marc Delisle http://infomarc.info

2 1

[Phpmyadmin-devel] Fixed XSS in unreleased RecentTable class
by Herman van Rink 05 Jul '11

05 Jul '11

Dear students/developers, Below is a small example of new code that has a vulnerability. Please lookout for places where you use ANY data that comes from the user, either through the web or through a database. In this case a table name. Luckily this has not yet been included in a release... diff --git a/libraries/RecentTable.class.php b/libraries/RecentTable.class.php index f844bbc..bfb6081 100644 --- a/libraries/RecentTable.class.php +++ b/libraries/RecentTable.class.php @@ -142,7 +142,7 @@ class PMA_RecentTable $html = '<option value="">(' . __('Recent tables') . ') ...</option>'; if (count($this->tables)) { foreach ($this->tables as $table) { - $html .= '<option value="' . $table . '">' . $table . '</option>'; + $html .= '<option value="' . htmlspecialchars($table) . '">' . htmlspecialchars($table) . '</option>'; } } else { $html .= '<option value="">' . __('There are no recent tables') . '</option>'; @@ -158,7 +158,7 @@ class PMA_RecentTable public function getHtmlSelect() { $html = '<input type="hidden" name="goto" id="LeftDefaultTabTable" value="' . - $GLOBALS['cfg']['LeftDefaultTabTable'] . '" />'; + htmlspecialchars($GLOBALS['cfg']['LeftDefaultTabTable']) . '" />'; $html .= '<select name="table" id="recentTable">'; $html .= $this->getHtmlSelectOption(); $html .= '</select>'; -- Met vriendelijke groet / Regards, Herman van Rink Initfour websolutions

3 2

[Phpmyadmin-devel] about fontsize selector on 3.4.3
by Marc Delisle 04 Jul '11

04 Jul '11

Hi, can someone reproduce this problem? https://sourceforge.net/tracker/?func=detail&aid=3339191&group_id=23067&ati… Please add your comments in the tracker, thanks. -- Marc Delisle http://infomarc.info

1 0

[Phpmyadmin-devel] Securing the test directory
by Herman van Rink 04 Jul '11

04 Jul '11

Zarubin / all, I would like to add a .htaccess file to the test directory of phpmyadmin similar to the libraries/.htaccess file. This should not affect regular users as the directory is not included in the download kits. It would protect someone who uses a Git checkout from accidentally exposing path information though. Would it be enough to include a README.txt file in the test directory which explains how to allow certain IP's ? What are your thoughts? -- Met vriendelijke groet / Regards, Herman van Rink Initfour websolutions

3 2