July 2014 - Developers - lists.phpmyadmin.net

[Phpmyadmin-devel] RFE #1488, #781 User privilege tab not shown in all relevant cases
by Chirayu Chiripal 11 Jul '14

11 Jul '14

Hi, >From the discussion on RFE #781, it seems that without having select access to mysql database the user having only GRANT or CREATE USER rights cannot see the list of users. So, what do you think should to be displayed in Users tab, only create user? Such users can create user if they have create privilege and grant privileges which they are having to another user. -- Regards, Chirayu Chiripal phpMyAdmin Intern - Google Summer of Code 2014 https://chirayuchiripal.wordpress.com/

3 6

[Phpmyadmin-devel] Follow up on the transformation feature
by Isaac Bennetch 11 Jul '14

11 Jul '14

Thanks to some extra detective work from Chirayu, we have traced the source of my problems with the transformation feature. In the process, the failure detection code was improved considerably, but ultimately I had a permissions problem that was silently causing the upgrade to fail. Thanks for your thoughts, especially Hugues for the extra insight in to multi query error reporting.

1 0

[Phpmyadmin-devel] About the transformation feature
by Isaac Bennetch 11 Jul '14

11 Jul '14

Hello, In the course of my testing the new input transformation feature, I've encountered some trouble that Chirayu is unable to reproduce. We've had a bit of discussion privately about it, but wanted to move discussion back to the mailing list. Note that running his branch[1] will change your pma__column_info table structure; so you may wish to back it up for testing purposes. The problem at the moment is the automatic table upgrade feature. What is supposed to happen is that, when logging in, PMA_checkRelationsParam() verifies that the correct table structure exists for pma__column_info. If it doesn't, it attempts to run ./examples/upgrade_column_info_4_3_0+.sql (after substituting the correct database and table names if needed). This is all quite good. On my system, what happens, however, is that $GLOBALS['dbi']->tryMultiQuery($query, $GLOBALS['controllink']) doesn't work. It returns 1 (which I presume is just how print_r represents TRUE), but the query doesn't execute ($query in this case is essentially the contents of the .sql file; several SQL statements with semicolons and newline characters and a few comments). It works properly on Chirayu's system but silently fails on mine. I'm hoping to get additional testing on the "silent upgrade" feature (or, for that matter, thoughts about the problem). At this point, I'm the only one for whom it fails, which is quite interesting. To test, simply checkout the branch and open phpMyAdmin, then check your pma__column_info table; it should have two new columns at the end (input_*). Thanks! Some more detailed information if you really want to read on: Around line 610, instead of directly testing the result of the tryMultiQuery in the if statement, I assign it to a variable then print_r that variable and get a message about "Commands out of sync; you can't run this command now". $ipb_test = $GLOBALS['dbi']->tryMultiQuery($query, $GLOBALS['controllink'] ); die("<pre>" . print_r($GLOBALS['controllink']) . "</pre>"); if ($ipb_test !== false ) { return true; mysqli Object ( [affected_rows] => 0 [client_info] => 5.5.37 [client_version] => 50537 [connect_errno] => 0 [connect_error] => [errno] => 0 [error] => [error_list] => Array ( ) [field_count] => 0 [host_info] => Localhost via UNIX socket [info] => [insert_id] => 0 [server_info] => 5.5.37-0+wheezy1 [server_version] => 50537 [stat] => Commands out of sync; you can't run this command now [sqlstate] => HY000 [protocol_version] => 10 [thread_id] => 6069 [warning_count] => 0 ) I'm not familiar enough with tryMultiQuery to know why [stat] contains this message. According to [2], it appears as if there is a problem with executing the code because either we haven't used mysql_free_result() or mysql_use_result() or mysql_store_result() since a previous query. We've looked at mysqli_multi_query() (http://www.php.net/manual/en/mysqli.multi-query.php) which is called by tryMultiQuery() depending on your DBI Extension (mine is mysqli). It says that it returns false when First statement is failed. See the return values section of it. Note that my mysqli object claims 0 rows were affected but also didn't return false. I expect that the 87 rows in my pma__column_info would have been affected by the first line (ALTER...). 1 - https://github.com/D-storm/phpmyadmin/commits/FR-637 2 - https://dev.mysql.com/doc/refman/5.0/en/commands-out-of-sync.html

4 11

[Phpmyadmin-devel] Comments for spreadsheets, databases, fields
by Thanushan Kailanathan 11 Jul '14

11 Jul '14

hi, We are planning to resolve the issue in 'sourceforge future request' (http://sourceforge.net/p/phpmyadmin/feature-requests/1534/) about Comments for spreadsheets, databases, fields. Do you have any suggestions about it?? Thank you.

2 1

[Phpmyadmin-devel] Interested in the drag and drop SQL file
by kumaran ragunathan 11 Jul '14

11 Jul '14

Hi , I'm interested in the project which enable phpmyadmin to drag and drop the SQL file to import into database .... ... There is a open ticket is available and I want to contribute to that part anyone else already started the process,???? -- - *R.Kumaran *

6 10

[Phpmyadmin-devel] About phpmyadmin-trk-bugs sourceforge mailing list
by Chirayu Chiripal 10 Jul '14

10 Jul '14

Hi, I am subscribed to Phpmyadmin-trk-bugs mailing list and receive Digest. In message digest I noticed something. It is about bug #4486, this bug report is kept private and when this link [1] is visited it says "Read access required" but the problem I see here is that if it is private then why I am getting that bug report message in the digest or am I missing something here? [1] : https://sourceforge.net/p/phpmyadmin/bugs/4486 Here is the message in digest: Message: 5 Date: Wed, 09 Jul 2014 20:00:28 +0000 From: "Marc Delisle" <lem9(a)users.sf.net> Subject: [Phpmyadmin-trk-bugs] [phpmyadmin:bugs] #4486 XSS injection due to unescaped table comment To: phpmyadmin-trk-bugs(a)lists.sourceforge.net Message-ID: <53bd9f5a485acd507b8dec62.bugs(a)phpmyadmin.p.sourceforge.net> Content-Type: text/plain; charset="us-ascii" --- ** [bugs:#4486] XSS injection due to unescaped table comment** **Status:** open **Group:** 4.2.5 **Created:** Wed Jul 09, 2014 08:00 PM UTC by Marc Delisle **Last Updated:** Wed Jul 09, 2014 08:00 PM UTC **Owner:** Marc Delisle -- Regards, Chirayu Chiripal phpMyAdmin Intern - Google Summer of Code 2014 https://chirayuchiripal.wordpress.com/

2 3

Re: [Phpmyadmin-devel] about the new error reporting at PHP level
by Dhananjay Nakrani 09 Jul '14

09 Jul '14

Hi, On Tue, Jul 1, 2014 at 5:28 PM, Dhananjay Nakrani < dhananjaynakrani(a)gmail.com> wrote: > Hi, > > On Tue, Jul 1, 2014 at 1:34 PM, Michal Čihař <michal(a)cihar.com> wrote: > >> Hi >> >> Dne Sun, 29 Jun 2014 07:49:26 -0400 >> Marc Delisle <marc(a)infomarc.info> napsal(a): >> >> > Since the new error reporting at the PHP level, errors that were >> > "hidden" using the at sign (for example, @fopen) are now displayed, with >> > the possibility of sending a report. >> >> This is IMHO bug in the error collecting code, Dhananjay can you please >> look at it? >> > > Sure. I will try to solve it this week only. > > >> > Do we now have to handle the situation differently (with try/catch) to >> > avoid this error reporting? In the case I mention, there is no need to >> > show the error report, as the situation is already handled by checking >> > what fopen() returns. >> >> I think using @ should be good enough (though catching the exceptions is >> probably cleaner approach). >> >> -- >> Michal Čihař | http://cihar.com | http://phpmyadmin.net >> > > I've solved that issue by adding an extra check in custom error handler. Please review Pull#1278. Thanks, Dhananjay Nakrani.

1 0

[Phpmyadmin-devel] Console: bug with queries containing quotes
by Marc Delisle 08 Jul '14

08 Jul '14

Hi Edward, in the console, if I type this kind of query: select 'hi' and press ctrl+enter, it gets executed correctly but in the console, it's shown as select \'hi\' which is problematic for "requery" or "reedit" followed by ctrl+enter. -- Marc Delisle | phpMyAdmin

2 1

[Phpmyadmin-devel] Console: improving a message
by Marc Delisle 08 Jul '14

08 Jul '14

Hi Edward, I was translating new messages and I blocked on: "Always expand queried messages". I would like to replace this message with: "Always expand query submenu" In fact, what is expanded looks like "Collapse Requery Reedit Database: employees Queried time: Tue Jul 08 2014 07:44:52 GMT-0400 (EDT) " so it contains a submenu plus some other info, but I cannot find a better improvement. Comments? -- Marc Delisle | phpMyAdmin

2 3

[Phpmyadmin-devel] Regarding RFE #908
by Ashutosh Dhundhara 08 Jul '14

08 Jul '14

Hi, I have got some ideas regarding RFE #908 <http://sourceforge.net/p/phpmyadmin/feature-requests/908/> (Improvements for the table editor (index creation)). *1. Making Column section on 'Add Index' dialog sort-able.* With this user will be able to change the order of columns in case of composite keys. *2. Displaying a dialog box when multiple columns for same type of index are selected on 'Create table' page.* This dialog will have two options: 'Create new' and 'Create composite'. - 'Create new' will allow user to create a new single column key. (Table can have only one Primary key) - 'Create composite' will allow user to add that column to a existing key (to be created) and sort the order of columns. Will this implement this feature request? -- Ashutosh Dhundhara

2 8