Hi
Dne Wed, 2 Jul 2014 16:02:23 +0530
Chirayu Chiripal <chirayu.chiripal(a)gmail.com> napsal(a):
> I have seen few translations using html tags in them. I was shocked, that
> why html tags are allowed in translations.
> Isn't it possible that someone can insert tags like this <script src="
> http://www.some-phishing-site.com/simple.js"></script> with the translation
> and can be used to attack users of particular language??
Technically it is possible, though markup changes is something I always
check (Weblate has flag for this, so it's quite easy to review), so that
will not get in. Indeed it would be better to use always just bbcode and
pass all strings though PMA_sanitize(), but that means somebody would
have to go through the code and fix the messages :-).
PS: I hope you don't mind bringing this back to -devel list.
--
Michal Čihař | http://cihar.com | http://blog.cihar.com
Hi,
>From this comment:
https://github.com/phpmyadmin/phpmyadmin/commit/fb14e92d62a1d9990bfd4d77970…
I find I save a bookmark which label named
"<script>alert("XSS");</script>", it runs while I click SQL tab.
Is it safe enough? Should we add htmlspecialchars() to INSERT query
included functions(e.g. PMA_Bookmark_save)?
--
Edward Cheng
Hi,
Just out of curiosity,
What I am trying to ask here is that suppose someone makes a non sensible
translation of a message in some language then who reviews it for its
accuracy?
What are the chances that such translations would go unnoticed?
--
Regards,
Chirayu Chiripal
phpMyAdmin Intern - Google Summer of Code 2014
https://chirayuchiripal.wordpress.com/
Hi all,
As a means of improving the usability of the designer, I'm trying to
implement a method to use "designer", without explicitly configuring all
the designer related tables, as my next task. For this I'm using the
browser local storage technology. After going through all available client
side storage mechanisms, I came across with two possible mechanisms.
- Web Sql database
- Indexed database
Although the "Web Sql" provides "SQL" functionalities, I's deprecated now.
The Index database would be a ideal solution as it combines the strengths
of web storage and web sql. And also, the browser support is good.
So for this task I'll be using the indexed DB.
I'd like to get any feedback on this.
Thanks,
Bimal.
Hi,
Since the new error reporting at the PHP level, errors that were
"hidden" using the at sign (for example, @fopen) are now displayed, with
the possibility of sending a report.
Do we now have to handle the situation differently (with try/catch) to
avoid this error reporting? In the case I mention, there is no need to
show the error report, as the situation is already handled by checking
what fopen() returns.
--
Marc Delisle | phpMyAdmin
Hi All,
I wanted to have some starting pointer on how to set up the selenium sever
on my system (I use Ubuntu), start with writing the tests and how to run
those tests for phpMyAdmin system.
It would be great help if anyone can points me to right direction. I
browsed the web, but didn't find anything very helpful in starting from
scratch.
Thanks and Regards
- Smita Kumari