July 2014 - Developers - lists.phpmyadmin.net

Re: [Phpmyadmin-devel] What are the chances that irrelevant translations would go unnoticed?
by Michal Čihař 02 Jul '14

02 Jul '14

Hi Dne Wed, 2 Jul 2014 16:02:23 +0530 Chirayu Chiripal <chirayu.chiripal(a)gmail.com> napsal(a): > I have seen few translations using html tags in them. I was shocked, that > why html tags are allowed in translations. > Isn't it possible that someone can insert tags like this <script src=" > http://www.some-phishing-site.com/simple.js"></script> with the translation > and can be used to attack users of particular language?? Technically it is possible, though markup changes is something I always check (Weblate has flag for this, so it's quite easy to review), so that will not get in. Indeed it would be better to use always just bbcode and pass all strings though PMA_sanitize(), but that means somebody would have to go through the code and fix the messages :-). PS: I hope you don't mind bringing this back to -devel list. -- Michal Čihař | http://cihar.com | http://blog.cihar.com

1 0

[Phpmyadmin-devel] XSS safe checks
by Edward Cheng 02 Jul '14

02 Jul '14

Hi, >From this comment: https://github.com/phpmyadmin/phpmyadmin/commit/fb14e92d62a1d9990bfd4d77970… I find I save a bookmark which label named "<script>alert("XSS");</script>", it runs while I click SQL tab. Is it safe enough? Should we add htmlspecialchars() to INSERT query included functions(e.g. PMA_Bookmark_save)? -- Edward Cheng

3 3

[Phpmyadmin-devel] What are the chances that irrelevant translations would go unnoticed?
by Chirayu Chiripal 02 Jul '14

02 Jul '14

Hi, Just out of curiosity, What I am trying to ask here is that suppose someone makes a non sensible translation of a message in some language then who reviews it for its accuracy? What are the chances that such translations would go unnoticed? -- Regards, Chirayu Chiripal phpMyAdmin Intern - Google Summer of Code 2014 https://chirayuchiripal.wordpress.com/

2 1

[Phpmyadmin-devel] Refactoring: Designer/schema integration
by Bimal Yashodha 01 Jul '14

01 Jul '14

Hi all, As a means of improving the usability of the designer, I'm trying to implement a method to use "designer", without explicitly configuring all the designer related tables, as my next task. For this I'm using the browser local storage technology. After going through all available client side storage mechanisms, I came across with two possible mechanisms. - Web Sql database - Indexed database Although the "Web Sql" provides "SQL" functionalities, I's deprecated now. The Index database would be a ideal solution as it combines the strengths of web storage and web sql. And also, the browser support is good. So for this task I'll be using the indexed DB. I'd like to get any feedback on this. Thanks, Bimal.

3 4

[Phpmyadmin-devel] about the new error reporting at PHP level
by Marc Delisle 01 Jul '14

01 Jul '14

Hi, Since the new error reporting at the PHP level, errors that were "hidden" using the at sign (for example, @fopen) are now displayed, with the possibility of sending a report. Do we now have to handle the situation differently (with try/catch) to avoid this error reporting? In the case I mention, there is no need to show the error report, as the situation is already handled by checking what fopen() returns. -- Marc Delisle | phpMyAdmin

2 1

[Phpmyadmin-devel] Selenium set up and writing tests
by Smita 01 Jul '14

01 Jul '14

Hi All, I wanted to have some starting pointer on how to set up the selenium sever on my system (I use Ubuntu), start with writing the tests and how to run those tests for phpMyAdmin system. It would be great help if anyone can points me to right direction. I browsed the web, but didn't find anything very helpful in starting from scratch. Thanks and Regards - Smita Kumari

2 2