- Developers - lists.phpmyadmin.net

[Phpmyadmin-devel] Broken Jenkins build
by Rouslan Placella 09 Aug '11

09 Aug '11

I managed to break the Jenkins build :( This happened when I was fixing a bug where triggers cannot be associated with views, as reported by Madhura on the list. Well, I just added in some calls to PMA_table::isView() to fix the issue, but the PMA_table class calls PMA_DBI_get_tables_full() which is not defined in unit tests. I'm not sure how I can fix this. Any ideas? Thanks. Rouslan

1 1

[Phpmyadmin-devel] Triggers and Views
by Madhura Jayaratne 09 Aug '11

09 Aug '11

Hi Rouslan, Are triggers applicable to views? I had errors when I tried to create a trigger on a view. MySQL documentation says that you can not associate a trigger with a view [1]. So I suggest we hide the 'Triggers' tab while browsing a view. And also removing views from the 'Table' drop down in the 'Create Trigger' dialog. -- Thanks and Regards, Madhura Jayaratne [1] http://dev.mysql.com/doc/refman/5.0/en/create-trigger.html

2 1

Re: [Phpmyadmin-devel] qTip usage for more reusable code
by Aris Feryanto 09 Aug '11

09 Aug '11

Hi Tyron, On 20 Jul 2011, at 17:12, Tyron Madlener <tyronx(a)gmail.com> wrote: > > I have a good idea in this regard. When we have all "Hint"-tooltips > centralized, we could easily add a config setting to disable all hint > tooltips. That might be very convenient for advanced users. > I agree with you. Advanced users may not want to see the hints everytime they use phpMyAdmin. I'll try to add this configuration after I finish the grid editing feature. P.S. I think you accidentally press Reply instead of Reply All in your gmail, so your message only delivered to me, instead to the list. -- Aris Feryanto

2 4

[Phpmyadmin-devel] Limits imposed by Suhosin
by Madhura Jayaratne 08 Aug '11

08 Aug '11

Hi all, While attending to a bug [1], I came across the following. Suhosin imposes a limit of 512 on the length of the variable that can be passed via a GET [2]. This is often problematic as in PMA we encounter long parameters (long sql queries, where clauses when no unique key is there etc). Due to the same problem [3] $cfg['LinkLengthLimit'] configuration was lowered to more stricter 1000 from 2000, which is more acceptable. In this particular bug the problem is that, though the URL length is under 1000, one parameter, 'sql_query', violates the Suhosin limit. What should be our stand on this. Should we adhere to Suhosin default values? In 3.5 we have a possible solution for this [4] and we can still lower $cfg['LinkLengthLimit'] value without losing the look and feel. However this needs to have JS enabled and I'm not sure whether we want to impose that condition for the 3.4 series. -- Thanks and Regards, Madhura Jayaratne [1] https://sourceforge.net/tracker/?func=detail&atid=377408&aid=3380946&group_… [2] http://www.hardened-php.net/suhosin/configuration.html#suhosin.get.max_valu… [3] https://sourceforge.net/tracker/?func=detail&aid=3358750&group_id=23067&ati… [4] https://sourceforge.net/mailarchive/message.php?msg_id=27839987

3 12

[Phpmyadmin-devel] Proposed changes to demo server and GSOC guidelines
by Piotr Przybylski 08 Aug '11

08 Aug '11

Hi, I would like to propose some changes to demo server configuration which would testing of edge cases a bit easier. Lately I've seen a few bugs related to data escaping which would manifest only in some edge cases and two issues with AJAX that could be discovered earlier if demo server's configuration would be changed a bit. Some of them were really old, some relatively new. 1. Data escaping. Everyone seems to remember about PMA_backquote() and escaping database data, but htmlspecialchars() for database and column names is sometimes missing, as well as PMA_escapeJsString(). With database `evil*/>` and table `evil'"*/>`(`so_<a'm>*/_i`, `quo"te`, `comm<!-- ent`, `plain`) I immediately broke some functionality (currently I can't recall what it was exactly), and I suppose we can have a few more such cases. 2. `server` variable. Demo server and possibly all student's servers run MySQL database as server 0, so that all cases of missing variable go unnoticed. For me fun started with server 1, when phpMyAdmin randomly warned about me missing variables due to changed security token. After some digging I discovered that this happened due to missing/broken 'server' argument in AJAX query, which caused PMA to regenerate this token and rendered some links with the old one unusable. So, I propose to: 1. Exchange MariaDB and MySQL databases in config file. 2. Change automatic login to select MySQL database which now has index 1. 3. Create some sample database with tables and columns which are potentially dangerous. Also, create a guidelines for future GSOC with a sample configuration consisting of two servers (the first one can be a broken fake, student should work with the second one) and a SQL script which creates tables from point 3. above, with some explanation on escaping and that MySQL identifiers can also contain dangerous data (not a security issue, but it do can break page layout). -- Regards, Piotr Przybylski

2 1

Re: [Phpmyadmin-devel] file_echo.php
by Michal Čihař 08 Aug '11

08 Aug '11

Hi ...resending to the list... Dne Thu, 4 Aug 2011 21:13:16 +0300 Tyron Madlener <tyronx(a)gmail.com> napsal(a): > On Thu, Aug 4, 2011 at 8:51 PM, Michal Čihař <michal(a)cihar.com> wrote: > > This is just limiting access to file_echo.php to users who are allowed > > to use phpMyAdmin (and thus have login to MySQL). I see no reason > > having publicly available echo service in phpMyAdmin. > > But don't you need valid mysql credentials to get a session (and token) anyway? Yes, though the token might be valid longer than MySQL credentials, so it's better to check both. > Since the file uploading is handled by the browser, I cannot think of > a case where you can upload a file unintentionally, or in any way get > it uploaded through other means than manually uploading it yourself. > I'd be really curious to know how a hacker can do anything malicious > in this direction. You can easily place form on other page and redirect it to this file. This is data you receive from outside, you should never trust it. > > If you don't need any HTML code inside, htmlspecialchars will help > > here. Also if you set content type to JSON, browser will not process it > > as HTML. > > Ah yes, great solution :) > It just didn't into my mind to actually change the http header, even > though its so obvious. > I'll change that today. Okay, please base changes on current master, I've made numerous changes to that file. -- Michal Čihař | http://cihar.com | http://blog.cihar.com

2 4

[Phpmyadmin-devel] New navigation frame resize handler
by Rouslan Placella 08 Aug '11

08 Aug '11

Hi there, I rewrote the navigation frame resize handler and I'm looking for some feedback and opinions. The new handler keeps navigation frame width synchronised and there is an option to collapse the frame. I made a video [1] that showcases the functionality and there are a few words about it in my blog [2] and of course, it can be seen ion action on my demo site [3]. Rouslan [1]: http://www.youtube.com/watch?v=o-MFX3i3tQ0 [2]: http://roccivic.blogspot.com/2011/07/report-for-week-10.html [3]: http://demo.phpmyadmin.net/gsoc-rouslan/

4 14

Re: [Phpmyadmin-devel] AJAXify phpMyAdmin Interface - GSOC 2011 - Table->Operations -> truncate table
by Thilanka Kaushalya 08 Aug '11

08 Aug '11

Hi Marc, > 3. In "*Delete data or table*" section currently there is a > > "*("#truncate_tbl_anchor").live('click'')*" action in functions.js > > file. In there after using the $.get() function, the two frames > > are reloaded. We can modify this action to stay at the same page > > after "*Truncate the table*". We cannot apply ajax to "*Delete the > > table(Drop)*" option because anyhow we have to quit the "*Table > > options*" after deleting the table. > > Agreed. > > I changed the logic in "#truncate_tbl_anchor" as it handles the ajax submission and pushed the changes to the repo. Can you please check that. Thank you. Regards, Thilanka. -- L G Thilanka Kaushalya Computer Science & Engineering, University of Moratuwa, Sri Lanka Connect with me at, Gmail : lgtkaushalya(a)gmail.com Twitter : @thilanka_k Facebook : Thilanka Kaushalya Yahoo : lgtkaushalya(a)yahoo.com Blog : http://coders-view.blogspot.com/

2 1

Re: [Phpmyadmin-devel] Grid editing
by Aris Feryanto 08 Aug '11

08 Aug '11

On 5 Agu 2011, at 10:04, Aris Feryanto <aris_feryanto(a)yahoo.com> wrote: >> From: Marc Delisle <marc(a)infomarc.info> > >> Aris Feryanto a écrit : >>>> From: Marc Delisle <marc(a)infomarc.info> >>> >>>> Le 2011-07-31 13:15, Aris Feryanto a écrit : >>>> >>>>>>>> 3. I hope that we'll get the OK from other >> developers to >>>> remove >>>>>>>> the row inline edit feature, because with the current >> code, >>>>>>>> >>>>>>>> 3.1 we have two features to do almost the same thing >> 3.2 >>>>>>>> currently, clicking on inline edit then on a cell >> activates the >>>>>>>> grid editing! >>>>>>> I hope so. Any objections? >>>> Still waiting for input from other developers... >>> >>> It seems there is no objection about this. Instead, positive feedback from >> other phpMyAdmin developers. >> >> Yes. Can you remove the row inline edit feature from your tree? > > Sure. I will work on this. Removed in my git. > >> >>> >>>>>>>> 4. With this feature, we have the same problems as >> with inline >>>>>>>> edit, such as: >>>>>>>> >>>>>>>> 4.2 (major) For tables with a unique key, if this key >> is >>>>>>>> edited, the Edit, Copy and Delete links no longer >> contain a >>>>>>>> valid where_clause parameter and the multi-rows >> actions at the >>>>>>>> bottom (with selected) no longer work. >>>>>>>> >>>>>>>> 4.3 (major) For tables without a unique key, if any >> column is >>>>>>>> edited, the Edit, Copy and Delete links no longer >> contain a >>>>>>>> valid where_clause parameter and the multi-rows >> actions at the >>>>>>>> bottom (with selected) no longer work. >>>>>>> >>>>>>> Two problems above were fixed. >>>>>> It's a good progress but the fix is not complete. >>>>>> >>>>>> About remark 4.2, the Delete link still refers to the old >> unique >>>>>> key. >>>>> It's weird, since this works in my test. Could you please >> check this >>>>> again? >>>> The real problem is that the confirmation message shown before deletion >>>> still contains the old key. Deletion itself works but I had stopped to >>>> test after seeing the wrong confirmation message. >>> >>> Fixed >> >> Confirmed. >> >>> >>>>>> About remark 4.3, the Edit link still points to the old data >> and >>>>>> fails, in the case of a table lacking a unique key. >>>>>> >>>>> Same as the response for 4.2, this works on my test. Could you >> check >>>>> this again? >>>> I confirm the problem, on a copy of the sakila.actor table where I have >>>> removed all indexes. I think it's because the last_update column (a >>>> timestamp) was updated via grid-editing but the URL still contains the >>>> previous value. >>> >>> Fixed. >> >> Problem 4.3 exists in your current tree. Tested with the Edit link on >> the sakila.actor table by changing the actor_id. > After some searching, problem 4.3 seems cannot be fixed, since any fields in where_clause can be modified when we execute an UPDATE statement (e.g., by Triggers, field with option "ON UPDATE CURRENT_TIMESTAMP"). IMO, the choices to solve this are: - to alert user when grid editing a nonunique row (telling that some features related to the edited table may not work after editing), or - disable the grid editing feature at all for nonunique rows What would be the best choice? > >> >>> >>>> 5. Just found out another problem, when the configuration AjaxEnable is >>>> set to false. >>>> >>>> Trying your version with latest commit >>>> 0d197603085c43cac543351795b3df6de4167b96 with Firefox 5 on >> sakila.actor, >>>> I cannot change the actor_id then click "Save edited data". >> Look what >>>> is >>>> generated: >>>> >>>> UPDATE `sakila`.`actor` SET = '4002' WHERE `actor2`.`actor_id` >> =2 >>>> >>> >>> >>> Regarding the AjaxEnable setting, should the grid editing works when >> AjaxEnable is set to off? >> >> No. > > I will work on this. > Fixed. -- Aris Feryanto

2 1

[Phpmyadmin-devel] Help Serieous help
by Washington Guerrier 08 Aug '11

08 Aug '11

My name : Washington Website http://www.goosefinder.com/blog I updated from softaculous to wordpress 3.2.1 since then my website do not want to upload now it's showing Internal Server Error can some help me do a databasebackup

2 2