- Developers - lists.phpmyadmin.net

[Phpmyadmin-devel] phpMyAdmin 2.11.9.2 is released
by Marc Delisle 22 Sep '08

22 Sep '08

Welcome to this second security update for phpMyAdmin 2.11.9. Download from http://phpmyadmin.net; details will follow on our website in the Security section. Marc Delisle, for the team

1 0

[Phpmyadmin-devel] phpMyAdmin 3.0.0-rc2 is released
by Marc Delisle 15 Sep '08

15 Sep '08

Welcome to the second release candidate for phpMyAdmin 3.0.0. The reason for this candidate is mainly a security fix (see http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7) Marc Delisle, for the team

1 0

Re: [Phpmyadmin-devel] Setup script translation
by Michal Čihař 15 Sep '08

15 Sep '08

Hi Dne Mon, 15 Sep 2008 18:59:24 +0200 Crack <piotrprz(a)gmail.com> napsal(a): > 2008/9/4 Michal Čihař <michal(a)cihar.com>: > > Dne Thu, 04 Sep 2008 11:03:09 -0400 > > Marc Delisle <Marc.Delisle(a)cegepsherbrooke.qc.ca> napsal(a): > > > >> I don't believe the cost is significant; besides, the same question > >> could be asked about any page we load (when you are on the Search page > >> you only need those messages) because some are less frequently used that > >> others. > >> > >> It's also easier to manipulate just one file, for our translators. > > > > I'm also for merging, but the strings should be somehow separated, to > > allow identification by translators which ones are needed only for > > setup script. > > > > Then should I prefix all setup script strings with eg. "Setup_" > ($strSetup_stringName)? I think there should be some prefix, so that translators can easily distinguish comments only used in setup. Comments anyone? -- Michal Čihař | http://cihar.com | http://blog.cihar.com

2 1

[Phpmyadmin-devel] phpMyAdmin 2.11.9.1 is released
by Marc Delisle 15 Sep '08

15 Sep '08

Welcome to this security update for phpMyAdmin 2.11.9. Details will follow on http://phpmyadmin.net. Marc Delisle, for the team

1 0

[Phpmyadmin-devel] phpMyAdmin 3.0.0-rc1 is released
by Marc Delisle 07 Sep '08

07 Sep '08

Welcome to the first release candidate for phpMyAdmin 3.0.0. This version supports various features of MySQL 5.1 and the Maria and PBXT storage engines. The 3.0 series requires PHP 5.2+ and MySQL 5.0+. The release notes and download info are available on http://phpmyadmin.net. Marc Delisle, for the team

1 0

Re: [Phpmyadmin-devel] [Phpmyadmin-svn] SF.net SVN: phpmyadmin:[11562] trunk/phpMyAdmin
by Michal Čihař 07 Sep '08

07 Sep '08

Hi Just few comments to recent changes to Swekey. Dne Sat, 06 Sep 2008 12:41:35 +0000 lem9(a)users.sourceforge.net napsal(a): > Revision: 11562 > http://phpmyadmin.svn.sourceforge.net/phpmyadmin/?rev=11562&view=rev > Author: lem9 > Date: 2008-09-06 12:41:34 +0000 (Sat, 06 Sep 2008) > > Log Message: > ----------- > latest Swekey fixes >  > @@ -268,7 +243,7 @@ > <?php } ?> > <div class="item"> > <label for="input_username"><?php echo $GLOBALS['strLogUsername']; ?></label> > - <input type="text" name="pma_username" id="input_username" value="<?php echo htmlspecialchars($default_user); ?>" size="24" class="textfield" <?php echo $user_input_disabled; ?>/> > + <input type="text" name="pma_username" id="input_username" value="" size="24" class="textfield"/> What is reason for dropping default_user here? It is used for user name recall from cookie. > + Swekey_SetUnplugUrl(key, "pma_login", url + "/libraries/auth/swekey/unplugged.php?session_to_unset=<?php echo session_id();?>"); This still won't work, if user has disable access to libraries, what is what we suggest. > + function open_swekey_site() > + { > + window.open("http://www.swekey.com?promo=pma"); > + } Didn't we agree not to put any direct links to their website? > + var input_username = document.getElementById("<?php echo $input_name; ?>"); > + var input_go = document.getElementById("<?php echo $input_go; ?>"); > + var swekey_status = document.createElement('img'); > + swekey_status.setAttribute('onClick', 'open_swekey_site()'); > + swekey_status.setAttribute('style', 'width:8px; height:16px; border:0px; vspace:0px; hspace:0px; frameborder:no'); > + if (user == null) > + { > + swekey_status.setAttribute('src', 'http://artwork.swekey.com/unplugged-8x16.png'); > + //swekey_status.setAttribute('title', 'No swekey plugged'); > + input_go.disabled = true; > + } > + else > + { > + swekey_status.setAttribute('src', 'http://artwork.swekey.com/plugged-8x16.png'); Do we have to use external images? > @@ -4,6 +4,9 @@ > * Version 1.0 > * > * History: > + * 1.2 Use curl (widely installed) to query the server > + * Fixed a possible tempfile race attack > + * Random token cache can now be disabled Documentation should mention curl requirement. > * 1.1 Added Swekey_HttpGet function that support faulty servers > * Support for custom servers > * 1.0 First release > @@ -54,6 +57,12 @@ > if (! isset($gSwekeyStatusServer)) > $gSwekeyStatusServer = 'http://auth-status.musbe.net'; Why is default still http? > -define ("SWEKEY_STATUS_STOLLEN",4); // The key was stolen (typo kept for backward comp) > -define ("SWEKEY_STATUS_STOLEN",4); // The key was stolen > +define ("SWEKEY_STATUS_STOLLEN",4); // The key was stollen > +define ("SWEKEY_STATUS_STOLEN",4); // The key was stollen Why introducing a typo and removing explanation comment? -- Michal Čihař | http://cihar.com | http://phpmyadmin.cz

3 2

[Phpmyadmin-devel] Setup script translation
by Michal Čihař 04 Sep '08

04 Sep '08

Hi all new setup script is translatable and brings tons of new strings to translate. They currently live in separate language file (as development was separate, it was only reasonable option), but I think we should merge it. Piotr do you have any objections? -- Michal Čihař | http://cihar.com | http://phpmyadmin.cz

4 5

[Phpmyadmin-devel] sf.net svn scheduled downtime
by Marc Delisle 03 Sep '08

03 Sep '08

"On 2008-09-04 at 04:00 UTC, Subversion service write operations will be offline for no more than 24 hours. During this time, Subversion write operations (such as commit) will fail with an error. Read operations (checkout, ViewVC, etc.) will succeed as normal. This downtime is being used to migrate data on to new storage hardware and conduct performance testing. We are taking this downtime approach (leaving service online, with write operations failing) to minimize the functional impact to users."

1 0

[Phpmyadmin-devel] Reason for $pma_server_changed
by Michal Čihař 03 Sep '08

03 Sep '08

Hi does anybody see reason for $pma_server_changed in libraries/auth/cookie.auth.lib.php? It seems to be only set and not used anywhere... -- Michal Čihař | http://cihar.com | http://phpmyadmin.cz

2 1

[Phpmyadmin-devel] Default configuration
by Michal Čihař 03 Sep '08

03 Sep '08

Hi all since ever, our default configuration is config which matches MySQL defaults. However we all know it is not really a good option from security point of view, because it might expose MySQL server from inexperienced user to public. I think it's time to change this. 1. Disallow logging in as root without password unless explicitly allowed in our config file. 2. Make cookie the default authentication method. 3. If no Blowfish secret is set, generate one on the fly and store it in the session - it should work for login, but it won't allow to recall username on next login, but if user wants this feature, he needs to set the secret in config. Opinions to make such change in trunk? -- Michal Čihař | http://cihar.com | http://phpmyadmin.cz

3 7