Developers

developers@phpmyadmin.net

7004 discussions

[Phpmyadmin-devel] still in Morocco
by Marc Delisle 03 May '06

03 May '06

Hi devs, I'm still in Morocco, with limited net access, but I'll be back on May 7 and I'll read my mail; meanwhile keep on the good work! Marc

1 0

[Phpmyadmin-devel] Don't use PHP 5.1.3
by Michal Čihař 03 May '06

03 May '06

Hi all PHP 5.1.3 seems to be hardly broken in handling POST and GET arrays and it kills many PHP apps including phpMyAdmin. See PHP bug #37276 [1] for details. 1. http://bugs.php.net/bug.php?id=37276 -- Michal Čihař | http://cihar.com | http://blog.cihar.com

1 0

[Phpmyadmin-devel] Doku/Developer Wiki
by Sebastian Mendel 03 May '06

03 May '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, some time ago we already discussed this wiki-thing, the result was that running a wiki on sf.net is not secure or there was no time to set it up? i could set up this wiki, whether on my own space, or somewhere on sf.net. (i have already set up and maintaining one wiki (phpbar.de)) ... i came across this again by the previous post of marc about sql query should always escaped (obviously that this is clear) there is no developer docu where this is written ... or? ... and some other things that are difficult to document in the source. - -- Sebastian Mendel www.sebastianmendel.de -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (MingW32) iD8DBQFER0CtX/0lClpZDr4RAsiNAJ9XxMl07THmcPAbuLRqUfcZgRZhuwCfd2ya I2iB2n7IE2cyIE6beSW7Nf0= =hwCv -----END PGP SIGNATURE-----

3 2

[Phpmyadmin-devel] Anonymous CVS out of sync
by Michal Čihař 03 May '06

03 May '06

Hi probably most of you noticed this, but just to make sure everybody knows it: Anonymous CVS is not being updated since CVS breakage at the end of March. This situation will stay at least till end of April, see sf.net status page [1] for details. This also means that snapshots and online demos are not on current versions, so do not tell users to test on those something you've recently fixed. 1. https://sourceforge.net/docs/A04/ -- Michal Čihař | http://cihar.com

2 2

[Phpmyadmin-devel] MySQL Forge
by Sebastian Mendel 01 May '06

01 May '06

http://forge.mysql.com/projects/view.php?id=3 -- Sebastian Mendel www.sebastianmendel.de

3 2

[Phpmyadmin-devel] why $*_font_family in lang files?
by Sebastian Mendel 27 Apr '06

27 Apr '06

Hi, what is/was the reason for putting this $*_font_family variables into the language files? is this still needed? shouldn't the browser has the right font to use for displaying the language requested by the user? (f.e. i use 'Arial Unicode MS', which works best with all languages) -- Sebastian Mendel www.sebastianmendel.de

2 4

[Phpmyadmin-devel] replacing 10px with 8pt in DarkBlue_Orange?
by Sebastian Mendel 27 Apr '06

27 Apr '06

Hi, is there a problem with replacing font-size 10px with f. e. 8pt in darkblue orange theme? i have absolutely no problem with leaving it at 10px! just a question! font size of 10 px gives me an absolute hight of X with about 1.3 mm and absolut height of x about 0.9mm - nearly unreadable! (my sytem is running at 144 DPI) font size 8 pt should appear with about the same size as 10px on 72 DPI displays (the default on most systems) and has the right size on any other dpi settings! -- Sebastian Mendel www.sebastianmendel.de

2 2

[Phpmyadmin-devel] Scientific Survey: Working Conditions in Open Source Projects
by Dirk Jendroska 24 Apr '06

24 Apr '06

We like to invite you to a survey about the working conditions in Free/Open-Source Software development. This survey is conducted by the Open-Source Research Group of the University of Würzburg (Germany). We will compare work design in open source and proprietary software development. Our findings should be used to adjust the working conditions of software development to the needs of the developers. The results will be published under the Creative Commons License. To start the survey, please follow the link: http://www.unipark.de/uc/open-source-task/ If you have any questions don't hesitate to contact us! Dirk Jendroska http://www.psychologie.uni-wuerzburg.de/ao/staff/jendroska.php?lang=en

1 0

[Phpmyadmin-devel] Re: phpMyAdmin 'sql_query' Cross-Site Scripting and SQL Code Execution
by Sebastian Mendel 20 Apr '06

20 Apr '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Michal ?iha? schrieb: > On Thu, 20 Apr 2006 14:50:55 +0200 > Michal ?iha? <michal(a)cihar.com> wrote: > >> Both is quite simple (see attached patch). Only problem is when to >> check whether token is correct. For now I added check to import.php and >> sql.php, are there any other dangerous places? > > Problematic places are many :-(. Eg. dropping users using URL: > > http://localhost/pma-2.8.0/server_privileges.php?selected_usr%5B%5D=aaa%1B%… > > It will be quite hard to spot all such places. Any better idea how to > protect against such XSS? token can be checked globaly in common.lib.php if token is wrong empty all $_REQUEST/GET/POST - -- Sebastian Mendel www.sebastianmendel.de -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (MingW32) iD8DBQFER5M9X/0lClpZDr4RAlQnAKCjjsLJgf1NVBSjgUF/kLCUEqh/WACgsdF6 r/rINW+W5Gu57iPUzqp9eUc= =O+JN -----END PGP SIGNATURE-----

1 0

[Phpmyadmin-devel] Re: phpMyAdmin 'sql_query' Cross-Site Scripting and SQL Code Execution
by Sebastian Mendel 20 Apr '06

20 Apr '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Garvin Hicking schrieb: > Hi! > >>> i don't know ... if this is really a security problem we should consider give >>> our forms a token - and proceed only with valid token >> IMHO SQL should be escaped (and I wonder it is not). > > Actually that's not a solution to the problem. PMA needs to be fed SQL commands, > and we need to accept the via POST. yes, but we should escape it before displaying in browser > The only way to not allow XSRF/CSRF is to put tokens into the form. BUT putting > token into the form means to things: > > 1. We need to utilize sessions. Only via sessions, form tokens could be easily > implemented, because a server-token needs to be compared with a client-token. sessions already utilized > 2. Implementing the tokens might be needed on virtually every <form> PMA has. > That'a a buttload full of work to do. ;) this can easily be implemented via PMA_generate_common_hidden_inputs(); also this token needs to be sent with get-requests/links - -- Sebastian Mendel www.sebastianmendel.de -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (MingW32) iD8DBQFER0dNX/0lClpZDr4RAmOiAJoD8jw4y+7/2/ieyeBkkx++iEB+NACfQxUL JN5eU9DXDHT79piRTZxem4c= =qRtC -----END PGP SIGNATURE-----

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

Developers