- Developers - lists.phpmyadmin.net

[Phpmyadmin-devel] Custom header and footers
by Michal Čihař 24 Nov '05

24 Nov '05

Hi all wouldn't be better to include custom headers and footers in themes and drop global ones? This feature was introduced as kind of customisation, however I feel it's better to place it into theme. Also see RFE# 984152 [1]. 1. https://sourceforge.net/tracker/index.php?func=detail&aid=984152&group_id=2… -- Michal Čihař | http://cihar.com

3 4

[Phpmyadmin-devel] 1350356 Show processes vs Processes
by Sebastian Mendel 24 Nov '05

24 Nov '05

should we add new strings or alter the old ones? -- Sebastian Mendel www.sebastianmendel.de www.sf.net/projects/phpdatetime | www.sf.net/projects/phptimesheet

3 6

[Phpmyadmin-devel] about "Duplicate current frameset"
by Marc Delisle 24 Nov '05

24 Nov '05

Hi, frankly I don't like this message. We could do better without using a technical term like "frameset". Some PMA users don't know what's a frameset, believe me. suggestions: "Duplicate this window" "New phpMyAdmin window" ... ? Marc

3 3

[Phpmyadmin-devel] undefined variables
by Marc Delisle 24 Nov '05

24 Nov '05

Hi, I just got a bunch of undefined: strProtocolVersion, strMySQLClientVersion, strUsedPhpExtension. Marc

2 5

[Phpmyadmin-devel] Yet another XSS?
by Michal Čihař 23 Nov '05

23 Nov '05

Hi all anyone working on this? http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=340438 -- Michal Čihař | http://cihar.com

3 5

[Phpmyadmin-devel] Security announcements
by Michal Čihař 23 Nov '05

23 Nov '05

Hi all another point on security: some of issues that has been fixed in "normal" release do not have security announcement, this should be also fixed. -- Michal Čihař | http://cihar.com

2 10

[Phpmyadmin-devel] Protect against attack on scripts in /libraries
by Michal Čihař 23 Nov '05

23 Nov '05

Hi all while speaking with friend about some recent security issues, we came to quite obvious idea, that access to /libraries folder should be disabled (by providing .htaccess file and suggesting same configuration in documentation) and all stuff that needs direct access should go out of this folder. Stuff that I quickly found that needs to be moved: - *.js - create /js folder for it? - libraries/transformations/overview.php - should be IMHO in root anyway Is there something else I missed? Any comments on implementing this in 2.7.0 branch? -- Michal Čihař | http://cihar.com

2 3

[Phpmyadmin-devel] strInvalidServerHostname
by Michal Čihař 23 Nov '05

23 Nov '05

Hi all and Sebastien there is missing message strInvalidServerHostname in current CVS that is used in common.lib... -- Michal Čihař | http://cihar.com

3 4

Re: [Phpmyadmin-devel] Re: [Phpmyadmin-cvs] CVS: phpMyAdmin/test theme.php,NONE,1.1
by Garvin Hicking 22 Nov '05

22 Nov '05

Hi! >> But then such a file should not be included in the release, or at least >> renamed to "test.php.txt" so that it can only be executed after being renamed? > > why? the lang scripts are not renamed too from .sh to .sh.txt ... and don't make > it too hard for theme developers - probably they are not techies .sh scripts cannot be executed through HTTP. .php Scripts can. >> Why did Michal then fix this a day ago? > > i don't know, i mean it is not wrong to escape this value, but it is not really > necessary, you can not reach the host you want if you add XSS code to the host > in the http header ... IMHO! That depends on the Apache setup. If you use HTTP 1.0 you can specify the Host: Header with any content you like. Plus you might be able to pass $HTTP_HOST as a register_global variable. Regards, Garvin -- ++ Garvin Hicking | Web-Entwickler [PHP] | www.garv.in | ICQ 21392242 ++ Developer of | www.phpMyAdmin.net | www.s9y.org ++ Make me happy | http://wishes.garv.in

3 5

[Phpmyadmin-devel] Re: [Phpmyadmin-cvs] CVS: phpMyAdmin/test theme.php,NONE,1.1
by Garvin Hicking 22 Nov '05

22 Nov '05

Hi Sebastian! I'm not up to date on recent code, but are these: > $lang_iso_code = $GLOBALS['available_languages'][$GLOBALS['lang']][2]; > > // start output > header('Content-Type: text/html; charset=' . $GLOBALS['charset']); > ?> > <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" > "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd"> > <html xmlns="http://www.w3.org/1999/xhtml" > xml:lang="<?php echo $lang_iso_code; ?>" > lang="<?php echo $lang_iso_code; ?>" dir="<?php echo $GLOBALS['text_dir']; ?>"> > <head> > <title>phpMyAdmin <?php echo PMA_VERSION; ?> - <?php echo $HTTP_HOST; ?> - Theme > Test</title> Checked against XSS attacks? At least I saw Michals commit about the $HTTP_HOST variable to be wrapped within htmlspecialchars() -- and does the 'charset' variable now get escaped for being passed to header()? I thought we would rather use a PMA_header() function or so? Best regards, Garvin -- Garvin Hicking | Web-Entwickler | Make me happy: www.supergarv.de | #ICQ 21392242 | http://wishes.garv.info/

3 5