August 2010 - Git - lists.phpmyadmin.net

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_3_6-9332-gc5ab617
by Marc Delisle 30 Aug '10

30 Aug '10

The branch, master has been updated via c5ab6175cd6bb99c7960ab2785bb8c756b14124b (commit) from fe868a5bf286ffecf143e261b39203e58a6826c6 (commit) - Log ----------------------------------------------------------------- commit c5ab6175cd6bb99c7960ab2785bb8c756b14124b Author: Marc Delisle <marc(a)infomarc.info> Date: Mon Aug 30 13:28:51 2010 -0400 table name should be displayed on top ----------------------------------------------------------------------- Summary of changes: libraries/header.inc.php | 69 +++++++++++++++++++++++---------------------- 1 files changed, 35 insertions(+), 34 deletions(-) diff --git a/libraries/header.inc.php b/libraries/header.inc.php index 448f1c0..33531ea 100644 --- a/libraries/header.inc.php +++ b/libraries/header.inc.php @@ -127,51 +127,52 @@ if (!$GLOBALS['is_ajax_request']) { // if the table is being dropped, $_REQUEST['purge'] is set // (it always contains "1") // so do not display the table name in upper div - } elseif (strlen($GLOBALS['table']) && ! (isset($_REQUEST['purge']))) { - require_once './libraries/tbl_info.inc.php'; + if (strlen($GLOBALS['table']) && ! (isset($_REQUEST['purge']))) { + require_once './libraries/tbl_info.inc.php'; - echo $separator; - printf($item, + echo $separator; + printf($item, $GLOBALS['cfg']['DefaultTabTable'], PMA_generate_common_url($GLOBALS['db'], $GLOBALS['table']), str_replace(' ', ' ', htmlspecialchars($GLOBALS['table'])), (isset($GLOBALS['tbl_is_view']) && $GLOBALS['tbl_is_view'] ? __('View') : __('Table')), (isset($GLOBALS['tbl_is_view']) && $GLOBALS['tbl_is_view'] ? 'b_views' : 's_tbl') . '.png'); - /** - * Displays table comment - * @uses $show_comment from libraries/tbl_info.inc.php - * @uses $GLOBALS['avoid_show_comment'] from tbl_relation.php - */ - if (!empty($show_comment) && !isset($GLOBALS['avoid_show_comment'])) { - if (strstr($show_comment, '; InnoDB free')) { - $show_comment = preg_replace('@; InnoDB free:.*?$@', '', $show_comment); - } - echo '<span class="table_comment" id="span_table_comment">' - .'"' . htmlspecialchars($show_comment) - .'"</span>' . "\n"; - } // end if - } else { - // no table selected, display database comment if present - /** - * Settings for relations stuff - */ - require_once './libraries/relation.lib.php'; - $cfgRelation = PMA_getRelationsParam(); - - // Get additional information about tables for tooltip is done - // in libraries/db_info.inc.php only once - if ($cfgRelation['commwork']) { - $comment = PMA_getDbComment($GLOBALS['db']); /** * Displays table comment + * @uses $show_comment from libraries/tbl_info.inc.php + * @uses $GLOBALS['avoid_show_comment'] from tbl_relation.php */ - if (! empty($comment)) { - echo '<span class="table_comment"' - . ' id="span_table_comment">"' - . htmlspecialchars($comment) - . '"</span>' . "\n"; + if (!empty($show_comment) && !isset($GLOBALS['avoid_show_comment'])) { + if (strstr($show_comment, '; InnoDB free')) { + $show_comment = preg_replace('@; InnoDB free:.*?$@', '', $show_comment); + } + echo '<span class="table_comment" id="span_table_comment">' + .'"' . htmlspecialchars($show_comment) + .'"</span>' . "\n"; } // end if + } else { + // no table selected, display database comment if present + /** + * Settings for relations stuff + */ + require_once './libraries/relation.lib.php'; + $cfgRelation = PMA_getRelationsParam(); + + // Get additional information about tables for tooltip is done + // in libraries/db_info.inc.php only once + if ($cfgRelation['commwork']) { + $comment = PMA_getDbComment($GLOBALS['db']); + /** + * Displays table comment + */ + if (! empty($comment)) { + echo '<span class="table_comment"' + . ' id="span_table_comment">"' + . htmlspecialchars($comment) + . '"</span>' . "\n"; + } // end if + } } } } hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_3, updated. RELEASE_3_3_6-15-g1b812f2
by Marc Delisle 30 Aug '10

30 Aug '10

The branch, QA_3_3 has been updated via 1b812f2d25189b4903028d7f98793542559b1d14 (commit) from 73ce5705bd1e0b62060f75702d62f88247ce09dd (commit) - Log ----------------------------------------------------------------- commit 1b812f2d25189b4903028d7f98793542559b1d14 Author: Marc Delisle <marc(a)infomarc.info> Date: Mon Aug 30 12:54:12 2010 -0400 undefined variables after deleting a user ----------------------------------------------------------------------- Summary of changes: libraries/common.lib.php | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/libraries/common.lib.php b/libraries/common.lib.php index d5b38cc..610438c 100644 --- a/libraries/common.lib.php +++ b/libraries/common.lib.php @@ -1080,6 +1080,9 @@ function PMA_showMessage($message, $sql_query = null, $type = 'notice') // Basic url query part $url_params = array(); + if (! isset($GLOBALS['db'])) { + $GLOBALS['db'] = ''; + } if (strlen($GLOBALS['db'])) { $url_params['db'] = $GLOBALS['db']; if (strlen($GLOBALS['table'])) { hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin website branch, master, updated. bcbcfd5e66c112a8e8a48fc873a18c22864d5dc2
by Michal Čihař 30 Aug '10

30 Aug '10

The branch, master has been updated via bcbcfd5e66c112a8e8a48fc873a18c22864d5dc2 (commit) from 4879bee1c7309200dbccffcce54e540b1ecf5965 (commit) - Log ----------------------------------------------------------------- commit bcbcfd5e66c112a8e8a48fc873a18c22864d5dc2 Author: Michal Čihař <mcihar(a)novell.com> Date: Mon Aug 30 17:52:22 2010 +0200 Add PMASA-2010-6 for 3.3.6. ----------------------------------------------------------------------- Summary of changes: templates/security/PMASA-2010-6 | 53 +++++++++++++++++++++++++++++++++++++++ 1 files changed, 53 insertions(+), 0 deletions(-) create mode 100644 templates/security/PMASA-2010-6 diff --git a/templates/security/PMASA-2010-6 b/templates/security/PMASA-2010-6 new file mode 100644 index 0000000..235c977 --- /dev/null +++ b/templates/security/PMASA-2010-6 @@ -0,0 +1,53 @@ +<html xmlns:py="http://genshi.edgewall.org/" xmlns:xi="http://www.w3.org/2001/XInclude" py:strip=""> + +<py:def function="announcement_id"> +PMASA-2010-6 +</py:def> + +<py:def function="announcement_date"> +2010-08-30 +</py:def> + +<py:def function="announcement_summary"> +XSS attack using debugging messages. +</py:def> + +<py:def function="announcement_description"> +It was possible to conduct a XSS attack using error messages in PHP backtrace. +</py:def> + +<py:def function="announcement_mitigation"> +Additional steps from administrator are required to actually exploit this +issue (phpMyAdmin error reporting and collection needs to be enabled, what +is against recommendation for production setup). +</py:def> + +<py:def function="announcement_severity"> +We consider this vulnerability to be non critical. +</py:def> + +<py:def function="announcement_affected"> +For 3.x: versions before 3.3.6 are affected. +</py:def> + +<py:def function="announcement_unaffected"> +Branch 2.11.x is not affected by this. +</py:def> + +<py:def function="announcement_solution"> +Upgrade to phpMyAdmin 3.3.6 or newer or apply patch listed below. +</py:def> + +<py:def function="announcement_references"> +Thanks to Aung Khant from <a href="http://yehg.net">YGN Ethical Hacker Group, +Myanmar</a> for reporting this issue. +</py:def> + +<py:def function="announcement_cve">CVE-2010-3056</py:def> + +<py:def function="announcement_commits"> +133a77fac7d31a38703db2099a90c1b49de62e37 +</py:def> + +<xi:include href="_page.tpl" /> +</html> hooks/post-receive -- phpMyAdmin website

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_3_6-9325-gb58db4c
by Michal Čihař 30 Aug '10

30 Aug '10

The branch, master has been updated via b58db4c2e7da52e72baae907c180ed71200e1249 (commit) via 73ce5705bd1e0b62060f75702d62f88247ce09dd (commit) from 0bf02f05f14065bc4f67218f9c089099fad41cb1 (commit) - Log ----------------------------------------------------------------- commit b58db4c2e7da52e72baae907c180ed71200e1249 Merge: 0bf02f05f14065bc4f67218f9c089099fad41cb1 73ce5705bd1e0b62060f75702d62f88247ce09dd Author: Michal Čihař <mcihar(a)novell.com> Date: Mon Aug 30 17:30:47 2010 +0200 Merge branch 'QA_3_3' ----------------------------------------------------------------------- Summary of changes: ChangeLog | 1 + setup/frames/index.inc.php | 2 +- 2 files changed, 2 insertions(+), 1 deletions(-) diff --git a/ChangeLog b/ChangeLog index 23ee447..682a8d6 100644 --- a/ChangeLog +++ b/ChangeLog @@ -119,6 +119,7 @@ $Id$ a page size increase, thanks to Martin Schönberger - mad05 - bug #3054458 [core] Fixed displaying number of rows. - bug #3035300 [parser] Fixed wrong definition of keywords. +- [setup] Fixed escaping of server name. 3.3.6.0 (2010-08-28) - bug #3033063 [core] Navi gets wrong db name diff --git a/setup/frames/index.inc.php b/setup/frames/index.inc.php index 1b1285c..00723cd 100644 --- a/setup/frames/index.inc.php +++ b/setup/frames/index.inc.php @@ -117,7 +117,7 @@ display_form_top('index.php', 'get', array( <?php foreach ($cf->getServers() as $id => $server): ?> <tr> <td><?php echo $id ?></td> - <td><?php echo $cf->getServerName($id) ?></td> + <td><?php echo htmlspecialchars($cf->getServerName($id)) ?></td> <td><?php echo htmlspecialchars($cf->getValue("Servers/$id/auth_type")) ?></td> <td><?php echo htmlspecialchars($cf->getServerDSN($id)) ?></td> <td style="white-space: nowrap"> hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_3, updated. RELEASE_3_3_6-14-g73ce570
by Michal Čihař 30 Aug '10

30 Aug '10

The branch, QA_3_3 has been updated via 73ce5705bd1e0b62060f75702d62f88247ce09dd (commit) from 061b87f11f09633fbfe21d8c35f520ca9b80ff60 (commit) - Log ----------------------------------------------------------------- ----------------------------------------------------------------------- Summary of changes: ChangeLog | 1 + setup/frames/index.inc.php | 2 +- 2 files changed, 2 insertions(+), 1 deletions(-) diff --git a/ChangeLog b/ChangeLog index da27bea..076faab 100644 --- a/ChangeLog +++ b/ChangeLog @@ -10,6 +10,7 @@ $HeadURL: https://phpmyadmin.svn.sourceforge.net/svnroot/phpmyadmin/trunk/phpMyA a page size increase, thanks to Martin Schönberger - mad05 - bug #3054458 [core] Fixed displaying number of rows. - bug #3035300 [parser] Fixed wrong definition of keywords. +- [setup] Fixed escaping of server name. 3.3.6.0 (2010-08-28) - bug #3033063 [core] Navi gets wrong db name diff --git a/setup/frames/index.inc.php b/setup/frames/index.inc.php index 1c93aee..fb37b90 100644 --- a/setup/frames/index.inc.php +++ b/setup/frames/index.inc.php @@ -126,7 +126,7 @@ display_form_top('index.php', 'get', array( <?php foreach ($_SESSION['ConfigFile']['Servers'] as $id => $server): ?> <tr> <td><?php echo $id ?></td> - <td><?php echo $cf->getServerName($id) ?></td> + <td><?php echo htmlspecialchars($cf->getServerName($id)) ?></td> <td><?php echo htmlspecialchars($cf->getValue("Servers/$id/auth_type")) ?></td> <td><?php echo htmlspecialchars($cf->getServerDSN($id)) ?></td> <td style="white-space: nowrap"> hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_3_6-9323-g0bf02f0
by Michal Čihař 30 Aug '10

30 Aug '10

The branch, master has been updated via 0bf02f05f14065bc4f67218f9c089099fad41cb1 (commit) via 061b87f11f09633fbfe21d8c35f520ca9b80ff60 (commit) via ca18fad776bd845fff3db5d3381434a7384e24d5 (commit) from 4f487780a07d2a89e97bb3249fd4389c7362681a (commit) - Log ----------------------------------------------------------------- commit 0bf02f05f14065bc4f67218f9c089099fad41cb1 Merge: 4f487780a07d2a89e97bb3249fd4389c7362681a 061b87f11f09633fbfe21d8c35f520ca9b80ff60 Author: Michal Čihař <mcihar(a)novell.com> Date: Mon Aug 30 17:24:55 2010 +0200 Merge branch 'QA_3_3' Conflicts: libraries/sqlparser.data.php pdf_pages.php ----------------------------------------------------------------------- Summary of changes: ChangeLog | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/ChangeLog b/ChangeLog index bdbba03..23ee447 100644 --- a/ChangeLog +++ b/ChangeLog @@ -118,6 +118,7 @@ $Id$ - patch #3050492 [PDF scratchboard] Cannot drag table box to the edge after a page size increase, thanks to Martin Schönberger - mad05 - bug #3054458 [core] Fixed displaying number of rows. +- bug #3035300 [parser] Fixed wrong definition of keywords. 3.3.6.0 (2010-08-28) - bug #3033063 [core] Navi gets wrong db name hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_3, updated. RELEASE_3_3_6-13-g061b87f
by Michal Čihař 30 Aug '10

30 Aug '10

The branch, QA_3_3 has been updated via 061b87f11f09633fbfe21d8c35f520ca9b80ff60 (commit) from ca18fad776bd845fff3db5d3381434a7384e24d5 (commit) - Log ----------------------------------------------------------------- ----------------------------------------------------------------------- Summary of changes: ChangeLog | 1 + libraries/sqlparser.data.php | 5 ++--- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 83ee862..da27bea 100644 --- a/ChangeLog +++ b/ChangeLog @@ -9,6 +9,7 @@ $HeadURL: https://phpmyadmin.svn.sourceforge.net/svnroot/phpmyadmin/trunk/phpMyA - patch #3050492 [PDF scratchboard] Cannot drag table box to the edge after a page size increase, thanks to Martin Schönberger - mad05 - bug #3054458 [core] Fixed displaying number of rows. +- bug #3035300 [parser] Fixed wrong definition of keywords. 3.3.6.0 (2010-08-28) - bug #3033063 [core] Navi gets wrong db name diff --git a/libraries/sqlparser.data.php b/libraries/sqlparser.data.php index 41bf096..5fb1451 100644 --- a/libraries/sqlparser.data.php +++ b/libraries/sqlparser.data.php @@ -211,7 +211,6 @@ $PMA_SQPdata_function_name = array ( 'MOD', 'MONTH', 'MONTHNAME', - 'NOW', 'MPOINTFROMTEXT', // MPointFromText() 'MPOINTFROMWKB', // MPointFromWKB() 'MPOLYFROMTEXT', // MPolyFromText() @@ -339,7 +338,7 @@ $PMA_SQPdata_function_name = array ( * * @global integer MySQL attributes count */ -$PMA_SQPdata_function_name_cnt = 299; +$PMA_SQPdata_function_name_cnt = 298; /* * DEBUG @@ -1047,9 +1046,9 @@ $PMA_SQPdata_forbidden_word = array ( 'RAID_TYPE', 'RANGE', // 5.1 'READ', + 'READS', 'READ_ONLY', // 5.1 'READ_WRITE', // 5.1 - 'READS', 'REAL', 'RECOVER', 'REDUNDANT', hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_3_6-9320-g4f48778
by Michal Čihař 30 Aug '10

30 Aug '10

The branch, master has been updated via 4f487780a07d2a89e97bb3249fd4389c7362681a (commit) via 68e1ff379806ab49b17855a66a9086b8f5714d69 (commit) via 8ce53e5bc81a8b798db7b4701d7afdad88c1406f (commit) via c63d3dde811b9e0deaf7eb8599871e3d47b76126 (commit) from fefd6a7def3433b7b9c52b0016044726015d43eb (commit) - Log ----------------------------------------------------------------- commit 4f487780a07d2a89e97bb3249fd4389c7362681a Author: Michal Čihař <mcihar(a)novell.com> Date: Mon Aug 30 17:17:07 2010 +0200 bug #3042665 [parser] Add workaround for MySQL way of handling backtick. commit 68e1ff379806ab49b17855a66a9086b8f5714d69 Author: Michal Čihař <mcihar(a)novell.com> Date: Mon Aug 30 17:16:44 2010 +0200 Do not fail if parsing query has failed. commit 8ce53e5bc81a8b798db7b4701d7afdad88c1406f Author: Michal Čihař <mcihar(a)novell.com> Date: Mon Aug 30 17:03:55 2010 +0200 Not used anywhere. commit c63d3dde811b9e0deaf7eb8599871e3d47b76126 Author: Michal Čihař <mcihar(a)novell.com> Date: Mon Aug 30 16:59:53 2010 +0200 Add more testcases. ----------------------------------------------------------------------- Summary of changes: ChangeLog | 1 + libraries/import/sql.php | 14 +++++- libraries/sqlparser.lib.php | 39 +++++++++++++-- test/PMA_SQL_parser_test.php | 104 +++++++++++++++++++++++++++++++++++++---- 4 files changed, 140 insertions(+), 18 deletions(-) diff --git a/ChangeLog b/ChangeLog index 3613acb..bdbba03 100644 --- a/ChangeLog +++ b/ChangeLog @@ -112,6 +112,7 @@ $Id$ + [interface] Added charts to status tab, profiling page and query results + [interface] AJAXification on various pages - [core] Remove last remaining parts of profiling code which was removed in 2006. +- bug #3042665 [parser] Add workaround for MySQL way of handling backtick. 3.3.7.0 (not yet released) - patch #3050492 [PDF scratchboard] Cannot drag table box to the edge after diff --git a/libraries/import/sql.php b/libraries/import/sql.php index fe62ca5..0e61080 100644 --- a/libraries/import/sql.php +++ b/libraries/import/sql.php @@ -168,8 +168,20 @@ while (!($GLOBALS['finished'] && $i >= $len) && !$error && !$timeout_passed) { while (!$endq) { // Find next quote $pos = strpos($buffer, $quote, $i + 1); + /* + * Behave same as MySQL and accept end of query as end of backtick. + * I know this is sick, but MySQL behaves like this: + * + * SELECT * FROM `table + * + * is treated like + * + * SELECT * FROM `table` + */ + if ($pos === FALSE && $quote == '`' && $found_delimiter) { + $pos = $first_sql_delimiter - 1; // No quote? Too short string - if ($pos === FALSE) { + } elseif ($pos === FALSE) { // We hit end of string => unclosed quote, but we handle it as end of query if ($GLOBALS['finished']) { $endq = TRUE; diff --git a/libraries/sqlparser.lib.php b/libraries/sqlparser.lib.php index b8b2bba..7c8e8fa 100644 --- a/libraries/sqlparser.lib.php +++ b/libraries/sqlparser.lib.php @@ -211,7 +211,6 @@ if (! defined('PMA_MINIMUM_COMMON')) { */ function PMA_SQP_parse($sql) { - global $cfg; global $PMA_SQPdata_column_attrib, $PMA_SQPdata_reserved_word, $PMA_SQPdata_column_type, $PMA_SQPdata_function_name, $PMA_SQPdata_column_attrib_cnt, $PMA_SQPdata_reserved_word_cnt, $PMA_SQPdata_column_type_cnt, $PMA_SQPdata_function_name_cnt; global $mysql_charsets, $mysql_collations_flat, $mysql_charsets_count, $mysql_collations_count; @@ -342,10 +341,38 @@ if (! defined('PMA_MINIMUM_COMMON')) { $pos = $GLOBALS['PMA_strpos'](' ' . $sql, $quotetype, $oldpos + 1) - 1; // ($pos === FALSE) if ($pos < 0) { - $debugstr = __('Unclosed quote') . ' @ ' . $startquotepos. "\n" - . 'STR: ' . htmlspecialchars($quotetype); - PMA_SQP_throwError($debugstr, $sql); - return $sql_array; + if ($c == '`') { + /* + * Behave same as MySQL and accept end of query as end of backtick. + * I know this is sick, but MySQL behaves like this: + * + * SELECT * FROM `table + * + * is treated like + * + * SELECT * FROM `table` + */ + $pos_quote_separator = $GLOBALS['PMA_strpos'](' ' . $sql, $GLOBALS['sql_delimiter'], $oldpos + 1) - 1; + if ($pos_quote_separator < 0) { + $len += 1; + $sql .= '`'; + $sql_array['raw'] .= '`'; + $pos = $len; + } else { + $len += 1; + $sql = $GLOBALS['PMA_substr']($sql, 0, $pos_quote_separator) . '`' . $GLOBALS['PMA_substr']($sql, $pos_quote_separator); + $sql_array['raw'] = $sql; + $pos = $pos_quote_separator; + } + if (class_exists('PMA_Message')) { + PMA_Message::warning(__('Automatically appended backtick to the end of query!'))->display(); + } + } else { + $debugstr = __('Unclosed quote') . ' @ ' . $startquotepos. "\n" + . 'STR: ' . htmlspecialchars($quotetype); + PMA_SQP_throwError($debugstr, $sql); + return $sql_array; + } } // If the quote is the first character, it can't be @@ -806,7 +833,7 @@ if (! defined('PMA_MINIMUM_COMMON')) { */ function PMA_SQP_analyze($arr) { - if ($arr == array()) { + if ($arr == array() || !isset($arr['len'])) { return array(); } $result = array(); diff --git a/test/PMA_SQL_parser_test.php b/test/PMA_SQL_parser_test.php index 2774ba1..aa3299c 100644 --- a/test/PMA_SQL_parser_test.php +++ b/test/PMA_SQL_parser_test.php @@ -149,12 +149,13 @@ class PMA_SQL_parser_test extends PHPUnit_Framework_TestCase public function testParse_4() { $this->assertParser('SELECT * from `aaa;', array ( - 'raw' => 'SELECT * from `aaa;', + 'raw' => 'SELECT * from `aaa`;', 0 => array ( - 'type' => 'alpha', + 'type' => 'alpha_reservedWord', 'data' => 'SELECT', 'pos' => 6, + 'forbidden' => true, ), 1 => array ( @@ -164,18 +165,99 @@ class PMA_SQL_parser_test extends PHPUnit_Framework_TestCase ), 2 => array ( - 'type' => 'alpha', + 'type' => 'alpha_reservedWord', 'data' => 'from', 'pos' => 13, + 'forbidden' => true, ), - ), -'<p>There seems to be an error in your SQL query. The MySQL server error output below, if there is any, may also help you in diagnosing the problem</p> -<pre> -ERROR: Unclosed quote @ 14 -STR: ` -SQL: SELECT * from `aaa; -</pre> -'); + 3 => + array ( + 'type' => 'quote_backtick', + 'data' => '`aaa`', + 'pos' => 0, + ), + 4 => + array ( + 'type' => 'punct_queryend', + 'data' => ';', + 'pos' => 0, + ), + 'len' => 5, + )); + } + + public function testParse_5() + { + $this->assertParser('SELECT * FROM `a_table` tbla INNER JOIN b_table` tblb ON tblb.id = tbla.id WHERE tblb.field1 != tbla.field1`;', array ( + 'raw' => 'SELECT * FROM `a_table` tbla INNER JOIN b_table` tblb ON tblb.id = tbla.id WHERE tblb.field1 != tbla.field1`;', + 0 => + array ( + 'type' => 'alpha_reservedWord', + 'data' => 'SELECT', + 'pos' => 6, + 'forbidden' => true, + ), + 1 => + array ( + 'type' => 'punct', + 'data' => '*', + 'pos' => 0, + ), + 2 => + array ( + 'type' => 'alpha_reservedWord', + 'data' => 'FROM', + 'pos' => 13, + 'forbidden' => true, + ), + 3 => + array ( + 'type' => 'quote_backtick', + 'data' => '`a_table`', + 'pos' => 0, + ), + 4 => + array ( + 'type' => 'alpha_identifier', + 'data' => 'tbla', + 'pos' => 28, + 'forbidden' => false, + ), + 5 => + array ( + 'type' => 'alpha_reservedWord', + 'data' => 'INNER', + 'pos' => 34, + 'forbidden' => true, + ), + 6 => + array ( + 'type' => 'alpha_reservedWord', + 'data' => 'JOIN', + 'pos' => 39, + 'forbidden' => true, + ), + 7 => + array ( + 'type' => 'alpha_identifier', + 'data' => 'b_table', + 'pos' => 47, + 'forbidden' => false, + ), + 8 => + array ( + 'type' => 'quote_backtick', + 'data' => '` tblb ON tblb.id = tbla.id WHERE tblb.field1 != tbla.field1`', + 'pos' => 0, + ), + 9 => + array ( + 'type' => 'punct_queryend', + 'data' => ';', + 'pos' => 0, + ), + 'len' => 10, + )); } } ?> hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_3_6-9316-gfefd6a7
by Marc Delisle 30 Aug '10

30 Aug '10

The branch, master has been updated via fefd6a7def3433b7b9c52b0016044726015d43eb (commit) via b9609f086d55251482419fdfd22bd00915870bd4 (commit) from 1d67babd5286f9f5198b40ee3a4be21f9643ad8e (commit) - Log ----------------------------------------------------------------- commit fefd6a7def3433b7b9c52b0016044726015d43eb Merge: b9609f086d55251482419fdfd22bd00915870bd4 1d67babd5286f9f5198b40ee3a4be21f9643ad8e Author: Marc Delisle <marc(a)infomarc.info> Date: Mon Aug 30 10:18:12 2010 -0400 Merge branch 'master' of ssh://phpmyadmin.git.sourceforge.net/gitroot/phpmyadmin/phpmyadmin commit b9609f086d55251482419fdfd22bd00915870bd4 Author: Marc Delisle <marc(a)infomarc.info> Date: Mon Aug 30 10:18:02 2010 -0400 move outer variables inside function ----------------------------------------------------------------------- Summary of changes: libraries/schema/User_Schema.class.php | 12 ++++++------ 1 files changed, 6 insertions(+), 6 deletions(-) diff --git a/libraries/schema/User_Schema.class.php b/libraries/schema/User_Schema.class.php index 8636d02..54ef5d4 100644 --- a/libraries/schema/User_Schema.class.php +++ b/libraries/schema/User_Schema.class.php @@ -216,9 +216,6 @@ class PMA_User_Schema . ' AND pdf_page_number = \'' . PMA_sqlAddslashes($this->choosenPage) . '\''; $page_rs = PMA_query_as_controluser($page_query, FALSE, $query_default_option); $array_sh_page = array(); - $draginit = ''; - $reset_draginit = ''; - $i = 0; while ($temp_sh_page = @PMA_DBI_fetch_assoc($page_rs)) { $array_sh_page[] = $temp_sh_page; } @@ -229,7 +226,7 @@ class PMA_User_Schema if (!isset($_POST['with_field_names']) && !isset($_POST['showwysiwyg'])) { $with_field_names = TRUE; } - $this->_displayScratchboardTables($array_sh_page,$draginit,$reset_draginit); + $this->_displayScratchboardTables($array_sh_page); ?> <form method="post" action="schema_edit.php" name="edcoord"> @@ -464,7 +461,7 @@ class PMA_User_Schema * @return void * @access private */ - private function _displayScratchboardTables($array_sh_page,$draginit,$reset_draginit) + private function _displayScratchboardTables($array_sh_page) { global $with_field_names,$cfg,$db; ?> @@ -475,12 +472,15 @@ class PMA_User_Schema </form> <div id="pdflayout" class="pdflayout" style="visibility: hidden;"> <?php + $draginit = ''; + $draginit2 = ''; + $reset_draginit = ''; $i = 0; foreach ($array_sh_page as $key => $temp_sh_page) { $drag_x = $temp_sh_page['x']; $drag_y = $temp_sh_page['y']; - $draginit2 = ' Drag.init(getElement("table_' . $i . '"), null, 0, parseInt(myid.style.width)-2, 0, parseInt(myid.style.height)-5);' . "\n"; + $draginit2 .= ' Drag.init(getElement("table_' . $i . '"), null, 0, parseInt(myid.style.width)-2, 0, parseInt(myid.style.height)-5);' . "\n"; $draginit .= ' getElement("table_' . $i . '").onDrag = function (x, y) { document.edcoord.elements["c_table_' . $i . '[x]"].value = parseInt(x); document.edcoord.elements["c_table_' . $i . '[y]"].value = parseInt(y) }' . "\n"; $draginit .= ' getElement("table_' . $i . '").style.left = "' . $drag_x . 'px";' . "\n"; $draginit .= ' getElement("table_' . $i . '").style.top = "' . $drag_y . 'px";' . "\n"; hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_3_6-9314-g1d67bab
by Michal Čihař 30 Aug '10

30 Aug '10

The branch, master has been updated via 1d67babd5286f9f5198b40ee3a4be21f9643ad8e (commit) via 61fe92976f290467b10443f679d7ed882ebb5d5b (commit) via e781f7f9b96fa2ca8970cefba5d628eb7481692d (commit) via 4afbb5958819a61d52c45bd2f262f8720fa0bb87 (commit) via 24b83423cea3d00d6d0f2e8a6fb52b5cf47b82f6 (commit) via a6ba9845042698610bb7071b8d127b7fb37dfd74 (commit) from 388327d642714ff42e3dd7eb3cdc1c9b24efea2d (commit) - Log ----------------------------------------------------------------- commit 1d67babd5286f9f5198b40ee3a4be21f9643ad8e Author: Michal Čihař <mcihar(a)novell.com> Date: Mon Aug 30 16:11:46 2010 +0200 Do not fail on non analyzed query (eg. because of parser failure). commit 61fe92976f290467b10443f679d7ed882ebb5d5b Author: Michal Čihař <mcihar(a)novell.com> Date: Mon Aug 30 16:10:51 2010 +0200 This variable does not seem to be used. commit e781f7f9b96fa2ca8970cefba5d628eb7481692d Author: Michal Čihař <mcihar(a)novell.com> Date: Mon Aug 30 16:00:33 2010 +0200 Add testcase for failed parsing. commit 4afbb5958819a61d52c45bd2f262f8720fa0bb87 Author: Michal Čihař <mcihar(a)novell.com> Date: Mon Aug 30 15:55:52 2010 +0200 Add testcase for backticked table. commit 24b83423cea3d00d6d0f2e8a6fb52b5cf47b82f6 Author: Michal Čihař <mcihar(a)novell.com> Date: Mon Aug 30 15:54:30 2010 +0200 Add testcase for simple SELECT. commit a6ba9845042698610bb7071b8d127b7fb37dfd74 Author: Michal Čihař <mcihar(a)novell.com> Date: Mon Aug 30 15:53:00 2010 +0200 Start testcase for SQL parser. ----------------------------------------------------------------------- Summary of changes: libraries/common.lib.php | 7 +- libraries/display_tbl.lib.php | 10 +-- libraries/sqlparser.lib.php | 8 +- test/PMA_SQL_parser_test.php | 181 +++++++++++++++++++++++++++++++++++++++++ 4 files changed, 194 insertions(+), 12 deletions(-) create mode 100644 test/PMA_SQL_parser_test.php diff --git a/libraries/common.lib.php b/libraries/common.lib.php index 665298b..6f7064a 100644 --- a/libraries/common.lib.php +++ b/libraries/common.lib.php @@ -1039,6 +1039,9 @@ function PMA_showMessage($message, $sql_query = null, $type = 'notice', $is_view } else { // Parse SQL if needed $parsed_sql = PMA_SQP_parse($query_base); + if (PMA_SQP_isError()) { + unset($parsed_sql); + } } // Analyze it @@ -1242,8 +1245,8 @@ function PMA_showMessage($message, $sql_query = null, $type = 'notice', $is_view } echo '</div><br />' . "\n"; - // If we are in an Ajax request, we have most probably been called in - // PMA_ajaxResponse(). Hence, collect the buffer contents and return it + // If we are in an Ajax request, we have most probably been called in + // PMA_ajaxResponse(). Hence, collect the buffer contents and return it // to PMA_ajaxResponse(), which will encode it for JSON. if( $GLOBALS['is_ajax_request'] == true && !isset($GLOBALS['buffer_message']) ) { $buffer_contents = ob_get_contents(); diff --git a/libraries/display_tbl.lib.php b/libraries/display_tbl.lib.php index 16ac8c9..bb16bbf 100644 --- a/libraries/display_tbl.lib.php +++ b/libraries/display_tbl.lib.php @@ -717,10 +717,6 @@ function PMA_displayTableHeaders(&$is_display, &$fields_meta, $fields_cnt = 0, $ $GLOBALS['mime_map'] = PMA_getMIME($db, $table); } - if ($is_display['sort_lnk'] == '1') { - $select_expr = $analyzed_sql[0]['select_expr_clause']; - } - // See if we have to highlight any header fields of a WHERE query. // Uses SQL-Parser results. $highlight_columns = array(); @@ -1299,7 +1295,7 @@ function PMA_displayTableBody(&$dt_result, &$is_display, $map, $analyzed_sql) { // reset $class from $data_inline_edit_class to '' as we can't edit binary data $class = ''; - + if (stristr($field_flags, 'BINARY')) { if (!isset($row[$i]) || is_null($row[$i])) { $vertical_display['data'][$row_no][$i] = ' <td align="right"' . $mouse_events . ' class="' . $class . ($condition_field ? ' condition' : '') . '"><i>NULL</i></td>' . "\n"; @@ -2094,7 +2090,7 @@ function PMA_displayTable(&$dt_result, &$the_disp_mode, $analyzed_sql) 'submit_mult_change', __('Change'), 'b_edit.png'); PMA_buttonOrImage('submit_mult', 'mult_submit', 'submit_mult_delete', $delete_text, 'b_drop.png'); - if ($analyzed_sql[0]['querytype'] == 'SELECT') { + if (isset($analyzed_sql[0]) && $analyzed_sql[0]['querytype'] == 'SELECT') { PMA_buttonOrImage('submit_mult', 'mult_submit', 'submit_mult_export', __('Export'), 'b_tblexport.png'); @@ -2352,7 +2348,7 @@ function PMA_prepare_row_data($mouse_events, $class, $condition_field, $analyzed } // continue the <td> tag started before calling this function: - $result = $mouse_events . ' class="' . $class . ($condition_field ? ' condition' : '') . $nowrap + $result = $mouse_events . ' class="' . $class . ($condition_field ? ' condition' : '') . $nowrap . ' ' . ($is_field_truncated ? ' truncated' : '') . ($transform_function != $default_function ? ' transformed' : '') . (isset($map[$meta->name]) ? ' relation' : '') diff --git a/libraries/sqlparser.lib.php b/libraries/sqlparser.lib.php index d8967d9..b8b2bba 100644 --- a/libraries/sqlparser.lib.php +++ b/libraries/sqlparser.lib.php @@ -43,7 +43,9 @@ if (! defined('PMA_MINIMUM_COMMON')) { * Include data for the SQL Parser */ require_once './libraries/sqlparser.data.php'; - require_once './libraries/mysql_charsets.lib.php'; + if (!defined('TESTSUITE')) { + require_once './libraries/mysql_charsets.lib.php'; + } if (!isset($mysql_charsets)) { $mysql_charsets = array(); $mysql_charsets_count = 0; @@ -2091,8 +2093,8 @@ if (! defined('PMA_MINIMUM_COMMON')) { $docu = TRUE; break; } // end switch - // inner_sql is a span that exists for all cases - // of $cfg['SQP']['fmtType'] to make possible a replacement + // inner_sql is a span that exists for all cases + // of $cfg['SQP']['fmtType'] to make possible a replacement // for inline editing $str .= '<span class="inner_sql">'; $close_docu_link = false; diff --git a/test/PMA_SQL_parser_test.php b/test/PMA_SQL_parser_test.php new file mode 100644 index 0000000..2774ba1 --- /dev/null +++ b/test/PMA_SQL_parser_test.php @@ -0,0 +1,181 @@ +<?php +/* vim: set expandtab sw=4 ts=4 sts=4: */ +/** + * tests for correctness of SQL parser + * + * @package phpMyAdmin-test + */ + +/** + * Tests core. + */ +require_once 'PHPUnit/Framework.php'; + +define('PHPMYADMIN', 1); +define('TESTSUITE', 1); +$GLOBALS['charset'] = 'utf-8'; + +function __($s) { + return $s; +} + +/** + * Include to test. + */ +require_once './libraries/sqlparser.lib.php'; + +/** + * Test for SQL parser + * + * @package phpMyAdmin-test + */ +class PMA_SQL_parser_test extends PHPUnit_Framework_TestCase +{ + private function assertParser($sql, $expected, $error = '') + { + $parsed_sql = PMA_SQP_parse($sql); + $this->assertEquals(PMA_SQP_getErrorString(), $error); + $this->assertEquals($parsed_sql, $expected); + } + + public function testParse_1() + { + $this->assertParser('SELECT 1;', array ( + 'raw' => 'SELECT 1;', + 0 => + array ( + 'type' => 'alpha_reservedWord', + 'data' => 'SELECT', + 'pos' => 6, + 'forbidden' => true, + ), + 1 => + array ( + 'type' => 'digit_integer', + 'data' => '1', + 'pos' => 8, + ), + 2 => + array ( + 'type' => 'punct_queryend', + 'data' => ';', + 'pos' => 0, + ), + 'len' => 3, + )); + } + + public function testParse_2() + { + $this->assertParser('SELECT * from aaa;', array ( + 'raw' => 'SELECT * from aaa;', + 0 => + array ( + 'type' => 'alpha_reservedWord', + 'data' => 'SELECT', + 'pos' => 6, + 'forbidden' => true, + ), + 1 => + array ( + 'type' => 'punct', + 'data' => '*', + 'pos' => 0, + ), + 2 => + array ( + 'type' => 'alpha_reservedWord', + 'data' => 'from', + 'pos' => 13, + 'forbidden' => true, + ), + 3 => + array ( + 'type' => 'alpha_identifier', + 'data' => 'aaa', + 'pos' => 17, + 'forbidden' => false, + ), + 4 => + array ( + 'type' => 'punct_queryend', + 'data' => ';', + 'pos' => 0, + ), + 'len' => 5, + )); + } + + public function testParse_3() + { + $this->assertParser('SELECT * from `aaa`;', array ( + 'raw' => 'SELECT * from `aaa`;', + 0 => + array ( + 'type' => 'alpha_reservedWord', + 'data' => 'SELECT', + 'pos' => 6, + 'forbidden' => true, + ), + 1 => + array ( + 'type' => 'punct', + 'data' => '*', + 'pos' => 0, + ), + 2 => + array ( + 'type' => 'alpha_reservedWord', + 'data' => 'from', + 'pos' => 13, + 'forbidden' => true, + ), + 3 => + array ( + 'type' => 'quote_backtick', + 'data' => '`aaa`', + 'pos' => 0, + ), + 4 => + array ( + 'type' => 'punct_queryend', + 'data' => ';', + 'pos' => 0, + ), + 'len' => 5, + )); + } + + public function testParse_4() + { + $this->assertParser('SELECT * from `aaa;', array ( + 'raw' => 'SELECT * from `aaa;', + 0 => + array ( + 'type' => 'alpha', + 'data' => 'SELECT', + 'pos' => 6, + ), + 1 => + array ( + 'type' => 'punct', + 'data' => '*', + 'pos' => 0, + ), + 2 => + array ( + 'type' => 'alpha', + 'data' => 'from', + 'pos' => 13, + ), + ), +'<p>There seems to be an error in your SQL query. The MySQL server error output below, if there is any, may also help you in diagnosing the problem</p> +<pre> +ERROR: Unclosed quote @ 14 +STR: ` +SQL: SELECT * from `aaa; +</pre> +'); + } +} +?> hooks/post-receive -- phpMyAdmin

1 0