January 2011 - Git - lists.phpmyadmin.net

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_0BETA2-1487-g3c573fc
by Marc Delisle 29 Jan '11

29 Jan '11

The branch, master has been updated via 3c573fc82e35834646ed861bbc53f55d30db1b4e (commit) from 21fd381c84482d2792902034f3292d274e11383c (commit) - Log ----------------------------------------------------------------- commit 3c573fc82e35834646ed861bbc53f55d30db1b4e Author: Marc Delisle <marc(a)infomarc.info> Date: Sat Jan 29 10:32:56 2011 -0500 Conditional Ajax for other db operations ----------------------------------------------------------------------- Summary of changes: db_operations.php | 8 ++++++-- js/db_operations.js | 20 ++++++++++++++------ 2 files changed, 20 insertions(+), 8 deletions(-) diff --git a/db_operations.php b/db_operations.php index 6382fe9..9280467 100644 --- a/db_operations.php +++ b/db_operations.php @@ -458,7 +458,7 @@ echo __('Remove database'); * Copy database */ ?> - <form id="copy_db_form" method="post" action="db_operations.php" + <form id="copy_db_form" <?php echo ($GLOBALS['cfg']['AjaxEnable'] ? ' class="ajax" ' : ''); ?>method="post" action="db_operations.php" onsubmit="return emptyFormElements(this, 'newname')"> <?php if (isset($db_collation)) { @@ -528,7 +528,11 @@ echo __('Remove database'); /** * Change database charset */ - echo '<form id="change_db_charset_form" method="post" action="./db_operations.php">' . "\n" + echo '<form id="change_db_charset_form" '; + if ($GLOBALS['cfg']['AjaxEnable']) { + echo ' class="ajax" '; + } + echo 'method="post" action="./db_operations.php">' . PMA_generate_common_hidden_inputs($db, $table) . '<fieldset>' . "\n" . ' <legend>'; diff --git a/js/db_operations.js b/js/db_operations.js index 22511fb..915c537 100644 --- a/js/db_operations.js +++ b/js/db_operations.js @@ -30,7 +30,7 @@ $(document).ready(function() { $("#rename_db_form.ajax").live('submit', function(event) { event.preventDefault(); - $form = $(this); + var $form = $(this); var question = 'CREATE DATABASE ' + $('#new_db_name').val() + ' / DROP DATABASE ' + window.parent.db; @@ -86,12 +86,15 @@ $(document).ready(function() { * Ajax Event Handler for 'Copy Database' * * @uses PMA_ajaxShowMessage() + * @see $cfg['AjaxEnable'] */ - $("#copy_db_form").live('submit', function(event) { + $("#copy_db_form.ajax").live('submit', function(event) { event.preventDefault(); PMA_ajaxShowMessage(PMA_messages['strCopyingDatabase']); - $form = $(this); + + var $form = $(this); + if (! $form.find('input:hidden').is('#ajax_request_hidden')) { $form.append('<input type="hidden" id="ajax_request_hidden" name="ajax_request" value="true" />'); } @@ -123,15 +126,20 @@ $(document).ready(function() { * Ajax Event handler for 'Change Charset' of the database * * @uses PMA_ajaxShowMessage() + * @see $cfg['AjaxEnable'] */ - $("#change_db_charset_form").live('submit', function(event) { + $("#change_db_charset_form.ajax").live('submit', function(event) { event.preventDefault(); - $(this).append('<input type="hidden" name="ajax_request" value="true" />'); + var $form = $(this); + + if (! $form.find('input:hidden').is('#ajax_request_hidden')) { + $form.append('<input type="hidden" id="ajax_request_hidden" name="ajax_request" value="true" />'); + } PMA_ajaxShowMessage(PMA_messages['strChangingCharset']); - $.get($(this).attr('action'), $(this).serialize() + "&submitcollation=" + $(this).find("input[name=submitcollation]").attr('value'), function(data) { + $.get($form.attr('action'), $form.serialize() + "&submitcollation=" + $form.find("input[name=submitcollation]").attr('value'), function(data) { if(data.success == true) { PMA_ajaxShowMessage(data.message); } hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_0BETA2-1486-g21fd381
by Marc Delisle 29 Jan '11

29 Jan '11

The branch, master has been updated via 21fd381c84482d2792902034f3292d274e11383c (commit) from cc8e3849cf88f90218df6c5b6c42b1c4393d8ec3 (commit) - Log ----------------------------------------------------------------- commit 21fd381c84482d2792902034f3292d274e11383c Author: Marc Delisle <marc(a)infomarc.info> Date: Sat Jan 29 08:22:26 2011 -0500 Conditional Ajax on db rename Remove extra wrapping of jQuery object Avoid extra generation of hidden field Improve confirmation message on db rename ----------------------------------------------------------------------- Summary of changes: db_operations.php | 4 ++-- js/db_operations.js | 14 ++++++++++---- 2 files changed, 12 insertions(+), 6 deletions(-) diff --git a/db_operations.php b/db_operations.php index b4a4263..6382fe9 100644 --- a/db_operations.php +++ b/db_operations.php @@ -378,7 +378,7 @@ if (!$is_information_schema) { */ if ($db != 'mysql') { ?> - <form id="rename_db_form" method="post" action="db_operations.php" + <form id="rename_db_form" <?php echo ($GLOBALS['cfg']['AjaxEnable'] ? ' class="ajax" ' : ''); ?>method="post" action="db_operations.php" onsubmit="return emptyFormElements(this, 'newname')"> <?php if (isset($db_collation)) { @@ -399,7 +399,7 @@ if ($db != 'mysql') { echo __('Rename database to') . ':'; ?> </legend> - <input type="text" name="newname" size="30" class="textfield" value="" /> + <input id="new_db_name" type="text" name="newname" size="30" class="textfield" value="" /> <?php echo '(' . __('Command') . ': '; /** diff --git a/js/db_operations.js b/js/db_operations.js index 12b17c1..22511fb 100644 --- a/js/db_operations.js +++ b/js/db_operations.js @@ -25,12 +25,18 @@ $(document).ready(function() { * * @uses $.PMA_confirm() * @uses PMA_ajaxShowUser() + * @see $cfg['AjaxEnable'] */ - $("#rename_db_form").live('submit', function(event) { + $("#rename_db_form.ajax").live('submit', function(event) { event.preventDefault(); - var question = 'CREATE DATABASE ... and then DROP DATABASE ' + window.parent.db; - $(this).append('<input type="hidden" name="ajax_request" value="true" />'); + $form = $(this); + + var question = 'CREATE DATABASE ' + $('#new_db_name').val() + ' / DROP DATABASE ' + window.parent.db; + + if (! $form.find('input:hidden').is('#ajax_request_hidden')) { + $form.append('<input type="hidden" id="ajax_request_hidden" name="ajax_request" value="true" />'); + } /** * @var button_options Object containing options for jQueryUI dialog buttons @@ -43,7 +49,7 @@ $(document).ready(function() { }; button_options[PMA_messages['strNo']] = function() { $(this).dialog("close").remove(); } - $(this).PMA_confirm(question, $(this).attr('action'), function(url) { + $form.PMA_confirm(question, $form.attr('action'), function(url) { PMA_ajaxShowMessage(PMA_messages['strRenamingDatabases']); $.get(url, $("#rename_db_form").serialize() + '&is_js_confirmed=1', function(data) { hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_0BETA2-1485-gcc8e384
by Michal Čihař 28 Jan '11

28 Jan '11

The branch, master has been updated via cc8e3849cf88f90218df6c5b6c42b1c4393d8ec3 (commit) from 59f561b4502f59a6b3387992074c6db4b17f1c15 (commit) - Log ----------------------------------------------------------------- commit cc8e3849cf88f90218df6c5b6c42b1c4393d8ec3 Author: Michal Čihař <michal(a)cihar.com> Date: Fri Jan 28 23:12:18 2011 +0100 The decodeBB did not escape <>, keep this functionality. ----------------------------------------------------------------------- Summary of changes: libraries/Message.class.php | 2 +- libraries/sanitizing.lib.php | 7 ++++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/libraries/Message.class.php b/libraries/Message.class.php index 6a4df5b..a985393 100644 --- a/libraries/Message.class.php +++ b/libraries/Message.class.php @@ -654,7 +654,7 @@ class PMA_Message */ static public function decodeBB($message) { - return PMA_sanitize($message, false); + return PMA_sanitize($message, false, true); } /** diff --git a/libraries/sanitizing.lib.php b/libraries/sanitizing.lib.php index 606c730..adb8df2 100644 --- a/libraries/sanitizing.lib.php +++ b/libraries/sanitizing.lib.php @@ -27,11 +27,12 @@ * * @access public */ -function PMA_sanitize($message, $escape = false) +function PMA_sanitize($message, $escape = false, $safe = false) { + if (!$safe) { + $message = strtr($message, array('<' => '<', '>' => '>')); + } $replace_pairs = array( - '<' => '<', - '>' => '>', '[i]' => '<em>', // deprecated by em '[/i]' => '</em>', // deprecated by em '[em]' => '<em>', hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_0BETA2-1484-g59f561b
by Marc Delisle 28 Jan '11

28 Jan '11

The branch, master has been updated via 59f561b4502f59a6b3387992074c6db4b17f1c15 (commit) from e0c0d21380fab68bf71fbfbdbd060f6f2178c29d (commit) - Log ----------------------------------------------------------------- commit 59f561b4502f59a6b3387992074c6db4b17f1c15 Author: Marc Delisle <marc(a)infomarc.info> Date: Fri Jan 28 13:08:20 2011 -0500 To fix this jQuery 1.4.4 error: tds[0] is undefined jQuery.support.reliableHiddenOffsets = tds[0].offsetHeight === 0; I merged this commit that is planned to appear in jQuery 1.5: https://github.com/dmethvin/jquery/commit/ad0ebf00abca53caaaa46fb172024ba9b… ----------------------------------------------------------------------- Summary of changes: js/jquery/jquery-1.4.4.js | 14 ++++++++++---- 1 files changed, 10 insertions(+), 4 deletions(-) diff --git a/js/jquery/jquery-1.4.4.js b/js/jquery/jquery-1.4.4.js index a4f1145..a9f2ec7 100644 --- a/js/jquery/jquery-1.4.4.js +++ b/js/jquery/jquery-1.4.4.js @@ -1035,10 +1035,16 @@ return (window.jQuery = window.$ = jQuery); // Figure out if the W3C box model works as expected // document.body must exist before we can do this jQuery(function() { - var div = document.createElement("div"); - div.style.width = div.style.paddingLeft = "1px"; + var div = document.createElement("div"), + body = document.getElementsByTagName("body")[0]; - document.body.appendChild( div ); + // Frameset documents with no body should not run this code + if ( !body ) { + return; + } + + div.style.width = div.style.paddingLeft = "1px"; + body.appendChild( div ); jQuery.boxModel = jQuery.support.boxModel = div.offsetWidth === 2; if ( "zoom" in div.style ) { @@ -1077,7 +1083,7 @@ return (window.jQuery = window.$ = jQuery); jQuery.support.reliableHiddenOffsets = jQuery.support.reliableHiddenOffsets && tds[0].offsetHeight === 0; div.innerHTML = ""; - document.body.removeChild( div ).style.display = "none"; + body.removeChild( div ).style.display = "none"; div = tds = null; }); hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_0BETA2-1483-ge0c0d21
by Marc Delisle 28 Jan '11

28 Jan '11

The branch, master has been updated via e0c0d21380fab68bf71fbfbdbd060f6f2178c29d (commit) from 2f751fbf94824d5a90be16b94acf76378fddbcde (commit) - Log ----------------------------------------------------------------- commit e0c0d21380fab68bf71fbfbdbd060f6f2178c29d Author: Marc Delisle <marc(a)infomarc.info> Date: Fri Jan 28 12:47:19 2011 -0500 Conditional Ajax on SQL query form ----------------------------------------------------------------------- Summary of changes: js/sql.js | 3 ++- libraries/sql_query_form.lib.php | 6 +++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/js/sql.js b/js/sql.js index e83cee8..f4fe708 100644 --- a/js/sql.js +++ b/js/sql.js @@ -208,10 +208,11 @@ $(document).ready(function() { * Ajax Event handler for 'SQL Query Submit' * * @see PMA_ajaxShowMessage() + * @see $cfg['AjaxEnable'] * @memberOf jQuery * @name sqlqueryform_submit */ - $("#sqlqueryform").live('submit', function(event) { + $("#sqlqueryform.ajax").live('submit', function(event) { event.preventDefault(); // remove any div containing a previous error message $('.error').remove(); diff --git a/libraries/sql_query_form.lib.php b/libraries/sql_query_form.lib.php index 7dfe8c5..0435325 100644 --- a/libraries/sql_query_form.lib.php +++ b/libraries/sql_query_form.lib.php @@ -115,7 +115,11 @@ function PMA_sqlQueryForm($query = true, $display_tab = false, $delimiter = ';') return checkSqlQuery(this)"> <?php } else { - echo '<form method="post" action="import.php" ' . $enctype . ' id="sqlqueryform"' + echo '<form method="post" action="import.php" ' . $enctype; + if ($GLOBALS['cfg']['AjaxEnable']) { + echo ' class="ajax"'; + } + echo ' id="sqlqueryform"' .' onsubmit="return checkSqlQuery(this)" name="sqlform">' . "\n"; } hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_0BETA2-1482-g2f751fb
by Marc Delisle 28 Jan '11

28 Jan '11

The branch, master has been updated via 2f751fbf94824d5a90be16b94acf76378fddbcde (commit) from 67a8a06c1a165b2c68ef4555cf1ad8f71b9eb5e6 (commit) - Log ----------------------------------------------------------------- commit 2f751fbf94824d5a90be16b94acf76378fddbcde Author: Marc Delisle <marc(a)infomarc.info> Date: Fri Jan 28 12:30:47 2011 -0500 Document AjaxEnable directive ----------------------------------------------------------------------- Summary of changes: Documentation.html | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/Documentation.html b/Documentation.html index 85f3174..5ace8bc 100644 --- a/Documentation.html +++ b/Documentation.html @@ -1295,6 +1295,12 @@ CREATE DATABASE,ALTER DATABASE,DROP DATABASE</pre> <dd>The maximum number of database names to be displayed in the navigation frame and the database list.</dd> + <dt id="cfg_AjaxEnable">$cfg['AjaxEnable'] boolean</dt> + <dd>Defines whether to refresh only parts of certain pages using Ajax + techniques. Applies only where a non-Ajax behavior is possible; + for example, the Designer feature is Ajax-only so this directive + does not apply to it.</dd> + <dt id="cfg_MaxTableList">$cfg['MaxTableList'] integer</dt> <dd>The maximum number of table names to be displayed in the main panel's list (except on the Export page). This limit is also enforced in the navigation panel hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_0BETA2-1481-g67a8a06
by Michal Čihař 28 Jan '11

28 Jan '11

The branch, master has been updated via 67a8a06c1a165b2c68ef4555cf1ad8f71b9eb5e6 (commit) from 5ceb7bc817fdae92b7ba340bc217be3564ac5e3d (commit) - Log ----------------------------------------------------------------- commit 67a8a06c1a165b2c68ef4555cf1ad8f71b9eb5e6 Author: Michal Čihař <mcihar(a)novell.com> Date: Fri Jan 28 14:29:44 2011 +0100 [interface] Default to not count tables in database. This gives big performance penalty in case there is many databases and the number of tables is not that much useful to justify it. ----------------------------------------------------------------------- Summary of changes: ChangeLog | 1 + libraries/config.default.php | 8 ++++---- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/ChangeLog b/ChangeLog index e3add30..10d1b73 100644 --- a/ChangeLog +++ b/ChangeLog @@ -132,6 +132,7 @@ - rfe #3158867 [privileges] No DROP DATABASE warning if you delete a user - [interface] Add link to documentation for status variables. - [security] Redirect external links to avoid Referer leakage. +- [interface] Default to not count tables in database. 3.3.10.0 (not yet released) - patch #3147400 [structure] Aria table size printed as unknown, diff --git a/libraries/config.default.php b/libraries/config.default.php index a544caf..d7df77e 100644 --- a/libraries/config.default.php +++ b/libraries/config.default.php @@ -425,7 +425,7 @@ $cfg['Servers'][$i]['ShowDatabasesCommand'] = 'SHOW DATABASES'; * * @global array $cfg['Servers'][$i]['CountTables'] */ -$cfg['Servers'][$i]['CountTables'] = true; +$cfg['Servers'][$i]['CountTables'] = false; /** * Whether the tracking mechanism creates versions for tables and views automatically. @@ -488,7 +488,7 @@ $cfg['ServerDefault'] = 1; * Other core phpMyAdmin settings */ /** - * whether Ajax behavior is active + * whether Ajax behavior is active * * @global boolean $cfg['AjaxEnable'] */ @@ -1179,7 +1179,7 @@ $cfg['Export']['file_template_server'] = '@SERVER@'; $cfg['Export']['codegen_structure_or_data'] = 'data'; /** - * + * * * @global $cfg['Export']['codegen_format'] */ @@ -2179,7 +2179,7 @@ $cfg['TextareaCols'] = 40; $cfg['TextareaRows'] = 15; /** - * double size of textarea size for LONGTEXT columns + * double size of textarea size for LONGTEXT columns * * @global boolean $cfg['LongtextDoubleTextarea'] */ hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_0BETA2-1480-g5ceb7bc
by Michal Čihař 28 Jan '11

28 Jan '11

The branch, master has been updated via 5ceb7bc817fdae92b7ba340bc217be3564ac5e3d (commit) via dc0c6938b284489acc4b13f6a023c44828b9457c (commit) from 87b0c3074722f4e64c03343145c65a8256227623 (commit) - Log ----------------------------------------------------------------- commit 5ceb7bc817fdae92b7ba340bc217be3564ac5e3d Author: Michal Čihař <mcihar(a)novell.com> Date: Fri Jan 28 13:28:02 2011 +0100 Drop duplicate implementation of same thing. commit dc0c6938b284489acc4b13f6a023c44828b9457c Author: Michal Čihař <mcihar(a)novell.com> Date: Fri Jan 28 13:13:22 2011 +0100 [security] Redirect external links to avoid Referer leakage. ----------------------------------------------------------------------- Summary of changes: ChangeLog | 1 + libraries/Message.class.php | 55 +--------------------------- libraries/auth/cookie.auth.lib.php | 2 +- libraries/auth/swekey/swekey.auth.lib.php | 2 +- libraries/blobstreaming.lib.php | 12 +++--- libraries/common.inc.php | 4 ++- libraries/common.lib.php | 10 +++--- libraries/config/FormDisplay.class.php | 4 +- libraries/config/config_functions.lib.php | 8 +++- libraries/display_export.lib.php | 2 +- libraries/engines/pbms.lib.php | 6 ++-- libraries/engines/pbxt.lib.php | 6 ++-- libraries/sanitizing.lib.php | 6 +++- main.php | 8 ++-- themes.php | 2 +- url.php | 18 +++++++++ 16 files changed, 62 insertions(+), 84 deletions(-) create mode 100644 url.php diff --git a/ChangeLog b/ChangeLog index 45e274b..e3add30 100644 --- a/ChangeLog +++ b/ChangeLog @@ -131,6 +131,7 @@ - [export] Better handling of export to PHP array. - rfe #3158867 [privileges] No DROP DATABASE warning if you delete a user - [interface] Add link to documentation for status variables. +- [security] Redirect external links to avoid Referer leakage. 3.3.10.0 (not yet released) - patch #3147400 [structure] Aria table size printed as unknown, diff --git a/libraries/Message.class.php b/libraries/Message.class.php index 8783cdb..6a4df5b 100644 --- a/libraries/Message.class.php +++ b/libraries/Message.class.php @@ -647,65 +647,14 @@ class PMA_Message * for formatting * * @static - * @uses PREG_SET_ORDER - * @uses in_array() - * @uses preg_match_all() - * @uses preg_match() - * @uses preg_replace() - * @uses substr() - * @uses strtr() + * @uses PMA_sanitize * @param string $message the message * @return string the decoded message * @access public */ static public function decodeBB($message) { - $replace_pairs = array( - '[i]' => '<em>', // deprecated by em - '[/i]' => '</em>', // deprecated by em - '[em]' => '<em>', - '[/em]' => '</em>', - '[b]' => '<strong>', // deprecated by strong - '[/b]' => '</strong>', // deprecated by strong - '[strong]' => '<strong>', - '[/strong]' => '</strong>', - '[tt]' => '<code>', // deprecated by CODE or KBD - '[/tt]' => '</code>', // deprecated by CODE or KBD - '[code]' => '<code>', - '[/code]' => '</code>', - '[kbd]' => '<kbd>', - '[/kbd]' => '</kbd>', - '[br]' => '<br />', - '[/a]' => '</a>', - '[sup]' => '<sup>', - '[/sup]' => '</sup>', - ); - - $message = strtr($message, $replace_pairs); - - $pattern = '/\[a@([^"@]*)@([^]"]*)\]/'; - - if (preg_match_all($pattern, $message, $founds, PREG_SET_ORDER)) { - $valid_links = array( - 'http', // default http:// links (and https://) - './Do', // ./Documentation - ); - - foreach ($founds as $found) { - // only http... and ./Do... allowed - if (! in_array(substr($found[1], 0, 4), $valid_links)) { - return $message; - } - // a-z and _ allowed in target - if (! empty($found[2]) && preg_match('/[^a-z_]+/i', $found[2])) { - return $message; - } - } - - $message = preg_replace($pattern, '<a href="\1" target="\2">', $message); - } - - return $message; + return PMA_sanitize($message, false); } /** diff --git a/libraries/auth/cookie.auth.lib.php b/libraries/auth/cookie.auth.lib.php index 21ca47a..805f9b3 100644 --- a/libraries/auth/cookie.auth.lib.php +++ b/libraries/auth/cookie.auth.lib.php @@ -192,7 +192,7 @@ if (top != self) { ?> <div class="container"> -<a href="http://www.phpmyadmin.net" target="_blank" class="logo"><?php +<a href="./url.php?url=http://www.phpmyadmin.net" target="_blank" class="logo"><?php $logo_image = $GLOBALS['pmaThemeImage'] . 'logo_right.png'; if (@file_exists($logo_image)) { echo '<img src="' . $logo_image . '" id="imLogo" name="imLogo" alt="phpMyAdmin" border="0" />'; diff --git a/libraries/auth/swekey/swekey.auth.lib.php b/libraries/auth/swekey/swekey.auth.lib.php index bb4e2c5..19b9163 100644 --- a/libraries/auth/swekey/swekey.auth.lib.php +++ b/libraries/auth/swekey/swekey.auth.lib.php @@ -231,7 +231,7 @@ function Swekey_login($input_name, $input_go) ?> function open_swekey_site() { - window.open("http://phpmyadmin.net/auth_key"); + window.open("./url.php?url=http://phpmyadmin.net/auth_key"); } var input_username = document.getElementById("<?php echo $input_name; ?>"); diff --git a/libraries/blobstreaming.lib.php b/libraries/blobstreaming.lib.php index 594e5f1..070c8f3 100644 --- a/libraries/blobstreaming.lib.php +++ b/libraries/blobstreaming.lib.php @@ -31,7 +31,7 @@ function initPBMSDatabase() $query = "select * from $target.pbms_metadata_header"; // If it exists this table will not contain much } } - + $result = PMA_DBI_query($query ); if (! $result) { return FALSE; @@ -106,7 +106,7 @@ function checkBLOBStreamingPlugins() } unset($existing_plugins, $one_existing_plugin); } - + // set variable indicating BS plugin existence $PMA_Config->set('BLOBSTREAMING_PLUGINS_EXIST', $has_blobstreaming); @@ -296,7 +296,7 @@ function PMA_BS_IsPBMSReference($bs_reference, $db_name) if (PMA_do_connect($db_name, FALSE) == FALSE) { return FALSE; } - + $ok = pbms_is_blob_reference($bs_reference); return $ok ; } @@ -391,8 +391,8 @@ function PMA_BS_IsTablePBMSEnabled($db_name, $tbl_name, $tbl_type) } // This information should be cached rather than selecting it each time. - //$query = "SELECT count(*) FROM information_schema.TABLES T, pbms.pbms_enabled E where T.table_schema = ". PMA_backquote($db_name) . " and T.table_name = ". PMA_backquote($tbl_name) . " and T.engine = E.name"; - $query = "SELECT count(*) FROM pbms.pbms_enabled E where E.name = '" . PMA_sqlAddslashes($tbl_type) . "'"; + //$query = "SELECT count(*) FROM information_schema.TABLES T, pbms.pbms_enabled E where T.table_schema = ". PMA_backquote($db_name) . " and T.table_name = ". PMA_backquote($tbl_name) . " and T.engine = E.name"; + $query = "SELECT count(*) FROM pbms.pbms_enabled E where E.name = '" . PMA_sqlAddslashes($tbl_type) . "'"; $result = PMA_DBI_query($query); $data = PMA_DBI_fetch_row($result); @@ -497,7 +497,7 @@ function PMA_BS_getURL($reference) return FALSE; } - $bs_url = 'http://' . $bs_server . '/' . rtrim($reference); + $bs_url = './url.php?url=http://' . $bs_server . '/' . rtrim($reference); return $bs_url; } diff --git a/libraries/common.inc.php b/libraries/common.inc.php index d65c254..da66fda 100644 --- a/libraries/common.inc.php +++ b/libraries/common.inc.php @@ -476,7 +476,9 @@ if (! PMA_isValid($_REQUEST['token']) || $_SESSION[' PMA_token '] != $_REQUEST[' /* for playing blobstreamable media */ 'media_type', 'custom_type', 'bs_reference', /* for changing BLOB repository file MIME type */ - 'bs_db', 'bs_table', 'bs_ref', 'bs_new_mime_type' + 'bs_db', 'bs_table', 'bs_ref', 'bs_new_mime_type', + /* URL redirector */ + 'url' ); /** * Require cleanup functions diff --git a/libraries/common.lib.php b/libraries/common.lib.php index 711627f..cf9b7a5 100644 --- a/libraries/common.lib.php +++ b/libraries/common.lib.php @@ -419,13 +419,13 @@ function PMA_showMySQLDocu($chapter, $link, $big_icon = false, $anchor = '', $ju } if ($just_open) { - return '<a href="' . $url . '" target="mysql_doc">'; + return '<a href="./url.php?url=' . $url . '" target="mysql_doc">'; } elseif ($big_icon) { - return '<a href="' . $url . '" target="mysql_doc"><img class="icon" src="' . $GLOBALS['pmaThemeImage'] . 'b_sqlhelp.png" width="16" height="16" alt="' . __('Documentation') . '" title="' . __('Documentation') . '" /></a>'; + return '<a href="./url.php?url=' . $url . '" target="mysql_doc"><img class="icon" src="' . $GLOBALS['pmaThemeImage'] . 'b_sqlhelp.png" width="16" height="16" alt="' . __('Documentation') . '" title="' . __('Documentation') . '" /></a>'; } elseif ($GLOBALS['cfg']['ReplaceHelpImg']) { - return '<a href="' . $url . '" target="mysql_doc"><img class="icon" src="' . $GLOBALS['pmaThemeImage'] . 'b_help.png" width="11" height="11" alt="' . __('Documentation') . '" title="' . __('Documentation') . '" /></a>'; + return '<a href="./url.php?url=' . $url . '" target="mysql_doc"><img class="icon" src="' . $GLOBALS['pmaThemeImage'] . 'b_help.png" width="11" height="11" alt="' . __('Documentation') . '" title="' . __('Documentation') . '" /></a>'; } else { - return '[<a href="' . $url . '" target="mysql_doc">' . __('Documentation') . '</a>]'; + return '[<a href="./url.php?url=' . $url . '" target="mysql_doc">' . __('Documentation') . '</a>]'; } } // end of the 'PMA_showMySQLDocu()' function @@ -2425,7 +2425,7 @@ function PMA_getDbLink($database = null) function PMA_externalBug($functionality, $component, $minimum_version, $bugref) { if ($component == 'mysql' && PMA_MYSQL_INT_VERSION < $minimum_version) { - echo PMA_showHint(sprintf(__('The %s functionality is affected by a known bug, see %s'), $functionality, 'http://bugs.mysql.com/' . $bugref)); + echo PMA_showHint(sprintf(__('The %s functionality is affected by a known bug, see %s'), $functionality, './url.php?url=http://bugs.mysql.com/' . $bugref)); } } diff --git a/libraries/config/FormDisplay.class.php b/libraries/config/FormDisplay.class.php index e3b10dc..b07ac3a 100644 --- a/libraries/config/FormDisplay.class.php +++ b/libraries/config/FormDisplay.class.php @@ -681,7 +681,7 @@ class FormDisplay if ($test == 'Export') { $opt_name = substr($opt_name, 7); } - return 'http://wiki.phpmyadmin.net/pma/Config#' . $opt_name; + return './url.php?url=http://wiki.phpmyadmin.net/pma/Config#' . $opt_name; } /** @@ -774,4 +774,4 @@ class FormDisplay } } } -?> \ No newline at end of file +?> diff --git a/libraries/config/config_functions.lib.php b/libraries/config/config_functions.lib.php index 6f9aabb..0d26cb5 100644 --- a/libraries/config/config_functions.lib.php +++ b/libraries/config/config_functions.lib.php @@ -91,10 +91,14 @@ function PMA_lang_link_replace($link, $text) $separator = PMA_get_arg_separator('html'); } - if (!preg_match('#^http://#', $link)) { + if (!preg_match('#^https?://#', $link)) { $link = str_replace('&', $separator, $link); + } elseif (defined('PMA_SETUP')) { + $link = '../url.php?url=' . $link; + } else { + $link = './url.php?url=' . $link; } return '<a href="' . $link . '">' . $text . '</a>'; } -?> \ No newline at end of file +?> diff --git a/libraries/display_export.lib.php b/libraries/display_export.lib.php index 202cd4d..fc2065f 100644 --- a/libraries/display_export.lib.php +++ b/libraries/display_export.lib.php @@ -235,7 +235,7 @@ if(isset($_GET['sql_query'])) { } $message = new PMA_Message(__('This value is interpreted using %1$sstrftime%2$s, so you can use time formatting strings. Additionally the following transformations will happen: %3$s. Other text will be kept as is. See the %4$sFAQ%5$s for details.')); - $message->addParam('<a href="http://php.net/strftime" target="documentation" title="' + $message->addParam('<a href="./url.php?url=http://php.net/strftime" target="documentation" title="' . __('Documentation') . '">', false); $message->addParam('</a>', false); $message->addParam($trans); diff --git a/libraries/engines/pbms.lib.php b/libraries/engines/pbms.lib.php index 58e3159..4065bf3 100644 --- a/libraries/engines/pbms.lib.php +++ b/libraries/engines/pbms.lib.php @@ -91,15 +91,15 @@ class PMA_StorageEngine_pbms extends PMA_StorageEngine function getPageDocumentation() { $output = '<p> Documentation and further information about PBMS can be found on ' . "\n" - . '<a href="http://www.blobstreaming.org/" target="_blank">The PrimeBase Media Streaming home page</a>.<br><br>' . "\n" + . '<a href="./url.php?url=http://www.blobstreaming.org/" target="_blank">The PrimeBase Media Streaming home page</a>.<br><br>' . "\n" . '<table id="PBMS_Related_Links" >' . "\n" . '<tr>' . "\n" . '<td>' . "\n" . '<p>' . "\n" . '<strong><font size="2"><b>Related Links</b></font></strong>' . "\n" . '<br>' . "\n" - . '<a href="http://bpbdev.blogspot.com/" target="_blank">The PrimeBase Media Streaming Blog by Barry Leslie</a><br><br>' . "\n" - . '<a href="http://www.primebase.com/xt" target="_blank">PrimeBase XT Home Page</a><br><br>' . "\n" + . '<a href="./url.php?url=http://bpbdev.blogspot.com/" target="_blank">The PrimeBase Media Streaming Blog by Barry Leslie</a><br><br>' . "\n" + . '<a href="./url.php?url=http://www.primebase.com/xt" target="_blank">PrimeBase XT Home Page</a><br><br>' . "\n" . '</font>' . "\n" . '</td>' . "\n" . '</tr>' . "\n" diff --git a/libraries/engines/pbxt.lib.php b/libraries/engines/pbxt.lib.php index fbc6ce6..66da56a 100644 --- a/libraries/engines/pbxt.lib.php +++ b/libraries/engines/pbxt.lib.php @@ -122,15 +122,15 @@ class PMA_StorageEngine_pbxt extends PMA_StorageEngine function getPageDocumentation() { $output = '<p> Documentation and further information about PBXT can be found on the ' . "\n" - . '<a href="http://www.primebase.com/xt/" target="_blank">PrimeBase XT Home Page</a>.<br><br>' . "\n" + . '<a href="./url.php?url=http://www.primebase.com/xt/" target="_blank">PrimeBase XT Home Page</a>.<br><br>' . "\n" . '<table id="PBMS_Related_Links" >' . "\n" . '<tr>' . "\n" . '<td>' . "\n" . '<p>' . "\n" . '<strong><font size="2"><b>Related Links</b></font></strong>' . "\n" . '<br>' . "\n" - . '<a href="http://pbxt.blogspot.com/" target="_blank">The PrimeBase XT Blog by Paul McCullagh</a><br><br>' . "\n" - . '<a href="http://www.blobstreaming.org/" target="_blank">The PrimeBase Media Streaming (PBMS) home page</a>.<br><br>' . "\n" + . '<a href="./url.php?url=http://pbxt.blogspot.com/" target="_blank">The PrimeBase XT Blog by Paul McCullagh</a><br><br>' . "\n" + . '<a href="./url.php?url=http://www.blobstreaming.org/" target="_blank">The PrimeBase Media Streaming (PBMS) home page</a>.<br><br>' . "\n" . '</font>' . "\n" . '</td>' . "\n" . '</tr>' . "\n" diff --git a/libraries/sanitizing.lib.php b/libraries/sanitizing.lib.php index eb8696d..606c730 100644 --- a/libraries/sanitizing.lib.php +++ b/libraries/sanitizing.lib.php @@ -72,7 +72,11 @@ function PMA_sanitize($message, $escape = false) } } - $message = preg_replace($pattern, '<a href="\1" target="\2">', $message); + if (substr($found[1], 0, 4) == 'http') { + $message = preg_replace($pattern, '<a href="./url.php?url=\1" target="\2">', $message); + } else { + $message = preg_replace($pattern, '<a href="\1" target="\2">', $message); + } } if ($escape) { diff --git a/main.php b/main.php index 48e98fc..3d03234 100644 --- a/main.php +++ b/main.php @@ -210,16 +210,16 @@ echo '<h2>phpMyAdmin</h2>'; echo '<ul>'; PMA_printListItem(__('Version information') . ': ' . PMA_VERSION, 'li_pma_version'); PMA_printListItem(__('Documentation'), 'li_pma_docs', 'Documentation.html', null, '_blank'); -PMA_printListItem(__('Wiki'), 'li_pma_wiki', 'http://wiki.phpmyadmin.net', null, '_blank'); +PMA_printListItem(__('Wiki'), 'li_pma_wiki', './url.php?url=http://wiki.phpmyadmin.net', null, '_blank'); // does not work if no target specified, don't know why -PMA_printListItem(__('Official Homepage'), 'li_pma_homepage', 'http://www.phpMyAdmin.net/', null, '_blank'); +PMA_printListItem(__('Official Homepage'), 'li_pma_homepage', './url.php?url=http://www.phpMyAdmin.net/', null, '_blank'); ?> <li><bdo xml:lang="en" dir="ltr"> [<a href="changelog.php" target="_blank">ChangeLog</a>] - [<a href="http://phpmyadmin.git.sourceforge.net/git/gitweb-index.cgi" + [<a href="./url.php?url=http://phpmyadmin.git.sourceforge.net/git/gitweb-index.cgi" target="_blank">Git</a>] - [<a href="http://sourceforge.net/mail/?group_id=23067" + [<a href="./url.php?url=http://sourceforge.net/mail/?group_id=23067" target="_blank"><?php echo __('Mailing lists'); ?></a>] </bdo> </li> diff --git a/themes.php b/themes.php index e58933f..e4ad9f6 100644 --- a/themes.php +++ b/themes.php @@ -38,7 +38,7 @@ function takeThis(what){ <body id="bodythemes"> <h1>phpMyAdmin - <?php echo __('Theme / Style'); ?></h1> -<p><a href="http://www.phpmyadmin.net/home_page/themes.php#pma_<?php echo preg_replace('/([0-9]*)\.([0-9]*)\..*/', '\1_\2', PMA_VERSION); ?>"><?php echo __('Get more themes!'); ?></a></p> +<p><a href="./url.php?url=http://www.phpmyadmin.net/home_page/themes.php#pma_<?php echo preg_replace('/([0-9]*)\.([0-9]*)\..*/', '\1_\2', PMA_VERSION); ?>"><?php echo __('Get more themes!'); ?></a></p> <?php $_SESSION['PMA_Theme_Manager']->printPreviews(); ?> diff --git a/url.php b/url.php new file mode 100644 index 0000000..a9d0f58 --- /dev/null +++ b/url.php @@ -0,0 +1,18 @@ +<?php +/** + * URL redirector to avoid leaking Referer with some sensitive information. + */ + +/** + * Gets core libraries and defines some variables + */ +require_once './libraries/common.inc.php'; + +PMA_checkParameters(array('url')); + +if (! preg_match('/^https?:\/\/[^\n\r]*$/', $GLOBALS['url'])) { + header('Location: ' . $cfg['PmaAbsoluteUri']); +} else { + header('Location: ' . $GLOBALS['url']); +} +?> hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_0BETA2-1478-g87b0c30
by Michal Čihař 28 Jan '11

28 Jan '11

The branch, master has been updated via 87b0c3074722f4e64c03343145c65a8256227623 (commit) from bb874cabdee70fdf44ed0c757cf986c69f83b529 (commit) - Log ----------------------------------------------------------------- commit 87b0c3074722f4e64c03343145c65a8256227623 Author: Michal Čihař <mcihar(a)novell.com> Date: Fri Jan 28 11:06:44 2011 +0100 Better sort some status variables ----------------------------------------------------------------------- Summary of changes: server_status.php | 9 +++++++++ 1 files changed, 9 insertions(+), 0 deletions(-) diff --git a/server_status.php b/server_status.php index 55f72b3..ca81691 100644 --- a/server_status.php +++ b/server_status.php @@ -342,12 +342,16 @@ $allocations = array( 'Flush_commands' => 'query', 'Last_query_cost' => 'query', 'Slow_queries' => 'query', + 'Queries' => 'query', + 'Prepared_stmt_count' => 'query', 'Select_' => 'select', 'Sort_' => 'sort', 'Open_tables' => 'table', 'Opened_tables' => 'table', + 'Open_table_definitions' => 'table', + 'Opened_table_definitions' => 'table', 'Table_locks_' => 'table', 'Rpl_status' => 'repl', @@ -356,6 +360,10 @@ $allocations = array( 'Tc_' => 'tc', 'Ssl_' => 'ssl', + + 'Open_files' => 'files', + 'Open_streams' => 'files', + 'Opened_files' => 'files', ); $sections = array( @@ -376,6 +384,7 @@ $sections = array( 'sort' => array('title' => __('Sorting')), 'table' => array('title' => __('Tables')), 'tc' => array('title' => __('Transaction coordinator')), + 'files' => array('title' => __('Files')), 'ssl' => array('title' => 'SSL'), ); hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_0BETA2-1477-gbb874ca
by Michal Čihař 28 Jan '11

28 Jan '11

The branch, master has been updated via bb874cabdee70fdf44ed0c757cf986c69f83b529 (commit) via a6baca6d77bd67eb0f8fd7f355b112c9e11f350e (commit) via 1fc9371c6ca3551642b09d4ee2148df3fa89dc66 (commit) from 85ab22ddc0544c886fc33d1e291d3aa7a6e0edc8 (commit) - Log ----------------------------------------------------------------- commit bb874cabdee70fdf44ed0c757cf986c69f83b529 Author: Michal Čihař <mcihar(a)novell.com> Date: Fri Jan 28 10:54:04 2011 +0100 bug #3103658 Fix typo in generated code. commit a6baca6d77bd67eb0f8fd7f355b112c9e11f350e Author: Michal Čihař <mcihar(a)novell.com> Date: Fri Jan 28 10:52:04 2011 +0100 Remove stray </div> commit 1fc9371c6ca3551642b09d4ee2148df3fa89dc66 Author: Michal Čihař <mcihar(a)novell.com> Date: Fri Jan 28 10:49:20 2011 +0100 input element can not be under tr Confirmation for DROP index did not work. ----------------------------------------------------------------------- Summary of changes: js/functions.js | 2 +- js/tbl_structure.js | 2 +- libraries/Index.class.php | 7 +++---- libraries/display_import.lib.php | 1 - 4 files changed, 5 insertions(+), 7 deletions(-) diff --git a/js/functions.js b/js/functions.js index bf10aaa..a13758e 100644 --- a/js/functions.js +++ b/js/functions.js @@ -2022,7 +2022,7 @@ $(document).ready(function() { button_options[PMA_messages['strCancel']] = function() {$(this).dialog('close').remove();} $.get($(this).attr('href'), {'ajax_request': true}, function(data) { - $('<div id="change_password_dialog></div>') + $('<div id="change_password_dialog"></div>') .dialog({ title: PMA_messages['strChangePassword'], width: 600, diff --git a/js/tbl_structure.js b/js/tbl_structure.js index 6a7c773..2720b51 100644 --- a/js/tbl_structure.js +++ b/js/tbl_structure.js @@ -119,7 +119,7 @@ $(document).ready(function() { */ var curr_row = $(this).parents('tr'); - var question = $(curr_row).children('.drop_primary_key_index_msg').val(); + var question = $(curr_row).children('td').children('.drop_primary_key_index_msg').val(); $(this).PMA_confirm(question, $(this).attr('href'), function(url) { diff --git a/libraries/Index.class.php b/libraries/Index.class.php index 53ea62d..6fc0bec 100644 --- a/libraries/Index.class.php +++ b/libraries/Index.class.php @@ -476,8 +476,9 @@ class PMA_Index $js_msg = PMA_jsFormat('ALTER TABLE ' . $table . ' DROP INDEX ' . $index->getName()); } - $r .= '<td ' . $row_span . '>' - . ' <a '; + $r .= '<td ' . $row_span . '>'; + $r .= '<input type="hidden" class="drop_primary_key_index_msg" value="' . $js_msg . '" />'; + $r .= ' <a '; if ($GLOBALS['cfg']['AjaxEnable']) { $r .= 'class="drop_primary_key_index_anchor" '; } @@ -485,8 +486,6 @@ class PMA_Index . '" >' . PMA_getIcon('b_drop.png', __('Drop')) . '</a>' . '</td>' . "\n"; - - $r .= '<input type="hidden" class="drop_primary_key_index_msg" value="' . $js_msg . '" />'; } $r .= '<th ' . $row_span . '>' . htmlspecialchars($index->getName()) . '</th>'; diff --git a/libraries/display_import.lib.php b/libraries/display_import.lib.php index 76865f4..53a9351 100644 --- a/libraries/display_import.lib.php +++ b/libraries/display_import.lib.php @@ -267,4 +267,3 @@ if ($_SESSION[$SESSION_KEY]["handler"]!="noplugin") { <input type="submit" value="<?php echo __('Go'); ?>" id="buttonGo" /> </div> </form> -</div> hooks/post-receive -- phpMyAdmin

1 0