October 2011 - Git - lists.phpmyadmin.net

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_4, updated. RELEASE_3_4_5-46-gf7a31e5
by Madhura Jayaratne 04 Oct '11

04 Oct '11

The branch, QA_3_4 has been updated via f7a31e5f4c71594a053c81ebac34d91ff930c51a (commit) from e2349585451ae8641f4f20ddc9c5bd1bc7ecee98 (commit) - Log ----------------------------------------------------------------- commit f7a31e5f4c71594a053c81ebac34d91ff930c51a Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: Wed Oct 5 00:34:56 2011 +0530 bug #3418610 [interface] Links in navigation when $cfg['MainPageIconic'] = false ----------------------------------------------------------------------- Summary of changes: ChangeLog | 1 + libraries/navigation_header.inc.php | 16 ++++++++++++++-- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index a285f45..edf76a7 100644 --- a/ChangeLog +++ b/ChangeLog @@ -2,6 +2,7 @@ phpMyAdmin - ChangeLog ====================== 3.4.7.0 (not yet released) +- bug #3418610 [interface] Links in navigation when $cfg['MainPageIconic'] = false 3.4.6.0 (not yet released) - patch #3404173 InnoDB comment display with tooltips/aliases diff --git a/libraries/navigation_header.inc.php b/libraries/navigation_header.inc.php index b549a02..a892c4f 100644 --- a/libraries/navigation_header.inc.php +++ b/libraries/navigation_header.inc.php @@ -97,15 +97,27 @@ if ($GLOBALS['cfg']['LeftDisplayLogo']) { if ($GLOBALS['cfg']['MainPageIconic']) { echo '<img class="icon" src="' . $pmaThemeImage . 'b_docs.png" width="16" height="16"' .' alt="' . __('phpMyAdmin documentation') . '" />'; + } else { + echo ' ' . __('phpMyAdmin documentation'); } echo '</a>'; - echo ' ' . PMA_showMySQLDocu('', '', TRUE) . "\n"; + + $documentation_link = PMA_showMySQLDocu('', '', true); + if ($GLOBALS['cfg']['MainPageIconic']) { + echo $documentation_link . "\n"; + } else { + preg_match('/<a[^>]*>/', $documentation_link, $matches); + $link = $matches[0]; + echo substr($link, 0, strlen($link) - 1) . ' title="' . __('Documentation') . '" >' + . ' ' . __('Documentation') . '</a>'; + } $params = array('uniqid' => uniqid()); if (!empty($GLOBALS['db'])) { $params['db'] = $GLOBALS['db']; } - echo '<a href="navigation.php?' . PMA_generate_common_url($params) . '" target="frame_navigation">'; + echo '<a href="navigation.php?' . PMA_generate_common_url($params) + . '" title="' . __('Reload navigation frame') . '" target="frame_navigation">'; if ($GLOBALS['cfg']['MainPageIconic']) { echo '<img class="icon" src="'. $GLOBALS['pmaThemeImage'] . 's_reload.png"' . ' title="' . __('Reload navigation frame') . '"' hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_5-20729-g3069013
by Rouslan Placella 04 Oct '11

04 Oct '11

The branch, master has been updated via 306901394e3e8960d3f212234ee99589a5311fed (commit) from 8adddca21f5fc04e8bfe37f513b87608abd7a0a7 (commit) - Log ----------------------------------------------------------------- commit 306901394e3e8960d3f212234ee99589a5311fed Author: Rouslan Placella <rouslan(a)placella.com> Date: Tue Oct 4 19:51:02 2011 +0100 Fixed usage of undefined function PMA_getImage() in setup script ----------------------------------------------------------------------- Summary of changes: libraries/config/FormDisplay.tpl.php | 52 +++++++++++++++++++++++++++------ 1 files changed, 42 insertions(+), 10 deletions(-) diff --git a/libraries/config/FormDisplay.tpl.php b/libraries/config/FormDisplay.tpl.php index a9e509a..58d6d3e 100644 --- a/libraries/config/FormDisplay.tpl.php +++ b/libraries/config/FormDisplay.tpl.php @@ -124,14 +124,46 @@ function display_fieldset_top($title = '', $description = '', $errors = null, $a function display_input($path, $name, $description = '', $type, $value, $value_is_default = true, $opts = null) { global $_FormDisplayGroup; - static $base_dir, $img_path; + static $base_dir; // Relative path to the root phpMyAdmin folder + static $icons; // An array of IMG tags used further below in the function $is_setup_script = defined('PMA_SETUP'); - if ($base_dir === null) { + if ($base_dir === null) { // if the static variables have not been initialised $base_dir = $is_setup_script ? '../' : ''; - $img_path = $is_setup_script - ? '../' . ltrim($GLOBALS['cfg']['ThemePath'], './') . '/original/img/' - : $_SESSION['PMA_Theme']->img_path; + $icons = array(); + // Icon definitions: + // The same indexes will be used in the $icons array. + // The first element contains the filename and the second + // element is used for the "alt" and "title" attributes. + $icon_init = array( + 'edit' => array('b_edit.png', ''), + 'help' => array('b_help.png', __('Documentation')), + 'info' => array('b_info.png', __('Wiki')), + 'reload' => array('s_reload.png', ''), + 'tblops' => array('b_tblops.png', '') + ); + if ($is_setup_script) { + // When called from the setup script, we don't have access to the + // sprite-aware PMA_getImage() function because the PMA_theme class + // has not been loaded, so we generate the img tags manually. + foreach ($icon_init as $k => $v) { + $title = ''; + if (! empty($v[1])) { + $title = ' title="' . $v[1] . '"'; + } + $icons[$k] = sprintf( + '<img alt="%s" src="%s"%s />', + $v[1], + ".{$GLOBALS['cfg']['ThemePath']}/original/img/{$v[0]}", + $title + ); + } + } else { + // In this case we just use PMA_getImage() because it's available + foreach ($icon_init as $k => $v) { + $icons[$k] = PMA_getImage($v[0], $v[1]); + } + } } $has_errors = isset($opts['errors']) && !empty($opts['errors']); $option_is_disabled = !$is_setup_script && isset($opts['userprefs_allow']) && !$opts['userprefs_allow']; @@ -159,8 +191,8 @@ function display_input($path, $name, $description = '', $type, $value, $value_is <label for="<?php echo htmlspecialchars($path) ?>"><?php echo $name ?></label> <?php if (!empty($opts['doc']) || !empty($opts['wiki'])) { ?> - <?php if (!empty($opts['doc'])) { ?><a href="<?php echo $base_dir . $opts['doc'] ?>" target="documentation"><?php echo PMA_getImage('b_help.png', __('Documentation')); ?></a><?php } ?> - <?php if (!empty($opts['wiki'])){ ?><a href="<?php echo $opts['wiki'] ?>" target="wiki"><?php echo PMA_getImage('b_info.png', __('Wiki')) ?></a><?php } ?> + <?php if (!empty($opts['doc'])) { ?><a href="<?php echo $base_dir . $opts['doc'] ?>" target="documentation"><?php echo $icons['help']; ?></a><?php } ?> + <?php if (!empty($opts['wiki'])){ ?><a href="<?php echo $opts['wiki'] ?>" target="wiki"><?php echo $icons['info']; ?></a><?php } ?> <?php } ?> <?php if ($option_is_disabled) { ?> @@ -234,17 +266,17 @@ function display_input($path, $name, $description = '', $type, $value, $value_is } if ($is_setup_script && isset($opts['userprefs_comment']) && $opts['userprefs_comment']) { ?> - <a class="userprefs-comment" title="<?php echo htmlspecialchars($opts['userprefs_comment']) ?>"><?php echo PMA_getImage('b_tblops.png', __('Comment')); ?></a> + <a class="userprefs-comment" title="<?php echo htmlspecialchars($opts['userprefs_comment']) ?>"><?php echo $icons['tblops']; ?></a> <?php } if (isset($opts['setvalue']) && $opts['setvalue']) { ?> - <a class="set-value" href="#<?php echo htmlspecialchars("$path={$opts['setvalue']}") ?>" title="<?php echo sprintf(__('Set value: %s'), htmlspecialchars($opts['setvalue'])) ?>" style="display:none"><?php echo PMA_getImage('b_edit.png'); ?></a> + <a class="set-value" href="#<?php echo htmlspecialchars("$path={$opts['setvalue']}") ?>" title="<?php echo sprintf(__('Set value: %s'), htmlspecialchars($opts['setvalue'])) ?>" style="display:none"><?php echo $icons['edit']; ?></a> <?php } if (isset($opts['show_restore_default']) && $opts['show_restore_default']) { ?> - <a class="restore-default" href="#<?php echo $path ?>" title="<?php echo __('Restore default value') ?>" style="display:none"><?php echo PMA_getImage('s_reload.png'); ?></a> + <a class="restore-default" href="#<?php echo $path ?>" title="<?php echo __('Restore default value') ?>" style="display:none"><?php echo $icons['reload']; ?></a> <?php } // this must match with displayErrors() in scripts/config.js hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_5-20728-g8adddca
by Dieter Adriaenssens 04 Oct '11

04 Oct '11

The branch, master has been updated via 8adddca21f5fc04e8bfe37f513b87608abd7a0a7 (commit) via e2349585451ae8641f4f20ddc9c5bd1bc7ecee98 (commit) via ca597dc423f3eebcca95ff33b088a03e39109115 (commit) from afd311a74c1a9a0cf0c2cbf75666b82398379dfc (commit) - Log ----------------------------------------------------------------- commit 8adddca21f5fc04e8bfe37f513b87608abd7a0a7 Merge: afd311a e234958 Author: Dieter Adriaenssens <ruleant(a)users.sourceforge.net> Date: Tue Oct 4 19:16:10 2011 +0200 Merge branch 'QA_3_4' ----------------------------------------------------------------------- Summary of changes: ChangeLog | 2 +- setup/frames/servers.inc.php | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 29e256c..8ced7db 100644 --- a/ChangeLog +++ b/ChangeLog @@ -72,7 +72,7 @@ phpMyAdmin - ChangeLog - patch #3314626 [display] CharTextareaRows is not respected - bug #3417089 [synchronize] Extraneous db choices - [security] Fixed local path disclosure vulnerability, see PMASA-2011-15 -- [security] Fixed XSS in setup (verbose parameter) +- [security] Fixed XSS in setup (host/verbose parameter), see PMASA-2011-16 3.4.5.0 (2011-09-14) - bug #3375325 [interface] Page list in navigation frame looks odd diff --git a/setup/frames/servers.inc.php b/setup/frames/servers.inc.php index 081c416..8d04966 100644 --- a/setup/frames/servers.inc.php +++ b/setup/frames/servers.inc.php @@ -26,7 +26,7 @@ $server_exists = !empty($id) && $cf->get("Servers/$id") !== null; if ($mode == 'edit' && $server_exists) { $page_title = __('Edit server') - . ' ' . $id . ' (' . $cf->getServerDSN($id) . ')'; + . ' ' . $id . ' (' . htmlspecialchars($cf->getServerDSN($id)) . ')'; } elseif ($mode == 'remove' && $server_exists) { $cf->removeServer($id); header('Location: index.php'); @@ -45,4 +45,4 @@ foreach ($forms['Servers'] as $form_name => $form) { $form_display->registerForm($form_name, $form, $id); } process_formset($form_display); -?> \ No newline at end of file +?> hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_4, updated. RELEASE_3_4_5-45-ge234958
by Dieter Adriaenssens 04 Oct '11

04 Oct '11

The branch, QA_3_4 has been updated via e2349585451ae8641f4f20ddc9c5bd1bc7ecee98 (commit) via ca597dc423f3eebcca95ff33b088a03e39109115 (commit) from bc5aa87ae9957a2c4740009c713bcbd54a31b93c (commit) - Log ----------------------------------------------------------------- ----------------------------------------------------------------------- Summary of changes: ChangeLog | 2 +- setup/frames/servers.inc.php | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 1f101fe..a285f45 100644 --- a/ChangeLog +++ b/ChangeLog @@ -23,7 +23,7 @@ phpMyAdmin - ChangeLog - patch #3314626 [display] CharTextareaRows is not respected - bug #3417089 [synchronize] Extraneous db choices - [security] Fixed local path disclosure vulnerability, see PMASA-2011-15 -- [security] Fixed XSS in setup (verbose parameter) +- [security] Fixed XSS in setup (host/verbose parameter), see PMASA-2011-16 3.4.5.0 (2011-09-14) - bug #3375325 [interface] Page list in navigation frame looks odd diff --git a/setup/frames/servers.inc.php b/setup/frames/servers.inc.php index 081c416..8d04966 100644 --- a/setup/frames/servers.inc.php +++ b/setup/frames/servers.inc.php @@ -26,7 +26,7 @@ $server_exists = !empty($id) && $cf->get("Servers/$id") !== null; if ($mode == 'edit' && $server_exists) { $page_title = __('Edit server') - . ' ' . $id . ' (' . $cf->getServerDSN($id) . ')'; + . ' ' . $id . ' (' . htmlspecialchars($cf->getServerDSN($id)) . ')'; } elseif ($mode == 'remove' && $server_exists) { $cf->removeServer($id); header('Location: index.php'); @@ -45,4 +45,4 @@ foreach ($forms['Servers'] as $form_name => $form) { $form_display->registerForm($form_name, $form, $id); } process_formset($form_display); -?> \ No newline at end of file +?> hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, MAINT_3_4_6, updated. RELEASE_3_4_5-40-gca597dc
by Dieter Adriaenssens 04 Oct '11

04 Oct '11

The branch, MAINT_3_4_6 has been updated via ca597dc423f3eebcca95ff33b088a03e39109115 (commit) from 1af420e22367ae72ff4091adb1620e59ddad5ba6 (commit) - Log ----------------------------------------------------------------- ----------------------------------------------------------------------- Summary of changes: ChangeLog | 2 +- setup/frames/servers.inc.php | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 020aef3..c9fc16d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -21,7 +21,7 @@ phpMyAdmin - ChangeLog - patch #3314626 [display] CharTextareaRows is not respected - bug #3417089 [synchronize] Extraneous db choices - [security] Fixed local path disclosure vulnerability, see PMASA-2011-15 -- [security] Fixed XSS in setup (verbose parameter) +- [security] Fixed XSS in setup (host/verbose parameter), see PMASA-2011-16 3.4.5.0 (2011-09-14) - bug #3375325 [interface] Page list in navigation frame looks odd diff --git a/setup/frames/servers.inc.php b/setup/frames/servers.inc.php index 081c416..8d04966 100644 --- a/setup/frames/servers.inc.php +++ b/setup/frames/servers.inc.php @@ -26,7 +26,7 @@ $server_exists = !empty($id) && $cf->get("Servers/$id") !== null; if ($mode == 'edit' && $server_exists) { $page_title = __('Edit server') - . ' ' . $id . ' (' . $cf->getServerDSN($id) . ')'; + . ' ' . $id . ' (' . htmlspecialchars($cf->getServerDSN($id)) . ')'; } elseif ($mode == 'remove' && $server_exists) { $cf->removeServer($id); header('Location: index.php'); @@ -45,4 +45,4 @@ foreach ($forms['Servers'] as $form_name => $form) { $form_display->registerForm($form_name, $form, $id); } process_formset($form_display); -?> \ No newline at end of file +?> hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_5-20725-gafd311a
by Michal Čihař 04 Oct '11

04 Oct '11

The branch, master has been updated via afd311a74c1a9a0cf0c2cbf75666b82398379dfc (commit) via 6bd5553b40d4c877e438842485640388881555d5 (commit) via 41018d1ba0904b001bbbbfa994861d9eb0886609 (commit) via 1a9d34c26fc1887f154544237d44ffe78dc7655a (commit) via 4866f0ced63398edfffe7a2e53b8a147c7972a17 (commit) from c25b7c896658bba418cc185ba2ff58a4c3bd0bc1 (commit) - Log ----------------------------------------------------------------- commit afd311a74c1a9a0cf0c2cbf75666b82398379dfc Merge: 6bd5553 c25b7c8 Author: Pootle server <pootle(a)cihar.com> Date: Tue Oct 4 12:40:18 2011 +0200 Merge remote-tracking branch 'origin/master' commit 6bd5553b40d4c877e438842485640388881555d5 Merge: 41018d1 f06ab07 Author: Pootle server <pootle(a)cihar.com> Date: Mon Oct 3 22:40:08 2011 +0200 Merge remote-tracking branch 'origin/master' commit 41018d1ba0904b001bbbbfa994861d9eb0886609 Merge: 1a9d34c 2ff7b4c Author: Pootle server <pootle(a)cihar.com> Date: Mon Oct 3 20:40:10 2011 +0200 Merge remote-tracking branch 'origin/master' commit 1a9d34c26fc1887f154544237d44ffe78dc7655a Author: Matías Bellone <matiasbellone(a)gmail.com> Date: Mon Oct 3 15:56:25 2011 +0200 Translation update done using Pootle. commit 4866f0ced63398edfffe7a2e53b8a147c7972a17 Author: Matías Bellone <matiasbellone(a)gmail.com> Date: Mon Oct 3 15:50:22 2011 +0200 Translation update done using Pootle. ----------------------------------------------------------------------- Summary of changes: po/es.po | 14 ++++++-------- 1 files changed, 6 insertions(+), 8 deletions(-) diff --git a/po/es.po b/po/es.po index f7fdf18..dcc9faa 100644 --- a/po/es.po +++ b/po/es.po @@ -4,7 +4,7 @@ msgstr "" "Project-Id-Version: phpMyAdmin 3.5.0-dev\n" "Report-Msgid-Bugs-To: phpmyadmin-devel(a)lists.sourceforge.net\n" "POT-Creation-Date: 2011-09-27 09:13+0200\n" -"PO-Revision-Date: 2011-09-21 15:24+0200\n" +"PO-Revision-Date: 2011-10-03 15:56+0200\n" "Last-Translator: Matías Bellone <matiasbellone(a)gmail.com>\n" "Language-Team: spanish <es(a)li.org>\n" "Language: es\n" @@ -12541,7 +12541,6 @@ msgid "There are lots of rows being sorted." msgstr "Hay demasiadas filas siendo ordenadas." #: po/advisory_rules.php:122 -#, fuzzy #| msgid "" #| "While there is nothing wrong with a high amount of row sorting, you might " #| "want to make sure that the queries which require a lot of sorting use " @@ -12553,9 +12552,9 @@ msgid "" "indexed columns in the ORDER BY clause, as this will result in much faster " "sorting" msgstr "" -"Si bien no hay nada de malo en ordenar una gran cantidad de filas, podría " -"llegar a desea asegurarse que las consultas que requieren gran cantidad de " -"ordenación utilicen campos indexados en la cláusula «ORDER BY», lo que " +"Si bien no hay nada de malo en ordenar una gran cantidad de filas, es " +"probable que desee asegurarse que las consultas que requieren gran cantidad " +"de ordenación utilicen campos indexados en la cláusula «ORDER BY», lo que " "resultará en una ordenación más rápida" #: po/advisory_rules.php:123 @@ -12572,7 +12571,6 @@ msgid "There are too many joins without indexes." msgstr "Hay demasiadas uniones («JOIN») sin índices." #: po/advisory_rules.php:127 -#, fuzzy #| msgid "" #| "This means that joins are doing full table scans. Adding indexes for the " #| "fields being used in the join conditions will greatly speed up table joins" @@ -12581,8 +12579,8 @@ msgid "" "columns being used in the join conditions will greatly speed up table joins" msgstr "" "Esto significa que las uniones («JOIN») están realizando escrutinios " -"completos sobre tablas. Agregar índices a los campos siendo utilizandos en " -"las condiciones de la unión las acelerarán en gran medida" +"completos sobre tablas. Agregar índices a los campos utilizados en las " +"condiciones de la unión las acelerarán en gran medida" #: po/advisory_rules.php:128 #, php-format hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_5-20720-gc25b7c8
by Marc Delisle 04 Oct '11

04 Oct '11

The branch, master has been updated via c25b7c896658bba418cc185ba2ff58a4c3bd0bc1 (commit) via bc5aa87ae9957a2c4740009c713bcbd54a31b93c (commit) via 1af420e22367ae72ff4091adb1620e59ddad5ba6 (commit) from 73913f135e51cbc3eba559ffd8af70a2938f0ac3 (commit) - Log ----------------------------------------------------------------- commit c25b7c896658bba418cc185ba2ff58a4c3bd0bc1 Merge: 73913f1 bc5aa87 Author: Marc Delisle <marc(a)infomarc.info> Date: Tue Oct 4 06:20:48 2011 -0400 Merge branch 'QA_3_4' ----------------------------------------------------------------------- Summary of changes: ChangeLog | 1 + libraries/config/ConfigFile.class.php | 2 +- 2 files changed, 2 insertions(+), 1 deletions(-) diff --git a/ChangeLog b/ChangeLog index 270b514..29e256c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -72,6 +72,7 @@ phpMyAdmin - ChangeLog - patch #3314626 [display] CharTextareaRows is not respected - bug #3417089 [synchronize] Extraneous db choices - [security] Fixed local path disclosure vulnerability, see PMASA-2011-15 +- [security] Fixed XSS in setup (verbose parameter) 3.4.5.0 (2011-09-14) - bug #3375325 [interface] Page list in navigation frame looks odd diff --git a/libraries/config/ConfigFile.class.php b/libraries/config/ConfigFile.class.php index 87c10b3..c1b01ec 100644 --- a/libraries/config/ConfigFile.class.php +++ b/libraries/config/ConfigFile.class.php @@ -414,7 +414,7 @@ class ConfigFile } $verbose = $this->get("Servers/$id/verbose"); if (!empty($verbose)) { - return $verbose; + return htmlspecialchars($verbose); } $host = $this->get("Servers/$id/host"); return empty($host) ? 'localhost' : $host; hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_4, updated. RELEASE_3_4_5-43-gbc5aa87
by Marc Delisle 04 Oct '11

04 Oct '11

The branch, QA_3_4 has been updated via bc5aa87ae9957a2c4740009c713bcbd54a31b93c (commit) via 1af420e22367ae72ff4091adb1620e59ddad5ba6 (commit) from 7d586b458dbbaf4002ead84ef7edea60833c528c (commit) - Log ----------------------------------------------------------------- ----------------------------------------------------------------------- Summary of changes: ChangeLog | 1 + libraries/config/ConfigFile.class.php | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index f36cc67..1f101fe 100644 --- a/ChangeLog +++ b/ChangeLog @@ -23,6 +23,7 @@ phpMyAdmin - ChangeLog - patch #3314626 [display] CharTextareaRows is not respected - bug #3417089 [synchronize] Extraneous db choices - [security] Fixed local path disclosure vulnerability, see PMASA-2011-15 +- [security] Fixed XSS in setup (verbose parameter) 3.4.5.0 (2011-09-14) - bug #3375325 [interface] Page list in navigation frame looks odd diff --git a/libraries/config/ConfigFile.class.php b/libraries/config/ConfigFile.class.php index 20369f1..9e1690c 100644 --- a/libraries/config/ConfigFile.class.php +++ b/libraries/config/ConfigFile.class.php @@ -422,7 +422,7 @@ class ConfigFile } $verbose = $this->get("Servers/$id/verbose"); if (!empty($verbose)) { - return $verbose; + return htmlspecialchars($verbose); } $host = $this->get("Servers/$id/host"); return empty($host) ? 'localhost' : $host; @@ -508,4 +508,4 @@ class ConfigFile return $c; } } -?> \ No newline at end of file +?> hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, MAINT_3_4_6, updated. RELEASE_3_4_5-39-g1af420e
by Marc Delisle 04 Oct '11

04 Oct '11

The branch, MAINT_3_4_6 has been updated via 1af420e22367ae72ff4091adb1620e59ddad5ba6 (commit) from e05b37d3c9e5b99e8a779fe55780d92df17b4a55 (commit) - Log ----------------------------------------------------------------- ----------------------------------------------------------------------- Summary of changes: ChangeLog | 1 + libraries/config/ConfigFile.class.php | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index b8c33cb..020aef3 100644 --- a/ChangeLog +++ b/ChangeLog @@ -21,6 +21,7 @@ phpMyAdmin - ChangeLog - patch #3314626 [display] CharTextareaRows is not respected - bug #3417089 [synchronize] Extraneous db choices - [security] Fixed local path disclosure vulnerability, see PMASA-2011-15 +- [security] Fixed XSS in setup (verbose parameter) 3.4.5.0 (2011-09-14) - bug #3375325 [interface] Page list in navigation frame looks odd diff --git a/libraries/config/ConfigFile.class.php b/libraries/config/ConfigFile.class.php index 20369f1..9e1690c 100644 --- a/libraries/config/ConfigFile.class.php +++ b/libraries/config/ConfigFile.class.php @@ -422,7 +422,7 @@ class ConfigFile } $verbose = $this->get("Servers/$id/verbose"); if (!empty($verbose)) { - return $verbose; + return htmlspecialchars($verbose); } $host = $this->get("Servers/$id/host"); return empty($host) ? 'localhost' : $host; @@ -508,4 +508,4 @@ class ConfigFile return $c; } } -?> \ No newline at end of file +?> hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_5-20717-g73913f1
by Marc Delisle 04 Oct '11

04 Oct '11

The branch, master has been updated via 73913f135e51cbc3eba559ffd8af70a2938f0ac3 (commit) from f06ab07979c5ca084955759a62092d51d90e1489 (commit) - Log ----------------------------------------------------------------- commit 73913f135e51cbc3eba559ffd8af70a2938f0ac3 Author: Marc Delisle <marc(a)infomarc.info> Date: Tue Oct 4 05:49:20 2011 -0400 Use standard SQL terminology in format string ----------------------------------------------------------------------- Summary of changes: Documentation.html | 4 ++-- libraries/common.lib.php | 23 ++++++++++++++--------- 2 files changed, 16 insertions(+), 11 deletions(-) diff --git a/Documentation.html b/Documentation.html index af27b89..1c47508 100644 --- a/Documentation.html +++ b/Documentation.html @@ -4341,8 +4341,8 @@ INSERT INTO REL_towns VALUES ('M', 'Montréal'); <dd>Currently opened database</dd> <dt><code>@TABLE@</code></dt> <dd>Currently opened table</dd> - <dt><code>@FIELDS@</code></dt> - <dd>Fields of currently opened table</dd> + <dt><code>@COLUMNS@</code></dt> + <dd>Columns of the currently opened table</dd> <dt><code>@PHPMYADMIN@</code></dt> <dd>phpMyAdmin with version</dd> </dl> diff --git a/libraries/common.lib.php b/libraries/common.lib.php index 2cc2278..5dcf21e 100644 --- a/libraries/common.lib.php +++ b/libraries/common.lib.php @@ -3097,7 +3097,7 @@ function PMA_getTitleForTarget($target) } /** - * Formats user string, expading @VARIABLES@, accepting strftime format string. + * Formats user string, expanding @VARIABLES@, accepting strftime format string. * * @param string $string Text where to do expansion. * @param function $escape Function to call for escaping variable values. @@ -3149,20 +3149,25 @@ function PMA_expandUserString($string, $escape = null, $updates = array()) } } - /* Fetch fields list if required */ + /* Backward compatibility in 3.5.x */ if (strpos($string, '@FIELDS@') !== false) { - $fields_list = PMA_DBI_get_columns($GLOBALS['db'], $GLOBALS['table']); + $string = strtr($string, array('@FIELDS@' => '@COLUMNS@')); + } + + /* Fetch columns list if required */ + if (strpos($string, '@COLUMNS@') !== false) { + $columns_list = PMA_DBI_get_columns($GLOBALS['db'], $GLOBALS['table']); - $field_names = array(); - foreach ($fields_list as $field) { - if (!is_null($escape)) { - $field_names[] = $escape($field['Field']); + $column_names = array(); + foreach ($columns_list as $column) { + if (! is_null($escape)) { + $column_names[] = $escape($column['Field']); } else { - $field_names[] = $field['Field']; + $column_names[] = $field['Field']; } } - $replace['@FIELDS@'] = implode(',', $field_names); + $replace['@COLUMNS@'] = implode(',', $column_names); } /* Do the replacement */ hooks/post-receive -- phpMyAdmin

1 0