July 2011 - Git - lists.phpmyadmin.net

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_3_1-11739-g35a5f31
by Marc Delisle 24 Jul '11

24 Jul '11

The branch, master has been updated via 35a5f312836f7119f9fd9ce7c1b241c381d8b6f7 (commit) via 08ee54d4a43b1bd6eff1e6695ff8553e6f26b37a (commit) from 7e197b695e50f3ba751e48cc45f28ab397534f6f (commit) - Log ----------------------------------------------------------------- commit 35a5f312836f7119f9fd9ce7c1b241c381d8b6f7 Merge: 7e197b695e50f3ba751e48cc45f28ab397534f6f 08ee54d4a43b1bd6eff1e6695ff8553e6f26b37a Author: Marc Delisle <marc(a)infomarc.info> Date: Sun Jul 24 08:08:51 2011 -0400 Merge branch 'QA_3_4' ----------------------------------------------------------------------- Summary of changes: ChangeLog | 1 + libraries/config.default.php | 5 ++++- 2 files changed, 5 insertions(+), 1 deletions(-) diff --git a/ChangeLog b/ChangeLog index feefa80..67d43b5 100644 --- a/ChangeLog +++ b/ChangeLog @@ -58,6 +58,7 @@ phpMyAdmin - ChangeLog - bug #3374374 [interface] Fix footnote for inexact count while browsing - bug #3372807 [interface] Fix security warning link in setup - bug #3374347 [display] Backquotes in normal text on import page +- bug #3358750 [core] With Suhosin, urls are too long in edit links 3.4.3.2 (2011-07-23) - [security] Fixed XSS vulnerability, see PMASA-2011-9 diff --git a/libraries/config.default.php b/libraries/config.default.php index 5762531..edf0264 100644 --- a/libraries/config.default.php +++ b/libraries/config.default.php @@ -2635,8 +2635,11 @@ $cfg['CheckConfigurationPermissions'] = true; * Limit for length of URL in links. When length would be above this limit, it * is replaced by form with button. * This is required as some web servers (IIS) have problems with long URLs. + * The recommended limit is 2000 + * (see http://www.boutell.com/newfaq/misc/urllength.html) but we put + * 1000 to accommodate Suhosin, see bug #3358750. */ -$cfg['LinkLengthLimit'] = 2000; +$cfg['LinkLengthLimit'] = 1000; /** * Disable the table maintenance mass operations, like optimizing or hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_4, updated. RELEASE_3_4_3_1-54-g08ee54d
by Marc Delisle 24 Jul '11

24 Jul '11

The branch, QA_3_4 has been updated via 08ee54d4a43b1bd6eff1e6695ff8553e6f26b37a (commit) from 3534dda30a587eafe3bf5016f2fb302dbc224c2e (commit) - Log ----------------------------------------------------------------- ----------------------------------------------------------------------- Summary of changes: ChangeLog | 1 + libraries/config.default.php | 5 ++++- 2 files changed, 5 insertions(+), 1 deletions(-) diff --git a/ChangeLog b/ChangeLog index 02db31c..551eb8d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -18,6 +18,7 @@ phpMyAdmin - ChangeLog - bug #3374374 [interface] Fix footnote for inexact count while browsing - bug #3372807 [interface] Fix security warning link in setup - bug #3374347 [display] Backquotes in normal text on import page +- bug #3358750 [core] With Suhosin, urls are too long in edit links 3.4.3.2 (2011-07-23) - [security] Fixed XSS vulnerability, see PMASA-2011-9 diff --git a/libraries/config.default.php b/libraries/config.default.php index 4ca31e7..4040acf 100644 --- a/libraries/config.default.php +++ b/libraries/config.default.php @@ -2596,8 +2596,11 @@ $cfg['CheckConfigurationPermissions'] = true; * Limit for length of URL in links. When length would be above this limit, it * is replaced by form with button. * This is required as some web servers (IIS) have problems with long URLs. + * The recommended limit is 2000 + * (see http://www.boutell.com/newfaq/misc/urllength.html) but we put + * 1000 to accommodate Suhosin, see bug #3358750. */ -$cfg['LinkLengthLimit'] = 2000; +$cfg['LinkLengthLimit'] = 1000; /******************************************************************************* * SQL Parser Settings hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin website branch, master, updated. e998431f730947d181458b716d8a141a099d6c13
by Marc Delisle 23 Jul '11

23 Jul '11

The branch, master has been updated via e998431f730947d181458b716d8a141a099d6c13 (commit) from 6c3d84a6a81b50cd85860d3486e0b73871bcddb5 (commit) - Log ----------------------------------------------------------------- commit e998431f730947d181458b716d8a141a099d6c13 Author: Marc Delisle <marc(a)infomarc.info> Date: Sat Jul 23 09:59:10 2011 -0400 Typo ----------------------------------------------------------------------- Summary of changes: templates/security/PMASA-2011-12 | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/templates/security/PMASA-2011-12 b/templates/security/PMASA-2011-12 index 6c92548..410633a 100644 --- a/templates/security/PMASA-2011-12 +++ b/templates/security/PMASA-2011-12 @@ -12,7 +12,7 @@ PMASA-2011-12 <py:def function="announcement_summary"> Possible session manipulation in swekey authentication. -<p/y:def> +</py:def> <py:def function="announcement_description"> It was possible to manipulate the PHP session superglobal using some of the Swekey authentication code. hooks/post-receive -- phpMyAdmin website

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin website branch, master, updated. 6c3d84a6a81b50cd85860d3486e0b73871bcddb5
by Marc Delisle 23 Jul '11

23 Jul '11

The branch, master has been updated via 6c3d84a6a81b50cd85860d3486e0b73871bcddb5 (commit) via aff9d71483d83588ca0a10965150a611e33b02cd (commit) via 1b00ee3750c28e3867f11f1e7f7ed10c3752789c (commit) via bc1e43bd9eef5c45ddb9fbc4d502de5f279d87fb (commit) via 80b307e2ccc22f8b29270bda0cebfb6b4cc0264f (commit) via dfa1b5539ebe2f98fad06779f0f31f6e83f92378 (commit) via 24a939592da18b47f7cf13b8ed0f46be2e69f27c (commit) via 5e886f236c4958246e9cf5911c5a67bf07c1861a (commit) via 532b37f7a0e545553e138c1978d78ee73585253d (commit) via 3196fae8c141a487df7231b5b3ab5505efd8d7e7 (commit) from 85358c18474ebd4ae2d6d941f3b7e398e8229e99 (commit) - Log ----------------------------------------------------------------- commit 6c3d84a6a81b50cd85860d3486e0b73871bcddb5 Author: Marc Delisle <marc(a)infomarc.info> Date: Sat Jul 23 09:25:21 2011 -0400 Reference to advisories commit aff9d71483d83588ca0a10965150a611e33b02cd Merge: 85358c18474ebd4ae2d6d941f3b7e398e8229e99 1b00ee3750c28e3867f11f1e7f7ed10c3752789c Author: Marc Delisle <marc(a)infomarc.info> Date: Sat Jul 23 09:18:11 2011 -0400 PMASA-2011-9 to -12 commit 1b00ee3750c28e3867f11f1e7f7ed10c3752789c Author: Marc Delisle <marc(a)infomarc.info> Date: Sat Jul 23 09:13:41 2011 -0400 - Add release date - Remove unknown CVE ids - Fix typos commit bc1e43bd9eef5c45ddb9fbc4d502de5f279d87fb Author: Herman van Rink <rink(a)initfour.nl> Date: Fri Jul 22 21:00:32 2011 +0200 Added 3.3 version number commit 80b307e2ccc22f8b29270bda0cebfb6b4cc0264f Author: Herman van Rink <rink(a)initfour.nl> Date: Fri Jul 22 20:16:32 2011 +0200 Added commit for 3.3 commit dfa1b5539ebe2f98fad06779f0f31f6e83f92378 Author: Marc Delisle <marc(a)infomarc.info> Date: Fri Jul 22 08:41:51 2011 -0400 Better wording commit 24a939592da18b47f7cf13b8ed0f46be2e69f27c Author: Marc Delisle <marc(a)infomarc.info> Date: Tue Jul 12 09:09:52 2011 -0400 Typo commit 5e886f236c4958246e9cf5911c5a67bf07c1861a Author: Herman van Rink <rink(a)initfour.nl> Date: Tue Jul 12 13:10:36 2011 +0200 Added commits for 3.3 commit 532b37f7a0e545553e138c1978d78ee73585253d Author: Herman van Rink <rink(a)initfour.nl> Date: Tue Jul 12 12:48:11 2011 +0200 Added draft for PMASA-2011-11 and PMASA-2011-12 commit 3196fae8c141a487df7231b5b3ab5505efd8d7e7 Author: Marc Delisle <marc(a)infomarc.info> Date: Mon Jul 11 09:42:48 2011 -0400 CVE ids ----------------------------------------------------------------------- Summary of changes: templates/security/{PMASA-2011-4 => PMASA-2011-10} | 26 +++++++-------- templates/security/{PMASA-2011-4 => PMASA-2011-11} | 27 +++++++-------- templates/security/{PMASA-2011-5 => PMASA-2011-12} | 33 +++++++++--------- templates/security/{PMASA-2011-3 => PMASA-2011-9} | 35 ++++++++------------ 4 files changed, 54 insertions(+), 67 deletions(-) copy templates/security/{PMASA-2011-4 => PMASA-2011-10} (57%) copy templates/security/{PMASA-2011-4 => PMASA-2011-11} (55%) copy templates/security/{PMASA-2011-5 => PMASA-2011-12} (61%) copy templates/security/{PMASA-2011-3 => PMASA-2011-9} (50%) diff --git a/templates/security/PMASA-2011-4 b/templates/security/PMASA-2011-10 similarity index 57% copy from templates/security/PMASA-2011-4 copy to templates/security/PMASA-2011-10 index d08d096..6be070a 100644 --- a/templates/security/PMASA-2011-4 +++ b/templates/security/PMASA-2011-10 @@ -3,51 +3,49 @@ <py:def function="announcement_id"> -PMASA-2011-4 +PMASA-2011-10 </py:def> <py:def function="announcement_date"> -2011-05-22 +2011-07-23 </py:def> <py:def function="announcement_summary"> -URL redirection to untrusted site. +Local file inclusion. </py:def> <py:def function="announcement_description"> -It was possible to redirect to an arbitrary, untrusted site, leading to -a possible phishing attack. +Via a crafted MIME-type transformation parameter, an attacker can perform a local file inclusion. </py:def> <py:def function="announcement_severity"> We consider this vulnerability to be serious. </py:def> -<py:def function="announcement_unaffected"> -Older releases than 3.4.0 are not affected. +<py:def function="announcement_mitigation"> +The phpMyAdmin's configuration storage mechanism must be configured for this attack to work. </py:def> <py:def function="announcement_affected"> -The 3.4.0 version is affected. +Versions 3.4.0 to 3.4.3.1 are affected. </py:def> <py:def function="announcement_solution"> -Upgrade to phpMyAdmin 3.4.1 or apply the related patch listed below. +Upgrade to phpMyAdmin 3.4.3.2 or apply the related patch listed below. </py:def>  <py:def function="announcement_references"> -This issue was found by Kian Mohageri. +This issue was found by Norman Hippert from <a href="http://www.the-wildcat.de/">The-Wildcat.de</a> </py:def>  -<py:def function="announcement_cve">CVE-2011-1941</py:def> +<py:def function="announcement_cve">CVE-2011-2643</py:def> -<py:def function="announcement_cwe">661 601</py:def> +<py:def function="announcement_cwe">661 98</py:def> <py:def function="announcement_commits"> -b7a8179eb6bf0f1643970ac57a70b5b513a1cd4f -ecfc8ba4f7b4ea612c58ab5726054ed0f28e200d +f63e1bb42a37401b2fdfcd2e66cce92b7ea2025c </py:def> <xi:include href="_page.tpl" /> diff --git a/templates/security/PMASA-2011-4 b/templates/security/PMASA-2011-11 similarity index 55% copy from templates/security/PMASA-2011-4 copy to templates/security/PMASA-2011-11 index d08d096..8c1b162 100644 --- a/templates/security/PMASA-2011-4 +++ b/templates/security/PMASA-2011-11 @@ -3,51 +3,48 @@ <py:def function="announcement_id"> -PMASA-2011-4 +PMASA-2011-11 </py:def> <py:def function="announcement_date"> -2011-05-22 +2011-07-23 </py:def> <py:def function="announcement_summary"> -URL redirection to untrusted site. +Local file inclusion vulnerability and code execution. </py:def> <py:def function="announcement_description"> -It was possible to redirect to an arbitrary, untrusted site, leading to -a possible phishing attack. +In the 'relational schema' code a parameter was not sanitized before being used to concatenate a class name. </py:def> <py:def function="announcement_severity"> -We consider this vulnerability to be serious. +We consider this vulnerability to be critical. </py:def> -<py:def function="announcement_unaffected"> -Older releases than 3.4.0 are not affected. +<py:def function="announcement_mitigation"> +An attacker must be logged in via phpMyAdmin to exploit this problem. </py:def> <py:def function="announcement_affected"> -The 3.4.0 version is affected. +Versions 3.4.0 to 3.4.3.1 are affected. </py:def> <py:def function="announcement_solution"> -Upgrade to phpMyAdmin 3.4.1 or apply the related patch listed below. +Upgrade to phpMyAdmin 3.4.3.2 or apply the related patch listed below. </py:def>  <py:def function="announcement_references"> -This issue was found by Kian Mohageri. +This issue was found by Norman Hippert from <a href="http://www.the-wildcat.de/">The-Wildcat.de</a> </py:def>  -<py:def function="announcement_cve">CVE-2011-1941</py:def> -<py:def function="announcement_cwe">661 601</py:def> +<py:def function="announcement_cwe">661 98</py:def> <py:def function="announcement_commits"> -b7a8179eb6bf0f1643970ac57a70b5b513a1cd4f -ecfc8ba4f7b4ea612c58ab5726054ed0f28e200d +3ae58f0cd6b89ad4767920f9b214c38d3f6d4393 </py:def> <xi:include href="_page.tpl" /> diff --git a/templates/security/PMASA-2011-5 b/templates/security/PMASA-2011-12 similarity index 61% copy from templates/security/PMASA-2011-5 copy to templates/security/PMASA-2011-12 index 5cea3f8..6c92548 100644 --- a/templates/security/PMASA-2011-5 +++ b/templates/security/PMASA-2011-12 @@ -3,32 +3,31 @@ <py:def function="announcement_id"> -PMASA-2011-5 +PMASA-2011-12 </py:def> <py:def function="announcement_date"> -2011-07-02 -</py:def> - -<py:def function="announcement_updated"> -2011-07-03 +2011-07-23 </py:def> <py:def function="announcement_summary"> -Possible session manipulation in Swekey authentication. -</py:def> +Possible session manipulation in swekey authentication. +<p/y:def> <py:def function="announcement_description"> It was possible to manipulate the PHP session superglobal using some of the Swekey authentication code. -This could open a path for other attacks. +This is very similar to PMASA-2011-5. </py:def> <py:def function="announcement_severity"> We consider this vulnerability to be critical. </py:def> +<py:def function="announcement_mitigation"> +</py:def> + <py:def function="announcement_affected"> -The 3.4.3 and earlier versions are affected. +The 3.4.3.1 and earlier versions are affected. </py:def> <py:def function="announcement_unaffected"> @@ -36,26 +35,26 @@ Branch 2.11.x is not affected by this. </py:def> <py:def function="announcement_solution"> -Upgrade to phpMyAdmin 3.3.10.2 or 3.4.3.1 or apply the related patch listed below. +Upgrade to phpMyAdmin 3.3.10.3 or 3.4.3.2 or apply the related patch listed below. </py:def>  <py:def function="announcement_references"> -This issue was found by Frans Pehrson from <a href="http://www.xxor.se">Xxor AB</a>. -<a href="http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Execution…">His advisory.</a> +This issue was found by Frans Pehrson from <a href="http://www.xxor.se">Xxor AB</a>.<a href="http://www.xxor.se/advisories/phpMyAdmin_3.x_Conditional_Session_Manipulati…">His first advisory.</a><a href="http://www.xxor.se/advisories/phpMyAdmin_3.x_Authenticated_Local_File_Inclu…">His second advisory.</a> </py:def>  -<py:def function="announcement_cve">CVE-2011-2505</py:def> -<py:def function="announcement_cwe">473 661</py:def> +<py:def function="announcement_cwe">661 473</py:def> <py:def function="announcement_commits"> -7ebd958b2bf59f96fecd5b3322bdbd0b244a7967 +e7bb42c002885c2aca7aba4d431b8c63ae4de9b7 +571cdc6ff4bf375871b594f4e06f8ad3159d1754 </py:def> <py:def function="announcement_commits_3_3"> -6e6e129f26295c83d67b74e202628a4b8bc49e54 +f6f6ee3f1171addb166fa18e75a0b56599bf374c +630b8260be45eb9b211f5d7628dbb9e5c1b05bc6 </py:def> <xi:include href="_page.tpl" /> diff --git a/templates/security/PMASA-2011-3 b/templates/security/PMASA-2011-9 similarity index 50% copy from templates/security/PMASA-2011-3 copy to templates/security/PMASA-2011-9 index 9219e26..00db8c3 100644 --- a/templates/security/PMASA-2011-3 +++ b/templates/security/PMASA-2011-9 @@ -3,61 +3,54 @@ <py:def function="announcement_id"> -PMASA-2011-3 +PMASA-2011-9 </py:def> <py:def function="announcement_date"> -2011-05-22 +2011-07-23 </py:def> <py:def function="announcement_summary"> -XSS vulnerability on Tracking page. +XSS in table Print view. </py:def> <py:def function="announcement_description"> -It was possible to create a crafted table name that leads to XSS. +The attacker must trick the victim into clicking a link that reaches phpMyAdmin's table print view script; one of the link's parameters is a crafted table name (the name containing Javascript code). </py:def> <py:def function="announcement_severity"> -We consider this vulnerability to be serious. +We consider this vulnerability to be minor. </py:def> <py:def function="announcement_mitigation"> -This vulnerability works in the context of a shared phpMyAdmin installation. -The attacker needs to convince a victim to go to the Tracking page that -relates to the crafted table. +The crafted table name must exist (the attacker must have access to create a table on the victim's server). </py:def> <py:def function="announcement_affected"> -The 3.3.x and 3.4.0 versions are affected. -</py:def> - -<py:def function="announcement_unaffected"> -Older releases than 3.3.0 are not affected. +The 3.4.3.1 and earlier versions are affected. </py:def> <py:def function="announcement_solution"> -Upgrade to phpMyAdmin 3.3.10.1 or 3.4.1 or apply the related patch listed below. +Upgrade to phpMyAdmin 3.3.10.3 or 3.4.3.2 or apply the related patch listed below. </py:def>  <py:def function="announcement_references"> -This issue was found by a person who wishes to be known as "dave b". +This issue was found by Norman Hippert from <a href="http://www.the-wildcat.de/">The-Wildcat.de</a> </py:def>  -<py:def function="announcement_cve">CVE-2011-1940</py:def> +<py:def function="announcement_cve">CVE-2011-2642</py:def> <py:def function="announcement_cwe">661 79</py:def> <py:def function="announcement_commits"> -7e10c132a3887c8ebfd7a8eee356b28375f1e287 -d3ccf798fdbd4f8a89d4088130637d8dee918492 +a0823be05aa5835f207c0838b9cca67d2d9a050a +4bd27166c314faa37cada91533b86377f4d4d214 </py:def> -<py:def function="announcement_commits_3_3_10"> -1300510d3686b40adefafb7f1778a6f06d0a553a -452669a1746898a08129d3a555ac4b1ec084b423 +<py:def function="announcement_commits_3_3"> +8ac8328229ae7493d6060b6272578d85879c698d </py:def> <xi:include href="_page.tpl" /> hooks/post-receive -- phpMyAdmin website

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, TESTING, updated. RELEASE_3_4_3_2-40-g2c2f798
by Marc Delisle 23 Jul '11

23 Jul '11

The branch, TESTING has been updated via 2c2f7988ca2241fcbcfc44485a3491483de9562e (commit) via ff536da86576efe733e4dfb5d69c8481ae590e2e (commit) via bd63726ee3daf32799f499b61d7cde973d8e8660 (commit) via 09c0f7ae557e40102fbfd23c4bea4939e19f0f29 (commit) via 571cdc6ff4bf375871b594f4e06f8ad3159d1754 (commit) via e7bb42c002885c2aca7aba4d431b8c63ae4de9b7 (commit) via 3ae58f0cd6b89ad4767920f9b214c38d3f6d4393 (commit) via 3caa6cbb7ed1b1933c3bded493a2fbc8273d746f (commit) via f63e1bb42a37401b2fdfcd2e66cce92b7ea2025c (commit) via 951fb4dd79253a3aca8b6e386db77c1affcfc3a9 (commit) via 4bd27166c314faa37cada91533b86377f4d4d214 (commit) via a0823be05aa5835f207c0838b9cca67d2d9a050a (commit) via d7cffc5dbde68342d46e891ea2c8bd72de134f43 (commit) from 50efb55a96643e997120a88e06b1a854b2feebd7 (commit) - Log ----------------------------------------------------------------- commit 2c2f7988ca2241fcbcfc44485a3491483de9562e Merge: 50efb55a96643e997120a88e06b1a854b2feebd7 ff536da86576efe733e4dfb5d69c8481ae590e2e Author: Marc Delisle <marc(a)infomarc.info> Date: Sat Jul 23 08:43:27 2011 -0400 Merge branch 'MAINT_3_4_3' into TESTING ----------------------------------------------------------------------- Summary of changes: ChangeLog | 18 ++++++++++++------ Documentation.html | 4 ++-- README | 2 +- libraries/Config.class.php | 2 +- libraries/auth/swekey/swekey.auth.lib.php | 12 +++++++----- libraries/schema/User_Schema.class.php | 7 +++++-- schema_export.php | 4 +++- sql.php | 2 +- tbl_printview.php | 4 ++-- 9 files changed, 34 insertions(+), 21 deletions(-) diff --git a/ChangeLog b/ChangeLog index 28a5ee0..24ff73c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,12 @@ phpMyAdmin - ChangeLog ====================== +3.4.3.2 (2011-07-23) +- [security] Fixed XSS vulnerability, see PMASA-2011-9 +- [security] Fixed local file inclusion vulnerability, see PMASA-2011-10 +- [security] Fixed local file inclusion vulnerability and code execution, see PMASA-2011-11 +- [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-12 + 3.4.3.1 (2011-07-02) - [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-5 - [security] Fixed possible code injection incase session variables are compromised, see PMASA-2011-6 @@ -95,7 +101,7 @@ phpMyAdmin - ChangeLog + patch #2974341 [structure] Clicking on table name in db Structure should Browse the table if possible, thanks to bhdouglass - dougboybhd + patch #2975533 [search] New search operators, thanks to - Martynas MickeviÄius + Martynas Mickevičius + patch #2967320 [designer] Colored relations based on the primary key, thanks to GreenRover - greenrover - [core] Provide way for vendors to easily change paths to config files. @@ -252,7 +258,7 @@ phpMyAdmin - ChangeLog 3.3.7.0 (2010-09-07) - patch #3050492 [PDF scratchboard] Cannot drag table box to the edge after - a page size increase, thanks to Martin SchÃ¶nberger - mad05 + a page size increase, thanks to Martin Schönberger - mad05 3.3.6.0 (2010-08-28) - bug #3033063 [core] Navi gets wrong db name @@ -273,7 +279,7 @@ phpMyAdmin - ChangeLog 3.3.5.0 (2010-07-26) - patch #2932113 [information_schema] Slow export when having lots of - databases, thanks to StÃ©phane Pontier - shadow_walker + databases, thanks to Stéphane Pontier - shadow_walker - bug #3022705 [import] Import button does not work in Catalan when there is no progress bar possible - bug [replication] Do not offer information_schema in the list of databases @@ -313,9 +319,9 @@ phpMyAdmin - ChangeLog - patch #2984893 [engines] InnoDB storage page emits a warning, thanks to Madhura Jayaratne - madhuracj - bug #2974687, bug #2974692 [compatibility] PHPExcel : IBM AIX iconv() does not work, - thanks to BjÃ¶rn Wiberg - bwiberg + thanks to Björn Wiberg - bwiberg - bug #2983066 [interface] Flush table on table operations shows the query twice, - thanks to Martynas MickeviÄius - BlinK_ + thanks to Martynas Mickevičius - BlinK_ - bug #2983060, patch #2987900 [interface] Fix initial state of tables in designer, thanks to Sutharshan Balachandren. - bug #2983062, patch #2989408 [engines] Fix warnings when changing table @@ -394,7 +400,7 @@ phpMyAdmin - ChangeLog + rfe #2839504 [engines] Support InnoDB plugin's new row formats + [core] Added ability for synchronizing databases among servers. + [lang] #2843101 Dutch update, thanks to scavenger2008 -+ [lang] Galician update, thanks to XosÃ© Calvo - xosecalvo ++ [lang] Galician update, thanks to Xosé Calvo - xosecalvo + [export] Added MediaWiki export module, thanks to Derek Schaefer - drummingds1 + [lang] Turkish update, thanks to Burak Yavuz diff --git a/Documentation.html b/Documentation.html index 25b9731..15f8000 100644 --- a/Documentation.html +++ b/Documentation.html @@ -9,7 +9,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <link rel="icon" href="./favicon.ico" type="image/x-icon" /> <link rel="shortcut icon" href="./favicon.ico" type="image/x-icon" /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> - <title>phpMyAdmin 3.4.3.1 - Documentation</title> + <title>phpMyAdmin 3.4.3.2 - Documentation</title> <link rel="stylesheet" type="text/css" href="docs.css" /> </head> @@ -17,7 +17,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <div id="header"> <h1> <a href="http://www.phpmyadmin.net/">php<span class="myadmin">MyAdmin</span></a> - 3.4.3.1 + 3.4.3.2 Documentation </h1> </div> diff --git a/README b/README index e57152a..65f7c52 100644 --- a/README +++ b/README @@ -1,7 +1,7 @@ phpMyAdmin - Readme =================== -Version 3.4.3.1 +Version 3.4.3.2 A set of PHP-scripts to manage MySQL over the web. diff --git a/libraries/Config.class.php b/libraries/Config.class.php index 28625f2..0cec6a9 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -96,7 +96,7 @@ class PMA_Config */ function checkSystem() { - $this->set('PMA_VERSION', '3.4.3.1'); + $this->set('PMA_VERSION', '3.4.3.2'); /** * @deprecated */ diff --git a/libraries/auth/swekey/swekey.auth.lib.php b/libraries/auth/swekey/swekey.auth.lib.php index c5f613b..8ec5ab4 100644 --- a/libraries/auth/swekey/swekey.auth.lib.php +++ b/libraries/auth/swekey/swekey.auth.lib.php @@ -143,7 +143,9 @@ function Swekey_auth_error() return "Internal Error: CA File $caFile not found"; $result = null; - parse_str($_SERVER['QUERY_STRING']); + $swekey_id = $_GET['swekey_id']; + $swekey_otp = $_GET['swekey_otp']; + if (isset($swekey_id)) { unset($_SESSION['SWEKEY']['AUTHENTICATED_SWEKEY']); if (! isset($_SESSION['SWEKEY']['RND_TOKEN'])) { @@ -166,7 +168,7 @@ function Swekey_auth_error() $result = __('No valid authentication key plugged'); if ($_SESSION['SWEKEY']['CONF_DEBUG']) { - $result .= "<br>".$swekey_id; + $result .= "<br>" . htmlspecialchars($swekey_id); } unset($_SESSION['SWEKEY']['CONF_LOADED']); // reload the conf file } @@ -186,16 +188,16 @@ function Swekey_auth_error() <script> if (key.length != 32) { - window.location.search="?swekey_id=" + key; + window.location.search="?swekey_id=" + key + "&token=<?php echo $_SESSION[' PMA_token ']; ?>"; } else { var url = "" + window.location; if (url.indexOf("?") > 0) url = url.substr(0, url.indexOf("?")); - Swekey_SetUnplugUrl(key, "pma_login", url + "?session_to_unset=<?php echo session_id();?>"); + Swekey_SetUnplugUrl(key, "pma_login", url + "?session_to_unset=<?php echo session_id();?>&token=<?php echo $_SESSION[' PMA_token ']; ?>"); var otp = Swekey_GetOtp(key, <?php echo '"'.$_SESSION['SWEKEY']['RND_TOKEN'].'"';?>); - window.location.search="?swekey_id=" + key + "&swekey_otp=" + otp; + window.location.search="?swekey_id=" + key + "&swekey_otp=" + otp + "&token=<?php echo $_SESSION[' PMA_token ']; ?>"; } </script> <?php diff --git a/libraries/schema/User_Schema.class.php b/libraries/schema/User_Schema.class.php index fbec138..cb42dde 100644 --- a/libraries/schema/User_Schema.class.php +++ b/libraries/schema/User_Schema.class.php @@ -567,10 +567,13 @@ class PMA_User_Schema require_once './libraries/transformations.lib.php'; require_once './libraries/Index.class.php'; /** - * default is PDF + * default is PDF, otherwise validate it's only letters a-z */ global $db,$export_type; - $export_type = isset($export_type) ? $export_type : 'pdf'; + if (!isset($export_type) || !preg_match('/^[a-zA-Z]+$/', $export_type)) { + $export_type = 'pdf'; + } + PMA_DBI_select_db($db); include("./libraries/schema/".ucfirst($export_type)."_Relation_Schema.class.php"); diff --git a/schema_export.php b/schema_export.php index 0a21d32..3e1067d 100644 --- a/schema_export.php +++ b/schema_export.php @@ -37,7 +37,9 @@ include_once("./libraries/schema/Export_Relation_Schema.class.php"); * default is PDF */ global $db,$export_type; -$export_type = isset($export_type) ? $export_type : 'pdf'; +if (!isset($export_type) || !preg_match('/^[a-zA-Z]+$/', $export_type)) { + $export_type = 'pdf'; +} PMA_DBI_select_db($db); $path = PMA_securePath(ucfirst($export_type)); diff --git a/sql.php b/sql.php index 9b19174..eb9254f 100644 --- a/sql.php +++ b/sql.php @@ -719,7 +719,7 @@ if (0 == $num_rows || $is_affected) { parse_str($_REQUEST['transform_fields_list'], $edited_values); foreach($mime_map as $transformation) { - $include_file = $transformation['transformation']; + $include_file = PMA_securePath($transformation['transformation']); $column_name = $transformation['column_name']; $column_data = $edited_values[$column_name]; diff --git a/tbl_printview.php b/tbl_printview.php index 74b6818..ce007d1 100644 --- a/tbl_printview.php +++ b/tbl_printview.php @@ -69,7 +69,7 @@ if ($multi_tables) { $tbl_list .= (empty($tbl_list) ? '' : ', ') . PMA_backquote($table); } - echo '<strong>'. __('Show tables') . ': ' . $tbl_list . '</strong>' . "\n"; + echo '<strong>'. __('Show tables') . ': ' . htmlspecialchars($tbl_list) . '</strong>' . "\n"; echo '<hr />' . "\n"; } // end if @@ -84,7 +84,7 @@ foreach ($the_tables as $key => $table) { } $counter++; echo '<div' . $breakstyle . '>' . "\n"; - echo '<h1>' . $table . '</h1>' . "\n"; + echo '<h1>' . htmlspecialchars($table) . '</h1>' . "\n"; /** * Gets table informations hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, STABLE, updated. RELEASE_3_4_3_2-23-g35de0db
by Marc Delisle 23 Jul '11

23 Jul '11

The branch, STABLE has been updated via 35de0db1e6c61c0fcb104144a6c31c3304efc79b (commit) via ff536da86576efe733e4dfb5d69c8481ae590e2e (commit) via bd63726ee3daf32799f499b61d7cde973d8e8660 (commit) via 09c0f7ae557e40102fbfd23c4bea4939e19f0f29 (commit) via 571cdc6ff4bf375871b594f4e06f8ad3159d1754 (commit) via e7bb42c002885c2aca7aba4d431b8c63ae4de9b7 (commit) via 3ae58f0cd6b89ad4767920f9b214c38d3f6d4393 (commit) via 3caa6cbb7ed1b1933c3bded493a2fbc8273d746f (commit) via f63e1bb42a37401b2fdfcd2e66cce92b7ea2025c (commit) via 951fb4dd79253a3aca8b6e386db77c1affcfc3a9 (commit) via 4bd27166c314faa37cada91533b86377f4d4d214 (commit) via a0823be05aa5835f207c0838b9cca67d2d9a050a (commit) via d7cffc5dbde68342d46e891ea2c8bd72de134f43 (commit) from e1a95b8cca8ed2eb89683bb78067079d6a7128e1 (commit) - Log ----------------------------------------------------------------- commit 35de0db1e6c61c0fcb104144a6c31c3304efc79b Merge: e1a95b8cca8ed2eb89683bb78067079d6a7128e1 ff536da86576efe733e4dfb5d69c8481ae590e2e Author: Marc Delisle <marc(a)infomarc.info> Date: Sat Jul 23 08:43:27 2011 -0400 Merge branch 'MAINT_3_4_3' into STABLE ----------------------------------------------------------------------- Summary of changes: ChangeLog | 18 ++++++++++++------ Documentation.html | 4 ++-- README | 2 +- libraries/Config.class.php | 2 +- libraries/auth/swekey/swekey.auth.lib.php | 12 +++++++----- libraries/schema/User_Schema.class.php | 7 +++++-- schema_export.php | 4 +++- sql.php | 2 +- tbl_printview.php | 4 ++-- 9 files changed, 34 insertions(+), 21 deletions(-) diff --git a/ChangeLog b/ChangeLog index fe71031..05d5fe5 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,12 @@ phpMyAdmin - ChangeLog ====================== +3.4.3.2 (2011-07-23) +- [security] Fixed XSS vulnerability, see PMASA-2011-9 +- [security] Fixed local file inclusion vulnerability, see PMASA-2011-10 +- [security] Fixed local file inclusion vulnerability and code execution, see PMASA-2011-11 +- [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-12 + 3.4.3.1 (2011-07-02) - [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-5 - [security] Fixed possible code injection incase session variables are compromised, see PMASA-2011-6 @@ -95,7 +101,7 @@ phpMyAdmin - ChangeLog + patch #2974341 [structure] Clicking on table name in db Structure should Browse the table if possible, thanks to bhdouglass - dougboybhd + patch #2975533 [search] New search operators, thanks to - Martynas MickeviÄius + Martynas Mickevičius + patch #2967320 [designer] Colored relations based on the primary key, thanks to GreenRover - greenrover - [core] Provide way for vendors to easily change paths to config files. @@ -249,7 +255,7 @@ phpMyAdmin - ChangeLog 3.3.7.0 (2010-09-07) - patch #3050492 [PDF scratchboard] Cannot drag table box to the edge after - a page size increase, thanks to Martin SchÃ¶nberger - mad05 + a page size increase, thanks to Martin Schönberger - mad05 3.3.6.0 (2010-08-28) - bug #3033063 [core] Navi gets wrong db name @@ -270,7 +276,7 @@ phpMyAdmin - ChangeLog 3.3.5.0 (2010-07-26) - patch #2932113 [information_schema] Slow export when having lots of - databases, thanks to StÃ©phane Pontier - shadow_walker + databases, thanks to Stéphane Pontier - shadow_walker - bug #3022705 [import] Import button does not work in Catalan when there is no progress bar possible - bug [replication] Do not offer information_schema in the list of databases @@ -310,9 +316,9 @@ phpMyAdmin - ChangeLog - patch #2984893 [engines] InnoDB storage page emits a warning, thanks to Madhura Jayaratne - madhuracj - bug #2974687, bug #2974692 [compatibility] PHPExcel : IBM AIX iconv() does not work, - thanks to BjÃ¶rn Wiberg - bwiberg + thanks to Björn Wiberg - bwiberg - bug #2983066 [interface] Flush table on table operations shows the query twice, - thanks to Martynas MickeviÄius - BlinK_ + thanks to Martynas Mickevičius - BlinK_ - bug #2983060, patch #2987900 [interface] Fix initial state of tables in designer, thanks to Sutharshan Balachandren. - bug #2983062, patch #2989408 [engines] Fix warnings when changing table @@ -391,7 +397,7 @@ phpMyAdmin - ChangeLog + rfe #2839504 [engines] Support InnoDB plugin's new row formats + [core] Added ability for synchronizing databases among servers. + [lang] #2843101 Dutch update, thanks to scavenger2008 -+ [lang] Galician update, thanks to XosÃ© Calvo - xosecalvo ++ [lang] Galician update, thanks to Xosé Calvo - xosecalvo + [export] Added MediaWiki export module, thanks to Derek Schaefer - drummingds1 + [lang] Turkish update, thanks to Burak Yavuz diff --git a/Documentation.html b/Documentation.html index 25b9731..15f8000 100644 --- a/Documentation.html +++ b/Documentation.html @@ -9,7 +9,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <link rel="icon" href="./favicon.ico" type="image/x-icon" /> <link rel="shortcut icon" href="./favicon.ico" type="image/x-icon" /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> - <title>phpMyAdmin 3.4.3.1 - Documentation</title> + <title>phpMyAdmin 3.4.3.2 - Documentation</title> <link rel="stylesheet" type="text/css" href="docs.css" /> </head> @@ -17,7 +17,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <div id="header"> <h1> <a href="http://www.phpmyadmin.net/">php<span class="myadmin">MyAdmin</span></a> - 3.4.3.1 + 3.4.3.2 Documentation </h1> </div> diff --git a/README b/README index e57152a..65f7c52 100644 --- a/README +++ b/README @@ -1,7 +1,7 @@ phpMyAdmin - Readme =================== -Version 3.4.3.1 +Version 3.4.3.2 A set of PHP-scripts to manage MySQL over the web. diff --git a/libraries/Config.class.php b/libraries/Config.class.php index 28625f2..0cec6a9 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -96,7 +96,7 @@ class PMA_Config */ function checkSystem() { - $this->set('PMA_VERSION', '3.4.3.1'); + $this->set('PMA_VERSION', '3.4.3.2'); /** * @deprecated */ diff --git a/libraries/auth/swekey/swekey.auth.lib.php b/libraries/auth/swekey/swekey.auth.lib.php index c5f613b..8ec5ab4 100644 --- a/libraries/auth/swekey/swekey.auth.lib.php +++ b/libraries/auth/swekey/swekey.auth.lib.php @@ -143,7 +143,9 @@ function Swekey_auth_error() return "Internal Error: CA File $caFile not found"; $result = null; - parse_str($_SERVER['QUERY_STRING']); + $swekey_id = $_GET['swekey_id']; + $swekey_otp = $_GET['swekey_otp']; + if (isset($swekey_id)) { unset($_SESSION['SWEKEY']['AUTHENTICATED_SWEKEY']); if (! isset($_SESSION['SWEKEY']['RND_TOKEN'])) { @@ -166,7 +168,7 @@ function Swekey_auth_error() $result = __('No valid authentication key plugged'); if ($_SESSION['SWEKEY']['CONF_DEBUG']) { - $result .= "<br>".$swekey_id; + $result .= "<br>" . htmlspecialchars($swekey_id); } unset($_SESSION['SWEKEY']['CONF_LOADED']); // reload the conf file } @@ -186,16 +188,16 @@ function Swekey_auth_error() <script> if (key.length != 32) { - window.location.search="?swekey_id=" + key; + window.location.search="?swekey_id=" + key + "&token=<?php echo $_SESSION[' PMA_token ']; ?>"; } else { var url = "" + window.location; if (url.indexOf("?") > 0) url = url.substr(0, url.indexOf("?")); - Swekey_SetUnplugUrl(key, "pma_login", url + "?session_to_unset=<?php echo session_id();?>"); + Swekey_SetUnplugUrl(key, "pma_login", url + "?session_to_unset=<?php echo session_id();?>&token=<?php echo $_SESSION[' PMA_token ']; ?>"); var otp = Swekey_GetOtp(key, <?php echo '"'.$_SESSION['SWEKEY']['RND_TOKEN'].'"';?>); - window.location.search="?swekey_id=" + key + "&swekey_otp=" + otp; + window.location.search="?swekey_id=" + key + "&swekey_otp=" + otp + "&token=<?php echo $_SESSION[' PMA_token ']; ?>"; } </script> <?php diff --git a/libraries/schema/User_Schema.class.php b/libraries/schema/User_Schema.class.php index fbec138..cb42dde 100644 --- a/libraries/schema/User_Schema.class.php +++ b/libraries/schema/User_Schema.class.php @@ -567,10 +567,13 @@ class PMA_User_Schema require_once './libraries/transformations.lib.php'; require_once './libraries/Index.class.php'; /** - * default is PDF + * default is PDF, otherwise validate it's only letters a-z */ global $db,$export_type; - $export_type = isset($export_type) ? $export_type : 'pdf'; + if (!isset($export_type) || !preg_match('/^[a-zA-Z]+$/', $export_type)) { + $export_type = 'pdf'; + } + PMA_DBI_select_db($db); include("./libraries/schema/".ucfirst($export_type)."_Relation_Schema.class.php"); diff --git a/schema_export.php b/schema_export.php index 0a21d32..3e1067d 100644 --- a/schema_export.php +++ b/schema_export.php @@ -37,7 +37,9 @@ include_once("./libraries/schema/Export_Relation_Schema.class.php"); * default is PDF */ global $db,$export_type; -$export_type = isset($export_type) ? $export_type : 'pdf'; +if (!isset($export_type) || !preg_match('/^[a-zA-Z]+$/', $export_type)) { + $export_type = 'pdf'; +} PMA_DBI_select_db($db); $path = PMA_securePath(ucfirst($export_type)); diff --git a/sql.php b/sql.php index 9b19174..eb9254f 100644 --- a/sql.php +++ b/sql.php @@ -719,7 +719,7 @@ if (0 == $num_rows || $is_affected) { parse_str($_REQUEST['transform_fields_list'], $edited_values); foreach($mime_map as $transformation) { - $include_file = $transformation['transformation']; + $include_file = PMA_securePath($transformation['transformation']); $column_name = $transformation['column_name']; $column_data = $edited_values[$column_name]; diff --git a/tbl_printview.php b/tbl_printview.php index 74b6818..ce007d1 100644 --- a/tbl_printview.php +++ b/tbl_printview.php @@ -69,7 +69,7 @@ if ($multi_tables) { $tbl_list .= (empty($tbl_list) ? '' : ', ') . PMA_backquote($table); } - echo '<strong>'. __('Show tables') . ': ' . $tbl_list . '</strong>' . "\n"; + echo '<strong>'. __('Show tables') . ': ' . htmlspecialchars($tbl_list) . '</strong>' . "\n"; echo '<hr />' . "\n"; } // end if @@ -84,7 +84,7 @@ foreach ($the_tables as $key => $table) { } $counter++; echo '<div' . $breakstyle . '>' . "\n"; - echo '<h1>' . $table . '</h1>' . "\n"; + echo '<h1>' . htmlspecialchars($table) . '</h1>' . "\n"; /** * Gets table informations hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin annotated tag, RELEASE_3_4_3_2, created. RELEASE_3_4_3_2
by Marc Delisle 23 Jul '11

23 Jul '11

The annotated tag, RELEASE_3_4_3_2 has been created at 7f397f585ce10cbcacfd4e96f4346167fc9de819 (tag) tagging ff536da86576efe733e4dfb5d69c8481ae590e2e (commit) replaces RELEASE_3_4_3_1 tagged by Marc Delisle on Sat Jul 23 08:43:26 2011 -0400 - Log ----------------------------------------------------------------- Released 3.4.3.2 Herman van Rink (5): Reverted some missing special chars in Changelog Another case of XSS Merge remote-tracking branch 'security/MAINT_3_4_3-security' into MAINT_3_4_3-security [security] Fixed local file inclusion vulnerability and code execution, see PMASA-2011-11 [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-12 Marc Delisle (6): XSS on table Print view ChangeLog for PMASA-2011-9 Local file inclusion vulnerability Fix broken characters 3.4.3.2 release date 3.4.3.2 release Michal Čihař (1): Pass token along with swekey auth requests ----------------------------------------------------------------------- hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_3_1-11737-g7e197b6
by Marc Delisle 23 Jul '11

23 Jul '11

The branch, master has been updated via 7e197b695e50f3ba751e48cc45f28ab397534f6f (commit) via 3534dda30a587eafe3bf5016f2fb302dbc224c2e (commit) via bd63726ee3daf32799f499b61d7cde973d8e8660 (commit) via 09c0f7ae557e40102fbfd23c4bea4939e19f0f29 (commit) via 571cdc6ff4bf375871b594f4e06f8ad3159d1754 (commit) via e7bb42c002885c2aca7aba4d431b8c63ae4de9b7 (commit) via 3ae58f0cd6b89ad4767920f9b214c38d3f6d4393 (commit) via 3caa6cbb7ed1b1933c3bded493a2fbc8273d746f (commit) via f63e1bb42a37401b2fdfcd2e66cce92b7ea2025c (commit) via 951fb4dd79253a3aca8b6e386db77c1affcfc3a9 (commit) via 4bd27166c314faa37cada91533b86377f4d4d214 (commit) via a0823be05aa5835f207c0838b9cca67d2d9a050a (commit) via d7cffc5dbde68342d46e891ea2c8bd72de134f43 (commit) from 5bc41ef1dc31019daaa0933bec967ebff63b55e0 (commit) - Log ----------------------------------------------------------------- commit 7e197b695e50f3ba751e48cc45f28ab397534f6f Merge: 5bc41ef1dc31019daaa0933bec967ebff63b55e0 3534dda30a587eafe3bf5016f2fb302dbc224c2e Author: Marc Delisle <marc(a)infomarc.info> Date: Sat Jul 23 08:25:49 2011 -0400 Fix merge conflicts ----------------------------------------------------------------------- Summary of changes: ChangeLog | 18 ++++++++++----- libraries/auth/swekey/swekey.auth.lib.php | 32 +++++++++++++++------------- libraries/schema/User_Schema.class.php | 7 ++++- schema_export.php | 4 ++- sql.php | 4 +- tbl_printview.php | 4 +- 6 files changed, 41 insertions(+), 28 deletions(-) diff --git a/ChangeLog b/ChangeLog index 16e3cac..feefa80 100644 --- a/ChangeLog +++ b/ChangeLog @@ -59,6 +59,12 @@ phpMyAdmin - ChangeLog - bug #3372807 [interface] Fix security warning link in setup - bug #3374347 [display] Backquotes in normal text on import page +3.4.3.2 (2011-07-23) +- [security] Fixed XSS vulnerability, see PMASA-2011-9 +- [security] Fixed local file inclusion vulnerability, see PMASA-2011-10 +- [security] Fixed local file inclusion vulnerability and code execution, see PMASA-2011-11 +- [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-12 + 3.4.3.1 (2011-07-02) - [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-5 - [security] Fixed possible code injection incase session variables are compromised, see PMASA-2011-6 @@ -153,7 +159,7 @@ phpMyAdmin - ChangeLog + patch #2974341 [structure] Clicking on table name in db Structure should Browse the table if possible, thanks to bhdouglass - dougboybhd + patch #2975533 [search] New search operators, thanks to - Martynas MickeviÄius + Martynas Mickevičius + patch #2967320 [designer] Colored relations based on the primary key, thanks to GreenRover - greenrover - [core] Provide way for vendors to easily change paths to config files. @@ -307,7 +313,7 @@ phpMyAdmin - ChangeLog 3.3.7.0 (2010-09-07) - patch #3050492 [PDF scratchboard] Cannot drag table box to the edge after - a page size increase, thanks to Martin SchÃ¶nberger - mad05 + a page size increase, thanks to Martin Schönberger - mad05 3.3.6.0 (2010-08-28) - bug #3033063 [core] Navi gets wrong db name @@ -328,7 +334,7 @@ phpMyAdmin - ChangeLog 3.3.5.0 (2010-07-26) - patch #2932113 [information_schema] Slow export when having lots of - databases, thanks to StÃ©phane Pontier - shadow_walker + databases, thanks to Stéphane Pontier - shadow_walker - bug #3022705 [import] Import button does not work in Catalan when there is no progress bar possible - bug [replication] Do not offer information_schema in the list of databases @@ -368,9 +374,9 @@ phpMyAdmin - ChangeLog - patch #2984893 [engines] InnoDB storage page emits a warning, thanks to Madhura Jayaratne - madhuracj - bug #2974687, bug #2974692 [compatibility] PHPExcel : IBM AIX iconv() does not work, - thanks to BjÃ¶rn Wiberg - bwiberg + thanks to Björn Wiberg - bwiberg - bug #2983066 [interface] Flush table on table operations shows the query twice, - thanks to Martynas MickeviÄius - BlinK_ + thanks to Martynas Mickevičius - BlinK_ - bug #2983060, patch #2987900 [interface] Fix initial state of tables in designer, thanks to Sutharshan Balachandren. - bug #2983062, patch #2989408 [engines] Fix warnings when changing table @@ -449,7 +455,7 @@ phpMyAdmin - ChangeLog + rfe #2839504 [engines] Support InnoDB plugin's new row formats + [core] Added ability for synchronizing databases among servers. + [lang] #2843101 Dutch update, thanks to scavenger2008 -+ [lang] Galician update, thanks to XosÃ© Calvo - xosecalvo ++ [lang] Galician update, thanks to Xosé Calvo - xosecalvo + [export] Added MediaWiki export module, thanks to Derek Schaefer - drummingds1 + [lang] Turkish update, thanks to Burak Yavuz diff --git a/libraries/auth/swekey/swekey.auth.lib.php b/libraries/auth/swekey/swekey.auth.lib.php index 184c845..fae3531 100644 --- a/libraries/auth/swekey/swekey.auth.lib.php +++ b/libraries/auth/swekey/swekey.auth.lib.php @@ -143,7 +143,9 @@ function Swekey_auth_error() return "Internal Error: CA File $caFile not found"; $result = null; - parse_str($_SERVER['QUERY_STRING']); + $swekey_id = $_GET['swekey_id']; + $swekey_otp = $_GET['swekey_otp']; + if (isset($swekey_id)) { unset($_SESSION['SWEKEY']['AUTHENTICATED_SWEKEY']); if (! isset($_SESSION['SWEKEY']['RND_TOKEN'])) { @@ -166,7 +168,7 @@ function Swekey_auth_error() $result = __('No valid authentication key plugged'); if ($_SESSION['SWEKEY']['CONF_DEBUG']) { - $result .= "<br>".$swekey_id; + $result .= "<br>" . htmlspecialchars($swekey_id); } unset($_SESSION['SWEKEY']['CONF_LOADED']); // reload the conf file } @@ -184,19 +186,19 @@ function Swekey_auth_error() if (! isset($swekey_id)) { ?> <script> - if (key.length != 32) - { - window.location.search="?swekey_id=" + key; - } - else - { - var url = "" + window.location; - if (url.indexOf("?") > 0) - url = url.substr(0, url.indexOf("?")); - Swekey_SetUnplugUrl(key, "pma_login", url + "?session_to_unset=<?php echo session_id();?>"); - var otp = Swekey_GetOtp(key, <?php echo '"'.$_SESSION['SWEKEY']['RND_TOKEN'].'"';?>); - window.location.search="?swekey_id=" + key + "&swekey_otp=" + otp; - } + if (key.length != 32) + { + window.location.search="?swekey_id=" + key + "&token=<?php echo $_SESSION[' PMA_token ']; ?>"; + } + else + { + var url = "" + window.location; + if (url.indexOf("?") > 0) + url = url.substr(0, url.indexOf("?")); + Swekey_SetUnplugUrl(key, "pma_login", url + "?session_to_unset=<?php echo session_id();?>&token=<?php echo $_SESSION[' PMA_token ']; ?>"); + var otp = Swekey_GetOtp(key, <?php echo '"'.$_SESSION['SWEKEY']['RND_TOKEN'].'"';?>); + window.location.search="?swekey_id=" + key + "&swekey_otp=" + otp + "&token=<?php echo $_SESSION[' PMA_token ']; ?>"; + } </script> <?php return __('Authenticating...'); diff --git a/libraries/schema/User_Schema.class.php b/libraries/schema/User_Schema.class.php index eb96835..aa39ec5 100644 --- a/libraries/schema/User_Schema.class.php +++ b/libraries/schema/User_Schema.class.php @@ -562,10 +562,13 @@ class PMA_User_Schema require_once './libraries/transformations.lib.php'; require_once './libraries/Index.class.php'; /** - * default is PDF + * default is PDF, otherwise validate it's only letters a-z */ global $db,$export_type; - $export_type = isset($export_type) ? $export_type : 'pdf'; + if (!isset($export_type) || !preg_match('/^[a-zA-Z]+$/', $export_type)) { + $export_type = 'pdf'; + } + PMA_DBI_select_db($db); include("./libraries/schema/".ucfirst($export_type)."_Relation_Schema.class.php"); diff --git a/schema_export.php b/schema_export.php index 0a21d32..3e1067d 100644 --- a/schema_export.php +++ b/schema_export.php @@ -37,7 +37,9 @@ include_once("./libraries/schema/Export_Relation_Schema.class.php"); * default is PDF */ global $db,$export_type; -$export_type = isset($export_type) ? $export_type : 'pdf'; +if (!isset($export_type) || !preg_match('/^[a-zA-Z]+$/', $export_type)) { + $export_type = 'pdf'; +} PMA_DBI_select_db($db); $path = PMA_securePath(ucfirst($export_type)); diff --git a/sql.php b/sql.php index 7ce5b24..4d22876 100644 --- a/sql.php +++ b/sql.php @@ -779,8 +779,8 @@ if (0 == $num_rows || $is_affected) { $edited_values = array(); parse_str($_REQUEST['transform_fields_list'], $edited_values); - foreach ($mime_map as $transformation) { - $include_file = $transformation['transformation']; + foreach($mime_map as $transformation) { + $include_file = PMA_securePath($transformation['transformation']); $column_name = $transformation['column_name']; $column_data = $edited_values[$column_name]; diff --git a/tbl_printview.php b/tbl_printview.php index 2e40587..9b7e7ff 100644 --- a/tbl_printview.php +++ b/tbl_printview.php @@ -69,7 +69,7 @@ if ($multi_tables) { $tbl_list .= (empty($tbl_list) ? '' : ', ') . PMA_backquote($table); } - echo '<strong>'. __('Show tables') . ': ' . $tbl_list . '</strong>' . "\n"; + echo '<strong>'. __('Show tables') . ': ' . htmlspecialchars($tbl_list) . '</strong>' . "\n"; echo '<hr />' . "\n"; } // end if @@ -84,7 +84,7 @@ foreach ($the_tables as $key => $table) { } $counter++; echo '<div' . $breakstyle . '>' . "\n"; - echo '<h1>' . $table . '</h1>' . "\n"; + echo '<h1>' . htmlspecialchars($table) . '</h1>' . "\n"; /** * Gets table informations hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_4, updated. RELEASE_3_4_3_1-53-g3534dda
by Marc Delisle 23 Jul '11

23 Jul '11

The branch, QA_3_4 has been updated via 3534dda30a587eafe3bf5016f2fb302dbc224c2e (commit) via bd63726ee3daf32799f499b61d7cde973d8e8660 (commit) via 09c0f7ae557e40102fbfd23c4bea4939e19f0f29 (commit) via 571cdc6ff4bf375871b594f4e06f8ad3159d1754 (commit) via e7bb42c002885c2aca7aba4d431b8c63ae4de9b7 (commit) via 3ae58f0cd6b89ad4767920f9b214c38d3f6d4393 (commit) via 3caa6cbb7ed1b1933c3bded493a2fbc8273d746f (commit) via f63e1bb42a37401b2fdfcd2e66cce92b7ea2025c (commit) via 951fb4dd79253a3aca8b6e386db77c1affcfc3a9 (commit) via 4bd27166c314faa37cada91533b86377f4d4d214 (commit) via a0823be05aa5835f207c0838b9cca67d2d9a050a (commit) via d7cffc5dbde68342d46e891ea2c8bd72de134f43 (commit) from 06bfdd7ca6d76335f45d53134770979d7d25d739 (commit) - Log ----------------------------------------------------------------- ----------------------------------------------------------------------- Summary of changes: ChangeLog | 18 ++++++++++++------ libraries/auth/swekey/swekey.auth.lib.php | 12 +++++++----- libraries/schema/User_Schema.class.php | 7 +++++-- schema_export.php | 4 +++- sql.php | 2 +- tbl_printview.php | 4 ++-- 6 files changed, 30 insertions(+), 17 deletions(-) diff --git a/ChangeLog b/ChangeLog index 021c2cc..02db31c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -19,6 +19,12 @@ phpMyAdmin - ChangeLog - bug #3372807 [interface] Fix security warning link in setup - bug #3374347 [display] Backquotes in normal text on import page +3.4.3.2 (2011-07-23) +- [security] Fixed XSS vulnerability, see PMASA-2011-9 +- [security] Fixed local file inclusion vulnerability, see PMASA-2011-10 +- [security] Fixed local file inclusion vulnerability and code execution, see PMASA-2011-11 +- [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-12 + 3.4.3.1 (2011-07-02) - [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-5 - [security] Fixed possible code injection incase session variables are compromised, see PMASA-2011-6 @@ -113,7 +119,7 @@ phpMyAdmin - ChangeLog + patch #2974341 [structure] Clicking on table name in db Structure should Browse the table if possible, thanks to bhdouglass - dougboybhd + patch #2975533 [search] New search operators, thanks to - Martynas MickeviÄius + Martynas Mickevičius + patch #2967320 [designer] Colored relations based on the primary key, thanks to GreenRover - greenrover - [core] Provide way for vendors to easily change paths to config files. @@ -267,7 +273,7 @@ phpMyAdmin - ChangeLog 3.3.7.0 (2010-09-07) - patch #3050492 [PDF scratchboard] Cannot drag table box to the edge after - a page size increase, thanks to Martin SchÃ¶nberger - mad05 + a page size increase, thanks to Martin Schönberger - mad05 3.3.6.0 (2010-08-28) - bug #3033063 [core] Navi gets wrong db name @@ -288,7 +294,7 @@ phpMyAdmin - ChangeLog 3.3.5.0 (2010-07-26) - patch #2932113 [information_schema] Slow export when having lots of - databases, thanks to StÃ©phane Pontier - shadow_walker + databases, thanks to Stéphane Pontier - shadow_walker - bug #3022705 [import] Import button does not work in Catalan when there is no progress bar possible - bug [replication] Do not offer information_schema in the list of databases @@ -328,9 +334,9 @@ phpMyAdmin - ChangeLog - patch #2984893 [engines] InnoDB storage page emits a warning, thanks to Madhura Jayaratne - madhuracj - bug #2974687, bug #2974692 [compatibility] PHPExcel : IBM AIX iconv() does not work, - thanks to BjÃ¶rn Wiberg - bwiberg + thanks to Björn Wiberg - bwiberg - bug #2983066 [interface] Flush table on table operations shows the query twice, - thanks to Martynas MickeviÄius - BlinK_ + thanks to Martynas Mickevičius - BlinK_ - bug #2983060, patch #2987900 [interface] Fix initial state of tables in designer, thanks to Sutharshan Balachandren. - bug #2983062, patch #2989408 [engines] Fix warnings when changing table @@ -409,7 +415,7 @@ phpMyAdmin - ChangeLog + rfe #2839504 [engines] Support InnoDB plugin's new row formats + [core] Added ability for synchronizing databases among servers. + [lang] #2843101 Dutch update, thanks to scavenger2008 -+ [lang] Galician update, thanks to XosÃ© Calvo - xosecalvo ++ [lang] Galician update, thanks to Xosé Calvo - xosecalvo + [export] Added MediaWiki export module, thanks to Derek Schaefer - drummingds1 + [lang] Turkish update, thanks to Burak Yavuz diff --git a/libraries/auth/swekey/swekey.auth.lib.php b/libraries/auth/swekey/swekey.auth.lib.php index c5f613b..8ec5ab4 100644 --- a/libraries/auth/swekey/swekey.auth.lib.php +++ b/libraries/auth/swekey/swekey.auth.lib.php @@ -143,7 +143,9 @@ function Swekey_auth_error() return "Internal Error: CA File $caFile not found"; $result = null; - parse_str($_SERVER['QUERY_STRING']); + $swekey_id = $_GET['swekey_id']; + $swekey_otp = $_GET['swekey_otp']; + if (isset($swekey_id)) { unset($_SESSION['SWEKEY']['AUTHENTICATED_SWEKEY']); if (! isset($_SESSION['SWEKEY']['RND_TOKEN'])) { @@ -166,7 +168,7 @@ function Swekey_auth_error() $result = __('No valid authentication key plugged'); if ($_SESSION['SWEKEY']['CONF_DEBUG']) { - $result .= "<br>".$swekey_id; + $result .= "<br>" . htmlspecialchars($swekey_id); } unset($_SESSION['SWEKEY']['CONF_LOADED']); // reload the conf file } @@ -186,16 +188,16 @@ function Swekey_auth_error() <script> if (key.length != 32) { - window.location.search="?swekey_id=" + key; + window.location.search="?swekey_id=" + key + "&token=<?php echo $_SESSION[' PMA_token ']; ?>"; } else { var url = "" + window.location; if (url.indexOf("?") > 0) url = url.substr(0, url.indexOf("?")); - Swekey_SetUnplugUrl(key, "pma_login", url + "?session_to_unset=<?php echo session_id();?>"); + Swekey_SetUnplugUrl(key, "pma_login", url + "?session_to_unset=<?php echo session_id();?>&token=<?php echo $_SESSION[' PMA_token ']; ?>"); var otp = Swekey_GetOtp(key, <?php echo '"'.$_SESSION['SWEKEY']['RND_TOKEN'].'"';?>); - window.location.search="?swekey_id=" + key + "&swekey_otp=" + otp; + window.location.search="?swekey_id=" + key + "&swekey_otp=" + otp + "&token=<?php echo $_SESSION[' PMA_token ']; ?>"; } </script> <?php diff --git a/libraries/schema/User_Schema.class.php b/libraries/schema/User_Schema.class.php index fbec138..cb42dde 100644 --- a/libraries/schema/User_Schema.class.php +++ b/libraries/schema/User_Schema.class.php @@ -567,10 +567,13 @@ class PMA_User_Schema require_once './libraries/transformations.lib.php'; require_once './libraries/Index.class.php'; /** - * default is PDF + * default is PDF, otherwise validate it's only letters a-z */ global $db,$export_type; - $export_type = isset($export_type) ? $export_type : 'pdf'; + if (!isset($export_type) || !preg_match('/^[a-zA-Z]+$/', $export_type)) { + $export_type = 'pdf'; + } + PMA_DBI_select_db($db); include("./libraries/schema/".ucfirst($export_type)."_Relation_Schema.class.php"); diff --git a/schema_export.php b/schema_export.php index 0a21d32..3e1067d 100644 --- a/schema_export.php +++ b/schema_export.php @@ -37,7 +37,9 @@ include_once("./libraries/schema/Export_Relation_Schema.class.php"); * default is PDF */ global $db,$export_type; -$export_type = isset($export_type) ? $export_type : 'pdf'; +if (!isset($export_type) || !preg_match('/^[a-zA-Z]+$/', $export_type)) { + $export_type = 'pdf'; +} PMA_DBI_select_db($db); $path = PMA_securePath(ucfirst($export_type)); diff --git a/sql.php b/sql.php index 10e472a..83900ab 100644 --- a/sql.php +++ b/sql.php @@ -719,7 +719,7 @@ if (0 == $num_rows || $is_affected) { parse_str($_REQUEST['transform_fields_list'], $edited_values); foreach($mime_map as $transformation) { - $include_file = $transformation['transformation']; + $include_file = PMA_securePath($transformation['transformation']); $column_name = $transformation['column_name']; $column_data = $edited_values[$column_name]; diff --git a/tbl_printview.php b/tbl_printview.php index 74b6818..ce007d1 100644 --- a/tbl_printview.php +++ b/tbl_printview.php @@ -69,7 +69,7 @@ if ($multi_tables) { $tbl_list .= (empty($tbl_list) ? '' : ', ') . PMA_backquote($table); } - echo '<strong>'. __('Show tables') . ': ' . $tbl_list . '</strong>' . "\n"; + echo '<strong>'. __('Show tables') . ': ' . htmlspecialchars($tbl_list) . '</strong>' . "\n"; echo '<hr />' . "\n"; } // end if @@ -84,7 +84,7 @@ foreach ($the_tables as $key => $table) { } $counter++; echo '<div' . $breakstyle . '>' . "\n"; - echo '<h1>' . $table . '</h1>' . "\n"; + echo '<h1>' . htmlspecialchars($table) . '</h1>' . "\n"; /** * Gets table informations hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, MAINT_3_4_3, updated. RELEASE_3_4_3_1-12-gff536da
by Marc Delisle 23 Jul '11

23 Jul '11

The branch, MAINT_3_4_3 has been updated via ff536da86576efe733e4dfb5d69c8481ae590e2e (commit) via bd63726ee3daf32799f499b61d7cde973d8e8660 (commit) via 09c0f7ae557e40102fbfd23c4bea4939e19f0f29 (commit) via 571cdc6ff4bf375871b594f4e06f8ad3159d1754 (commit) via e7bb42c002885c2aca7aba4d431b8c63ae4de9b7 (commit) via 3ae58f0cd6b89ad4767920f9b214c38d3f6d4393 (commit) via 3caa6cbb7ed1b1933c3bded493a2fbc8273d746f (commit) via f63e1bb42a37401b2fdfcd2e66cce92b7ea2025c (commit) via 951fb4dd79253a3aca8b6e386db77c1affcfc3a9 (commit) via 4bd27166c314faa37cada91533b86377f4d4d214 (commit) via a0823be05aa5835f207c0838b9cca67d2d9a050a (commit) via d7cffc5dbde68342d46e891ea2c8bd72de134f43 (commit) from e214683f9fe4955dcbf0ffce045983728c7fa9d3 (commit) - Log ----------------------------------------------------------------- commit ff536da86576efe733e4dfb5d69c8481ae590e2e Author: Marc Delisle <marc(a)infomarc.info> Date: Sat Jul 23 08:32:25 2011 -0400 3.4.3.2 release ----------------------------------------------------------------------- Summary of changes: ChangeLog | 18 ++++++++++++------ Documentation.html | 4 ++-- README | 2 +- libraries/Config.class.php | 2 +- libraries/auth/swekey/swekey.auth.lib.php | 12 +++++++----- libraries/schema/User_Schema.class.php | 7 +++++-- schema_export.php | 4 +++- sql.php | 2 +- tbl_printview.php | 4 ++-- 9 files changed, 34 insertions(+), 21 deletions(-) diff --git a/ChangeLog b/ChangeLog index fe71031..05d5fe5 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,12 @@ phpMyAdmin - ChangeLog ====================== +3.4.3.2 (2011-07-23) +- [security] Fixed XSS vulnerability, see PMASA-2011-9 +- [security] Fixed local file inclusion vulnerability, see PMASA-2011-10 +- [security] Fixed local file inclusion vulnerability and code execution, see PMASA-2011-11 +- [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-12 + 3.4.3.1 (2011-07-02) - [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-5 - [security] Fixed possible code injection incase session variables are compromised, see PMASA-2011-6 @@ -95,7 +101,7 @@ phpMyAdmin - ChangeLog + patch #2974341 [structure] Clicking on table name in db Structure should Browse the table if possible, thanks to bhdouglass - dougboybhd + patch #2975533 [search] New search operators, thanks to - Martynas MickeviÄius + Martynas Mickevičius + patch #2967320 [designer] Colored relations based on the primary key, thanks to GreenRover - greenrover - [core] Provide way for vendors to easily change paths to config files. @@ -249,7 +255,7 @@ phpMyAdmin - ChangeLog 3.3.7.0 (2010-09-07) - patch #3050492 [PDF scratchboard] Cannot drag table box to the edge after - a page size increase, thanks to Martin SchÃ¶nberger - mad05 + a page size increase, thanks to Martin Schönberger - mad05 3.3.6.0 (2010-08-28) - bug #3033063 [core] Navi gets wrong db name @@ -270,7 +276,7 @@ phpMyAdmin - ChangeLog 3.3.5.0 (2010-07-26) - patch #2932113 [information_schema] Slow export when having lots of - databases, thanks to StÃ©phane Pontier - shadow_walker + databases, thanks to Stéphane Pontier - shadow_walker - bug #3022705 [import] Import button does not work in Catalan when there is no progress bar possible - bug [replication] Do not offer information_schema in the list of databases @@ -310,9 +316,9 @@ phpMyAdmin - ChangeLog - patch #2984893 [engines] InnoDB storage page emits a warning, thanks to Madhura Jayaratne - madhuracj - bug #2974687, bug #2974692 [compatibility] PHPExcel : IBM AIX iconv() does not work, - thanks to BjÃ¶rn Wiberg - bwiberg + thanks to Björn Wiberg - bwiberg - bug #2983066 [interface] Flush table on table operations shows the query twice, - thanks to Martynas MickeviÄius - BlinK_ + thanks to Martynas Mickevičius - BlinK_ - bug #2983060, patch #2987900 [interface] Fix initial state of tables in designer, thanks to Sutharshan Balachandren. - bug #2983062, patch #2989408 [engines] Fix warnings when changing table @@ -391,7 +397,7 @@ phpMyAdmin - ChangeLog + rfe #2839504 [engines] Support InnoDB plugin's new row formats + [core] Added ability for synchronizing databases among servers. + [lang] #2843101 Dutch update, thanks to scavenger2008 -+ [lang] Galician update, thanks to XosÃ© Calvo - xosecalvo ++ [lang] Galician update, thanks to Xosé Calvo - xosecalvo + [export] Added MediaWiki export module, thanks to Derek Schaefer - drummingds1 + [lang] Turkish update, thanks to Burak Yavuz diff --git a/Documentation.html b/Documentation.html index 25b9731..15f8000 100644 --- a/Documentation.html +++ b/Documentation.html @@ -9,7 +9,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <link rel="icon" href="./favicon.ico" type="image/x-icon" /> <link rel="shortcut icon" href="./favicon.ico" type="image/x-icon" /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> - <title>phpMyAdmin 3.4.3.1 - Documentation</title> + <title>phpMyAdmin 3.4.3.2 - Documentation</title> <link rel="stylesheet" type="text/css" href="docs.css" /> </head> @@ -17,7 +17,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <div id="header"> <h1> <a href="http://www.phpmyadmin.net/">php<span class="myadmin">MyAdmin</span></a> - 3.4.3.1 + 3.4.3.2 Documentation </h1> </div> diff --git a/README b/README index e57152a..65f7c52 100644 --- a/README +++ b/README @@ -1,7 +1,7 @@ phpMyAdmin - Readme =================== -Version 3.4.3.1 +Version 3.4.3.2 A set of PHP-scripts to manage MySQL over the web. diff --git a/libraries/Config.class.php b/libraries/Config.class.php index 28625f2..0cec6a9 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -96,7 +96,7 @@ class PMA_Config */ function checkSystem() { - $this->set('PMA_VERSION', '3.4.3.1'); + $this->set('PMA_VERSION', '3.4.3.2'); /** * @deprecated */ diff --git a/libraries/auth/swekey/swekey.auth.lib.php b/libraries/auth/swekey/swekey.auth.lib.php index c5f613b..8ec5ab4 100644 --- a/libraries/auth/swekey/swekey.auth.lib.php +++ b/libraries/auth/swekey/swekey.auth.lib.php @@ -143,7 +143,9 @@ function Swekey_auth_error() return "Internal Error: CA File $caFile not found"; $result = null; - parse_str($_SERVER['QUERY_STRING']); + $swekey_id = $_GET['swekey_id']; + $swekey_otp = $_GET['swekey_otp']; + if (isset($swekey_id)) { unset($_SESSION['SWEKEY']['AUTHENTICATED_SWEKEY']); if (! isset($_SESSION['SWEKEY']['RND_TOKEN'])) { @@ -166,7 +168,7 @@ function Swekey_auth_error() $result = __('No valid authentication key plugged'); if ($_SESSION['SWEKEY']['CONF_DEBUG']) { - $result .= "<br>".$swekey_id; + $result .= "<br>" . htmlspecialchars($swekey_id); } unset($_SESSION['SWEKEY']['CONF_LOADED']); // reload the conf file } @@ -186,16 +188,16 @@ function Swekey_auth_error() <script> if (key.length != 32) { - window.location.search="?swekey_id=" + key; + window.location.search="?swekey_id=" + key + "&token=<?php echo $_SESSION[' PMA_token ']; ?>"; } else { var url = "" + window.location; if (url.indexOf("?") > 0) url = url.substr(0, url.indexOf("?")); - Swekey_SetUnplugUrl(key, "pma_login", url + "?session_to_unset=<?php echo session_id();?>"); + Swekey_SetUnplugUrl(key, "pma_login", url + "?session_to_unset=<?php echo session_id();?>&token=<?php echo $_SESSION[' PMA_token ']; ?>"); var otp = Swekey_GetOtp(key, <?php echo '"'.$_SESSION['SWEKEY']['RND_TOKEN'].'"';?>); - window.location.search="?swekey_id=" + key + "&swekey_otp=" + otp; + window.location.search="?swekey_id=" + key + "&swekey_otp=" + otp + "&token=<?php echo $_SESSION[' PMA_token ']; ?>"; } </script> <?php diff --git a/libraries/schema/User_Schema.class.php b/libraries/schema/User_Schema.class.php index fbec138..cb42dde 100644 --- a/libraries/schema/User_Schema.class.php +++ b/libraries/schema/User_Schema.class.php @@ -567,10 +567,13 @@ class PMA_User_Schema require_once './libraries/transformations.lib.php'; require_once './libraries/Index.class.php'; /** - * default is PDF + * default is PDF, otherwise validate it's only letters a-z */ global $db,$export_type; - $export_type = isset($export_type) ? $export_type : 'pdf'; + if (!isset($export_type) || !preg_match('/^[a-zA-Z]+$/', $export_type)) { + $export_type = 'pdf'; + } + PMA_DBI_select_db($db); include("./libraries/schema/".ucfirst($export_type)."_Relation_Schema.class.php"); diff --git a/schema_export.php b/schema_export.php index 0a21d32..3e1067d 100644 --- a/schema_export.php +++ b/schema_export.php @@ -37,7 +37,9 @@ include_once("./libraries/schema/Export_Relation_Schema.class.php"); * default is PDF */ global $db,$export_type; -$export_type = isset($export_type) ? $export_type : 'pdf'; +if (!isset($export_type) || !preg_match('/^[a-zA-Z]+$/', $export_type)) { + $export_type = 'pdf'; +} PMA_DBI_select_db($db); $path = PMA_securePath(ucfirst($export_type)); diff --git a/sql.php b/sql.php index 9b19174..eb9254f 100644 --- a/sql.php +++ b/sql.php @@ -719,7 +719,7 @@ if (0 == $num_rows || $is_affected) { parse_str($_REQUEST['transform_fields_list'], $edited_values); foreach($mime_map as $transformation) { - $include_file = $transformation['transformation']; + $include_file = PMA_securePath($transformation['transformation']); $column_name = $transformation['column_name']; $column_data = $edited_values[$column_name]; diff --git a/tbl_printview.php b/tbl_printview.php index 74b6818..ce007d1 100644 --- a/tbl_printview.php +++ b/tbl_printview.php @@ -69,7 +69,7 @@ if ($multi_tables) { $tbl_list .= (empty($tbl_list) ? '' : ', ') . PMA_backquote($table); } - echo '<strong>'. __('Show tables') . ': ' . $tbl_list . '</strong>' . "\n"; + echo '<strong>'. __('Show tables') . ': ' . htmlspecialchars($tbl_list) . '</strong>' . "\n"; echo '<hr />' . "\n"; } // end if @@ -84,7 +84,7 @@ foreach ($the_tables as $key => $table) { } $counter++; echo '<div' . $breakstyle . '>' . "\n"; - echo '<h1>' . $table . '</h1>' . "\n"; + echo '<h1>' . htmlspecialchars($table) . '</h1>' . "\n"; /** * Gets table informations hooks/post-receive -- phpMyAdmin

1 0