- Git - lists.phpmyadmin.net

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_4, updated. RELEASE_3_4_7-31-g849b681
by Marc Delisle 10 Nov '11

10 Nov '11

The branch, QA_3_4 has been updated via 849b6818f81cae1d5ae0a6857b6e5839a8b3ea10 (commit) from e51a1cb73df8f3706fe0bb50ccdcae7fa2f893eb (commit) - Log ----------------------------------------------------------------- commit 849b6818f81cae1d5ae0a6857b6e5839a8b3ea10 Author: Marc Delisle <marc(a)infomarc.info> Date: Thu Nov 10 09:09:17 2011 -0500 3.4.7.1 release ----------------------------------------------------------------------- Summary of changes: ChangeLog | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/ChangeLog b/ChangeLog index 5836756..b18adfd 100644 --- a/ChangeLog +++ b/ChangeLog @@ -13,7 +13,7 @@ phpMyAdmin - ChangeLog - patch #3430291 [import] Handle conflicts in some open_basedir situations - bug #3431427 [display] Dropdown results - setting NULL does not work -3.4.7.1 (not yet released) +3.4.7.1 (2011-11-10) - [security] Fixed possible local file inclusion in XML import (CVE-2011-4107). hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, MAINT_3_4_7, updated. RELEASE_3_4_7-8-gec040a1
by Marc Delisle 10 Nov '11

10 Nov '11

The branch, MAINT_3_4_7 has been updated via ec040a1b6e9d19bf3439e3f8931a4d63720ce867 (commit) from 1b8f5a5c098905997a3072170d773a073331f7f6 (commit) - Log ----------------------------------------------------------------- commit ec040a1b6e9d19bf3439e3f8931a4d63720ce867 Author: Marc Delisle <marc(a)infomarc.info> Date: Thu Nov 10 09:08:43 2011 -0500 3.4.7.1 release ----------------------------------------------------------------------- Summary of changes: ChangeLog | 2 +- Documentation.html | 4 ++-- README | 2 +- libraries/Config.class.php | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/ChangeLog b/ChangeLog index 0ccfc21..6ada51e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,7 +1,7 @@ phpMyAdmin - ChangeLog ====================== -3.4.7.1 (not yet released) +3.4.7.1 (2011-11-10) - [security] Fixed possible local file inclusion in XML import (CVE-2011-4107). 3.4.7.0 (2011-10-23) diff --git a/Documentation.html b/Documentation.html index d376f73..083da6e 100644 --- a/Documentation.html +++ b/Documentation.html @@ -9,7 +9,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <link rel="icon" href="./favicon.ico" type="image/x-icon" /> <link rel="shortcut icon" href="./favicon.ico" type="image/x-icon" /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> - <title>phpMyAdmin 3.4.7 - Documentation</title> + <title>phpMyAdmin 3.4.7.1 - Documentation</title> <link rel="stylesheet" type="text/css" href="docs.css" /> </head> @@ -17,7 +17,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <div id="header"> <h1> <a href="http://www.phpmyadmin.net/">php<span class="myadmin">MyAdmin</span></a> - 3.4.7 + 3.4.7.1 Documentation </h1> </div> diff --git a/README b/README index ae117eb..488cb04 100644 --- a/README +++ b/README @@ -1,7 +1,7 @@ phpMyAdmin - Readme =================== -Version 3.4.7 +Version 3.4.7.1 A set of PHP-scripts to manage MySQL over the web. diff --git a/libraries/Config.class.php b/libraries/Config.class.php index 824d04c..f42ad6e 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -96,7 +96,7 @@ class PMA_Config */ function checkSystem() { - $this->set('PMA_VERSION', '3.4.7'); + $this->set('PMA_VERSION', '3.4.7.1'); /** * @deprecated */ hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_7-22595-g839c0d4
by Marc Delisle 10 Nov '11

10 Nov '11

The branch, master has been updated via 839c0d493aedbfb031752b706acd550790f72019 (commit) via e51a1cb73df8f3706fe0bb50ccdcae7fa2f893eb (commit) via f674e3dbe952d9c4a7864067d7c286e9b01f527a (commit) via 1b8f5a5c098905997a3072170d773a073331f7f6 (commit) via edea25b07b51c2c5e277323f8047fcd82e695f7e (commit) via 05f96b921a7e7dacd02be5ca61b2e7bdd014ee55 (commit) via 4dd5c0d0dc413d2cb2cfcb31f8d4aec0c753033c (commit) via 063e6f92929c3aed3641cf79add4128c7e972d2f (commit) via 34d99de000de9d15cfdf5e9cc8b7682d51110bbd (commit) via a5e206fbd2ca814042cfc1bb7dd3b40c28ce3fb5 (commit) from f49fe427f534350e029f0b08627e6ce565368de8 (commit) - Log ----------------------------------------------------------------- commit 839c0d493aedbfb031752b706acd550790f72019 Merge: f49fe42 e51a1cb Author: Marc Delisle <marc(a)infomarc.info> Date: Thu Nov 10 09:00:13 2011 -0500 Merge branch 'QA_3_4' ----------------------------------------------------------------------- Summary of changes: ChangeLog | 4 ++++ Documentation.html | 3 +++ libraries/import/ods.php | 12 ++++++++++++ libraries/import/xml.php | 12 ++++++++++++ 4 files changed, 31 insertions(+), 0 deletions(-) diff --git a/ChangeLog b/ChangeLog index d8b0494..6e2fd10 100644 --- a/ChangeLog +++ b/ChangeLog @@ -70,6 +70,10 @@ phpMyAdmin - ChangeLog - patch #3430291 [import] Handle conflicts in some open_basedir situations - bug #3431427 [display] Dropdown results - setting NULL does not work +3.4.7.1 (not yet released) +- [security] Fixed possible local file inclusion in XML import +(CVE-2011-4107). + 3.4.7.0 (2011-10-23) - bug #3418610 [interface] Links in navigation when $cfg['MainPageIconic'] = false - bug #3418849 [interface] Inline edit shows dropdowns even after closing diff --git a/Documentation.html b/Documentation.html index c31706a..458108c 100644 --- a/Documentation.html +++ b/Documentation.html @@ -82,6 +82,9 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <li>To support BLOB streaming, see PHP and MySQL requirements in <a href="#faq6_25"> <abbr title="Frequently Asked Questions">FAQ</abbr> 6.25</a>.</li> + <li>To support XML and Open Document Spreadsheet importing, + you need PHP 5.2.17 or newer and the + <a href="http://www.php.net/libxml"><tt>libxml</tt></a> extension.</li> </ul> </li> <li><b>MySQL</b> 5.0 or newer (<a href="#faq1_17">details</a>);</li> diff --git a/libraries/import/ods.php b/libraries/import/ods.php index fc1c177..8af40f4 100644 --- a/libraries/import/ods.php +++ b/libraries/import/ods.php @@ -14,6 +14,13 @@ if (! defined('PHPMYADMIN')) { } /** + * We need way to disable external XML entities processing. + */ +if (!function_exists('libxml_disable_entity_loader')) { + return; +} + +/** * The possible scopes for $plugin_param are: 'table', 'database', and 'server' */ @@ -61,6 +68,11 @@ while (! ($finished && $i >= $len) && ! $error && ! $timeout_passed) { unset($data); /** + * Disable loading of external XML entities. + */ +libxml_disable_entity_loader(); + +/** * Load the XML string * * The option LIBXML_COMPACT is specified because it can diff --git a/libraries/import/xml.php b/libraries/import/xml.php index a3768cd..727c63b 100644 --- a/libraries/import/xml.php +++ b/libraries/import/xml.php @@ -13,6 +13,13 @@ if (! defined('PHPMYADMIN')) { } /** + * We need way to disable external XML entities processing. + */ +if (!function_exists('libxml_disable_entity_loader')) { + return; +} + +/** * The possible scopes for $plugin_param are: 'table', 'database', and 'server' */ @@ -54,6 +61,11 @@ while (! ($finished && $i >= $len) && ! $error && ! $timeout_passed) { unset($data); /** + * Disable loading of external XML entities. + */ +libxml_disable_entity_loader(); + +/** * Load the XML string * * The option LIBXML_COMPACT is specified because it can hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_4, updated. RELEASE_3_4_7-30-ge51a1cb
by Marc Delisle 10 Nov '11

10 Nov '11

The branch, QA_3_4 has been updated via e51a1cb73df8f3706fe0bb50ccdcae7fa2f893eb (commit) via f674e3dbe952d9c4a7864067d7c286e9b01f527a (commit) via 1b8f5a5c098905997a3072170d773a073331f7f6 (commit) via edea25b07b51c2c5e277323f8047fcd82e695f7e (commit) via 05f96b921a7e7dacd02be5ca61b2e7bdd014ee55 (commit) via 4dd5c0d0dc413d2cb2cfcb31f8d4aec0c753033c (commit) via 063e6f92929c3aed3641cf79add4128c7e972d2f (commit) via 34d99de000de9d15cfdf5e9cc8b7682d51110bbd (commit) via a5e206fbd2ca814042cfc1bb7dd3b40c28ce3fb5 (commit) from bd0ad7377e92325d92d1de40ba52b8e89bc19664 (commit) - Log ----------------------------------------------------------------- ----------------------------------------------------------------------- Summary of changes: ChangeLog | 4 +++ Documentation.html | 3 ++ libraries/import/ods.php | 12 +++++++++++ libraries/import/xml.php | 50 ++++++++++++++++++++++++++++----------------- 4 files changed, 50 insertions(+), 19 deletions(-) diff --git a/ChangeLog b/ChangeLog index bab9d7b..5836756 100644 --- a/ChangeLog +++ b/ChangeLog @@ -13,6 +13,10 @@ phpMyAdmin - ChangeLog - patch #3430291 [import] Handle conflicts in some open_basedir situations - bug #3431427 [display] Dropdown results - setting NULL does not work +3.4.7.1 (not yet released) +- [security] Fixed possible local file inclusion in XML import +(CVE-2011-4107). + 3.4.7.0 (2011-10-23) - bug #3418610 [interface] Links in navigation when $cfg['MainPageIconic'] = false - bug #3418849 [interface] Inline edit shows dropdowns even after closing diff --git a/Documentation.html b/Documentation.html index c8afb33..41e42aa 100644 --- a/Documentation.html +++ b/Documentation.html @@ -82,6 +82,9 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <li>To support BLOB streaming, see PHP and MySQL requirements in <a href="#faq6_25"> <abbr title="Frequently Asked Questions">FAQ</abbr> 6.25</a>.</li> + <li>To support XML and Open Document Spreadsheet importing, + you need PHP 5.2.17 or newer and the + <a href="http://www.php.net/libxml"><tt>libxml</tt></a> extension.</li> </ul> </li> <li><b>MySQL</b> 5.0 or newer (<a href="#faq1_17">details</a>);</li> diff --git a/libraries/import/ods.php b/libraries/import/ods.php index d50bee9..cd48f68 100644 --- a/libraries/import/ods.php +++ b/libraries/import/ods.php @@ -14,6 +14,13 @@ if (! defined('PHPMYADMIN')) { } /** + * We need way to disable external XML entities processing. + */ +if (!function_exists('libxml_disable_entity_loader')) { + return; +} + +/** * The possible scopes for $plugin_param are: 'table', 'database', and 'server' */ @@ -61,6 +68,11 @@ while (! ($finished && $i >= $len) && ! $error && ! $timeout_passed) { unset($data); /** + * Disable loading of external XML entities. + */ +libxml_disable_entity_loader(); + +/** * Load the XML string * * The option LIBXML_COMPACT is specified because it can diff --git a/libraries/import/xml.php b/libraries/import/xml.php index 36af788..0afbd15 100644 --- a/libraries/import/xml.php +++ b/libraries/import/xml.php @@ -13,6 +13,13 @@ if (! defined('PHPMYADMIN')) { } /** + * We need way to disable external XML entities processing. + */ +if (!function_exists('libxml_disable_entity_loader')) { + return; +} + +/** * The possible scopes for $plugin_param are: 'table', 'database', and 'server' */ @@ -54,6 +61,11 @@ while (! ($finished && $i >= $len) && ! $error && ! $timeout_passed) { unset($data); /** + * Disable loading of external XML entities. + */ +libxml_disable_entity_loader(); + +/** * Load the XML string * * The option LIBXML_COMPACT is specified because it can @@ -138,19 +150,19 @@ if (isset($namespaces['pma'])) { * Get structures for all tables */ $struct = $xml->children($namespaces['pma']); - + $create = array(); - + foreach ($struct as $tier1 => $val1) { foreach($val1 as $tier2 => $val2) { /* Need to select the correct database for the creation of tables, views, triggers, etc. */ /** - * @todo Generating a USE here blocks importing of a table - * into another database. + * @todo Generating a USE here blocks importing of a table + * into another database. */ $attrs = $val2->attributes(); $create[] = "USE " . PMA_backquote($attrs["name"]); - + foreach ($val2 as $val3) { /** * Remove the extra cosmetic spacing @@ -160,7 +172,7 @@ if (isset($namespaces['pma'])) { } } } - + $struct_present = true; } @@ -176,13 +188,13 @@ $data_present = false; */ if (@count($xml->children())) { $data_present = true; - + /** * Process all database content */ foreach ($xml as $k1 => $v1) { $tbl_attr = $v1->attributes(); - + $isInTables = false; for ($i = 0; $i < count($tables); ++$i) { if (! strcmp($tables[$i][TBL_NAME], (string)$tbl_attr['name'])) { @@ -190,11 +202,11 @@ if (@count($xml->children())) { break; } } - + if ($isInTables == false) { $tables[] = array((string)$tbl_attr['name']); } - + foreach ($v1 as $k2 => $v2) { $row_attr = $v2->attributes(); if (! array_search((string)$row_attr['name'], $tempRow)) @@ -203,17 +215,17 @@ if (@count($xml->children())) { } $tempCells[] = (string)$v2; } - + $rows[] = array((string)$tbl_attr['name'], $tempRow, $tempCells); - + $tempRow = array(); $tempCells = array(); } - + unset($tempRow); unset($tempCells); unset($xml); - + /** * Bring accumulated rows into the corresponding table */ @@ -224,17 +236,17 @@ if (@count($xml->children())) { if (! isset($tables[$i][COL_NAMES])) { $tables[$i][] = $rows[$j][COL_NAMES]; } - + $tables[$i][ROWS][] = $rows[$j][ROWS]; } } } - + unset($rows); - + if (! $struct_present) { $analyses = array(); - + $len = count($tables); for ($i = 0; $i < $len; ++$i) { $analyses[] = PMA_analyzeTable($tables[$i]); @@ -286,7 +298,7 @@ if (strlen($db)) { if ($db_name === NULL) { $db_name = 'XML_DB'; } - + /* Set database collation/charset */ $options = array( 'db_collation' => $collation, hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, MAINT_3_4_7, updated. RELEASE_3_4_7-7-g1b8f5a5
by Marc Delisle 10 Nov '11

10 Nov '11

The branch, MAINT_3_4_7 has been updated via 1b8f5a5c098905997a3072170d773a073331f7f6 (commit) via 05f96b921a7e7dacd02be5ca61b2e7bdd014ee55 (commit) via 4dd5c0d0dc413d2cb2cfcb31f8d4aec0c753033c (commit) via 063e6f92929c3aed3641cf79add4128c7e972d2f (commit) via 34d99de000de9d15cfdf5e9cc8b7682d51110bbd (commit) via a5e206fbd2ca814042cfc1bb7dd3b40c28ce3fb5 (commit) from 987f943de33a0d0aa6ac3e3c352d48ac4a527a6d (commit) - Log ----------------------------------------------------------------- ----------------------------------------------------------------------- Summary of changes: ChangeLog | 3 ++ Documentation.html | 3 ++ libraries/import/ods.php | 12 +++++++++++ libraries/import/xml.php | 50 ++++++++++++++++++++++++++++----------------- 4 files changed, 49 insertions(+), 19 deletions(-) diff --git a/ChangeLog b/ChangeLog index 1e06756..0ccfc21 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,9 @@ phpMyAdmin - ChangeLog ====================== +3.4.7.1 (not yet released) +- [security] Fixed possible local file inclusion in XML import (CVE-2011-4107). + 3.4.7.0 (2011-10-23) - bug #3418610 [interface] Links in navigation when $cfg['MainPageIconic'] = false - bug #3418849 [interface] Inline edit shows dropdowns even after closing diff --git a/Documentation.html b/Documentation.html index 834215c..d376f73 100644 --- a/Documentation.html +++ b/Documentation.html @@ -82,6 +82,9 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <li>To support BLOB streaming, see PHP and MySQL requirements in <a href="#faq6_25"> <abbr title="Frequently Asked Questions">FAQ</abbr> 6.25</a>.</li> + <li>To support XML and Open Document Spreadsheet importing, + you need PHP 5.2.17 or newer and the + <a href="http://www.php.net/libxml"><tt>libxml</tt></a> extension.</li> </ul> </li> <li><b>MySQL</b> 5.0 or newer (<a href="#faq1_17">details</a>);</li> diff --git a/libraries/import/ods.php b/libraries/import/ods.php index 4bf5200..9016016 100644 --- a/libraries/import/ods.php +++ b/libraries/import/ods.php @@ -14,6 +14,13 @@ if (! defined('PHPMYADMIN')) { } /** + * We need way to disable external XML entities processing. + */ +if (!function_exists('libxml_disable_entity_loader')) { + return; +} + +/** * The possible scopes for $plugin_param are: 'table', 'database', and 'server' */ @@ -64,6 +71,11 @@ while (! ($finished && $i >= $len) && ! $error && ! $timeout_passed) { unset($data); /** + * Disable loading of external XML entities. + */ +libxml_disable_entity_loader(); + +/** * Load the XML string * * The option LIBXML_COMPACT is specified because it can diff --git a/libraries/import/xml.php b/libraries/import/xml.php index 640aac8..ce20fe7 100644 --- a/libraries/import/xml.php +++ b/libraries/import/xml.php @@ -13,6 +13,13 @@ if (! defined('PHPMYADMIN')) { } /** + * We need way to disable external XML entities processing. + */ +if (!function_exists('libxml_disable_entity_loader')) { + return; +} + +/** * The possible scopes for $plugin_param are: 'table', 'database', and 'server' */ @@ -57,6 +64,11 @@ while (! ($finished && $i >= $len) && ! $error && ! $timeout_passed) { unset($data); /** + * Disable loading of external XML entities. + */ +libxml_disable_entity_loader(); + +/** * Load the XML string * * The option LIBXML_COMPACT is specified because it can @@ -141,19 +153,19 @@ if (isset($namespaces['pma'])) { * Get structures for all tables */ $struct = $xml->children($namespaces['pma']); - + $create = array(); - + foreach ($struct as $tier1 => $val1) { foreach($val1 as $tier2 => $val2) { /* Need to select the correct database for the creation of tables, views, triggers, etc. */ /** - * @todo Generating a USE here blocks importing of a table - * into another database. + * @todo Generating a USE here blocks importing of a table + * into another database. */ $attrs = $val2->attributes(); $create[] = "USE " . PMA_backquote($attrs["name"]); - + foreach ($val2 as $val3) { /** * Remove the extra cosmetic spacing @@ -163,7 +175,7 @@ if (isset($namespaces['pma'])) { } } } - + $struct_present = true; } @@ -179,13 +191,13 @@ $data_present = false; */ if (@count($xml->children())) { $data_present = true; - + /** * Process all database content */ foreach ($xml as $k1 => $v1) { $tbl_attr = $v1->attributes(); - + $isInTables = false; for ($i = 0; $i < count($tables); ++$i) { if (! strcmp($tables[$i][TBL_NAME], (string)$tbl_attr['name'])) { @@ -193,11 +205,11 @@ if (@count($xml->children())) { break; } } - + if ($isInTables == false) { $tables[] = array((string)$tbl_attr['name']); } - + foreach ($v1 as $k2 => $v2) { $row_attr = $v2->attributes(); if (! array_search((string)$row_attr['name'], $tempRow)) @@ -206,17 +218,17 @@ if (@count($xml->children())) { } $tempCells[] = (string)$v2; } - + $rows[] = array((string)$tbl_attr['name'], $tempRow, $tempCells); - + $tempRow = array(); $tempCells = array(); } - + unset($tempRow); unset($tempCells); unset($xml); - + /** * Bring accumulated rows into the corresponding table */ @@ -227,17 +239,17 @@ if (@count($xml->children())) { if (! isset($tables[$i][COL_NAMES])) { $tables[$i][] = $rows[$j][COL_NAMES]; } - + $tables[$i][ROWS][] = $rows[$j][ROWS]; } } } - + unset($rows); - + if (! $struct_present) { $analyses = array(); - + $len = count($tables); for ($i = 0; $i < $len; ++$i) { $analyses[] = PMA_analyzeTable($tables[$i]); @@ -289,7 +301,7 @@ if (strlen($db)) { if ($db_name === NULL) { $db_name = 'XML_DB'; } - + /* Set database collation/charset */ $options = array( 'db_collation' => $collation, hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_7-22585-gf49fe42
by Michal Čihař 10 Nov '11

10 Nov '11

The branch, master has been updated via f49fe427f534350e029f0b08627e6ce565368de8 (commit) via bd0ad7377e92325d92d1de40ba52b8e89bc19664 (commit) via db6cd4b5f1a6392bba65e9671e0ca2bc29d877b7 (commit) via 06ef08de195ea10c4e4b94ba1c03f8a6210421cf (commit) via 3884a20bbbbd50b89787dc6280c088fd4f13abcf (commit) via 5f4c3baeb86b7421c0eed45080ac89157a483e8c (commit) via f3a3be27078d5429116f9346f274f78e799a084f (commit) via 7887b102d233aca0e3ee25a72426a13719c1fcb8 (commit) via e8f2e54e372cddbfb7a73b17283b2ad35670e915 (commit) via 2f4a6f7887a985cda85283f807f175b651251b5e (commit) via f2cd5949691ea3046e836d8b9509a81339d3def4 (commit) via 58336172827d40d914f6000a67f13349e766cdc0 (commit) via 0b93849064935459483368e0f47ad14e6dad0afe (commit) via 2436413b7627f699ff16ed2f833b8d0a28d0e572 (commit) via 83b67b5b83272ef4d4e518d43909b1f5fbfb43e0 (commit) via 319d52a920ce6e5fb56e461e2f6a9979ebd2452c (commit) via ab4461ffc11b2a0db36e4777a4790e8eff68e6c8 (commit) via eb0eb9f314c7934fe10a9cf9d1aca4f0155c63ea (commit) via 50501884b126fd92bcc111c9b4c64a44d446fb36 (commit) via 1935157590dfeafb08644e06ca126cd8c85071b6 (commit) via c049f54e5cb1b4b62ea299abb91eb3e3804c23e0 (commit) via f93638f47acfceb081c624ef3c0264989fb0b897 (commit) via 4f919c28a2a99812ec4908036723fc104aab0d59 (commit) via 2dfd1dca1490959f4ee594eb7de9e3e996fd6b4c (commit) via efc03d8c8cfa354f703c7a40780035efa93235a4 (commit) from 44fb8024eef8abac296b139beb5f9b7f7c66e5d3 (commit) - Log ----------------------------------------------------------------- commit f49fe427f534350e029f0b08627e6ce565368de8 Merge: db6cd4b bd0ad73 Author: Michal Čihař <mcihar(a)suse.cz> Date: Thu Nov 10 14:54:08 2011 +0100 Merge remote-tracking branch 'origin/QA_3_4' commit db6cd4b5f1a6392bba65e9671e0ca2bc29d877b7 Author: Victor Volkov <hanut(a)php-myadmin.ru> Date: Thu Nov 10 15:44:06 2011 +0200 Translation update done using Pootle. commit 06ef08de195ea10c4e4b94ba1c03f8a6210421cf Author: Victor Volkov <hanut(a)php-myadmin.ru> Date: Thu Nov 10 15:43:31 2011 +0200 Translation update done using Pootle. commit 3884a20bbbbd50b89787dc6280c088fd4f13abcf Author: Victor Volkov <hanut(a)php-myadmin.ru> Date: Thu Nov 10 15:42:56 2011 +0200 Translation update done using Pootle. commit 5f4c3baeb86b7421c0eed45080ac89157a483e8c Author: Victor Volkov <hanut(a)php-myadmin.ru> Date: Thu Nov 10 15:40:54 2011 +0200 Translation update done using Pootle. commit f3a3be27078d5429116f9346f274f78e799a084f Author: Victor Volkov <hanut(a)php-myadmin.ru> Date: Thu Nov 10 15:37:33 2011 +0200 Translation update done using Pootle. commit 7887b102d233aca0e3ee25a72426a13719c1fcb8 Author: Victor Volkov <hanut(a)php-myadmin.ru> Date: Thu Nov 10 15:36:47 2011 +0200 Translation update done using Pootle. commit e8f2e54e372cddbfb7a73b17283b2ad35670e915 Author: Victor Volkov <hanut(a)php-myadmin.ru> Date: Thu Nov 10 15:35:52 2011 +0200 Translation update done using Pootle. commit 2f4a6f7887a985cda85283f807f175b651251b5e Author: Victor Volkov <hanut(a)php-myadmin.ru> Date: Thu Nov 10 15:34:31 2011 +0200 Translation update done using Pootle. commit f2cd5949691ea3046e836d8b9509a81339d3def4 Author: Victor Volkov <hanut(a)php-myadmin.ru> Date: Thu Nov 10 15:34:01 2011 +0200 Translation update done using Pootle. commit 58336172827d40d914f6000a67f13349e766cdc0 Author: Victor Volkov <hanut(a)php-myadmin.ru> Date: Thu Nov 10 15:33:07 2011 +0200 Translation update done using Pootle. commit 0b93849064935459483368e0f47ad14e6dad0afe Author: Michal Čihař <michal(a)cihar.com> Date: Thu Nov 10 12:24:49 2011 +0200 Translation update done using Pootle. commit 2436413b7627f699ff16ed2f833b8d0a28d0e572 Author: Michal Čihař <michal(a)cihar.com> Date: Thu Nov 10 12:24:07 2011 +0200 Translation update done using Pootle. commit 83b67b5b83272ef4d4e518d43909b1f5fbfb43e0 Author: Michal Čihař <michal(a)cihar.com> Date: Thu Nov 10 12:23:47 2011 +0200 Translation update done using Pootle. commit 319d52a920ce6e5fb56e461e2f6a9979ebd2452c Author: Michal Čihař <michal(a)cihar.com> Date: Thu Nov 10 12:23:29 2011 +0200 Translation update done using Pootle. commit ab4461ffc11b2a0db36e4777a4790e8eff68e6c8 Author: Michal Čihař <michal(a)cihar.com> Date: Thu Nov 10 12:22:48 2011 +0200 Translation update done using Pootle. commit eb0eb9f314c7934fe10a9cf9d1aca4f0155c63ea Author: Michal Čihař <michal(a)cihar.com> Date: Thu Nov 10 12:22:36 2011 +0200 Translation update done using Pootle. commit 50501884b126fd92bcc111c9b4c64a44d446fb36 Author: Michal Čihař <michal(a)cihar.com> Date: Thu Nov 10 12:22:21 2011 +0200 Translation update done using Pootle. commit 1935157590dfeafb08644e06ca126cd8c85071b6 Author: Michal Čihař <michal(a)cihar.com> Date: Thu Nov 10 12:22:12 2011 +0200 Translation update done using Pootle. commit c049f54e5cb1b4b62ea299abb91eb3e3804c23e0 Author: Michal Čihař <michal(a)cihar.com> Date: Thu Nov 10 12:21:44 2011 +0200 Translation update done using Pootle. commit f93638f47acfceb081c624ef3c0264989fb0b897 Author: Michal Čihař <michal(a)cihar.com> Date: Thu Nov 10 12:21:07 2011 +0200 Translation update done using Pootle. commit 4f919c28a2a99812ec4908036723fc104aab0d59 Author: Michal Čihař <michal(a)cihar.com> Date: Thu Nov 10 12:20:28 2011 +0200 Translation update done using Pootle. ----------------------------------------------------------------------- Summary of changes: Documentation.html | 3 +-- po/cs.po | 28 +++++++++++++--------------- po/ru.po | 27 +++++++++++++++------------ 3 files changed, 29 insertions(+), 29 deletions(-) diff --git a/Documentation.html b/Documentation.html index ad67696..c31706a 100644 --- a/Documentation.html +++ b/Documentation.html @@ -3589,8 +3589,7 @@ have either the <a href="http://pecl.php.net/package/APC">APC</a> extension group under which Apache runs. </li> <li> - You should use PHP safe mode, to protect from other users that try - to include your <i>config.inc.php</i> in their scripts. + Follow security recommendations for PHP and your webserver. </li> </ul> diff --git a/po/cs.po b/po/cs.po index c4b5ca3..46f5509 100644 --- a/po/cs.po +++ b/po/cs.po @@ -5,7 +5,7 @@ msgstr "" "Project-Id-Version: phpMyAdmin 3.5.0-dev\n" "Report-Msgid-Bugs-To: phpmyadmin-devel(a)lists.sourceforge.net\n" "POT-Creation-Date: 2011-11-09 14:34+0100\n" -"PO-Revision-Date: 2011-11-01 14:49+0200\n" +"PO-Revision-Date: 2011-11-10 12:24+0200\n" "Last-Translator: Michal Čihař <michal(a)cihar.com>\n" "Language-Team: czech <cs(a)li.org>\n" "Language: cs\n" @@ -11797,6 +11797,7 @@ msgstr "" #, php-format msgid "The slow query rate should be below 5%%, your value is %s%%." msgstr "" +"Četnost pomalých dotazů by měla být pod 5%%, ale na tomto serveru je %s%%." #: po/advisory_rules.php:20 msgid "Slow query rate" @@ -11805,7 +11806,7 @@ msgstr "Četnost pomalých dotazů" #: po/advisory_rules.php:21 msgid "" "There is a high percentage of slow queries compared to the server uptime." -msgstr "" +msgstr "Server provádí mnoho pomalých dotazů v porovnání s dobou běhu." #: po/advisory_rules.php:23 #, php-format @@ -11813,6 +11814,8 @@ msgid "" "You have a slow query rate of %s per hour, you should have less than 1%% per " "hour." msgstr "" +"Četnost pomalých dotazů na tomto serveru je %s za hodinu, měla by být pod 1%" +"%." #: po/advisory_rules.php:25 msgid "Long query time" @@ -11836,16 +11839,14 @@ msgid "long_query_time is currently set to %ds." msgstr "long_query_time je nastaven na %d sekund." #: po/advisory_rules.php:30 -#, fuzzy #| msgid "Show query box" msgid "Slow query logging" -msgstr "Zobrazit pole pro dotaz" +msgstr "Zaznamenávání pomalých dotazů" #: po/advisory_rules.php:31 -#, fuzzy #| msgid "slow_query_log is enabled." msgid "The slow query log is disabled." -msgstr "slow_query_log je povolen." +msgstr "Zaznamenávání pomalých dotazů je vypnuto." #: po/advisory_rules.php:32 msgid "" @@ -11858,14 +11859,13 @@ msgid "log_slow_queries is set to 'OFF'" msgstr "" #: po/advisory_rules.php:35 -#, fuzzy #| msgid "Clear series" msgid "Release Series" -msgstr "Odstranit série" +msgstr "Vydání" #: po/advisory_rules.php:36 msgid "The MySQL server version less then 5.1." -msgstr "" +msgstr "MySQL server je starší než 5.1." #: po/advisory_rules.php:37 msgid "" @@ -11886,7 +11886,7 @@ msgstr "Verze" #: po/advisory_rules.php:41 msgid "Version less than 5.1.30 (the first GA release of 5.1)." -msgstr "" +msgstr "Verze staší než 5.1.30 (první GA vydání 5.1)." #: po/advisory_rules.php:42 msgid "" @@ -11896,13 +11896,12 @@ msgstr "" #: po/advisory_rules.php:46 msgid "Version less than 5.5.8 (the first GA release of 5.5)." -msgstr "" +msgstr "Verze staší než 5.5.8 (první GA vydání 5.5)." #: po/advisory_rules.php:47 -#, fuzzy #| msgid "You should upgrade to %s %s or later." msgid "You should upgrade, to a stable version of MySQL 5.5" -msgstr "Měli byste aktualizovat %s na verzi %s nebo vyšší." +msgstr "Měli byste aktualizovat na stabilní verzi MySQL 5.5." #: po/advisory_rules.php:50 po/advisory_rules.php:55 po/advisory_rules.php:60 msgid "Distribution" @@ -11971,10 +11970,9 @@ msgid "Query cache disabled" msgstr "Vyrovnávací paměť dotazů je vypnutá" #: po/advisory_rules.php:71 -#, fuzzy #| msgid "The server is not responding" msgid "The query cache is not enabled." -msgstr "Server neodpovídá" +msgstr "Vyrovnávací paměť není povolena." #: po/advisory_rules.php:72 msgid "" diff --git a/po/ru.po b/po/ru.po index 3e6e4fa..7f6263f 100644 --- a/po/ru.po +++ b/po/ru.po @@ -4,7 +4,7 @@ msgstr "" "Project-Id-Version: phpMyAdmin 3.5.0-dev\n" "Report-Msgid-Bugs-To: phpmyadmin-devel(a)lists.sourceforge.net\n" "POT-Creation-Date: 2011-11-09 14:34+0100\n" -"PO-Revision-Date: 2011-11-09 22:22+0200\n" +"PO-Revision-Date: 2011-11-10 15:43+0200\n" "Last-Translator: Victor Volkov <hanut(a)php-myadmin.ru>\n" "Language-Team: russian <ru(a)li.org>\n" "Language: ru\n" @@ -12895,54 +12895,57 @@ msgid "The thread cache is set to 0" msgstr "Кеш потока установлен в 0" #: po/advisory_rules.php:210 -#, fuzzy, php-format +#, php-format #| msgid "Tracking is not active." msgid "Thread cache hit rate %%" -msgstr "Слежение выключено." +msgstr "%% соотношение обращений в кеш потока" #: po/advisory_rules.php:211 -#, fuzzy #| msgid "Tracking is not active." msgid "Thread cache is not efficient." -msgstr "Слежение выключено." +msgstr "Кеш потока действует не эффективно." #: po/advisory_rules.php:212 msgid "Increase {thread_cache_size}." -msgstr "" +msgstr "Увеличьте {thread_cache_size}." #: po/advisory_rules.php:213 #, php-format msgid "Thread cache hitrate: %s%%, this value should be above 80%%" msgstr "" +"Частота успешных обращений в кеш потока: %s%%, данное значение должно быть " +"выше 80%%" #: po/advisory_rules.php:215 msgid "Threads that are slow to launch" -msgstr "" +msgstr "Потоки с медленным запуском" #: po/advisory_rules.php:216 -#, fuzzy #| msgid "The number of threads that are not sleeping." msgid "There are too many threads that are slow to launch." -msgstr "Количество процессов, находящихся в активном состоянии." +msgstr "Обнаружено большое количество потоков с медленным запуском." #: po/advisory_rules.php:217 msgid "" "This generally happens in case of general system overload as it is pretty " "simple operations. You might want to monitor your system load carefully." msgstr "" +"По большей части, это может происходить из-за перегрузки основной системы, " +"так как сами операции достаточно просты. Обратите особое внимание на " +"загрузку вашей системы." #: po/advisory_rules.php:218 #, php-format msgid "%s thread(s) took longer than %s seconds to start, it should be 0" -msgstr "" +msgstr "Запуск %s потока(ов) занял более %s секунд, должно быть 0" #: po/advisory_rules.php:220 msgid "Slow launch time" -msgstr "" +msgstr "Время медленного запуска" #: po/advisory_rules.php:221 msgid "Slow_launch_threads is above 2s" -msgstr "" +msgstr "Slow_launch_threads выше 2 сек." #: po/advisory_rules.php:222 msgid "" hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin annotated tag, RELEASE_3_3_10_5, created. RELEASE_3_3_10_5
by Marc Delisle 10 Nov '11

10 Nov '11

The annotated tag, RELEASE_3_3_10_5 has been created at f85a631d7032f8c5b9e9d34d98f484cf8228993b (tag) tagging 6f982a164575ab0d4f35aba9425576189e4013d5 (commit) replaces RELEASE_3_3_10_4 tagged by Marc Delisle on Thu Nov 10 08:49:47 2011 -0500 - Log ----------------------------------------------------------------- Released 3.3.10.5 Herman van Rink (1): Missing sanitization on the table, column and index names leads to XSS vulnerabilities, see PMASA-2011-13 Marc Delisle (4): Fix merge conflicts ChangeLog for 3.3.10.5 New PHP requirements for XML and ODS importing 3.3.10.5 release Michal Čihař (2): Disable loading of external XML entities when loading XML Disable XML loading plugins on old PHP ----------------------------------------------------------------------- hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_4, updated. RELEASE_3_4_7-21-gbd0ad73
by Michal Čihař 10 Nov '11

10 Nov '11

The branch, QA_3_4 has been updated via bd0ad7377e92325d92d1de40ba52b8e89bc19664 (commit) from 2dfd1dca1490959f4ee594eb7de9e3e996fd6b4c (commit) - Log ----------------------------------------------------------------- commit bd0ad7377e92325d92d1de40ba52b8e89bc19664 Author: Michal Čihař <mcihar(a)suse.cz> Date: Thu Nov 10 14:52:13 2011 +0100 Remove mention of safe mode as it is not recommended anymore (rfe #3313257). ----------------------------------------------------------------------- Summary of changes: Documentation.html | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) diff --git a/Documentation.html b/Documentation.html index 32c0674..c8afb33 100644 --- a/Documentation.html +++ b/Documentation.html @@ -3507,8 +3507,7 @@ have either the <a href="http://pecl.php.net/package/APC">APC</a> extension group under which Apache runs. </li> <li> - You should use PHP safe mode, to protect from other users that try - to include your <i>config.inc.php</i> in their scripts. + Follow security recommendations for PHP and your webserver. </li> </ul> hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_3, updated. RELEASE_3_3_10_4-22-gc96500f
by Marc Delisle 10 Nov '11

10 Nov '11

The branch, QA_3_3 has been updated via c96500ff1d028b2bbc75e0d36ca6b151723b2ad6 (commit) via 4bd5476eed81cb17d2869bfe5f45942293bf381c (commit) via 75606e5f82280eb1a3817badf1b24d512a010b80 (commit) via 1a89c8ecfd09ceace81fb11e488f12599c0e49b6 (commit) via 2fbf631384fd8cded55f4500cb87b129442f9ed2 (commit) via 5fa86b8e81565c15ddbc359e8f59ecd829a2b717 (commit) via e3d3ef7af2915cf30bf6f3e69e75f9eb58d94be9 (commit) via bd92c092cd422667097e98a3cd8ebc0140338244 (commit) via c79375598d46552fc1717f798a6560f9a1cdc102 (commit) from a60420aa5003426174dde15a0cecfc05579a37bb (commit) - Log ----------------------------------------------------------------- commit c96500ff1d028b2bbc75e0d36ca6b151723b2ad6 Author: Marc Delisle <marc(a)infomarc.info> Date: Thu Nov 10 08:43:40 2011 -0500 3.3.10.5 release commit 4bd5476eed81cb17d2869bfe5f45942293bf381c Merge: a60420a 75606e5 Author: Marc Delisle <marc(a)infomarc.info> Date: Thu Nov 10 08:36:26 2011 -0500 Merge branch 'MAINT_3_3_10' into QA_3_3 ----------------------------------------------------------------------- Summary of changes: ChangeLog | 4 +++ Documentation.html | 6 +++++ db_datadict.php | 2 +- libraries/import/ods.php | 12 +++++++++++ libraries/import/xml.php | 50 ++++++++++++++++++++++++++++----------------- 5 files changed, 54 insertions(+), 20 deletions(-) diff --git a/ChangeLog b/ChangeLog index ec15343..2a74855 100644 --- a/ChangeLog +++ b/ChangeLog @@ -7,6 +7,10 @@ $HeadURL: https://phpmyadmin.svn.sourceforge.net/svnroot/phpmyadmin/trunk/phpMyA 3.3.11.0 (not yet released) +3.3.10.5 (2011-11-10) +- [security] Fixed possible local file inclusion in XML import +(CVE-2011-4107). + 3.3.10.4 (2011-08-24) - [security] Missing sanitization on the table, column and index names leads to XSS vulnerabilities, see PMASA-2011-13 diff --git a/Documentation.html b/Documentation.html index 229e8bb..d9bcf0e 100644 --- a/Documentation.html +++ b/Documentation.html @@ -81,6 +81,12 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 </li> <li>To support upload progress bars, see <a href="#faq2_9"> <abbr title="Frequently Asked Questions">FAQ</abbr> 2.9</a>.</li> + <li>To support BLOB streaming, see PHP and MySQL requirements + in <a href="#faq6_25"> + <abbr title="Frequently Asked Questions">FAQ</abbr> 6.25</a>.</li> + <li>To support XML and Open Document Spreadsheet importing, + you need PHP 5.2.17 or newer and the + <a href="http://www.php.net/libxml"><tt>libxml</tt></a> extension.</li> </ul> </li> <li><b>MySQL</b> 5.0 or newer (<a href="#faq1_17">details</a>);</li> diff --git a/db_datadict.php b/db_datadict.php index 0c16cb7..086d7be 100644 --- a/db_datadict.php +++ b/db_datadict.php @@ -70,7 +70,7 @@ while ($row = PMA_DBI_fetch_assoc($rowset)) { echo '<div>' . "\n"; } - echo '<h2>' . $table . '</h2>' . "\n"; + echo '<h2>' . htmlspecialchars($table) . '</h2>' . "\n"; /** * Gets table informations diff --git a/libraries/import/ods.php b/libraries/import/ods.php index 81aed5e..dcc6a51 100644 --- a/libraries/import/ods.php +++ b/libraries/import/ods.php @@ -14,6 +14,13 @@ if (! defined('PHPMYADMIN')) { } /** + * We need way to disable external XML entities processing. + */ +if (!function_exists('libxml_disable_entity_loader')) { + return; +} + +/** * The possible scopes for $plugin_param are: 'table', 'database', and 'server' */ @@ -62,6 +69,11 @@ while (! ($finished && $i >= $len) && ! $error && ! $timeout_passed) { unset($data); /** + * Disable loading of external XML entities. + */ +libxml_disable_entity_loader(); + +/** * Load the XML string * * The option LIBXML_COMPACT is specified because it can diff --git a/libraries/import/xml.php b/libraries/import/xml.php index f62328e..9298225 100644 --- a/libraries/import/xml.php +++ b/libraries/import/xml.php @@ -13,6 +13,13 @@ if (! defined('PHPMYADMIN')) { } /** + * We need way to disable external XML entities processing. + */ +if (!function_exists('libxml_disable_entity_loader')) { + return; +} + +/** * The possible scopes for $plugin_param are: 'table', 'database', and 'server' */ @@ -57,6 +64,11 @@ while (! ($finished && $i >= $len) && ! $error && ! $timeout_passed) { unset($data); /** + * Disable loading of external XML entities. + */ +libxml_disable_entity_loader(); + +/** * Load the XML string * * The option LIBXML_COMPACT is specified because it can @@ -141,19 +153,19 @@ if (isset($namespaces['pma'])) { * Get structures for all tables */ $struct = $xml->children($namespaces['pma']); - + $create = array(); - + foreach ($struct as $tier1 => $val1) { foreach($val1 as $tier2 => $val2) { /* Need to select the correct database for the creation of tables, views, triggers, etc. */ /** - * @todo Generating a USE here blocks importing of a table - * into another database. + * @todo Generating a USE here blocks importing of a table + * into another database. */ $attrs = $val2->attributes(); $create[] = "USE " . PMA_backquote($attrs["name"]); - + foreach ($val2 as $val3) { /** * Remove the extra cosmetic spacing @@ -163,7 +175,7 @@ if (isset($namespaces['pma'])) { } } } - + $struct_present = true; } @@ -179,13 +191,13 @@ $data_present = false; */ if (@count($xml->children())) { $data_present = true; - + /** * Process all database content */ foreach ($xml as $k1 => $v1) { $tbl_attr = $v1->attributes(); - + $isInTables = false; for ($i = 0; $i < count($tables); ++$i) { if (! strcmp($tables[$i][TBL_NAME], (string)$tbl_attr['name'])) { @@ -193,11 +205,11 @@ if (@count($xml->children())) { break; } } - + if ($isInTables == false) { $tables[] = array((string)$tbl_attr['name']); } - + foreach ($v1 as $k2 => $v2) { $row_attr = $v2->attributes(); if (! array_search((string)$row_attr['name'], $tempRow)) @@ -206,17 +218,17 @@ if (@count($xml->children())) { } $tempCells[] = (string)$v2; } - + $rows[] = array((string)$tbl_attr['name'], $tempRow, $tempCells); - + $tempRow = array(); $tempCells = array(); } - + unset($tempRow); unset($tempCells); unset($xml); - + /** * Bring accumulated rows into the corresponding table */ @@ -227,17 +239,17 @@ if (@count($xml->children())) { if (! isset($tables[$i][COL_NAMES])) { $tables[$i][] = $rows[$j][COL_NAMES]; } - + $tables[$i][ROWS][] = $rows[$j][ROWS]; } } } - + unset($rows); - + if (! $struct_present) { $analyses = array(); - + $len = count($tables); for ($i = 0; $i < $len; ++$i) { $analyses[] = PMA_analyzeTable($tables[$i]); @@ -289,7 +301,7 @@ if (strlen($db)) { if ($db_name === NULL) { $db_name = 'XML_DB'; } - + /* Set database collation/charset */ $options = array( 'db_collation' => $collation, hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, MAINT_3_3_10, updated. RELEASE_3_3_10_4-7-g6f982a1
by Marc Delisle 10 Nov '11

10 Nov '11

The branch, MAINT_3_3_10 has been updated via 6f982a164575ab0d4f35aba9425576189e4013d5 (commit) via 75606e5f82280eb1a3817badf1b24d512a010b80 (commit) via 1a89c8ecfd09ceace81fb11e488f12599c0e49b6 (commit) via 2fbf631384fd8cded55f4500cb87b129442f9ed2 (commit) via 5fa86b8e81565c15ddbc359e8f59ecd829a2b717 (commit) via e3d3ef7af2915cf30bf6f3e69e75f9eb58d94be9 (commit) via c79375598d46552fc1717f798a6560f9a1cdc102 (commit) from bd92c092cd422667097e98a3cd8ebc0140338244 (commit) - Log ----------------------------------------------------------------- commit 6f982a164575ab0d4f35aba9425576189e4013d5 Author: Marc Delisle <marc(a)infomarc.info> Date: Thu Nov 10 08:42:22 2011 -0500 3.3.10.5 release ----------------------------------------------------------------------- Summary of changes: ChangeLog | 4 +++ Documentation.html | 10 +++++++- README | 2 +- db_datadict.php | 2 +- libraries/Config.class.php | 2 +- libraries/import/ods.php | 12 ++++++++++ libraries/import/xml.php | 50 +++++++++++++++++++++++++++---------------- translators.html | 4 +- 8 files changed, 60 insertions(+), 26 deletions(-) diff --git a/ChangeLog b/ChangeLog index ddc085d..7a69d01 100644 --- a/ChangeLog +++ b/ChangeLog @@ -5,6 +5,10 @@ phpMyAdmin - ChangeLog $Id$ $HeadURL: https://phpmyadmin.svn.sourceforge.net/svnroot/phpmyadmin/trunk/phpMyAdmin/… $ +3.3.10.5 (2011-11-10) +- [security] Fixed possible local file inclusion in XML import +(CVE-2011-4107). + 3.3.10.4 (2011-08-24) - [security] Missing sanitization on the table, column and index names leads to XSS vulnerabilities, see PMASA-2011-13 diff --git a/Documentation.html b/Documentation.html index 7ee8e50..3a115a7 100644 --- a/Documentation.html +++ b/Documentation.html @@ -10,7 +10,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <link rel="icon" href="./favicon.ico" type="image/x-icon" /> <link rel="shortcut icon" href="./favicon.ico" type="image/x-icon" /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> - <title>phpMyAdmin 3.3.10.4 - Documentation</title> + <title>phpMyAdmin 3.3.10.5 - Documentation</title> <link rel="stylesheet" type="text/css" href="docs.css" /> </head> @@ -18,7 +18,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <div id="header"> <h1> <a href="http://www.phpmyadmin.net/">php<span class="myadmin">MyAdmin</span></a> - 3.3.10.4 + 3.3.10.5 Documentation </h1> </div> @@ -81,6 +81,12 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 </li> <li>To support upload progress bars, see <a href="#faq2_9"> <abbr title="Frequently Asked Questions">FAQ</abbr> 2.9</a>.</li> + <li>To support BLOB streaming, see PHP and MySQL requirements + in <a href="#faq6_25"> + <abbr title="Frequently Asked Questions">FAQ</abbr> 6.25</a>.</li> + <li>To support XML and Open Document Spreadsheet importing, + you need PHP 5.2.17 or newer and the + <a href="http://www.php.net/libxml"><tt>libxml</tt></a> extension.</li> </ul> </li> <li><b>MySQL</b> 5.0 or newer (<a href="#faq1_17">details</a>);</li> diff --git a/README b/README index 4d2bcbd..3ad7217 100644 --- a/README +++ b/README @@ -5,7 +5,7 @@ phpMyAdmin - Readme A set of PHP-scripts to manage MySQL over the web. - Version 3.3.10.4 + Version 3.3.10.5 ---------------- http://www.phpmyadmin.net/ diff --git a/db_datadict.php b/db_datadict.php index 0c16cb7..086d7be 100644 --- a/db_datadict.php +++ b/db_datadict.php @@ -70,7 +70,7 @@ while ($row = PMA_DBI_fetch_assoc($rowset)) { echo '<div>' . "\n"; } - echo '<h2>' . $table . '</h2>' . "\n"; + echo '<h2>' . htmlspecialchars($table) . '</h2>' . "\n"; /** * Gets table informations diff --git a/libraries/Config.class.php b/libraries/Config.class.php index 0ace890..9dd464b 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -92,7 +92,7 @@ class PMA_Config */ function checkSystem() { - $this->set('PMA_VERSION', '3.3.10.4'); + $this->set('PMA_VERSION', '3.3.10.5'); /** * @deprecated */ diff --git a/libraries/import/ods.php b/libraries/import/ods.php index 81aed5e..dcc6a51 100644 --- a/libraries/import/ods.php +++ b/libraries/import/ods.php @@ -14,6 +14,13 @@ if (! defined('PHPMYADMIN')) { } /** + * We need way to disable external XML entities processing. + */ +if (!function_exists('libxml_disable_entity_loader')) { + return; +} + +/** * The possible scopes for $plugin_param are: 'table', 'database', and 'server' */ @@ -62,6 +69,11 @@ while (! ($finished && $i >= $len) && ! $error && ! $timeout_passed) { unset($data); /** + * Disable loading of external XML entities. + */ +libxml_disable_entity_loader(); + +/** * Load the XML string * * The option LIBXML_COMPACT is specified because it can diff --git a/libraries/import/xml.php b/libraries/import/xml.php index f62328e..9298225 100644 --- a/libraries/import/xml.php +++ b/libraries/import/xml.php @@ -13,6 +13,13 @@ if (! defined('PHPMYADMIN')) { } /** + * We need way to disable external XML entities processing. + */ +if (!function_exists('libxml_disable_entity_loader')) { + return; +} + +/** * The possible scopes for $plugin_param are: 'table', 'database', and 'server' */ @@ -57,6 +64,11 @@ while (! ($finished && $i >= $len) && ! $error && ! $timeout_passed) { unset($data); /** + * Disable loading of external XML entities. + */ +libxml_disable_entity_loader(); + +/** * Load the XML string * * The option LIBXML_COMPACT is specified because it can @@ -141,19 +153,19 @@ if (isset($namespaces['pma'])) { * Get structures for all tables */ $struct = $xml->children($namespaces['pma']); - + $create = array(); - + foreach ($struct as $tier1 => $val1) { foreach($val1 as $tier2 => $val2) { /* Need to select the correct database for the creation of tables, views, triggers, etc. */ /** - * @todo Generating a USE here blocks importing of a table - * into another database. + * @todo Generating a USE here blocks importing of a table + * into another database. */ $attrs = $val2->attributes(); $create[] = "USE " . PMA_backquote($attrs["name"]); - + foreach ($val2 as $val3) { /** * Remove the extra cosmetic spacing @@ -163,7 +175,7 @@ if (isset($namespaces['pma'])) { } } } - + $struct_present = true; } @@ -179,13 +191,13 @@ $data_present = false; */ if (@count($xml->children())) { $data_present = true; - + /** * Process all database content */ foreach ($xml as $k1 => $v1) { $tbl_attr = $v1->attributes(); - + $isInTables = false; for ($i = 0; $i < count($tables); ++$i) { if (! strcmp($tables[$i][TBL_NAME], (string)$tbl_attr['name'])) { @@ -193,11 +205,11 @@ if (@count($xml->children())) { break; } } - + if ($isInTables == false) { $tables[] = array((string)$tbl_attr['name']); } - + foreach ($v1 as $k2 => $v2) { $row_attr = $v2->attributes(); if (! array_search((string)$row_attr['name'], $tempRow)) @@ -206,17 +218,17 @@ if (@count($xml->children())) { } $tempCells[] = (string)$v2; } - + $rows[] = array((string)$tbl_attr['name'], $tempRow, $tempCells); - + $tempRow = array(); $tempCells = array(); } - + unset($tempRow); unset($tempCells); unset($xml); - + /** * Bring accumulated rows into the corresponding table */ @@ -227,17 +239,17 @@ if (@count($xml->children())) { if (! isset($tables[$i][COL_NAMES])) { $tables[$i][] = $rows[$j][COL_NAMES]; } - + $tables[$i][ROWS][] = $rows[$j][ROWS]; } } } - + unset($rows); - + if (! $struct_present) { $analyses = array(); - + $len = count($tables); for ($i = 0; $i < $len; ++$i) { $analyses[] = PMA_analyzeTable($tables[$i]); @@ -289,7 +301,7 @@ if (strlen($db)) { if ($db_name === NULL) { $db_name = 'XML_DB'; } - + /* Set database collation/charset */ $options = array( 'db_collation' => $collation, diff --git a/translators.html b/translators.html index 24096d7..af5719b 100644 --- a/translators.html +++ b/translators.html @@ -11,7 +11,7 @@ <link rel="icon" href="./favicon.ico" type="image/x-icon" /> <link rel="shortcut icon" href="./favicon.ico" type="image/x-icon" /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> - <title>phpMyAdmin 3.3.10.4 - Official translators</title> + <title>phpMyAdmin 3.3.10.5 - Official translators</title> <link rel="stylesheet" type="text/css" href="docs.css" /> </head> @@ -19,7 +19,7 @@ <div id="header"> <h1> <a href="http://www.phpmyadmin.net/">php<span class="myadmin">MyAdmin</span></a> - 3.3.10.4 + 3.3.10.5 official translators list </h1> </div> hooks/post-receive -- phpMyAdmin

1 0