- Git - lists.phpmyadmin.net

[Phpmyadmin-git] [SCM] phpMyAdmin branch, STABLE, updated. RELEASE_3_4_3_1-22-ge1a95b8
by Marc Delisle 02 Jul '11

02 Jul '11

The branch, STABLE has been updated via e1a95b8cca8ed2eb89683bb78067079d6a7128e1 (commit) via e214683f9fe4955dcbf0ffce045983728c7fa9d3 (commit) via b434320eff8ca9c2fc1b043c1804f868341af9a7 (commit) via 69fb0f8e7dc38075427aceaf09bcac697d0590ff (commit) via 0fbedaf5fd7a771d0885c6b7385d934fc90d0d7f (commit) via 7ebd958b2bf59f96fecd5b3322bdbd0b244a7967 (commit) from da052729c9c1783836ed0de402939c54fc2a94f8 (commit) - Log ----------------------------------------------------------------- commit e1a95b8cca8ed2eb89683bb78067079d6a7128e1 Merge: da052729c9c1783836ed0de402939c54fc2a94f8 e214683f9fe4955dcbf0ffce045983728c7fa9d3 Author: Marc Delisle <marc(a)infomarc.info> Date: Sat Jul 2 21:19:06 2011 -0400 Merge branch 'MAINT_3_4_3' into STABLE ----------------------------------------------------------------------- Summary of changes: ChangeLog | 18 ++++++++++++------ Documentation.html | 4 ++-- README | 2 +- libraries/Config.class.php | 2 +- libraries/auth/swekey/swekey.auth.lib.php | 5 ++--- libraries/display_tbl.lib.php | 2 +- libraries/server_synchronize.lib.php | 2 +- setup/lib/ConfigGenerator.class.php | 2 +- 8 files changed, 21 insertions(+), 16 deletions(-) diff --git a/ChangeLog b/ChangeLog index cb3ba9a..fe71031 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,12 @@ phpMyAdmin - ChangeLog ====================== +3.4.3.1 (2011-07-02) +- [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-5 +- [security] Fixed possible code injection incase session variables are compromised, see PMASA-2011-6 +- [security] Fixed regexp quoting issue in Synchronize code, see PMASA-2011-7 +- [security] Fixed filtering of a file path, which allowed for directory traversal, see PMASA-2011-8 + 3.4.3.0 (2011-06-27) - bug #3311170 [sync] Missing helper icons in Synchronize - patch #3304473 [setup] Redefine a lable that was wrong @@ -89,7 +95,7 @@ phpMyAdmin - ChangeLog + patch #2974341 [structure] Clicking on table name in db Structure should Browse the table if possible, thanks to bhdouglass - dougboybhd + patch #2975533 [search] New search operators, thanks to - Martynas Mickevičius + Martynas MickeviÄius + patch #2967320 [designer] Colored relations based on the primary key, thanks to GreenRover - greenrover - [core] Provide way for vendors to easily change paths to config files. @@ -243,7 +249,7 @@ phpMyAdmin - ChangeLog 3.3.7.0 (2010-09-07) - patch #3050492 [PDF scratchboard] Cannot drag table box to the edge after - a page size increase, thanks to Martin Schönberger - mad05 + a page size increase, thanks to Martin SchÃ¶nberger - mad05 3.3.6.0 (2010-08-28) - bug #3033063 [core] Navi gets wrong db name @@ -264,7 +270,7 @@ phpMyAdmin - ChangeLog 3.3.5.0 (2010-07-26) - patch #2932113 [information_schema] Slow export when having lots of - databases, thanks to Stéphane Pontier - shadow_walker + databases, thanks to StÃ©phane Pontier - shadow_walker - bug #3022705 [import] Import button does not work in Catalan when there is no progress bar possible - bug [replication] Do not offer information_schema in the list of databases @@ -304,9 +310,9 @@ phpMyAdmin - ChangeLog - patch #2984893 [engines] InnoDB storage page emits a warning, thanks to Madhura Jayaratne - madhuracj - bug #2974687, bug #2974692 [compatibility] PHPExcel : IBM AIX iconv() does not work, - thanks to Björn Wiberg - bwiberg + thanks to BjÃ¶rn Wiberg - bwiberg - bug #2983066 [interface] Flush table on table operations shows the query twice, - thanks to Martynas Mickevičius - BlinK_ + thanks to Martynas MickeviÄius - BlinK_ - bug #2983060, patch #2987900 [interface] Fix initial state of tables in designer, thanks to Sutharshan Balachandren. - bug #2983062, patch #2989408 [engines] Fix warnings when changing table @@ -385,7 +391,7 @@ phpMyAdmin - ChangeLog + rfe #2839504 [engines] Support InnoDB plugin's new row formats + [core] Added ability for synchronizing databases among servers. + [lang] #2843101 Dutch update, thanks to scavenger2008 -+ [lang] Galician update, thanks to Xosé Calvo - xosecalvo ++ [lang] Galician update, thanks to XosÃ© Calvo - xosecalvo + [export] Added MediaWiki export module, thanks to Derek Schaefer - drummingds1 + [lang] Turkish update, thanks to Burak Yavuz diff --git a/Documentation.html b/Documentation.html index 576c1f0..25b9731 100644 --- a/Documentation.html +++ b/Documentation.html @@ -9,7 +9,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <link rel="icon" href="./favicon.ico" type="image/x-icon" /> <link rel="shortcut icon" href="./favicon.ico" type="image/x-icon" /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> - <title>phpMyAdmin 3.4.3 - Documentation</title> + <title>phpMyAdmin 3.4.3.1 - Documentation</title> <link rel="stylesheet" type="text/css" href="docs.css" /> </head> @@ -17,7 +17,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <div id="header"> <h1> <a href="http://www.phpmyadmin.net/">php<span class="myadmin">MyAdmin</span></a> - 3.4.3 + 3.4.3.1 Documentation </h1> </div> diff --git a/README b/README index 02ad016..e57152a 100644 --- a/README +++ b/README @@ -1,7 +1,7 @@ phpMyAdmin - Readme =================== -Version 3.4.3 +Version 3.4.3.1 A set of PHP-scripts to manage MySQL over the web. diff --git a/libraries/Config.class.php b/libraries/Config.class.php index cd1a0bf..28625f2 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -96,7 +96,7 @@ class PMA_Config */ function checkSystem() { - $this->set('PMA_VERSION', '3.4.3'); + $this->set('PMA_VERSION', '3.4.3.1'); /** * @deprecated */ diff --git a/libraries/auth/swekey/swekey.auth.lib.php b/libraries/auth/swekey/swekey.auth.lib.php index d2ec1b1..c5f613b 100644 --- a/libraries/auth/swekey/swekey.auth.lib.php +++ b/libraries/auth/swekey/swekey.auth.lib.php @@ -263,11 +263,10 @@ function Swekey_login($input_name, $input_go) } } -if (strstr($_SERVER['QUERY_STRING'],'session_to_unset') != false) +if (!empty($_GET['session_to_unset'])) { - parse_str($_SERVER['QUERY_STRING']); session_write_close(); - session_id($session_to_unset); + session_id($_GET['session_to_unset']); session_start(); $_SESSION = array(); session_write_close(); diff --git a/libraries/display_tbl.lib.php b/libraries/display_tbl.lib.php index 64a0383..c7d74ef 100644 --- a/libraries/display_tbl.lib.php +++ b/libraries/display_tbl.lib.php @@ -1308,7 +1308,7 @@ function PMA_displayTableBody(&$dt_result, &$is_display, $map, $analyzed_sql) { if ($GLOBALS['cfgRelation']['mimework'] && $GLOBALS['cfg']['BrowseMIME']) { if (isset($GLOBALS['mime_map'][$meta->name]['mimetype']) && isset($GLOBALS['mime_map'][$meta->name]['transformation']) && !empty($GLOBALS['mime_map'][$meta->name]['transformation'])) { - $include_file = $GLOBALS['mime_map'][$meta->name]['transformation']; + $include_file = PMA_securePath($GLOBALS['mime_map'][$meta->name]['transformation']); if (file_exists('./libraries/transformations/' . $include_file)) { $transformfunction_name = str_replace('.inc.php', '', $GLOBALS['mime_map'][$meta->name]['transformation']); diff --git a/libraries/server_synchronize.lib.php b/libraries/server_synchronize.lib.php index ba6f813..c9f1242 100644 --- a/libraries/server_synchronize.lib.php +++ b/libraries/server_synchronize.lib.php @@ -624,7 +624,7 @@ function PMA_createTargetTables($src_db, $trg_db, $src_link, $trg_link, &$uncomm $Create_Query = PMA_DBI_fetch_value("SHOW CREATE TABLE " . PMA_backquote($src_db) . '.' . PMA_backquote($uncommon_tables[$table_index]), 0, 1, $src_link); // Replace the src table name with a `dbname`.`tablename` - $Create_Table_Query = preg_replace('/' . PMA_backquote($uncommon_tables[$table_index]) . '/', + $Create_Table_Query = preg_replace('/' . preg_quote(PMA_backquote($uncommon_tables[$table_index]), '/') . '/', PMA_backquote($trg_db) . '.' .PMA_backquote($uncommon_tables[$table_index]), $Create_Query, $limit = 1 diff --git a/setup/lib/ConfigGenerator.class.php b/setup/lib/ConfigGenerator.class.php index 95c3325..e33775e 100644 --- a/setup/lib/ConfigGenerator.class.php +++ b/setup/lib/ConfigGenerator.class.php @@ -39,7 +39,7 @@ class ConfigGenerator if ($cf->getServerCount() > 0) { $ret .= "/* Servers configuration */$crlf\$i = 0;" . $crlf . $crlf; foreach ($c['Servers'] as $id => $server) { - $ret .= '/* Server: ' . strtr($cf->getServerName($id), '*/', '-') . " [$id] */" . $crlf + $ret .= '/* Server: ' . strtr($cf->getServerName($id) . " [$id] ", '*/', '-') . "*/" . $crlf . '$i++;' . $crlf; foreach ($server as $k => $v) { $k = preg_replace('/[^A-Za-z0-9_]/', '_', $k); hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin annotated tag, RELEASE_3_4_3_1, created. RELEASE_3_4_3_1
by Marc Delisle 02 Jul '11

02 Jul '11

The annotated tag, RELEASE_3_4_3_1 has been created at 11bdba6ae1a4484650f032d36842cf4c4c341be2 (tag) tagging e214683f9fe4955dcbf0ffce045983728c7fa9d3 (commit) replaces RELEASE_3_4_3 tagged by Marc Delisle on Sat Jul 2 21:19:05 2011 -0400 - Log ----------------------------------------------------------------- Released 3.4.3.1 Herman van Rink (4): Fixed possible session manipulation in swekey authentication, see PMASA-2011-5 Fixed possible code injection incase session variables are compromised, see PMASA-2011-6 Fixed regexp quoting issue in Synchronize code, see PMASA-2011-7 Fixed filtering of a file path, which allowed for directory traversal, see PMASA-2011-8 Marc Delisle (1): 3.4.3.1 release ----------------------------------------------------------------------- hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin annotated tag, RELEASE_3_3_10_2, created. RELEASE_3_3_10_2
by Marc Delisle 02 Jul '11

02 Jul '11

The annotated tag, RELEASE_3_3_10_2 has been created at 5881d2a9e0cfbd3df4f1b5b60aca82eeda7fad42 (tag) tagging ab31a2565f494c69e6b0d9a82a2932c7656592b5 (commit) replaces RELEASE_3_3_10_1 tagged by Marc Delisle on Sat Jul 2 21:10:55 2011 -0400 - Log ----------------------------------------------------------------- Released 3.3.10.2 Herman van Rink (5): Fixed possible session corruption in swekey authentication Fixed possible code injection incase session variables are compromised Fixed regexp quoting issue in Synchronize code Updated Changelog to add PMASA references Fixed filtering of a file path, which allowed for directory traversal, see PMASA-2011-8 Marc Delisle (1): 3.3.10.2 release ----------------------------------------------------------------------- hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_3-6497-g12fcc27
by Marc Delisle 02 Jul '11

02 Jul '11

The branch, master has been updated via 12fcc270f2d0cc7df3a94a131e2f234b0ee8414c (commit) via 041cd7e7d2dfa95dd055da6fd2eb5308902fda95 (commit) via 58d86350c439c2ea06d58ba37f723e6e8a8f1abf (commit) via e214683f9fe4955dcbf0ffce045983728c7fa9d3 (commit) via b434320eff8ca9c2fc1b043c1804f868341af9a7 (commit) via 69fb0f8e7dc38075427aceaf09bcac697d0590ff (commit) via 0fbedaf5fd7a771d0885c6b7385d934fc90d0d7f (commit) via 7ebd958b2bf59f96fecd5b3322bdbd0b244a7967 (commit) from a45a11f4e84c19dfa9e4ce0c2e25fc0e9dd8c01f (commit) - Log ----------------------------------------------------------------- commit 12fcc270f2d0cc7df3a94a131e2f234b0ee8414c Merge: a45a11f4e84c19dfa9e4ce0c2e25fc0e9dd8c01f 041cd7e7d2dfa95dd055da6fd2eb5308902fda95 Author: Marc Delisle <marc(a)infomarc.info> Date: Sat Jul 2 20:52:10 2011 -0400 Merge branch 'QA_3_4' ----------------------------------------------------------------------- Summary of changes: ChangeLog | 18 ++++++++++++------ libraries/auth/swekey/swekey.auth.lib.php | 5 ++--- libraries/display_tbl.lib.php | 2 +- libraries/server_synchronize.lib.php | 2 +- setup/lib/ConfigGenerator.class.php | 2 +- 5 files changed, 17 insertions(+), 12 deletions(-) diff --git a/ChangeLog b/ChangeLog index 504f54c..ae70fb7 100644 --- a/ChangeLog +++ b/ChangeLog @@ -33,6 +33,12 @@ phpMyAdmin - ChangeLog - bug #3348995 [config] $cfg['Export']['asfile'] set to false does not select asText option - bug #3340151 [export] Working SQL query exports error page +3.4.3.1 (2011-07-02) +- [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-5 +- [security] Fixed possible code injection incase session variables are compromised, see PMASA-2011-6 +- [security] Fixed regexp quoting issue in Synchronize code, see PMASA-2011-7 +- [security] Fixed filtering of a file path, which allowed for directory traversal, see PMASA-2011-8 + 3.4.3.0 (2011-06-27) - bug #3311170 [sync] Missing helper icons in Synchronize - patch #3304473 [setup] Redefine a lable that was wrong @@ -121,7 +127,7 @@ phpMyAdmin - ChangeLog + patch #2974341 [structure] Clicking on table name in db Structure should Browse the table if possible, thanks to bhdouglass - dougboybhd + patch #2975533 [search] New search operators, thanks to - Martynas Mickevičius + Martynas MickeviÄius + patch #2967320 [designer] Colored relations based on the primary key, thanks to GreenRover - greenrover - [core] Provide way for vendors to easily change paths to config files. @@ -275,7 +281,7 @@ phpMyAdmin - ChangeLog 3.3.7.0 (2010-09-07) - patch #3050492 [PDF scratchboard] Cannot drag table box to the edge after - a page size increase, thanks to Martin Schönberger - mad05 + a page size increase, thanks to Martin SchÃ¶nberger - mad05 3.3.6.0 (2010-08-28) - bug #3033063 [core] Navi gets wrong db name @@ -296,7 +302,7 @@ phpMyAdmin - ChangeLog 3.3.5.0 (2010-07-26) - patch #2932113 [information_schema] Slow export when having lots of - databases, thanks to Stéphane Pontier - shadow_walker + databases, thanks to StÃ©phane Pontier - shadow_walker - bug #3022705 [import] Import button does not work in Catalan when there is no progress bar possible - bug [replication] Do not offer information_schema in the list of databases @@ -336,9 +342,9 @@ phpMyAdmin - ChangeLog - patch #2984893 [engines] InnoDB storage page emits a warning, thanks to Madhura Jayaratne - madhuracj - bug #2974687, bug #2974692 [compatibility] PHPExcel : IBM AIX iconv() does not work, - thanks to Björn Wiberg - bwiberg + thanks to BjÃ¶rn Wiberg - bwiberg - bug #2983066 [interface] Flush table on table operations shows the query twice, - thanks to Martynas Mickevičius - BlinK_ + thanks to Martynas MickeviÄius - BlinK_ - bug #2983060, patch #2987900 [interface] Fix initial state of tables in designer, thanks to Sutharshan Balachandren. - bug #2983062, patch #2989408 [engines] Fix warnings when changing table @@ -417,7 +423,7 @@ phpMyAdmin - ChangeLog + rfe #2839504 [engines] Support InnoDB plugin's new row formats + [core] Added ability for synchronizing databases among servers. + [lang] #2843101 Dutch update, thanks to scavenger2008 -+ [lang] Galician update, thanks to Xosé Calvo - xosecalvo ++ [lang] Galician update, thanks to XosÃ© Calvo - xosecalvo + [export] Added MediaWiki export module, thanks to Derek Schaefer - drummingds1 + [lang] Turkish update, thanks to Burak Yavuz diff --git a/libraries/auth/swekey/swekey.auth.lib.php b/libraries/auth/swekey/swekey.auth.lib.php index d2ec1b1..c5f613b 100644 --- a/libraries/auth/swekey/swekey.auth.lib.php +++ b/libraries/auth/swekey/swekey.auth.lib.php @@ -263,11 +263,10 @@ function Swekey_login($input_name, $input_go) } } -if (strstr($_SERVER['QUERY_STRING'],'session_to_unset') != false) +if (!empty($_GET['session_to_unset'])) { - parse_str($_SERVER['QUERY_STRING']); session_write_close(); - session_id($session_to_unset); + session_id($_GET['session_to_unset']); session_start(); $_SESSION = array(); session_write_close(); diff --git a/libraries/display_tbl.lib.php b/libraries/display_tbl.lib.php index 3a39bc6..0280d8b 100644 --- a/libraries/display_tbl.lib.php +++ b/libraries/display_tbl.lib.php @@ -1383,7 +1383,7 @@ function PMA_displayTableBody(&$dt_result, &$is_display, $map, $analyzed_sql) { if ($GLOBALS['cfgRelation']['mimework'] && $GLOBALS['cfg']['BrowseMIME']) { if (isset($GLOBALS['mime_map'][$meta->name]['mimetype']) && isset($GLOBALS['mime_map'][$meta->name]['transformation']) && !empty($GLOBALS['mime_map'][$meta->name]['transformation'])) { - $include_file = $GLOBALS['mime_map'][$meta->name]['transformation']; + $include_file = PMA_securePath($GLOBALS['mime_map'][$meta->name]['transformation']); if (file_exists('./libraries/transformations/' . $include_file)) { $transformfunction_name = str_replace('.inc.php', '', $GLOBALS['mime_map'][$meta->name]['transformation']); diff --git a/libraries/server_synchronize.lib.php b/libraries/server_synchronize.lib.php index 1d8aaa5..a2ea20b 100644 --- a/libraries/server_synchronize.lib.php +++ b/libraries/server_synchronize.lib.php @@ -610,7 +610,7 @@ function PMA_createTargetTables($src_db, $trg_db, $src_link, $trg_link, &$uncomm $Create_Query = PMA_DBI_fetch_value("SHOW CREATE TABLE " . PMA_backquote($src_db) . '.' . PMA_backquote($uncommon_tables[$table_index]), 0, 1, $src_link); // Replace the src table name with a `dbname`.`tablename` - $Create_Table_Query = preg_replace('/' . PMA_backquote($uncommon_tables[$table_index]) . '/', + $Create_Table_Query = preg_replace('/' . preg_quote(PMA_backquote($uncommon_tables[$table_index]), '/') . '/', PMA_backquote($trg_db) . '.' .PMA_backquote($uncommon_tables[$table_index]), $Create_Query, $limit = 1 diff --git a/setup/lib/ConfigGenerator.class.php b/setup/lib/ConfigGenerator.class.php index 2872221..f3c6ed8 100644 --- a/setup/lib/ConfigGenerator.class.php +++ b/setup/lib/ConfigGenerator.class.php @@ -39,7 +39,7 @@ class ConfigGenerator if ($cf->getServerCount() > 0) { $ret .= "/* Servers configuration */$crlf\$i = 0;" . $crlf . $crlf; foreach ($c['Servers'] as $id => $server) { - $ret .= '/* Server: ' . strtr($cf->getServerName($id), '*/', '-') . " [$id] */" . $crlf + $ret .= '/* Server: ' . strtr($cf->getServerName($id) . " [$id] ", '*/', '-') . "*/" . $crlf . '$i++;' . $crlf; foreach ($server as $k => $v) { $k = preg_replace('/[^A-Za-z0-9_]/', '_', $k); hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_4, updated. RELEASE_3_4_3-22-g041cd7e
by Marc Delisle 02 Jul '11

02 Jul '11

The branch, QA_3_4 has been updated via 041cd7e7d2dfa95dd055da6fd2eb5308902fda95 (commit) via 58d86350c439c2ea06d58ba37f723e6e8a8f1abf (commit) via e214683f9fe4955dcbf0ffce045983728c7fa9d3 (commit) via b434320eff8ca9c2fc1b043c1804f868341af9a7 (commit) via 69fb0f8e7dc38075427aceaf09bcac697d0590ff (commit) via 0fbedaf5fd7a771d0885c6b7385d934fc90d0d7f (commit) via 7ebd958b2bf59f96fecd5b3322bdbd0b244a7967 (commit) from 5217946601b64ee6e92f97443cf4e515c03c0c27 (commit) - Log ----------------------------------------------------------------- ----------------------------------------------------------------------- Summary of changes: ChangeLog | 18 ++++++++++++------ libraries/auth/swekey/swekey.auth.lib.php | 5 ++--- libraries/display_tbl.lib.php | 2 +- libraries/server_synchronize.lib.php | 2 +- setup/lib/ConfigGenerator.class.php | 2 +- 5 files changed, 17 insertions(+), 12 deletions(-) diff --git a/ChangeLog b/ChangeLog index 8ac61c1..6bdeb8c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -7,6 +7,12 @@ phpMyAdmin - ChangeLog - bug #3348995 [config] $cfg['Export']['asfile'] set to false does not select asText option - bug #3340151 [export] Working SQL query exports error page +3.4.3.1 (2011-07-02) +- [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-5 +- [security] Fixed possible code injection incase session variables are compromised, see PMASA-2011-6 +- [security] Fixed regexp quoting issue in Synchronize code, see PMASA-2011-7 +- [security] Fixed filtering of a file path, which allowed for directory traversal, see PMASA-2011-8 + 3.4.3.0 (2011-06-27) - bug #3311170 [sync] Missing helper icons in Synchronize - patch #3304473 [setup] Redefine a lable that was wrong @@ -95,7 +101,7 @@ phpMyAdmin - ChangeLog + patch #2974341 [structure] Clicking on table name in db Structure should Browse the table if possible, thanks to bhdouglass - dougboybhd + patch #2975533 [search] New search operators, thanks to - Martynas Mickevičius + Martynas MickeviÄius + patch #2967320 [designer] Colored relations based on the primary key, thanks to GreenRover - greenrover - [core] Provide way for vendors to easily change paths to config files. @@ -249,7 +255,7 @@ phpMyAdmin - ChangeLog 3.3.7.0 (2010-09-07) - patch #3050492 [PDF scratchboard] Cannot drag table box to the edge after - a page size increase, thanks to Martin Schönberger - mad05 + a page size increase, thanks to Martin SchÃ¶nberger - mad05 3.3.6.0 (2010-08-28) - bug #3033063 [core] Navi gets wrong db name @@ -270,7 +276,7 @@ phpMyAdmin - ChangeLog 3.3.5.0 (2010-07-26) - patch #2932113 [information_schema] Slow export when having lots of - databases, thanks to Stéphane Pontier - shadow_walker + databases, thanks to StÃ©phane Pontier - shadow_walker - bug #3022705 [import] Import button does not work in Catalan when there is no progress bar possible - bug [replication] Do not offer information_schema in the list of databases @@ -310,9 +316,9 @@ phpMyAdmin - ChangeLog - patch #2984893 [engines] InnoDB storage page emits a warning, thanks to Madhura Jayaratne - madhuracj - bug #2974687, bug #2974692 [compatibility] PHPExcel : IBM AIX iconv() does not work, - thanks to Björn Wiberg - bwiberg + thanks to BjÃ¶rn Wiberg - bwiberg - bug #2983066 [interface] Flush table on table operations shows the query twice, - thanks to Martynas Mickevičius - BlinK_ + thanks to Martynas MickeviÄius - BlinK_ - bug #2983060, patch #2987900 [interface] Fix initial state of tables in designer, thanks to Sutharshan Balachandren. - bug #2983062, patch #2989408 [engines] Fix warnings when changing table @@ -391,7 +397,7 @@ phpMyAdmin - ChangeLog + rfe #2839504 [engines] Support InnoDB plugin's new row formats + [core] Added ability for synchronizing databases among servers. + [lang] #2843101 Dutch update, thanks to scavenger2008 -+ [lang] Galician update, thanks to Xosé Calvo - xosecalvo ++ [lang] Galician update, thanks to XosÃ© Calvo - xosecalvo + [export] Added MediaWiki export module, thanks to Derek Schaefer - drummingds1 + [lang] Turkish update, thanks to Burak Yavuz diff --git a/libraries/auth/swekey/swekey.auth.lib.php b/libraries/auth/swekey/swekey.auth.lib.php index d2ec1b1..c5f613b 100644 --- a/libraries/auth/swekey/swekey.auth.lib.php +++ b/libraries/auth/swekey/swekey.auth.lib.php @@ -263,11 +263,10 @@ function Swekey_login($input_name, $input_go) } } -if (strstr($_SERVER['QUERY_STRING'],'session_to_unset') != false) +if (!empty($_GET['session_to_unset'])) { - parse_str($_SERVER['QUERY_STRING']); session_write_close(); - session_id($session_to_unset); + session_id($_GET['session_to_unset']); session_start(); $_SESSION = array(); session_write_close(); diff --git a/libraries/display_tbl.lib.php b/libraries/display_tbl.lib.php index 64a0383..c7d74ef 100644 --- a/libraries/display_tbl.lib.php +++ b/libraries/display_tbl.lib.php @@ -1308,7 +1308,7 @@ function PMA_displayTableBody(&$dt_result, &$is_display, $map, $analyzed_sql) { if ($GLOBALS['cfgRelation']['mimework'] && $GLOBALS['cfg']['BrowseMIME']) { if (isset($GLOBALS['mime_map'][$meta->name]['mimetype']) && isset($GLOBALS['mime_map'][$meta->name]['transformation']) && !empty($GLOBALS['mime_map'][$meta->name]['transformation'])) { - $include_file = $GLOBALS['mime_map'][$meta->name]['transformation']; + $include_file = PMA_securePath($GLOBALS['mime_map'][$meta->name]['transformation']); if (file_exists('./libraries/transformations/' . $include_file)) { $transformfunction_name = str_replace('.inc.php', '', $GLOBALS['mime_map'][$meta->name]['transformation']); diff --git a/libraries/server_synchronize.lib.php b/libraries/server_synchronize.lib.php index ba6f813..c9f1242 100644 --- a/libraries/server_synchronize.lib.php +++ b/libraries/server_synchronize.lib.php @@ -624,7 +624,7 @@ function PMA_createTargetTables($src_db, $trg_db, $src_link, $trg_link, &$uncomm $Create_Query = PMA_DBI_fetch_value("SHOW CREATE TABLE " . PMA_backquote($src_db) . '.' . PMA_backquote($uncommon_tables[$table_index]), 0, 1, $src_link); // Replace the src table name with a `dbname`.`tablename` - $Create_Table_Query = preg_replace('/' . PMA_backquote($uncommon_tables[$table_index]) . '/', + $Create_Table_Query = preg_replace('/' . preg_quote(PMA_backquote($uncommon_tables[$table_index]), '/') . '/', PMA_backquote($trg_db) . '.' .PMA_backquote($uncommon_tables[$table_index]), $Create_Query, $limit = 1 diff --git a/setup/lib/ConfigGenerator.class.php b/setup/lib/ConfigGenerator.class.php index 95c3325..e33775e 100644 --- a/setup/lib/ConfigGenerator.class.php +++ b/setup/lib/ConfigGenerator.class.php @@ -39,7 +39,7 @@ class ConfigGenerator if ($cf->getServerCount() > 0) { $ret .= "/* Servers configuration */$crlf\$i = 0;" . $crlf . $crlf; foreach ($c['Servers'] as $id => $server) { - $ret .= '/* Server: ' . strtr($cf->getServerName($id), '*/', '-') . " [$id] */" . $crlf + $ret .= '/* Server: ' . strtr($cf->getServerName($id) . " [$id] ", '*/', '-') . "*/" . $crlf . '$i++;' . $crlf; foreach ($server as $k => $v) { $k = preg_replace('/[^A-Za-z0-9_]/', '_', $k); hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_3, updated. RELEASE_3_3_10_1-16-g1d60fb6
by Marc Delisle 02 Jul '11

02 Jul '11

The branch, QA_3_3 has been updated via 1d60fb6da9bc9488c897f57efca21cb683ca8b8a (commit) via b8be5ebe2f98354eb7273e12a32f450daaa1479f (commit) via ab31a2565f494c69e6b0d9a82a2932c7656592b5 (commit) via 5ee357a572866e730d83f56d6187a67c7c48e523 (commit) via 911a83393e5b7064084fd140889d0fb2f3166b99 (commit) via ca74f480f119a53ef07ca40d2ab28f063cc89ec9 (commit) via 2e01647949df937040e73a94ce0bac0daecbdcf4 (commit) via 6e6e129f26295c83d67b74e202628a4b8bc49e54 (commit) via 6eae88e65f39347e480cf67008f3d98f19f47248 (commit) from 1ec75facafab7fc88e486a20222c07c88730a925 (commit) - Log ----------------------------------------------------------------- commit 1d60fb6da9bc9488c897f57efca21cb683ca8b8a Author: Marc Delisle <marc(a)infomarc.info> Date: Sat Jul 2 20:45:06 2011 -0400 3.3.10.2 release commit b8be5ebe2f98354eb7273e12a32f450daaa1479f Merge: 1ec75facafab7fc88e486a20222c07c88730a925 ab31a2565f494c69e6b0d9a82a2932c7656592b5 Author: Marc Delisle <marc(a)infomarc.info> Date: Sat Jul 2 20:42:04 2011 -0400 Merge branch 'MAINT_3_3_10' into QA_3_3 ----------------------------------------------------------------------- Summary of changes: ChangeLog | 7 +++++++ libraries/auth/swekey/swekey.auth.lib.php | 5 ++--- libraries/display_tbl.lib.php | 2 +- libraries/server_synchronize.lib.php | 2 +- setup/lib/ConfigFile.class.php | 2 +- 5 files changed, 12 insertions(+), 6 deletions(-) diff --git a/ChangeLog b/ChangeLog index 920123b..0aa00f1 100644 --- a/ChangeLog +++ b/ChangeLog @@ -7,6 +7,13 @@ $HeadURL: https://phpmyadmin.svn.sourceforge.net/svnroot/phpmyadmin/trunk/phpMyA 3.3.11.0 (not yet released) +3.3.10.2 (2011-07-02) +- [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-5 +- [security] Fixed possible code injection incase session variables are compromised, see PMASA-2011-6 +- [security] Fixed regexp quoting issue in Synchronize code, see PMASA-2011-7 +- [security] Fixed filtering of a file path, which allowed for directory travers +al, see PMASA-2011-8 + 3.3.10.1 (2011-05-20) - [security] XSS on Tracking page diff --git a/libraries/auth/swekey/swekey.auth.lib.php b/libraries/auth/swekey/swekey.auth.lib.php index 3dbad75..2a790c4 100644 --- a/libraries/auth/swekey/swekey.auth.lib.php +++ b/libraries/auth/swekey/swekey.auth.lib.php @@ -263,11 +263,10 @@ function Swekey_login($input_name, $input_go) } } -if (strstr($_SERVER['QUERY_STRING'],'session_to_unset') != false) +if (!empty($_GET['session_to_unset'])) { - parse_str($_SERVER['QUERY_STRING']); session_write_close(); - session_id($session_to_unset); + session_id($_GET['session_to_unset']); session_start(); $_SESSION = array(); session_write_close(); diff --git a/libraries/display_tbl.lib.php b/libraries/display_tbl.lib.php index 7ef333d..186ce3e 100644 --- a/libraries/display_tbl.lib.php +++ b/libraries/display_tbl.lib.php @@ -1220,7 +1220,7 @@ function PMA_displayTableBody(&$dt_result, &$is_display, $map, $analyzed_sql) { if ($GLOBALS['cfgRelation']['mimework'] && $GLOBALS['cfg']['BrowseMIME']) { if (isset($GLOBALS['mime_map'][$meta->name]['mimetype']) && isset($GLOBALS['mime_map'][$meta->name]['transformation']) && !empty($GLOBALS['mime_map'][$meta->name]['transformation'])) { - $include_file = $GLOBALS['mime_map'][$meta->name]['transformation']; + $include_file = PMA_securePath($GLOBALS['mime_map'][$meta->name]['transformation']); if (file_exists('./libraries/transformations/' . $include_file)) { $transformfunction_name = str_replace('.inc.php', '', $GLOBALS['mime_map'][$meta->name]['transformation']); diff --git a/libraries/server_synchronize.lib.php b/libraries/server_synchronize.lib.php index 79948b9..646ef25 100644 --- a/libraries/server_synchronize.lib.php +++ b/libraries/server_synchronize.lib.php @@ -624,7 +624,7 @@ function PMA_createTargetTables($src_db, $trg_db, $src_link, $trg_link, &$uncomm $Create_Query = PMA_DBI_fetch_value("SHOW CREATE TABLE " . PMA_backquote($src_db) . '.' . PMA_backquote($uncommon_tables[$table_index]), 0, 1, $src_link); // Replace the src table name with a `dbname`.`tablename` - $Create_Table_Query = preg_replace('/' . PMA_backquote($uncommon_tables[$table_index]) . '/', + $Create_Table_Query = preg_replace('/' . preg_quote(PMA_backquote($uncommon_tables[$table_index]), '/') . '/', PMA_backquote($trg_db) . '.' .PMA_backquote($uncommon_tables[$table_index]), $Create_Query, $limit = 1 diff --git a/setup/lib/ConfigFile.class.php b/setup/lib/ConfigFile.class.php index c0ff63d..978eba3 100644 --- a/setup/lib/ConfigFile.class.php +++ b/setup/lib/ConfigFile.class.php @@ -286,7 +286,7 @@ class ConfigFile if ($this->getServerCount() > 0) { $ret .= "/* Servers configuration */$crlf\$i = 0;" . $crlf . $crlf; foreach ($c['Servers'] as $id => $server) { - $ret .= '/* Server: ' . strtr($this->getServerName($id), '*/', '-') . " [$id] */" . $crlf + $ret .= '/* Server: ' . strtr($this->getServerName($id) . " [$id] ", '*/', '-') . "*/" . $crlf . '$i++;' . $crlf; foreach ($server as $k => $v) { $k = preg_replace('/[^A-Za-z0-9_]/', '_', $k); hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, MAINT_3_4_3, updated. RELEASE_3_4_3-5-ge214683
by Marc Delisle 02 Jul '11

02 Jul '11

The branch, MAINT_3_4_3 has been updated via e214683f9fe4955dcbf0ffce045983728c7fa9d3 (commit) via b434320eff8ca9c2fc1b043c1804f868341af9a7 (commit) via 69fb0f8e7dc38075427aceaf09bcac697d0590ff (commit) via 0fbedaf5fd7a771d0885c6b7385d934fc90d0d7f (commit) via 7ebd958b2bf59f96fecd5b3322bdbd0b244a7967 (commit) from 9fc6e35cfd1d8270d943f5577807a3c79f5c6168 (commit) - Log ----------------------------------------------------------------- ----------------------------------------------------------------------- Summary of changes: ChangeLog | 18 ++++++++++++------ Documentation.html | 4 ++-- README | 2 +- libraries/Config.class.php | 2 +- libraries/auth/swekey/swekey.auth.lib.php | 5 ++--- libraries/display_tbl.lib.php | 2 +- libraries/server_synchronize.lib.php | 2 +- setup/lib/ConfigGenerator.class.php | 2 +- 8 files changed, 21 insertions(+), 16 deletions(-) diff --git a/ChangeLog b/ChangeLog index cb3ba9a..fe71031 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,12 @@ phpMyAdmin - ChangeLog ====================== +3.4.3.1 (2011-07-02) +- [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-5 +- [security] Fixed possible code injection incase session variables are compromised, see PMASA-2011-6 +- [security] Fixed regexp quoting issue in Synchronize code, see PMASA-2011-7 +- [security] Fixed filtering of a file path, which allowed for directory traversal, see PMASA-2011-8 + 3.4.3.0 (2011-06-27) - bug #3311170 [sync] Missing helper icons in Synchronize - patch #3304473 [setup] Redefine a lable that was wrong @@ -89,7 +95,7 @@ phpMyAdmin - ChangeLog + patch #2974341 [structure] Clicking on table name in db Structure should Browse the table if possible, thanks to bhdouglass - dougboybhd + patch #2975533 [search] New search operators, thanks to - Martynas Mickevičius + Martynas MickeviÄius + patch #2967320 [designer] Colored relations based on the primary key, thanks to GreenRover - greenrover - [core] Provide way for vendors to easily change paths to config files. @@ -243,7 +249,7 @@ phpMyAdmin - ChangeLog 3.3.7.0 (2010-09-07) - patch #3050492 [PDF scratchboard] Cannot drag table box to the edge after - a page size increase, thanks to Martin Schönberger - mad05 + a page size increase, thanks to Martin SchÃ¶nberger - mad05 3.3.6.0 (2010-08-28) - bug #3033063 [core] Navi gets wrong db name @@ -264,7 +270,7 @@ phpMyAdmin - ChangeLog 3.3.5.0 (2010-07-26) - patch #2932113 [information_schema] Slow export when having lots of - databases, thanks to Stéphane Pontier - shadow_walker + databases, thanks to StÃ©phane Pontier - shadow_walker - bug #3022705 [import] Import button does not work in Catalan when there is no progress bar possible - bug [replication] Do not offer information_schema in the list of databases @@ -304,9 +310,9 @@ phpMyAdmin - ChangeLog - patch #2984893 [engines] InnoDB storage page emits a warning, thanks to Madhura Jayaratne - madhuracj - bug #2974687, bug #2974692 [compatibility] PHPExcel : IBM AIX iconv() does not work, - thanks to Björn Wiberg - bwiberg + thanks to BjÃ¶rn Wiberg - bwiberg - bug #2983066 [interface] Flush table on table operations shows the query twice, - thanks to Martynas Mickevičius - BlinK_ + thanks to Martynas MickeviÄius - BlinK_ - bug #2983060, patch #2987900 [interface] Fix initial state of tables in designer, thanks to Sutharshan Balachandren. - bug #2983062, patch #2989408 [engines] Fix warnings when changing table @@ -385,7 +391,7 @@ phpMyAdmin - ChangeLog + rfe #2839504 [engines] Support InnoDB plugin's new row formats + [core] Added ability for synchronizing databases among servers. + [lang] #2843101 Dutch update, thanks to scavenger2008 -+ [lang] Galician update, thanks to Xosé Calvo - xosecalvo ++ [lang] Galician update, thanks to XosÃ© Calvo - xosecalvo + [export] Added MediaWiki export module, thanks to Derek Schaefer - drummingds1 + [lang] Turkish update, thanks to Burak Yavuz diff --git a/Documentation.html b/Documentation.html index 576c1f0..25b9731 100644 --- a/Documentation.html +++ b/Documentation.html @@ -9,7 +9,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <link rel="icon" href="./favicon.ico" type="image/x-icon" /> <link rel="shortcut icon" href="./favicon.ico" type="image/x-icon" /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> - <title>phpMyAdmin 3.4.3 - Documentation</title> + <title>phpMyAdmin 3.4.3.1 - Documentation</title> <link rel="stylesheet" type="text/css" href="docs.css" /> </head> @@ -17,7 +17,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <div id="header"> <h1> <a href="http://www.phpmyadmin.net/">php<span class="myadmin">MyAdmin</span></a> - 3.4.3 + 3.4.3.1 Documentation </h1> </div> diff --git a/README b/README index 02ad016..e57152a 100644 --- a/README +++ b/README @@ -1,7 +1,7 @@ phpMyAdmin - Readme =================== -Version 3.4.3 +Version 3.4.3.1 A set of PHP-scripts to manage MySQL over the web. diff --git a/libraries/Config.class.php b/libraries/Config.class.php index cd1a0bf..28625f2 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -96,7 +96,7 @@ class PMA_Config */ function checkSystem() { - $this->set('PMA_VERSION', '3.4.3'); + $this->set('PMA_VERSION', '3.4.3.1'); /** * @deprecated */ diff --git a/libraries/auth/swekey/swekey.auth.lib.php b/libraries/auth/swekey/swekey.auth.lib.php index d2ec1b1..c5f613b 100644 --- a/libraries/auth/swekey/swekey.auth.lib.php +++ b/libraries/auth/swekey/swekey.auth.lib.php @@ -263,11 +263,10 @@ function Swekey_login($input_name, $input_go) } } -if (strstr($_SERVER['QUERY_STRING'],'session_to_unset') != false) +if (!empty($_GET['session_to_unset'])) { - parse_str($_SERVER['QUERY_STRING']); session_write_close(); - session_id($session_to_unset); + session_id($_GET['session_to_unset']); session_start(); $_SESSION = array(); session_write_close(); diff --git a/libraries/display_tbl.lib.php b/libraries/display_tbl.lib.php index 64a0383..c7d74ef 100644 --- a/libraries/display_tbl.lib.php +++ b/libraries/display_tbl.lib.php @@ -1308,7 +1308,7 @@ function PMA_displayTableBody(&$dt_result, &$is_display, $map, $analyzed_sql) { if ($GLOBALS['cfgRelation']['mimework'] && $GLOBALS['cfg']['BrowseMIME']) { if (isset($GLOBALS['mime_map'][$meta->name]['mimetype']) && isset($GLOBALS['mime_map'][$meta->name]['transformation']) && !empty($GLOBALS['mime_map'][$meta->name]['transformation'])) { - $include_file = $GLOBALS['mime_map'][$meta->name]['transformation']; + $include_file = PMA_securePath($GLOBALS['mime_map'][$meta->name]['transformation']); if (file_exists('./libraries/transformations/' . $include_file)) { $transformfunction_name = str_replace('.inc.php', '', $GLOBALS['mime_map'][$meta->name]['transformation']); diff --git a/libraries/server_synchronize.lib.php b/libraries/server_synchronize.lib.php index ba6f813..c9f1242 100644 --- a/libraries/server_synchronize.lib.php +++ b/libraries/server_synchronize.lib.php @@ -624,7 +624,7 @@ function PMA_createTargetTables($src_db, $trg_db, $src_link, $trg_link, &$uncomm $Create_Query = PMA_DBI_fetch_value("SHOW CREATE TABLE " . PMA_backquote($src_db) . '.' . PMA_backquote($uncommon_tables[$table_index]), 0, 1, $src_link); // Replace the src table name with a `dbname`.`tablename` - $Create_Table_Query = preg_replace('/' . PMA_backquote($uncommon_tables[$table_index]) . '/', + $Create_Table_Query = preg_replace('/' . preg_quote(PMA_backquote($uncommon_tables[$table_index]), '/') . '/', PMA_backquote($trg_db) . '.' .PMA_backquote($uncommon_tables[$table_index]), $Create_Query, $limit = 1 diff --git a/setup/lib/ConfigGenerator.class.php b/setup/lib/ConfigGenerator.class.php index 95c3325..e33775e 100644 --- a/setup/lib/ConfigGenerator.class.php +++ b/setup/lib/ConfigGenerator.class.php @@ -39,7 +39,7 @@ class ConfigGenerator if ($cf->getServerCount() > 0) { $ret .= "/* Servers configuration */$crlf\$i = 0;" . $crlf . $crlf; foreach ($c['Servers'] as $id => $server) { - $ret .= '/* Server: ' . strtr($cf->getServerName($id), '*/', '-') . " [$id] */" . $crlf + $ret .= '/* Server: ' . strtr($cf->getServerName($id) . " [$id] ", '*/', '-') . "*/" . $crlf . '$i++;' . $crlf; foreach ($server as $k => $v) { $k = preg_replace('/[^A-Za-z0-9_]/', '_', $k); hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, MAINT_3_3_10, updated. RELEASE_3_3_10_1-6-gab31a25
by Marc Delisle 02 Jul '11

02 Jul '11

The branch, MAINT_3_3_10 has been updated via ab31a2565f494c69e6b0d9a82a2932c7656592b5 (commit) via 5ee357a572866e730d83f56d6187a67c7c48e523 (commit) via 911a83393e5b7064084fd140889d0fb2f3166b99 (commit) via ca74f480f119a53ef07ca40d2ab28f063cc89ec9 (commit) via 2e01647949df937040e73a94ce0bac0daecbdcf4 (commit) via 6e6e129f26295c83d67b74e202628a4b8bc49e54 (commit) from 6eae88e65f39347e480cf67008f3d98f19f47248 (commit) - Log ----------------------------------------------------------------- ----------------------------------------------------------------------- Summary of changes: ChangeLog | 6 ++++++ Documentation.html | 4 ++-- README | 2 +- libraries/Config.class.php | 2 +- libraries/auth/swekey/swekey.auth.lib.php | 5 ++--- libraries/display_tbl.lib.php | 2 +- libraries/server_synchronize.lib.php | 2 +- setup/lib/ConfigFile.class.php | 2 +- translators.html | 4 ++-- 9 files changed, 17 insertions(+), 12 deletions(-) diff --git a/ChangeLog b/ChangeLog index f207579..3816fdc 100644 --- a/ChangeLog +++ b/ChangeLog @@ -5,6 +5,12 @@ phpMyAdmin - ChangeLog $Id$ $HeadURL: https://phpmyadmin.svn.sourceforge.net/svnroot/phpmyadmin/trunk/phpMyAdmin/… $ +3.3.10.2 (2011-07-02) +- [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-5 +- [security] Fixed possible code injection incase session variables are compromised, see PMASA-2011-6 +- [security] Fixed regexp quoting issue in Synchronize code, see PMASA-2011-7 +- [security] Fixed filtering of a file path, which allowed for directory traversal, see PMASA-2011-8 + 3.3.10.1 (2011-05-20) - [security] XSS on Tracking page diff --git a/Documentation.html b/Documentation.html index 7797037..89640a1 100644 --- a/Documentation.html +++ b/Documentation.html @@ -10,7 +10,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <link rel="icon" href="./favicon.ico" type="image/x-icon" /> <link rel="shortcut icon" href="./favicon.ico" type="image/x-icon" /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> - <title>phpMyAdmin 3.3.10.1 - Documentation</title> + <title>phpMyAdmin 3.3.10.2 - Documentation</title> <link rel="stylesheet" type="text/css" href="docs.css" /> </head> @@ -18,7 +18,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <div id="header"> <h1> <a href="http://www.phpmyadmin.net/">php<span class="myadmin">MyAdmin</span></a> - 3.3.10.1 + 3.3.10.2 Documentation </h1> </div> diff --git a/README b/README index 3e821bf..5bce68c 100644 --- a/README +++ b/README @@ -5,7 +5,7 @@ phpMyAdmin - Readme A set of PHP-scripts to manage MySQL over the web. - Version 3.3.10.1 + Version 3.3.10.2 ---------------- http://www.phpmyadmin.net/ diff --git a/libraries/Config.class.php b/libraries/Config.class.php index 614cc2e..79a006b 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -92,7 +92,7 @@ class PMA_Config */ function checkSystem() { - $this->set('PMA_VERSION', '3.3.10.1'); + $this->set('PMA_VERSION', '3.3.10.2'); /** * @deprecated */ diff --git a/libraries/auth/swekey/swekey.auth.lib.php b/libraries/auth/swekey/swekey.auth.lib.php index 3dbad75..2a790c4 100644 --- a/libraries/auth/swekey/swekey.auth.lib.php +++ b/libraries/auth/swekey/swekey.auth.lib.php @@ -263,11 +263,10 @@ function Swekey_login($input_name, $input_go) } } -if (strstr($_SERVER['QUERY_STRING'],'session_to_unset') != false) +if (!empty($_GET['session_to_unset'])) { - parse_str($_SERVER['QUERY_STRING']); session_write_close(); - session_id($session_to_unset); + session_id($_GET['session_to_unset']); session_start(); $_SESSION = array(); session_write_close(); diff --git a/libraries/display_tbl.lib.php b/libraries/display_tbl.lib.php index 7ef333d..186ce3e 100644 --- a/libraries/display_tbl.lib.php +++ b/libraries/display_tbl.lib.php @@ -1220,7 +1220,7 @@ function PMA_displayTableBody(&$dt_result, &$is_display, $map, $analyzed_sql) { if ($GLOBALS['cfgRelation']['mimework'] && $GLOBALS['cfg']['BrowseMIME']) { if (isset($GLOBALS['mime_map'][$meta->name]['mimetype']) && isset($GLOBALS['mime_map'][$meta->name]['transformation']) && !empty($GLOBALS['mime_map'][$meta->name]['transformation'])) { - $include_file = $GLOBALS['mime_map'][$meta->name]['transformation']; + $include_file = PMA_securePath($GLOBALS['mime_map'][$meta->name]['transformation']); if (file_exists('./libraries/transformations/' . $include_file)) { $transformfunction_name = str_replace('.inc.php', '', $GLOBALS['mime_map'][$meta->name]['transformation']); diff --git a/libraries/server_synchronize.lib.php b/libraries/server_synchronize.lib.php index 79948b9..646ef25 100644 --- a/libraries/server_synchronize.lib.php +++ b/libraries/server_synchronize.lib.php @@ -624,7 +624,7 @@ function PMA_createTargetTables($src_db, $trg_db, $src_link, $trg_link, &$uncomm $Create_Query = PMA_DBI_fetch_value("SHOW CREATE TABLE " . PMA_backquote($src_db) . '.' . PMA_backquote($uncommon_tables[$table_index]), 0, 1, $src_link); // Replace the src table name with a `dbname`.`tablename` - $Create_Table_Query = preg_replace('/' . PMA_backquote($uncommon_tables[$table_index]) . '/', + $Create_Table_Query = preg_replace('/' . preg_quote(PMA_backquote($uncommon_tables[$table_index]), '/') . '/', PMA_backquote($trg_db) . '.' .PMA_backquote($uncommon_tables[$table_index]), $Create_Query, $limit = 1 diff --git a/setup/lib/ConfigFile.class.php b/setup/lib/ConfigFile.class.php index c0ff63d..978eba3 100644 --- a/setup/lib/ConfigFile.class.php +++ b/setup/lib/ConfigFile.class.php @@ -286,7 +286,7 @@ class ConfigFile if ($this->getServerCount() > 0) { $ret .= "/* Servers configuration */$crlf\$i = 0;" . $crlf . $crlf; foreach ($c['Servers'] as $id => $server) { - $ret .= '/* Server: ' . strtr($this->getServerName($id), '*/', '-') . " [$id] */" . $crlf + $ret .= '/* Server: ' . strtr($this->getServerName($id) . " [$id] ", '*/', '-') . "*/" . $crlf . '$i++;' . $crlf; foreach ($server as $k => $v) { $k = preg_replace('/[^A-Za-z0-9_]/', '_', $k); diff --git a/translators.html b/translators.html index 3238f69..5ca2669 100644 --- a/translators.html +++ b/translators.html @@ -11,7 +11,7 @@ <link rel="icon" href="./favicon.ico" type="image/x-icon" /> <link rel="shortcut icon" href="./favicon.ico" type="image/x-icon" /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> - <title>phpMyAdmin 3.3.10.1 - Official translators</title> + <title>phpMyAdmin 3.3.10.2 - Official translators</title> <link rel="stylesheet" type="text/css" href="docs.css" /> </head> @@ -19,7 +19,7 @@ <div id="header"> <h1> <a href="http://www.phpmyadmin.net/">php<span class="myadmin">MyAdmin</span></a> - 3.3.10.1 + 3.3.10.2 official translators list </h1> </div> hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_3-6489-ga45a11f
by Madhura Jayaratne 01 Jul '11

01 Jul '11

The branch, master has been updated via a45a11f4e84c19dfa9e4ce0c2e25fc0e9dd8c01f (commit) via 5217946601b64ee6e92f97443cf4e515c03c0c27 (commit) from 6d883454046623718bd777e0f6044eb57a65a55e (commit) - Log ----------------------------------------------------------------- commit a45a11f4e84c19dfa9e4ce0c2e25fc0e9dd8c01f Merge: 6d883454046623718bd777e0f6044eb57a65a55e 5217946601b64ee6e92f97443cf4e515c03c0c27 Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: Sat Jul 2 07:12:39 2011 +0530 Merge branch 'QA_3_4' ----------------------------------------------------------------------- Summary of changes: ChangeLog | 1 + libraries/display_export.lib.php | 9 +-------- 2 files changed, 2 insertions(+), 8 deletions(-) diff --git a/ChangeLog b/ChangeLog index b5a0cf0..504f54c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -31,6 +31,7 @@ phpMyAdmin - ChangeLog - bug #3323060 [parser] SQL parser breaks AJAX requests if query has unclosed quotes - bug #3323101 [parser] Invalid escape sequence in SQL parser - bug #3348995 [config] $cfg['Export']['asfile'] set to false does not select asText option +- bug #3340151 [export] Working SQL query exports error page 3.4.3.0 (2011-06-27) - bug #3311170 [sync] Missing helper icons in Synchronize diff --git a/libraries/display_export.lib.php b/libraries/display_export.lib.php index e47b170..dd6c347 100644 --- a/libraries/display_export.lib.php +++ b/libraries/display_export.lib.php @@ -35,13 +35,6 @@ if (empty($export_list)) { PMA_Message::error( __('Could not load export plugins, please check your installation!'))->display(); require './libraries/footer.inc.php'; } - -// If the form data is being loaded from GET data, decode it -foreach($_GET as $name => $value) { - if(is_string($value)) { - $_GET[urldecode($name)] = urldecode($value); - } -} ?> <form method="post" action="export.php" name="dump"> @@ -73,7 +66,7 @@ echo '<input type="hidden" name="export_method" value="' . htmlspecialchars($cfg if(isset($_GET['sql_query'])) { - echo '<input type="hidden" name="sql_query" value="' . htmlspecialchars(urldecode($_GET['sql_query'])) . '" />' . "\n"; + echo '<input type="hidden" name="sql_query" value="' . htmlspecialchars($_GET['sql_query']) . '" />' . "\n"; } elseif (! empty($sql_query)) { echo '<input type="hidden" name="sql_query" value="' . htmlspecialchars($sql_query) . '" />' . "\n"; } hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_4, updated. RELEASE_3_4_3-15-g5217946
by Madhura Jayaratne 01 Jul '11

01 Jul '11

The branch, QA_3_4 has been updated via 5217946601b64ee6e92f97443cf4e515c03c0c27 (commit) from 4d1540cc1c8136040968bcfb3a4629aad2551b3a (commit) - Log ----------------------------------------------------------------- commit 5217946601b64ee6e92f97443cf4e515c03c0c27 Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: Sat Jul 2 07:05:54 2011 +0530 bug #3340151 [export] Working SQL query exports error page ----------------------------------------------------------------------- Summary of changes: ChangeLog | 1 + libraries/display_export.lib.php | 9 +-------- 2 files changed, 2 insertions(+), 8 deletions(-) diff --git a/ChangeLog b/ChangeLog index 4e47917..8ac61c1 100644 --- a/ChangeLog +++ b/ChangeLog @@ -5,6 +5,7 @@ phpMyAdmin - ChangeLog - bug #3323060 [parser] SQL parser breaks AJAX requests if query has unclosed quotes - bug #3323101 [parser] Invalid escape sequence in SQL parser - bug #3348995 [config] $cfg['Export']['asfile'] set to false does not select asText option +- bug #3340151 [export] Working SQL query exports error page 3.4.3.0 (2011-06-27) - bug #3311170 [sync] Missing helper icons in Synchronize diff --git a/libraries/display_export.lib.php b/libraries/display_export.lib.php index 3bc9c7f..637b069 100644 --- a/libraries/display_export.lib.php +++ b/libraries/display_export.lib.php @@ -35,13 +35,6 @@ if (empty($export_list)) { PMA_Message::error( __('Could not load export plugins, please check your installation!'))->display(); require './libraries/footer.inc.php'; } - -// If the form data is being loaded from GET data, decode it -foreach($_GET as $name => $value) { - if(is_string($value)) { - $_GET[urldecode($name)] = urldecode($value); - } -} ?> <form method="post" action="export.php" name="dump"> @@ -73,7 +66,7 @@ echo '<input type="hidden" name="export_method" value="' . htmlspecialchars($cfg if(isset($_GET['sql_query'])) { - echo '<input type="hidden" name="sql_query" value="' . htmlspecialchars(urldecode($_GET['sql_query'])) . '" />' . "\n"; + echo '<input type="hidden" name="sql_query" value="' . htmlspecialchars($_GET['sql_query']) . '" />' . "\n"; } elseif (! empty($sql_query)) { echo '<input type="hidden" name="sql_query" value="' . htmlspecialchars($sql_query) . '" />' . "\n"; } hooks/post-receive -- phpMyAdmin

1 0