- Git - lists.phpmyadmin.net

[phpmyadmin/phpmyadmin] 75a558: Fix XSS in DB_search.php
by Michal Čihař 28 Jan '16

28 Jan '16

Branch: refs/heads/master Home: https://github.com/phpmyadmin/phpmyadmin Commit: 75a55824012406a08c4debf5ddb7ae41c32a7dbc https://github.com/phpmyadmin/phpmyadmin/commit/75a55824012406a08c4debf5ddb… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M libraries/DbSearch.class.php Log Message: ----------- Fix XSS in DB_search.php Signed-off-by: Madhura Jayaratne <madhura.cj(a)gmail.com> Commit: 5aee5035646c4fc617564cb0d3d58c0435d64d81 https://github.com/phpmyadmin/phpmyadmin/commit/5aee5035646c4fc617564cb0d3d… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M setup/frames/form.inc.php M setup/index.php M setup/validate.php Log Message: ----------- Fix path disclosure, items 1.4.x, 1.5 and 1.6 Signed-off-by: Madhura Jayaratne <madhura.cj(a)gmail.com> Commit: 019c4f25d500ec5db9ba3b84cc961a7e4e850738 https://github.com/phpmyadmin/phpmyadmin/commit/019c4f25d500ec5db9ba3b84cc9… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M js/normalization.js Log Message: ----------- Fix XSS in normalization.php Signed-off-by: Madhura Jayaratne <madhura.cj(a)gmail.com> Commit: edffb52884b09562490081c3b8666ef46c296418 https://github.com/phpmyadmin/phpmyadmin/commit/edffb52884b09562490081c3b86… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M templates/table/search/rows_zoom.phtml Log Message: ----------- Fix XSS in zoom search Signed-off-by: Madhura Jayaratne <madhura.cj(a)gmail.com> Commit: ec0e88e37ef30a66eada1c072953f4ec385a3e49 https://github.com/phpmyadmin/phpmyadmin/commit/ec0e88e37ef30a66eada1c07295… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M libraries/common.inc.php M libraries/core.lib.php Log Message: ----------- Use hash_equals for comparing token Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 0a24f92d081033576bfdd9d4bdec1a54501734c1 https://github.com/phpmyadmin/phpmyadmin/commit/0a24f92d081033576bfdd9d4bde… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M import_status.php M libraries/Response.class.php M libraries/core.lib.php M libraries/display_import_ajax.lib.php M lint.php M normalization.php M setup/validate.php M version_check.php Log Message: ----------- Set correct content type for JSON responses Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: f20970d32c3dfdf82aef7b6c244da1f769043813 https://github.com/phpmyadmin/phpmyadmin/commit/f20970d32c3dfdf82aef7b6c244… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M libraries/session.inc.php Log Message: ----------- Use phpseclib's Crypt::Random to generate CSRF token Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: cb7748ac9cffcd1cd0f3081499cd4aafa9d1065e https://github.com/phpmyadmin/phpmyadmin/commit/cb7748ac9cffcd1cd0f3081499c… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M libraries/phpseclib/Crypt/AES.php M libraries/phpseclib/Crypt/Base.php M libraries/phpseclib/Crypt/Random.php M libraries/phpseclib/Crypt/Rijndael.php Log Message: ----------- Update phpseclib to 2.0.1 New version uses PHP 7.0 random_bytes to generate cryptographically secure pseudo-random bytes. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 11496890d7e21786cbfd9fd17ab968f498116b3f https://github.com/phpmyadmin/phpmyadmin/commit/11496890d7e21786cbfd9fd17ab… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M js/codemirror/addon/lint/sql-lint.js Log Message: ----------- Tell jQuery we're expecting JSON here It's better to be explicit rather than relying on autodetection. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: aca42efa01917cc0fe8cfdb2927a6399ca1742f2 https://github.com/phpmyadmin/phpmyadmin/commit/aca42efa01917cc0fe8cfdb2927… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-25 (Mon, 25 Jan 2016) Changed paths: M templates/header_location.phtml Log Message: ----------- Escape javascript variable content Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 671d61830417101352fd8153f276f8854bb17fd0 https://github.com/phpmyadmin/phpmyadmin/commit/671d61830417101352fd8153f27… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-25 (Mon, 25 Jan 2016) Changed paths: M ChangeLog M db_create.php M db_designer.php M export.php M gis_data_editor.php M js/server_status_monitor.js M js/server_status_variables.js M js/server_variables.js M libraries/sql.lib.php M schema_export.php M test/libraries/PMA_operations_test.php Log Message: ----------- Merge branch 'MAINT_4_5_4' into MAINT_4_5_4-security Commit: 8dedcc1a175eb07debd4fe116407c43694c60b22 https://github.com/phpmyadmin/phpmyadmin/commit/8dedcc1a175eb07debd4fe11640… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-25 (Mon, 25 Jan 2016) Changed paths: M js/functions.js Log Message: ----------- Use secure RNG if available Recent browsers come with better RNG, so let's use it for generating password instead of Math.random if available. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 912856b432d794201884c36e5f390d446339b6e4 https://github.com/phpmyadmin/phpmyadmin/commit/912856b432d794201884c36e5f3… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-25 (Mon, 25 Jan 2016) Changed paths: M js/functions.js Log Message: ----------- Use full alphabet to generate random passwords Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 3bb784045b7d75e530bdb34522e59d7ad233ba15 https://github.com/phpmyadmin/phpmyadmin/commit/3bb784045b7d75e530bdb34522e… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/phpseclib/Crypt/AES.php M libraries/phpseclib/Crypt/Base.php M libraries/phpseclib/Crypt/Random.php M libraries/phpseclib/Crypt/Rijndael.php M libraries/session.inc.php Log Message: ----------- Merge pull request #4 from phpmyadmin/random Improve token generation Commit: 8aa28962f14b5fc6aba8cf018b7e347d4854f427 https://github.com/phpmyadmin/phpmyadmin/commit/8aa28962f14b5fc6aba8cf018b7… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M import_status.php M js/codemirror/addon/lint/sql-lint.js M libraries/Response.class.php M libraries/core.lib.php M libraries/display_import_ajax.lib.php M lint.php M normalization.php M setup/validate.php M version_check.php Log Message: ----------- Merge pull request #6 from phpmyadmin/json-header Set correct content type for JSON responses Commit: c8615de52a8ad0ec235c6c6efcab1e7a6f8914df https://github.com/phpmyadmin/phpmyadmin/commit/c8615de52a8ad0ec235c6c6efca… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M templates/header_location.phtml Log Message: ----------- Merge pull request #7 from phpmyadmin/iis-escape Escape javascript variable content Commit: 1d885f90bc35cae54e348260e8a960754c6c3155 https://github.com/phpmyadmin/phpmyadmin/commit/1d885f90bc35cae54e348260e8a… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M js/functions.js Log Message: ----------- Merge pull request #8 from phpmyadmin/js-password Improve JS password generating Commit: 7ffd8d69a17fab5eee144a7e68990da35e45f089 https://github.com/phpmyadmin/phpmyadmin/commit/7ffd8d69a17fab5eee144a7e689… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/common.inc.php M libraries/core.lib.php Log Message: ----------- Merge pull request #5 from phpmyadmin/hash_equals Use hash_equals for comparing token Commit: 85ccdbb5b9c6c7a9830e5cb468662837a59a7aa3 https://github.com/phpmyadmin/phpmyadmin/commit/85ccdbb5b9c6c7a9830e5cb4686… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/common.inc.php Log Message: ----------- Include common libraries in setup We use PMA_fatalError which in turn needs Response and related objects. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 447c88f4884fe30a25d38c331c31d820a19f8c93 https://github.com/phpmyadmin/phpmyadmin/commit/447c88f4884fe30a25d38c331c3… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M setup/lib/common.inc.php Log Message: ----------- Can not use PMA_fatalError when including fails Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: f83b52737e321005959497d8e8f59f8aaedc9048 https://github.com/phpmyadmin/phpmyadmin/commit/f83b52737e321005959497d8e8f… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/common.inc.php Log Message: ----------- Do not process subforms with PMA_MINIMUM_COMMON In such case needed infrastructure is not loaded, so related code won't work anyway. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 76b10187c38634a29d6780f99f6dcd796191073b https://github.com/phpmyadmin/phpmyadmin/commit/76b10187c38634a29d6780f99f6… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/DatabaseInterface.class.php Log Message: ----------- Fallback to default collation connection If user supplied wrong string we should gracefully fallback. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: c57d3cc7b97b5f32801032f7bb222297aa97dfea https://github.com/phpmyadmin/phpmyadmin/commit/c57d3cc7b97b5f32801032f7bb2… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/sql-parser/autoload.php Log Message: ----------- Avoid invalid invocation of SQL parser Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 0cade5712a719f15c44a436895fff3802f1169a5 https://github.com/phpmyadmin/phpmyadmin/commit/0cade5712a719f15c44a436895f… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M test/libraries/core/PMA_headerLocation_test.php Log Message: ----------- Fix test expectations Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 60530a1df9f71870d045eef6ae3a845aa58f7973 https://github.com/phpmyadmin/phpmyadmin/commit/60530a1df9f71870d045eef6ae3… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M .travis.yml Log Message: ----------- Merge branch 'MAINT_4_5_4' into MAINT_4_5_4-security Commit: d4b9c22c1f8465bda5b6a83dc7e2cf59c3fe44e1 https://github.com/phpmyadmin/phpmyadmin/commit/d4b9c22c1f8465bda5b6a83dc7e… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-27 (Wed, 27 Jan 2016) Changed paths: M libraries/common.inc.php Log Message: ----------- Enable localization before redirect This is needed in case of IIS which needs full HTML response. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 5a3de108f26e4b0dddadddbe8ccdb1dd5526771f https://github.com/phpmyadmin/phpmyadmin/commit/5a3de108f26e4b0dddadddbe8cc… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-27 (Wed, 27 Jan 2016) Changed paths: M libraries/phpseclib/Crypt/AES.php M libraries/phpseclib/Crypt/Rijndael.php Log Message: ----------- Avoid execution outside phpMyAdmin This is hacky, but avoids path disclossure on direct access to the scripts. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: c9536a88e9d49a67bcfed4873e476aff4b0782b1 https://github.com/phpmyadmin/phpmyadmin/commit/c9536a88e9d49a67bcfed4873e4… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-27 (Wed, 27 Jan 2016) Changed paths: M libraries/phpseclib/Crypt/AES.php M libraries/phpseclib/Crypt/Rijndael.php Log Message: ----------- Move security check behind namespace Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 2870a797f366589d89bc23c6cf29681f17ce3a89 https://github.com/phpmyadmin/phpmyadmin/commit/2870a797f366589d89bc23c6cf2… Author: Isaac Bennetch <bennetch(a)gmail.com> Date: 2016-01-27 (Wed, 27 Jan 2016) Changed paths: M README M doc/conf.py M libraries/Config.class.php Log Message: ----------- Release 4.5.4 Signed-off-by: Isaac Bennetch <bennetch(a)gmail.com> Commit: 1d6efadaeac366a11b430bd70935d1a75d9bfbb8 https://github.com/phpmyadmin/phpmyadmin/commit/1d6efadaeac366a11b430bd7093… Author: Isaac Bennetch <bennetch(a)gmail.com> Date: 2016-01-28 (Thu, 28 Jan 2016) Changed paths: M import_status.php M js/codemirror/addon/lint/sql-lint.js M js/functions.js M js/normalization.js M libraries/DatabaseInterface.class.php M libraries/DbSearch.class.php M libraries/Response.class.php M libraries/common.inc.php M libraries/core.lib.php M libraries/display_import_ajax.lib.php M libraries/phpseclib/Crypt/AES.php M libraries/phpseclib/Crypt/Base.php M libraries/phpseclib/Crypt/Random.php M libraries/phpseclib/Crypt/Rijndael.php M libraries/session.inc.php M libraries/sql-parser/autoload.php M lint.php M normalization.php M setup/frames/form.inc.php M setup/index.php M setup/lib/common.inc.php M setup/validate.php M templates/header_location.phtml M templates/table/search/rows_zoom.phtml M test/libraries/core/PMA_headerLocation_test.php M version_check.php Log Message: ----------- Fix merge conflicts Signed-off-by: Isaac Bennetch <bennetch(a)gmail.com> Commit: ed96969ff991005899916f95590761addb38a31c https://github.com/phpmyadmin/phpmyadmin/commit/ed96969ff991005899916f95590… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-28 (Thu, 28 Jan 2016) Changed paths: M import_status.php M js/codemirror/addon/lint/sql-lint.js M js/functions.js M js/normalization.js M libraries/DatabaseInterface.php M libraries/DbSearch.php M libraries/Response.php M libraries/common.inc.php M libraries/core.lib.php M libraries/display_import_ajax.lib.php M libraries/phpseclib/Crypt/AES.php M libraries/phpseclib/Crypt/Base.php M libraries/phpseclib/Crypt/Random.php M libraries/phpseclib/Crypt/Rijndael.php M libraries/session.inc.php M libraries/session.lib.php M libraries/sql-parser/autoload.php M lint.php M normalization.php M setup/frames/form.inc.php M setup/index.php M setup/lib/common.inc.php M setup/validate.php M templates/header_location.phtml M templates/table/search/rows_zoom.phtml M test/libraries/core/PMA_headerLocation_test.php M version_check.php Log Message: ----------- Merge branch 'QA_4_5' Compare: https://github.com/phpmyadmin/phpmyadmin/compare/439feae865fd...ed96969ff991

1 0

[phpmyadmin/phpmyadmin]
by ibennetch 28 Jan '16

28 Jan '16

Branch: refs/tags/RELEASE_4_0_10_13 Home: https://github.com/phpmyadmin/phpmyadmin

1 0

[phpmyadmin/phpmyadmin]
by ibennetch 28 Jan '16

28 Jan '16

Branch: refs/tags/RELEASE_4_4_15_3 Home: https://github.com/phpmyadmin/phpmyadmin

1 0

[phpmyadmin/phpmyadmin]
by ibennetch 28 Jan '16

28 Jan '16

Branch: refs/tags/RELEASE_4_5_4 Home: https://github.com/phpmyadmin/phpmyadmin

1 0

[phpmyadmin/phpmyadmin] 75a558: Fix XSS in DB_search.php
by Isaac Bennetch 28 Jan '16

28 Jan '16

Branch: refs/heads/QA_4_5 Home: https://github.com/phpmyadmin/phpmyadmin Commit: 75a55824012406a08c4debf5ddb7ae41c32a7dbc https://github.com/phpmyadmin/phpmyadmin/commit/75a55824012406a08c4debf5ddb… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M libraries/DbSearch.class.php Log Message: ----------- Fix XSS in DB_search.php Signed-off-by: Madhura Jayaratne <madhura.cj(a)gmail.com> Commit: 5aee5035646c4fc617564cb0d3d58c0435d64d81 https://github.com/phpmyadmin/phpmyadmin/commit/5aee5035646c4fc617564cb0d3d… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M setup/frames/form.inc.php M setup/index.php M setup/validate.php Log Message: ----------- Fix path disclosure, items 1.4.x, 1.5 and 1.6 Signed-off-by: Madhura Jayaratne <madhura.cj(a)gmail.com> Commit: 019c4f25d500ec5db9ba3b84cc961a7e4e850738 https://github.com/phpmyadmin/phpmyadmin/commit/019c4f25d500ec5db9ba3b84cc9… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M js/normalization.js Log Message: ----------- Fix XSS in normalization.php Signed-off-by: Madhura Jayaratne <madhura.cj(a)gmail.com> Commit: edffb52884b09562490081c3b8666ef46c296418 https://github.com/phpmyadmin/phpmyadmin/commit/edffb52884b09562490081c3b86… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M templates/table/search/rows_zoom.phtml Log Message: ----------- Fix XSS in zoom search Signed-off-by: Madhura Jayaratne <madhura.cj(a)gmail.com> Commit: ec0e88e37ef30a66eada1c072953f4ec385a3e49 https://github.com/phpmyadmin/phpmyadmin/commit/ec0e88e37ef30a66eada1c07295… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M libraries/common.inc.php M libraries/core.lib.php Log Message: ----------- Use hash_equals for comparing token Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 0a24f92d081033576bfdd9d4bdec1a54501734c1 https://github.com/phpmyadmin/phpmyadmin/commit/0a24f92d081033576bfdd9d4bde… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M import_status.php M libraries/Response.class.php M libraries/core.lib.php M libraries/display_import_ajax.lib.php M lint.php M normalization.php M setup/validate.php M version_check.php Log Message: ----------- Set correct content type for JSON responses Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: f20970d32c3dfdf82aef7b6c244da1f769043813 https://github.com/phpmyadmin/phpmyadmin/commit/f20970d32c3dfdf82aef7b6c244… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M libraries/session.inc.php Log Message: ----------- Use phpseclib's Crypt::Random to generate CSRF token Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: cb7748ac9cffcd1cd0f3081499cd4aafa9d1065e https://github.com/phpmyadmin/phpmyadmin/commit/cb7748ac9cffcd1cd0f3081499c… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M libraries/phpseclib/Crypt/AES.php M libraries/phpseclib/Crypt/Base.php M libraries/phpseclib/Crypt/Random.php M libraries/phpseclib/Crypt/Rijndael.php Log Message: ----------- Update phpseclib to 2.0.1 New version uses PHP 7.0 random_bytes to generate cryptographically secure pseudo-random bytes. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 11496890d7e21786cbfd9fd17ab968f498116b3f https://github.com/phpmyadmin/phpmyadmin/commit/11496890d7e21786cbfd9fd17ab… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M js/codemirror/addon/lint/sql-lint.js Log Message: ----------- Tell jQuery we're expecting JSON here It's better to be explicit rather than relying on autodetection. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: aca42efa01917cc0fe8cfdb2927a6399ca1742f2 https://github.com/phpmyadmin/phpmyadmin/commit/aca42efa01917cc0fe8cfdb2927… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-25 (Mon, 25 Jan 2016) Changed paths: M templates/header_location.phtml Log Message: ----------- Escape javascript variable content Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 671d61830417101352fd8153f276f8854bb17fd0 https://github.com/phpmyadmin/phpmyadmin/commit/671d61830417101352fd8153f27… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-25 (Mon, 25 Jan 2016) Changed paths: M ChangeLog M db_create.php M db_designer.php M export.php M gis_data_editor.php M js/server_status_monitor.js M js/server_status_variables.js M js/server_variables.js M libraries/sql.lib.php M schema_export.php M test/libraries/PMA_operations_test.php Log Message: ----------- Merge branch 'MAINT_4_5_4' into MAINT_4_5_4-security Commit: 8dedcc1a175eb07debd4fe116407c43694c60b22 https://github.com/phpmyadmin/phpmyadmin/commit/8dedcc1a175eb07debd4fe11640… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-25 (Mon, 25 Jan 2016) Changed paths: M js/functions.js Log Message: ----------- Use secure RNG if available Recent browsers come with better RNG, so let's use it for generating password instead of Math.random if available. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 912856b432d794201884c36e5f390d446339b6e4 https://github.com/phpmyadmin/phpmyadmin/commit/912856b432d794201884c36e5f3… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-25 (Mon, 25 Jan 2016) Changed paths: M js/functions.js Log Message: ----------- Use full alphabet to generate random passwords Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 3bb784045b7d75e530bdb34522e59d7ad233ba15 https://github.com/phpmyadmin/phpmyadmin/commit/3bb784045b7d75e530bdb34522e… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/phpseclib/Crypt/AES.php M libraries/phpseclib/Crypt/Base.php M libraries/phpseclib/Crypt/Random.php M libraries/phpseclib/Crypt/Rijndael.php M libraries/session.inc.php Log Message: ----------- Merge pull request #4 from phpmyadmin/random Improve token generation Commit: 8aa28962f14b5fc6aba8cf018b7e347d4854f427 https://github.com/phpmyadmin/phpmyadmin/commit/8aa28962f14b5fc6aba8cf018b7… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M import_status.php M js/codemirror/addon/lint/sql-lint.js M libraries/Response.class.php M libraries/core.lib.php M libraries/display_import_ajax.lib.php M lint.php M normalization.php M setup/validate.php M version_check.php Log Message: ----------- Merge pull request #6 from phpmyadmin/json-header Set correct content type for JSON responses Commit: c8615de52a8ad0ec235c6c6efcab1e7a6f8914df https://github.com/phpmyadmin/phpmyadmin/commit/c8615de52a8ad0ec235c6c6efca… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M templates/header_location.phtml Log Message: ----------- Merge pull request #7 from phpmyadmin/iis-escape Escape javascript variable content Commit: 1d885f90bc35cae54e348260e8a960754c6c3155 https://github.com/phpmyadmin/phpmyadmin/commit/1d885f90bc35cae54e348260e8a… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M js/functions.js Log Message: ----------- Merge pull request #8 from phpmyadmin/js-password Improve JS password generating Commit: 7ffd8d69a17fab5eee144a7e68990da35e45f089 https://github.com/phpmyadmin/phpmyadmin/commit/7ffd8d69a17fab5eee144a7e689… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/common.inc.php M libraries/core.lib.php Log Message: ----------- Merge pull request #5 from phpmyadmin/hash_equals Use hash_equals for comparing token Commit: 85ccdbb5b9c6c7a9830e5cb468662837a59a7aa3 https://github.com/phpmyadmin/phpmyadmin/commit/85ccdbb5b9c6c7a9830e5cb4686… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/common.inc.php Log Message: ----------- Include common libraries in setup We use PMA_fatalError which in turn needs Response and related objects. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 447c88f4884fe30a25d38c331c31d820a19f8c93 https://github.com/phpmyadmin/phpmyadmin/commit/447c88f4884fe30a25d38c331c3… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M setup/lib/common.inc.php Log Message: ----------- Can not use PMA_fatalError when including fails Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: f83b52737e321005959497d8e8f59f8aaedc9048 https://github.com/phpmyadmin/phpmyadmin/commit/f83b52737e321005959497d8e8f… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/common.inc.php Log Message: ----------- Do not process subforms with PMA_MINIMUM_COMMON In such case needed infrastructure is not loaded, so related code won't work anyway. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 76b10187c38634a29d6780f99f6dcd796191073b https://github.com/phpmyadmin/phpmyadmin/commit/76b10187c38634a29d6780f99f6… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/DatabaseInterface.class.php Log Message: ----------- Fallback to default collation connection If user supplied wrong string we should gracefully fallback. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: c57d3cc7b97b5f32801032f7bb222297aa97dfea https://github.com/phpmyadmin/phpmyadmin/commit/c57d3cc7b97b5f32801032f7bb2… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/sql-parser/autoload.php Log Message: ----------- Avoid invalid invocation of SQL parser Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 0cade5712a719f15c44a436895fff3802f1169a5 https://github.com/phpmyadmin/phpmyadmin/commit/0cade5712a719f15c44a436895f… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M test/libraries/core/PMA_headerLocation_test.php Log Message: ----------- Fix test expectations Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 60530a1df9f71870d045eef6ae3a845aa58f7973 https://github.com/phpmyadmin/phpmyadmin/commit/60530a1df9f71870d045eef6ae3… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M .travis.yml Log Message: ----------- Merge branch 'MAINT_4_5_4' into MAINT_4_5_4-security Commit: d4b9c22c1f8465bda5b6a83dc7e2cf59c3fe44e1 https://github.com/phpmyadmin/phpmyadmin/commit/d4b9c22c1f8465bda5b6a83dc7e… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-27 (Wed, 27 Jan 2016) Changed paths: M libraries/common.inc.php Log Message: ----------- Enable localization before redirect This is needed in case of IIS which needs full HTML response. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 5a3de108f26e4b0dddadddbe8ccdb1dd5526771f https://github.com/phpmyadmin/phpmyadmin/commit/5a3de108f26e4b0dddadddbe8cc… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-27 (Wed, 27 Jan 2016) Changed paths: M libraries/phpseclib/Crypt/AES.php M libraries/phpseclib/Crypt/Rijndael.php Log Message: ----------- Avoid execution outside phpMyAdmin This is hacky, but avoids path disclossure on direct access to the scripts. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: c9536a88e9d49a67bcfed4873e476aff4b0782b1 https://github.com/phpmyadmin/phpmyadmin/commit/c9536a88e9d49a67bcfed4873e4… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-27 (Wed, 27 Jan 2016) Changed paths: M libraries/phpseclib/Crypt/AES.php M libraries/phpseclib/Crypt/Rijndael.php Log Message: ----------- Move security check behind namespace Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 2870a797f366589d89bc23c6cf29681f17ce3a89 https://github.com/phpmyadmin/phpmyadmin/commit/2870a797f366589d89bc23c6cf2… Author: Isaac Bennetch <bennetch(a)gmail.com> Date: 2016-01-27 (Wed, 27 Jan 2016) Changed paths: M README M doc/conf.py M libraries/Config.class.php Log Message: ----------- Release 4.5.4 Signed-off-by: Isaac Bennetch <bennetch(a)gmail.com> Commit: 1d6efadaeac366a11b430bd70935d1a75d9bfbb8 https://github.com/phpmyadmin/phpmyadmin/commit/1d6efadaeac366a11b430bd7093… Author: Isaac Bennetch <bennetch(a)gmail.com> Date: 2016-01-28 (Thu, 28 Jan 2016) Changed paths: M import_status.php M js/codemirror/addon/lint/sql-lint.js M js/functions.js M js/normalization.js M libraries/DatabaseInterface.class.php M libraries/DbSearch.class.php M libraries/Response.class.php M libraries/common.inc.php M libraries/core.lib.php M libraries/display_import_ajax.lib.php M libraries/phpseclib/Crypt/AES.php M libraries/phpseclib/Crypt/Base.php M libraries/phpseclib/Crypt/Random.php M libraries/phpseclib/Crypt/Rijndael.php M libraries/session.inc.php M libraries/sql-parser/autoload.php M lint.php M normalization.php M setup/frames/form.inc.php M setup/index.php M setup/lib/common.inc.php M setup/validate.php M templates/header_location.phtml M templates/table/search/rows_zoom.phtml M test/libraries/core/PMA_headerLocation_test.php M version_check.php Log Message: ----------- Fix merge conflicts Signed-off-by: Isaac Bennetch <bennetch(a)gmail.com> Compare: https://github.com/phpmyadmin/phpmyadmin/compare/77922b22e4ab...1d6efadaeac3

1 0

[phpmyadmin/phpmyadmin] 75a558: Fix XSS in DB_search.php
by Isaac Bennetch 28 Jan '16

28 Jan '16

Branch: refs/heads/MAINT_4_5_4 Home: https://github.com/phpmyadmin/phpmyadmin Commit: 75a55824012406a08c4debf5ddb7ae41c32a7dbc https://github.com/phpmyadmin/phpmyadmin/commit/75a55824012406a08c4debf5ddb… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M libraries/DbSearch.class.php Log Message: ----------- Fix XSS in DB_search.php Signed-off-by: Madhura Jayaratne <madhura.cj(a)gmail.com> Commit: 5aee5035646c4fc617564cb0d3d58c0435d64d81 https://github.com/phpmyadmin/phpmyadmin/commit/5aee5035646c4fc617564cb0d3d… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M setup/frames/form.inc.php M setup/index.php M setup/validate.php Log Message: ----------- Fix path disclosure, items 1.4.x, 1.5 and 1.6 Signed-off-by: Madhura Jayaratne <madhura.cj(a)gmail.com> Commit: 019c4f25d500ec5db9ba3b84cc961a7e4e850738 https://github.com/phpmyadmin/phpmyadmin/commit/019c4f25d500ec5db9ba3b84cc9… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M js/normalization.js Log Message: ----------- Fix XSS in normalization.php Signed-off-by: Madhura Jayaratne <madhura.cj(a)gmail.com> Commit: edffb52884b09562490081c3b8666ef46c296418 https://github.com/phpmyadmin/phpmyadmin/commit/edffb52884b09562490081c3b86… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M templates/table/search/rows_zoom.phtml Log Message: ----------- Fix XSS in zoom search Signed-off-by: Madhura Jayaratne <madhura.cj(a)gmail.com> Commit: ec0e88e37ef30a66eada1c072953f4ec385a3e49 https://github.com/phpmyadmin/phpmyadmin/commit/ec0e88e37ef30a66eada1c07295… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M libraries/common.inc.php M libraries/core.lib.php Log Message: ----------- Use hash_equals for comparing token Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 0a24f92d081033576bfdd9d4bdec1a54501734c1 https://github.com/phpmyadmin/phpmyadmin/commit/0a24f92d081033576bfdd9d4bde… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M import_status.php M libraries/Response.class.php M libraries/core.lib.php M libraries/display_import_ajax.lib.php M lint.php M normalization.php M setup/validate.php M version_check.php Log Message: ----------- Set correct content type for JSON responses Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: f20970d32c3dfdf82aef7b6c244da1f769043813 https://github.com/phpmyadmin/phpmyadmin/commit/f20970d32c3dfdf82aef7b6c244… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M libraries/session.inc.php Log Message: ----------- Use phpseclib's Crypt::Random to generate CSRF token Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: cb7748ac9cffcd1cd0f3081499cd4aafa9d1065e https://github.com/phpmyadmin/phpmyadmin/commit/cb7748ac9cffcd1cd0f3081499c… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M libraries/phpseclib/Crypt/AES.php M libraries/phpseclib/Crypt/Base.php M libraries/phpseclib/Crypt/Random.php M libraries/phpseclib/Crypt/Rijndael.php Log Message: ----------- Update phpseclib to 2.0.1 New version uses PHP 7.0 random_bytes to generate cryptographically secure pseudo-random bytes. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 11496890d7e21786cbfd9fd17ab968f498116b3f https://github.com/phpmyadmin/phpmyadmin/commit/11496890d7e21786cbfd9fd17ab… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M js/codemirror/addon/lint/sql-lint.js Log Message: ----------- Tell jQuery we're expecting JSON here It's better to be explicit rather than relying on autodetection. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: aca42efa01917cc0fe8cfdb2927a6399ca1742f2 https://github.com/phpmyadmin/phpmyadmin/commit/aca42efa01917cc0fe8cfdb2927… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-25 (Mon, 25 Jan 2016) Changed paths: M templates/header_location.phtml Log Message: ----------- Escape javascript variable content Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 671d61830417101352fd8153f276f8854bb17fd0 https://github.com/phpmyadmin/phpmyadmin/commit/671d61830417101352fd8153f27… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-25 (Mon, 25 Jan 2016) Changed paths: M ChangeLog M db_create.php M db_designer.php M export.php M gis_data_editor.php M js/server_status_monitor.js M js/server_status_variables.js M js/server_variables.js M libraries/sql.lib.php M schema_export.php M test/libraries/PMA_operations_test.php Log Message: ----------- Merge branch 'MAINT_4_5_4' into MAINT_4_5_4-security Commit: 8dedcc1a175eb07debd4fe116407c43694c60b22 https://github.com/phpmyadmin/phpmyadmin/commit/8dedcc1a175eb07debd4fe11640… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-25 (Mon, 25 Jan 2016) Changed paths: M js/functions.js Log Message: ----------- Use secure RNG if available Recent browsers come with better RNG, so let's use it for generating password instead of Math.random if available. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 912856b432d794201884c36e5f390d446339b6e4 https://github.com/phpmyadmin/phpmyadmin/commit/912856b432d794201884c36e5f3… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-25 (Mon, 25 Jan 2016) Changed paths: M js/functions.js Log Message: ----------- Use full alphabet to generate random passwords Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 3bb784045b7d75e530bdb34522e59d7ad233ba15 https://github.com/phpmyadmin/phpmyadmin/commit/3bb784045b7d75e530bdb34522e… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/phpseclib/Crypt/AES.php M libraries/phpseclib/Crypt/Base.php M libraries/phpseclib/Crypt/Random.php M libraries/phpseclib/Crypt/Rijndael.php M libraries/session.inc.php Log Message: ----------- Merge pull request #4 from phpmyadmin/random Improve token generation Commit: 8aa28962f14b5fc6aba8cf018b7e347d4854f427 https://github.com/phpmyadmin/phpmyadmin/commit/8aa28962f14b5fc6aba8cf018b7… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M import_status.php M js/codemirror/addon/lint/sql-lint.js M libraries/Response.class.php M libraries/core.lib.php M libraries/display_import_ajax.lib.php M lint.php M normalization.php M setup/validate.php M version_check.php Log Message: ----------- Merge pull request #6 from phpmyadmin/json-header Set correct content type for JSON responses Commit: c8615de52a8ad0ec235c6c6efcab1e7a6f8914df https://github.com/phpmyadmin/phpmyadmin/commit/c8615de52a8ad0ec235c6c6efca… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M templates/header_location.phtml Log Message: ----------- Merge pull request #7 from phpmyadmin/iis-escape Escape javascript variable content Commit: 1d885f90bc35cae54e348260e8a960754c6c3155 https://github.com/phpmyadmin/phpmyadmin/commit/1d885f90bc35cae54e348260e8a… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M js/functions.js Log Message: ----------- Merge pull request #8 from phpmyadmin/js-password Improve JS password generating Commit: 7ffd8d69a17fab5eee144a7e68990da35e45f089 https://github.com/phpmyadmin/phpmyadmin/commit/7ffd8d69a17fab5eee144a7e689… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/common.inc.php M libraries/core.lib.php Log Message: ----------- Merge pull request #5 from phpmyadmin/hash_equals Use hash_equals for comparing token Commit: 85ccdbb5b9c6c7a9830e5cb468662837a59a7aa3 https://github.com/phpmyadmin/phpmyadmin/commit/85ccdbb5b9c6c7a9830e5cb4686… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/common.inc.php Log Message: ----------- Include common libraries in setup We use PMA_fatalError which in turn needs Response and related objects. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 447c88f4884fe30a25d38c331c31d820a19f8c93 https://github.com/phpmyadmin/phpmyadmin/commit/447c88f4884fe30a25d38c331c3… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M setup/lib/common.inc.php Log Message: ----------- Can not use PMA_fatalError when including fails Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: f83b52737e321005959497d8e8f59f8aaedc9048 https://github.com/phpmyadmin/phpmyadmin/commit/f83b52737e321005959497d8e8f… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/common.inc.php Log Message: ----------- Do not process subforms with PMA_MINIMUM_COMMON In such case needed infrastructure is not loaded, so related code won't work anyway. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 76b10187c38634a29d6780f99f6dcd796191073b https://github.com/phpmyadmin/phpmyadmin/commit/76b10187c38634a29d6780f99f6… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/DatabaseInterface.class.php Log Message: ----------- Fallback to default collation connection If user supplied wrong string we should gracefully fallback. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: c57d3cc7b97b5f32801032f7bb222297aa97dfea https://github.com/phpmyadmin/phpmyadmin/commit/c57d3cc7b97b5f32801032f7bb2… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/sql-parser/autoload.php Log Message: ----------- Avoid invalid invocation of SQL parser Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 0cade5712a719f15c44a436895fff3802f1169a5 https://github.com/phpmyadmin/phpmyadmin/commit/0cade5712a719f15c44a436895f… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M test/libraries/core/PMA_headerLocation_test.php Log Message: ----------- Fix test expectations Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 60530a1df9f71870d045eef6ae3a845aa58f7973 https://github.com/phpmyadmin/phpmyadmin/commit/60530a1df9f71870d045eef6ae3… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M .travis.yml Log Message: ----------- Merge branch 'MAINT_4_5_4' into MAINT_4_5_4-security Commit: d4b9c22c1f8465bda5b6a83dc7e2cf59c3fe44e1 https://github.com/phpmyadmin/phpmyadmin/commit/d4b9c22c1f8465bda5b6a83dc7e… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-27 (Wed, 27 Jan 2016) Changed paths: M libraries/common.inc.php Log Message: ----------- Enable localization before redirect This is needed in case of IIS which needs full HTML response. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 5a3de108f26e4b0dddadddbe8ccdb1dd5526771f https://github.com/phpmyadmin/phpmyadmin/commit/5a3de108f26e4b0dddadddbe8cc… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-27 (Wed, 27 Jan 2016) Changed paths: M libraries/phpseclib/Crypt/AES.php M libraries/phpseclib/Crypt/Rijndael.php Log Message: ----------- Avoid execution outside phpMyAdmin This is hacky, but avoids path disclossure on direct access to the scripts. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: c9536a88e9d49a67bcfed4873e476aff4b0782b1 https://github.com/phpmyadmin/phpmyadmin/commit/c9536a88e9d49a67bcfed4873e4… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-27 (Wed, 27 Jan 2016) Changed paths: M libraries/phpseclib/Crypt/AES.php M libraries/phpseclib/Crypt/Rijndael.php Log Message: ----------- Move security check behind namespace Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 2870a797f366589d89bc23c6cf29681f17ce3a89 https://github.com/phpmyadmin/phpmyadmin/commit/2870a797f366589d89bc23c6cf2… Author: Isaac Bennetch <bennetch(a)gmail.com> Date: 2016-01-27 (Wed, 27 Jan 2016) Changed paths: M README M doc/conf.py M libraries/Config.class.php Log Message: ----------- Release 4.5.4 Signed-off-by: Isaac Bennetch <bennetch(a)gmail.com> Compare: https://github.com/phpmyadmin/phpmyadmin/compare/6e6b922ee8bd...2870a797f366

1 0

[phpmyadmin/phpmyadmin] b39c02: [Security] Fix path disclosure, items 1.4.x, 1.5 a...
by Isaac Bennetch 28 Jan '16

28 Jan '16

Branch: refs/heads/MAINT_4_4_15 Home: https://github.com/phpmyadmin/phpmyadmin Commit: b39c02b0a82b13d2198276d228051139e6b838d9 https://github.com/phpmyadmin/phpmyadmin/commit/b39c02b0a82b13d2198276d2280… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-15 (Fri, 15 Jan 2016) Changed paths: M setup/frames/form.inc.php M setup/index.php M setup/validate.php Log Message: ----------- [Security] Fix path disclosure, items 1.4.x, 1.5 and 1.6 Signed-off-by: Madhura Jayaratne <madhura.cj(a)gmail.com> Commit: 2b3f915f72bfe7eb9ae60a69582f041ddc55f663 https://github.com/phpmyadmin/phpmyadmin/commit/2b3f915f72bfe7eb9ae60a69582… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M libraries/DbSearch.class.php Log Message: ----------- Fix XSS in DB_search.php Signed-off-by: Madhura Jayaratne <madhura.cj(a)gmail.com> Commit: 8f86713de6163ccd0f8bd9987251a9d17feaee18 https://github.com/phpmyadmin/phpmyadmin/commit/8f86713de6163ccd0f8bd998725… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M js/normalization.js Log Message: ----------- Fix XSS in normalization.php Signed-off-by: Madhura Jayaratne <madhura.cj(a)gmail.com> Commit: 75de41635d387e1c3c8d71a746241502a90c8422 https://github.com/phpmyadmin/phpmyadmin/commit/75de41635d387e1c3c8d71a7462… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M libraries/TableSearch.class.php Log Message: ----------- Fix XSS in zoom search Signed-off-by: Madhura Jayaratne <madhura.cj(a)gmail.com> Commit: 8b6737735be5787d0b98c6cdfe2c7e3131b1bc95 https://github.com/phpmyadmin/phpmyadmin/commit/8b6737735be5787d0b98c6cdfe2… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M js/functions.js Log Message: ----------- Use secure RNG if available Recent browsers come with better RNG, so let's use it for generating password instead of Math.random if available. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 5530a72e162fab442218486a90ff3365c96fde98 https://github.com/phpmyadmin/phpmyadmin/commit/5530a72e162fab442218486a90f… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M js/functions.js Log Message: ----------- Use full alphabet to generate random passwords Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 91638c04d1f2c3977560a5b9db3ac3879a38691b https://github.com/phpmyadmin/phpmyadmin/commit/91638c04d1f2c3977560a5b9db3… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/session.inc.php Log Message: ----------- Use phpseclib's Crypt::Random to generate CSRF token Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 13384f7f47dadb02cfe950af0413c7d3e136df8e https://github.com/phpmyadmin/phpmyadmin/commit/13384f7f47dadb02cfe950af041… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/phpseclib/Crypt/AES.php M libraries/phpseclib/Crypt/Base.php M libraries/phpseclib/Crypt/Random.php M libraries/phpseclib/Crypt/Rijndael.php Log Message: ----------- Update phpseclib to 2.0.1 New version uses PHP 7.0 random_bytes to generate cryptographically secure pseudo-random bytes. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 3303b3d6c304d71da4a7d242307bf449aaa955c5 https://github.com/phpmyadmin/phpmyadmin/commit/3303b3d6c304d71da4a7d242307… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/common.inc.php M libraries/core.lib.php Log Message: ----------- Use hash_equals for comparing token Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 1414d60cbfe01a2d08ab9d5e6a7178a6323fca68 https://github.com/phpmyadmin/phpmyadmin/commit/1414d60cbfe01a2d08ab9d5e6a7… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/core.lib.php Log Message: ----------- Escape javascript variable content Signed-off-by: Madhura Jayaratne <madhura.cj(a)gmail.com> Commit: 470cd68344e86915679356dcc2cdb88c63a1d91d https://github.com/phpmyadmin/phpmyadmin/commit/470cd68344e86915679356dcc2c… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/common.inc.php Log Message: ----------- Include common libraries in setup We use PMA_fatalError which in turn needs Response and related objects. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: b95360334d69b032b58cafb7d29db6670e9c7224 https://github.com/phpmyadmin/phpmyadmin/commit/b95360334d69b032b58cafb7d29… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M setup/lib/common.inc.php Log Message: ----------- Can not use PMA_fatalError when including fails Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: d63a8ab7e028925707902266fc989760118a4c72 https://github.com/phpmyadmin/phpmyadmin/commit/d63a8ab7e028925707902266fc9… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/common.inc.php Log Message: ----------- Do not process subforms with PMA_MINIMUM_COMMON In such case needed infrastructure is not loaded, so related code won't work anyway. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 879a14ad165b475ec58ceab33687d7cc5913a63b https://github.com/phpmyadmin/phpmyadmin/commit/879a14ad165b475ec58ceab3368… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/DatabaseInterface.class.php Log Message: ----------- Fallback to default collation connection If user supplied wrong string we should gracefully fallback. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: ccf3c36f474f8b202c7d3b167b2477d23fd5b8e6 https://github.com/phpmyadmin/phpmyadmin/commit/ccf3c36f474f8b202c7d3b167b2… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M .travis.yml M libraries/VersionInformation.php Log Message: ----------- Merge branch 'MAINT_4_4_15' into MAINT_4_4_15-security Commit: d0a9baef3728a37120d53dc0a96abf04ace139da https://github.com/phpmyadmin/phpmyadmin/commit/d0a9baef3728a37120d53dc0a96… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-27 (Wed, 27 Jan 2016) Changed paths: M libraries/common.inc.php Log Message: ----------- Enable localization before redirect This is needed in case of IIS which needs full HTML response. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 3b96f3600651163b8c1d9b6ff7ebd0b142412993 https://github.com/phpmyadmin/phpmyadmin/commit/3b96f3600651163b8c1d9b6ff7e… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-27 (Wed, 27 Jan 2016) Changed paths: M libraries/phpseclib/Crypt/AES.php M libraries/phpseclib/Crypt/Rijndael.php Log Message: ----------- Avoid execution outside phpMyAdmin This is hacky, but avoids path disclossure on direct access to the scripts. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 11eeed0c0577acc256ad1a331cda7e65d51d3a41 https://github.com/phpmyadmin/phpmyadmin/commit/11eeed0c0577acc256ad1a331cd… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-27 (Wed, 27 Jan 2016) Changed paths: M libraries/phpseclib/Crypt/AES.php M libraries/phpseclib/Crypt/Rijndael.php Log Message: ----------- Move security check behind namespace Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: c21937440af0b0b2ed752f229c3d2523ac178d85 https://github.com/phpmyadmin/phpmyadmin/commit/c21937440af0b0b2ed752f229c3… Author: Isaac Bennetch <bennetch(a)gmail.com> Date: 2016-01-27 (Wed, 27 Jan 2016) Changed paths: M README M doc/conf.py M libraries/Config.class.php Log Message: ----------- Release 4.4.15.3 Signed-off-by: Isaac Bennetch <bennetch(a)gmail.com> Compare: https://github.com/phpmyadmin/phpmyadmin/compare/01d0e0975f68...c21937440af0

1 0

[phpmyadmin/phpmyadmin] ac8159: [Security] Fix path disclosure, items 1.4.x, 1.5 a...
by Isaac Bennetch 28 Jan '16

28 Jan '16

Branch: refs/heads/MAINT_4_0_10 Home: https://github.com/phpmyadmin/phpmyadmin Commit: ac81596bfcf0b3cae9f6bc821efa4aa1c7f0c81d https://github.com/phpmyadmin/phpmyadmin/commit/ac81596bfcf0b3cae9f6bc821ef… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-15 (Fri, 15 Jan 2016) Changed paths: M setup/frames/form.inc.php M setup/index.php M setup/validate.php Log Message: ----------- [Security] Fix path disclosure, items 1.4.x, 1.5 and 1.6 Signed-off-by: Madhura Jayaratne <madhura.cj(a)gmail.com> Commit: 9f3488fc3ab6b83618dbb4bebbea4b973764e2ac https://github.com/phpmyadmin/phpmyadmin/commit/9f3488fc3ab6b83618dbb4bebbe… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M libraries/TableSearch.class.php Log Message: ----------- Fix XSS in zoom search Signed-off-by: Madhura Jayaratne <madhura.cj(a)gmail.com> Commit: 0ce4fd2750491a54d27f94cc1403f9da21738aa6 https://github.com/phpmyadmin/phpmyadmin/commit/0ce4fd2750491a54d27f94cc140… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-19 (Tue, 19 Jan 2016) Changed paths: M libraries/DbSearch.class.php Log Message: ----------- Fix XSS in DB_search.php Signed-off-by: Madhura Jayaratne <madhura.cj(a)gmail.com> Commit: 6a96e67487f2faecb4de4204fee9b96b94020720 https://github.com/phpmyadmin/phpmyadmin/commit/6a96e67487f2faecb4de4204fee… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M js/functions.js Log Message: ----------- Use secure RNG if available Recent browsers come with better RNG, so let's use it for generating password instead of Math.random if available. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 2369daa7f5f550797f560e6b46a021e4558c2d72 https://github.com/phpmyadmin/phpmyadmin/commit/2369daa7f5f550797f560e6b46a… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M js/functions.js Log Message: ----------- Use full alphabet to generate random passwords Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 6fe54dfa000dd6f43f237e859781fad7111ac1bd https://github.com/phpmyadmin/phpmyadmin/commit/6fe54dfa000dd6f43f237e85978… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: A libraries/phpseclib/Crypt/Random.php M libraries/session.inc.php Log Message: ----------- Use phpseclib's Crypt::Random to generate CSRF token Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 27eb98faedcdcd0b856577fcbdfe3e87b2445345 https://github.com/phpmyadmin/phpmyadmin/commit/27eb98faedcdcd0b856577fcbdf… Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/core.lib.php Log Message: ----------- Escape javascript variable content Signed-off-by: Madhura Jayaratne <madhura.cj(a)gmail.com> Commit: fe62b69a5b032de8e1d9d0a04456c1cecf46428c https://github.com/phpmyadmin/phpmyadmin/commit/fe62b69a5b032de8e1d9d0a0445… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/common.inc.php M libraries/core.lib.php Log Message: ----------- Use hash_equals for comparing token Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 8023340a259ecae6a3bd9268f4e39d097bdf0146 https://github.com/phpmyadmin/phpmyadmin/commit/8023340a259ecae6a3bd9268f4e… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/common.inc.php Log Message: ----------- Include common libraries in setup We use PMA_fatalError which in turn needs Response and related objects. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 215f4a8ebe717ba646be00fca8519cf768a902f5 https://github.com/phpmyadmin/phpmyadmin/commit/215f4a8ebe717ba646be00fca85… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M setup/lib/common.inc.php Log Message: ----------- Can not use PMA_fatalError when including fails Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 7056ca9458d26b24a6b1d9255073237c1636ca33 https://github.com/phpmyadmin/phpmyadmin/commit/7056ca9458d26b24a6b1d925507… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/common.inc.php Log Message: ----------- Do not process subforms with PMA_MINIMUM_COMMON In such case needed infrastructure is not loaded, so related code won't work anyway. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 25738352df8057b542eeac3237eb6fd1d3ba4289 https://github.com/phpmyadmin/phpmyadmin/commit/25738352df8057b542eeac3237e… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-26 (Tue, 26 Jan 2016) Changed paths: M libraries/database_interface.lib.php Log Message: ----------- Fallback to default collation connection If user supplied wrong string we should gracefully fallback. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 5b79467245b6e0a476775e2958b42088794f8e02 https://github.com/phpmyadmin/phpmyadmin/commit/5b79467245b6e0a476775e2958b… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-27 (Wed, 27 Jan 2016) Changed paths: M libraries/common.inc.php Log Message: ----------- Enable localization before redirect This is needed in case of IIS which needs full HTML response. Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 16136ea0ef224ed22c3dffd629e3e147579f5f38 https://github.com/phpmyadmin/phpmyadmin/commit/16136ea0ef224ed22c3dffd629e… Author: Isaac Bennetch <bennetch(a)gmail.com> Date: 2016-01-27 (Wed, 27 Jan 2016) Changed paths: M README M doc/conf.py M libraries/Config.class.php Log Message: ----------- Increment version for 4.0.10.13 release Signed-off-by: Isaac Bennetch <bennetch(a)gmail.com> Compare: https://github.com/phpmyadmin/phpmyadmin/compare/66149607b1b5...16136ea0ef22

1 0

[phpmyadmin/error-reporting-server] 28cfd9: Add logging
by Michal Čihař 27 Jan '16

27 Jan '16

Branch: refs/heads/master Home: https://github.com/phpmyadmin/error-reporting-server Commit: 28cfd939ce3905fd8b49aa81bd8ecd55a7faca3e https://github.com/phpmyadmin/error-reporting-server/commit/28cfd939ce3905f… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-27 (Wed, 27 Jan 2016) Changed paths: M phpunit.xml.dist Log Message: ----------- Add logging Signed-off-by: Michal Čihař <michal(a)cihar.com>

1 0

[phpmyadmin/error-reporting-server] ac0e9e: Fix vendor exclude path
by Michal Čihař 27 Jan '16

27 Jan '16

Branch: refs/heads/master Home: https://github.com/phpmyadmin/error-reporting-server Commit: ac0e9e3505cbe7568cba7d9d9dfa2e49909ff673 https://github.com/phpmyadmin/error-reporting-server/commit/ac0e9e3505cbe75… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-27 (Wed, 27 Jan 2016) Changed paths: M build.xml Log Message: ----------- Fix vendor exclude path Signed-off-by: Michal Čihař <michal(a)cihar.com> Commit: 08427569b0ede36f543241a5fe2de55b96fff6bb https://github.com/phpmyadmin/error-reporting-server/commit/08427569b0ede36… Author: Michal Čihař <michal(a)cihar.com> Date: 2016-01-27 (Wed, 27 Jan 2016) Changed paths: M build.xml Log Message: ----------- Generate checkstyle output from jshint Signed-off-by: Michal Čihař <michal(a)cihar.com> Compare: https://github.com/phpmyadmin/error-reporting-server/compare/84dee314ecbd..…

1 0