- Git - lists.phpmyadmin.net

[Phpmyadmin-git] [SCM] phpMyAdmin branch, MAINT_3_4_8, updated. RELEASE_3_4_7_1-44-gb00745d
by Marc Delisle 24 Nov '11

24 Nov '11

The branch, MAINT_3_4_8 has been updated via b00745d352c89a5e52673e717e6cbef43dc229d6 (commit) from 29455fe79bc9896129d7004e0242c451f4a32cc8 (commit) - Log ----------------------------------------------------------------- commit b00745d352c89a5e52673e717e6cbef43dc229d6 Author: Marc Delisle <marc(a)infomarc.info> Date: Thu Nov 24 17:09:17 2011 -0500 3.4.8-rc1 ----------------------------------------------------------------------- Summary of changes: Documentation.html | 4 ++-- README | 2 +- libraries/Config.class.php | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Documentation.html b/Documentation.html index 1d938d9..3d9f3c3 100644 --- a/Documentation.html +++ b/Documentation.html @@ -9,7 +9,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <link rel="icon" href="./favicon.ico" type="image/x-icon" /> <link rel="shortcut icon" href="./favicon.ico" type="image/x-icon" /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> - <title>phpMyAdmin 3.4.8-dev - Documentation</title> + <title>phpMyAdmin 3.4.8-rc1 - Documentation</title> <link rel="stylesheet" type="text/css" href="docs.css" /> </head> @@ -17,7 +17,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <div id="header"> <h1> <a href="http://www.phpmyadmin.net/">php<span class="myadmin">MyAdmin</span></a> - 3.4.8-dev + 3.4.8-rc1 Documentation </h1> </div> diff --git a/README b/README index aecad4c..65349d8 100644 --- a/README +++ b/README @@ -1,7 +1,7 @@ phpMyAdmin - Readme =================== -Version 3.4.8-dev +Version 3.4.8-rc1 A set of PHP-scripts to manage MySQL over the web. diff --git a/libraries/Config.class.php b/libraries/Config.class.php index ed9d775..bd02527 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -96,7 +96,7 @@ class PMA_Config */ function checkSystem() { - $this->set('PMA_VERSION', '3.4.8-dev'); + $this->set('PMA_VERSION', '3.4.8-rc1'); /** * @deprecated */ hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_7_1-23453-g7d553e1
by Marc Delisle 24 Nov '11

24 Nov '11

The branch, master has been updated via 7d553e1bc8b7aec7701c1cf045b297cf0685c8f4 (commit) from 96dd071a5f2362d5a244656bf4acf240b5b1aac0 (commit) - Log ----------------------------------------------------------------- commit 7d553e1bc8b7aec7701c1cf045b297cf0685c8f4 Author: Marc Delisle <marc(a)infomarc.info> Date: Thu Nov 24 17:06:51 2011 -0500 3.4.9-dev ----------------------------------------------------------------------- Summary of changes: ChangeLog | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/ChangeLog b/ChangeLog index 062ee96..c895ddb 100644 --- a/ChangeLog +++ b/ChangeLog @@ -61,6 +61,8 @@ phpMyAdmin - ChangeLog + patch #3432835 [interface] Add useful intermediate pages to pageselector + [interface] Improved index editor +3.4.9.0 (not yet released) + 3.4.8.0 (not yet released) - bug #3425230 [interface] enum data split at space char (more space to edit) - bug #3426840 [interface] ENUM/SET editor can't handle commas in values hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_4, updated. RELEASE_3_4_7_1-44-gc43baba
by Marc Delisle 24 Nov '11

24 Nov '11

The branch, QA_3_4 has been updated via c43babad7cbde73098ded7fe502027a1af731f4b (commit) from 29455fe79bc9896129d7004e0242c451f4a32cc8 (commit) - Log ----------------------------------------------------------------- commit c43babad7cbde73098ded7fe502027a1af731f4b Author: Marc Delisle <marc(a)infomarc.info> Date: Thu Nov 24 17:05:44 2011 -0500 3.4.9-dev ----------------------------------------------------------------------- Summary of changes: ChangeLog | 2 ++ Documentation.html | 4 ++-- README | 2 +- libraries/Config.class.php | 2 +- 4 files changed, 6 insertions(+), 4 deletions(-) diff --git a/ChangeLog b/ChangeLog index 7c40e9d..dd66822 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,8 @@ phpMyAdmin - ChangeLog ====================== +3.4.9.0 (not yet released) + 3.4.8.0 (not yet released) - bug #3425230 [interface] enum data split at space char (more space to edit) - bug #3426840 [interface] ENUM/SET editor can't handle commas in values diff --git a/Documentation.html b/Documentation.html index 1d938d9..c0952f0 100644 --- a/Documentation.html +++ b/Documentation.html @@ -9,7 +9,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <link rel="icon" href="./favicon.ico" type="image/x-icon" /> <link rel="shortcut icon" href="./favicon.ico" type="image/x-icon" /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> - <title>phpMyAdmin 3.4.8-dev - Documentation</title> + <title>phpMyAdmin 3.4.9-dev - Documentation</title> <link rel="stylesheet" type="text/css" href="docs.css" /> </head> @@ -17,7 +17,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <div id="header"> <h1> <a href="http://www.phpmyadmin.net/">php<span class="myadmin">MyAdmin</span></a> - 3.4.8-dev + 3.4.9-dev Documentation </h1> </div> diff --git a/README b/README index aecad4c..fb06935 100644 --- a/README +++ b/README @@ -1,7 +1,7 @@ phpMyAdmin - Readme =================== -Version 3.4.8-dev +Version 3.4.9-dev A set of PHP-scripts to manage MySQL over the web. diff --git a/libraries/Config.class.php b/libraries/Config.class.php index ed9d775..2539c4e 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -96,7 +96,7 @@ class PMA_Config */ function checkSystem() { - $this->set('PMA_VERSION', '3.4.8-dev'); + $this->set('PMA_VERSION', '3.4.9-dev'); /** * @deprecated */ hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, MAINT_3_4_8, created. RELEASE_3_4_7_1-43-g29455fe
by Marc Delisle 24 Nov '11

24 Nov '11

The branch, MAINT_3_4_8 has been created at 29455fe79bc9896129d7004e0242c451f4a32cc8 (commit) - Log ----------------------------------------------------------------- ----------------------------------------------------------------------- hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_7_1-23452-g96dd071
by Marc Delisle 24 Nov '11

24 Nov '11

The branch, master has been updated via 96dd071a5f2362d5a244656bf4acf240b5b1aac0 (commit) via 29455fe79bc9896129d7004e0242c451f4a32cc8 (commit) via cf5faa1dd1bcae329eddb793765ad2ba3e4471dc (commit) via 077c10020e349e8c1beb46309098992fde616913 (commit) via dac8d6ce256333ff45b5f46270304b8657452740 (commit) via bc45a1048d2f5ca8a532f774ddb1dd80985dff3d (commit) via 1490533d91e9d3820e78ca4eac7981886eaea2cb (commit) via b289fe082441dc739939b0ba15dae0d9dc6cee92 (commit) from 03fd5593823d6999e85792a910d460902f844db3 (commit) - Log ----------------------------------------------------------------- commit 96dd071a5f2362d5a244656bf4acf240b5b1aac0 Merge: 03fd559 29455fe Author: Marc Delisle <marc(a)infomarc.info> Date: Thu Nov 24 16:54:25 2011 -0500 Fix merge conflicts ----------------------------------------------------------------------- Summary of changes: ChangeLog | 5 +++++ js/db_operations.js | 2 +- libraries/common.lib.php | 5 +---- tbl_indexes.php | 4 ++-- tbl_select.php | 2 +- 5 files changed, 10 insertions(+), 8 deletions(-) diff --git a/ChangeLog b/ChangeLog index 2c6e859..062ee96 100644 --- a/ChangeLog +++ b/ChangeLog @@ -81,6 +81,11 @@ phpMyAdmin - ChangeLog - [interface] Avoid showing the password in phpinfo()'s output - bug #3441572 [GUI] 'newer version of phpMyAdmin' message not shown in IE8 - bug #3407235 [interface] Entering the key through a lookup window does not reset NULL +- [security] Self-XSS on database names (Synchronize), see PMASA-2011-18 +- [security] Self-XSS on database names (Operations/rename), see PMASA-2011-18 +- [security] Self-XSS on column type (Create index), see PMASA-2011-18 +- [security] Self-XSS on column type (table Search), see PMASA-2011-18 +- [security] Self-XSS on invalid query (table overview), see PMASA-2011-18 3.4.7.1 (2011-11-10) - [security] Fixed possible local file inclusion in XML import diff --git a/js/db_operations.js b/js/db_operations.js index 9776cef..bc61679 100644 --- a/js/db_operations.js +++ b/js/db_operations.js @@ -32,7 +32,7 @@ $(document).ready(function() { var $form = $(this); - var question = 'CREATE DATABASE ' + $('#new_db_name').val() + ' / DROP DATABASE ' + window.parent.db; + var question = escapeHtml('CREATE DATABASE ' + $('#new_db_name').val() + ' / DROP DATABASE ' + window.parent.db); PMA_prepareForAjaxRequest($form); /** diff --git a/libraries/common.lib.php b/libraries/common.lib.php index bb5c6e1..767e284 100644 --- a/libraries/common.lib.php +++ b/libraries/common.lib.php @@ -1066,13 +1066,10 @@ function PMA_showMessage($message, $sql_query = null, $type = 'notice', $is_view } else { // Parse SQL if needed $parsed_sql = PMA_SQP_parse($query_base); - if (PMA_SQP_isError()) { - unset($parsed_sql); - } } // Analyze it - if (isset($parsed_sql)) { + if (isset($parsed_sql) && ! PMA_SQP_isError()) { $analyzed_display_query = PMA_SQP_analyze($parsed_sql); // Same as below (append LIMIT), append the remembered ORDER BY diff --git a/tbl_indexes.php b/tbl_indexes.php index 195568b..bcdc59c 100644 --- a/tbl_indexes.php +++ b/tbl_indexes.php @@ -233,7 +233,7 @@ foreach ($index->getColumns() as $column) { ) { echo '<option value="' . htmlspecialchars($field_name) . '"' . (($field_name == $column->getName()) ? ' selected="selected"' : '') . '>' - . htmlspecialchars($field_name) . ' [' . $field_type . ']' + . htmlspecialchars($field_name) . ' [' . htmlspecialchars($field_type) . ']' . '</option>' . "\n"; } } // end foreach $fields @@ -256,7 +256,7 @@ for ($i = 0; $i < $add_fields; $i++) { <?php foreach ($fields as $field_name => $field_type) { echo '<option value="' . htmlspecialchars($field_name) . '">' - . htmlspecialchars($field_name) . ' [' . $field_type . ']' + . htmlspecialchars($field_name) . ' [' . htmlspecialchars($field_type) . ']' . '</option>' . "\n"; } // end foreach $fields ?> diff --git a/tbl_select.php b/tbl_select.php index 7103814..c888291 100644 --- a/tbl_select.php +++ b/tbl_select.php @@ -113,7 +113,7 @@ echo PMA_generate_html_tabs(PMA_tbl_getSubTabs(), $url_params, '', 'topmenu2'); } ?> <th><?php echo htmlspecialchars($fields_list[$i]); ?></th> - <td><?php echo $fields_type[$i]; ?></td> + <td><?php echo htmlspecialchars($fields_type[$i]); ?></td> <td><?php echo $fields_collation[$i]; ?></td> <td><select name="func[]"> <?php hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_7_1-23444-g03fd559
by Michal Čihař 24 Nov '11

24 Nov '11

The branch, master has been updated via 03fd5593823d6999e85792a910d460902f844db3 (commit) from 378fe0b5972ce57f38faf333986a5538d104cf50 (commit) - Log ----------------------------------------------------------------- commit 03fd5593823d6999e85792a910d460902f844db3 Author: Michal Čihař <michal(a)cihar.com> Date: Thu Nov 24 19:25:08 2011 +0100 Fix syntax error introduced by f62c4a1809458008c778afac98e481f54def216b ----------------------------------------------------------------------- Summary of changes: server_databases.php | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/server_databases.php b/server_databases.php index c76da53..0b01f4c 100644 --- a/server_databases.php +++ b/server_databases.php @@ -247,7 +247,7 @@ if ($databases_count > 0) { foreach ($replication_types as $type) { if (${"server_{$type}_status"}) { echo ' <th></th>' . "\n"; - { + } } if ($is_superuser) { hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_7_1-23443-g378fe0b
by Madhura Jayaratne 24 Nov '11

24 Nov '11

The branch, master has been updated via 378fe0b5972ce57f38faf333986a5538d104cf50 (commit) via ff0ea2f9b960359234fab02a74b156bc9bb1e383 (commit) from c8dbed11b2e2ad76c3c7dcd41777f314427f3f32 (commit) - Log ----------------------------------------------------------------- commit 378fe0b5972ce57f38faf333986a5538d104cf50 Merge: c8dbed1 ff0ea2f Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: Thu Nov 24 23:42:25 2011 +0530 Merge branch 'QA_3_4' ----------------------------------------------------------------------- Summary of changes: hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_4, updated. RELEASE_3_4_7_1-43-g29455fe
by Madhura Jayaratne 24 Nov '11

24 Nov '11

The branch, QA_3_4 has been updated via 29455fe79bc9896129d7004e0242c451f4a32cc8 (commit) via ff0ea2f9b960359234fab02a74b156bc9bb1e383 (commit) from cf5faa1dd1bcae329eddb793765ad2ba3e4471dc (commit) - Log ----------------------------------------------------------------- commit 29455fe79bc9896129d7004e0242c451f4a32cc8 Merge: ff0ea2f cf5faa1 Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: Thu Nov 24 23:12:37 2011 +0530 Merge branch 'QA_3_4' of ssh://phpmyadmin.git.sourceforge.net/gitroot/phpmyadmin/phpmyadmin into QA_3_4 commit ff0ea2f9b960359234fab02a74b156bc9bb1e383 Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: Sun Nov 20 23:01:58 2011 +0530 bug #3431427: Fix for enum and set columns ----------------------------------------------------------------------- Summary of changes: js/tbl_change.js | 15 +++++++++++---- 1 files changed, 11 insertions(+), 4 deletions(-) diff --git a/js/tbl_change.js b/js/tbl_change.js index 79e7906..234e4e1 100644 --- a/js/tbl_change.js +++ b/js/tbl_change.js @@ -26,10 +26,9 @@ function nullify(theType, urlField, md5Field, multi_edit) rowForm.elements['funcs' + multi_edit + '[' + md5Field + ']'].selectedIndex = -1; } - // "SET" field , "ENUM" field with more than 20 characters - // or foreign key field (drop-down) - if (theType == 1 || theType == 3 || theType == 4) { - rowForm.elements['fields' + multi_edit + '[' + md5Field + ']'].selectedIndex = -1; + // "ENUM" field with more than 20 characters + if (theType == 1) { + rowForm.elements['fields' + multi_edit + '[' + md5Field + ']'][1].selectedIndex = -1; } // Other "ENUM" field else if (theType == 2) { @@ -45,6 +44,14 @@ function nullify(theType, urlField, md5Field, multi_edit) } // end if } + // "SET" field + else if (theType == 3) { + rowForm.elements['fields' + multi_edit + '[' + md5Field + '][]'].selectedIndex = -1; + } + // Foreign key field (drop-down) + else if (theType == 4) { + rowForm.elements['fields' + multi_edit + '[' + md5Field + ']'].selectedIndex = -1; + } // foreign key field (with browsing icon for foreign values) else if (theType == 6) { rowForm.elements['fields' + multi_edit + '[' + md5Field + ']'].value = ''; hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_4, updated. RELEASE_3_4_7_1-41-gcf5faa1
by Marc Delisle 24 Nov '11

24 Nov '11

The branch, QA_3_4 has been updated via cf5faa1dd1bcae329eddb793765ad2ba3e4471dc (commit) via 077c10020e349e8c1beb46309098992fde616913 (commit) via dac8d6ce256333ff45b5f46270304b8657452740 (commit) via bc45a1048d2f5ca8a532f774ddb1dd80985dff3d (commit) via 1490533d91e9d3820e78ca4eac7981886eaea2cb (commit) via b289fe082441dc739939b0ba15dae0d9dc6cee92 (commit) from f414a0ec32626c3f0084bd020daba2b4553d244b (commit) - Log ----------------------------------------------------------------- commit cf5faa1dd1bcae329eddb793765ad2ba3e4471dc Merge: f414a0e 077c100 Author: Marc Delisle <marc(a)infomarc.info> Date: Thu Nov 24 12:26:31 2011 -0500 Fix merge conflicts commit 077c10020e349e8c1beb46309098992fde616913 Author: Dieter Adriaenssens <ruleant(a)users.sourceforge.net> Date: Tue Nov 22 21:59:19 2011 +0100 [security] Self-XSS on invalid query (table overview), see PMASA-2011-18 commit dac8d6ce256333ff45b5f46270304b8657452740 Author: Marc Delisle <marc(a)infomarc.info> Date: Tue Nov 22 12:46:46 2011 -0500 [security] Self-XSS on column type (table Search), see PMASA-2011-18 commit bc45a1048d2f5ca8a532f774ddb1dd80985dff3d Author: Rouslan Placella <rouslan(a)placella.com> Date: Tue Nov 22 12:38:22 2011 -0500 [security] Self-XSS on column type (Create index), see PMASA-2011-18 commit 1490533d91e9d3820e78ca4eac7981886eaea2cb Author: Marc Delisle <marc(a)infomarc.info> Date: Mon Nov 21 18:08:49 2011 -0500 [security] Self-XSS on database names (Operations/rename), see PMASA-2011-18 commit b289fe082441dc739939b0ba15dae0d9dc6cee92 Author: Marc Delisle <marc(a)infomarc.info> Date: Mon Nov 21 17:53:10 2011 -0500 [security] Self-XSS on database names (Synchronize), see PMASA-2011-18 ----------------------------------------------------------------------- Summary of changes: ChangeLog | 5 +++++ js/db_operations.js | 2 +- libraries/common.lib.php | 5 +---- libraries/server_synchronize.lib.php | 4 ++-- tbl_indexes.php | 4 ++-- tbl_select.php | 4 ++-- 6 files changed, 13 insertions(+), 11 deletions(-) diff --git a/ChangeLog b/ChangeLog index 36a9e0a..7c40e9d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -21,6 +21,11 @@ phpMyAdmin - ChangeLog - [interface] Avoid showing the password in phpinfo()'s output - bug #3441572 [GUI] 'newer version of phpMyAdmin' message not shown in IE8 - bug #3407235 [interface] Entering the key through a lookup window does not reset NULL +- [security] Self-XSS on database names (Synchronize), see PMASA-2011-18 +- [security] Self-XSS on database names (Operations/rename), see PMASA-2011-18 +- [security] Self-XSS on column type (Create index), see PMASA-2011-18 +- [security] Self-XSS on column type (table Search), see PMASA-2011-18 +- [security] Self-XSS on invalid query (table overview), see PMASA-2011-18 3.4.7.1 (2011-11-10) - [security] Fixed possible local file inclusion in XML import diff --git a/js/db_operations.js b/js/db_operations.js index b053694..ad39635 100644 --- a/js/db_operations.js +++ b/js/db_operations.js @@ -32,7 +32,7 @@ $(document).ready(function() { var $form = $(this); - var question = 'CREATE DATABASE ' + $('#new_db_name').val() + ' / DROP DATABASE ' + window.parent.db; + var question = escapeHtml('CREATE DATABASE ' + $('#new_db_name').val() + ' / DROP DATABASE ' + window.parent.db); PMA_prepareForAjaxRequest($form); /** diff --git a/libraries/common.lib.php b/libraries/common.lib.php index ad38266..caeeee2 100644 --- a/libraries/common.lib.php +++ b/libraries/common.lib.php @@ -1059,13 +1059,10 @@ function PMA_showMessage($message, $sql_query = null, $type = 'notice', $is_view } else { // Parse SQL if needed $parsed_sql = PMA_SQP_parse($query_base); - if (PMA_SQP_isError()) { - unset($parsed_sql); - } } // Analyze it - if (isset($parsed_sql)) { + if (isset($parsed_sql) && ! PMA_SQP_isError()) { $analyzed_display_query = PMA_SQP_analyze($parsed_sql); // Here we append the LIMIT added for navigation, to // enable its display. Adding it higher in the code diff --git a/libraries/server_synchronize.lib.php b/libraries/server_synchronize.lib.php index c1b9159..53ad9d7 100644 --- a/libraries/server_synchronize.lib.php +++ b/libraries/server_synchronize.lib.php @@ -1335,7 +1335,7 @@ function PMA_syncDisplayHeaderSource($src_db) { echo '<table id="serverstatusconnections" class="data" width="55%">'; echo '<tr>'; - echo '<th>' . __('Source database') . ': ' . $src_db . '<br />('; + echo '<th>' . __('Source database') . ': ' . htmlspecialchars($src_db) . '<br />('; if ('cur' == $_SESSION['src_type']) { echo __('Current server'); } else { @@ -1358,7 +1358,7 @@ function PMA_syncDisplayHeaderSource($src_db) { function PMA_syncDisplayHeaderTargetAndMatchingTables($trg_db, $matching_tables) { echo '<table id="serverstatusconnections" class="data" width="43%">'; echo '<tr>'; - echo '<th>' . __('Target database') . ': '. $trg_db . '<br />('; + echo '<th>' . __('Target database') . ': '. htmlspecialchars($trg_db) . '<br />('; if ('cur' == $_SESSION['trg_type']) { echo __('Current server'); } else { diff --git a/tbl_indexes.php b/tbl_indexes.php index 54923a0..ac32387 100644 --- a/tbl_indexes.php +++ b/tbl_indexes.php @@ -200,7 +200,7 @@ foreach ($index->getColumns() as $column) { || preg_match('/(char|text)/i', $field_type)) { echo '<option value="' . htmlspecialchars($field_name) . '"' . (($field_name == $column->getName()) ? ' selected="selected"' : '') . '>' - . htmlspecialchars($field_name) . ' [' . $field_type . ']' + . htmlspecialchars($field_name) . ' [' . htmlspecialchars($field_type) . ']' . '</option>' . "\n"; } } // end foreach $fields @@ -222,7 +222,7 @@ for ($i = 0; $i < $add_fields; $i++) { <?php foreach ($fields as $field_name => $field_type) { echo '<option value="' . htmlspecialchars($field_name) . '">' - . htmlspecialchars($field_name) . ' [' . $field_type . ']' + . htmlspecialchars($field_name) . ' [' . htmlspecialchars($field_type) . ']' . '</option>' . "\n"; } // end foreach $fields ?> diff --git a/tbl_select.php b/tbl_select.php index 2cb0086..8414222 100644 --- a/tbl_select.php +++ b/tbl_select.php @@ -124,7 +124,7 @@ if (!isset($param) || $param[0] == '') { ?> <tr class="noclick <?php echo $odd_row ? 'odd' : 'even'; $odd_row = ! $odd_row; ?>"> <th><?php echo htmlspecialchars($fields_list[$i]); ?></th> - <td><?php echo $fields_type[$i]; ?></td> + <td><?php echo htmlspecialchars($fields_type[$i]); ?></td> <td><?php echo $fields_collation[$i]; ?></td> <td><select name="func[]"> <?php @@ -190,7 +190,7 @@ if (!isset($param) || $param[0] == '') { <?php } elseif (strncasecmp($fields_type[$i], 'enum', 4) == 0) { // e n u m s - $enum_value=explode(', ', str_replace("'", '', substr($fields_type[$i], 5, -1))); + $enum_value=explode(', ', str_replace("'", '', substr(htmlspecialchars($fields_type[$i]), 5, -1))); $cnt_enum_value = count($enum_value); echo ' <select name="fields[' . $i . '][]"' .' multiple="multiple" size="' . min(3, $cnt_enum_value) . '">' . "\n"; hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_7_1-23441-gc8dbed1
by Madhura Jayaratne 24 Nov '11

24 Nov '11

The branch, master has been updated via c8dbed11b2e2ad76c3c7dcd41777f314427f3f32 (commit) via f414a0ec32626c3f0084bd020daba2b4553d244b (commit) from f22a4571998df392e2a5d6817f04fe02da1b111a (commit) - Log ----------------------------------------------------------------- commit c8dbed11b2e2ad76c3c7dcd41777f314427f3f32 Merge: f22a457 f414a0e Author: Madhura Jayaratne <madhura.cj(a)gmail.com> Date: Thu Nov 24 22:48:25 2011 +0530 Merge branch 'QA_3_4' ----------------------------------------------------------------------- Summary of changes: ChangeLog | 1 + browse_foreigners.php | 5 +++++ 2 files changed, 6 insertions(+), 0 deletions(-) diff --git a/ChangeLog b/ChangeLog index ec37459..2c6e859 100644 --- a/ChangeLog +++ b/ChangeLog @@ -80,6 +80,7 @@ phpMyAdmin - ChangeLog - bug #3425156 [interface] Add column after drop - [interface] Avoid showing the password in phpinfo()'s output - bug #3441572 [GUI] 'newer version of phpMyAdmin' message not shown in IE8 +- bug #3407235 [interface] Entering the key through a lookup window does not reset NULL 3.4.7.1 (2011-11-10) - [security] Fixed possible local file inclusion in XML import diff --git a/browse_foreigners.php b/browse_foreigners.php index ab5385c..74e4e99 100644 --- a/browse_foreigners.php +++ b/browse_foreigners.php @@ -104,9 +104,11 @@ require_once './libraries/header_scripts.inc.php'; if (opener && opener.document && opener.document.insertForm) { var field = 'fields'; + var field_null = 'fields_null'; <?php if (isset($rownumber)) { ?> var element_name = field + '[multi_edit][<?php echo htmlspecialchars($rownumber); ?>][' + fieldmd5 + ']'; + var null_name = field_null + '[multi_edit][<?php echo htmlspecialchars($rownumber); ?>][' + fieldmd5 + ']'; <?php } else { ?> var element_name = field + '[]'; <?php } ?> @@ -120,6 +122,9 @@ require_once './libraries/header_scripts.inc.php'; if (opener.document.insertForm.elements[element_name]) { // Edit/Insert form opener.document.insertForm.elements[element_name].value = key; + if (opener.document.insertForm.elements[null_name]) { + opener.document.insertForm.elements[null_name].checked = false; + } self.close(); return false; } else if (opener.document.insertForm.elements[element_name_alt]) { hooks/post-receive -- phpMyAdmin

1 0