- Git - lists.phpmyadmin.net

[Phpmyadmin-git] [SCM] phpMyAdmin annotated tag, RELEASE_3_4_3_2, created. RELEASE_3_4_3_2
by Marc Delisle 23 Jul '11

23 Jul '11

The annotated tag, RELEASE_3_4_3_2 has been created at 7f397f585ce10cbcacfd4e96f4346167fc9de819 (tag) tagging ff536da86576efe733e4dfb5d69c8481ae590e2e (commit) replaces RELEASE_3_4_3_1 tagged by Marc Delisle on Sat Jul 23 08:43:26 2011 -0400 - Log ----------------------------------------------------------------- Released 3.4.3.2 Herman van Rink (5): Reverted some missing special chars in Changelog Another case of XSS Merge remote-tracking branch 'security/MAINT_3_4_3-security' into MAINT_3_4_3-security [security] Fixed local file inclusion vulnerability and code execution, see PMASA-2011-11 [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-12 Marc Delisle (6): XSS on table Print view ChangeLog for PMASA-2011-9 Local file inclusion vulnerability Fix broken characters 3.4.3.2 release date 3.4.3.2 release Michal Čihař (1): Pass token along with swekey auth requests ----------------------------------------------------------------------- hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_3_1-11737-g7e197b6
by Marc Delisle 23 Jul '11

23 Jul '11

The branch, master has been updated via 7e197b695e50f3ba751e48cc45f28ab397534f6f (commit) via 3534dda30a587eafe3bf5016f2fb302dbc224c2e (commit) via bd63726ee3daf32799f499b61d7cde973d8e8660 (commit) via 09c0f7ae557e40102fbfd23c4bea4939e19f0f29 (commit) via 571cdc6ff4bf375871b594f4e06f8ad3159d1754 (commit) via e7bb42c002885c2aca7aba4d431b8c63ae4de9b7 (commit) via 3ae58f0cd6b89ad4767920f9b214c38d3f6d4393 (commit) via 3caa6cbb7ed1b1933c3bded493a2fbc8273d746f (commit) via f63e1bb42a37401b2fdfcd2e66cce92b7ea2025c (commit) via 951fb4dd79253a3aca8b6e386db77c1affcfc3a9 (commit) via 4bd27166c314faa37cada91533b86377f4d4d214 (commit) via a0823be05aa5835f207c0838b9cca67d2d9a050a (commit) via d7cffc5dbde68342d46e891ea2c8bd72de134f43 (commit) from 5bc41ef1dc31019daaa0933bec967ebff63b55e0 (commit) - Log ----------------------------------------------------------------- commit 7e197b695e50f3ba751e48cc45f28ab397534f6f Merge: 5bc41ef1dc31019daaa0933bec967ebff63b55e0 3534dda30a587eafe3bf5016f2fb302dbc224c2e Author: Marc Delisle <marc(a)infomarc.info> Date: Sat Jul 23 08:25:49 2011 -0400 Fix merge conflicts ----------------------------------------------------------------------- Summary of changes: ChangeLog | 18 ++++++++++----- libraries/auth/swekey/swekey.auth.lib.php | 32 +++++++++++++++------------- libraries/schema/User_Schema.class.php | 7 ++++- schema_export.php | 4 ++- sql.php | 4 +- tbl_printview.php | 4 +- 6 files changed, 41 insertions(+), 28 deletions(-) diff --git a/ChangeLog b/ChangeLog index 16e3cac..feefa80 100644 --- a/ChangeLog +++ b/ChangeLog @@ -59,6 +59,12 @@ phpMyAdmin - ChangeLog - bug #3372807 [interface] Fix security warning link in setup - bug #3374347 [display] Backquotes in normal text on import page +3.4.3.2 (2011-07-23) +- [security] Fixed XSS vulnerability, see PMASA-2011-9 +- [security] Fixed local file inclusion vulnerability, see PMASA-2011-10 +- [security] Fixed local file inclusion vulnerability and code execution, see PMASA-2011-11 +- [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-12 + 3.4.3.1 (2011-07-02) - [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-5 - [security] Fixed possible code injection incase session variables are compromised, see PMASA-2011-6 @@ -153,7 +159,7 @@ phpMyAdmin - ChangeLog + patch #2974341 [structure] Clicking on table name in db Structure should Browse the table if possible, thanks to bhdouglass - dougboybhd + patch #2975533 [search] New search operators, thanks to - Martynas MickeviÄius + Martynas Mickevičius + patch #2967320 [designer] Colored relations based on the primary key, thanks to GreenRover - greenrover - [core] Provide way for vendors to easily change paths to config files. @@ -307,7 +313,7 @@ phpMyAdmin - ChangeLog 3.3.7.0 (2010-09-07) - patch #3050492 [PDF scratchboard] Cannot drag table box to the edge after - a page size increase, thanks to Martin SchÃ¶nberger - mad05 + a page size increase, thanks to Martin Schönberger - mad05 3.3.6.0 (2010-08-28) - bug #3033063 [core] Navi gets wrong db name @@ -328,7 +334,7 @@ phpMyAdmin - ChangeLog 3.3.5.0 (2010-07-26) - patch #2932113 [information_schema] Slow export when having lots of - databases, thanks to StÃ©phane Pontier - shadow_walker + databases, thanks to Stéphane Pontier - shadow_walker - bug #3022705 [import] Import button does not work in Catalan when there is no progress bar possible - bug [replication] Do not offer information_schema in the list of databases @@ -368,9 +374,9 @@ phpMyAdmin - ChangeLog - patch #2984893 [engines] InnoDB storage page emits a warning, thanks to Madhura Jayaratne - madhuracj - bug #2974687, bug #2974692 [compatibility] PHPExcel : IBM AIX iconv() does not work, - thanks to BjÃ¶rn Wiberg - bwiberg + thanks to Björn Wiberg - bwiberg - bug #2983066 [interface] Flush table on table operations shows the query twice, - thanks to Martynas MickeviÄius - BlinK_ + thanks to Martynas Mickevičius - BlinK_ - bug #2983060, patch #2987900 [interface] Fix initial state of tables in designer, thanks to Sutharshan Balachandren. - bug #2983062, patch #2989408 [engines] Fix warnings when changing table @@ -449,7 +455,7 @@ phpMyAdmin - ChangeLog + rfe #2839504 [engines] Support InnoDB plugin's new row formats + [core] Added ability for synchronizing databases among servers. + [lang] #2843101 Dutch update, thanks to scavenger2008 -+ [lang] Galician update, thanks to XosÃ© Calvo - xosecalvo ++ [lang] Galician update, thanks to Xosé Calvo - xosecalvo + [export] Added MediaWiki export module, thanks to Derek Schaefer - drummingds1 + [lang] Turkish update, thanks to Burak Yavuz diff --git a/libraries/auth/swekey/swekey.auth.lib.php b/libraries/auth/swekey/swekey.auth.lib.php index 184c845..fae3531 100644 --- a/libraries/auth/swekey/swekey.auth.lib.php +++ b/libraries/auth/swekey/swekey.auth.lib.php @@ -143,7 +143,9 @@ function Swekey_auth_error() return "Internal Error: CA File $caFile not found"; $result = null; - parse_str($_SERVER['QUERY_STRING']); + $swekey_id = $_GET['swekey_id']; + $swekey_otp = $_GET['swekey_otp']; + if (isset($swekey_id)) { unset($_SESSION['SWEKEY']['AUTHENTICATED_SWEKEY']); if (! isset($_SESSION['SWEKEY']['RND_TOKEN'])) { @@ -166,7 +168,7 @@ function Swekey_auth_error() $result = __('No valid authentication key plugged'); if ($_SESSION['SWEKEY']['CONF_DEBUG']) { - $result .= "<br>".$swekey_id; + $result .= "<br>" . htmlspecialchars($swekey_id); } unset($_SESSION['SWEKEY']['CONF_LOADED']); // reload the conf file } @@ -184,19 +186,19 @@ function Swekey_auth_error() if (! isset($swekey_id)) { ?> <script> - if (key.length != 32) - { - window.location.search="?swekey_id=" + key; - } - else - { - var url = "" + window.location; - if (url.indexOf("?") > 0) - url = url.substr(0, url.indexOf("?")); - Swekey_SetUnplugUrl(key, "pma_login", url + "?session_to_unset=<?php echo session_id();?>"); - var otp = Swekey_GetOtp(key, <?php echo '"'.$_SESSION['SWEKEY']['RND_TOKEN'].'"';?>); - window.location.search="?swekey_id=" + key + "&swekey_otp=" + otp; - } + if (key.length != 32) + { + window.location.search="?swekey_id=" + key + "&token=<?php echo $_SESSION[' PMA_token ']; ?>"; + } + else + { + var url = "" + window.location; + if (url.indexOf("?") > 0) + url = url.substr(0, url.indexOf("?")); + Swekey_SetUnplugUrl(key, "pma_login", url + "?session_to_unset=<?php echo session_id();?>&token=<?php echo $_SESSION[' PMA_token ']; ?>"); + var otp = Swekey_GetOtp(key, <?php echo '"'.$_SESSION['SWEKEY']['RND_TOKEN'].'"';?>); + window.location.search="?swekey_id=" + key + "&swekey_otp=" + otp + "&token=<?php echo $_SESSION[' PMA_token ']; ?>"; + } </script> <?php return __('Authenticating...'); diff --git a/libraries/schema/User_Schema.class.php b/libraries/schema/User_Schema.class.php index eb96835..aa39ec5 100644 --- a/libraries/schema/User_Schema.class.php +++ b/libraries/schema/User_Schema.class.php @@ -562,10 +562,13 @@ class PMA_User_Schema require_once './libraries/transformations.lib.php'; require_once './libraries/Index.class.php'; /** - * default is PDF + * default is PDF, otherwise validate it's only letters a-z */ global $db,$export_type; - $export_type = isset($export_type) ? $export_type : 'pdf'; + if (!isset($export_type) || !preg_match('/^[a-zA-Z]+$/', $export_type)) { + $export_type = 'pdf'; + } + PMA_DBI_select_db($db); include("./libraries/schema/".ucfirst($export_type)."_Relation_Schema.class.php"); diff --git a/schema_export.php b/schema_export.php index 0a21d32..3e1067d 100644 --- a/schema_export.php +++ b/schema_export.php @@ -37,7 +37,9 @@ include_once("./libraries/schema/Export_Relation_Schema.class.php"); * default is PDF */ global $db,$export_type; -$export_type = isset($export_type) ? $export_type : 'pdf'; +if (!isset($export_type) || !preg_match('/^[a-zA-Z]+$/', $export_type)) { + $export_type = 'pdf'; +} PMA_DBI_select_db($db); $path = PMA_securePath(ucfirst($export_type)); diff --git a/sql.php b/sql.php index 7ce5b24..4d22876 100644 --- a/sql.php +++ b/sql.php @@ -779,8 +779,8 @@ if (0 == $num_rows || $is_affected) { $edited_values = array(); parse_str($_REQUEST['transform_fields_list'], $edited_values); - foreach ($mime_map as $transformation) { - $include_file = $transformation['transformation']; + foreach($mime_map as $transformation) { + $include_file = PMA_securePath($transformation['transformation']); $column_name = $transformation['column_name']; $column_data = $edited_values[$column_name]; diff --git a/tbl_printview.php b/tbl_printview.php index 2e40587..9b7e7ff 100644 --- a/tbl_printview.php +++ b/tbl_printview.php @@ -69,7 +69,7 @@ if ($multi_tables) { $tbl_list .= (empty($tbl_list) ? '' : ', ') . PMA_backquote($table); } - echo '<strong>'. __('Show tables') . ': ' . $tbl_list . '</strong>' . "\n"; + echo '<strong>'. __('Show tables') . ': ' . htmlspecialchars($tbl_list) . '</strong>' . "\n"; echo '<hr />' . "\n"; } // end if @@ -84,7 +84,7 @@ foreach ($the_tables as $key => $table) { } $counter++; echo '<div' . $breakstyle . '>' . "\n"; - echo '<h1>' . $table . '</h1>' . "\n"; + echo '<h1>' . htmlspecialchars($table) . '</h1>' . "\n"; /** * Gets table informations hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_4, updated. RELEASE_3_4_3_1-53-g3534dda
by Marc Delisle 23 Jul '11

23 Jul '11

The branch, QA_3_4 has been updated via 3534dda30a587eafe3bf5016f2fb302dbc224c2e (commit) via bd63726ee3daf32799f499b61d7cde973d8e8660 (commit) via 09c0f7ae557e40102fbfd23c4bea4939e19f0f29 (commit) via 571cdc6ff4bf375871b594f4e06f8ad3159d1754 (commit) via e7bb42c002885c2aca7aba4d431b8c63ae4de9b7 (commit) via 3ae58f0cd6b89ad4767920f9b214c38d3f6d4393 (commit) via 3caa6cbb7ed1b1933c3bded493a2fbc8273d746f (commit) via f63e1bb42a37401b2fdfcd2e66cce92b7ea2025c (commit) via 951fb4dd79253a3aca8b6e386db77c1affcfc3a9 (commit) via 4bd27166c314faa37cada91533b86377f4d4d214 (commit) via a0823be05aa5835f207c0838b9cca67d2d9a050a (commit) via d7cffc5dbde68342d46e891ea2c8bd72de134f43 (commit) from 06bfdd7ca6d76335f45d53134770979d7d25d739 (commit) - Log ----------------------------------------------------------------- ----------------------------------------------------------------------- Summary of changes: ChangeLog | 18 ++++++++++++------ libraries/auth/swekey/swekey.auth.lib.php | 12 +++++++----- libraries/schema/User_Schema.class.php | 7 +++++-- schema_export.php | 4 +++- sql.php | 2 +- tbl_printview.php | 4 ++-- 6 files changed, 30 insertions(+), 17 deletions(-) diff --git a/ChangeLog b/ChangeLog index 021c2cc..02db31c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -19,6 +19,12 @@ phpMyAdmin - ChangeLog - bug #3372807 [interface] Fix security warning link in setup - bug #3374347 [display] Backquotes in normal text on import page +3.4.3.2 (2011-07-23) +- [security] Fixed XSS vulnerability, see PMASA-2011-9 +- [security] Fixed local file inclusion vulnerability, see PMASA-2011-10 +- [security] Fixed local file inclusion vulnerability and code execution, see PMASA-2011-11 +- [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-12 + 3.4.3.1 (2011-07-02) - [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-5 - [security] Fixed possible code injection incase session variables are compromised, see PMASA-2011-6 @@ -113,7 +119,7 @@ phpMyAdmin - ChangeLog + patch #2974341 [structure] Clicking on table name in db Structure should Browse the table if possible, thanks to bhdouglass - dougboybhd + patch #2975533 [search] New search operators, thanks to - Martynas MickeviÄius + Martynas Mickevičius + patch #2967320 [designer] Colored relations based on the primary key, thanks to GreenRover - greenrover - [core] Provide way for vendors to easily change paths to config files. @@ -267,7 +273,7 @@ phpMyAdmin - ChangeLog 3.3.7.0 (2010-09-07) - patch #3050492 [PDF scratchboard] Cannot drag table box to the edge after - a page size increase, thanks to Martin SchÃ¶nberger - mad05 + a page size increase, thanks to Martin Schönberger - mad05 3.3.6.0 (2010-08-28) - bug #3033063 [core] Navi gets wrong db name @@ -288,7 +294,7 @@ phpMyAdmin - ChangeLog 3.3.5.0 (2010-07-26) - patch #2932113 [information_schema] Slow export when having lots of - databases, thanks to StÃ©phane Pontier - shadow_walker + databases, thanks to Stéphane Pontier - shadow_walker - bug #3022705 [import] Import button does not work in Catalan when there is no progress bar possible - bug [replication] Do not offer information_schema in the list of databases @@ -328,9 +334,9 @@ phpMyAdmin - ChangeLog - patch #2984893 [engines] InnoDB storage page emits a warning, thanks to Madhura Jayaratne - madhuracj - bug #2974687, bug #2974692 [compatibility] PHPExcel : IBM AIX iconv() does not work, - thanks to BjÃ¶rn Wiberg - bwiberg + thanks to Björn Wiberg - bwiberg - bug #2983066 [interface] Flush table on table operations shows the query twice, - thanks to Martynas MickeviÄius - BlinK_ + thanks to Martynas Mickevičius - BlinK_ - bug #2983060, patch #2987900 [interface] Fix initial state of tables in designer, thanks to Sutharshan Balachandren. - bug #2983062, patch #2989408 [engines] Fix warnings when changing table @@ -409,7 +415,7 @@ phpMyAdmin - ChangeLog + rfe #2839504 [engines] Support InnoDB plugin's new row formats + [core] Added ability for synchronizing databases among servers. + [lang] #2843101 Dutch update, thanks to scavenger2008 -+ [lang] Galician update, thanks to XosÃ© Calvo - xosecalvo ++ [lang] Galician update, thanks to Xosé Calvo - xosecalvo + [export] Added MediaWiki export module, thanks to Derek Schaefer - drummingds1 + [lang] Turkish update, thanks to Burak Yavuz diff --git a/libraries/auth/swekey/swekey.auth.lib.php b/libraries/auth/swekey/swekey.auth.lib.php index c5f613b..8ec5ab4 100644 --- a/libraries/auth/swekey/swekey.auth.lib.php +++ b/libraries/auth/swekey/swekey.auth.lib.php @@ -143,7 +143,9 @@ function Swekey_auth_error() return "Internal Error: CA File $caFile not found"; $result = null; - parse_str($_SERVER['QUERY_STRING']); + $swekey_id = $_GET['swekey_id']; + $swekey_otp = $_GET['swekey_otp']; + if (isset($swekey_id)) { unset($_SESSION['SWEKEY']['AUTHENTICATED_SWEKEY']); if (! isset($_SESSION['SWEKEY']['RND_TOKEN'])) { @@ -166,7 +168,7 @@ function Swekey_auth_error() $result = __('No valid authentication key plugged'); if ($_SESSION['SWEKEY']['CONF_DEBUG']) { - $result .= "<br>".$swekey_id; + $result .= "<br>" . htmlspecialchars($swekey_id); } unset($_SESSION['SWEKEY']['CONF_LOADED']); // reload the conf file } @@ -186,16 +188,16 @@ function Swekey_auth_error() <script> if (key.length != 32) { - window.location.search="?swekey_id=" + key; + window.location.search="?swekey_id=" + key + "&token=<?php echo $_SESSION[' PMA_token ']; ?>"; } else { var url = "" + window.location; if (url.indexOf("?") > 0) url = url.substr(0, url.indexOf("?")); - Swekey_SetUnplugUrl(key, "pma_login", url + "?session_to_unset=<?php echo session_id();?>"); + Swekey_SetUnplugUrl(key, "pma_login", url + "?session_to_unset=<?php echo session_id();?>&token=<?php echo $_SESSION[' PMA_token ']; ?>"); var otp = Swekey_GetOtp(key, <?php echo '"'.$_SESSION['SWEKEY']['RND_TOKEN'].'"';?>); - window.location.search="?swekey_id=" + key + "&swekey_otp=" + otp; + window.location.search="?swekey_id=" + key + "&swekey_otp=" + otp + "&token=<?php echo $_SESSION[' PMA_token ']; ?>"; } </script> <?php diff --git a/libraries/schema/User_Schema.class.php b/libraries/schema/User_Schema.class.php index fbec138..cb42dde 100644 --- a/libraries/schema/User_Schema.class.php +++ b/libraries/schema/User_Schema.class.php @@ -567,10 +567,13 @@ class PMA_User_Schema require_once './libraries/transformations.lib.php'; require_once './libraries/Index.class.php'; /** - * default is PDF + * default is PDF, otherwise validate it's only letters a-z */ global $db,$export_type; - $export_type = isset($export_type) ? $export_type : 'pdf'; + if (!isset($export_type) || !preg_match('/^[a-zA-Z]+$/', $export_type)) { + $export_type = 'pdf'; + } + PMA_DBI_select_db($db); include("./libraries/schema/".ucfirst($export_type)."_Relation_Schema.class.php"); diff --git a/schema_export.php b/schema_export.php index 0a21d32..3e1067d 100644 --- a/schema_export.php +++ b/schema_export.php @@ -37,7 +37,9 @@ include_once("./libraries/schema/Export_Relation_Schema.class.php"); * default is PDF */ global $db,$export_type; -$export_type = isset($export_type) ? $export_type : 'pdf'; +if (!isset($export_type) || !preg_match('/^[a-zA-Z]+$/', $export_type)) { + $export_type = 'pdf'; +} PMA_DBI_select_db($db); $path = PMA_securePath(ucfirst($export_type)); diff --git a/sql.php b/sql.php index 10e472a..83900ab 100644 --- a/sql.php +++ b/sql.php @@ -719,7 +719,7 @@ if (0 == $num_rows || $is_affected) { parse_str($_REQUEST['transform_fields_list'], $edited_values); foreach($mime_map as $transformation) { - $include_file = $transformation['transformation']; + $include_file = PMA_securePath($transformation['transformation']); $column_name = $transformation['column_name']; $column_data = $edited_values[$column_name]; diff --git a/tbl_printview.php b/tbl_printview.php index 74b6818..ce007d1 100644 --- a/tbl_printview.php +++ b/tbl_printview.php @@ -69,7 +69,7 @@ if ($multi_tables) { $tbl_list .= (empty($tbl_list) ? '' : ', ') . PMA_backquote($table); } - echo '<strong>'. __('Show tables') . ': ' . $tbl_list . '</strong>' . "\n"; + echo '<strong>'. __('Show tables') . ': ' . htmlspecialchars($tbl_list) . '</strong>' . "\n"; echo '<hr />' . "\n"; } // end if @@ -84,7 +84,7 @@ foreach ($the_tables as $key => $table) { } $counter++; echo '<div' . $breakstyle . '>' . "\n"; - echo '<h1>' . $table . '</h1>' . "\n"; + echo '<h1>' . htmlspecialchars($table) . '</h1>' . "\n"; /** * Gets table informations hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, MAINT_3_4_3, updated. RELEASE_3_4_3_1-12-gff536da
by Marc Delisle 23 Jul '11

23 Jul '11

The branch, MAINT_3_4_3 has been updated via ff536da86576efe733e4dfb5d69c8481ae590e2e (commit) via bd63726ee3daf32799f499b61d7cde973d8e8660 (commit) via 09c0f7ae557e40102fbfd23c4bea4939e19f0f29 (commit) via 571cdc6ff4bf375871b594f4e06f8ad3159d1754 (commit) via e7bb42c002885c2aca7aba4d431b8c63ae4de9b7 (commit) via 3ae58f0cd6b89ad4767920f9b214c38d3f6d4393 (commit) via 3caa6cbb7ed1b1933c3bded493a2fbc8273d746f (commit) via f63e1bb42a37401b2fdfcd2e66cce92b7ea2025c (commit) via 951fb4dd79253a3aca8b6e386db77c1affcfc3a9 (commit) via 4bd27166c314faa37cada91533b86377f4d4d214 (commit) via a0823be05aa5835f207c0838b9cca67d2d9a050a (commit) via d7cffc5dbde68342d46e891ea2c8bd72de134f43 (commit) from e214683f9fe4955dcbf0ffce045983728c7fa9d3 (commit) - Log ----------------------------------------------------------------- commit ff536da86576efe733e4dfb5d69c8481ae590e2e Author: Marc Delisle <marc(a)infomarc.info> Date: Sat Jul 23 08:32:25 2011 -0400 3.4.3.2 release ----------------------------------------------------------------------- Summary of changes: ChangeLog | 18 ++++++++++++------ Documentation.html | 4 ++-- README | 2 +- libraries/Config.class.php | 2 +- libraries/auth/swekey/swekey.auth.lib.php | 12 +++++++----- libraries/schema/User_Schema.class.php | 7 +++++-- schema_export.php | 4 +++- sql.php | 2 +- tbl_printview.php | 4 ++-- 9 files changed, 34 insertions(+), 21 deletions(-) diff --git a/ChangeLog b/ChangeLog index fe71031..05d5fe5 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,12 @@ phpMyAdmin - ChangeLog ====================== +3.4.3.2 (2011-07-23) +- [security] Fixed XSS vulnerability, see PMASA-2011-9 +- [security] Fixed local file inclusion vulnerability, see PMASA-2011-10 +- [security] Fixed local file inclusion vulnerability and code execution, see PMASA-2011-11 +- [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-12 + 3.4.3.1 (2011-07-02) - [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-5 - [security] Fixed possible code injection incase session variables are compromised, see PMASA-2011-6 @@ -95,7 +101,7 @@ phpMyAdmin - ChangeLog + patch #2974341 [structure] Clicking on table name in db Structure should Browse the table if possible, thanks to bhdouglass - dougboybhd + patch #2975533 [search] New search operators, thanks to - Martynas MickeviÄius + Martynas Mickevičius + patch #2967320 [designer] Colored relations based on the primary key, thanks to GreenRover - greenrover - [core] Provide way for vendors to easily change paths to config files. @@ -249,7 +255,7 @@ phpMyAdmin - ChangeLog 3.3.7.0 (2010-09-07) - patch #3050492 [PDF scratchboard] Cannot drag table box to the edge after - a page size increase, thanks to Martin SchÃ¶nberger - mad05 + a page size increase, thanks to Martin Schönberger - mad05 3.3.6.0 (2010-08-28) - bug #3033063 [core] Navi gets wrong db name @@ -270,7 +276,7 @@ phpMyAdmin - ChangeLog 3.3.5.0 (2010-07-26) - patch #2932113 [information_schema] Slow export when having lots of - databases, thanks to StÃ©phane Pontier - shadow_walker + databases, thanks to Stéphane Pontier - shadow_walker - bug #3022705 [import] Import button does not work in Catalan when there is no progress bar possible - bug [replication] Do not offer information_schema in the list of databases @@ -310,9 +316,9 @@ phpMyAdmin - ChangeLog - patch #2984893 [engines] InnoDB storage page emits a warning, thanks to Madhura Jayaratne - madhuracj - bug #2974687, bug #2974692 [compatibility] PHPExcel : IBM AIX iconv() does not work, - thanks to BjÃ¶rn Wiberg - bwiberg + thanks to Björn Wiberg - bwiberg - bug #2983066 [interface] Flush table on table operations shows the query twice, - thanks to Martynas MickeviÄius - BlinK_ + thanks to Martynas Mickevičius - BlinK_ - bug #2983060, patch #2987900 [interface] Fix initial state of tables in designer, thanks to Sutharshan Balachandren. - bug #2983062, patch #2989408 [engines] Fix warnings when changing table @@ -391,7 +397,7 @@ phpMyAdmin - ChangeLog + rfe #2839504 [engines] Support InnoDB plugin's new row formats + [core] Added ability for synchronizing databases among servers. + [lang] #2843101 Dutch update, thanks to scavenger2008 -+ [lang] Galician update, thanks to XosÃ© Calvo - xosecalvo ++ [lang] Galician update, thanks to Xosé Calvo - xosecalvo + [export] Added MediaWiki export module, thanks to Derek Schaefer - drummingds1 + [lang] Turkish update, thanks to Burak Yavuz diff --git a/Documentation.html b/Documentation.html index 25b9731..15f8000 100644 --- a/Documentation.html +++ b/Documentation.html @@ -9,7 +9,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <link rel="icon" href="./favicon.ico" type="image/x-icon" /> <link rel="shortcut icon" href="./favicon.ico" type="image/x-icon" /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> - <title>phpMyAdmin 3.4.3.1 - Documentation</title> + <title>phpMyAdmin 3.4.3.2 - Documentation</title> <link rel="stylesheet" type="text/css" href="docs.css" /> </head> @@ -17,7 +17,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <div id="header"> <h1> <a href="http://www.phpmyadmin.net/">php<span class="myadmin">MyAdmin</span></a> - 3.4.3.1 + 3.4.3.2 Documentation </h1> </div> diff --git a/README b/README index e57152a..65f7c52 100644 --- a/README +++ b/README @@ -1,7 +1,7 @@ phpMyAdmin - Readme =================== -Version 3.4.3.1 +Version 3.4.3.2 A set of PHP-scripts to manage MySQL over the web. diff --git a/libraries/Config.class.php b/libraries/Config.class.php index 28625f2..0cec6a9 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -96,7 +96,7 @@ class PMA_Config */ function checkSystem() { - $this->set('PMA_VERSION', '3.4.3.1'); + $this->set('PMA_VERSION', '3.4.3.2'); /** * @deprecated */ diff --git a/libraries/auth/swekey/swekey.auth.lib.php b/libraries/auth/swekey/swekey.auth.lib.php index c5f613b..8ec5ab4 100644 --- a/libraries/auth/swekey/swekey.auth.lib.php +++ b/libraries/auth/swekey/swekey.auth.lib.php @@ -143,7 +143,9 @@ function Swekey_auth_error() return "Internal Error: CA File $caFile not found"; $result = null; - parse_str($_SERVER['QUERY_STRING']); + $swekey_id = $_GET['swekey_id']; + $swekey_otp = $_GET['swekey_otp']; + if (isset($swekey_id)) { unset($_SESSION['SWEKEY']['AUTHENTICATED_SWEKEY']); if (! isset($_SESSION['SWEKEY']['RND_TOKEN'])) { @@ -166,7 +168,7 @@ function Swekey_auth_error() $result = __('No valid authentication key plugged'); if ($_SESSION['SWEKEY']['CONF_DEBUG']) { - $result .= "<br>".$swekey_id; + $result .= "<br>" . htmlspecialchars($swekey_id); } unset($_SESSION['SWEKEY']['CONF_LOADED']); // reload the conf file } @@ -186,16 +188,16 @@ function Swekey_auth_error() <script> if (key.length != 32) { - window.location.search="?swekey_id=" + key; + window.location.search="?swekey_id=" + key + "&token=<?php echo $_SESSION[' PMA_token ']; ?>"; } else { var url = "" + window.location; if (url.indexOf("?") > 0) url = url.substr(0, url.indexOf("?")); - Swekey_SetUnplugUrl(key, "pma_login", url + "?session_to_unset=<?php echo session_id();?>"); + Swekey_SetUnplugUrl(key, "pma_login", url + "?session_to_unset=<?php echo session_id();?>&token=<?php echo $_SESSION[' PMA_token ']; ?>"); var otp = Swekey_GetOtp(key, <?php echo '"'.$_SESSION['SWEKEY']['RND_TOKEN'].'"';?>); - window.location.search="?swekey_id=" + key + "&swekey_otp=" + otp; + window.location.search="?swekey_id=" + key + "&swekey_otp=" + otp + "&token=<?php echo $_SESSION[' PMA_token ']; ?>"; } </script> <?php diff --git a/libraries/schema/User_Schema.class.php b/libraries/schema/User_Schema.class.php index fbec138..cb42dde 100644 --- a/libraries/schema/User_Schema.class.php +++ b/libraries/schema/User_Schema.class.php @@ -567,10 +567,13 @@ class PMA_User_Schema require_once './libraries/transformations.lib.php'; require_once './libraries/Index.class.php'; /** - * default is PDF + * default is PDF, otherwise validate it's only letters a-z */ global $db,$export_type; - $export_type = isset($export_type) ? $export_type : 'pdf'; + if (!isset($export_type) || !preg_match('/^[a-zA-Z]+$/', $export_type)) { + $export_type = 'pdf'; + } + PMA_DBI_select_db($db); include("./libraries/schema/".ucfirst($export_type)."_Relation_Schema.class.php"); diff --git a/schema_export.php b/schema_export.php index 0a21d32..3e1067d 100644 --- a/schema_export.php +++ b/schema_export.php @@ -37,7 +37,9 @@ include_once("./libraries/schema/Export_Relation_Schema.class.php"); * default is PDF */ global $db,$export_type; -$export_type = isset($export_type) ? $export_type : 'pdf'; +if (!isset($export_type) || !preg_match('/^[a-zA-Z]+$/', $export_type)) { + $export_type = 'pdf'; +} PMA_DBI_select_db($db); $path = PMA_securePath(ucfirst($export_type)); diff --git a/sql.php b/sql.php index 9b19174..eb9254f 100644 --- a/sql.php +++ b/sql.php @@ -719,7 +719,7 @@ if (0 == $num_rows || $is_affected) { parse_str($_REQUEST['transform_fields_list'], $edited_values); foreach($mime_map as $transformation) { - $include_file = $transformation['transformation']; + $include_file = PMA_securePath($transformation['transformation']); $column_name = $transformation['column_name']; $column_data = $edited_values[$column_name]; diff --git a/tbl_printview.php b/tbl_printview.php index 74b6818..ce007d1 100644 --- a/tbl_printview.php +++ b/tbl_printview.php @@ -69,7 +69,7 @@ if ($multi_tables) { $tbl_list .= (empty($tbl_list) ? '' : ', ') . PMA_backquote($table); } - echo '<strong>'. __('Show tables') . ': ' . $tbl_list . '</strong>' . "\n"; + echo '<strong>'. __('Show tables') . ': ' . htmlspecialchars($tbl_list) . '</strong>' . "\n"; echo '<hr />' . "\n"; } // end if @@ -84,7 +84,7 @@ foreach ($the_tables as $key => $table) { } $counter++; echo '<div' . $breakstyle . '>' . "\n"; - echo '<h1>' . $table . '</h1>' . "\n"; + echo '<h1>' . htmlspecialchars($table) . '</h1>' . "\n"; /** * Gets table informations hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin annotated tag, RELEASE_3_3_10_3, created. RELEASE_3_3_10_3
by Marc Delisle 23 Jul '11

23 Jul '11

The annotated tag, RELEASE_3_3_10_3 has been created at b3f1146d0e874d2ba2cdb6a6d07db3c5df81f0db (tag) tagging 3e95b08ceddaad36a3633920d7b0bcf85ce2f565 (commit) replaces RELEASE_3_3_10_2 tagged by Marc Delisle on Sat Jul 23 08:05:45 2011 -0400 - Log ----------------------------------------------------------------- Released 3.3.10.3 Herman van Rink (3): [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-12 Backported fix for PMASA-2011-9 to 3.3 Updated/fixed Changelog Marc Delisle (2): 3.3.10.3 release date 3.3.10.3 release Michal Čihař (1): Pass token along with swekey auth requests ----------------------------------------------------------------------- hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, MAINT_3_3_10, updated. RELEASE_3_3_10_2-6-g3e95b08
by Marc Delisle 23 Jul '11

23 Jul '11

The branch, MAINT_3_3_10 has been updated via 3e95b08ceddaad36a3633920d7b0bcf85ce2f565 (commit) from 6cb0ad8a0de2890ef9cf895804455d1d6206df72 (commit) - Log ----------------------------------------------------------------- commit 3e95b08ceddaad36a3633920d7b0bcf85ce2f565 Author: Marc Delisle <marc(a)infomarc.info> Date: Sat Jul 23 08:03:58 2011 -0400 3.3.10.3 release ----------------------------------------------------------------------- Summary of changes: Documentation.html | 4 ++-- README | 2 +- libraries/Config.class.php | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Documentation.html b/Documentation.html index 89640a1..f92b46b 100644 --- a/Documentation.html +++ b/Documentation.html @@ -10,7 +10,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <link rel="icon" href="./favicon.ico" type="image/x-icon" /> <link rel="shortcut icon" href="./favicon.ico" type="image/x-icon" /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> - <title>phpMyAdmin 3.3.10.2 - Documentation</title> + <title>phpMyAdmin 3.3.10.3 - Documentation</title> <link rel="stylesheet" type="text/css" href="docs.css" /> </head> @@ -18,7 +18,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <div id="header"> <h1> <a href="http://www.phpmyadmin.net/">php<span class="myadmin">MyAdmin</span></a> - 3.3.10.2 + 3.3.10.3 Documentation </h1> </div> diff --git a/README b/README index 5bce68c..f5967ed 100644 --- a/README +++ b/README @@ -5,7 +5,7 @@ phpMyAdmin - Readme A set of PHP-scripts to manage MySQL over the web. - Version 3.3.10.2 + Version 3.3.10.3 ---------------- http://www.phpmyadmin.net/ diff --git a/libraries/Config.class.php b/libraries/Config.class.php index 79a006b..68b9663 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -92,7 +92,7 @@ class PMA_Config */ function checkSystem() { - $this->set('PMA_VERSION', '3.3.10.2'); + $this->set('PMA_VERSION', '3.3.10.3'); /** * @deprecated */ hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_3, updated. RELEASE_3_3_10_2-16-g8a5c5c8
by Marc Delisle 23 Jul '11

23 Jul '11

The branch, QA_3_3 has been updated via 8a5c5c8ef525e59f3368f993d3cc0ab2bb57ea7e (commit) via 6cb0ad8a0de2890ef9cf895804455d1d6206df72 (commit) via 2254a70fad144a2b6b3820c325be7304765e41d7 (commit) via 8ac8328229ae7493d6060b6272578d85879c698d (commit) via 630b8260be45eb9b211f5d7628dbb9e5c1b05bc6 (commit) via f6f6ee3f1171addb166fa18e75a0b56599bf374c (commit) from 1d60fb6da9bc9488c897f57efca21cb683ca8b8a (commit) - Log ----------------------------------------------------------------- commit 8a5c5c8ef525e59f3368f993d3cc0ab2bb57ea7e Merge: 1d60fb6da9bc9488c897f57efca21cb683ca8b8a 6cb0ad8a0de2890ef9cf895804455d1d6206df72 Author: Marc Delisle <marc(a)infomarc.info> Date: Sat Jul 23 07:56:45 2011 -0400 Fix merge conflicts ----------------------------------------------------------------------- Summary of changes: ChangeLog | 4 ++++ libraries/auth/swekey/swekey.auth.lib.php | 12 +++++++----- tbl_printview.php | 4 ++-- 3 files changed, 13 insertions(+), 7 deletions(-) diff --git a/ChangeLog b/ChangeLog index 0aa00f1..f0200a5 100644 --- a/ChangeLog +++ b/ChangeLog @@ -7,6 +7,10 @@ $HeadURL: https://phpmyadmin.svn.sourceforge.net/svnroot/phpmyadmin/trunk/phpMyA 3.3.11.0 (not yet released) +3.3.10.3 (2011-07-23) +- [security] Fixed XSS vulnerability, see PMASA-2011-9 +- [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-12 + 3.3.10.2 (2011-07-02) - [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-5 - [security] Fixed possible code injection incase session variables are compromised, see PMASA-2011-6 diff --git a/libraries/auth/swekey/swekey.auth.lib.php b/libraries/auth/swekey/swekey.auth.lib.php index 2a790c4..197de1c 100644 --- a/libraries/auth/swekey/swekey.auth.lib.php +++ b/libraries/auth/swekey/swekey.auth.lib.php @@ -143,7 +143,9 @@ function Swekey_auth_error() return "Internal Error: CA File $caFile not found"; $result = null; - parse_str($_SERVER['QUERY_STRING']); + $swekey_id = $_GET['swekey_id']; + $swekey_otp = $_GET['swekey_otp']; + if (isset($swekey_id)) { unset($_SESSION['SWEKEY']['AUTHENTICATED_SWEKEY']); if (! isset($_SESSION['SWEKEY']['RND_TOKEN'])) { @@ -166,7 +168,7 @@ function Swekey_auth_error() $result = $GLOBALS['strSwekeyNoKey']; if ($_SESSION['SWEKEY']['CONF_DEBUG']) { - $result .= "<br>".$swekey_id; + $result .= "<br>" . htmlspecialchars($swekey_id); } unset($_SESSION['SWEKEY']['CONF_LOADED']); // reload the conf file } @@ -186,16 +188,16 @@ function Swekey_auth_error() <script> if (key.length != 32) { - window.location.search="?swekey_id=" + key; + window.location.search="?swekey_id=" + key + "&token=<?php echo $_SESSION[' PMA_token ']; ?>"; } else { var url = "" + window.location; if (url.indexOf("?") > 0) url = url.substr(0, url.indexOf("?")); - Swekey_SetUnplugUrl(key, "pma_login", url + "?session_to_unset=<?php echo session_id();?>"); + Swekey_SetUnplugUrl(key, "pma_login", url + "?session_to_unset=<?php echo session_id();?>&token=<?php echo $_SESSION[' PMA_token ']; ?>"); var otp = Swekey_GetOtp(key, <?php echo '"'.$_SESSION['SWEKEY']['RND_TOKEN'].'"';?>); - window.location.search="?swekey_id=" + key + "&swekey_otp=" + otp; + window.location.search="?swekey_id=" + key + "&swekey_otp=" + otp + "&token=<?php echo $_SESSION[' PMA_token ']; ?>"; } </script> <?php diff --git a/tbl_printview.php b/tbl_printview.php index c5b17ab..2b38e24 100644 --- a/tbl_printview.php +++ b/tbl_printview.php @@ -72,7 +72,7 @@ if ($multi_tables) { $tbl_list .= (empty($tbl_list) ? '' : ', ') . PMA_backquote($table); } - echo '<strong>'. $strShowTables . ': ' . $tbl_list . '</strong>' . "\n"; + echo '<strong>'. $strShowTables . ': ' . htmlspecialchars($tbl_list) . '</strong>' . "\n"; echo '<hr />' . "\n"; } // end if @@ -87,7 +87,7 @@ foreach ($the_tables as $key => $table) { } $counter++; echo '<div' . $breakstyle . '>' . "\n"; - echo '<h1>' . $table . '</h1>' . "\n"; + echo '<h1>' . htmlspecialchars($table) . '</h1>' . "\n"; /** * Gets table informations hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, MAINT_3_3_10, updated. RELEASE_3_3_10_2-5-g6cb0ad8
by Marc Delisle 23 Jul '11

23 Jul '11

The branch, MAINT_3_3_10 has been updated via 6cb0ad8a0de2890ef9cf895804455d1d6206df72 (commit) via 2254a70fad144a2b6b3820c325be7304765e41d7 (commit) via 8ac8328229ae7493d6060b6272578d85879c698d (commit) via 630b8260be45eb9b211f5d7628dbb9e5c1b05bc6 (commit) via f6f6ee3f1171addb166fa18e75a0b56599bf374c (commit) from ab31a2565f494c69e6b0d9a82a2932c7656592b5 (commit) - Log ----------------------------------------------------------------- ----------------------------------------------------------------------- Summary of changes: ChangeLog | 4 ++++ libraries/auth/swekey/swekey.auth.lib.php | 12 +++++++----- tbl_printview.php | 4 ++-- 3 files changed, 13 insertions(+), 7 deletions(-) diff --git a/ChangeLog b/ChangeLog index 3816fdc..54ef4ec 100644 --- a/ChangeLog +++ b/ChangeLog @@ -5,6 +5,10 @@ phpMyAdmin - ChangeLog $Id$ $HeadURL: https://phpmyadmin.svn.sourceforge.net/svnroot/phpmyadmin/trunk/phpMyAdmin/… $ +3.3.10.3 (2011-07-23) +- [security] Fixed XSS vulnerability, see PMASA-2011-9 +- [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-12 + 3.3.10.2 (2011-07-02) - [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-5 - [security] Fixed possible code injection incase session variables are compromised, see PMASA-2011-6 diff --git a/libraries/auth/swekey/swekey.auth.lib.php b/libraries/auth/swekey/swekey.auth.lib.php index 2a790c4..197de1c 100644 --- a/libraries/auth/swekey/swekey.auth.lib.php +++ b/libraries/auth/swekey/swekey.auth.lib.php @@ -143,7 +143,9 @@ function Swekey_auth_error() return "Internal Error: CA File $caFile not found"; $result = null; - parse_str($_SERVER['QUERY_STRING']); + $swekey_id = $_GET['swekey_id']; + $swekey_otp = $_GET['swekey_otp']; + if (isset($swekey_id)) { unset($_SESSION['SWEKEY']['AUTHENTICATED_SWEKEY']); if (! isset($_SESSION['SWEKEY']['RND_TOKEN'])) { @@ -166,7 +168,7 @@ function Swekey_auth_error() $result = $GLOBALS['strSwekeyNoKey']; if ($_SESSION['SWEKEY']['CONF_DEBUG']) { - $result .= "<br>".$swekey_id; + $result .= "<br>" . htmlspecialchars($swekey_id); } unset($_SESSION['SWEKEY']['CONF_LOADED']); // reload the conf file } @@ -186,16 +188,16 @@ function Swekey_auth_error() <script> if (key.length != 32) { - window.location.search="?swekey_id=" + key; + window.location.search="?swekey_id=" + key + "&token=<?php echo $_SESSION[' PMA_token ']; ?>"; } else { var url = "" + window.location; if (url.indexOf("?") > 0) url = url.substr(0, url.indexOf("?")); - Swekey_SetUnplugUrl(key, "pma_login", url + "?session_to_unset=<?php echo session_id();?>"); + Swekey_SetUnplugUrl(key, "pma_login", url + "?session_to_unset=<?php echo session_id();?>&token=<?php echo $_SESSION[' PMA_token ']; ?>"); var otp = Swekey_GetOtp(key, <?php echo '"'.$_SESSION['SWEKEY']['RND_TOKEN'].'"';?>); - window.location.search="?swekey_id=" + key + "&swekey_otp=" + otp; + window.location.search="?swekey_id=" + key + "&swekey_otp=" + otp + "&token=<?php echo $_SESSION[' PMA_token ']; ?>"; } </script> <?php diff --git a/tbl_printview.php b/tbl_printview.php index c5b17ab..2b38e24 100644 --- a/tbl_printview.php +++ b/tbl_printview.php @@ -72,7 +72,7 @@ if ($multi_tables) { $tbl_list .= (empty($tbl_list) ? '' : ', ') . PMA_backquote($table); } - echo '<strong>'. $strShowTables . ': ' . $tbl_list . '</strong>' . "\n"; + echo '<strong>'. $strShowTables . ': ' . htmlspecialchars($tbl_list) . '</strong>' . "\n"; echo '<hr />' . "\n"; } // end if @@ -87,7 +87,7 @@ foreach ($the_tables as $key => $table) { } $counter++; echo '<div' . $breakstyle . '>' . "\n"; - echo '<h1>' . $table . '</h1>' . "\n"; + echo '<h1>' . htmlspecialchars($table) . '</h1>' . "\n"; /** * Gets table informations hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_3_1-11724-g5bc41ef
by Marc Delisle 22 Jul '11

22 Jul '11

The branch, master has been updated via 5bc41ef1dc31019daaa0933bec967ebff63b55e0 (commit) via 97055ad6fe4f13dccdf2288050e8c433a0db2be6 (commit) via 67ad16516b1f3a3e0039c15dfb35ab53f92391ed (commit) via 710362f869da38590ae507ee86c11c49c49387fa (commit) via 15a9db72b39bf033629c45a1cf87bd890ada9259 (commit) via 5288a55b9803c1b8fbb0fc580661ff5b2b46ac1e (commit) via 063b6bd544b35d7ee5a76e44c766258fb1c551de (commit) via 3a2d3e3c4eab717140526ca8ba5e6a234244c7d5 (commit) from 04d2a605dd2473be5c060faadb08916a3b4ca648 (commit) - Log ----------------------------------------------------------------- commit 5bc41ef1dc31019daaa0933bec967ebff63b55e0 Author: Marc Delisle <marc(a)infomarc.info> Date: Fri Jul 22 14:34:46 2011 -0400 ChangeLog for "AJAX for table Structure column Add" commit 97055ad6fe4f13dccdf2288050e8c433a0db2be6 Author: Marc Delisle <marc(a)infomarc.info> Date: Fri Jul 22 14:33:28 2011 -0400 Typo commit 67ad16516b1f3a3e0039c15dfb35ab53f92391ed Merge: 710362f869da38590ae507ee86c11c49c49387fa 04d2a605dd2473be5c060faadb08916a3b4ca648 Author: Thilanka Kaushalya <lgtkaushalya(a)gmail.com> Date: Fri Jul 22 23:32:28 2011 +0530 Merge branch 'master' of git://phpmyadmin.git.sourceforge.net/gitroot/phpmyadmin/phpmyadmin commit 710362f869da38590ae507ee86c11c49c49387fa Author: Thilanka Kaushalya <lgtkaushalya(a)gmail.com> Date: Fri Jul 22 23:31:44 2011 +0530 Fixed issues in enum editor in table insert column option commit 15a9db72b39bf033629c45a1cf87bd890ada9259 Merge: 5288a55b9803c1b8fbb0fc580661ff5b2b46ac1e 49b2ca984a6c38fa7b49aeff3f1344d837cf5834 Author: Thilanka Kaushalya <lgtkaushalya(a)gmail.com> Date: Fri Jul 22 07:40:41 2011 +0530 Merge branch 'master' of git://phpmyadmin.git.sourceforge.net/gitroot/phpmyadmin/phpmyadmin commit 5288a55b9803c1b8fbb0fc580661ff5b2b46ac1e Author: Thilanka Kaushalya <lgtkaushalya(a)gmail.com> Date: Fri Jul 22 07:40:14 2011 +0530 Fixed issues of Add Columns commit 063b6bd544b35d7ee5a76e44c766258fb1c551de Merge: 3a2d3e3c4eab717140526ca8ba5e6a234244c7d5 4925260d959d8bd7194b912ddd1317c71f7cc42b Author: Thilanka Kaushalya <lgtkaushalya(a)gmail.com> Date: Thu Jul 21 23:55:31 2011 +0530 Merge branch 'master' of git://phpmyadmin.git.sourceforge.net/gitroot/phpmyadmin/phpmyadmin commit 3a2d3e3c4eab717140526ca8ba5e6a234244c7d5 Author: Thilanka Kaushalya <lgtkaushalya(a)gmail.com> Date: Thu Jul 21 23:53:37 2011 +0530 Ajaxified add columns option in table structure ----------------------------------------------------------------------- Summary of changes: ChangeLog | 1 + js/functions.js | 12 +++++++- js/messages.php | 3 ++ js/tbl_structure.js | 66 +++++++++++++++++++++++++++++++++++++++++++++++++++ tbl_addfield.php | 6 ++++ tbl_structure.php | 2 +- 6 files changed, 87 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 38ac1e8..16e3cac 100644 --- a/ChangeLog +++ b/ChangeLog @@ -39,6 +39,7 @@ phpMyAdmin - ChangeLog + [interface] Improved support for events + [interface] Improved support for triggers + [interface] Improved server monitoring ++ AJAX for table Structure column Add 3.4.4.0 (not yet released) - bug #3323060 [parser] SQL parser breaks AJAX requests if query has unclosed quotes diff --git a/js/functions.js b/js/functions.js index 1e2cced..7b36e51 100644 --- a/js/functions.js +++ b/js/functions.js @@ -1836,12 +1836,12 @@ $(document).ready(function() { }, 'top.frame_content'); //end $(document).ready for 'Create Table' /** - * jQuery coding for 'Change Table'. Used on tbl_structure.php * + * jQuery coding for 'Change Table' and 'Add Column'. Used on tbl_structure.php * * Attach Ajax Event handlers for Change Table */ $(document).ready(function() { /** - *Ajax action for submitting the column change form + *Ajax action for submitting the "Column Change" and "Add Column" form **/ $("#append_fields_form input[name=do_save_data]").live('click', function(event) { event.preventDefault(); @@ -1876,16 +1876,20 @@ $(document).ready(function() { $("#result_query").prepend((data.message)); if ($("#change_column_dialog").length > 0) { $("#change_column_dialog").dialog("close").remove(); + } else if ($("#add_columns").length > 0) { + $("#add_columns").dialog("close").remove(); } /*Reload the field form*/ $.post($("#fieldsForm").attr('action'), $("#fieldsForm").serialize()+"&ajax_request=true", function(form_data) { $("#fieldsForm").remove(); + $("#addColumns").remove(); var $temp_div = $("<div id='temp_div'><div>").append(form_data); if ($("#sqlqueryresults").length != 0) { $temp_div.find("#fieldsForm").insertAfter("#sqlqueryresults"); } else { $temp_div.find("#fieldsForm").insertAfter(".error"); } + $temp_div.find("#addColumns").insertBefore("iframe.IE_hack"); /*Call the function to display the more options in table*/ displayMoreTableOpts(); }); @@ -2107,6 +2111,10 @@ $(document).ready(function() { $("#popup_background").css({"opacity":"0.7"}); $("#popup_background").fadeIn("fast"); $("#enum_editor").fadeIn("fast"); + /**Replacing the column name in the enum editor header*/ + var column_name = $("#append_fields_form").find("input[id=field_0_1]").attr("value"); + var h3_text = $("#enum_editor h3").html(); + $("#enum_editor h3").html(h3_text.split('"')[0]+'"'+column_name+'"'); // Get the values var values = $(this).parent().prev("input").attr("value").split(","); diff --git a/js/messages.php b/js/messages.php index 5b91d79..4cfa7e7 100644 --- a/js/messages.php +++ b/js/messages.php @@ -207,6 +207,9 @@ $js_messages['strShowSearchCriteria'] = __('Show search criteria'); /* For tbl_change.js */ $js_messages['strIgnore'] = __('Ignore'); +/* For tbl_structure.js */ +$js_messages['strAddColumns'] = __('Add columns'); + /* Designer (pmd/scripts/move.js) */ $js_messages['strSelectReferencedKey'] = __('Select referenced key'); $js_messages['strSelectForeignKey'] = __('Select Foreign Key'); diff --git a/js/tbl_structure.js b/js/tbl_structure.js index 69f872d..897cad8 100644 --- a/js/tbl_structure.js +++ b/js/tbl_structure.js @@ -336,6 +336,70 @@ $(document).ready(function() { }); } //end show/hide table index + /** + *Ajax event handler for Add column(s) + **/ + $("#addColumns.ajax input[value=Go]").live('click', function(event){ + event.preventDefault(); + + /*Remove the hidden dialogs if there are*/ + if ($('#add_columns').length != 0) { + $('#add_columns').remove(); + } + var $div = $('<div id="add_columns"></div>'); + + var $form = $("#addColumns"); + + /** + * @var button_options Object that stores the options passed to jQueryUI + * dialog + */ + var button_options = {}; + // in the following function we need to use $(this) + button_options[PMA_messages['strCancel']] = function() {$(this).dialog('close').remove();} + + var button_options_error = {}; + button_options_error[PMA_messages['strOK']] = function() {$(this).dialog('close').remove();} + var $msgbox = PMA_ajaxShowMessage(); + + $.get( $form.attr('action') , $form.serialize()+"&ajax_request=true" , function(data) { + //in the case of an error, show the error message returned. + if (data.success != undefined && data.success == false) { + $div + .append(data.error) + .dialog({ + title: PMA_messages['strAddColumns'], + height: 230, + width: 900, + open: PMA_verifyTypeOfAllColumns, + modal: true, + buttons : button_options_error + })// end dialog options + } else { + $div + .append(data) + .dialog({ + title: PMA_messages['strAddColumns'], + height: 600, + width: 900, + open: PMA_verifyTypeOfAllColumns, + modal: true, + buttons : button_options + }) + //Remove the top menu container from the dialog + .find("#topmenucontainer").hide() + ; // end dialog options + + $div = $("#add_columns"); + /*changed the z-index of the enum editor to allow the edit*/ + $("#enum_editor").css("z-index", "1100"); + PMA_convertFootnotesToTooltips($div); + } + PMA_ajaxRemoveMessage($msgbox); + }) // end $.get() + }); + + }) // end $(document).ready() @@ -396,6 +460,8 @@ function changeColumns(action,url) { $("#append_fields_form input[name=do_save_data]").addClass("ajax"); /*changed the z-index of the enum editor to allow the edit*/ $("#enum_editor").css("z-index", "1100"); + $div = $("#change_column_dialog"); + PMA_convertFootnotesToTooltips($div); } PMA_ajaxRemoveMessage($msgbox); }) // end $.get() diff --git a/tbl_addfield.php b/tbl_addfield.php index ec910fd..a866fef 100644 --- a/tbl_addfield.php +++ b/tbl_addfield.php @@ -184,6 +184,12 @@ if (isset($_REQUEST['do_save_data'])) { // Go back to the structure sub-page $message = PMA_Message::success(__('Table %1$s has been altered successfully')); $message->addParam($table); + + if( $GLOBALS['is_ajax_request'] == true) { + $extra_data['sql_query'] = PMA_showMessage(NULL, $sql_query); + PMA_ajaxResponse($message, $message->isSuccess(),$extra_data); + } + $active_page = 'tbl_structure.php'; require './tbl_structure.php'; } else { diff --git a/tbl_structure.php b/tbl_structure.php index afac23f..a4e9692 100644 --- a/tbl_structure.php +++ b/tbl_structure.php @@ -668,7 +668,7 @@ if (! $tbl_is_view && ! $db_is_information_schema) { ?> <br /> -<form method="post" action="tbl_addfield.php" +<form method="post" action="tbl_addfield.php" id="addColumns" name="addColumns" <?php echo ($GLOBALS['cfg']['AjaxEnable'] ? ' class="ajax"' : '');?> onsubmit="return checkFormElementInRange(this, 'num_fields', '<?php echo str_replace('\'', '\\\'', __('You have to add at least one column.')); ?>', 1)"> <?php echo PMA_generate_common_hidden_inputs($db, $table); hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_3_1-11716-g04d2a60
by Michal Čihař 22 Jul '11

22 Jul '11

The branch, master has been updated via 04d2a605dd2473be5c060faadb08916a3b4ca648 (commit) via 06bfdd7ca6d76335f45d53134770979d7d25d739 (commit) from c968408de7b5353832c428cc85901080ed7394f8 (commit) - Log ----------------------------------------------------------------- commit 04d2a605dd2473be5c060faadb08916a3b4ca648 Merge: c968408de7b5353832c428cc85901080ed7394f8 06bfdd7ca6d76335f45d53134770979d7d25d739 Author: Michal Čihař <mcihar(a)suse.cz> Date: Fri Jul 22 15:53:58 2011 +0200 Merge remote-tracking branch 'origin/QA_3_4' ----------------------------------------------------------------------- Summary of changes: ChangeLog | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/ChangeLog b/ChangeLog index 24167bd..38ac1e8 100644 --- a/ChangeLog +++ b/ChangeLog @@ -54,6 +54,8 @@ phpMyAdmin - ChangeLog - bug #3363221 [display] Missing Server Parameter on inline sql query - bug #3367986 [navi] Drop field -> lost active table - remove misleading comment on the "Rename database" interface +- bug #3374374 [interface] Fix footnote for inexact count while browsing +- bug #3372807 [interface] Fix security warning link in setup - bug #3374347 [display] Backquotes in normal text on import page 3.4.3.1 (2011-07-02) hooks/post-receive -- phpMyAdmin

1 0