Git

git@phpmyadmin.net

18 participants
38269 discussions

[Phpmyadmin-git] [SCM] phpMyAdmin branch, MAINT_3_4_1, updated. RELEASE_3_4_1RC1-12-g89c8f3c
by Marc Delisle 20 May '11

20 May '11

The branch, MAINT_3_4_1 has been updated via 89c8f3cbfe5356995ad71e5a41438e81fa994a55 (commit) via 7e10c132a3887c8ebfd7a8eee356b28375f1e287 (commit) via d3ccf798fdbd4f8a89d4088130637d8dee918492 (commit) from b7a8179eb6bf0f1643970ac57a70b5b513a1cd4f (commit) - Log ----------------------------------------------------------------- ----------------------------------------------------------------------- Summary of changes: ChangeLog | 4 ++++ libraries/tbl_links.inc.php | 2 +- tbl_tracking.php | 12 ++++++------ 3 files changed, 11 insertions(+), 7 deletions(-) diff --git a/ChangeLog b/ChangeLog index 99d7444..f6b479f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -9,6 +9,7 @@ - bug #3285929 [privileges] Revert temporary fix - bug #3302872 [synchronize] Synchronize and user name - bug #3302733 [core] Some browsers report an insecure https connection +- [security] Make redirector require valid token 3.4.0.0 (2011-05-11) + rfe #2890226 [view] Enable VIEW rename @@ -167,6 +168,9 @@ 3.3.11.0 (not yet released) +3.3.10.1 (2011-05-20) +- [security] XSS on Tracking page + 3.3.10.0 (2011-03-19) - patch #3147400 [structure] Aria table size printed as unknown, thanks to erickoh75 - erickoh75 diff --git a/libraries/tbl_links.inc.php b/libraries/tbl_links.inc.php index bc72d21..e31dd53 100644 --- a/libraries/tbl_links.inc.php +++ b/libraries/tbl_links.inc.php @@ -112,7 +112,7 @@ unset($tabs); if(PMA_Tracker::isActive() and PMA_Tracker::isTracked($GLOBALS["db"], $GLOBALS["table"])) { - $msg = PMA_Message::notice('<a href="tbl_tracking.php?'.$url_query.'">'.sprintf(__('Tracking of %s.%s is activated.'), $GLOBALS["db"], $GLOBALS["table"]).'</a>'); + $msg = PMA_Message::notice('<a href="tbl_tracking.php?'.$url_query.'">'.sprintf(__('Tracking of %s.%s is activated.'), htmlspecialchars($GLOBALS["db"]), htmlspecialchars($GLOBALS["table"])).'</a>'); $msg->display(); } diff --git a/tbl_tracking.php b/tbl_tracking.php index 757456b..99a540e 100644 --- a/tbl_tracking.php +++ b/tbl_tracking.php @@ -179,7 +179,7 @@ if (isset($_REQUEST['submit_create_version'])) { $tracking_set = rtrim($tracking_set, ','); if (PMA_Tracker::createVersion($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'], $tracking_set )) { - $msg = PMA_Message::success(sprintf(__('Version %s is created, tracking for %s.%s is activated.'), $_REQUEST['version'], $GLOBALS['db'], $GLOBALS['table'])); + $msg = PMA_Message::success(sprintf(__('Version %s is created, tracking for %s.%s is activated.'), $_REQUEST['version'], htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table']))); $msg->display(); } } @@ -187,7 +187,7 @@ if (isset($_REQUEST['submit_create_version'])) { // Deactivate tracking if (isset($_REQUEST['submit_deactivate_now'])) { if (PMA_Tracker::deactivateTracking($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])) { - $msg = PMA_Message::success(sprintf(__('Tracking for %s.%s , version %s is deactivated.'), $GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])); + $msg = PMA_Message::success(sprintf(__('Tracking for %s.%s , version %s is deactivated.'), htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table']), $_REQUEST['version'])); $msg->display(); } } @@ -195,7 +195,7 @@ if (isset($_REQUEST['submit_deactivate_now'])) { // Activate tracking if (isset($_REQUEST['submit_activate_now'])) { if (PMA_Tracker::activateTracking($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])) { - $msg = PMA_Message::success(sprintf(__('Tracking for %s.%s , version %s is activated.'), $GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])); + $msg = PMA_Message::success(sprintf(__('Tracking for %s.%s , version %s is activated.'), htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table']), $_REQUEST['version'])); $msg->display(); } } @@ -632,7 +632,7 @@ if ($last_version > 0) { <div id="div_deactivate_tracking"> <form method="post" action="tbl_tracking.php?<?php echo $url_query; ?>"> <fieldset> - <legend><?php printf(__('Deactivate tracking for %s.%s'), $GLOBALS['db'], $GLOBALS['table']); ?></legend> + <legend><?php printf(__('Deactivate tracking for %s.%s'), htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table'])); ?></legend> <input type="hidden" name="version" value="<?php echo $last_version; ?>" /> <input type="submit" name="submit_deactivate_now" value="<?php echo __('Deactivate now'); ?>" /> </fieldset> @@ -645,7 +645,7 @@ if ($last_version > 0) { <div id="div_activate_tracking"> <form method="post" action="tbl_tracking.php?<?php echo $url_query; ?>"> <fieldset> - <legend><?php printf(__('Activate tracking for %s.%s'), $GLOBALS['db'], $GLOBALS['table']); ?></legend> + <legend><?php printf(__('Activate tracking for %s.%s'), htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table'])); ?></legend> <input type="hidden" name="version" value="<?php echo $last_version; ?>" /> <input type="submit" name="submit_activate_now" value="<?php echo __('Activate now'); ?>" /> </fieldset> @@ -660,7 +660,7 @@ if ($last_version > 0) { <form method="post" action="tbl_tracking.php?<?php echo $url_query; ?>"> <?php echo PMA_generate_common_hidden_inputs($GLOBALS['db'], $GLOBALS['table']); ?> <fieldset> - <legend><?php printf(__('Create version %s of %s.%s'), ($last_version + 1), $GLOBALS['db'], $GLOBALS['table']); ?></legend> + <legend><?php printf(__('Create version %s of %s.%s'), ($last_version + 1), htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table'])); ?></legend> <input type="hidden" name="version" value="<?php echo ($last_version + 1); ?>" /> hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, MAINT_3_3_10, updated. RELEASE_3_3_10-3-g0c2a2a6
by Marc Delisle 20 May '11

20 May '11

The branch, MAINT_3_3_10 has been updated via 0c2a2a6220b8f1084c70f7dfdd14b4ab4fc4f4a4 (commit) via 1300510d3686b40adefafb7f1778a6f06d0a553a (commit) via 452669a1746898a08129d3a555ac4b1ec084b423 (commit) from 3e31ab117262a1d36c5dd0d57d9ec823289d20f9 (commit) - Log ----------------------------------------------------------------- ----------------------------------------------------------------------- Summary of changes: ChangeLog | 3 +++ libraries/tbl_links.inc.php | 2 +- tbl_tracking.php | 12 ++++++------ 3 files changed, 10 insertions(+), 7 deletions(-) diff --git a/ChangeLog b/ChangeLog index e42d62d..f207579 100644 --- a/ChangeLog +++ b/ChangeLog @@ -5,6 +5,9 @@ phpMyAdmin - ChangeLog $Id$ $HeadURL: https://phpmyadmin.svn.sourceforge.net/svnroot/phpmyadmin/trunk/phpMyAdmin/… $ +3.3.10.1 (2011-05-20) +- [security] XSS on Tracking page + 3.3.10.0 (2011-03-19) - patch #3147400 [structure] Aria table size printed as unknown, thanks to erickoh75 - erickoh75 diff --git a/libraries/tbl_links.inc.php b/libraries/tbl_links.inc.php index b6c9121..22cdbc3 100644 --- a/libraries/tbl_links.inc.php +++ b/libraries/tbl_links.inc.php @@ -136,7 +136,7 @@ unset($tabs); if(PMA_Tracker::isActive() and PMA_Tracker::isTracked($GLOBALS["db"], $GLOBALS["table"])) { - $msg = PMA_Message::notice('<a href="tbl_tracking.php?'.$url_query.'">'.sprintf($strTrackingActivated, $GLOBALS["db"], $GLOBALS["table"]).'</a>'); + $msg = PMA_Message::notice('<a href="tbl_tracking.php?'.$url_query.'">'.sprintf($strTrackingActivated, htmlspecialchars($GLOBALS["db"]), htmlspecialchars($GLOBALS["table"])).'</a>'); $msg->display(); } diff --git a/tbl_tracking.php b/tbl_tracking.php index 224ed87..b3ac4f3 100644 --- a/tbl_tracking.php +++ b/tbl_tracking.php @@ -185,7 +185,7 @@ if (isset($_REQUEST['submit_create_version'])) { $tracking_set = rtrim($tracking_set, ','); if (PMA_Tracker::createVersion($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'], $tracking_set )) { - $msg = PMA_Message::success(sprintf($strTrackingVersionCreated, $_REQUEST['version'], $GLOBALS['db'], $GLOBALS['table'])); + $msg = PMA_Message::success(sprintf($strTrackingVersionCreated, $_REQUEST['version'], htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table']))); $msg->display(); } } @@ -193,7 +193,7 @@ if (isset($_REQUEST['submit_create_version'])) { // Deactivate tracking if (isset($_REQUEST['submit_deactivate_now'])) { if (PMA_Tracker::deactivateTracking($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])) { - $msg = PMA_Message::success(sprintf($strTrackingVersionDeactivated, $GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])); + $msg = PMA_Message::success(sprintf($strTrackingVersionDeactivated, htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table']), $_REQUEST['version'])); $msg->display(); } } @@ -201,7 +201,7 @@ if (isset($_REQUEST['submit_deactivate_now'])) { // Activate tracking if (isset($_REQUEST['submit_activate_now'])) { if (PMA_Tracker::activateTracking($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])) { - $msg = PMA_Message::success(sprintf($strTrackingVersionActivated, $GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])); + $msg = PMA_Message::success(sprintf($strTrackingVersionActivated, htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table']), $_REQUEST['version'])); $msg->display(); } } @@ -638,7 +638,7 @@ if ($last_version > 0) { <div id="div_deactivate_tracking"> <form method="post" action="tbl_tracking.php?<?php echo $url_query; ?>"> <fieldset> - <legend><?php printf($strTrackingDeactivateTrackingFor, $GLOBALS['db'], $GLOBALS['table']); ?></legend> + <legend><?php printf($strTrackingDeactivateTrackingFor, htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table'])); ?></legend> <input type="hidden" name="version" value="<?php echo $last_version; ?>" /> <input type="submit" name="submit_deactivate_now" value="<?php echo $strTrackingDeactivateNow; ?>" /> </fieldset> @@ -651,7 +651,7 @@ if ($last_version > 0) { <div id="div_activate_tracking"> <form method="post" action="tbl_tracking.php?<?php echo $url_query; ?>"> <fieldset> - <legend><?php printf($strTrackingActivateTrackingFor, $GLOBALS['db'], $GLOBALS['table']); ?></legend> + <legend><?php printf($strTrackingActivateTrackingFor, htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table'])); ?></legend> <input type="hidden" name="version" value="<?php echo $last_version; ?>" /> <input type="submit" name="submit_activate_now" value="<?php echo $strTrackingActivateNow; ?>" /> </fieldset> @@ -666,7 +666,7 @@ if ($last_version > 0) { <form method="post" action="tbl_tracking.php?<?php echo $url_query; ?>"> <?php echo PMA_generate_common_hidden_inputs($GLOBALS['db'], $GLOBALS['table']); ?> <fieldset> - <legend><?php printf($strTrackingCreateVersionOf, ($last_version + 1), $GLOBALS['db'], $GLOBALS['table']); ?></legend> + <legend><?php printf($strTrackingCreateVersionOf, ($last_version + 1), htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table'])); ?></legend> <input type="hidden" name="version" value="<?php echo ($last_version + 1); ?>" /> hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_1RC1-1793-gfc59c64
by Michal Čihař 20 May '11

20 May '11

The branch, master has been updated via fc59c64fbd94a408f0500576d97ba7d29a254d00 (commit) via e22344168fa0c717538f78e4b4e5935dd78dc69d (commit) via b7a8179eb6bf0f1643970ac57a70b5b513a1cd4f (commit) from b3a79a9344297ec9d391e32e8c9ec247cd9a98c0 (commit) - Log ----------------------------------------------------------------- commit fc59c64fbd94a408f0500576d97ba7d29a254d00 Merge: b3a79a9344297ec9d391e32e8c9ec247cd9a98c0 e22344168fa0c717538f78e4b4e5935dd78dc69d Author: Michal Čihař <mcihar(a)novell.com> Date: Fri May 20 10:03:19 2011 +0200 Merge remote-tracking branch 'origin/QA_3_4' ----------------------------------------------------------------------- Summary of changes: libraries/core.lib.php | 11 ++++------- 1 files changed, 4 insertions(+), 7 deletions(-) diff --git a/libraries/core.lib.php b/libraries/core.lib.php index 63f1a25..51315d7 100644 --- a/libraries/core.lib.php +++ b/libraries/core.lib.php @@ -681,15 +681,12 @@ function PMA_array_remove($path, &$array) * @return string URL for a link. */ function PMA_linkURL($url) { - $params = array(); - $params['url'] = $url; - $goto = 'url.php' . PMA_generate_common_url($params); - if (!preg_match('#^https?://#', $url)) { + if (!preg_match('#^https?://#', $url) || defined('PMA_SETUP')) { return $url; - } elseif (defined('PMA_SETUP')) { - return '../' . $goto; } else { - return './' . $goto; + $params = array(); + $params['url'] = $url; + return './url.php' . PMA_generate_common_url($params); } } hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_4, updated. RELEASE_3_4_1RC1-24-ge223441
by Michal Čihař 20 May '11

20 May '11

The branch, QA_3_4 has been updated via e22344168fa0c717538f78e4b4e5935dd78dc69d (commit) via b7a8179eb6bf0f1643970ac57a70b5b513a1cd4f (commit) from 1a1e548a396756656852771b3066673837570004 (commit) - Log ----------------------------------------------------------------- commit e22344168fa0c717538f78e4b4e5935dd78dc69d Merge: 1a1e548a396756656852771b3066673837570004 b7a8179eb6bf0f1643970ac57a70b5b513a1cd4f Author: Michal Čihař <mcihar(a)novell.com> Date: Fri May 20 10:02:48 2011 +0200 Merge remote-tracking branch 'origin/MAINT_3_4_1' into QA_3_4 ----------------------------------------------------------------------- Summary of changes: libraries/core.lib.php | 11 ++++------- 1 files changed, 4 insertions(+), 7 deletions(-) diff --git a/libraries/core.lib.php b/libraries/core.lib.php index 1152d6a..1350247 100644 --- a/libraries/core.lib.php +++ b/libraries/core.lib.php @@ -681,15 +681,12 @@ function PMA_array_remove($path, &$array) * @return string URL for a link. */ function PMA_linkURL($url) { - $params = array(); - $params['url'] = $url; - $goto = 'url.php' . PMA_generate_common_url($params); - if (!preg_match('#^https?://#', $url)) { + if (!preg_match('#^https?://#', $url) || defined('PMA_SETUP')) { return $url; - } elseif (defined('PMA_SETUP')) { - return '../' . $goto; } else { - return './' . $goto; + $params = array(); + $params['url'] = $url; + return './url.php' . PMA_generate_common_url($params); } } hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, MAINT_3_4_1, updated. RELEASE_3_4_1RC1-9-gb7a8179
by Michal Čihař 20 May '11

20 May '11

The branch, MAINT_3_4_1 has been updated via b7a8179eb6bf0f1643970ac57a70b5b513a1cd4f (commit) from ecfc8ba4f7b4ea612c58ab5726054ed0f28e200d (commit) - Log ----------------------------------------------------------------- commit b7a8179eb6bf0f1643970ac57a70b5b513a1cd4f Author: Michal Čihař <mcihar(a)novell.com> Date: Fri May 20 09:46:15 2011 +0200 Can not use redirector for setup. We currently have no reasonable way to protect it there. ----------------------------------------------------------------------- Summary of changes: libraries/core.lib.php | 11 ++++------- 1 files changed, 4 insertions(+), 7 deletions(-) diff --git a/libraries/core.lib.php b/libraries/core.lib.php index 1152d6a..1350247 100644 --- a/libraries/core.lib.php +++ b/libraries/core.lib.php @@ -681,15 +681,12 @@ function PMA_array_remove($path, &$array) * @return string URL for a link. */ function PMA_linkURL($url) { - $params = array(); - $params['url'] = $url; - $goto = 'url.php' . PMA_generate_common_url($params); - if (!preg_match('#^https?://#', $url)) { + if (!preg_match('#^https?://#', $url) || defined('PMA_SETUP')) { return $url; - } elseif (defined('PMA_SETUP')) { - return '../' . $goto; } else { - return './' . $goto; + $params = array(); + $params['url'] = $url; + return './url.php' . PMA_generate_common_url($params); } } hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_1RC1-1790-gb3a79a9
by Michal Čihař 20 May '11

20 May '11

The branch, master has been updated via b3a79a9344297ec9d391e32e8c9ec247cd9a98c0 (commit) via 1a1e548a396756656852771b3066673837570004 (commit) via ecfc8ba4f7b4ea612c58ab5726054ed0f28e200d (commit) via 0ea08ee47306e314e96c7cbb5425c1450935fff5 (commit) via 32d8446e01d5097599e89cb78ade338f03e82a1d (commit) from b8a411a227c70ed6d0304251703b368886b45cbb (commit) - Log ----------------------------------------------------------------- commit b3a79a9344297ec9d391e32e8c9ec247cd9a98c0 Merge: b8a411a227c70ed6d0304251703b368886b45cbb 1a1e548a396756656852771b3066673837570004 Author: Michal Čihař <mcihar(a)novell.com> Date: Fri May 20 09:02:28 2011 +0200 Merge remote-tracking branch 'origin/QA_3_4' ----------------------------------------------------------------------- Summary of changes: libraries/common.inc.php | 2 -- libraries/core.lib.php | 7 +++++-- url.php | 6 ++---- 3 files changed, 7 insertions(+), 8 deletions(-) diff --git a/libraries/common.inc.php b/libraries/common.inc.php index 7c3bcf5..d75084b 100644 --- a/libraries/common.inc.php +++ b/libraries/common.inc.php @@ -477,8 +477,6 @@ if (! PMA_isValid($_REQUEST['token']) || $_SESSION[' PMA_token '] != $_REQUEST[' 'media_type', 'custom_type', 'bs_reference', /* for changing BLOB repository file MIME type */ 'bs_db', 'bs_table', 'bs_ref', 'bs_new_mime_type', - /* URL redirector */ - 'url' ); /** * Require cleanup functions diff --git a/libraries/core.lib.php b/libraries/core.lib.php index 1d0f3a6..63f1a25 100644 --- a/libraries/core.lib.php +++ b/libraries/core.lib.php @@ -681,12 +681,15 @@ function PMA_array_remove($path, &$array) * @return string URL for a link. */ function PMA_linkURL($url) { + $params = array(); + $params['url'] = $url; + $goto = 'url.php' . PMA_generate_common_url($params); if (!preg_match('#^https?://#', $url)) { return $url; } elseif (defined('PMA_SETUP')) { - return '../url.php?url=' . $url; + return '../' . $goto; } else { - return './url.php?url=' . $url; + return './' . $goto; } } diff --git a/url.php b/url.php index ec0ab39..5088eff 100644 --- a/url.php +++ b/url.php @@ -3,16 +3,14 @@ * URL redirector to avoid leaking Referer with some sensitive information. */ -define('PMA_MINIMUM_COMMON', TRUE); - /** * Gets core libraries and defines some variables */ require_once './libraries/common.inc.php'; -if (empty($GLOBALS['url']) || ! preg_match('/^https?:\/\/[^\n\r]*$/', $GLOBALS['url'])) { +if (! PMA_isValid($_GET['url']) || ! preg_match('/^https?:\/\/[^\n\r]*$/', $_GET['url'])) { header('Location: ' . $cfg['PmaAbsoluteUri']); } else { - header('Location: ' . $GLOBALS['url']); + header('Location: ' . $_GET['url']); } ?> hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_4, updated. RELEASE_3_4_1RC1-22-g1a1e548
by Michal Čihař 20 May '11

20 May '11

The branch, QA_3_4 has been updated via 1a1e548a396756656852771b3066673837570004 (commit) via ecfc8ba4f7b4ea612c58ab5726054ed0f28e200d (commit) from 0ea08ee47306e314e96c7cbb5425c1450935fff5 (commit) - Log ----------------------------------------------------------------- commit 1a1e548a396756656852771b3066673837570004 Merge: 0ea08ee47306e314e96c7cbb5425c1450935fff5 ecfc8ba4f7b4ea612c58ab5726054ed0f28e200d Author: Michal Čihař <mcihar(a)novell.com> Date: Fri May 20 09:02:05 2011 +0200 Merge remote-tracking branch 'origin/MAINT_3_4_1' into QA_3_4 ----------------------------------------------------------------------- Summary of changes: libraries/common.inc.php | 2 -- libraries/core.lib.php | 7 +++++-- url.php | 6 ++---- 3 files changed, 7 insertions(+), 8 deletions(-) diff --git a/libraries/common.inc.php b/libraries/common.inc.php index 49937c8..7d71993 100644 --- a/libraries/common.inc.php +++ b/libraries/common.inc.php @@ -477,8 +477,6 @@ if (! PMA_isValid($_REQUEST['token']) || $_SESSION[' PMA_token '] != $_REQUEST[' 'media_type', 'custom_type', 'bs_reference', /* for changing BLOB repository file MIME type */ 'bs_db', 'bs_table', 'bs_ref', 'bs_new_mime_type', - /* URL redirector */ - 'url' ); /** * Require cleanup functions diff --git a/libraries/core.lib.php b/libraries/core.lib.php index 76d2c86..1152d6a 100644 --- a/libraries/core.lib.php +++ b/libraries/core.lib.php @@ -681,12 +681,15 @@ function PMA_array_remove($path, &$array) * @return string URL for a link. */ function PMA_linkURL($url) { + $params = array(); + $params['url'] = $url; + $goto = 'url.php' . PMA_generate_common_url($params); if (!preg_match('#^https?://#', $url)) { return $url; } elseif (defined('PMA_SETUP')) { - return '../url.php?url=' . $url; + return '../' . $goto; } else { - return './url.php?url=' . $url; + return './' . $goto; } } diff --git a/url.php b/url.php index ec0ab39..5088eff 100644 --- a/url.php +++ b/url.php @@ -3,16 +3,14 @@ * URL redirector to avoid leaking Referer with some sensitive information. */ -define('PMA_MINIMUM_COMMON', TRUE); - /** * Gets core libraries and defines some variables */ require_once './libraries/common.inc.php'; -if (empty($GLOBALS['url']) || ! preg_match('/^https?:\/\/[^\n\r]*$/', $GLOBALS['url'])) { +if (! PMA_isValid($_GET['url']) || ! preg_match('/^https?:\/\/[^\n\r]*$/', $_GET['url'])) { header('Location: ' . $cfg['PmaAbsoluteUri']); } else { - header('Location: ' . $GLOBALS['url']); + header('Location: ' . $_GET['url']); } ?> hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, MAINT_3_4_1, updated. RELEASE_3_4_1RC1-8-gecfc8ba
by Michal Čihař 20 May '11

20 May '11

The branch, MAINT_3_4_1 has been updated via ecfc8ba4f7b4ea612c58ab5726054ed0f28e200d (commit) from 32d8446e01d5097599e89cb78ade338f03e82a1d (commit) - Log ----------------------------------------------------------------- commit ecfc8ba4f7b4ea612c58ab5726054ed0f28e200d Author: Michal Čihař <mcihar(a)novell.com> Date: Fri May 20 09:01:20 2011 +0200 Make redirector require valid token ----------------------------------------------------------------------- Summary of changes: libraries/common.inc.php | 2 -- libraries/core.lib.php | 7 +++++-- url.php | 6 ++---- 3 files changed, 7 insertions(+), 8 deletions(-) diff --git a/libraries/common.inc.php b/libraries/common.inc.php index 49937c8..7d71993 100644 --- a/libraries/common.inc.php +++ b/libraries/common.inc.php @@ -477,8 +477,6 @@ if (! PMA_isValid($_REQUEST['token']) || $_SESSION[' PMA_token '] != $_REQUEST[' 'media_type', 'custom_type', 'bs_reference', /* for changing BLOB repository file MIME type */ 'bs_db', 'bs_table', 'bs_ref', 'bs_new_mime_type', - /* URL redirector */ - 'url' ); /** * Require cleanup functions diff --git a/libraries/core.lib.php b/libraries/core.lib.php index 76d2c86..1152d6a 100644 --- a/libraries/core.lib.php +++ b/libraries/core.lib.php @@ -681,12 +681,15 @@ function PMA_array_remove($path, &$array) * @return string URL for a link. */ function PMA_linkURL($url) { + $params = array(); + $params['url'] = $url; + $goto = 'url.php' . PMA_generate_common_url($params); if (!preg_match('#^https?://#', $url)) { return $url; } elseif (defined('PMA_SETUP')) { - return '../url.php?url=' . $url; + return '../' . $goto; } else { - return './url.php?url=' . $url; + return './' . $goto; } } diff --git a/url.php b/url.php index ec0ab39..5088eff 100644 --- a/url.php +++ b/url.php @@ -3,16 +3,14 @@ * URL redirector to avoid leaking Referer with some sensitive information. */ -define('PMA_MINIMUM_COMMON', TRUE); - /** * Gets core libraries and defines some variables */ require_once './libraries/common.inc.php'; -if (empty($GLOBALS['url']) || ! preg_match('/^https?:\/\/[^\n\r]*$/', $GLOBALS['url'])) { +if (! PMA_isValid($_GET['url']) || ! preg_match('/^https?:\/\/[^\n\r]*$/', $_GET['url'])) { header('Location: ' . $cfg['PmaAbsoluteUri']); } else { - header('Location: ' . $GLOBALS['url']); + header('Location: ' . $_GET['url']); } ?> hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_4, updated. RELEASE_3_4_1RC1-20-g0ea08ee
by Michal Čihař 20 May '11

20 May '11

The branch, QA_3_4 has been updated via 0ea08ee47306e314e96c7cbb5425c1450935fff5 (commit) via 32d8446e01d5097599e89cb78ade338f03e82a1d (commit) from 05e7ce152d5c634bd5909f5f89279a6443605e9b (commit) - Log ----------------------------------------------------------------- commit 0ea08ee47306e314e96c7cbb5425c1450935fff5 Merge: 05e7ce152d5c634bd5909f5f89279a6443605e9b 32d8446e01d5097599e89cb78ade338f03e82a1d Author: Michal Čihař <mcihar(a)novell.com> Date: Fri May 20 08:33:22 2011 +0200 Merge remote-tracking branch 'origin/MAINT_3_4_1' into QA_3_4 ----------------------------------------------------------------------- Summary of changes: po/cy.po | 8 +++++--- po/hu.po | 46 +++++++++++++++++++++++----------------------- po/mk.po | 2 +- 3 files changed, 29 insertions(+), 27 deletions(-) diff --git a/po/cy.po b/po/cy.po index d8e2bf0..b81a06e 100644 --- a/po/cy.po +++ b/po/cy.po @@ -99,7 +99,7 @@ msgstr "Defnyddiwch y gwerth hwn" #: bs_disp_as_mime_type.php:29 bs_play_media.php:35 #: libraries/blobstreaming.lib.php:331 msgid "No blob streaming server configured!" -msgstr "" +msgstr "Dim gweinydd ffrydio blob wedi'i ffurfweddu!" #: bs_disp_as_mime_type.php:35 #, fuzzy @@ -109,7 +109,7 @@ msgstr "Methu ag ysgrifennu i'r ddisg." #: bs_disp_as_mime_type.php:41 msgid "Failed to open remote URL" -msgstr "" +msgstr "Methu ag agor URL pell" #: changelog.php:32 license.php:28 #, php-format @@ -117,6 +117,8 @@ msgid "" "The %s file is not available on this system, please visit www.phpmyadmin.net " "for more information." msgstr "" +"Dyw'r ffeil %s ddim ar gael ar y system hon, ewch i www.phpmyadmin.net am " +"wybodaeth bellach." #: db_create.php:58 #, php-format @@ -429,7 +431,7 @@ msgstr "" #: db_qbe.php:186 msgid "visual builder" -msgstr "" +msgstr "adeiladwr gweledol" #: db_qbe.php:222 libraries/db_structure.lib.php:95 #: libraries/display_tbl.lib.php:852 diff --git a/po/hu.po b/po/hu.po index 954dd44..37e66b8 100644 --- a/po/hu.po +++ b/po/hu.po @@ -6552,7 +6552,7 @@ msgstr "Keresés az adatbázisban" #: libraries/server_synchronize.lib.php:1339 #: libraries/server_synchronize.lib.php:1362 msgid "Current server" -msgstr "" +msgstr "Jelenlegi szerver" #: libraries/server_synchronize.lib.php:1341 #: libraries/server_synchronize.lib.php:1364 @@ -7528,7 +7528,7 @@ msgstr "Fájlok importálása" #: prefs_manage.php:245 msgid "Import from browser's storage" -msgstr "" +msgstr "Importálás a böngészőből" #: prefs_manage.php:248 msgid "Settings will be imported from your browser's local storage." @@ -8135,7 +8135,7 @@ msgstr "AZ" #: server_replication.php:49 msgid "Unknown error" -msgstr "" +msgstr "Ismeretlen hiba" #: server_replication.php:56 #, php-format @@ -8289,7 +8289,7 @@ msgstr "" #: server_replication.php:343 msgid "Skip next" -msgstr "" +msgstr "Következő átugrása" #: server_replication.php:346 msgid "errors." @@ -9150,7 +9150,7 @@ msgstr "Nem lehetett kapcsolódni a MySQL-szerverhez" #: tbl_get_field.php:19 #, php-format msgid "'%s' database does not exist." -msgstr "" +msgstr "Nem létezik '%s' nevű adatbázis." #: server_synchronize.php:263 msgid "Structure Synchronization" @@ -9175,31 +9175,31 @@ msgstr "" #: server_synchronize.php:429 server_synchronize.php:872 msgid "Add column(s)" -msgstr "" +msgstr "Oszlop(ok) hozzáadása" #: server_synchronize.php:430 server_synchronize.php:873 msgid "Remove column(s)" -msgstr "" +msgstr "Oszlop(ok) eltávolítása" #: server_synchronize.php:431 server_synchronize.php:874 msgid "Alter column(s)" -msgstr "" +msgstr "Oszlop(ok) módosítása" #: server_synchronize.php:432 server_synchronize.php:875 msgid "Remove index(s)" -msgstr "" +msgstr "Index(ek) törlése" #: server_synchronize.php:433 server_synchronize.php:876 msgid "Apply index(s)" -msgstr "" +msgstr "Index(ek) alkalmazása" #: server_synchronize.php:434 server_synchronize.php:877 msgid "Update row(s)" -msgstr "" +msgstr "Sor(ok) frissítése" #: server_synchronize.php:435 server_synchronize.php:878 msgid "Insert row(s)" -msgstr "" +msgstr "Sor(ok) beszúrása" #: server_synchronize.php:445 server_synchronize.php:889 msgid "Would you like to delete all the previous rows from target tables?" @@ -9207,11 +9207,11 @@ msgstr "" #: server_synchronize.php:448 server_synchronize.php:893 msgid "Apply Selected Changes" -msgstr "" +msgstr "Kiválasztott módosítások végrehajtása" #: server_synchronize.php:450 server_synchronize.php:895 msgid "Synchronize Databases" -msgstr "" +msgstr "Adatbázisok szinkronizálása" #: server_synchronize.php:463 msgid "Selected target tables have been synchronized with source tables." @@ -9765,23 +9765,23 @@ msgstr "Becsült érték lehet. Lásd: GYIK 3.11" #: tbl_chart.php:90 msgid "Width" -msgstr "" +msgstr "Szélesség" #: tbl_chart.php:94 msgid "Height" -msgstr "" +msgstr "Magasság" #: tbl_chart.php:98 msgid "Title" -msgstr "" +msgstr "Cím" #: tbl_chart.php:103 msgid "X Axis label" -msgstr "" +msgstr "X tengely címkéje" #: tbl_chart.php:107 msgid "Y Axis label" -msgstr "" +msgstr "Y tengely címkéje" #: tbl_chart.php:112 msgid "Area margins" @@ -9850,7 +9850,7 @@ msgstr "" #: tbl_chart.php:181 msgid "Redraw" -msgstr "" +msgstr "Újrarajzolás" #: tbl_create.php:56 #, php-format @@ -9987,7 +9987,7 @@ msgstr "A tábla adatainak kiíratása" #: tbl_operations.php:688 msgid "Empty the table (TRUNCATE)" -msgstr "" +msgstr "Tábla kiürítése (TRUNCATE)" #: tbl_operations.php:708 #, fuzzy @@ -10134,11 +10134,11 @@ msgstr "" #: tbl_structure.php:168 tbl_structure.php:169 msgid "Add index" -msgstr "" +msgstr "Index hozzáadása" #: tbl_structure.php:170 tbl_structure.php:171 msgid "Add unique index" -msgstr "" +msgstr "Elsődleges kulcs hozzáadása" #: tbl_structure.php:172 tbl_structure.php:173 msgid "Add FULLTEXT index" diff --git a/po/mk.po b/po/mk.po index 6dda875..993a9b9 100644 --- a/po/mk.po +++ b/po/mk.po @@ -103,7 +103,7 @@ msgstr "" #: bs_disp_as_mime_type.php:41 msgid "Failed to open remote URL" -msgstr "" +msgstr "Неуспешно отворање на далечински URL" #: changelog.php:32 license.php:28 #, php-format hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, MAINT_3_4_1, updated. RELEASE_3_4_1RC1-7-g32d8446
by Michal Čihař 20 May '11

20 May '11

The branch, MAINT_3_4_1 has been updated via 32d8446e01d5097599e89cb78ade338f03e82a1d (commit) from e043bfe2afa2617b3983ff27e248be18b4b2c6a9 (commit) - Log ----------------------------------------------------------------- commit 32d8446e01d5097599e89cb78ade338f03e82a1d Author: Michal Čihař <mcihar(a)novell.com> Date: Fri May 20 08:32:16 2011 +0200 Update from master ----------------------------------------------------------------------- Summary of changes: po/cy.po | 8 +++++--- po/hu.po | 46 +++++++++++++++++++++++----------------------- po/mk.po | 2 +- 3 files changed, 29 insertions(+), 27 deletions(-) diff --git a/po/cy.po b/po/cy.po index d8e2bf0..b81a06e 100644 --- a/po/cy.po +++ b/po/cy.po @@ -99,7 +99,7 @@ msgstr "Defnyddiwch y gwerth hwn" #: bs_disp_as_mime_type.php:29 bs_play_media.php:35 #: libraries/blobstreaming.lib.php:331 msgid "No blob streaming server configured!" -msgstr "" +msgstr "Dim gweinydd ffrydio blob wedi'i ffurfweddu!" #: bs_disp_as_mime_type.php:35 #, fuzzy @@ -109,7 +109,7 @@ msgstr "Methu ag ysgrifennu i'r ddisg." #: bs_disp_as_mime_type.php:41 msgid "Failed to open remote URL" -msgstr "" +msgstr "Methu ag agor URL pell" #: changelog.php:32 license.php:28 #, php-format @@ -117,6 +117,8 @@ msgid "" "The %s file is not available on this system, please visit www.phpmyadmin.net " "for more information." msgstr "" +"Dyw'r ffeil %s ddim ar gael ar y system hon, ewch i www.phpmyadmin.net am " +"wybodaeth bellach." #: db_create.php:58 #, php-format @@ -429,7 +431,7 @@ msgstr "" #: db_qbe.php:186 msgid "visual builder" -msgstr "" +msgstr "adeiladwr gweledol" #: db_qbe.php:222 libraries/db_structure.lib.php:95 #: libraries/display_tbl.lib.php:852 diff --git a/po/hu.po b/po/hu.po index 954dd44..37e66b8 100644 --- a/po/hu.po +++ b/po/hu.po @@ -6552,7 +6552,7 @@ msgstr "Keresés az adatbázisban" #: libraries/server_synchronize.lib.php:1339 #: libraries/server_synchronize.lib.php:1362 msgid "Current server" -msgstr "" +msgstr "Jelenlegi szerver" #: libraries/server_synchronize.lib.php:1341 #: libraries/server_synchronize.lib.php:1364 @@ -7528,7 +7528,7 @@ msgstr "Fájlok importálása" #: prefs_manage.php:245 msgid "Import from browser's storage" -msgstr "" +msgstr "Importálás a böngészőből" #: prefs_manage.php:248 msgid "Settings will be imported from your browser's local storage." @@ -8135,7 +8135,7 @@ msgstr "AZ" #: server_replication.php:49 msgid "Unknown error" -msgstr "" +msgstr "Ismeretlen hiba" #: server_replication.php:56 #, php-format @@ -8289,7 +8289,7 @@ msgstr "" #: server_replication.php:343 msgid "Skip next" -msgstr "" +msgstr "Következő átugrása" #: server_replication.php:346 msgid "errors." @@ -9150,7 +9150,7 @@ msgstr "Nem lehetett kapcsolódni a MySQL-szerverhez" #: tbl_get_field.php:19 #, php-format msgid "'%s' database does not exist." -msgstr "" +msgstr "Nem létezik '%s' nevű adatbázis." #: server_synchronize.php:263 msgid "Structure Synchronization" @@ -9175,31 +9175,31 @@ msgstr "" #: server_synchronize.php:429 server_synchronize.php:872 msgid "Add column(s)" -msgstr "" +msgstr "Oszlop(ok) hozzáadása" #: server_synchronize.php:430 server_synchronize.php:873 msgid "Remove column(s)" -msgstr "" +msgstr "Oszlop(ok) eltávolítása" #: server_synchronize.php:431 server_synchronize.php:874 msgid "Alter column(s)" -msgstr "" +msgstr "Oszlop(ok) módosítása" #: server_synchronize.php:432 server_synchronize.php:875 msgid "Remove index(s)" -msgstr "" +msgstr "Index(ek) törlése" #: server_synchronize.php:433 server_synchronize.php:876 msgid "Apply index(s)" -msgstr "" +msgstr "Index(ek) alkalmazása" #: server_synchronize.php:434 server_synchronize.php:877 msgid "Update row(s)" -msgstr "" +msgstr "Sor(ok) frissítése" #: server_synchronize.php:435 server_synchronize.php:878 msgid "Insert row(s)" -msgstr "" +msgstr "Sor(ok) beszúrása" #: server_synchronize.php:445 server_synchronize.php:889 msgid "Would you like to delete all the previous rows from target tables?" @@ -9207,11 +9207,11 @@ msgstr "" #: server_synchronize.php:448 server_synchronize.php:893 msgid "Apply Selected Changes" -msgstr "" +msgstr "Kiválasztott módosítások végrehajtása" #: server_synchronize.php:450 server_synchronize.php:895 msgid "Synchronize Databases" -msgstr "" +msgstr "Adatbázisok szinkronizálása" #: server_synchronize.php:463 msgid "Selected target tables have been synchronized with source tables." @@ -9765,23 +9765,23 @@ msgstr "Becsült érték lehet. Lásd: GYIK 3.11" #: tbl_chart.php:90 msgid "Width" -msgstr "" +msgstr "Szélesség" #: tbl_chart.php:94 msgid "Height" -msgstr "" +msgstr "Magasság" #: tbl_chart.php:98 msgid "Title" -msgstr "" +msgstr "Cím" #: tbl_chart.php:103 msgid "X Axis label" -msgstr "" +msgstr "X tengely címkéje" #: tbl_chart.php:107 msgid "Y Axis label" -msgstr "" +msgstr "Y tengely címkéje" #: tbl_chart.php:112 msgid "Area margins" @@ -9850,7 +9850,7 @@ msgstr "" #: tbl_chart.php:181 msgid "Redraw" -msgstr "" +msgstr "Újrarajzolás" #: tbl_create.php:56 #, php-format @@ -9987,7 +9987,7 @@ msgstr "A tábla adatainak kiíratása" #: tbl_operations.php:688 msgid "Empty the table (TRUNCATE)" -msgstr "" +msgstr "Tábla kiürítése (TRUNCATE)" #: tbl_operations.php:708 #, fuzzy @@ -10134,11 +10134,11 @@ msgstr "" #: tbl_structure.php:168 tbl_structure.php:169 msgid "Add index" -msgstr "" +msgstr "Index hozzáadása" #: tbl_structure.php:170 tbl_structure.php:171 msgid "Add unique index" -msgstr "" +msgstr "Elsődleges kulcs hozzáadása" #: tbl_structure.php:172 tbl_structure.php:173 msgid "Add FULLTEXT index" diff --git a/po/mk.po b/po/mk.po index 6dda875..993a9b9 100644 --- a/po/mk.po +++ b/po/mk.po @@ -103,7 +103,7 @@ msgstr "" #: bs_disp_as_mime_type.php:41 msgid "Failed to open remote URL" -msgstr "" +msgstr "Неуспешно отворање на далечински URL" #: changelog.php:32 license.php:28 #, php-format hooks/post-receive -- phpMyAdmin

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

Git