- Git - lists.phpmyadmin.net

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_4, updated. RELEASE_3_4_1RC1-30-g16a28bb
by Marc Delisle 20 May '11

20 May '11

The branch, QA_3_4 has been updated via 16a28bbeaa9bc70a82891b5aac9a88d45987659b (commit) from 20cf17923e321718aa6d19fb9dc846625c1879fb (commit) - Log ----------------------------------------------------------------- commit 16a28bbeaa9bc70a82891b5aac9a88d45987659b Author: Marc Delisle <marc(a)infomarc.info> Date: Fri May 20 13:17:17 2011 -0400 3.4.1 ----------------------------------------------------------------------- Summary of changes: ChangeLog | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/ChangeLog b/ChangeLog index a7c19b4..1f945db 100644 --- a/ChangeLog +++ b/ChangeLog @@ -6,7 +6,7 @@ - bug #3303869 [interface] Unnecessary scrolling on Databases page - patch #3303813 [setup] Define a label that was missing -3.4.1.0 (not yet released) +3.4.1.0 (2011-05-20) - bug #3301108 [interface] Synchronize and already configured host - bug #3302457 Inline edit and $cfg['PropertiesIconic'] - Patch #3302313 Show a translated label hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, MAINT_3_4_1, updated. RELEASE_3_4_1RC1-13-g8c1fbf4
by Marc Delisle 20 May '11

20 May '11

The branch, MAINT_3_4_1 has been updated via 8c1fbf450500a6903aab062c837139baf3a7296b (commit) from 89c8f3cbfe5356995ad71e5a41438e81fa994a55 (commit) - Log ----------------------------------------------------------------- commit 8c1fbf450500a6903aab062c837139baf3a7296b Author: Marc Delisle <marc(a)infomarc.info> Date: Fri May 20 13:16:42 2011 -0400 3.4.1 ----------------------------------------------------------------------- Summary of changes: ChangeLog | 2 +- Documentation.html | 4 ++-- README | 2 +- libraries/Config.class.php | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/ChangeLog b/ChangeLog index f6b479f..278d4cc 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,7 +1,7 @@ phpMyAdmin - ChangeLog ====================== -3.4.1.0 (not yet released) +3.4.1.0 (2011-05-20) - bug #3301108 [interface] Synchronize and already configured host - bug #3302457 Inline edit and $cfg['PropertiesIconic'] - Patch #3302313 Show a translated label diff --git a/Documentation.html b/Documentation.html index 0b30194..d9627dd 100644 --- a/Documentation.html +++ b/Documentation.html @@ -9,7 +9,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <link rel="icon" href="./favicon.ico" type="image/x-icon" /> <link rel="shortcut icon" href="./favicon.ico" type="image/x-icon" /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> - <title>phpMyAdmin 3.4.1-rc1 - Documentation</title> + <title>phpMyAdmin 3.4.1 - Documentation</title> <link rel="stylesheet" type="text/css" href="docs.css" /> </head> @@ -17,7 +17,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <div id="header"> <h1> <a href="http://www.phpmyadmin.net/">php<span class="myadmin">MyAdmin</span></a> - 3.4.1-rc1 + 3.4.1 Documentation </h1> </div> diff --git a/README b/README index d728493..2d0d4c1 100644 --- a/README +++ b/README @@ -1,7 +1,7 @@ phpMyAdmin - Readme =================== -Version 3.4.1-rc1 +Version 3.4.1 A set of PHP-scripts to manage MySQL over the web. diff --git a/libraries/Config.class.php b/libraries/Config.class.php index d0f4903..73a379b 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -96,7 +96,7 @@ class PMA_Config */ function checkSystem() { - $this->set('PMA_VERSION', '3.4.1-rc1'); + $this->set('PMA_VERSION', '3.4.1'); /** * @deprecated */ hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin annotated tag, RELEASE_3_3_10_1, created. RELEASE_3_3_10_1
by Marc Delisle 20 May '11

20 May '11

The annotated tag, RELEASE_3_3_10_1 has been created at ec197e66d4af7f1f323ec5af358cfac19c59f66b (tag) tagging 6eae88e65f39347e480cf67008f3d98f19f47248 (commit) replaces RELEASE_3_3_10 tagged by Marc Delisle on Fri May 20 13:06:59 2011 -0400 - Log ----------------------------------------------------------------- Released 3.3.10.1 Herman van Rink (2): XSS in Tracking page XSS in Tracking page, more Marc Delisle (2): XSS on Tracking page 3.3.10.1 ----------------------------------------------------------------------- hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, MAINT_3_3_10, updated. RELEASE_3_3_10-4-g6eae88e
by Marc Delisle 20 May '11

20 May '11

The branch, MAINT_3_3_10 has been updated via 6eae88e65f39347e480cf67008f3d98f19f47248 (commit) from 0c2a2a6220b8f1084c70f7dfdd14b4ab4fc4f4a4 (commit) - Log ----------------------------------------------------------------- commit 6eae88e65f39347e480cf67008f3d98f19f47248 Author: Marc Delisle <marc(a)infomarc.info> Date: Fri May 20 13:02:23 2011 -0400 3.3.10.1 ----------------------------------------------------------------------- Summary of changes: Documentation.html | 4 ++-- README | 4 ++-- libraries/Config.class.php | 2 +- translators.html | 4 ++-- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/Documentation.html b/Documentation.html index 5b596c1..7797037 100644 --- a/Documentation.html +++ b/Documentation.html @@ -10,7 +10,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <link rel="icon" href="./favicon.ico" type="image/x-icon" /> <link rel="shortcut icon" href="./favicon.ico" type="image/x-icon" /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> - <title>phpMyAdmin 3.3.10 - Documentation</title> + <title>phpMyAdmin 3.3.10.1 - Documentation</title> <link rel="stylesheet" type="text/css" href="docs.css" /> </head> @@ -18,7 +18,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <div id="header"> <h1> <a href="http://www.phpmyadmin.net/">php<span class="myadmin">MyAdmin</span></a> - 3.3.10 + 3.3.10.1 Documentation </h1> </div> diff --git a/README b/README index 00e24a8..3e821bf 100644 --- a/README +++ b/README @@ -5,8 +5,8 @@ phpMyAdmin - Readme A set of PHP-scripts to manage MySQL over the web. - Version 3.3.10 - -------------- + Version 3.3.10.1 + ---------------- http://www.phpmyadmin.net/ Copyright (C) 1998-2000 Tobias Ratschiller <tobias_at_ratschiller.com> diff --git a/libraries/Config.class.php b/libraries/Config.class.php index 1a5521d..614cc2e 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -92,7 +92,7 @@ class PMA_Config */ function checkSystem() { - $this->set('PMA_VERSION', '3.3.10'); + $this->set('PMA_VERSION', '3.3.10.1'); /** * @deprecated */ diff --git a/translators.html b/translators.html index 5882a08..3238f69 100644 --- a/translators.html +++ b/translators.html @@ -11,7 +11,7 @@ <link rel="icon" href="./favicon.ico" type="image/x-icon" /> <link rel="shortcut icon" href="./favicon.ico" type="image/x-icon" /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> - <title>phpMyAdmin 3.3.10 - Official translators</title> + <title>phpMyAdmin 3.3.10.1 - Official translators</title> <link rel="stylesheet" type="text/css" href="docs.css" /> </head> @@ -19,7 +19,7 @@ <div id="header"> <h1> <a href="http://www.phpmyadmin.net/">php<span class="myadmin">MyAdmin</span></a> - 3.3.10 + 3.3.10.1 official translators list </h1> </div> hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_1RC1-1800-g15e0b38
by Marc Delisle 20 May '11

20 May '11

The branch, master has been updated via 15e0b38073a02c38a67459ceb3bbab4f3b935b03 (commit) via 20cf17923e321718aa6d19fb9dc846625c1879fb (commit) via 89c8f3cbfe5356995ad71e5a41438e81fa994a55 (commit) via a4c168a3a35bbdbf058a2e6fd1d2673c52821279 (commit) via 8fd8e3efd86b119ca5be7aaa9e047c92bfd06c23 (commit) via 7e10c132a3887c8ebfd7a8eee356b28375f1e287 (commit) via d3ccf798fdbd4f8a89d4088130637d8dee918492 (commit) from fc59c64fbd94a408f0500576d97ba7d29a254d00 (commit) - Log ----------------------------------------------------------------- commit 15e0b38073a02c38a67459ceb3bbab4f3b935b03 Merge: a4c168a3a35bbdbf058a2e6fd1d2673c52821279 20cf17923e321718aa6d19fb9dc846625c1879fb Author: Marc Delisle <marc(a)infomarc.info> Date: Fri May 20 12:55:55 2011 -0400 Merge branch 'QA_3_4' commit a4c168a3a35bbdbf058a2e6fd1d2673c52821279 Merge: fc59c64fbd94a408f0500576d97ba7d29a254d00 8fd8e3efd86b119ca5be7aaa9e047c92bfd06c23 Author: Marc Delisle <marc(a)infomarc.info> Date: Fri May 20 12:51:47 2011 -0400 Merge branch 'QA_3_4' ----------------------------------------------------------------------- Summary of changes: ChangeLog | 4 ++++ libraries/tbl_links.inc.php | 2 +- tbl_tracking.php | 12 ++++++------ 3 files changed, 11 insertions(+), 7 deletions(-) diff --git a/ChangeLog b/ChangeLog index 7f90d9a..09d7c13 100644 --- a/ChangeLog +++ b/ChangeLog @@ -21,6 +21,7 @@ - bug #3285929 [privileges] Revert temporary fix - bug #3302872 [synchronize] Synchronize and user name - bug #3302733 [core] Some browsers report an insecure https connection +- [security] Make redirector require valid token 3.4.0.0 (2011-05-11) + rfe #2890226 [view] Enable VIEW rename @@ -179,6 +180,9 @@ 3.3.11.0 (not yet released) +3.3.10.1 (2011-05-20) +- [security] XSS on Tracking page + 3.3.10.0 (2011-03-19) - patch #3147400 [structure] Aria table size printed as unknown, thanks to erickoh75 - erickoh75 diff --git a/libraries/tbl_links.inc.php b/libraries/tbl_links.inc.php index bc72d21..e31dd53 100644 --- a/libraries/tbl_links.inc.php +++ b/libraries/tbl_links.inc.php @@ -112,7 +112,7 @@ unset($tabs); if(PMA_Tracker::isActive() and PMA_Tracker::isTracked($GLOBALS["db"], $GLOBALS["table"])) { - $msg = PMA_Message::notice('<a href="tbl_tracking.php?'.$url_query.'">'.sprintf(__('Tracking of %s.%s is activated.'), $GLOBALS["db"], $GLOBALS["table"]).'</a>'); + $msg = PMA_Message::notice('<a href="tbl_tracking.php?'.$url_query.'">'.sprintf(__('Tracking of %s.%s is activated.'), htmlspecialchars($GLOBALS["db"]), htmlspecialchars($GLOBALS["table"])).'</a>'); $msg->display(); } diff --git a/tbl_tracking.php b/tbl_tracking.php index 0534851..a708f0a 100644 --- a/tbl_tracking.php +++ b/tbl_tracking.php @@ -179,7 +179,7 @@ if (isset($_REQUEST['submit_create_version'])) { $tracking_set = rtrim($tracking_set, ','); if (PMA_Tracker::createVersion($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'], $tracking_set )) { - $msg = PMA_Message::success(sprintf(__('Version %s is created, tracking for %s.%s is activated.'), $_REQUEST['version'], $GLOBALS['db'], $GLOBALS['table'])); + $msg = PMA_Message::success(sprintf(__('Version %s is created, tracking for %s.%s is activated.'), $_REQUEST['version'], htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table']))); $msg->display(); } } @@ -187,7 +187,7 @@ if (isset($_REQUEST['submit_create_version'])) { // Deactivate tracking if (isset($_REQUEST['submit_deactivate_now'])) { if (PMA_Tracker::deactivateTracking($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])) { - $msg = PMA_Message::success(sprintf(__('Tracking for %s.%s , version %s is deactivated.'), $GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])); + $msg = PMA_Message::success(sprintf(__('Tracking for %s.%s , version %s is deactivated.'), htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table']), $_REQUEST['version'])); $msg->display(); } } @@ -195,7 +195,7 @@ if (isset($_REQUEST['submit_deactivate_now'])) { // Activate tracking if (isset($_REQUEST['submit_activate_now'])) { if (PMA_Tracker::activateTracking($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])) { - $msg = PMA_Message::success(sprintf(__('Tracking for %s.%s , version %s is activated.'), $GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])); + $msg = PMA_Message::success(sprintf(__('Tracking for %s.%s , version %s is activated.'), htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table']), $_REQUEST['version'])); $msg->display(); } } @@ -689,7 +689,7 @@ if ($last_version > 0) { <div id="div_deactivate_tracking"> <form method="post" action="tbl_tracking.php?<?php echo $url_query; ?>"> <fieldset> - <legend><?php printf(__('Deactivate tracking for %s.%s'), $GLOBALS['db'], $GLOBALS['table']); ?></legend> + <legend><?php printf(__('Deactivate tracking for %s.%s'), htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table'])); ?></legend> <input type="hidden" name="version" value="<?php echo $last_version; ?>" /> <input type="submit" name="submit_deactivate_now" value="<?php echo __('Deactivate now'); ?>" /> </fieldset> @@ -702,7 +702,7 @@ if ($last_version > 0) { <div id="div_activate_tracking"> <form method="post" action="tbl_tracking.php?<?php echo $url_query; ?>"> <fieldset> - <legend><?php printf(__('Activate tracking for %s.%s'), $GLOBALS['db'], $GLOBALS['table']); ?></legend> + <legend><?php printf(__('Activate tracking for %s.%s'), htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table'])); ?></legend> <input type="hidden" name="version" value="<?php echo $last_version; ?>" /> <input type="submit" name="submit_activate_now" value="<?php echo __('Activate now'); ?>" /> </fieldset> @@ -717,7 +717,7 @@ if ($last_version > 0) { <form method="post" action="tbl_tracking.php?<?php echo $url_query; ?>"> <?php echo PMA_generate_common_hidden_inputs($GLOBALS['db'], $GLOBALS['table']); ?> <fieldset> - <legend><?php printf(__('Create version %s of %s.%s'), ($last_version + 1), $GLOBALS['db'], $GLOBALS['table']); ?></legend> + <legend><?php printf(__('Create version %s of %s.%s'), ($last_version + 1), htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table'])); ?></legend> <input type="hidden" name="version" value="<?php echo ($last_version + 1); ?>" /> hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_4, updated. RELEASE_3_4_1RC1-29-g20cf179
by Marc Delisle 20 May '11

20 May '11

The branch, QA_3_4 has been updated via 20cf17923e321718aa6d19fb9dc846625c1879fb (commit) via 89c8f3cbfe5356995ad71e5a41438e81fa994a55 (commit) via 8fd8e3efd86b119ca5be7aaa9e047c92bfd06c23 (commit) via 7e10c132a3887c8ebfd7a8eee356b28375f1e287 (commit) via d3ccf798fdbd4f8a89d4088130637d8dee918492 (commit) from e22344168fa0c717538f78e4b4e5935dd78dc69d (commit) - Log ----------------------------------------------------------------- ----------------------------------------------------------------------- Summary of changes: ChangeLog | 4 ++++ libraries/tbl_links.inc.php | 2 +- tbl_tracking.php | 12 ++++++------ 3 files changed, 11 insertions(+), 7 deletions(-) diff --git a/ChangeLog b/ChangeLog index b766a76..a7c19b4 100644 --- a/ChangeLog +++ b/ChangeLog @@ -14,6 +14,7 @@ - bug #3285929 [privileges] Revert temporary fix - bug #3302872 [synchronize] Synchronize and user name - bug #3302733 [core] Some browsers report an insecure https connection +- [security] Make redirector require valid token 3.4.0.0 (2011-05-11) + rfe #2890226 [view] Enable VIEW rename @@ -172,6 +173,9 @@ 3.3.11.0 (not yet released) +3.3.10.1 (2011-05-20) +- [security] XSS on Tracking page + 3.3.10.0 (2011-03-19) - patch #3147400 [structure] Aria table size printed as unknown, thanks to erickoh75 - erickoh75 diff --git a/libraries/tbl_links.inc.php b/libraries/tbl_links.inc.php index bc72d21..e31dd53 100644 --- a/libraries/tbl_links.inc.php +++ b/libraries/tbl_links.inc.php @@ -112,7 +112,7 @@ unset($tabs); if(PMA_Tracker::isActive() and PMA_Tracker::isTracked($GLOBALS["db"], $GLOBALS["table"])) { - $msg = PMA_Message::notice('<a href="tbl_tracking.php?'.$url_query.'">'.sprintf(__('Tracking of %s.%s is activated.'), $GLOBALS["db"], $GLOBALS["table"]).'</a>'); + $msg = PMA_Message::notice('<a href="tbl_tracking.php?'.$url_query.'">'.sprintf(__('Tracking of %s.%s is activated.'), htmlspecialchars($GLOBALS["db"]), htmlspecialchars($GLOBALS["table"])).'</a>'); $msg->display(); } diff --git a/tbl_tracking.php b/tbl_tracking.php index 757456b..99a540e 100644 --- a/tbl_tracking.php +++ b/tbl_tracking.php @@ -179,7 +179,7 @@ if (isset($_REQUEST['submit_create_version'])) { $tracking_set = rtrim($tracking_set, ','); if (PMA_Tracker::createVersion($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'], $tracking_set )) { - $msg = PMA_Message::success(sprintf(__('Version %s is created, tracking for %s.%s is activated.'), $_REQUEST['version'], $GLOBALS['db'], $GLOBALS['table'])); + $msg = PMA_Message::success(sprintf(__('Version %s is created, tracking for %s.%s is activated.'), $_REQUEST['version'], htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table']))); $msg->display(); } } @@ -187,7 +187,7 @@ if (isset($_REQUEST['submit_create_version'])) { // Deactivate tracking if (isset($_REQUEST['submit_deactivate_now'])) { if (PMA_Tracker::deactivateTracking($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])) { - $msg = PMA_Message::success(sprintf(__('Tracking for %s.%s , version %s is deactivated.'), $GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])); + $msg = PMA_Message::success(sprintf(__('Tracking for %s.%s , version %s is deactivated.'), htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table']), $_REQUEST['version'])); $msg->display(); } } @@ -195,7 +195,7 @@ if (isset($_REQUEST['submit_deactivate_now'])) { // Activate tracking if (isset($_REQUEST['submit_activate_now'])) { if (PMA_Tracker::activateTracking($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])) { - $msg = PMA_Message::success(sprintf(__('Tracking for %s.%s , version %s is activated.'), $GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])); + $msg = PMA_Message::success(sprintf(__('Tracking for %s.%s , version %s is activated.'), htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table']), $_REQUEST['version'])); $msg->display(); } } @@ -632,7 +632,7 @@ if ($last_version > 0) { <div id="div_deactivate_tracking"> <form method="post" action="tbl_tracking.php?<?php echo $url_query; ?>"> <fieldset> - <legend><?php printf(__('Deactivate tracking for %s.%s'), $GLOBALS['db'], $GLOBALS['table']); ?></legend> + <legend><?php printf(__('Deactivate tracking for %s.%s'), htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table'])); ?></legend> <input type="hidden" name="version" value="<?php echo $last_version; ?>" /> <input type="submit" name="submit_deactivate_now" value="<?php echo __('Deactivate now'); ?>" /> </fieldset> @@ -645,7 +645,7 @@ if ($last_version > 0) { <div id="div_activate_tracking"> <form method="post" action="tbl_tracking.php?<?php echo $url_query; ?>"> <fieldset> - <legend><?php printf(__('Activate tracking for %s.%s'), $GLOBALS['db'], $GLOBALS['table']); ?></legend> + <legend><?php printf(__('Activate tracking for %s.%s'), htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table'])); ?></legend> <input type="hidden" name="version" value="<?php echo $last_version; ?>" /> <input type="submit" name="submit_activate_now" value="<?php echo __('Activate now'); ?>" /> </fieldset> @@ -660,7 +660,7 @@ if ($last_version > 0) { <form method="post" action="tbl_tracking.php?<?php echo $url_query; ?>"> <?php echo PMA_generate_common_hidden_inputs($GLOBALS['db'], $GLOBALS['table']); ?> <fieldset> - <legend><?php printf(__('Create version %s of %s.%s'), ($last_version + 1), $GLOBALS['db'], $GLOBALS['table']); ?></legend> + <legend><?php printf(__('Create version %s of %s.%s'), ($last_version + 1), htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table'])); ?></legend> <input type="hidden" name="version" value="<?php echo ($last_version + 1); ?>" /> hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, QA_3_3, updated. RELEASE_3_3_10-11-g1ec75fa
by Marc Delisle 20 May '11

20 May '11

The branch, QA_3_3 has been updated via 1ec75facafab7fc88e486a20222c07c88730a925 (commit) via 0c2a2a6220b8f1084c70f7dfdd14b4ab4fc4f4a4 (commit) via 1300510d3686b40adefafb7f1778a6f06d0a553a (commit) via 452669a1746898a08129d3a555ac4b1ec084b423 (commit) from 7ebe311433e7396e0623ac6f00fe48d095d2edb7 (commit) - Log ----------------------------------------------------------------- commit 1ec75facafab7fc88e486a20222c07c88730a925 Merge: 7ebe311433e7396e0623ac6f00fe48d095d2edb7 0c2a2a6220b8f1084c70f7dfdd14b4ab4fc4f4a4 Author: Marc Delisle <marc(a)infomarc.info> Date: Fri May 20 12:29:07 2011 -0400 Fix merge conflict ----------------------------------------------------------------------- Summary of changes: ChangeLog | 3 +++ libraries/tbl_links.inc.php | 2 +- tbl_tracking.php | 12 ++++++------ 3 files changed, 10 insertions(+), 7 deletions(-) diff --git a/ChangeLog b/ChangeLog index a3cd1f2..920123b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -7,6 +7,9 @@ $HeadURL: https://phpmyadmin.svn.sourceforge.net/svnroot/phpmyadmin/trunk/phpMyA 3.3.11.0 (not yet released) +3.3.10.1 (2011-05-20) +- [security] XSS on Tracking page + 3.3.10.0 (2011-03-19) - patch #3147400 [structure] Aria table size printed as unknown, thanks to erickoh75 - erickoh75 diff --git a/libraries/tbl_links.inc.php b/libraries/tbl_links.inc.php index b6c9121..22cdbc3 100644 --- a/libraries/tbl_links.inc.php +++ b/libraries/tbl_links.inc.php @@ -136,7 +136,7 @@ unset($tabs); if(PMA_Tracker::isActive() and PMA_Tracker::isTracked($GLOBALS["db"], $GLOBALS["table"])) { - $msg = PMA_Message::notice('<a href="tbl_tracking.php?'.$url_query.'">'.sprintf($strTrackingActivated, $GLOBALS["db"], $GLOBALS["table"]).'</a>'); + $msg = PMA_Message::notice('<a href="tbl_tracking.php?'.$url_query.'">'.sprintf($strTrackingActivated, htmlspecialchars($GLOBALS["db"]), htmlspecialchars($GLOBALS["table"])).'</a>'); $msg->display(); } diff --git a/tbl_tracking.php b/tbl_tracking.php index 224ed87..b3ac4f3 100644 --- a/tbl_tracking.php +++ b/tbl_tracking.php @@ -185,7 +185,7 @@ if (isset($_REQUEST['submit_create_version'])) { $tracking_set = rtrim($tracking_set, ','); if (PMA_Tracker::createVersion($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'], $tracking_set )) { - $msg = PMA_Message::success(sprintf($strTrackingVersionCreated, $_REQUEST['version'], $GLOBALS['db'], $GLOBALS['table'])); + $msg = PMA_Message::success(sprintf($strTrackingVersionCreated, $_REQUEST['version'], htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table']))); $msg->display(); } } @@ -193,7 +193,7 @@ if (isset($_REQUEST['submit_create_version'])) { // Deactivate tracking if (isset($_REQUEST['submit_deactivate_now'])) { if (PMA_Tracker::deactivateTracking($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])) { - $msg = PMA_Message::success(sprintf($strTrackingVersionDeactivated, $GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])); + $msg = PMA_Message::success(sprintf($strTrackingVersionDeactivated, htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table']), $_REQUEST['version'])); $msg->display(); } } @@ -201,7 +201,7 @@ if (isset($_REQUEST['submit_deactivate_now'])) { // Activate tracking if (isset($_REQUEST['submit_activate_now'])) { if (PMA_Tracker::activateTracking($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])) { - $msg = PMA_Message::success(sprintf($strTrackingVersionActivated, $GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])); + $msg = PMA_Message::success(sprintf($strTrackingVersionActivated, htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table']), $_REQUEST['version'])); $msg->display(); } } @@ -638,7 +638,7 @@ if ($last_version > 0) { <div id="div_deactivate_tracking"> <form method="post" action="tbl_tracking.php?<?php echo $url_query; ?>"> <fieldset> - <legend><?php printf($strTrackingDeactivateTrackingFor, $GLOBALS['db'], $GLOBALS['table']); ?></legend> + <legend><?php printf($strTrackingDeactivateTrackingFor, htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table'])); ?></legend> <input type="hidden" name="version" value="<?php echo $last_version; ?>" /> <input type="submit" name="submit_deactivate_now" value="<?php echo $strTrackingDeactivateNow; ?>" /> </fieldset> @@ -651,7 +651,7 @@ if ($last_version > 0) { <div id="div_activate_tracking"> <form method="post" action="tbl_tracking.php?<?php echo $url_query; ?>"> <fieldset> - <legend><?php printf($strTrackingActivateTrackingFor, $GLOBALS['db'], $GLOBALS['table']); ?></legend> + <legend><?php printf($strTrackingActivateTrackingFor, htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table'])); ?></legend> <input type="hidden" name="version" value="<?php echo $last_version; ?>" /> <input type="submit" name="submit_activate_now" value="<?php echo $strTrackingActivateNow; ?>" /> </fieldset> @@ -666,7 +666,7 @@ if ($last_version > 0) { <form method="post" action="tbl_tracking.php?<?php echo $url_query; ?>"> <?php echo PMA_generate_common_hidden_inputs($GLOBALS['db'], $GLOBALS['table']); ?> <fieldset> - <legend><?php printf($strTrackingCreateVersionOf, ($last_version + 1), $GLOBALS['db'], $GLOBALS['table']); ?></legend> + <legend><?php printf($strTrackingCreateVersionOf, ($last_version + 1), htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table'])); ?></legend> <input type="hidden" name="version" value="<?php echo ($last_version + 1); ?>" /> hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, MAINT_3_4_1, updated. RELEASE_3_4_1RC1-12-g89c8f3c
by Marc Delisle 20 May '11

20 May '11

The branch, MAINT_3_4_1 has been updated via 89c8f3cbfe5356995ad71e5a41438e81fa994a55 (commit) via 7e10c132a3887c8ebfd7a8eee356b28375f1e287 (commit) via d3ccf798fdbd4f8a89d4088130637d8dee918492 (commit) from b7a8179eb6bf0f1643970ac57a70b5b513a1cd4f (commit) - Log ----------------------------------------------------------------- ----------------------------------------------------------------------- Summary of changes: ChangeLog | 4 ++++ libraries/tbl_links.inc.php | 2 +- tbl_tracking.php | 12 ++++++------ 3 files changed, 11 insertions(+), 7 deletions(-) diff --git a/ChangeLog b/ChangeLog index 99d7444..f6b479f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -9,6 +9,7 @@ - bug #3285929 [privileges] Revert temporary fix - bug #3302872 [synchronize] Synchronize and user name - bug #3302733 [core] Some browsers report an insecure https connection +- [security] Make redirector require valid token 3.4.0.0 (2011-05-11) + rfe #2890226 [view] Enable VIEW rename @@ -167,6 +168,9 @@ 3.3.11.0 (not yet released) +3.3.10.1 (2011-05-20) +- [security] XSS on Tracking page + 3.3.10.0 (2011-03-19) - patch #3147400 [structure] Aria table size printed as unknown, thanks to erickoh75 - erickoh75 diff --git a/libraries/tbl_links.inc.php b/libraries/tbl_links.inc.php index bc72d21..e31dd53 100644 --- a/libraries/tbl_links.inc.php +++ b/libraries/tbl_links.inc.php @@ -112,7 +112,7 @@ unset($tabs); if(PMA_Tracker::isActive() and PMA_Tracker::isTracked($GLOBALS["db"], $GLOBALS["table"])) { - $msg = PMA_Message::notice('<a href="tbl_tracking.php?'.$url_query.'">'.sprintf(__('Tracking of %s.%s is activated.'), $GLOBALS["db"], $GLOBALS["table"]).'</a>'); + $msg = PMA_Message::notice('<a href="tbl_tracking.php?'.$url_query.'">'.sprintf(__('Tracking of %s.%s is activated.'), htmlspecialchars($GLOBALS["db"]), htmlspecialchars($GLOBALS["table"])).'</a>'); $msg->display(); } diff --git a/tbl_tracking.php b/tbl_tracking.php index 757456b..99a540e 100644 --- a/tbl_tracking.php +++ b/tbl_tracking.php @@ -179,7 +179,7 @@ if (isset($_REQUEST['submit_create_version'])) { $tracking_set = rtrim($tracking_set, ','); if (PMA_Tracker::createVersion($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'], $tracking_set )) { - $msg = PMA_Message::success(sprintf(__('Version %s is created, tracking for %s.%s is activated.'), $_REQUEST['version'], $GLOBALS['db'], $GLOBALS['table'])); + $msg = PMA_Message::success(sprintf(__('Version %s is created, tracking for %s.%s is activated.'), $_REQUEST['version'], htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table']))); $msg->display(); } } @@ -187,7 +187,7 @@ if (isset($_REQUEST['submit_create_version'])) { // Deactivate tracking if (isset($_REQUEST['submit_deactivate_now'])) { if (PMA_Tracker::deactivateTracking($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])) { - $msg = PMA_Message::success(sprintf(__('Tracking for %s.%s , version %s is deactivated.'), $GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])); + $msg = PMA_Message::success(sprintf(__('Tracking for %s.%s , version %s is deactivated.'), htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table']), $_REQUEST['version'])); $msg->display(); } } @@ -195,7 +195,7 @@ if (isset($_REQUEST['submit_deactivate_now'])) { // Activate tracking if (isset($_REQUEST['submit_activate_now'])) { if (PMA_Tracker::activateTracking($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])) { - $msg = PMA_Message::success(sprintf(__('Tracking for %s.%s , version %s is activated.'), $GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])); + $msg = PMA_Message::success(sprintf(__('Tracking for %s.%s , version %s is activated.'), htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table']), $_REQUEST['version'])); $msg->display(); } } @@ -632,7 +632,7 @@ if ($last_version > 0) { <div id="div_deactivate_tracking"> <form method="post" action="tbl_tracking.php?<?php echo $url_query; ?>"> <fieldset> - <legend><?php printf(__('Deactivate tracking for %s.%s'), $GLOBALS['db'], $GLOBALS['table']); ?></legend> + <legend><?php printf(__('Deactivate tracking for %s.%s'), htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table'])); ?></legend> <input type="hidden" name="version" value="<?php echo $last_version; ?>" /> <input type="submit" name="submit_deactivate_now" value="<?php echo __('Deactivate now'); ?>" /> </fieldset> @@ -645,7 +645,7 @@ if ($last_version > 0) { <div id="div_activate_tracking"> <form method="post" action="tbl_tracking.php?<?php echo $url_query; ?>"> <fieldset> - <legend><?php printf(__('Activate tracking for %s.%s'), $GLOBALS['db'], $GLOBALS['table']); ?></legend> + <legend><?php printf(__('Activate tracking for %s.%s'), htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table'])); ?></legend> <input type="hidden" name="version" value="<?php echo $last_version; ?>" /> <input type="submit" name="submit_activate_now" value="<?php echo __('Activate now'); ?>" /> </fieldset> @@ -660,7 +660,7 @@ if ($last_version > 0) { <form method="post" action="tbl_tracking.php?<?php echo $url_query; ?>"> <?php echo PMA_generate_common_hidden_inputs($GLOBALS['db'], $GLOBALS['table']); ?> <fieldset> - <legend><?php printf(__('Create version %s of %s.%s'), ($last_version + 1), $GLOBALS['db'], $GLOBALS['table']); ?></legend> + <legend><?php printf(__('Create version %s of %s.%s'), ($last_version + 1), htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table'])); ?></legend> <input type="hidden" name="version" value="<?php echo ($last_version + 1); ?>" /> hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, MAINT_3_3_10, updated. RELEASE_3_3_10-3-g0c2a2a6
by Marc Delisle 20 May '11

20 May '11

The branch, MAINT_3_3_10 has been updated via 0c2a2a6220b8f1084c70f7dfdd14b4ab4fc4f4a4 (commit) via 1300510d3686b40adefafb7f1778a6f06d0a553a (commit) via 452669a1746898a08129d3a555ac4b1ec084b423 (commit) from 3e31ab117262a1d36c5dd0d57d9ec823289d20f9 (commit) - Log ----------------------------------------------------------------- ----------------------------------------------------------------------- Summary of changes: ChangeLog | 3 +++ libraries/tbl_links.inc.php | 2 +- tbl_tracking.php | 12 ++++++------ 3 files changed, 10 insertions(+), 7 deletions(-) diff --git a/ChangeLog b/ChangeLog index e42d62d..f207579 100644 --- a/ChangeLog +++ b/ChangeLog @@ -5,6 +5,9 @@ phpMyAdmin - ChangeLog $Id$ $HeadURL: https://phpmyadmin.svn.sourceforge.net/svnroot/phpmyadmin/trunk/phpMyAdmin/… $ +3.3.10.1 (2011-05-20) +- [security] XSS on Tracking page + 3.3.10.0 (2011-03-19) - patch #3147400 [structure] Aria table size printed as unknown, thanks to erickoh75 - erickoh75 diff --git a/libraries/tbl_links.inc.php b/libraries/tbl_links.inc.php index b6c9121..22cdbc3 100644 --- a/libraries/tbl_links.inc.php +++ b/libraries/tbl_links.inc.php @@ -136,7 +136,7 @@ unset($tabs); if(PMA_Tracker::isActive() and PMA_Tracker::isTracked($GLOBALS["db"], $GLOBALS["table"])) { - $msg = PMA_Message::notice('<a href="tbl_tracking.php?'.$url_query.'">'.sprintf($strTrackingActivated, $GLOBALS["db"], $GLOBALS["table"]).'</a>'); + $msg = PMA_Message::notice('<a href="tbl_tracking.php?'.$url_query.'">'.sprintf($strTrackingActivated, htmlspecialchars($GLOBALS["db"]), htmlspecialchars($GLOBALS["table"])).'</a>'); $msg->display(); } diff --git a/tbl_tracking.php b/tbl_tracking.php index 224ed87..b3ac4f3 100644 --- a/tbl_tracking.php +++ b/tbl_tracking.php @@ -185,7 +185,7 @@ if (isset($_REQUEST['submit_create_version'])) { $tracking_set = rtrim($tracking_set, ','); if (PMA_Tracker::createVersion($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'], $tracking_set )) { - $msg = PMA_Message::success(sprintf($strTrackingVersionCreated, $_REQUEST['version'], $GLOBALS['db'], $GLOBALS['table'])); + $msg = PMA_Message::success(sprintf($strTrackingVersionCreated, $_REQUEST['version'], htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table']))); $msg->display(); } } @@ -193,7 +193,7 @@ if (isset($_REQUEST['submit_create_version'])) { // Deactivate tracking if (isset($_REQUEST['submit_deactivate_now'])) { if (PMA_Tracker::deactivateTracking($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])) { - $msg = PMA_Message::success(sprintf($strTrackingVersionDeactivated, $GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])); + $msg = PMA_Message::success(sprintf($strTrackingVersionDeactivated, htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table']), $_REQUEST['version'])); $msg->display(); } } @@ -201,7 +201,7 @@ if (isset($_REQUEST['submit_deactivate_now'])) { // Activate tracking if (isset($_REQUEST['submit_activate_now'])) { if (PMA_Tracker::activateTracking($GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])) { - $msg = PMA_Message::success(sprintf($strTrackingVersionActivated, $GLOBALS['db'], $GLOBALS['table'], $_REQUEST['version'])); + $msg = PMA_Message::success(sprintf($strTrackingVersionActivated, htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table']), $_REQUEST['version'])); $msg->display(); } } @@ -638,7 +638,7 @@ if ($last_version > 0) { <div id="div_deactivate_tracking"> <form method="post" action="tbl_tracking.php?<?php echo $url_query; ?>"> <fieldset> - <legend><?php printf($strTrackingDeactivateTrackingFor, $GLOBALS['db'], $GLOBALS['table']); ?></legend> + <legend><?php printf($strTrackingDeactivateTrackingFor, htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table'])); ?></legend> <input type="hidden" name="version" value="<?php echo $last_version; ?>" /> <input type="submit" name="submit_deactivate_now" value="<?php echo $strTrackingDeactivateNow; ?>" /> </fieldset> @@ -651,7 +651,7 @@ if ($last_version > 0) { <div id="div_activate_tracking"> <form method="post" action="tbl_tracking.php?<?php echo $url_query; ?>"> <fieldset> - <legend><?php printf($strTrackingActivateTrackingFor, $GLOBALS['db'], $GLOBALS['table']); ?></legend> + <legend><?php printf($strTrackingActivateTrackingFor, htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table'])); ?></legend> <input type="hidden" name="version" value="<?php echo $last_version; ?>" /> <input type="submit" name="submit_activate_now" value="<?php echo $strTrackingActivateNow; ?>" /> </fieldset> @@ -666,7 +666,7 @@ if ($last_version > 0) { <form method="post" action="tbl_tracking.php?<?php echo $url_query; ?>"> <?php echo PMA_generate_common_hidden_inputs($GLOBALS['db'], $GLOBALS['table']); ?> <fieldset> - <legend><?php printf($strTrackingCreateVersionOf, ($last_version + 1), $GLOBALS['db'], $GLOBALS['table']); ?></legend> + <legend><?php printf($strTrackingCreateVersionOf, ($last_version + 1), htmlspecialchars($GLOBALS['db']), htmlspecialchars($GLOBALS['table'])); ?></legend> <input type="hidden" name="version" value="<?php echo ($last_version + 1); ?>" /> hooks/post-receive -- phpMyAdmin

1 0

[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_1RC1-1793-gfc59c64
by Michal Čihař 20 May '11

20 May '11

The branch, master has been updated via fc59c64fbd94a408f0500576d97ba7d29a254d00 (commit) via e22344168fa0c717538f78e4b4e5935dd78dc69d (commit) via b7a8179eb6bf0f1643970ac57a70b5b513a1cd4f (commit) from b3a79a9344297ec9d391e32e8c9ec247cd9a98c0 (commit) - Log ----------------------------------------------------------------- commit fc59c64fbd94a408f0500576d97ba7d29a254d00 Merge: b3a79a9344297ec9d391e32e8c9ec247cd9a98c0 e22344168fa0c717538f78e4b4e5935dd78dc69d Author: Michal Čihař <mcihar(a)novell.com> Date: Fri May 20 10:03:19 2011 +0200 Merge remote-tracking branch 'origin/QA_3_4' ----------------------------------------------------------------------- Summary of changes: libraries/core.lib.php | 11 ++++------- 1 files changed, 4 insertions(+), 7 deletions(-) diff --git a/libraries/core.lib.php b/libraries/core.lib.php index 63f1a25..51315d7 100644 --- a/libraries/core.lib.php +++ b/libraries/core.lib.php @@ -681,15 +681,12 @@ function PMA_array_remove($path, &$array) * @return string URL for a link. */ function PMA_linkURL($url) { - $params = array(); - $params['url'] = $url; - $goto = 'url.php' . PMA_generate_common_url($params); - if (!preg_match('#^https?://#', $url)) { + if (!preg_match('#^https?://#', $url) || defined('PMA_SETUP')) { return $url; - } elseif (defined('PMA_SETUP')) { - return '../' . $goto; } else { - return './' . $goto; + $params = array(); + $params['url'] = $url; + return './url.php' . PMA_generate_common_url($params); } } hooks/post-receive -- phpMyAdmin

1 0