The branch, master has been updated via 839c0d493aedbfb031752b706acd550790f72019 (commit) via e51a1cb73df8f3706fe0bb50ccdcae7fa2f893eb (commit) via f674e3dbe952d9c4a7864067d7c286e9b01f527a (commit) via 1b8f5a5c098905997a3072170d773a073331f7f6 (commit) via edea25b07b51c2c5e277323f8047fcd82e695f7e (commit) via 05f96b921a7e7dacd02be5ca61b2e7bdd014ee55 (commit) via 4dd5c0d0dc413d2cb2cfcb31f8d4aec0c753033c (commit) via 063e6f92929c3aed3641cf79add4128c7e972d2f (commit) via 34d99de000de9d15cfdf5e9cc8b7682d51110bbd (commit) via a5e206fbd2ca814042cfc1bb7dd3b40c28ce3fb5 (commit) from f49fe427f534350e029f0b08627e6ce565368de8 (commit)
- Log ----------------------------------------------------------------- commit 839c0d493aedbfb031752b706acd550790f72019 Merge: f49fe42 e51a1cb Author: Marc Delisle marc@infomarc.info Date: Thu Nov 10 09:00:13 2011 -0500
Merge branch 'QA_3_4'
-----------------------------------------------------------------------
Summary of changes: ChangeLog | 4 ++++ Documentation.html | 3 +++ libraries/import/ods.php | 12 ++++++++++++ libraries/import/xml.php | 12 ++++++++++++ 4 files changed, 31 insertions(+), 0 deletions(-)
diff --git a/ChangeLog b/ChangeLog index d8b0494..6e2fd10 100644 --- a/ChangeLog +++ b/ChangeLog @@ -70,6 +70,10 @@ phpMyAdmin - ChangeLog - patch #3430291 [import] Handle conflicts in some open_basedir situations - bug #3431427 [display] Dropdown results - setting NULL does not work
+3.4.7.1 (not yet released) +- [security] Fixed possible local file inclusion in XML import +(CVE-2011-4107). + 3.4.7.0 (2011-10-23) - bug #3418610 [interface] Links in navigation when $cfg['MainPageIconic'] = false - bug #3418849 [interface] Inline edit shows dropdowns even after closing diff --git a/Documentation.html b/Documentation.html index c31706a..458108c 100644 --- a/Documentation.html +++ b/Documentation.html @@ -82,6 +82,9 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 <li>To support BLOB streaming, see PHP and MySQL requirements in <a href="#faq6_25"> <abbr title="Frequently Asked Questions">FAQ</abbr> 6.25</a>.</li> + <li>To support XML and Open Document Spreadsheet importing, + you need PHP 5.2.17 or newer and the + <a href="http://www.php.net/libxml"><tt>libxml</tt></a> extension.</li> </ul> </li> <li><b>MySQL</b> 5.0 or newer (<a href="#faq1_17">details</a>);</li> diff --git a/libraries/import/ods.php b/libraries/import/ods.php index fc1c177..8af40f4 100644 --- a/libraries/import/ods.php +++ b/libraries/import/ods.php @@ -14,6 +14,13 @@ if (! defined('PHPMYADMIN')) { }
/** + * We need way to disable external XML entities processing. + */ +if (!function_exists('libxml_disable_entity_loader')) { + return; +} + +/** * The possible scopes for $plugin_param are: 'table', 'database', and 'server' */
@@ -61,6 +68,11 @@ while (! ($finished && $i >= $len) && ! $error && ! $timeout_passed) { unset($data);
/** + * Disable loading of external XML entities. + */ +libxml_disable_entity_loader(); + +/** * Load the XML string * * The option LIBXML_COMPACT is specified because it can diff --git a/libraries/import/xml.php b/libraries/import/xml.php index a3768cd..727c63b 100644 --- a/libraries/import/xml.php +++ b/libraries/import/xml.php @@ -13,6 +13,13 @@ if (! defined('PHPMYADMIN')) { }
/** + * We need way to disable external XML entities processing. + */ +if (!function_exists('libxml_disable_entity_loader')) { + return; +} + +/** * The possible scopes for $plugin_param are: 'table', 'database', and 'server' */
@@ -54,6 +61,11 @@ while (! ($finished && $i >= $len) && ! $error && ! $timeout_passed) { unset($data);
/** + * Disable loading of external XML entities. + */ +libxml_disable_entity_loader(); + +/** * Load the XML string * * The option LIBXML_COMPACT is specified because it can
hooks/post-receive
-
Marc Delisle