[Phpmyadmin-git] [SCM] phpMyAdmin branch, master, updated. RELEASE_3_4_7-22595-g839c0d4

[Marc Delisle]

The branch, master has been updated
       via  839c0d493aedbfb031752b706acd550790f72019 (commit)
       via  e51a1cb73df8f3706fe0bb50ccdcae7fa2f893eb (commit)
       via  f674e3dbe952d9c4a7864067d7c286e9b01f527a (commit)
       via  1b8f5a5c098905997a3072170d773a073331f7f6 (commit)
       via  edea25b07b51c2c5e277323f8047fcd82e695f7e (commit)
       via  05f96b921a7e7dacd02be5ca61b2e7bdd014ee55 (commit)
       via  4dd5c0d0dc413d2cb2cfcb31f8d4aec0c753033c (commit)
       via  063e6f92929c3aed3641cf79add4128c7e972d2f (commit)
       via  34d99de000de9d15cfdf5e9cc8b7682d51110bbd (commit)
       via  a5e206fbd2ca814042cfc1bb7dd3b40c28ce3fb5 (commit)
      from  f49fe427f534350e029f0b08627e6ce565368de8 (commit)


- Log -----------------------------------------------------------------
commit 839c0d493aedbfb031752b706acd550790f72019
Merge: f49fe42 e51a1cb
Author: Marc Delisle <marc at infomarc.info>
Date:   Thu Nov 10 09:00:13 2011 -0500

    Merge branch 'QA_3_4'

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog                |    4 ++++
 Documentation.html       |    3 +++
 libraries/import/ods.php |   12 ++++++++++++
 libraries/import/xml.php |   12 ++++++++++++
 4 files changed, 31 insertions(+), 0 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index d8b0494..6e2fd10 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -70,6 +70,10 @@ phpMyAdmin - ChangeLog
 - patch #3430291 [import] Handle conflicts in some open_basedir situations
 - bug #3431427 [display] Dropdown results - setting NULL does not work
 
+3.4.7.1 (not yet released)
+- [security] Fixed possible local file inclusion in XML import
+(CVE-2011-4107).
+
 3.4.7.0 (2011-10-23)
 - bug #3418610 [interface] Links in navigation when $cfg['MainPageIconic'] = false
 - bug #3418849 [interface] Inline edit shows dropdowns even after closing
diff --git a/Documentation.html b/Documentation.html
index c31706a..458108c 100644
--- a/Documentation.html
+++ b/Documentation.html
@@ -82,6 +82,9 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78
                 <li>To support BLOB streaming, see PHP and MySQL requirements
                 in <a href="#faq6_25">
                     <abbr title="Frequently Asked Questions">FAQ</abbr> 6.25</a>.</li>
+                <li>To support XML and Open Document Spreadsheet importing,
+                you need PHP 5.2.17 or newer and the 
+                <a href="http://www.php.net/libxml"><tt>libxml</tt></a> extension.</li>
         </ul>
     </li>
     <li><b>MySQL</b> 5.0 or newer (<a href="#faq1_17">details</a>);</li>
diff --git a/libraries/import/ods.php b/libraries/import/ods.php
index fc1c177..8af40f4 100644
--- a/libraries/import/ods.php
+++ b/libraries/import/ods.php
@@ -14,6 +14,13 @@ if (! defined('PHPMYADMIN')) {
 }
 
 /**
+ * We need way to disable external XML entities processing.
+ */
+if (!function_exists('libxml_disable_entity_loader')) {
+    return;
+}
+
+/**
  * The possible scopes for $plugin_param are: 'table', 'database', and 'server'
  */
 
@@ -61,6 +68,11 @@ while (! ($finished && $i >= $len) && ! $error && ! $timeout_passed) {
 unset($data);
 
 /**
+ * Disable loading of external XML entities.
+ */
+libxml_disable_entity_loader();
+
+/**
  * Load the XML string
  *
  * The option LIBXML_COMPACT is specified because it can
diff --git a/libraries/import/xml.php b/libraries/import/xml.php
index a3768cd..727c63b 100644
--- a/libraries/import/xml.php
+++ b/libraries/import/xml.php
@@ -13,6 +13,13 @@ if (! defined('PHPMYADMIN')) {
 }
 
 /**
+ * We need way to disable external XML entities processing.
+ */
+if (!function_exists('libxml_disable_entity_loader')) {
+    return;
+}
+
+/**
  * The possible scopes for $plugin_param are: 'table', 'database', and 'server'
  */
 
@@ -54,6 +61,11 @@ while (! ($finished && $i >= $len) && ! $error && ! $timeout_passed) {
 unset($data);
 
 /**
+ * Disable loading of external XML entities.
+ */
+libxml_disable_entity_loader();
+
+/**
  * Load the XML string
  *
  * The option LIBXML_COMPACT is specified because it can


hooks/post-receive
-- 
phpMyAdmin