Merge branch 'master' of github.com:phpmyadmin/phpmyadmin

phpmyadmin · Jun 4, 2013 · 4538ab5 · 4538ab5
2 parents 0456658 + 91a9656
commit 4538ab5
Show file tree

Hide file tree

Showing 89 changed files with 28,929 additions and 29,461 deletions.
diff --git a/ChangeLog b/ChangeLog
@@ -16,12 +16,22 @@ phpMyAdmin - ChangeLog
 + [interface] Upgraded CodeMirror to 3.x series
 + rfe #1363 Improved query profiler
 
+4.0.4.0 (not yet released)
+- bug #3959 Using DefaultTabDatabase in NavigationTree for Database Click
+- bug #3961 Avoid Suhosin warning when in simulation mode
+- bug #3897 Row Statistics and Space usage bugs
+
 4.0.3.0 (not yet released)
 - bug #3941 Recent tables list always empty
 - bug #3933 Do not translate "Open Document" in export settings
 - bug #3927 List of tables is missing after expanding in the navigation frame
 - bug #3942 Warnings about reserved word for many non reserved words
 - bug #3912 Exporting row selection, resulted by ORDER BY query
+- bug #3957 Cookies must be enabled past this point
+- bug #3956 "Browse foreign values" search filter / page selector not working
+- bug #3579 NOW() function incorrectly selected (partial regression)
+- [security] Javascript execution vulnerability in Create view,
+  reported by Maxim Rupp (see PMASA-2013-6)
 
 4.0.2.0 (2013-05-24)
 - bug #3902 Cannot browse when table name contains keyword "call"

diff --git a/browse_foreigners.php b/browse_foreigners.php
@@ -9,7 +9,22 @@
 require_once 'libraries/common.inc.php';
 require_once 'libraries/transformations.lib.php';
 
-$field = $_REQUEST['field'];
+/**
+ * Sets globals from $_REQUEST
+ */
+$request_params = array(
+    'field',
+    'fieldkey',
+    'foreign_filter',
+    'pos',
+    'rownumber'
+);
+
+foreach ($request_params as $one_request_param) {
+    if (isset($_REQUEST[$one_request_param])) {
+        $GLOBALS[$one_request_param] = $_REQUEST[$one_request_param];
+    }
+}
 
 PMA_Util::checkParameters(array('db', 'table', 'field'));
 
@@ -66,6 +81,7 @@
 
     if ($foreignData['the_total'] > $GLOBALS['cfg']['MaxRows']) {
         $gotopage = PMA_Util::pageselector(
+            'pos',
             $session_max_rows,
             $pageNow,
             $nbTotalPage,

diff --git a/doc/config.rst b/doc/config.rst
@@ -2609,14 +2609,14 @@ SQL parser settings
     :type: string
     :default: ``'html'``
 
-    The main use of the new :term:`SQL` Parser
-    is to pretty-print :term:`SQL` queries. By
-    default we use HTML to format the query, but you can disable this by
+    The main use of the :term:`SQL` Parser
+    is to format and analyze :term:`SQL` queries. By
+    default we use text to format the query, but you can disable this by
     setting this variable to ``'none'``.
 
     Available options:
 
-    * ``'html'``
+    * ``'text'``
     * ``'none'``
 
 .. _cfg_SQP:

diff --git a/index.php b/index.php
@@ -535,6 +535,8 @@
  */
 if ($cfg['SuhosinDisableWarning'] == false
     && @ini_get('suhosin.request.max_value_length')
+    // warn about Suhosin only if its simulation mode is not enabled
+    && @ini_get('suhosin.simulation') == '0'
 ) {
     trigger_error(
         sprintf(

diff --git a/js/tbl_select.js b/js/tbl_select.js
@@ -175,7 +175,7 @@ AJAX.registerOnload('tbl_select.js', function () {
         ];
         var outputGeomFunctions = binaryFunctions.concat(tempArray);
 
-        // If the chosen function takes two geomerty objects as parameters
+        // If the chosen function takes two geometry objects as parameters
         var $operator = $geomFuncSelector.parents('tr').find('td:nth-child(5)').find('select');
         if ($.inArray($geomFuncSelector.val(), binaryFunctions) >= 0) {
             $operator.prop('readonly', true);

diff --git a/libraries/Header.class.php b/libraries/Header.class.php
@@ -616,14 +616,6 @@ private function _getWarnings()
     {
         $retval = '';
         if ($this->_warningsEnabled) {
-            // message of "Cookies required" displayed for auth_type http or config
-            // note: here, the decoration won't work because without cookies,
-            // our standard CSS is not operational
-            if (empty($_COOKIE)) {
-                $retval .= PMA_Message::notice(
-                    __('Cookies must be enabled past this point.')
-                )->getDisplay();
-            }
             $retval .= "<noscript>";
             $retval .= PMA_message::error(
                 __("Javascript must be enabled past this point")

diff --git a/libraries/Table.class.php b/libraries/Table.class.php
@@ -273,6 +273,7 @@ static public function analyzeStructure($db = null, $table = null)
             );
             $analyzed_sql = PMA_SQP_analyze(PMA_SQP_parse($show_create_table));
         }
+        return $analyzed_sql;
     }
 
     /**

diff --git a/libraries/Util.class.php b/libraries/Util.class.php
@@ -404,9 +404,6 @@ public static function formatSql($parsed_sql, $unparsed_sql = '')
                 $formatted_sql = PMA_SQP_formatNone($parsed_sql);
             }
             break;
-        case 'html':
-            $formatted_sql = PMA_SQP_format($parsed_sql, 'color');
-            break;
         case 'text':
             $formatted_sql = PMA_SQP_format($parsed_sql, 'text');
             break;
@@ -3745,6 +3742,7 @@ public static function getDefaultFunctionForField($field, $insert_mode)
         // and the column does not have the
         // ON UPDATE DEFAULT TIMESTAMP attribute.
         if (($field['True_Type'] == 'timestamp')
+            && $field['first_timestamp']
             && empty($field['Default'])
             && empty($data)
             && ! isset($analyzed_sql_field_array['on_update_current_timestamp'])
@@ -3753,11 +3751,6 @@ public static function getDefaultFunctionForField($field, $insert_mode)
             $default_function = $cfg['DefaultFunctions']['first_timestamp'];
         }
 
-        // Default for first timestamp field
-        if ($field['first_timestamp']) {
-            $default_function = $cfg['DefaultFunctions']['first_timestamp'];
-        }
-
         // For primary keys of type char(36) or varchar(36) UUID if the default
         // function
         // Only applies to insert mode, as it would silently trash data on updates.
@@ -4109,18 +4102,18 @@ public static function fillTooltip(
      *
      * @return String Matching regular expression.
      */
-    public static function getFirstOccuringRegularExpression($regex_array, $query)
+    public static function getFirstOccurringRegularExpression($regex_array, $query)
     {
-        $minimum_first_occurance_index = null;
+        $minimum_first_occurence_index = null;
         $regex = null;
 
         for ($i = 0; $i < count($regex_array); $i++) {
             if (preg_match($regex_array[$i], $query, $matches, PREG_OFFSET_CAPTURE)) {
-                if (is_null($minimum_first_occurance_index)
-                    || ($matches[0][1] < $minimum_first_occurance_index)
+                if (is_null($minimum_first_occurence_index)
+                    || ($matches[0][1] < $minimum_first_occurence_index)
                 ) {
                     $regex = $regex_array[$i];
-                    $minimum_first_occurance_index = $matches[0][1];
+                    $minimum_first_occurence_index = $matches[0][1];
                 }
             }
         }

diff --git a/libraries/insert_edit.lib.php b/libraries/insert_edit.lib.php
@@ -511,7 +511,7 @@ function PMA_getNullColumn($column, $column_name_appendix, $real_null_value,
     $html_output .= '<input type="checkbox" class="checkbox_null" tabindex="'
         . ($tabindex + $tabindex_for_null) . '"'
         . ' name="fields_null' . $column_name_appendix . '"';
-    if ($real_null_value && !$column['first_timestamp']) {
+    if ($real_null_value) {
         $html_output .= ' checked="checked"';
     }
     $html_output .= ' id="field_' . ($idindex) . '_2" />';

diff --git a/libraries/navigation/Nodes/Node_Database.class.php b/libraries/navigation/Nodes/Node_Database.class.php
@@ -31,7 +31,8 @@ public function __construct($name, $type = Node::OBJECT, $is_group = false)
         parent::__construct($name, $type, $is_group);
         $this->icon  = PMA_Util::getImage('s_db.png');
         $this->links = array(
-            'text' => 'db_structure.php?server=' . $GLOBALS['server']
+            'text' => $GLOBALS['cfg']['DefaultTabDatabase']
+                    . '?server=' . $GLOBALS['server']
                     . '&amp;db=%1$s&amp;token=' . $GLOBALS['token'],
             'icon' => 'db_operations.php?server=' . $GLOBALS['server']
                     . '&amp;db=%1$s&amp;token=' . $GLOBALS['token']

diff --git a/libraries/plugins/auth/AuthenticationCookie.class.php b/libraries/plugins/auth/AuthenticationCookie.class.php
@@ -262,14 +262,6 @@ public function auth()
         Swekey_login('input_username', 'input_go');
         // END Swekey Integration
 
-        // show the "Cookies required" message only if cookies are disabled
-        // (we previously tried to set some cookies)
-        if (empty($_COOKIE)) {
-            trigger_error(
-                __('Cookies must be enabled past this point.'),
-                E_USER_NOTICE
-            );
-        }
         if ($GLOBALS['error_handler']->hasDisplayErrors()) {
             echo '<div>';
             $GLOBALS['error_handler']->dispErrors();

diff --git a/libraries/session.inc.php b/libraries/session.inc.php
@@ -92,7 +92,8 @@
         PMA_fatalError(
             'Cannot start session without errors, please check errors given '
             . 'in your PHP and/or webserver log file and configure your PHP '
-            . 'installation properly.'
+            . 'installation properly. Also ensure that cookies are enabled '
+            . 'in your browser.'
         );
     }
     unset($orig_error_count);

diff --git a/libraries/sqlparser.lib.php b/libraries/sqlparser.lib.php
@@ -1233,7 +1233,6 @@ function PMA_SQP_analyze($arr)
                  * present in the list of forbidden words, for example
                  * "storage" which can be used as an identifier
                  *
-                 * @todo avoid the pretty printing in color in this case
                  */
                 $identifier = $arr[$i]['data'];
                 break;
@@ -2146,33 +2145,6 @@ function PMA_SQP_analyze($arr)
 } // end of the "PMA_SQP_analyze()" function
 
 
-/**
- * Colorizes SQL queries html formatted
- *
- * @param array $arr The SQL queries html formatted
- *
- * @return array   The colorized SQL queries
- *
- * @todo check why adding a "\n" after the </span> would cause extra blanks
- * to be displayed: SELECT p . person_name
- *
- * @access public
- */
-function PMA_SQP_formatHtml_colorize($arr)
-{
-    $i         = PMA_strpos($arr['type'], '_');
-    $class     = '';
-    if ($i > 0) {
-        $class = 'syntax_' . PMA_substr($arr['type'], 0, $i) . ' ';
-    }
-
-    $class     .= 'syntax_' . $arr['type'];
-
-    return '<span class="' . $class . '">'
-        . htmlspecialchars($arr['data']) . '</span>';
-} // end of the "PMA_SQP_formatHtml_colorize()" function
-
-
 /**
  * Formats SQL queries
  *
@@ -2186,7 +2158,7 @@ function PMA_SQP_formatHtml_colorize($arr)
  * @access public
  */
 function PMA_SQP_format(
-    $arr, $mode='color', $start_token=0,
+    $arr, $mode='text', $start_token=0,
     $number_of_tokens=-1
 ) {
     global $PMA_SQPdata_operators_docs, $PMA_SQPdata_functions_docs;
@@ -2202,11 +2174,6 @@ function PMA_SQP_format(
     }
     // else do it properly
     switch ($mode) {
-    case 'color':
-        $str                                = '<span class="syntax">';
-        $html_line_break                    = '<br />';
-        $docu                               = true;
-        break;
     case 'query_only':
         $str                                = '';
         $html_line_break                    = "\n";
@@ -2887,9 +2854,7 @@ function PMA_SQP_format(
         $after                 .= "\n";
         */
         $str .= $before;
-        if ($mode=='color') {
-            $str .= PMA_SQP_formatHtml_colorize($arr[$i]);
-        } elseif ($mode == 'text') {
+        if ($mode == 'text') {
             $str .= htmlspecialchars($arr[$i]['data']);
         } else {
             $str .= $arr[$i]['data'];
@@ -2910,10 +2875,6 @@ function PMA_SQP_format(
         // close inner_sql span
             $str .= '</span>';
     }
-    if ($mode=='color') {
-        // close syntax span
-        $str .= '</span>';
-    }
 
     return $str;
 } // end of the "PMA_SQP_format()" function

diff --git a/libraries/structure.lib.php b/libraries/structure.lib.php
@@ -1667,7 +1667,7 @@ function getHtmlForRowStatsTable($showtable, $tbl_collation,
     $odd_row = false;
     $html_output = '<table id="tablerowstats" class="data">';
     $html_output .= '<caption class="tblHeaders">'
-        . __('Row Statistics') . '</caption>';
+        . __('Row statistics') . '</caption>';
     $html_output .= '<tbody>';
 
     if (isset($showtable['Row_format'])) {
@@ -1714,11 +1714,18 @@ function getHtmlForRowStatsTable($showtable, $tbl_collation,
         && isset($showtable['Avg_row_length'])
         && $showtable['Avg_row_length'] > 0
     ) {
+        list($avg_row_length_value, $avg_row_length_unit) 
+            = PMA_Util::formatByteDown(
+                $showtable['Avg_row_length'],
+                6, 
+                1
+            );
         $html_output .= PMA_getHtmlForRowStatsTableRow(
             $odd_row,
             __('Row length'),
-            PMA_Util::formatNumber($showtable['Avg_row_length'], 0)
+            ($avg_row_length_value . ' ' . $avg_row_length_unit)
         );
+        unset($avg_row_length_value, $avg_row_length_unit);
         $odd_row = !$odd_row;
     }
     if (!$is_innodb
@@ -1747,6 +1754,7 @@ function getHtmlForRowStatsTable($showtable, $tbl_collation,
             __('Creation'),
             PMA_Util::localisedDate(strtotime($showtable['Create_time']))
         );
+        $odd_row = !$odd_row;
     }
     if (isset($showtable['Update_time'])) {
         $html_output .= PMA_getHtmlForRowStatsTableRow(

diff --git a/phpunit.xml.dist b/phpunit.xml.dist
@@ -55,6 +55,7 @@
             <exclude>
                 <!-- we don't care about coverage of embedded libraries -->
                 <directory suffix=".php">libraries/tcpdf</directory>
+                <directory suffix=".php">libraries/phpseclib</directory>
                 <directory suffix=".php">libraries/bfShapeFiles</directory>
                 <directory suffix=".php">libraries/php-gettext</directory>
                 <directory suffix=".inc">libraries/php-gettext</directory>