diff --git a/ChangeLog b/ChangeLog index 9a614146fbf5..aa17d3434af5 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,11 +1,11 @@ phpMyAdmin - ChangeLog ====================== -4.0.10.3 (2014-09-13) +4.1.14.4 (2014-09-13) - bug #4530 [security] DOM based XSS that results to a CSRF that creates a ROOT account in certain conditions -4.0.10.2 (2014-08-17) +4.1.14.3 (2014-08-17) - bug #4501 [security] XSS in table browse page - bug #4502 [security] Self-XSS in enum value editor - bug #4503 [security] Self-XSSes in monitor diff --git a/README b/README index 44299496dc7c..692a9332fee2 100644 --- a/README +++ b/README @@ -1,7 +1,7 @@ phpMyAdmin - Readme =================== -Version 4.0.10.3 +Version 4.1.14.4 A set of PHP-scripts to manage MySQL over the web. diff --git a/doc/conf.py b/doc/conf.py index 4db529cc825d..060f74083271 100644 --- a/doc/conf.py +++ b/doc/conf.py @@ -51,7 +51,7 @@ # built documents. # # The short X.Y version. -version = '4.0.10.3' +version = '4.1.14.4' # The full version, including alpha/beta/rc tags. release = version diff --git a/libraries/Config.class.php b/libraries/Config.class.php index 99eee206fd55..ed47fda61f74 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -114,7 +114,7 @@ function __construct($source = null) */ function checkSystem() { - $this->set('PMA_VERSION', '4.0.10.3'); + $this->set('PMA_VERSION', '4.1.14.4'); /** * @deprecated */ diff --git a/libraries/Header.class.php b/libraries/Header.class.php index 7662b3a0015b..c54f8a03d9f8 100644 --- a/libraries/Header.class.php +++ b/libraries/Header.class.php @@ -149,10 +149,9 @@ private function _addDefaultScripts() if (isset($GLOBALS['db'])) { $params['db'] = $GLOBALS['db']; } - $this->_scripts->addFile('jquery/jquery-1.8.3.min.js'); $this->_scripts->addFile( - 'whitelist.php' . PMA_generate_common_url($params), false, true + 'whitelist.php' . PMA_URL_getCommon($params), false, true ); $this->_scripts->addFile('ajax.js'); $this->_scripts->addFile('keyhandler.js'); @@ -180,7 +179,7 @@ private function _addDefaultScripts() // Here would not be a good place to add CodeMirror because // the user preferences have not been merged at this point - $this->_scripts->addFile('messages.php' . PMA_generate_common_url($params)); + $this->_scripts->addFile('messages.php' . PMA_URL_getCommon($params)); // Append the theme id to this url to invalidate // the cache on a theme change. Though this might be // unavailable for fatal errors. diff --git a/libraries/Scripts.class.php b/libraries/Scripts.class.php index 416032ff8dc5..9fc1e9154a5d 100644 --- a/libraries/Scripts.class.php +++ b/libraries/Scripts.class.php @@ -54,27 +54,29 @@ private function _includeFiles($files) $dynamic_scripts = ""; $scripts = array(); foreach ($files as $value) { - if (strpos($value['filename'], "?") !== false) { - $dynamic_scripts .= ""; - continue; - } - $include = true; - if ($value['conditional_ie'] !== false - && PMA_USR_BROWSER_AGENT === 'IE' - ) { - if ($value['conditional_ie'] === true) { - $include = true; - } else if ($value['conditional_ie'] == PMA_USR_BROWSER_VER) { - $include = true; - } else { - $include = false; + if (strpos($value['filename'], "?") === false) { + $include = true; + if ($value['conditional_ie'] !== false + && PMA_USR_BROWSER_AGENT === 'IE' + ) { + if ($value['conditional_ie'] === true) { + $include = true; + } else if ($value['conditional_ie'] == PMA_USR_BROWSER_VER) { + $include = true; + } else { + $include = false; + } + } + if ($include) { + $scripts[] = "scripts[]=" . $value['filename']; } } else { if ($value['before_statics'] === true) { - $first_dynamic_scripts .= ""; + $first_dynamic_scripts .= ""; } else { - $dynamic_scripts .= ""; + $dynamic_scripts .= ""; } } } @@ -110,7 +112,7 @@ public function __construct() * @param bool $conditional_ie Whether to wrap the script tag in * conditional comments for IE * @param bool $before_statics Whether this dynamic script should be - * include before the static ones + * included before the static ones * * @return void */