Fix merge conflicts from QA_4_9 and prepare for 5.0.1

Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
phpmyadmin · Jan 8, 2020 · dc1e81e · dc1e81e
2 parents e16ccbd + fa53b37
commit dc1e81e
Show file tree

Hide file tree

Showing 6 changed files with 9 additions and 7 deletions.
diff --git a/ChangeLog b/ChangeLog
@@ -1,7 +1,7 @@
 phpMyAdmin - ChangeLog
 ======================
 
-5.0.1 (not yet released)
+5.0.1 (2020-01-07)
 - issue #15719 Fixed error 500 when browsing a table when $cfg['LimitChars'] used a string and not an int value
 - issue #14936 Fixed display NULL on numeric fields has showing empty string since 5.0.0
 - issue #15722 Fix get Database structure fails with PHP error on replicated server
@@ -17,6 +17,7 @@ phpMyAdmin - ChangeLog
 - issue #14875 Fix shp file import tests where failing when php dbase extension was enabled
 - issue #14299 Fix JS error "PMA_makegrid is not defined" when clicking on a table from the "Insert" tab opened in a new tab
 - issue #15351 Fixed 2FA setting removed each time the user edits another configuration setting
+- issue        [security] Fix SQL injection vulnerability on the user accounts page (PMASA-2020-1)
 
 5.0.0 (2019-12-26)
 - issue #13896 Drop support for PHP 5.5, PHP 5.6, PHP 7.0 and HHVM
@@ -64,8 +65,9 @@ phpMyAdmin - ChangeLog
 - issue #15677 Fix show process-list triggers a php exception
 - issue #15697 Fix uncaught php error: "Call to a member function get() on null" in db_export.php when exporting a table from the list
 
-4.9.4 (not yet released)
+4.9.4 (2020-01-07)
 - issue #15724 Fix 2FA was disabled by a bug
+- issue        [security] Fix SQL injection vulnerability on the user accounts page (PMASA-2020-1)
 
 4.9.3 (2019-12-26)
 - issue #15570 Fix page contents go underneath of floating menubar in some cases

diff --git a/README b/README
@@ -1,7 +1,7 @@
 phpMyAdmin - Readme
 ===================
 
-Version 5.0.1-dev
+Version 5.0.1
 
 A web interface for MySQL and MariaDB.
 

diff --git a/doc/conf.py b/doc/conf.py
@@ -51,7 +51,7 @@
 # built documents.
 #
 # The short X.Y version.
-version = '5.0.1-dev'
+version = '5.0.1'
 # The full version, including alpha/beta/rc tags.
 release = version
 

diff --git a/libraries/classes/Config.php b/libraries/classes/Config.php
@@ -113,7 +113,7 @@ public function __construct(?string $source = null)
      */
     public function checkSystem(): void
     {
-        $this->set('PMA_VERSION', '5.0.1-dev');
+        $this->set('PMA_VERSION', '5.0.1');
         /* Major version */
         $this->set(
             'PMA_MAJOR_VERSION',

diff --git a/libraries/classes/Server/Privileges.php b/libraries/classes/Server/Privileges.php
@@ -3213,7 +3213,7 @@ public function getExtraDataForAjaxBehavior(
 
         if (isset($_GET['validate_username'])) {
             $sql_query = "SELECT * FROM `mysql`.`user` WHERE `User` = '"
-                . $_GET['username'] . "';";
+                . $this->dbi->escapeString($_GET['username']) . "';";
             $res = $this->dbi->query($sql_query);
             $row = $this->dbi->fetchRow($res);
             if (empty($row)) {

diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "phpmyadmin",
-  "version": "5.0.1-dev",
+  "version": "5.0.1",
   "description": "A web interface for MySQL and MariaDB",
   "repository": "https://github.com/phpmyadmin/phpmyadmin.git",
   "author": "The phpMyAdmin Team <developers@phpmyadmin.net> (https://www.phpmyadmin.net/team/)",