Skip to content
GitLab
Explore
Sign in
Register
Primary navigation
Search or go to…
Project
aports
Manage
Activity
Members
Labels
Plan
Issues
Issue boards
Milestones
Wiki
Code
Merge requests
Repository
Branches
Commits
Tags
Repository graph
Compare revisions
Snippets
Build
Pipelines
Jobs
Pipeline schedules
Artifacts
Deploy
Releases
Container Registry
Model registry
Operate
Environments
Monitor
Incidents
Service Desk
Analyze
Value stream analytics
Contributor analytics
CI/CD analytics
Repository analytics
Model experiments
Help
Help
Support
GitLab documentation
Compare GitLab plans
Community forum
Contribute to GitLab
Provide feedback
Terms and privacy
Keyboard shortcuts
?
Snippets
Groups
Projects
Show more breadcrumbs
Michael Pirogov
aports
Commits
ca4b594f
Commit
ca4b594f
authored
6 years ago
by
Natanael Copa
Browse files
Options
Downloads
Patches
Plain Diff
community/phpmyadmin: upgrade to 4.8.1 and update maintainer
parent
a601b975
No related branches found
No related tags found
No related merge requests found
Changes
2
Hide whitespace changes
Inline
Side-by-side
Showing
2 changed files
community/phpmyadmin/APKBUILD
+7
-9
7 additions, 9 deletions
community/phpmyadmin/APKBUILD
community/phpmyadmin/CVE-2018-10188.patch
+0
-111
0 additions, 111 deletions
community/phpmyadmin/CVE-2018-10188.patch
with
7 additions
and
120 deletions
community/phpmyadmin/APKBUILD
+
7
−
9
View file @
ca4b594f
# Contributor: Sergei Lukin <sergej.lukin@gmail.com>
# Contributor: Sergei Lukin <sergej.lukin@gmail.com>
# Contributor: Matt Smith <mcs@darkregion.net>
# Contributor: Matt Smith <mcs@darkregion.net>
# Maintainer:
Matt Smith <mcs@darkregion.net
>
# Maintainer:
Andy Postnikov <apostnikov@gmail.com
>
_php
=
php
5
_php
=
php
7
pkgname
=
phpmyadmin
pkgname
=
phpmyadmin
pkgver
=
4.8.
0
pkgver
=
4.8.
1
pkgrel
=
2
pkgrel
=
0
pkgdesc
=
"A Web-based PHP tool for administering MySQL"
pkgdesc
=
"A Web-based PHP tool for administering MySQL"
url
=
"https://www.phpmyadmin.net/"
url
=
"https://www.phpmyadmin.net/"
arch
=
"noarch"
arch
=
"noarch"
license
=
"GPL-2.0 MIT BSD"
license
=
"GPL-2.0 MIT BSD"
depends
=
"
${
_php
}
${
_php
}
-mysqli
${
_php
}
-zip
${
_php
}
-zlib
${
_php
}
-bz2
depends
=
"
${
_php
}
${
_php
}
-mysqli
${
_php
}
-zip
${
_php
}
-bz2
${
_php
}
-ctype
${
_php
}
-gd
${
_php
}
-mcrypt
${
_php
}
-json"
${
_php
}
-ctype
${
_php
}
-gd
${
_php
}
-mcrypt
${
_php
}
-json"
depends_dev
=
depends_dev
=
makedepends
=
"
$depends_dev
"
makedepends
=
"
$depends_dev
"
...
@@ -18,7 +18,6 @@ subpackages="$pkgname-doc"
...
@@ -18,7 +18,6 @@ subpackages="$pkgname-doc"
_fullpkgname
=
phpMyAdmin-
$pkgver
-all-languages
_fullpkgname
=
phpMyAdmin-
$pkgver
-all-languages
source
=
"https://files.phpmyadmin.net/phpMyAdmin/
$pkgver
/
$_fullpkgname
.tar.xz
source
=
"https://files.phpmyadmin.net/phpMyAdmin/
$pkgver
/
$_fullpkgname
.tar.xz
$pkgname
.apache2.conf
$pkgname
.apache2.conf
CVE-2018-10188.patch
"
"
options
=
"!check"
# tests require running MySQL
options
=
"!check"
# tests require running MySQL
...
@@ -103,6 +102,5 @@ doc() {
...
@@ -103,6 +102,5 @@ doc() {
done
done
}
}
sha512sums
=
"50d69ebc1e0a814d1a348a59e6cb42931dbd1d8a9b16e542293b8e30e2ed0ec45ccd993c4388733ce3b099536db39accbc86941554710a4b4b4de8368f9dac02 phpMyAdmin-4.8.0-all-languages.tar.xz
sha512sums
=
"93f04c76b8a0a73ff61dbe3edb9df8b1536eb18f5b5944c2f5eb0e8f5eddb183497c4c2e4a3d290f70422a49027c1de220630bdce731a6b7315b1d3295641d0c phpMyAdmin-4.8.1-all-languages.tar.xz
c6af2960b95924c31cc05d90e7282ba9be6cb6eabb134b8bb627230a4253c017eca75132420a356acd6aecdce146e29666ed90fc90749820060a64478d3e2105 phpmyadmin.apache2.conf
c6af2960b95924c31cc05d90e7282ba9be6cb6eabb134b8bb627230a4253c017eca75132420a356acd6aecdce146e29666ed90fc90749820060a64478d3e2105 phpmyadmin.apache2.conf"
04abc7767b4fd435f405110fea9ba072ccee1e16e77a82671b2c6a23636286d29f188a0abc29b6ff39918d9ea9cd3be79464d1b49be2f18f7a487d33f9713e8e CVE-2018-10188.patch"
This diff is collapsed.
Click to expand it.
community/phpmyadmin/CVE-2018-10188.patch
deleted
100644 → 0
+
0
−
111
View file @
a601b975
From c6dd6b56e236a3aff953cee4135ecaa67130e641 Mon Sep 17 00:00:00 2001
From: Madhura Jayaratne <madhura.cj@gmail.com>
Date: Wed, 18 Apr 2018 00:07:48 +1000
Subject: [PATCH] Fix phpmyadmin-security#240 Multiple CSRF vulnerabilities
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
---
js/db_operations.js | 7 +++----
js/tbl_operations.js | 6 ++++--
libraries/classes/Operations.php | 9 +++++----
sql.php | 4 ++--
5 files changed, 16 insertions(+), 13 deletions(-)
diff --git a/js/db_operations.js b/js/db_operations.js
index 5a8e95d5799..b65733d896f 100644
--- a/js/db_operations.js
+++ b/js/db_operations.js
@@ -134,6 +134,7 @@
AJAX.registerOnload('db_operations.js', function () {
*/
$(document).on('click', '#drop_db_anchor.ajax', function (event) {
event.preventDefault();
+ var $link = $(this);
/**
* @var question String containing the question to be asked for confirmation
*/
@@ -142,10 +143,8 @@
AJAX.registerOnload('db_operations.js', function () {
PMA_messages.strDoYouReally,
'DROP DATABASE `' + escapeHtml(PMA_commonParams.get('db') + '`')
);
- var params = {
- 'is_js_confirmed': '1',
- 'ajax_request': true
- };
+ var params = getJSConfirmCommonParam(this, $link.getPostData());
+
$(this).PMA_confirm(question, $(this).attr('href'), function (url) {
PMA_ajaxShowMessage(PMA_messages.strProcessingRequest);
$.post(url, params, function (data) {
diff --git a/js/tbl_operations.js b/js/tbl_operations.js
index 2763e0263c2..59b8c534e7c 100644
--- a/js/tbl_operations.js
+++ b/js/tbl_operations.js
@@ -218,6 +218,7 @@
AJAX.registerOnload('tbl_operations.js', function () {
$(document).on('click', '#drop_tbl_anchor.ajax', function (event) {
event.preventDefault();
+ var $link = $(this);
/**
* @var question String containing the question to be asked for confirmation
*/
@@ -230,7 +231,7 @@
AJAX.registerOnload('tbl_operations.js', function () {
$(this).PMA_confirm(question, $(this).attr('href'), function (url) {
var $msgbox = PMA_ajaxShowMessage(PMA_messages.strProcessingRequest);
- var params = getJSConfirmCommonParam(this);
+ var params = getJSConfirmCommonParam(this, $link.getPostData());
$.post(url, params, function (data) {
if (typeof data !== 'undefined' && data.success === true) {
@@ -289,6 +290,7 @@
AJAX.registerOnload('tbl_operations.js', function () {
$(document).on('click', '#truncate_tbl_anchor.ajax', function (event) {
event.preventDefault();
+ var $link = $(this);
/**
* @var question String containing the question to be asked for confirmation
*/
@@ -300,7 +302,7 @@
AJAX.registerOnload('tbl_operations.js', function () {
$(this).PMA_confirm(question, $(this).attr('href'), function (url) {
PMA_ajaxShowMessage(PMA_messages.strProcessingRequest);
- var params = getJSConfirmCommonParam(this);
+ var params = getJSConfirmCommonParam(this, $link.getPostData());
$.post(url, params, function (data) {
if ($('.sqlqueryresults').length !== 0) {
diff --git a/libraries/classes/Operations.php b/libraries/classes/Operations.php
index e62038a5727..d7277edb8bc 100644
--- a/libraries/classes/Operations.php
+++ b/libraries/classes/Operations.php
@@ -1559,10 +1559,11 @@
public function getHtmlForDeleteDataOrTable(
*/
public function getDeleteDataOrTablelink(array $url_params, $syntax, $link, $htmlId)
{
- return '<li><a '
- . 'href="sql.php' . Url::getCommon($url_params) . '"'
- . ' id="' . $htmlId . '" class="ajax">'
- . $link . '</a>'
+ return '<li>' . Util::linkOrButton(
+ 'sql.php' . Url::getCommon($url_params),
+ $link,
+ array('id' => $htmlId, 'class' => 'ajax')
+ )
. Util::showMySQLDocu($syntax)
. '</li>';
}
diff --git a/sql.php b/sql.php
index 13eb168e03f..056497fd3bc 100644
--- a/sql.php
+++ b/sql.php
@@ -69,8 +69,8 @@
// Coming from a bookmark dialog
if (isset($_POST['bkm_fields']['bkm_sql_query'])) {
$sql_query = $_POST['bkm_fields']['bkm_sql_query'];
-} elseif (isset($_GET['sql_query'])) {
- $sql_query = $_GET['sql_query'];
+} elseif (isset($_POST['sql_query'])) {
+ $sql_query = $_POST['sql_query'];
}
// This one is just to fill $db
This diff is collapsed.
Click to expand it.
Preview
0%
Loading
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Save comment
Cancel
Please
register
or
sign in
to comment