Skip to content

Commit

Permalink
[SECURITY] Update pMA to the latest stable 4.4.x release (4.4.15.10) …
Browse files Browse the repository at this point in the history
…- MWEXT-11

Includes vendor security fixes

PMASA-2017-7: DOS in replication status
PMASA-2017-6: SSRF in replication
PMASA-2017-5: Cookie attribute injection attack
PMASA-2017-4: CSS injection in themes
PMASA-2017-3: DOS vulnerability in table editing
PMASA-2017-1: Open redirect
PMASA-2017-2: php-gettext code execution
Signed-off-by: Andreas Beutel <[email protected]>
  • Loading branch information
abeutel committed Jan 31, 2017
1 parent 6690754 commit c418de4
Show file tree
Hide file tree
Showing 1,393 changed files with 67 additions and 200 deletions.
2 changes: 1 addition & 1 deletion BeModule/conf.php
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
// Configuration
$MCONF['name'] = 'tools_txphpmyadmin';
$MCONF['script'] = '_DISPATCH';
$MCONF['PMA_subdir'] = 'Vendor/phpMyAdmin-4.4.15.9-all-languages/';
$MCONF['PMA_subdir'] = 'Vendor/phpMyAdmin-4.4.15.10-all-languages/';
$MCONF['PMA_script'] = 'index.php';

// Localization
Expand Down
2 changes: 1 addition & 1 deletion BeModule/index.php
Original file line number Diff line number Diff line change
Expand Up @@ -235,7 +235,7 @@ public function printContent() {
$MCONF['name'] = 'tools_txphpmyadmin';
$MCONF['script'] = '_DISPATCH';
$MCONF['access'] = 'admin';
$MCONF['PMA_subdir'] = 'Vendor/phpMyAdmin-4.4.15.9-all-languages/';
$MCONF['PMA_subdir'] = 'Vendor/phpMyAdmin-4.4.15.10-all-languages/';
$MCONF['PMA_script'] = 'index.php';

// Proceed if TYPO3_MODE is defined
Expand Down
13 changes: 13 additions & 0 deletions Documentation/Changelog/Index.rst
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,19 @@ Change Log

The following is an overview of the changes in this extension. For more details `read the online log <https://github.com/mehrwert/TYPO3-phpMyAdmin>`_.

2017-01-31 Andreas Beutel - Version 5.1.9
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
- [FEATURE] Updated pMA to the latest stable 4.4.x release (4.4.15.10)
- [SECURITY] Includes non-critical vendor security fixes
- `PMASA-2017-7 <https://www.phpmyadmin.net/security/PMASA-2017-7/>`_: DOS in replication status
- `PMASA-2017-6 <https://www.phpmyadmin.net/security/PMASA-2017-6/>`_: SSRF in replication
- `PMASA-2017-5 <https://www.phpmyadmin.net/security/PMASA-2017-5/>`_: Cookie attribute injection attack
- `PMASA-2017-4 <https://www.phpmyadmin.net/security/PMASA-2017-4/>`_: CSS injection in themes
- `PMASA-2017-3 <https://www.phpmyadmin.net/security/PMASA-2017-3/>`_: DOS vulnerability in table editing
- `PMASA-2017-1 <https://www.phpmyadmin.net/security/PMASA-2017-1/>`_: Open redirect
- [SECURITY] Includes minor vendor security fixes
- `PMASA-2017-2 <https://www.phpmyadmin.net/security/PMASA-2017-2/>`_: php-gettext code execution

2016-11-30 Andreas Beutel - Version 5.1.8
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
- [FEATURE] Updated pMA to the latest stable 4.4.x release (4.4.15.9)
Expand Down
2 changes: 1 addition & 1 deletion Documentation/Index.rst
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ phpMyAdmin for TYPO3
2002-11-01

:Changed:
2016-11-30
2017-01-31

:Changed by:
Andreas Beutel
Expand Down
6 changes: 3 additions & 3 deletions Settings.yml
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,10 @@

---
conf.py:
copyright: 2002-2016
copyright: 2002-2017
project: phpMyAdmin Extension for TYPO3
version: 5.1.8
release: 5.1.8
version: 5.1.9
release: 5.1.9
latex_documents:
- - Index
- phpmyadmin.tex
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,15 @@
phpMyAdmin - ChangeLog
======================

4.4.15.10 (2017-01-23)
- issue [security] Multiple vulnerabilities in setup script, see PMASA-2016-44.
- issue [security] Open redirect, see PMASA-2017-1.
- issue [security] php-gettext code execution, see PMASA-2017-2.
- issue [security] DOS vulnerability in table editing, see PMASA-2017-3.
- issue [security] CSS injection in themes, see PMASA-2017-4.
- issue [security] SSRF in replication, see PMASA-2017-6.
- issue [security] DOS in replication status, see PMASA-2017-7.

4.4.15.9 (2016-11-24)
- issue #12485 Do not show warning about short blowfish_secret if none is set
- issue [security] Unsafe generation of $cfg['blowfish_secret'], see PMASA-2016-58
Expand Down Expand Up @@ -36,7 +45,6 @@ phpMyAdmin - ChangeLog
- issue [security] Verify data before unserializing, see PMASA-2016-43
- issue [security] Use HTTPS for wiki links
- issue Remove Swekey support
- issue [security] SSRF in setup script, see PMASA-2016-44
- issue [security] Denial-of-service attack with $cfg['AllowArbitraryServer'] = true and persistent connections, see PMASA-2016-45
- issue [security] Improve SSL certificate handling
- issue [security] Fix full path disclosure in debugging code
Expand Down
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
phpMyAdmin - Readme
===================

Version 4.4.15.9
Version 4.4.15.10

A set of PHP-scripts to manage MySQL over the web.

Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Mon Jan 23 19:08:23 UTC 2017
Loading

0 comments on commit c418de4

Please sign in to comment.