Version: 4.9.11-bp153.2.6.1
* Tue May 23 2023 chris@computersalat.de
- Update to 4.9.11
This is a security and bugfix release.
* Fix for boo#1208186 (CVE-2023-25727, PMASA-2023-1, CWE-661)
XSS vulnerability in drag-and-drop upload
- An XSS vulnerability has been discovered where an authenticated
user can trigger an XSS attack by uploading a specially-crafted
.sql file through the drag-and-drop interface.
* Wed Jul 13 2022 chris@computersalat.de
- update changes file
* fix missing bugzilla information
* Thu Dec 10 2020 Arjen de Korte <suse+build@de-korte.org>
- Use system apache rpm macros
* Fri Oct 16 2020 Andreas Stieger <andreas.stieger@gmx.de>
- phpMyAdmin 4.9.7:
* Fix two factor authentication that was broken in 4.9.6
* Fix incompatibilities with older PHP versions
* Sun May 03 2020 chris@computersalat.de
- fix for boo#1170743
phpMyAdmin installation wipes it's sysconfig apache_server_flag entry
* Sat May 02 2020 Arjen de Korte <suse+build@de-korte.org>
- Don't expand @FQDN@ from /etc/HOSTNAME (this used to set
$cfg['PmaAbsoluteUri'] parameter, but this variable is no longer
in the config.sample.ini file)
* Thu Apr 23 2020 Dominique Leuenberger <dimstar@opensuse.org>
- Drop python-devel BuildRequires: python2 is EOL and this seems
unused.
- Drop xz BuildRequires: OBS takes care of unpacking the tarball.
* Tue Jan 21 2020 chris@computersalat.de
- fix for boo#1092345
* change ap_docroot from /srv/www/htdocs to /usr/share
work is based on changes provided by ecsos@opensuse.org
if phpMyAdmin.conf for apache was changed by local admin, we will
create a backup and replace the original file with the new version
sorry admins, but you need to apply your changes again
* needed Alias /phpMyAdmin is an enabled APACHE_SERVER_FLAGS default
for more info have a look into /etc/apache2/conf.d/phpMyAdmin.conf
- cleanup tmp/twig on
* uninstall
* ap_docroot change
Version: 4.8.2-bp150.2.1
* Tue Jul 31 2018 chris@computersalat.de
- fix for boo#1103305
* add missing dependency for php-ctype
* Fri Jun 22 2018 chris@computersalat.de
- update to 4.8.2 (2018-06-21)
* issue #14370 WHERE 0 causes Fatal error
* issue #14225 Fix missing index icon
- fix for boo#1098752
* PMASA-2018-3 (CVE-2018-12581, CWE-661)
https://www.phpmyadmin.net/security/PMASA-2018-3/
- XSS in Designer feature
- fix for boo#1098751
* PMASA-2018-4 (CVE-2018-12613, CWE-661)
https://www.phpmyadmin.net/security/PMASA-2018-4/
- File inclusion and remote code execution attack
- some minor changelog fixes about security fix entries
* Sat May 26 2018 ecsos@opensuse.org
- update to 4.8.1 (2018-05-25)
* gh#12772 Fix case where the central columns attributes don't
get filled in
* gh#14049 Fix case where the query builder doesn't work when
selected column is *
* gh#14029 Revert "Browse" table CSS overflow
* gh#14241 Dropping indexes and foreign keys fail
* gh#14227 Relational linking broken
* gh#14246 Fixed error in configuration storage zero config
* gh#14128 Show 2FA Secret next to QR code
* gh#14212 XML Export from single table throws fatal error
* gh#14239 Line and some other charts ignore result set order of
values chosen for the x-axis
* gh#14260 Fixed configuration for DefaultLang and Lang
* gh#14264 Linking for 'Distinct values' broken
* gh#13968 Fix MariaDB 10.2 current_timestamp()
* gh#14249 Fix for missing go button in view edit
* gh#14125 Fix for issues with spatial fields
* gh#14189 Remember table's sorting broken
* gh#14289 Fix multi-column sorting
* gh#14278 Fix central columns in-line edit bug
* gh#14066 Fix AUTO_INCREMENT error when only exporting table
structure in database-level exports
* gh#13893 Simulating queries produces unexpected results
* gh#14309 Setup script icons missing
* Fri Apr 20 2018 ecsos@opensuse.org
- update to 4.8.0.1 (2018-04-19)
- fix for boo#1090309
* PMASA-2018-2 (CVE-2018-10188, CWE-661)
https://www.phpmyadmin.net/security/PMASA-2018-2/
- Multiple CSRF vulnerabilities
* Wed Apr 11 2018 ecsos@opensuse.org
- fix wrong require /usr/bin/bash to /bin/bash so phpMyAdmin could
install
- insert missing templates dir in htaccess
See https://docs.phpmyadmin.net/de/latest/setup.html#securing-your-phpmyadmin-installation
- create tmp dir and insert this in htaccess to fix the errormessage
after login
* Wed Apr 11 2018 javier@opensuse.org
- spec clean up
* Let rpm find the library dependencies by itself. Remove
unneeded explicit Requires: tags (php-zlib)
* Remove logic for obsolete openSUSE releases
* Ignore pem-certificate rpmlint warning (see
libraries/certs/README.rst)
* Remove hidden .github, .php_cs.dist, .scrutinizer.yml and
.editorconfig
* Remove php_twig.h and twig.c (devel)
* Set proper shebang for bash and php scripts
* Make phpmyadmin/sql-parser/bin/*-query and
paragonie/random_compat/*.sh executable
* Wed Apr 11 2018 javier@opensuse.org
- update to 4.8.0 (2018-04-07)
* gh#12946 Allow to export JSON with unescaped unicode chars
* gh#12983 Disable login button without solved reCaptcha
* gh#12315 Allow to remove individual segments from pie charts
* gh Change label from "Improve table structure" to
"Normalize" to match standard terminology
* gh#13087 Offer login as different user on access denied from
MySQL
* gh#13110 Indicate when HTTPS is not properly reported on the
server
* gh#13119 No database selected error when adding foreign key
* gh#12388 Improved database search to allow search for exact
phrase match
* gh#13099 Report error when trying to copy database to same
name
* gh#13167 Themes now have to contain metadata in theme.json
* gh#6363 phpMyAdmin no longer requires eval() in PHP
* gh#12386 The mbstring dependency is now optional
* gh#13269 Small refactoring in preparation to CSP
* gh#13384 Database link broken in Databases Page
* gh#13391 Configurable authentication logging using
$cfg['AuthLog']
* gh#13086 Add support for Google Invisible Captcha
* gh#13058 Improved error reporting for reCAPTCHA
* gh#12899 Improved rendering of server variables table
* gh#12948 Fixed javascript editor for TIME values
* gh#13095 Fixed alignment of foreign keys editing
* gh#12944 Improved inline editor for JSON
* gh#13145 Improved layout of operations pages
* gh#13448 Add "format" query button in edit view form
* gh#6241 Implement Responsive Design/mobile interface
* gh Use a single location for classes under PhpMyAdmin
namespace
* gh#12354 Indicate SSL status on main page
* gh#5666 Configuration directives for defaults of Transformation
options
* gh#12261 Remove inline JavaScript
* gh#13408 Show MySQL warnings when executing SQL queries
* gh#5827 Allow Designer to show tables from other databases
* gh#13268 Replace Query-By-Example with multi-table query
generator interface
* gh#13576 Add privileges export to per-database listing
* gh Consolidate functions into class files
* gh#13560 Add support for changing collation for all tables and
columns in database
* gh#13303 Add support for creating fulltext index from table
structure
* gh#13711 Lower default value for $cfg['MaxExactCount']
* gh#13722 DisableIS is not fully honored
* gh#6197 Added support for authentication using U2F and 2FA
* gh#13480 Avoid removing cookies on upgrade
* gh#13397 Remember state of navigation panel
* gh#11688 Reduced cookie usage
* gh#13466 Better utilization of user preferences
* gh#14042 Rename PMD to Designer
* gh#13940 Honor arg_separator in AJAX requests
* gh#14060 Can't edit rows in Internet Explorer
* gh#14096 Internet Explorer compatibility; fixes JavaScript error
Object doesn't support property or method 'startsWith'
* Tue Mar 06 2018 ecsos@opensuse.org
- update to 4.7.9 (2018-03-05)
* gh#13931 Fixed browsing tables with more results
* gh#13927 "Not an integer" when browsing a table
* gh#13887 "Input variables exceeded 1000" error relating
to PHP's max_input_vars directive
* Thu Feb 22 2018 astieger@suse.com
- phpMyAdmin 4.7.8:
* Fixed error handling with PHP 7.2
* Fixed resetting default setting values
* Fixed fallback value for collation connection
- fix for boo#1082188
* PMASA-2018-1 (CVE-2018-7260, CWE-661)
https://www.phpmyadmin.net/security/PMASA-2018-1/
- Fix XSS in Central Columns Feature
* Mon Dec 25 2017 astieger@suse.com
- phpMyAdmin 4.7.7:
* Fixed displaying of formatted numeric values for some locales
* Ensure datetimepicker is always loaded for datetime fields
* Fixed PHP error when browsing certain results
* Fix XSRF/CSRF vulnerability (bsc#1074066, PMASA-2017-09)
CVE-2017-1000499
* Sat Dec 02 2017 ecsos@opensuse.org
- update to 4.7.6 (2017-11-29)
* gh#13517 Fixed check all interaction with filtering
* gh#13803 Add SJIS-win to default list of allowed charsets
* gh#13436 Improve detection that MySQL server needs SSL connection
* gh#13038 Support JSON datatype on MariaDB 10.2.7 and newer
* gh#13824 Fixed constructing ALTER query with AFTER
* gh#13821 Lock page when changes are done in the SQL editor
* gh#13842 Prefer iconv for encoding conversions
* gh#13737 Fixed changing password on MariaDB cluster
* Sun Nov 26 2017 suse+build@de-korte.org
- fix for boo#1057661
* no longer require php_mod_any (recommend it instead)
* only enable php5 / php7 if running Apache prefork MPM
- fix %post
* use sed instead of grep/awk to determine PHP version
* Tue Oct 24 2017 ecsos@opensuse.org
- update to 4.7.5 (2017-10-23)
* gh#13615 Avoid problems with browsing unknown query types
* gh#13612 Integrate tooltip into datetime pickers
* gh#13628 Fixed javascript error in server monitor
* gh#13444 Fixed server monitor on non Linux and Windows systems
* gh#13633 Reload javscript messages when changing language
* gh#13604 Fixed crash on invalid ordering data
* gh#13639 Fixed error when browsing non SELECT results
* gh#13533 Fixed saving column to display
* gh#13647 Fixed export of tables with VIRTUAL columns
* gh#13669 Fixed selecting multiple rows accidentally selects
the next row too
* gh#13513 Fixed edit index Column alignment issue
* gh#13515 Fixed rendering of add index dialog
* gh#13710 Fixed possible error in server advisor
* gh#13477 Fixed setting input transformations
* gh#13552 Fixed IPv4/IPv6 To Binary input transformation
* gh#13686 Clicking on column name to trigger sort with an active
search leads to logout
* gh#13725 Fixed copying tables with specific PARTITION
definition
* gh#13761 Fixed listing of bookmarks for a database
* Fri Sep 08 2017 chris@computersalat.de
- fix recommends
* php5-curl -> php-curl
* php5-zip -> php-zip
- fix post step
* enable correct phpX module
* Fri Aug 25 2017 ecsos@opensuse.org
- update to 4.7.4
* gh#13415 Remove shadow from the logo
* gh#13507 Fixed per server theme feature
* gh#13523 Missing newline in ALTER exports
* gh#13414 Fixed several compatibility issues with PHP 7.2
* gh#13550 Fixed copy results to clipboard
* gh#13562 Add limitation for user group length
* gh#13561 Fixed edit variable link in advisor
* gh#13579 Optimize table link should not be visible in print
page
* gh#13553 Improved error handling on corrupted tables
* gh#13512 Fixed rendering of add index dialog
* gh#13606 Fixed refreshing server variables
* Fri Jul 28 2017 chris@computersalat.de
- fix for boo#1050980
* replace mcrypt with openssl, see
https://github.com/phpseclib/phpseclib/issues/1028
- update changes (update to 4.6.6 (2017-01-23))
* add missing (CVE-Not yet available) CVE's
* Sat Jul 22 2017 ecsos@opensuse.org
- update to 4.7.3
* gh#13447 Large multi-line query removes Export operation and
blanks query box options
* gh#13445 Fixed rendering of query results
* gh#13437 Fixed version check when not connected to a database
* gh#13465 Fixed creating relation
* gh#13475 Fixed export without backquotes
* gh#13482 Improved handling of uploaded files with open_basedir
* gh#13387 Fixed inline editing of hex values
* gh#13382 Fixed size of index edit dialog
* gh#13489 Fixed rendering SQL lint errors
* gh#13468 Avoid breakage if set_time_limit is disabled
* gh#13471 Fail if ini_set/ini_get are disabled
* gh#13436 Automatically connect using SSL when server is
configured so
* gh#13478 Fixed usage of some browser transformations
* Sun Jul 02 2017 ecsos@opensuse.org
- update to 4.7.2 (2017-06-29)
* gh#13314 Make theme selection keep current server
* gh#13311 Fixed direct login for accounts without password
* gh#13316 Fixed check for mbstring.func_overload
* gh#13323 Fixed wrong encoding of table at triggers
* gh#12976 Fixed natural sorting in several places
* gh#12718 Show warning for users removed from mysql.user table
* gh#13362 Fixed loading additional javascripts
* gh#13343 Fixed editing QBE
* gh#13193 Improved documentation on user settings
* gh#13092 Gracefully handle early fatal errors in AJAX requests
* gh#13327 Fixed Incorrect NavigationTreeEnableExpansion default
value in the documentation
* gh#13008 Fixed export of database with a lot of tables
* gh#13318 Improved performance when importing with enabled
tracking
* gh#13386 Avoid PHP errors with non existing configuration on
OS X
* gh#13388 Show only supported charsets for conversion
* gh#13392 Fixed operation with session.auto_start enabled
* gh#13383 "Create PHP code" is broken
* gh#13189 Fixed links to resume timeouted import
* Fri Jun 02 2017 ecsos@opensuse.org
- update to 4.7.1 (2017-05-25)
* gh#13132 Always execute tracking queries as controluser
* gh#13125 Focus on SQL editor after inserting field name
* gh#13133 Fixed broken links in setup
* gh#13135 Database list Tooltips: Show wrong value
* gh#13150 Fixed pagination while browsing resuls
* gh#13149 Fixed outbound links in changelog.php
* gh#13146 Do not include devel dependencies in the release
* gh#13144 Do not show New as a database in database dropdown
* gh#13130 Fixed handling of errors in AJAX requests
* gh#13152 Fixed PHP error in case of invalid table preferences
* gh#13154 Fixed PHP error on password change
* gh#13219 Fix Refresh of Process List
* gh#13182 Fix refresh of long queries
* gh#12301 Improved handling of logout with disabled
LoginCookieDeleteAll
* gh#13216 Add support for MySQL 8.0 collations
* gh#13218 Fixed rendering of phpMyAdmin logos
* gh#13234 Properly report not working sessions
* gh#13256 Fixed password check on server replication
* gh#13252 Fixed grid editing time column
* gh#13258 Fixed detection of Amazon RDS
* gh#13241 Redirect user to last page that has any tables to
display
* gh#13266 Fix link to User accounts overview page
* gh#13274 Fix error in query builder
* gh#13177 Grid editing repeats action after error
* Sat Apr 22 2017 chris@computersalat.de
- restore phpMyAdmin-pma.patch
* because it is NOT upstream and needed for configuration storage
- restore previous phpMyAdmin-config.patch
* merge with upstream config VAR changes
- removed $cfg['Servers'][$i]['designer_coords']