Commit Graph

98 Commits

Author SHA1 Message Date
Gyorgy Sarvari 4e2c202346 phpmyadmin: ignore CVE-2020-22452
Details: https://nvd.nist.gov/vuln/detail/CVE-2020-22452

The fix is present in the recipe version (5.1.4)[1]

[1]: https://github.com/phpmyadmin/phpmyadmin/pull/16004/commits/ca42395ee4b2936d3702524f8fb8bec1e9502bc7

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-08 22:03:03 +01:00
Gyorgy Sarvari 3b6d6286c7 xdebug: upgrade 3.1.1 -> 3.1.5
This update contains many bugfixes.

Changelog: https://xdebug.org/updates#x_3_1_5

3.1.5:
- Install documentation gives wrong arch for installation on M1 Macs
- phpize --clean removes required clocks.m4 file
- Constant defined with an enum case produce double "facet" attribute in context_get response
- Crash when used with source guardian encoded files
- Segfault in __callStatic() after FFI initialization

3.1.4:
- Removing second call breakpoint with same function name
- XDebug breaks the Symfony "PhpFilesAdapter" cache adapter
- Possible use after free with GC Stats
- Can't inspect ArrayObject storage elements
- Segmentation fault in symfony cache
- Debug session can be started with "XDEBUG_SESSION_START=anything" when xdebug.trigger_value is set
- Warn when profiler_append is used together with zlib compression
- Code coverage misses static array assignment lines

3.1.3:
- evaling broken code (still) causes unhandled exception in PHP 7.4
- Memory leak when a trace file can't be opened because xdebug.trace_output_name is invalid
- Slowdown when calling a function with long string parameters
- Debugger creates XML with double facet attribute

3.1.2:
- Segfault on fiber switch in finally block in garbage collected fiber
- Crash when profile file can not be created
- __debugInfo is not used for var_dump output
- Segault on xdebug_get_function_stack inside a Fiber

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-22 20:56:36 +01:00
Gyorgy Sarvari 10e14b601c phpmyadmin: upgrade 5.1.3 -> 5.1.4
Last bugfix release of the 5.1.x series.

Changelog:
- Fixed sorting the database list with "statistics" enabled on "Data" column creates a PHP type error
- Fix for invalid cache when losing access to config storage after it being cached
- Fix session cookie not respecting the CookieSameSite configuration directive in PHP 7.2
- Fix create index form accepting too many columns
- Disable editing to system schemas
- Add better error handling when IndexedDB is not working
- Fixed incorrect escaping of special MySQL characters on some pages
- Fix GIS visualization with an edited query
- Remove the use of the deprecated `strftime` function in OpenDocument exports
- Enable tabindex recompute on preview button while insert new rows
- Fix invalid SQL generated when PRIMARY/UNIQUE key contains a POINT column
- Fix setup's CSS not loading when the URL doesn't have a trailing slash
- Remove jQuery SVG JavaScript dependency
- Fix column visibility dropdown when the column name is too long
- Fix issue when exporting using Firefox or Safari on PHP 8.1.4
- Update JavaScript dependencies
- Fix case where errors were thrown when browsing a table
- Fix UI issue when user accounts page has the initials navigation bar

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-22 20:56:35 +01:00
Changqing Li 880df90c86 phpmyadmin: fix CVE-2025-24529/CVE-2025-24530
CVE-2025-24529:
An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS
vulnerability has been discovered for the Insert tab.
Refer: https://nvd.nist.gov/vuln/detail/CVE-2025-24529

CVE-2025-24530:
An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS
vulnerability has been discovered for the check tables feature. A
crafted table or database name could be used for XSS.
Refer: https://nvd.nist.gov/vuln/detail/CVE-2025-24530

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-02-09 07:58:44 -08:00
Dragos-Marian Panait 99047e44ce phpmyadmin: fix CVE-2023-25727
In phpMyAdmin before 4.9.11 and 5.x before 5.2.1,
an authenticated user can trigger XSS by
uploading a crafted .sql file through the drag-and-drop interface.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2023-25727

Upstream patch:
https://github.com/phpmyadmin/phpmyadmin/commit/efa2406695551667f726497750d3db91fb6f662e

Signed-off-by: Dragos-Marian Panait <dragos.panait@windriver.com>
Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-04-04 09:04:49 -04:00
Khem Raj 312832a3c5 recipes: Update LICENSE variable to use SPDX license identifiers
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-03-04 17:41:45 -08:00
Zheng Ruoqin 0733019d04 phpmyadmin: upgrade 5.1.2 -> 5.1.3
Changelog:
=========
- Fix broken pagination links in the navigation sidebar
- Fix MariaDB has no support for system variable "disabled_storage_engines"
- Fix unsupported operand types in Results.php when running "SHOW PROCESSLIST" SQL query
- Fixed importing browser settings question box after login when having no pmadb
- Fix "First day of calendar" user override has no effect
- Fixed repeating headers are not working
- Fixed import of email-adresses or links from ODS results in empty contents
- Fixed a type error on ODS import with non string values
- Fixed header row show/hide columns buttons on each line after hover are shown on each row
- [security] Fix for path disclosure under certain server configurations (if display_errors is on, for instance)

Signed-off-by: Zheng Ruoqin <zhengrq.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-02-23 09:25:19 -08:00
Yi Zhao 96b5e3e6f8 phpmyadmin: upgrade 5.1.1 -> 5.1.2
License-Update: Change JS Foundation to OpenJS Foundation

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-01-25 09:13:09 -08:00
wangmy 833e059855 xdebug: upgrade 2.9.5 -> 3.1.1
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2021-10-19 20:03:08 -07:00
Yi Zhao bb3123bb87 phpmyadmin: upgrade 5.1.0 -> 5.1.1
Release note:
https://www.phpmyadmin.net/files/5.1.1/

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2021-09-29 19:28:06 -07:00
Martin Jansa c61dc077bb Convert to new override syntax
This is the result of automated script (0.9.1) conversion:

oe-core/scripts/contrib/convert-overrides.py .

converting the metadata to use ":" as the override character instead of "_".

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2021-08-03 10:21:25 -07:00
zhengruoqin 9f70bac38a phpmyadmin: upgrade 5.0.4 -> 5.1.0
The following changes have taken place in copyright:
-Copyright 2013 jQuery Foundation and other contributors
-http://jquery.com/
+Copyright JS Foundation and other contributors, https://js.foundation/

Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2021-03-08 17:24:13 -08:00
Yi Zhao 04bb5ad26e phpmyadmin: 5.0.2 -> 5.0.4
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2021-01-05 09:16:26 -08:00
Changqing Li 30f1da6f26 xdebug: upgrade 2.7.2 -> 2.9.5
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-04-27 07:48:46 -07:00
Wang Mingyu 7bbfd99551 phpmyadmin: upgrade 4.9.2 -> 5.0.2
Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-04-01 23:32:54 -07:00
Yi Zhao ba5fbb239e phpmyadmin: upgrade 4.9.1 -> 4.9.2
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-12-13 18:29:14 -08:00
Yi Zhao 190bd286f2 phpmyadmin: upgrade 4.9.0.1 -> 4.9.1
License-Update: tecnickcom/tcpdf/LICENSE.TXT: copyright years updated.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-09-23 08:33:10 -07:00
Yi Zhao 267d1cc226 phpmyadmin: upgrade 4.8.5 -> 4.9.0.1
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-06-15 16:46:51 -07:00
Yi Zhao b3fc553cb3 xdebug: upgrade 2.7.0RC2 -> 2.7.2
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-06-15 16:46:50 -07:00
Yi Zhao d2d3784d7a phpmyadmin: upgrade 4.8.3 -> 4.8.5
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-05-02 14:13:57 -07:00
Changqing Li 95a1d25517 xdebug: upgrade 2.6.1 -> 2.7.0RC2
License-Update: Change http://xdebug.org to https://xdebug.org everywhere

php upgrade to 3.7.2, 2.6.1 not support php 3.x, need
upgrade to 2.7 which support php 3.x.

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-02-18 23:16:06 -08:00
Yi Zhao 85986e6d73 phpmyadmin: upgrade 4.8.2 -> 4.8.3
Security fixes:
CVE-2018-15605: An issue was discovered in phpMyAdmin before 4.8.3. A
Cross-Site Scripting vulnerability has been found where an attacker can
use a crafted file to manipulate an authenticated user who loads that
file through the import feature.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2018-09-05 13:59:16 -07:00
Yi Zhao 811447a949 xdebug: upgrade 2.6.0 -> 2.6.1
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2018-08-21 17:28:14 -07:00
Changqing Li ed440efa1e phpmyadmin: add rdepend to php-cli
phpmyadmin install some bin list below that depend on interpreter php,
without rdepend,  will report "Not found the interpreter php"

/usr/share/phpmyadmin/vendor/phpmyadmin/sql-parser/bin/lint-query
/usr/share/phpmyadmin/vendor/phpmyadmin/sql-parser/bin/tokenize-query
/usr/share/phpmyadmin/vendor/phpmyadmin/sql-parser/bin/highlight-query

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2018-08-08 12:04:14 -07:00
Yi Zhao 841fbbf4a0 phpmyadmin: upgrade 4.7.9 -> 4.8.2
License-Update: move js/jquery to js/vendor/jquery

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2018-07-03 17:42:25 -07:00
Yi Zhao 9044bb2daf xdebug: add UPSTREAM_CHECK_REGEX
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2018-05-30 12:41:18 -07:00
Khem Raj 2fde407390 xdebug: Add missing dep on re2c-native
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-05-01 18:14:27 -07:00
Armin Kuster 0b67e4b4dd xdebug: update to 2.6.0
fixes:
checking Check for supported PHP versions... configure: error: not supported. Need a PHP version >= 5.5.0 and < 7.2.0 (found 7.2.4)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-04-13 12:43:48 -07:00
Derek Straka 5da057c1ca phpmyadmin: add correct versions for upstream url and version regex
Signed-off-by: Derek Straka <derek@asterius.io>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-03-16 19:27:54 -07:00
Derek Straka da0e5171b4 phpmyadmin: update to version 4.7.9
Signed-off-by: Derek Straka <derek@asterius.io>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-03-16 19:27:54 -07:00
Derek Straka c186045e8b phpmyadmin: update to version 4.7.6
Signed-off-by: Derek Straka <derek@asterius.io>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-12-27 07:25:02 -08:00
Derek Straka 2de93541d9 phpmyadmin: update to version 4.7.5
Signed-off-by: Derek Straka <derek@asterius.io>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-11-15 16:34:06 -08:00
Jackie Huang 315aadd763 phpmyadmin: upgrade to 4.7.3
The license files and md5 are updated.

Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2017-08-28 11:06:02 +02:00
dengke.du@windriver.com 6cd249225e php: fix install error for libphp*.so
Changed in V4:
	Add the tag: meta-oe

1. Different version php have different libphp*.so, so we need to install its
   corresponding libphp*.so, for example:

    php-7.1.0  libphp7.so
    php-5.6.26 libphp5.so

2. Fix php-5.6.26 compiling errors:

    ld: TSRM/.libs/TSRM.o: undefined reference to symbol
    'pthread_sigmask@@GLIBC_2.2.5'
    error adding symbols: DSO missing from command line

3. Create a configure script like 70_mod_php5, we name it 70_mod_php7, this
   file connect the php7 and the apache2, so they work together to let the
   LAMP works correctly.

Signed-off-by: Dengke Du <dengke.du@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2017-05-23 15:49:36 +02:00
Robert Yang 444e1fb198 php: remove PNBLACKLIST
It has been fixed since:
commit b5bb611637
Author: dengke.du@windriver.com <dengke.du@windriver.com>
Date:   Tue Mar 28 04:13:36 2017 -0400

    php: fix install failure

Also remove it for xdebug since php works now.

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2017-04-18 14:21:53 +02:00
Martin Jansa cdb428e7c4 recipes: add removal date to PNBLACKLIST messages
* based on discussion in pndeprecated thread:
  https://patchwork.openembedded.org/patch/137573/
  update the messages to warn possible users that the
  recipe will be removed before the end of the next development
  cycle (before Yocto 2.4 is released).

* updated with:
  sed -i 's/^\(PNBLACKLIST.*".*\)"/\1 - the recipe will be removed on 2017-09-01 unless the issue is fixed"/g' `git grep PNBLACKLIST | sed 's/:.*//g' | sort -u | xargs`
* then noticed couple recipes being blacklisted only based on
  DISTRO_FEATURES, so removed those:
  meta-networking/recipes-support/lksctp-tools/lksctp-tools_1.0.17.bb
  meta-oe/recipes-connectivity/bluez/bluez-hcidump_2.5.bb
  meta-oe/recipes-connectivity/bluez/bluez4_4.101.bb
  meta-oe/recipes-connectivity/bluez/gst-plugin-bluetooth_4.101.bb
  meta-oe/recipes-navigation/foxtrotgps/foxtrotgps_1.1.1.bb
  meta-oe/recipes-navigation/gypsy/gypsy.inc
  meta-oe/recipes-navigation/navit/navit.inc
  meta-oe/recipes-support/opensync/libsyncml_0.5.4.bb

* if it isn't fixed by this date, it's fair game to be removed
  whenever someone gets around to i

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2017-04-05 19:36:45 +02:00
dengke.du@windriver.com a34ab25fc1 xdebug: 2.2.6 -> 2.5.1
Upgrade the xdebug to fix the build failure with php 7.1

Signed-off-by: Dengke Du <dengke.du@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2017-04-05 19:28:31 +02:00
Martin Jansa 00ba7da845 recipes: blacklist recipes depending on blacklisted recipes
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2017-02-13 18:44:35 +01:00
Jackie Huang 1a6e6a9d96 phpmyadmin: upgrade to 4.6.3
* Compatible with PHP 5.5 to 7.0 and MySQL 5.5 and newer.

* Release notes: http://www.phpmyadmin.net/files/4.6.3/

* Drop two CVE patches which have been fixed:
  CVE-2015-7873 and CVE-2015-8669

* Use PV in SRC_URI instead of hardcoded version number.

Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2016-07-29 11:00:57 +02:00
Martin Jansa df7242fddb recipes: Replace "cp -a" with "cp -R --no-dereference --preserve=mode,links"
* Using "cp -a" leaks UID of user running the builds, causing
  many QA warnings.
* See this thread for details:
  http://lists.openembedded.org/pipermail/openembedded-core/2015-November/112904.html

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2016-03-04 09:06:22 +01:00
Liu Jian 350ad5dd55 phpmyadmin: CVE-2015-8669
libraries/config/messages.inc.php in phpMyAdmin 4.0.x before 4.0.10.12,
4.4.x before 4.4.15.2, and 4.5.x before 4.5.3.1 allows remote attackers
to obtain sensitive information via a crafted request, which reveals
the full path in an error message.

This patch is from https://github.com/phpmyadmin/phpmyadmin/commit/c4d649325b25139d7c097e56e2e46cc7187fae45

Signed-off-by: Jian Liu <jian.liu@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2016-02-01 15:58:04 +01:00
Wenzong Fan b12220887e phpmyadmin: fix CVE-2015-7873
The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1
and 4.5.x before 4.5.1 allows remote attackers to spoof content via the
url parameter.

Backport upstream commit to fix it:
https://github.com/phpmyadmin/phpmyadmin/commit/cd097656758f981f80fb9029c7d6b4294582b706

Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2015-12-18 12:44:42 +01:00
Kai Kang 4e8d16ea6e phpmyadmin: 4.4.9 -> 4.5.0.2
Upgrade phpmyadmin from 4.4.9 to 4.5.0.2 and SRC_URI is updated.

Accoring to release note, there is NO API changes for 4.5.0.x serial. So
upgrade to 4.5.0.2 rather than 4.4.15 which will only support for
security fixes only.

And license file has some text update. See:
https://github.com/phpmyadmin/phpmyadmin/commit/9d080a482fae73bde5049620088d4687da245163

Change files owner to fix [host-user-contaminated] warnings.

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2015-10-23 12:53:23 +02:00
Roy Li ac462c7e58 phpmyadmin: upgrade 4.4.9
upgrade to include CVE fixes:
	CVE-2015-3903
	CVE-2015-3902

Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2015-06-23 12:41:52 +02:00
Roy Li afb00a1179 phpmyadmin: upgrade to 4.4.4
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2015-05-11 10:25:53 +02:00
Paul Eggleton 1601beb5a5 phpmyadmin: update to 4.3.4
Drop patches merged upstream.

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
2015-01-08 12:04:27 +01:00
Paul Eggleton 84f085314e xdebug: update to 2.2.6
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
2015-01-08 12:04:27 +01:00
Paul Eggleton 51bc8cea90 xdebug: fix DEPENDS and un-blacklist
Now we use a single php recipe there is no conflict.

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
2015-01-08 12:04:27 +01:00
Paul Eggleton 06af52095b modphp: remove
This is now built out of the standard php recipe.

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
2015-01-08 12:04:26 +01:00
Wenzong Fan a64536fe90 phpmyadmin: don't install patches
Don't install local patch files to target.

Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2014-12-19 20:10:56 +01:00