phpmyadmin (4:4.6.6-5ubuntu0.5) bionic-security; urgency=medium

  * SECURITY UPDATE: Cross-site scripting (XSS)
    - debian/patches/CVE-2020-26934.patch: make sure where_clause is not
      modified
    - debian/patches/fix-tests-for-CVE-2020-26934-and-CVE-2020-26935.patch:
      Fix failing tests
    - debian/patches/CVE-2018-7260.patch: Fix XSS vulnerability in central
      columns feature
    - debian/patches/CVE-2018-19970.patch: Fix stored Cross-Site Scripting
      (XSS) in navigation tree.
    - CVE-2020-26934
    - CVE-2018-7260
    - CVE-2018-19970
  * SECURITY UPDATE: Cross-site request forgery (CSRF)
    - debian/patches/CVE-2019-12616.patch: Retrieve parameters from $_POST
      in AuthenticationCookie.
    - debian/patches/fix-tests-for-CVE-2019-12616.patch: Fix tests for
      CVE-2019-12616
  * SECURITY UPDATE: SQL Injection
    - debian/patches/CVE-2020-26935.patch: Check where clause signature in
      TableSearchController
    - debian/patches/CVE-2019-6798.patch: SQL injection in Designer
    - debian/patches/CVE-2019-11768.patch: Fix escape database name when
      saving page on designer.
    - debian/patches/CVE-2020-5504.patch: escape username in the query
    - debian/patches/CVE-2020-10804: escape username, password, and hostname
    - debian/patches/CVE-2020-10802: Use Util::backquote in getDataRowAction
    - debian/patches/CVE-2020-10803: Add where_clause check in
      tbl_get_field.php
    - debian/patches/fix-tests-for-CVE-2020-10803.patch: Fix
      Display/ResultsTest errors
    - CVE-2020-26935
    - CVE-2019-6798
    - CVE-2019-11768
    - CVE-2020-5504
    - CVE-2020-10804
    - CVE-2020-10802
    - CVE-2020-10803
  * SECURITY UPDATE: Sensitive information exposure
    - debian/patches/CVE-2018-19968.patch: Remove transform plugin includes
    - debian/patches/CVE-2019-6799.patch: Prevent arbitrary file read by
      the webserver
    - CVE-2018-19968
    - CVE-2019-6799
  * FTBFS: PHPUnit namespace discrepancy
    - debian/patches/fix-tests-bionic.patch: The version of PHPUnit packaged
      with bionic is not compatible with these unit tests. Some minor namespace
      tweaks were needed in order to get the test suite to run. One test case
      provided by rulesProvider for testAddRules() was disabled.

 -- Mike Salvatore <mike.salvatore@canonical.com>  Tue, 17 Nov 2020 19:16:01 -0500

phpmyadmin (4:4.6.6-5) unstable; urgency=medium

  * Add alternate dependency to php-mysqli. This seems to help in case people
    are using the package with other than default PHP.
  * Debconf translations update (Ukrainian, Portuguese, Kabyle and French).
  * Fix open_basedir setting for PHP 7 (Closes: #867882).

 -- Michal Čihař <nijel@debian.org>  Mon, 10 Jul 2017 12:43:06 +0200

phpmyadmin (4:4.6.6-4) unstable; urgency=medium

  * Build depend on locales-all to ensure en_US.UTF-8 is available (see
    #859219).

 -- Michal Čihař <nijel@debian.org>  Fri, 07 Apr 2017 16:54:26 +0200

phpmyadmin (4:4.6.6-3) unstable; urgency=medium

  * Set locales for tests to avoid problems with transliteration in glibc for
    C.UTF-8 (Closes: #859219).

 -- Michal Čihař <nijel@debian.org>  Tue, 04 Apr 2017 15:19:53 +0200

phpmyadmin (4:4.6.6-2) unstable; urgency=high

  * Apply upstream patch to fix not working
    $cfg['Servers'][$i]['AllowNoPassword'] (PMASA-2017-8).

 -- Michal Čihař <nijel@debian.org>  Thu, 30 Mar 2017 14:40:46 +0200

phpmyadmin (4:4.6.6-1) unstable; urgency=medium

  * New upstream release.
    - Multiple vulnerabilities in setup script (PMASA-2016-44).
    - Open redirect (PMASA-2017-1).
    - php-gettext code execution (PMASA-2017-2, CVE-2015-8980).
    - DOS vulnerabiltiy in table editing (PMASA-2017-3).
    - CSS injection in themes (PMASA-2017-4).
    - Cookie attribute injection attack (PMASA-2017-5).
    - SSRF in replication (PMASA-2017-6).
    - DOS in replication status (PMASA-2017-7).

 -- Michal Čihař <nijel@debian.org>  Tue, 24 Jan 2017 09:14:39 +0100

phpmyadmin (4:4.6.5.2-1) unstable; urgency=medium

  * New upstream release.
  * Remove allow_url_fopen setting, recommend php-curl as that's better way to
    support ReCaptcha or similar plugins.
  * Simplify dependency on php-gettext.
  * Properly work with both php-gettext and php-php-gettext packages as each
    of them installs library to different path.
  * Run testsuite during build, this includes dozen of upstream fixes for it.

 -- Michal Čihař <nijel@debian.org>  Tue, 06 Dec 2016 10:48:29 +0100

phpmyadmin (4:4.6.5.1-1) unstable; urgency=high

  * New upstream release, fixing several security issues:
    - Unsafe generation of $cfg['blowfish_secret']
      (PMASA-2016-58, CVE-2016-9847)
    - phpMyAdmin's phpinfo functionality is removed
      (PMASA-2016-59, CVE-2016-9848)
    - AllowRoot and allow/deny rule bypass with specially-crafted username
      (PMASA-2016-60, CVE-2016-9849)
    - Username matching weaknesses with allow/deny rules
      (PMASA-2016-61, CVE-2016-9850)
    - Possible to bypass logout timeout
      (PMASA-2016-62, CVE-2016-9851)
    - Full path disclosure (FPD) weaknesses
      (PMASA-2016-63, CVE-2016-9852, CVE-2016-9853, CVE-2016-9854, CVE-2016-9855)
    - Multiple XSS weaknesses
      (PMASA-2016-64, CVE-2016-9856, CVE-2016-9857)
    - Multiple denial-of-service (DOS) vulnerabilities
      (PMASA-2016-65, CVE-2016-9858, CVE-2016-9859, CVE-2016-9860)
    - Possible to bypass white-list protection for URL redirection
      (PMASA-2016-66, CVE-2016-9861)
    - BBCode injection to login page
      (PMASA-2016-67, CVE-2016-9862)
    - Denial-of-service (DOS) vulnerability in table partitioning
      (PMASA-2016-68, CVE-2016-9863)
    - Multiple SQL injection vulnerabilities
      (PMASA-2016-69, CVE-2016-9864)
    - Incorrect serialized string parsing
      (PMASA-2016-70, CVE-2016-9865)
    - CSRF token not stripped from the URL
      (PMASA-2016-71, CVE-2016-9866)

 -- Michal Čihař <nijel@debian.org>  Mon, 28 Nov 2016 10:22:19 +0100

phpmyadmin (4:4.6.4+dfsg1-2) unstable; urgency=medium

  * Change suggests to prefer default-mysql-server.
  * Depend on php-php-gettext as the package has been renamed
    (Closes: #837507).
  * Deny direct access to template files.
  * Use HTTPS in the Vcs-* fields, and use the cgit frontend instead of
    gitweb
  * Use current email address in debian/doc-base and debian/copyright.
  * Remove obsolete PHP settings from Apache configuration.
  * Disable mbstring.func_overload in Apache configuration.
  * Added Korean debconf translation.
  * Updated Polish debconf translation.
  * Fix path to php-gettext library (Closes: #839923).

 -- Michal Čihař <nijel@debian.org>  Fri, 18 Nov 2016 18:14:21 +0100

phpmyadmin (4:4.6.4+dfsg1-1) unstable; urgency=high

  * Repacked sources to exclude non free sRGB profile.
  * Replace FollowSymLinks with SymLinksIfOwnerMatch to apache configuration.
  * Updated Chinese debconf translations.
  * Better generate blowfish_secret.
  * New upstream release, fixing several security issues:
    - Weaknesses with cookie encryption
      (PMASA-2016-29, CVE-2016-6606)
    - Multiple XSS vulnerabilities
      (PMASA-2016-30, CVE-2016-6607)
    - Multiple XSS vulnerabilities
      (PMASA-2016-31, CVE-2016-6608)
    - PHP code injection
      (PMASA-2016-32, CVE-2016-6609)
    - Full path disclosure
      (PMASA-2016-33, CVE-2016-6610)
    - SQL injection attack
      (PMASA-2016-34, CVE-2016-6611)
    - Local file exposure through LOAD DATA LOCAL INFILE
      (PMASA-2016-35, CVE-2016-6612)
    - Local file exposure through symlinks with UploadDir
      (PMASA-2016-36, CVE-2016-6613)
    - Path traversal with SaveDir and UploadDir
      (PMASA-2016-37, CVE-2016-6614)
    - Multiple XSS vulnerabilities
      (PMASA-2016-38, CVE-2016-6615)
    - SQL injection vulnerability as control user
      (PMASA-2016-39, CVE-2016-6616)
    - SQL injection vulnerability
      (PMASA-2016-40, CVE-2016-6617)
    - Denial-of-service attack through transformation feature
      (PMASA-2016-41, CVE-2016-6618)
    - SQL injection vulnerability as control user
      (PMASA-2016-42, CVE-2016-6619)
    - Verify data before unserializing
      (PMASA-2016-43, CVE-2016-6620)
    - SSRF in setup script
      (PMASA-2016-44, CVE-2016-6621)
    - Denial-of-service attack with $cfg['AllowArbitraryServer'] = true and
    persistent connections
      (PMASA-2016-45, CVE-2016-6622)
    - Denial-of-service attack by using for loops
      (PMASA-2016-46, CVE-2016-6623)
    - Possible circumvention of IP-based allow/deny rules with IPv6 and proxy
    server
      (PMASA-2016-47, CVE-2016-6624)
    - Detect if user is logged in
      (PMASA-2016-48, CVE-2016-6625)
    - Bypass URL redirection protection
      (PMASA-2016-49, CVE-2016-6626)
    - Referrer leak
      (PMASA-2016-50, CVE-2016-6627)
    - Reflected File Download
      (PMASA-2016-51, CVE-2016-6628)
    - ArbitraryServerRegexp bypass
      (PMASA-2016-52, CVE-2016-6629)
    - Denial-of-service attack by entering long password
      (PMASA-2016-53, CVE-2016-6630)
    - Remote code execution vulnerability when running as CGI
      (PMASA-2016-54, CVE-2016-6631)
    - Denial-of-service attack when PHP uses dbase extension
      (PMASA-2016-55, CVE-2016-6632)
    - Remove tode execution vulnerability when PHP uses dbase extension
      (PMASA-2016-56, CVE-2016-6633)

 -- Michal Čihař <nijel@debian.org>  Wed, 17 Aug 2016 10:05:21 +0200

# For older changelog entries, run 'apt-get changelog phpmyadmin'
