Hi Paolo, > If you click to add a field or modify a table you are redirect to > the phppgadmin welcome page. You only can modify a table using the SQL > language.
This is a regression in the previous security update. I prepared an update to fix this issue. Attached the debdiff, you can also find dsc,diff.gz, and .deb here: http://sd6.iuculano.it/phppgadmin/ Could you confirm if etch2[1] revision fix this issue please? Sorry for the noise... [1]http://sd6.iuculano.it/phppgadmin/phppgadmin_4.0.1-3.1etch2_all.deb Cheers, Giuseppe.
diff -u phppgadmin-4.0.1/debian/changelog phppgadmin-4.0.1/debian/changelog --- phppgadmin-4.0.1/debian/changelog +++ phppgadmin-4.0.1/debian/changelog @@ -1,3 +1,11 @@ +phppgadmin (4.0.1-3.1etch2) stable-security; urgency=low + + * debian/patches/02_CVE-2007-2865_CVE-2007-5728.dpatch: Restore redirect + functionality and fix a regression introduced in the previous security + update. (Closes: #511759) + + -- Giuseppe Iuculano <[email protected]> Wed, 07 Jan 2009 16:54:10 +0100 + phppgadmin (4.0.1-3.1etch1) stable-security; urgency=high * Non-maintainer upload. diff -u phppgadmin-4.0.1/debian/patches/02_CVE-2007-2865_CVE-2007-5728.dpatch phppgadmin-4.0.1/debian/patches/02_CVE-2007-2865_CVE-2007-5728.dpatch --- phppgadmin-4.0.1/debian/patches/02_CVE-2007-2865_CVE-2007-5728.dpatch +++ phppgadmin-4.0.1/debian/patches/02_CVE-2007-2865_CVE-2007-5728.dpatch @@ -7,7 +7,7 @@ @DPATCH@ diff -urNad phppgadmin-4.0.1~/all_db.php phppgadmin-4.0.1/all_db.php --- phppgadmin-4.0.1~/all_db.php 2005-10-18 05:45:15.000000000 +0200 -+++ phppgadmin-4.0.1/all_db.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/all_db.php 2009-01-07 16:52:40.000000000 +0100 @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; @@ -18,7 +18,7 @@ * Display a form for alter and perform actual alter diff -urNad phppgadmin-4.0.1~/casts.php phppgadmin-4.0.1/casts.php --- phppgadmin-4.0.1~/casts.php 2005-10-18 05:45:15.000000000 +0200 -+++ phppgadmin-4.0.1/casts.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/casts.php 2009-01-07 16:52:40.000000000 +0100 @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; @@ -29,7 +29,7 @@ * Show default list of casts in the database diff -urNad phppgadmin-4.0.1~/constraints.php phppgadmin-4.0.1/constraints.php --- phppgadmin-4.0.1~/constraints.php 2005-10-18 05:45:15.000000000 +0200 -+++ phppgadmin-4.0.1/constraints.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/constraints.php 2009-01-07 16:52:40.000000000 +0100 @@ -11,7 +11,6 @@ include_once('./classes/class.select.php'); @@ -40,7 +40,7 @@ * Confirm and then actually add a FOREIGN KEY constraint diff -urNad phppgadmin-4.0.1~/conversions.php phppgadmin-4.0.1/conversions.php --- phppgadmin-4.0.1~/conversions.php 2005-10-18 05:45:15.000000000 +0200 -+++ phppgadmin-4.0.1/conversions.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/conversions.php 2009-01-07 16:52:40.000000000 +0100 @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; @@ -51,7 +51,7 @@ * Show default list of conversions in the database diff -urNad phppgadmin-4.0.1~/database.php phppgadmin-4.0.1/database.php --- phppgadmin-4.0.1~/database.php 2005-11-09 10:05:58.000000000 +0100 -+++ phppgadmin-4.0.1/database.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/database.php 2009-01-07 16:52:40.000000000 +0100 @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; @@ -62,7 +62,7 @@ return str_replace($term, "<b>{$term}</b>", $string); diff -urNad phppgadmin-4.0.1~/dataexport.php phppgadmin-4.0.1/dataexport.php --- phppgadmin-4.0.1~/dataexport.php 2005-10-18 05:45:16.000000000 +0200 -+++ phppgadmin-4.0.1/dataexport.php 2008-12-23 18:13:26.000000000 +0100 ++++ phppgadmin-4.0.1/dataexport.php 2009-01-07 16:52:40.000000000 +0100 @@ -307,7 +307,7 @@ $misc->printTitle($lang['strexport']); if (isset($msg)) $misc->printMsg($msg); @@ -74,7 +74,7 @@ // COPY and SQL require a table diff -urNad phppgadmin-4.0.1~/display.php phppgadmin-4.0.1/display.php --- phppgadmin-4.0.1~/display.php 2005-11-20 04:07:26.000000000 +0100 -+++ phppgadmin-4.0.1/display.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/display.php 2009-01-07 16:52:40.000000000 +0100 @@ -21,7 +21,6 @@ global $conf, $lang; @@ -85,7 +85,7 @@ * Show confirmation of edit and perform actual update diff -urNad phppgadmin-4.0.1~/domains.php phppgadmin-4.0.1/domains.php --- phppgadmin-4.0.1~/domains.php 2005-10-18 05:45:16.000000000 +0200 -+++ phppgadmin-4.0.1/domains.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/domains.php 2009-01-07 16:52:40.000000000 +0100 @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; @@ -96,7 +96,7 @@ * Function to save after altering a domain diff -urNad phppgadmin-4.0.1~/functions.php phppgadmin-4.0.1/functions.php --- phppgadmin-4.0.1~/functions.php 2005-10-18 05:45:16.000000000 +0200 -+++ phppgadmin-4.0.1/functions.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/functions.php 2009-01-07 16:52:40.000000000 +0100 @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; @@ -107,7 +107,7 @@ * Function to save after editing a function diff -urNad phppgadmin-4.0.1~/groups.php phppgadmin-4.0.1/groups.php --- phppgadmin-4.0.1~/groups.php 2005-10-18 05:45:16.000000000 +0200 -+++ phppgadmin-4.0.1/groups.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/groups.php 2009-01-07 16:52:40.000000000 +0100 @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; @@ -118,7 +118,7 @@ * Add user to a group diff -urNad phppgadmin-4.0.1~/indexes.php phppgadmin-4.0.1/indexes.php --- phppgadmin-4.0.1~/indexes.php 2005-10-18 05:45:16.000000000 +0200 -+++ phppgadmin-4.0.1/indexes.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/indexes.php 2009-01-07 16:52:40.000000000 +0100 @@ -11,7 +11,6 @@ include_once('./classes/class.select.php'); @@ -129,7 +129,7 @@ * Show confirmation of cluster index and perform actual cluster diff -urNad phppgadmin-4.0.1~/info.php phppgadmin-4.0.1/info.php --- phppgadmin-4.0.1~/info.php 2005-10-18 05:45:16.000000000 +0200 -+++ phppgadmin-4.0.1/info.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/info.php 2009-01-07 16:52:40.000000000 +0100 @@ -10,7 +10,6 @@ include_once('./libraries/lib.inc.php'); @@ -140,7 +140,7 @@ * List all the information on the table diff -urNad phppgadmin-4.0.1~/intro.php phppgadmin-4.0.1/intro.php --- phppgadmin-4.0.1~/intro.php 2005-05-02 17:47:24.000000000 +0200 -+++ phppgadmin-4.0.1/intro.php 2008-12-23 18:13:26.000000000 +0100 ++++ phppgadmin-4.0.1/intro.php 2009-01-07 16:52:40.000000000 +0100 @@ -19,7 +19,7 @@ <h1><?php echo "$appName $appVersion (PHP ". phpversion() .')' ?></h1> @@ -152,7 +152,7 @@ <?php diff -urNad phppgadmin-4.0.1~/languages.php phppgadmin-4.0.1/languages.php --- phppgadmin-4.0.1~/languages.php 2005-10-18 05:45:16.000000000 +0200 -+++ phppgadmin-4.0.1/languages.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/languages.php 2009-01-07 16:52:40.000000000 +0100 @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; @@ -162,8 +162,8 @@ /** * Show default list of languages in the database diff -urNad phppgadmin-4.0.1~/libraries/lib.inc.php phppgadmin-4.0.1/libraries/lib.inc.php ---- phppgadmin-4.0.1~/libraries/lib.inc.php 2008-12-23 18:13:04.000000000 +0100 -+++ phppgadmin-4.0.1/libraries/lib.inc.php 2008-12-23 18:13:36.000000000 +0100 +--- phppgadmin-4.0.1~/libraries/lib.inc.php 2009-01-07 16:52:40.000000000 +0100 ++++ phppgadmin-4.0.1/libraries/lib.inc.php 2009-01-07 16:52:40.000000000 +0100 @@ -221,4 +221,7 @@ } } @@ -174,7 +174,7 @@ ?> diff -urNad phppgadmin-4.0.1~/login.php phppgadmin-4.0.1/login.php --- phppgadmin-4.0.1~/login.php 2005-11-19 10:14:34.000000000 +0100 -+++ phppgadmin-4.0.1/login.php 2008-12-23 18:13:26.000000000 +0100 ++++ phppgadmin-4.0.1/login.php 2009-01-07 16:52:40.000000000 +0100 @@ -10,6 +10,8 @@ // This needs to be an include once to prevent lib.inc.php infinite recursive includes. // Check to see if the configuration file exists, if not, explain @@ -195,7 +195,7 @@ else $vars =& $_GET; diff -urNad phppgadmin-4.0.1~/operators.php phppgadmin-4.0.1/operators.php --- phppgadmin-4.0.1~/operators.php 2005-10-18 05:45:16.000000000 +0200 -+++ phppgadmin-4.0.1/operators.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/operators.php 2009-01-07 16:52:40.000000000 +0100 @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; @@ -206,7 +206,7 @@ * Show read only properties for an operator diff -urNad phppgadmin-4.0.1~/plugin_slony.php phppgadmin-4.0.1/plugin_slony.php --- phppgadmin-4.0.1~/plugin_slony.php 2005-11-09 10:05:58.000000000 +0100 -+++ phppgadmin-4.0.1/plugin_slony.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/plugin_slony.php 2009-01-07 16:52:40.000000000 +0100 @@ -20,7 +20,6 @@ include_once('./libraries/lib.inc.php'); @@ -217,7 +217,7 @@ if (isset($_REQUEST['slony_cluster'])) { diff -urNad phppgadmin-4.0.1~/privileges.php phppgadmin-4.0.1/privileges.php --- phppgadmin-4.0.1~/privileges.php 2005-10-18 05:45:16.000000000 +0200 -+++ phppgadmin-4.0.1/privileges.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/privileges.php 2009-01-07 16:52:40.000000000 +0100 @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; @@ -226,9 +226,21 @@ /** * Grant permissions on an object to a user +diff -urNad phppgadmin-4.0.1~/redirect.php phppgadmin-4.0.1/redirect.php +--- phppgadmin-4.0.1~/redirect.php 2005-05-02 17:47:24.000000000 +0200 ++++ phppgadmin-4.0.1/redirect.php 2009-01-07 16:53:28.000000000 +0100 +@@ -8,7 +8,7 @@ + + $url = parse_url($misc->getLastTabURL($subject)); + +- $_SERVER['PHP_SELF'] = $url['path']; ++ $PHP_SELF = $url['path']; + + // Load query vars into superglobal arrays + if (isset($url['query'])) { diff -urNad phppgadmin-4.0.1~/reports.php phppgadmin-4.0.1/reports.php --- phppgadmin-4.0.1~/reports.php 2005-10-18 05:45:16.000000000 +0200 -+++ phppgadmin-4.0.1/reports.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/reports.php 2009-01-07 16:52:40.000000000 +0100 @@ -10,7 +10,6 @@ include_once('./libraries/lib.inc.php'); @@ -239,7 +251,7 @@ * Displays a screen where they can edit a report diff -urNad phppgadmin-4.0.1~/rules.php phppgadmin-4.0.1/rules.php --- phppgadmin-4.0.1~/rules.php 2005-10-18 05:45:16.000000000 +0200 -+++ phppgadmin-4.0.1/rules.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/rules.php 2009-01-07 16:52:40.000000000 +0100 @@ -10,7 +10,6 @@ include_once('./libraries/lib.inc.php'); @@ -250,7 +262,7 @@ * Confirm and then actually create a rule diff -urNad phppgadmin-4.0.1~/schemas.php phppgadmin-4.0.1/schemas.php --- phppgadmin-4.0.1~/schemas.php 2005-10-18 06:00:19.000000000 +0200 -+++ phppgadmin-4.0.1/schemas.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/schemas.php 2009-01-07 16:52:40.000000000 +0100 @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; @@ -261,7 +273,7 @@ * Show default list of schemas in the database diff -urNad phppgadmin-4.0.1~/sequences.php phppgadmin-4.0.1/sequences.php --- phppgadmin-4.0.1~/sequences.php 2005-10-18 05:45:16.000000000 +0200 -+++ phppgadmin-4.0.1/sequences.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/sequences.php 2009-01-07 16:52:40.000000000 +0100 @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; @@ -272,7 +284,7 @@ * Display list of all sequences in the database/schema diff -urNad phppgadmin-4.0.1~/servers.php phppgadmin-4.0.1/servers.php --- phppgadmin-4.0.1~/servers.php 2005-10-18 06:00:19.000000000 +0200 -+++ phppgadmin-4.0.1/servers.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/servers.php 2009-01-07 16:52:40.000000000 +0100 @@ -12,7 +12,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; @@ -283,7 +295,7 @@ global $misc, $lang, $_reload_browser; diff -urNad phppgadmin-4.0.1~/sql.php phppgadmin-4.0.1/sql.php --- phppgadmin-4.0.1~/sql.php 2005-06-16 16:40:11.000000000 +0200 -+++ phppgadmin-4.0.1/sql.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/sql.php 2009-01-07 16:52:40.000000000 +0100 @@ -87,8 +87,6 @@ exit; } @@ -295,7 +307,7 @@ $misc->printTrail('database'); diff -urNad phppgadmin-4.0.1~/sqledit.php phppgadmin-4.0.1/sqledit.php --- phppgadmin-4.0.1~/sqledit.php 2005-10-18 05:45:16.000000000 +0200 -+++ phppgadmin-4.0.1/sqledit.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/sqledit.php 2009-01-07 16:52:40.000000000 +0100 @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; @@ -306,7 +318,7 @@ * Private function to display server and list of databases diff -urNad phppgadmin-4.0.1~/tables.php phppgadmin-4.0.1/tables.php --- phppgadmin-4.0.1~/tables.php 2005-10-18 05:45:16.000000000 +0200 -+++ phppgadmin-4.0.1/tables.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/tables.php 2009-01-07 16:52:40.000000000 +0100 @@ -10,7 +10,6 @@ include_once('./libraries/lib.inc.php'); @@ -317,7 +329,7 @@ * Displays a screen where they can enter a new table diff -urNad phppgadmin-4.0.1~/tablespaces.php phppgadmin-4.0.1/tablespaces.php --- phppgadmin-4.0.1~/tablespaces.php 2005-10-18 05:45:16.000000000 +0200 -+++ phppgadmin-4.0.1/tablespaces.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/tablespaces.php 2009-01-07 16:52:40.000000000 +0100 @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; @@ -328,7 +340,7 @@ * Function to allow altering of a tablespace diff -urNad phppgadmin-4.0.1~/tblproperties.php phppgadmin-4.0.1/tblproperties.php --- phppgadmin-4.0.1~/tblproperties.php 2005-10-18 05:45:16.000000000 +0200 -+++ phppgadmin-4.0.1/tblproperties.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/tblproperties.php 2009-01-07 16:52:40.000000000 +0100 @@ -10,7 +10,6 @@ include_once('./libraries/lib.inc.php'); @@ -339,7 +351,7 @@ * Function to save after altering a table diff -urNad phppgadmin-4.0.1~/triggers.php phppgadmin-4.0.1/triggers.php --- phppgadmin-4.0.1~/triggers.php 2005-10-18 05:45:16.000000000 +0200 -+++ phppgadmin-4.0.1/triggers.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/triggers.php 2009-01-07 16:52:40.000000000 +0100 @@ -11,7 +11,6 @@ include_once('./classes/class.select.php'); @@ -350,7 +362,7 @@ * Function to save after altering a trigger diff -urNad phppgadmin-4.0.1~/types.php phppgadmin-4.0.1/types.php --- phppgadmin-4.0.1~/types.php 2005-10-18 05:45:16.000000000 +0200 -+++ phppgadmin-4.0.1/types.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/types.php 2009-01-07 16:52:40.000000000 +0100 @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; @@ -361,7 +373,7 @@ * Show read only properties for a type diff -urNad phppgadmin-4.0.1~/users.php phppgadmin-4.0.1/users.php --- phppgadmin-4.0.1~/users.php 2005-10-18 05:45:16.000000000 +0200 -+++ phppgadmin-4.0.1/users.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/users.php 2009-01-07 16:52:40.000000000 +0100 @@ -11,7 +11,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; @@ -372,7 +384,7 @@ * If a user is not a superuser, then we have an 'account management' page diff -urNad phppgadmin-4.0.1~/viewproperties.php phppgadmin-4.0.1/viewproperties.php --- phppgadmin-4.0.1~/viewproperties.php 2005-10-18 05:45:16.000000000 +0200 -+++ phppgadmin-4.0.1/viewproperties.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/viewproperties.php 2009-01-07 16:52:40.000000000 +0100 @@ -10,7 +10,6 @@ include_once('./libraries/lib.inc.php'); @@ -383,7 +395,7 @@ * Function to save after editing a view diff -urNad phppgadmin-4.0.1~/views.php phppgadmin-4.0.1/views.php --- phppgadmin-4.0.1~/views.php 2005-10-18 05:45:16.000000000 +0200 -+++ phppgadmin-4.0.1/views.php 2008-12-23 18:13:36.000000000 +0100 ++++ phppgadmin-4.0.1/views.php 2009-01-07 16:52:40.000000000 +0100 @@ -12,7 +12,6 @@ $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : '';
signature.asc
Description: OpenPGP digital signature
