linux/meta-openembedded.git/meta-webserver/recipes-php, branch kirkstone

phpmyadmin: ignore CVE-2020-22452

2026-01-08T21:03:03+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2020-22452 The fix is present in the recipe version (5.1.4)[1] [1]: https://github.com/phpmyadmin/phpmyadmin/pull/16004/commits/ca42395ee4b2936d3702524f8fb8bec1e9502bc7 Signed-off-by: Gyorgy Sarvari

xdebug: upgrade 3.1.1 -> 3.1.5

2025-12-22T19:56:36+00:00

This update contains many bugfixes. Changelog: https://xdebug.org/updates#x_3_1_5 3.1.5: - Install documentation gives wrong arch for installation on M1 Macs - phpize --clean removes required clocks.m4 file - Constant defined with an enum case produce double "facet" attribute in context_get response - Crash when used with source guardian encoded files - Segfault in __callStatic() after FFI initialization 3.1.4: - Removing second call breakpoint with same function name - XDebug breaks the Symfony "PhpFilesAdapter" cache adapter - Possible use after free with GC Stats - Can't inspect ArrayObject storage elements - Segmentation fault in symfony cache - Debug session can be started with "XDEBUG_SESSION_START=anything" when xdebug.trigger_value is set - Warn when profiler_append is used together with zlib compression - Code coverage misses static array assignment lines 3.1.3: - evaling broken code (still) causes unhandled exception in PHP 7.4 - Memory leak when a trace file can't be opened because xdebug.trace_output_name is invalid - Slowdown when calling a function with long string parameters - Debugger creates XML with double facet attribute 3.1.2: - Segfault on fiber switch in finally block in garbage collected fiber - Crash when profile file can not be created - __debugInfo is not used for var_dump output - Segault on xdebug_get_function_stack inside a Fiber Signed-off-by: Gyorgy Sarvari

phpmyadmin: upgrade 5.1.3 -> 5.1.4

2025-12-22T19:56:35+00:00

Last bugfix release of the 5.1.x series. Changelog: - Fixed sorting the database list with "statistics" enabled on "Data" column creates a PHP type error - Fix for invalid cache when losing access to config storage after it being cached - Fix session cookie not respecting the CookieSameSite configuration directive in PHP 7.2 - Fix create index form accepting too many columns - Disable editing to system schemas - Add better error handling when IndexedDB is not working - Fixed incorrect escaping of special MySQL characters on some pages - Fix GIS visualization with an edited query - Remove the use of the deprecated `strftime` function in OpenDocument exports - Enable tabindex recompute on preview button while insert new rows - Fix invalid SQL generated when PRIMARY/UNIQUE key contains a POINT column - Fix setup's CSS not loading when the URL doesn't have a trailing slash - Remove jQuery SVG JavaScript dependency - Fix column visibility dropdown when the column name is too long - Fix issue when exporting using Firefox or Safari on PHP 8.1.4 - Update JavaScript dependencies - Fix case where errors were thrown when browsing a table - Fix UI issue when user accounts page has the initials navigation bar Signed-off-by: Gyorgy Sarvari

phpmyadmin: fix CVE-2025-24529/CVE-2025-24530

2025-02-09T15:58:44+00:00

CVE-2025-24529: An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the Insert tab. Refer: https://nvd.nist.gov/vuln/detail/CVE-2025-24529 CVE-2025-24530: An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name could be used for XSS. Refer: https://nvd.nist.gov/vuln/detail/CVE-2025-24530 Signed-off-by: Changqing Li Signed-off-by: Armin Kuster

phpmyadmin: fix CVE-2023-25727

2023-04-04T13:04:49+00:00

In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-25727 Upstream patch: https://github.com/phpmyadmin/phpmyadmin/commit/efa2406695551667f726497750d3db91fb6f662e Signed-off-by: Dragos-Marian Panait Signed-off-by: Joe Slater Signed-off-by: Armin Kuster

recipes: Update LICENSE variable to use SPDX license identifiers

2022-03-05T01:41:45+00:00

Signed-off-by: Khem Raj

phpmyadmin: upgrade 5.1.2 -> 5.1.3

2022-02-23T17:25:19+00:00

Changelog: ========= - Fix broken pagination links in the navigation sidebar - Fix MariaDB has no support for system variable "disabled_storage_engines" - Fix unsupported operand types in Results.php when running "SHOW PROCESSLIST" SQL query - Fixed importing browser settings question box after login when having no pmadb - Fix "First day of calendar" user override has no effect - Fixed repeating headers are not working - Fixed import of email-adresses or links from ODS results in empty contents - Fixed a type error on ODS import with non string values - Fixed header row show/hide columns buttons on each line after hover are shown on each row - [security] Fix for path disclosure under certain server configurations (if display_errors is on, for instance) Signed-off-by: Zheng Ruoqin Signed-off-by: Khem Raj

phpmyadmin: upgrade 5.1.1 -> 5.1.2

2022-01-25T17:13:09+00:00

License-Update: Change JS Foundation to OpenJS Foundation Signed-off-by: Yi Zhao Signed-off-by: Khem Raj

xdebug: upgrade 2.9.5 -> 3.1.1

2021-10-20T03:03:08+00:00

Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj

phpmyadmin: upgrade 5.1.0 -> 5.1.1

2021-09-30T02:28:06+00:00

Release note: https://www.phpmyadmin.net/files/5.1.1/ Signed-off-by: Yi Zhao Signed-off-by: Khem Raj