phpMyAdmin work during the seventh week

This week was quite busy with a lot security fixes. At the beginning of the week 5 security vulnerabilities were reported and I spent most of Monday and Tuesday doing fixes, porting them to other branches, preparing security advisories and communicating with reporter, security team and CVE team.

Following are the list of security vulnerabilities fixed.

Security fixes
#4594 Path Traversal in File Inclusion of GIS Factory
#4595 Path Traversal can lead to leakage of line count
#4596 XSS through exception stack
#4597 XSS through pma_fontsize cookie
#4598 XSS in multi submit

During the week I was also engaged in usual bug fixing and following bug fixes are now ready to be released with the next release.

Bug fixes
#4057 db/table query string parameters no longer work
#4444 No insert statement produced in SQL export for queries with alias
#4591 Spinner in navigation running forever
#4599 Input field is erased after keyboard language switch
#4602 Exporting selected rows export all rows of the query
#4603 Field disabled when internal relations used

Additionally, I also attended to the following bugs.

Bugs attended
#4254 Unable to log in after timeout had been exceeded (cookie)
#4008 Unable to log back in after session expired
#3773 No tables shown because of privileges of views
#4367 Import status infinite loop
#4295 Problem when session expires while importing file

Towards the end of the week, I had a look at the token mismatch issue that were reported to us several time. I will update you on the progress of this in the next post.

phpMyAdmin work during the sixth week

During the week I mostly attended to bugs. Please find below the list of bugs fixed and attended during the week.

Bug fixes
#4582 Debug SQL works only for the first page
#4581 Some links in query_result doesn't work
#4404 Recordset return from procedure display nothing
#4584 Edit dialog for routines is too long for smaller displays
#4585 Multi query results not shown
#4588 Moving, renaming, dropping actions in table operations page results in token mismatch
#4589 Can not add new procedures

Bugs attended
#3588 X-WebKit-CSP Header breaks Safari
#3940 Content Security Policy errors with Safari 5.1
#4061 No error message when calling an insert stored procedure with too few parameters
#4590 "Browse Foreign Values" not working

In addition to the above I was occupied with upgrading the result showing for multiple queries. Earlier it is at a very primitive level where all the rows are shown without limiting and no additional browsing features present. I refactored the result showing mechanism to reuse it for the multiple queries. However, it was decided that the changes might make the upcoming release 4.3 unstable and now it is targeted for version 4.4. Here is the pull request

https://github.com/phpmyadmin/phpmyadmin/pull/1397

Following feature requests were also implemented during the week

Feature requests
#1556 Disabling Show all
#1553 InnoDB presently supports one FULLTEXT index creation at a time

phpMyAdmin work during the fifth week

I am back from the holiday going to GSoC Reunion and doing some wonderful sightseeing in the USA. During the fifth week of work (first week of November) I attended to  a mix of performance improvements as well as a couple of bug fixes.

I got access to the test server prepared by Ann + J.M. and could test the performance improvements done for the environments with thousands of databases. Even though I could achieve reasonable performance for privileged user, unprivileged users were still seeing long delays. Even 'SHOW DATABASES' queries were as slow as queries on information_schema. The only fast query to access database list was 'SHOW DATABASES LIKE '<db_name>' queries. So the navigation was updated to parse the GRANTS for the user to identify the database he/she has access to and those were used with 'SHOW DATABASES LIKE' queries to get the list of databases.

In addition to the above I attended to the following fixes during the week.

Bug fixes
#4577 Multi row actions causes full page reloads
#3481 Designer relations in IE 8 - partial fix
#4582 Debug SQL works only for the first page

Bugs attended
#3046 Tracking + MySQL interactive_timeout yields error
#3554 copy paste with middle mouseclick in colored sqlbox
#3073 auth_type signon - odd behaviour at ex- and importing

Security fixes
#4578 Undisclosed vulnerability
#4579 Undisclosed vulnerability

Refactoring
Refactoring Node class of the navigation

P.S: I was on leave on Friday due to personal reasons

phpMyAdmin work during the third week

This blog post was due for sometime. However, I couldn't write it since I was busy attending the GSoC Reunion and doing some sight seeing in the USA afterwards.

During the third week of work I continued to focus on stabilizing the code for upcoming version 4.3 release. I was mainly attending to performance improvements related to the usage of information_schema. Following are the bugs addressed by the performance improvements

#3869 Count(*) on information_scheme.INNODB_BUFFER_PAGE with a huge bufferpool
#4243 Super slow page rendering with tens of thousands of DBs
#4513 phpmyadmin run very slow (information_schema)

Additionally hide_db, only_db directives were fixed as part of performance improvements fixing the following bug

#3820 hide_db, only_db not working in left panel

Further following bugs were also fixed

#4259 reCaptcha sound session expired problem
#4560 PHP error on master branch
#4564 Designer: spaces in table name with edit table link generates bad links
#4557 PHP fatal error
#4568 Date displayed incorrectly when charting a timeline
#4561 PHP error in transformations
#4431 Wiki page on charts is out of date

Two security issues were also identified and fixed during the third week.

#4562 XSS in debug SQL output
#4563 XSS in monitor query analyzer

phpMyAdmin work during the second week

The second week of my work was relatively a short one since I had to take 2 days (8th Oct Wednesday and 13th Oct Monday) off. So effectively I only worked for 3 days (9th, 10th and 14th) during the second week.

As suggested in the monthly IRC meeting I focused more on stabilizing the code for the upcoming alpha release of version 4.3. I stated with performance improvements related to the usage of information_schema which was a problem since version 4.1. The work carried out can be found at pull request 1375 [1]

In addition to that the following bug was fixed.
#4556 Fast filters for tables, views etc. should be governed by NavigationTreeDisplayItemFilterMinimum

I also did some bug tracker clean up which which resulted in me attending to the following bugs
#3154 No db table entry for users with table_priv only and no host
#4277 Export problems - low execution time
#3165 Redundant Foreign Keys not supported

[1] https://github.com/phpmyadmin/phpmyadmin/pull/1375

Working for phpMyAdmin and my work during the first week

I started working for phpMyAdmin on 1st October after my work proposal got selected for the phpMyAdmin Developer Position (one year contract). Here I am blogging about what I did during the first week. However, going forward I will probably write my blog posts during weekends rather than mid week.

Anyways, here is what I did during the last week.

Bug fixes
#4259 reCaptcha sound session expired problem
#4547 Micro history does not work in Users page
#4548 Inline editing a field converts tab to spaces
#4551 Wrong test in source code
#4552 Incorrect routines display for database due to case insensitive checks
#4553 Add index dialog does not open on choosing index from create table
#4537 BLOB inline-view JPG column transformation does not work for anything except simple queries
#4252 Database-level permission bug for db names containing underscores
#3120 events are not exported when using xml

Bug investigations
#4303 "New" link in navi panel is shown even if no privileges (out of date)
#4309 Cannot create/edit events and procedures (out of date)
#4495 Comment lines in multiquery
#4255 Can't enter when session die
#3154 No db table entry for users with table_priv only and no host

Feature requests
#1542 Better error reporting in Designer; can get stuck Processing

Security issues
#4544 XSS vulnerabilities in table search and table structure pages

Refactoring
Users page refactoring

Improvements
Proper privilege checks in procudures, events and triggers to enable editing, adding new ones
Various coding style and doc improvements

Retrospect - continued...

If you missed the first part of this post you can find it here.

Last week I concluded the blog post telling you how my FOSS life began with phpMyAdmin. It was just after the GSoC and the team was preparing to release the version 3.4 of phpMyAdmin. There was a lot of testing going on, bringing a continuous stream of bugs. This was a good opportunity for me to get a good hang of the code. I fixed quite a number of bugs. None of the alpha, beta or a release candidate version went without a fix from me. Version 3.4 was released soon and it was quite fascinating to see people using what you have contributed.

I was still an undergrad and wanted to take part in the 2011 version of GSoC. Initially I wasn’t sure whether I could apply under phpMyAdmin since I was already a team member. However Marc Delisle, one of the project admins helped me clear my doubts and I chose to apply for project idea that was due for some time. The project was about supporting geographical data types in phpMyAdmin. My knowledge on the area was very limited, so I started doing my own little research. I tried out other database engines that had GIS support such as PostgreSQL and SQLServer and their clients. This helped me write a better proposal.

To my delight, the project got accepted. I was going to spend my entire summer with phpMyAdmin!!! Michal Čihař, the other project admin was my mentor. My project covered quite a lot of areas related to geographical data types in phpMyAdmin. It included providing an interface to enter geographic data, visualizing them, exporting them, importing from ESRI format for GIS data as well as searching with geographical data specific functions. This covered most of the areas of the phpMyAdmin code and by the end of the summer I was more confident with the code. GSoC was a great experience for me, getting to know my mentor, the team and community well.

2011 was quite an eventful year in my life. I graduated in December and started working. Of course this limited the hours I could put for phpMyAdmin, but I managed to contribute much during the weekends. Another very much looked forward to event was closing by. The team decided to meet in real life at FOSDEM 2012 in Brussels. All expenses covered visit to the best FOSS conference in Europe plus meeting the phpMyAdmin team!!! How cool is that!!! This was the first time I visited the Europe and this was an amazing experience to me. Subzero temperatures and snow was all new to me who is coming from a tropical country where the sun shines the whole year along. The conference was very rich with what it had to offer and it was a great opportunity for developing a closer friendship with my fellow team members. I did not forget to spend some time doing sightseeing in this beautiful country.

GSoC 2013 edition was another milestone in my Open Source life. I was asked by the phpMyAdmin team whether I would like to mentor a GSoC project. The proposal submission period was a one big rush with a lot of discussions going on in the developer’s mailing list and receiving a large number of patches. Students were digging into the code as phpMyAdmin required the potential candidates to display their familiarity with code by submitting patches for bugs or new features. Reviewing proposals was very interesting with proposals varying from students who did not even know what phpMyAdmin is written in to student who knew very well the product as well the their proposed projects.

I chose to co-mentor a project that was aimed at improving the testing mechanism and testing coverage of phpMyAdmin with Michal Čihař. It was indeed a very interesting project. It’s only when you are trying to write unit tests, you find the problems in the architecture. The student was willing to even improve the code by refactoring. He was enthusiastic about the project and quickly grabbed techniques like mocking for testing. It was a pleasure to co-mentor a student who’s enthusiastic and willing to learn. Even I learnt a lot on the technology front and from my co-mentor about mentoring a student.

So this is how my FOSS life started and evolved, thanks to GSoC. I’m contributing to the project to date and I never seem to get bored doing that. Since FOSDEM 2012 I have met the team members twice, once in picture perfect Switzerland and more recently in Germany. I have developed stronger friendships with my fellow team members and even visited them in their home countries and looking forward to receive them back in Sri Lanka. I am mentoring a GSoC project this year as well. All in all I find it very satisfying to being able to contribute to this great work.