From 2a56aad03612ccbbc84bd269c80dd0d21e36622b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lo=C3=AFc=20Chapeaux?= <lolo@phpheaven.net>
Date: Sat, 27 Oct 2001 12:09:54 +0000
Subject: [PATCH] "SELECT" privilege on the "Password" field is no long
 required for the standard user

---
 ChangeLog                 |  6 ++++++
 libraries/common.lib.php3 | 34 +++++++++++++++++++---------------
 main.php3                 |  2 +-
 3 files changed, 26 insertions(+), 16 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index d2ab07061..47878328c 100755
--- a/ChangeLog
+++ b/ChangeLog
@@ -9,6 +9,12 @@ $Source$
 2001-10-27  Loïc Chapeaux  <lolo@phpheaven.net>
 	* read_dump.php3, lines 286-288; lang/*: "there is no query" were displayed
 	  when deleting a bookmark.
+	* Documentation.php3; main.php3; libraries/common.lib.php3: feature request
+	  #??? (will update this whn SF is up) - Improved security by no long
+	  requiring the "SELECT" privilege on the "Password" field for the standard
+	  user.
+	* Documentation.html: added faq entries about a Xitami 2.5b4 bug and a
+	  widespread IIS misconfiguration problem.
 
 2001-10-27  Olivier Müller  <om@omnis.ch>
 	* config.inc.php3: put the ENCRYPT function back to the config file.
diff --git a/libraries/common.lib.php3 b/libraries/common.lib.php3
index 67ba4d4b7..1c5341b52 100644
--- a/libraries/common.lib.php3
+++ b/libraries/common.lib.php3
@@ -104,36 +104,42 @@ if (!defined('__LIB_COMMON__')){
 
     // For compatibility with old config.inc.php3
     if (!isset($cfgShowStats)) {
-        $cfgShowStats         = TRUE;
+        $cfgShowStats           = TRUE;
     }
     if (!isset($cfgShowTooltip)) {
-        $cfgShowTooltip       = TRUE;
+        $cfgShowTooltip         = TRUE;
     }
     if (!isset($cfgShowAll)) {
-        $cfgShowAll           = FALSE;
+        $cfgShowAll             = FALSE;
+    }
+    if (!isset($cfgNavigationBarIconic)) {
+        $cfgNavigationBarIconic = TRUE;
     }
     if (!isset($cfgProtectBinary)) {
         if (isset($cfgProtectBlob)) {
-            $cfgProtectBinary = ($cfgProtectBlob ? 'blob' : FALSE);
+            $cfgProtectBinary   = ($cfgProtectBlob ? 'blob' : FALSE);
             unset($cfgProtectBlob);
         } else {
-            $cfgProtectBinary = 'blob';
+            $cfgProtectBinary   = 'blob';
         }
     }
     if (!isset($cfgZipDump)) {
-        $cfgZipDump           = (isset($cfgGZipDump) ? $cfgGZipDump : TRUE);
+        $cfgZipDump             = (isset($cfgGZipDump) ? $cfgGZipDump : TRUE);
     }
     if (!isset($cfgLeftBgColor)) {
-        $cfgLeftBgColor       = '#D0DCE0';
+        $cfgLeftBgColor         = '#D0DCE0';
     }
     if (!isset($cfgRightBgColor)) {
-        $cfgRightBgColor      = '#F5F5F5';
+        $cfgRightBgColor        = '#F5F5F5';
+    }
+    if (!isset($cfgPointerColor)) {
+        $cfgPointerColor        = '#CCFFCC';
     }
     if (!isset($cfgTextareaCols)) {
-        $cfgTextareaCols      = 40;
+        $cfgTextareaCols        = 40;
     }
     if (!isset($cfgTextareaRows)) {
-        $cfgTextareaRows      = 7;
+        $cfgTextareaRows        = 7;
     }
 
     // Adds a trailing slash et the end of the phpMyAdmin uri if it does not
@@ -527,7 +533,7 @@ if (!defined('__LIB_COMMON__')){
                 if (ereg($re, $dblist[$i])) {
                     $local_query = 'SHOW DATABASES LIKE \'' . $dblist[$i] . '\'';
                     $rs          = mysql_query($local_query, $dbh);
-                    // "SHOW DATABASES" statements are disabled
+                    // "SHOW DATABASES" statement is disabled
                     if ($i == 0
                         && (mysql_error() && mysql_errno() == 1045)) {
                         $true_dblist   = $dblist;
@@ -555,11 +561,9 @@ if (!defined('__LIB_COMMON__')){
         // 'only_db' is empty for the current user -> checks for available
         // databases in the "mysql" db
         else {
-            $auth_query = 'SELECT User, Password, Select_priv '
+            $auth_query = 'SELECT User, Select_priv '
                         . 'FROM mysql.user '
-                        . 'WHERE '
-                        .    'User = \'' . sql_addslashes($cfgServer['user']) . '\' '
-                        .    'AND Password = PASSWORD(\'' . sql_addslashes($cfgServer['password']) . '\')';
+                        . 'WHERE User = \'' . sql_addslashes($cfgServer['user']) . '\'';
             $rs         = mysql_query($auth_query, $dbh); // Debug: or mysql_die('', $auth_query, FALSE);
         } // end if
 
diff --git a/main.php3 b/main.php3
index 8c979f756..a07b7027b 100755
--- a/main.php3
+++ b/main.php3
@@ -161,7 +161,7 @@ if ($server > 0)
     $is_reload_priv  = FALSE;
     $is_superuser    = @mysql_query('USE mysql', $userlink);
     if ($dbh) {
-        $local_query = 'SELECT * FROM mysql.user WHERE User = \'' . sql_addslashes($cfgServer['user']) . '\'';
+        $local_query = 'SELECT Create_priv, Process_priv, Reload_priv FROM mysql.user WHERE User = \'' . sql_addslashes($cfgServer['user']) . '\' OR User = \'\'';
         $rs_usr      = mysql_query($local_query, $dbh); // Debug: or mysql_die('', $local_query, FALSE);
         if ($rs_usr) {
             $result_usr      = mysql_fetch_array($rs_usr);