Thanks to visit codestin.com
Credit goes to github.com

Skip to content

do not expose PMA_VERSION in requests #15993

@hudecof

Description

@hudecof

Is your feature request related to a problem? Please describe.

In version 5.0.1, not tested on earlier versions, the PMA_VERSION is exposed by subsequent requests to the server.

For example https://<domain>/js/cross_framing_protection.js?v=5.0.1

See the code in Scripts.php->getDisplay(), wehere the version field is hardcoded to PMA_VERSION .

Describe the solution you'd like

To have any possibility to configure the version field, with fallback back to the PMA_VERSION.

Describe alternatives you've considered

From my point of view this is security bug, while you are exposing the PMA version. After any security issue you are giving to the attackers information about the version and all possible CVE.

None other alternatives have been considered.

Additional context

  • phpMyAdmin version: 5.0.1

Metadata

Metadata

Assignees

No one assigned

    Labels

    BugA problem or regression with an existing featureEnhancementA feature request for improving phpMyAdminhardening

    Type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions