Michal Čihař - Blog Archives for phpMyAdmin

Weekly phpMyAdmin contributions 2017-W01

First week in 2017 has been quite busy. There was usual amount of bug screening and fixing on phpMyAdmin, but I've attended other parts of the project as well.

The Docker container got big upgrade to Alpine 3.5 and PHP 7, so it will perform better thanks to performance improvements in PHP 7. Thanks to additional cleanups the image also got 3 MB smaller.

On the libraries side we've started using php-cs-fixer for code cleanup. It all started with pull request for SQL parser, but I've quickly added it to all libraries making the code consistent (this still doesn't apply to phpMyAdmin itself as it has historical mess with own coding style). While visiting SQL parser it got also bunch of fixes which were released as 3.4.16.

Handled issues:

Seven tools that help us develop Weblate

Weblate probably would not exist (or at least would be much harder to manage) without several services that help us to develop, improve and fix bugs in our code base.

Over the time the development world has become very relying on cloud services. As every change this has both sides - you don't have to run the service, but you also don't have control on the service. Personally I'd prefer to use more free software services, on the other side I really love this comfort and I'm lazy to setup things which I can get for free.

The list was written down mostly for showing up how we work and the services are not listed in any particular order. All of the services provide free offerings for free software projects or for limited usage.

GitHub

I guess there is not much to say here, it has become standard place to develop software - it has Git repositories, issue tracker, pull requests and several other features.

Travis CI

Running tests on every commit is something what will make you feel confident that you didn't break anything. Of course you still need to write the tests, but having them run automatically is really great help. Especially great for automatically checking pull requests.

AppVeyor

Continuous integration on Windows - it's still widely used platform with it's quirks, so it's really good idea to test there as well. With AppVeyor you can do that and it works pretty nicely.

Codecov

When running tests it's good to know how much of your code is covered by them. Codecov is one of the best interfaces I've seen for this. They are also able to merge coverage reports from multiple builds and platforms (for example for wlc we have combined coverage for Linux, OSX and Windows coming from Travis CI and AppVeyor builds).

SauceLabs

Unit testing is good, but the frontend testing in browser is also important. We run Selenium tests in several browsers in SauceLabs to verify that we haven't screwed up something from the user interface.

Read the Docs

Documentation is necessary for every project and having it built automatically is nice bonus.

Landscape

Doing code analysis is a way to avoid some problems which are not spot during testing. These can be code paths not covered by test or simply coding style issues. There are several such services, but Landscape is my favorite one right now.

Weekly phpMyAdmin contributions 2016-W51

Week before Christmas was pretty productive with dozen of fixed issues, merged pull requests and various code and infrastructure improvements.

There was nothing extraordinary in bug fixing. One thing worth mentioning is that we were again hit by another PHP weirdness - this time in the openssl library, which emits warnings as errors and stores them internally while the function works just fine and returns expected result. We didn't realize that not picking up the warnings will lead to MySQL connection failure when using SSL.

On the infrastructure side, I've automated updates to localized documentation, so it now automatically follows master (on daily basis), so it will no longer happen that it's forgotten to be updated for few months. As you can see, there is quite big amount of strings to translate there, so any help is welcome.

Also the SQL parser finally got it's translations, you are welcome to contribute there as well (it mostly covers syntax error messages).

This is last report for 2016, I'm spending this week with family and without computer :-).

Handled issues:

Weekly phpMyAdmin contributions 2016-W50

Last week was more focused on bug fixing in phpMyAdmin itself, though some of the libraries (like motranslator) got their attention as well. I've also finally looked at forgotten pull requests with new themes.

Especially OS X users will love fixing long outstanding bug with MySQL running in lower_case_table_names=2 mode. The MySQL server in this case returns table name in lower case in some situations and thus it didn't correctly compare with mixed case one. Hopefully this is fixed for now and I looking forward to another MySQL weirdness.

Another important fix is that future 4.6 releases will be compatible with PHP 7.1. We had the fixes ready in master branch, but 4.7.0 will be released in about three months, so it's better to push the fixes for new PHP version earlier (note that most of the errors were just in the testsuite, most of the code will work just fine).

Handled issues:

wlc 0.7

wlc 0.7, a command line utility for Weblate, has been just released. There are several new commands like translation file download or statistics fetching.

Full list of changes:

  • Added reset operation.
  • Added statistrics for project.
  • Added changes listing.
  • Added file downloads.

wlc is built on API introduced in Weblate 2.6 and still being in development, you need Weblate 2.10 for some feature (already available on our hosting offering). You can find usage examples in the wlc documentation.

Weblate 2.10

Quite on the schedule, Weblate 2.10 is out today. This release brings Git exporter module, improves support for machine translation services and adds various CSV exports and API interfaces.

Full list of changes:

  • Added quality check to check whether plurals are translated differently.
  • Fixed GitHub hooks for repositories with authentication.
  • Added optional Git exporter module.
  • Support for Microsoft Cognitive Services Translator API.
  • Simplified project and component user interface.
  • Added automatic fix to remove control chars.
  • Added per language overview to project.
  • Added support for CSV export.
  • Added CSV download for stats.
  • Added matrix view for quick overview of all translations
  • Added basic API for changes and units.
  • Added support for Apertium APy server for machine translations.

If you are upgrading from older version, please follow our upgrading instructions.

You can find more information about Weblate on https://weblate.org, the code is hosted on Github. If you are curious how it looks, you can try it out on demo server. You can login there with demo account using demo password or register your own user. Weblate is also being used on https://hosted.weblate.org/ as official translating service for phpMyAdmin, OsmAnd, Aptoide, FreedomBox, Weblate itself and many other projects.

Should you be looking for hosting of translations for your project, I'm happy to host them for you or help with setting it up on your infrastructure.

Further development of Weblate would not be possible without people providing donations, thanks to everybody who have helped so far! The roadmap for next release is just being prepared, you can influence this by expressing support for individual issues either by comments or by providing bounty for them.

Weekly phpMyAdmin contributions 2016-W49

My last week was about usual amount of bug screening and fixing. Overall it was quite calm bringing small progress in many areas and hard to highlight something.

There were also dozen of improvements to our Docker image, the most important being change to tags we provide - latest is now latest released version, while edge is getting changes from master branch (of docker repository, it still contains released phpMyAdmin).

Handled issues:

Weekly phpMyAdmin contributions 2016-W48

Last week was heavily focused on cleaning up our issue trackers. As you can see from huge list of issues I've closed there is always lot of things to handle. Many of those were not fixed though, it was just housekeeping of old questions where the submitter didn't come back after we've asked for clarification. On the code side there were some pull requests merges including those who needed non trivial fixes and authors didn't found time to implement them.

Another improvements were done on the Docker image, where several cleanups were done (more to follow this week).

Handled issues:

Weekly phpMyAdmin contributions 2016-W47

Last week we've finally managed to release phpMyAdmin 4.6.5 (and quickly followed by hotfix 4.6.5.1). This included several security fixes (see my comment on our security status yesterday and lot of bugfixes as we've really failed to release quickly this time. Next release should follow two month release schedule, so let's see how we will manage that.

There was some work on the code and libraries as well. The ShapeFile library has reached 1.0 milestone after several fixes and testsuite improvements, so if you are looking for PHP library to handle ESRI Shape Files, this is the best choice right now.

Handled issues:

phpMyAdmin security issues

You might wonder why there is so high number of phpMyAdmin security announcements this year. This situations has two main reasons and I will comment a bit on those.

First of all we've got quite a lot of attention of people doing security reviews this year. It has all started with Mozilla SOS Fund funded audit. It has discovered few minor issues which were fixed in the 4.6.2 release. However this was really just the beginning of the story and the announcement has attracted quite some attention to us. In upcoming weeks the security@phpmyadmin.net mailbox was full of reports and we really struggled to handle such amount. Handling that amount actually lead to creating more formalized approach to handling them as we clearly were no longer able to deal with them based on email only. Anyway most work here was done by Emanuel Bronshtein, who is really looking at every piece of our code and giving useful tips to harden our code base and infrastructure.

Second thing which got changed is that we release security announcements for security hardening even when there might not be any practical attack possible. Typical example here might be PMASA-2016-61, where using hash_equals is definitely safer, but even if the timing attack would be doable here, the practical result of figuring out admin configured allow/deny rules is usually not critical. Many of the issues also cover quite rare setups (or server misconfigurations, which we've silently fixed in past) like PMASA-2016-54 being possibly caused by server executing shell scripts shipped together with phpMyAdmin.

Overall phpMyAdmin indeed got safer this year. I don't think that there was any bug that would be really critical, on the other side we've made quite a lot of hardenings and we use current best practices when dealing with sensitive data. On the other side, I'm pretty sure our code was not in worse shape than any similarly sized projects with 18 years of history, we just become more visible thanks to security audit and people looked deeper into our code base.

Besides security announcements this all lead to generic hardening of our code and infrastructure, what might be not that visible, but are important as well:

  • All our websites are server by https only
  • All our releases are PGP signed
  • We actively encourage users to verify the downloaded files
  • All new Git tags are PGP signed as well