发布日期: 2026-08-07
版本号: v6.0.0

本次更新主要涉及安全加固、功能修复与增强、跨浏览器兼容性改善以及多个数据库驱动的针对性优化。安全方面修复了多处XSS漏洞与CSRF防护，并加强了登录安全。核心功能上，优化了表格概览速度、SQL命令行操作、数据编辑与导出流程，并改进了分页、排序等交互细节。针对MySQL、PostgreSQL、SQLite、MS SQL、Redis、MongoDB、Elasticsearch及ClickHouse等不同数据库驱动，增强了特定功能支持并修复了相关问题。同时，移除了部分旧插件，新增了数个实用插件，并对内部构建流程与代码规范进行了整理与升级。

更新内容 （中文）

  • 在表结构中转义索引类型、算法和长度（XSS）
  • 转义事件计划和非数字表状态值（XSS）
  • 修复单语言版本中包含撇号的翻译
  • 转义在JavaScript中打印字符串时的<，包含<!--<script>的名称会导致页面中断
  • 登录：禁止访问接受任何密码的服务器（例如使用trust认证的PostgreSQL）
  • 登录：在节流代理请求的登录时建议使用login-reverse-proxy插件
  • 选择：禁止通过SQL操作符修改数据（CSRF）
  • 即使没有JavaScript也检查新版本
  • 修复Safari < 11和Firefox < 52中的JavaScript（5.5.0版本回归问题）
  • 修复Chrome < 61和Edge < 17中元素的显示和隐藏（5.1.0版本回归问题）
  • 将AJAX请求的JSON响应作为application/json而非text/javascript发送
  • 按翻译后的语言名称排序语言
  • 修复Apple系统上未显示的复制到剪贴板图标
  • 在小屏幕上按Esc键关闭菜单
  • 移除对IIS 5和2008年FastCGI更新前的IIS 7.0的兼容性
  • 通过仅转义必要字符来缩短URL，例如where[0][col]而非where%5B0%5D%5Bcol%5D
  • 通过JavaScript发送GET表单以缩短其URL
  • 表概览：加速，在SQLite中显示总计，在MS SQL和Oracle中显示实际大小
  • 表结构：缩短长检查和生成的列
  • SQL命令：在结果表头中显示列类型
  • SQL命令：在所有驱动程序中显示行数
  • SQL命令：通过JavaScript将结果导出为CSV，无需重新运行查询（bug #1108，SF-760）
  • SQL命令：回滚未完成的事务，以免破坏后续查询
  • 修改表：无需页面刷新即可添加下一列
  • 修改表：拖动列时不要高亮其他移动手柄
  • 修改表：在触摸屏上移动列
  • 修改表：在文本区域中编辑多行列注释
  • 修改表、权限：如果没有更改任何内容，则不打印成功消息
  • 修改表、选择：如果字段数量可能超过max_input_vars，则发出警告
  • 修改视图、例程和类型：在PostgreSQL、SQLite、MS SQL中使用事务而非临时对象
  • 修改例程：修复修改名称超过42个字符的例程
  • 选择：点击页码图例后不再询问页码
  • 选择：在分页中高亮当前页
  • 选择：修复在历史记录中返回后选中的行数
  • 选择：在排序字段集中保持按聚合函数排序
  • 选择：在行复选框前显示编辑链接并将列右对齐
  • 选择：将修改链接移至修改字段集，在修改值前禁用保存
  • 选择：禁用二进制值的内联编辑
  • 选择：在Firefox中按Esc键清除搜索字段及其列
  • 选择：在所有驱动程序中导入CSV，而不仅限于那些有自己插入或更新行方式的驱动程序
  • 选择：修复在使用游标分页的驱动程序（Redis、SimpleDB）中加载更多数据
  • 选择：用所有通过等式搜索的列值预填充新项目，而不仅是外键
  • 编辑：错误后保留具有特殊字符名称的列值
  • 编辑：修复使用edit-foreign插件切换函数到SQL（bug #1254）
  • 编辑：隐藏没有参数的函数（例如now、uuid）的值字段
  • 编辑：修复在没有唯一键的表中编辑具有二进制列的行
  • 编辑：更改标识行的值后禁用保存并继续编辑
  • 选择、编辑：使用专用高亮器高亮JSON，而非JavaScript高亮器
  • 修复多个表CSV的TAR归档，它包含了视图和外键的SQL
  • 导出：在所有驱动程序中导出数据，而不仅限于能够运行生成的SELECT的驱动程序
  • 修复导入仅含数据的转储，表被逐个截断，其外键被重新创建
  • MySQL：如果login-ssl插件仅配置为其他驱动程序，则不使用SSL
  • MySQL：仅当获取数据库列表缓慢时才缓存
  • MySQL：将performance_schema和sys表链接到其文档
  • MySQL：修复无符号或zerofill的例程参数长度，再次支持MySQL < 8（bug #1312，5.4.4版本回归问题）
  • MySQL：修复使用PDO扩展在创建表页面上的警告
  • PostgreSQL：支持索引中的操作符类
  • PostgreSQL：不显示扩展创建的函数和类型
  • PostgreSQL：使用美元符号引号主体创建例程，以免被转义
  • PostgreSQL：修复修改具有数组或用户定义类型参数的函数
  • PostgreSQL：隐藏pg_catalog和pg_toast中的表操作和行编辑
  • PostgreSQL：支持范围类型（bug #1308）
  • PostgreSQL：在枚举旁边显示复合、域和范围类型
  • PostgreSQL：修改和重命名用户定义类型
  • PostgreSQL：无需重新创建即可向枚举类型添加值
  • PostgreSQL：导出所有用户定义类型，修复导出包含撇号的枚举值
  • PostgreSQL：在导出中一次删除所有表，以免外键、视图和类型阻止删除
  • PostgreSQL：一次删除选定的表，以免外键阻止删除
  • PostgreSQL：导出物化视图及其索引，之前作为普通视图导出
  • PostgreSQL：使用INSERT … ON CONFLICT导入CSV，而非每行两个查询
  • PostgreSQL：显示、修改和导出自动增量，仅导出名称异常的序列
  • PostgreSQL PDO：修复COPY … FROM stdin中的受影响行数
  • PostgreSQL、MS SQL：在select COUNT(*), COUNT(DISTINCT id)中显示两列
  • PostgreSQL、MS SQL：在数据库架构中高亮主键（5.1.0版本回归问题）
  • CockroachDB：不提供可延迟外键，不支持
  • SQLite：修复通过PDO处理二进制数据
  • MS SQL：将二进制字段视为blob（bug SF-369）
  • MS SQL：隐藏sys架构中的表操作和行编辑
  • MS SQL：修复克隆和插入具有标识列的行，表单提供了原始值
  • MS SQL：如果数据库没有排序规则，修复数据库概览上的错误
  • Elasticsearch、ClickHouse：使用默认端口
  • Elasticsearch：驱动程序不再是beta版，支持Elasticsearch 7、8和9
  • ClickHouse：修复可空列，修复默认值，显示服务器版本
  • ClickHouse：支持架构管理、内省和管理
  • MongoDB：针对登录中使用的数据库进行身份验证
  • MongoDB：不将字符串NULL视为NULL值
  • MongoDB：修改索引时显示主键列（5.4.0版本回归问题）
  • Redis：redis-cli语法中的SQL命令，打印已执行命令
  • Redis：redis-cli语法中打印二进制键和值
  • Redis：显示键的类型
  • SimpleDB：使用默认服务器
  • CSS：改进查询时间和深色模式的对比度
  • CSS：在表外显示重复的链接和行复选框，designs/adminer-border将其保留在内部
  • 编辑器：显示PHP识别的所有图像，设置其大小，延迟加载
  • 编辑器：修复在外键值为空时选择中的致命错误（5.1.1版本回归问题）
  • 编辑器：在外键非空的选择中不提供空选项，保存它会在数据库中失败
  • 设计：如果使用的设计与版本不匹配，在其旁边显示Adminer版本
  • 插件：dumpData()获取选择的部分而非查询，它通过Driver::select()选择行
  • 插件：方法importPrint()和importProcess()
  • 插件：方法verifyVersion()
  • 插件：方法commentValue()和commentInput()（bug #1233）
  • 插件：在已加载插件列表中显示驱动程序插件
  • 插件：在与版本不匹配的插件旁边显示Adminer版本
  • 插件：移除edit-calendar、tinymce、json-column、pretty-json-column、translation、email-table、dump-php、master-slave
  • 插件：当插件不是对象时，不会导致致命错误（bug TimWolla/docker-adminer#211）
  • 插件：修复编译版本中缺失的翻译
  • 驱动程序插件：不捆绑igdb和simpledb的语法高亮器，从adminer-plugins/jush-.js加载
  • 插件login-ip：默认允许本地主机，如果未指定X-Forwarded-For前缀，则要求请求未被代理
  • 插件login-password-less：允许插件密码也是某些服务器的密码
  • 插件menu-links：添加仅在悬停时显示选择链接和其他重复链接的选项
  • 新插件：从导入的CSV文件创建表
  • 新插件：在选择中显示图像，与Adminer编辑器中相同
  • 新插件：仅通过持有密码的密钥登录
  • 新插件：如果Adminer或数据库未在本地机器上运行，则通过红色条带警告

内部

  • 通过数据属性而非脚本元素注册JavaScript事件处理程序
  • 在functions.js而非内联脚本中注册事件处理程序
  • Composer：安装时初始化子模块
  • 移除Makefile，Composer脚本涵盖编译和清理
  • 将文档移至docs/，linter配置移至conf/，coverage.php移至tests/
  • 添加docs/versions.php测量所有版本的大小
  • 编码风格：将行包装至200个字符
  • 在系统临时目录中缓存PHP_CodeSniffer结果
  • PHPStan：检查编辑器，代码已通过的更多检查
  • 向所有驱动程序和编辑器添加类型声明
  • 使用命名常量而非其值
  • 编译：如果替换不匹配则退出
  • 编译：修复编译不支持SQL命令的驱动程序
  • 编译：使用英语翻译作为词典压缩翻译，节省21 kB
  • JavaScript中要求ES6，移除旧浏览器的变通方法
  • 使用标准JSDoc @param和@return语法
  • ESLint：通过composer安装，在composer check和CI中运行
  • ESLint：还检查编译到单个文件中的jush模块
  • 文档：值和二进制数据的处理、插件翻译、CSS更改不得破坏皮肤
  • 将Git master分支重命名为main
  • 通过composer test和CI运行命令行测试
  • 将端到端测试从Katalon Recorder转换为Playwright，通过composer e2e无头运行
  • 修复启用OPcache时将所有文件报告为完全覆盖的代码覆盖率

更新内容 （原始）

  • Escape index type, algorithm and length in table structure (XSS)
  • Escape event schedule and non-numeric table status values (XSS)
  • Fix translations containing an apostrophe in single language versions
  • Escape < in strings printed to JavaScript, a name containing <!–<script> broke the page
  • Login: Disallow accessing servers which accept any password (e.g. PostgreSQL with trust authentication)
  • Login: Suggest the login-reverse-proxy plugin when throttling logins of a proxied request
  • Select: Disallow modifying data by the SQL operator (CSRF)
  • Check for a new version even without JavaScript
  • Fix JavaScript in Safari < 11 and Firefox < 52 (regression from 5.5.0)
  • Fix showing and hiding elements in Chrome < 61 and Edge < 17 (regression from 5.1.0)
  • Send the JSON responses of AJAX requests as application/json instead of text/javascript
  • Sort languages by their translated name
  • Fix the copy to clipboard icon not displayed on Apple systems
  • Close the menu on small screens by Esc
  • Drop compatibility with IIS 5 and with IIS 7.0 before its 2008 FastCGI update
  • Shorten URLs by escaping only the necessary characters, e.g. where[0][col] instead of where%5B0%5D%5Bcol%5D
  • Send GET forms by JavaScript to shorten their URLs too
  • Tables overview: speed up, show totals in SQLite, real size in MS SQL, Oracle
  • Table structure: Shorten long checks and generated columns
  • SQL command: Show column type in result table header
  • SQL command: Show number of rows in all drivers
  • SQL command: Export result to CSV by JavaScript without re-running the query (bug #1108, SF-760)
  • SQL command: Rollback an unfinished transaction so that it doesn’t break the following queries
  • Alter table: Add next column without page reload
  • Alter table: Do not highlight other move handles while dragging a column
  • Alter table: Move columns on touch screens
  • Alter table: Edit multiline column comments in a textarea
  • Alter table, Privileges: Do not print a success message if nothing was changed
  • Alter table, Select: Warn if the number of fields can exceed max_input_vars
  • Alter view, routine and type: Use a transaction instead of a temporary object in PostgreSQL, SQLite, MS SQL
  • Alter routine: Fix altering a routine with a name longer than 42 characters
  • Select: Remove asking for the page number after clicking the Page legend
  • Select: Highlight the current page in the pagination
  • Select: Fix the number of selected rows after going back in history
  • Select: Keep sorting by an aggregation function in the Sort fieldset
  • Select: Show the edit link before the row checkbox and align the column to the right
  • Select: Move the Modify link to the Modify fieldset, disable Save until a value is modified
  • Select: Disable inline edit of binary values
  • Select: Clear the search field and its column by Esc in Firefox
  • Select: Import CSV in all drivers, not only in those with their own way to insert or update a row
  • Select: Fix Load more data in drivers paginating by a cursor (Redis, SimpleDB)
  • Select: Prefill New item with the values of all columns searched by equality, not only foreign keys
  • Edit: Keep values of columns with special characters in name after error
  • Edit: Fix switching function to SQL with the edit-foreign plugin (bug #1254)
  • Edit: Hide the value field for functions without arguments (e.g. now, uuid)
  • Edit: Fix editing rows with binary columns in tables without a unique key
  • Edit: Disable Save and continue edit after changing a value identifying the row
  • Select, Edit: Highlight JSON by a dedicated highlighter instead of the JavaScript one
  • Export: Fix the TAR archive of multiple tables in CSV, it contained SQL of views and foreign keys
  • Export: Export data in all drivers, not only in those able to run the generated SELECT
  • Export: Fix importing a dump with data only, the tables were truncated one by one and their foreign keys were re-created
  • MySQL: Do not use SSL if the login-ssl plugin is configured only for other drivers
  • MySQL: Cache the list of databases only if getting it is slow
  • MySQL: Link performance_schema and sys tables to their documentation
  • MySQL: Fix length of routine parameters with unsigned or zerofill, support MySQL < 8 again (bug #1312, regression from 5.4.4)
  • MySQL: Fix a warning on the Create table page with the PDO extension
  • PostgreSQL: Support operator classes in indexes
  • PostgreSQL: Do not show functions and types created by extensions
  • PostgreSQL: Create routines with a dollar quoted body so that it is not escaped
  • PostgreSQL: Fix altering functions with parameters of array or user-defined types
  • PostgreSQL: Hide table actions and row editing in pg_catalog and pg_toast
  • PostgreSQL: Support range types (bug #1308)
  • PostgreSQL: Show composite, domain and range types next to enums
  • PostgreSQL: Alter and rename user defined types
  • PostgreSQL: Add values to an enum type without re-creating it
  • PostgreSQL: Export all user defined types, fix exporting enum values containing an apostrophe
  • PostgreSQL: Drop all tables at once in export so that foreign keys, views and types don’t prevent the drop
  • PostgreSQL: Drop the selected tables at once so that foreign keys don’t prevent the drop
  • PostgreSQL: Export materialized views with their indexes, they were exported as plain views
  • PostgreSQL: Import CSV by INSERT … ON CONFLICT instead of two queries for each row
  • PostgreSQL: Show, alter and export Auto Increment, only sequences with an unusual name were exported
  • PostgreSQL PDO: Fix the number of affected rows in COPY … FROM stdin
  • PostgreSQL, MS SQL: Show two columns in select COUNT(*), COUNT(DISTINCT id)
  • PostgreSQL, MS SQL: Highlight primary keys in the database schema (regression from 5.1.0)
  • CockroachDB: Do not offer deferrable foreign keys, they are not supported
  • SQLite: Fix working with binary data through PDO
  • MS SQL: Treat binary fields as blob (bug SF-369)
  • MS SQL: Hide table actions and row editing in the sys schema
  • MS SQL: Fix cloning and inserting a row with an identity column, the form offered the original value
  • MS SQL: Fix error on the databases overview if a database has no collation
  • Elasticsearch, ClickHouse: Use default port
  • Elasticsearch: The driver is no longer beta, it works with Elasticsearch 7, 8 and 9
  • ClickHouse: Fix nullable columns, fix default values, show server version
  • ClickHouse: Support schema management, introspection and administration
  • MongoDB: Authenticate against the database used in login
  • MongoDB: Do not treat the string NULL as the NULL value
  • MongoDB: Show the primary key column when altering indexes (regression from 5.4.0)
  • Redis: SQL command in the redis-cli syntax, print executed commands
  • Redis: Print binary keys and values in the redis-cli syntax
  • Redis: Display the type of keys
  • SimpleDB: Use default server
  • CSS: Improve contrast of query time and dark mode
  • CSS: Display the repeated links and row checkboxes outside the table, designs/adminer-border keeps them inside
  • Editor: Display all images recognized by PHP, set their size, load them lazily
  • Editor: Fix a fatal error in select with an empty foreign key value (regression from 5.1.1)
  • Editor: Don’t offer an empty option in a select of a not null foreign key, saving it failed in the database
  • Designs: Show version of Adminer next to a used design not matching this version
  • Plugins: dumpData() gets the parts of the select instead of a query, it selects the rows by Driver::select()
  • Plugins: Methods importPrint() and importProcess()
  • Plugins: Method verifyVersion()
  • Plugins: Methods commentValue() and commentInput() (bug #1233)
  • Plugins: Show driver plugins in the list of loaded plugins
  • Plugins: Show version of Adminer next to plugins not matching this version
  • Plugins: Remove edit-calendar, tinymce, json-column, pretty-json-column, translation, email-table, dump-php, master-slave
  • Plugins: Do not fail with a fatal error when a plugin is not an object (bug TimWolla/docker-adminer#211)
  • Plugins: Fix missing translations in the compiled version
  • Driver plugins: Do not bundle the syntax highlighter of igdb and simpledb, load it from adminer-plugins/jush-<driver>.js
  • Plugin login-ip: Allow localhost by default, require the request to not be proxied if X-Forwarded-For prefixes are not specified
  • Plugin login-password-less: Allow the plugin password to be also the password of some server
  • Plugin menu-links: Add option to show the select link and other repeated links only on hover
  • New plugin: Create a table from an imported CSV file
  • New plugin: Display images in select, same as in Adminer Editor
  • New plugin: Log in only by a passkey holding the passwords
  • New plugin: Warn by a red strip if Adminer or the database doesn’t run on the local machine

Internal

  • Register JavaScript event handlers by a data attribute instead of a script element
  • Register the event handlers in functions.js instead of an inline script
  • Composer: Initialize submodules on install
  • Remove the Makefile, Composer scripts cover compiling and cleaning
  • Move documentation to docs/, linter configuration to conf/, coverage.php to tests/
  • Add docs/versions.php measuring the size of all releases
  • Coding style: Wrap lines to 200 characters
  • Cache PHP_CodeSniffer results in the system temp directory
  • PHPStan: Check the Editor, more checks which the code already passes
  • Add type declarations to all drivers and the Editor
  • Use named constants instead of their values
  • Compile: Exit if a replacement doesn’t match
  • Compile: Fix compiling a driver without support for the SQL command
  • Compile: Compress translations with the English translation as a dictionary, it saves 21 kB
  • Require ES6 in JavaScript, remove old browser workarounds
  • Use standard JSDoc @param and @return syntax
  • ESLint: Install it by composer install, run it in composer check and CI
  • ESLint: Check also the jush modules compiled into the single file
  • Docs: Handling of values and binary data, plugin translations, CSS changes must not break skins
  • Rename the Git master branch to main
  • Run the command line tests by composer test and in CI
  • Convert the end-to-end tests from Katalon Recorder to Playwright, run them headless by composer e2e
  • Fix the code coverage reporting all files as fully covered when OPcache is enabled

下载链接