发布日期: 2026-08-14
版本号: v6.0.1

Adminer的更新主要涵盖安全加固、功能优化和内部改进三方面。安全方面修复了CSRF验证漏洞（登录、查询终止等场景）、密码处理策略、会话cookie属性及跨站请求防护。功能上增强了多数据库支持（如MySQL协作排序、PostgreSQL复合键编辑、MS SQL多结果集显示、Elasticsearch/OpenSearch/Redis适配）、改进了数据编辑体验（保持JSON值、批量事务操作、文件上传进度）、优化了界面一致性（字体样式、表结构可视化）。同时更新了多个插件（如登录认证、驱动集成）并完善了内部开发规范，包括模块化重组、测试覆盖扩展和代码质量检测工具链的整合。

更新内容 （中文）

  • 仅从 adminer/ 目录运行开发版本，可复制至任意位置并使用任何名称
  • 发送带有 SameSite=lax 属性的会话 Cookie，未默认使用此属性的浏览器也会跨站发送
  • 为 JavaScript 设置的 Cookie 添加与其他 Cookie 相同的属性
  • 保存行数据后不重定向至 Adminer 外部
  • 不将无凭证的请求计为失败登录
  • 当服务器接受任意密码时，使用其自身消息而非缺少密码提示进行报告（缺陷 #1318）
  • 当数据库可无密码访问时，打印 Adminer\Password 配置信息
  • 以文本而非 HTML 格式打印帮助内容
  • 登录时验证 CSRF 令牌
  • 在终止客户端超时查询前验证 CSRF 令牌
  • 对无效 CSRF 令牌和过大 POST 数据发送错误 HTTP 状态码
  • 在 <textarea> 中使用与 <input> 相同的字体，在 SQL 命令和 JSON 值中保持等宽字体
  • 自动补全：禁用不使用 SQL 的驱动程序（如 Redis）
  • 自动补全：仅提供触发器中允许的语句，检查约束中不提供语句
  • 建表：在不使用 SQL 的驱动程序（如 Elasticsearch）中打印成功消息（6.0.0 版本后的回归问题）
  • 数据库架构：按外键将表排列在网格中，而非单列显示
  • 数据库架构：不显示被 tableName() 隐藏的表及其引用
  • 查询：仅搜索可容纳搜索值的列，将其他类型转换为文本（缺陷 #1216）
  • 查询：在事务中修改或删除多行数据
  • 编辑：错误发生后保留用户输入的 JSON 值，无效时此前会被替换为 null
  • 编辑：打印获取行的查询语句，与查询界面保持一致
  • 导入：显示文件上传进度
  • MySQL：支持存储过程参数和返回值的排序规则
  • MariaDB 12：支持多事件触发器及 UPDATE OF 语法（缺陷 #1306）
  • PostgreSQL：通过复合类型列标识编辑和删除行（缺陷 #1217）
  • MS SQL：显示存储过程的所有结果集，服务器消息应停止迭代（缺陷 #1180）
  • MS SQL：将服务器打印的消息显示为警告（例如通过 PRINT 语句）
  • MS SQL：修复通过 PDO 向含标识列的表导入 CSV 文件时静默失败的问题
  • Elasticsearch：将数据库从 elastic 重命名为 data
  • Elasticsearch：重定向至唯一数据库
  • Elasticsearch：在消息中打印已执行命令
  • Elasticsearch：高亮显示打印的查询语句
  • OpenSearch：通过 Elasticsearch 驱动程序添加支持
  • Redis：重定向至唯一数据表
  • 编辑器：禁止访问无密码数据库，与 Adminer 行为一致

插件

  • error() 方法用于修改打印的数据库错误消息（缺陷 #1249）
  • dumpPrint() 方法用于在导出表单中打印 HTML 代码
  • editRowPrint() 方法接收编辑行所用的查询语句及其耗时
  • 插件配置：通过 POST 保存设置以便验证 CSRF 令牌
  • 插件文件上传：防止列名脱离上传目录
  • 插件一次性密码登录：未提供有效 OTP 时禁止创建永久登录
  • 插件无密码登录：已移至 Adminer 作为 Adminer\Password 类，插件仅对其进行扩展
  • 插件反向代理登录：按代理地址分组无效登录
  • 插件服务器登录：允许包含特殊字符的服务器描述（缺陷 #1320）
  • 插件 SSL 登录：同时在 pdo_sqlsrv 扩展中使用（缺陷 #1324）
  • 插件数据表登录：通过 password_hash 列验证密码
  • 插件 slugify：仅打印数值型 maxlength
  • 插件 SQL 日志：默认写入临时目录
  • 驱动插件：Driver::select() 将执行的查询赋值给 $this->query
  • 驱动插件：将语法高亮器打包至插件文件，不再加载 adminer-plugins/jush-<driver>.js
  • 驱动插件：jushAutocomplete() 方法用于禁用或替换查询 <textarea> 的自动补全功能

内部调整

  • 将子模块从 externals/ 移至使用位置：adminer/static/jush、conf/JsShrink 和 conf/PhpShrink
  • 测试：覆盖所有驱动程序中的 CSV 导入导出、分页、Ctrl+点击修改值、批量表操作和 SQL 文件导入
  • 测试：通过 plugins.spec.js 覆盖打包插件，该文件从 tests/plugins.php 的固定集合加载
  • 测试：将测试入口迁移至 tests/ 目录，其为固定装置而非部署示例
  • 通过 Slevomat 编码标准检查代码风格，通过 PHPCompatibility（composer compat）检查编译文件
  • 启用无错误报告的 PHPStan 严格规则
  • 通过 composer install 安装 PHPCS 和 PHPStan（与 ESLint 类似）
  • 在 composer install –no-dev 中跳过所有代码检查工具，仅初始化子模块

更新内容 （原始）

  • Run the development version from the adminer/ directory alone, copied anywhere and under any name
  • Send the session cookie with SameSite=lax, the browsers not defaulting to it sent it also cross-site
  • Send the cookies set by JavaScript with the same attributes as the other cookies
  • Do not redirect outside Adminer after saving a row
  • Do not count a request without credentials as an unsuccessful login
  • Report a server accepting any password by its own message instead of the one about a missing password (bug #1318)
  • Print the configuration of Adminer\Password when the database can be accessed without a password
  • Print the help as a text, not HTML
  • Verify the CSRF token also when logging in
  • Verify the CSRF token before killing a query timed out on the client
  • Send an error HTTP status on an invalid CSRF token and too large POST data
  • Use the same font in <textarea> as in <input>, keep monospace in the SQL command and JSON values
  • Autocomplete: Disable in the drivers not using SQL, e.g. Redis
  • Autocomplete: Offer only the statements allowed in a trigger and no statement in a check constraint
  • Create table: Print the success message in drivers not using SQL, e.g. Elasticsearch (regression from 6.0.0)
  • Database schema: Arrange the tables in a grid by their foreign keys instead of in one column
  • Database schema: Do not display the tables hidden by tableName() and the references to them
  • Select: Search only the columns which can hold the searched value, convert the other types to text (bug #1216)
  • Select: Modify or delete several rows in a transaction
  • Edit: Keep the JSON value entered by the user after an error, it was replaced by null if it was invalid
  • Edit: Print the query fetching the row, the same as in Select
  • Import: Display the progress of the file upload
  • MySQL: Support collation of routine parameters and return values
  • MariaDB 12: Support triggers for multiple events and for UPDATE OF (bug #1306)
  • PostgreSQL: Edit and delete rows identified by a column of a composite type (bug #1217)
  • MS SQL: Display all result sets of a procedure, a message from the server stopped the iteration (bug #1180)
  • MS SQL: Display the messages printed by the server as warnings, e.g. by PRINT
  • MS SQL: Fix importing a CSV file to a table with an identity column through PDO, it silently did nothing
  • Elasticsearch: Rename the database from elastic to data
  • Elasticsearch: Redirect to the only database
  • Elasticsearch: Print the executed commands in the messages
  • Elasticsearch: Highlight the printed queries
  • OpenSearch: Add support via Elasticsearch driver
  • Redis: Redirect to the only table
  • Editor: Do not access a database without a password, the same as Adminer

Plugins

  • Method error() to modify the printed database error messages (bug #1249)
  • Method dumpPrint() to print HTML code in the export form
  • Method editRowPrint() receives the query which got the edited row and the time it took
  • Plugin config: Save the settings by POST so that the CSRF token can be verified
  • Plugin file-upload: Do not let the column name escape the upload directory
  • Plugin login-otp: Do not create a permanent login without a valid OTP
  • Plugin login-password-less: Moved to Adminer as the Adminer\Password class, the plugin only extends it
  • Plugin login-reverse-proxy: Group the invalid logins also by the address of the proxy
  • Plugin login-servers: Allow server description with special characters (bug #1320)
  • Plugin login-ssl: Use also in the pdo_sqlsrv extension (bug #1324)
  • Plugin login-table: Verify the password from column password_hash
  • Plugin slugify: Print only a numeric maxlength
  • Plugin sql-log: Write the log to the temp directory by default
  • Driver plugins: Driver::select() assigns the executed query to $this->query
  • Driver plugins: Bundle the syntax highlighter in the plugin file, adminer-plugins/jush-<driver>.js is not loaded anymore
  • Driver plugins: Method jushAutocomplete() to disable or replace the autocomplete of the query <textarea>

Internal

  • Move the submodules from externals/ to where they are used: adminer/static/jush, conf/JsShrink and conf/PhpShrink
  • Tests: Cover the CSV import and export, pagination, modifying a value by Ctrl+click, the bulk table operations and the SQL file import in every driver
  • Tests: Cover the bundled plugins by plugins.spec.js, which loads them from a fixed set in tests/plugins.php
  • Tests: Move the entry points to tests/, they are fixtures and not examples to deploy
  • Check the code style also by Slevomat Coding Standard and the compiled files by PHPCompatibility (composer compat)
  • Enable the PHPStan strict rules which report no error
  • Install PHPCS and PHPStan by composer install, like ESLint
  • Skip all the linters in composer install –no-dev, it only initializes the submodules

下载链接