From ebaf126501e5159329b1f84d7fd94c2e08c70057 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Mon, 27 Mar 2017 11:28:16 +0200 Subject: [PATCH] Do not use empty() for checking submitted username MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The empty() function is evil and will you block from login with username "0". Signed-off-by: Michal Čihař --- libraries/plugins/auth/AuthenticationCookie.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libraries/plugins/auth/AuthenticationCookie.php b/libraries/plugins/auth/AuthenticationCookie.php index a26152fcca..953f0db91b 100644 --- a/libraries/plugins/auth/AuthenticationCookie.php +++ b/libraries/plugins/auth/AuthenticationCookie.php @@ -294,7 +294,7 @@ class AuthenticationCookie extends AuthenticationPlugin $GLOBALS['PHP_AUTH_USER'] = $GLOBALS['PHP_AUTH_PW'] = ''; $GLOBALS['from_cookie'] = false; - if (! empty($_REQUEST['pma_username'])) { + if (isset($_REQUEST['pma_username']) && strlen($_REQUEST['pma_username']) > 0) { // Verify Captcha if it is required. if (! empty($GLOBALS['cfg']['CaptchaLoginPrivateKey'])