From 5022ff95603d3b3969ac222477641bf051c3d389 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@cihar.com>
Date: Thu, 2 Feb 2017 13:42:37 +0100
Subject: [PATCH] Do not show errors from OpenSSL cookie encryption/decryption
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This can happen from corrupted cookies, by invalid encryption parameters
used in older phpMyAdmin versions or by wrong openSSL configuration.

In neither case the error is useful to user, but we need to clear the
error buffer as otherwise the errors would pop up later, for example
during MySQL SSL setup.

Fixes #12924

Signed-off-by: Michal Čihař <michal@cihar.com>
---
 ChangeLog                                     |  1 +
 .../plugins/auth/AuthenticationCookie.php     | 28 +++++++++++--------
 2 files changed, 18 insertions(+), 11 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index e10f8f456a..49473eaeb5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -50,6 +50,7 @@ phpMyAdmin - ChangeLog
 - issue #12918 Always use \r\n as newline when editing fields
 - issue #12923 Fixed server side search in navigation panel
 - issue #12929 Undefined index warning with ssl_ca_paths
+- issue #12924 Do not show errors from OpenSSL cookie encryption/decryption
 
 4.6.6 (2017-01-23)
 - issue #12759 Fix Notice regarding 'Undefined index: old_usergroup'
diff --git a/libraries/plugins/auth/AuthenticationCookie.php b/libraries/plugins/auth/AuthenticationCookie.php
index 2694bcd92e..ccb734c51e 100644
--- a/libraries/plugins/auth/AuthenticationCookie.php
+++ b/libraries/plugins/auth/AuthenticationCookie.php
@@ -712,17 +712,23 @@ class AuthenticationCookie extends AuthenticationPlugin
     }
 
     /**
-     * Reports any SSL errors
+     * Cleans any SSL errors
+     *
+     * This can happen from corrupted cookies, by invalid encryption
+     * parameters used in older phpMyAdmin versions or by wrong openSSL
+     * configuration.
+     *
+     * In neither case the error is useful to user, but we need to clear
+     * the error buffer as otherwise the errors would pop up later, for
+     * example during MySQL SSL setup.
      *
      * @return void
      */
-    public function reportSSLErrors()
+    public function cleanSSLErrors()
     {
-        while (($ssl_err = openssl_error_string()) !== false) {
-            trigger_error(
-                _('OpenSSL error when manipulating with cookies:') . ' ' . $ssl_err,
-                E_USER_ERROR
-            );
+        if (function_exists('openssl_error_string')) {
+            while (($ssl_err = openssl_error_string()) !== false) {
+            }
         }
     }
 
@@ -748,13 +754,13 @@ class AuthenticationCookie extends AuthenticationPlugin
                 0,
                 $iv
             );
-            $this->reportSSLErrors();
         } else {
             $cipher = new Crypt\AES(Crypt\Base::MODE_CBC);
             $cipher->setIV($iv);
             $cipher->setKey($aes_secret);
             $result = base64_encode($cipher->encrypt($data));
         }
+        $this->cleanSSLErrors();
         $iv = base64_encode($iv);
         return json_encode(
             array(
@@ -800,14 +806,14 @@ class AuthenticationCookie extends AuthenticationPlugin
                 0,
                 base64_decode($data['iv'])
             );
-            $this->reportSSLErrors();
-            return $result;
         } else {
             $cipher = new Crypt\AES(Crypt\Base::MODE_CBC);
             $cipher->setIV(base64_decode($data['iv']));
             $cipher->setKey($aes_secret);
-            return $cipher->decrypt(base64_decode($data['payload']));
+            $result = $cipher->decrypt(base64_decode($data['payload']));
         }
+        $this->cleanSSLErrors();
+        return $result;
     }
 
     /**