From 285e5623b638cb414b3c3e5ab7c0f3126d616b54 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@cihar.com>
Date: Thu, 18 Aug 2016 09:08:06 +0200
Subject: [PATCH] Strip null bytes from MySQL username
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In old PHP versions this could lead to allow/deny rules bypass.

Signed-off-by: Michal Čihař <michal@cihar.com>
---
 libraries/core.lib.php                         | 18 ++++++++++++++++++
 .../auth/AuthenticationCookie.class.php        |  2 +-
 .../plugins/auth/AuthenticationHttp.class.php  |  3 +++
 3 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/libraries/core.lib.php b/libraries/core.lib.php
index ed2c058f99..337347a53e 100644
--- a/libraries/core.lib.php
+++ b/libraries/core.lib.php
@@ -899,6 +899,24 @@ function PMA_sanitizeMySQLHost($name)
     return $name;
 }
 
+/**
+ * Sanitizes MySQL username
+ *
+ * * strips part behind null byte
+ *
+ * @param string $name User given username
+ *
+ * @return string
+ */
+function PMA_sanitizeMySQLUser($name)
+{
+    $position = strpos($name, chr(0));
+    if ($position !== false) {
+        return substr($name, 0, $position);
+    }
+    return $name;
+}
+
 /**
  * Safe unserializer wrapper
  *
diff --git a/libraries/plugins/auth/AuthenticationCookie.class.php b/libraries/plugins/auth/AuthenticationCookie.class.php
index 5c4a87d203..d0ac972b8c 100644
--- a/libraries/plugins/auth/AuthenticationCookie.class.php
+++ b/libraries/plugins/auth/AuthenticationCookie.class.php
@@ -333,7 +333,7 @@ class AuthenticationCookie extends AuthenticationPlugin
 
         if (! empty($_REQUEST['pma_username'])) {
             // The user just logged in
-            $GLOBALS['PHP_AUTH_USER'] = $_REQUEST['pma_username'];
+            $GLOBALS['PHP_AUTH_USER'] = PMA_sanitizeMySQLUser($_REQUEST['pma_username']);
             $GLOBALS['PHP_AUTH_PW']   = empty($_REQUEST['pma_password'])
                 ? ''
                 : $_REQUEST['pma_password'];
diff --git a/libraries/plugins/auth/AuthenticationHttp.class.php b/libraries/plugins/auth/AuthenticationHttp.class.php
index f81ab92a55..54a49ad09c 100644
--- a/libraries/plugins/auth/AuthenticationHttp.class.php
+++ b/libraries/plugins/auth/AuthenticationHttp.class.php
@@ -158,6 +158,9 @@ class AuthenticationHttp extends AuthenticationPlugin
             unset($usr_pass);
         }
 
+        // sanitize username
+        $PHP_AUTH_USER = PMA_sanitizeMySQLUser($PHP_AUTH_USER);
+
         // User logged out -> ensure the new username is not the same
         $old_usr = isset($_REQUEST['old_usr']) ? $_REQUEST['old_usr'] : '';
         if (! empty($old_usr)