From 1daa32fb97b90fd1bf233cae9ed249e37fa175c4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Wed, 3 Dec 2014 08:29:55 -0500 Subject: [PATCH 1/3] bug #4612 [security] XSS vulnerability in redirection mechanism Signed-off-by: Marc Delisle --- ChangeLog | 3 +++ url.php | 6 +++++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index f9835027c1..4d465fc284 100644 --- a/ChangeLog +++ b/ChangeLog @@ -65,6 +65,9 @@ phpMyAdmin - ChangeLog - bug #4391 Upgraded to 4.2.0, insanely slow now + rfe #1537 PHP OpenSSL support for cookie encryption/decryption +4.2.13.1 (2014-12-03) +- bug #4612 [security] XSS vulnerability in redirection mechanism + 4.2.13.0 (2014-11-30) - bug #4604 Query history not being deleted - bug #4057 db/table query string parameters no longer work diff --git a/url.php b/url.php index 71efc9fb6b..82b224311b 100644 --- a/url.php +++ b/url.php @@ -11,6 +11,10 @@ */ define('PMA_MINIMUM_COMMON', true); require_once './libraries/common.inc.php'; +/** + * JavaScript escaping. + */ +require_once './libraries/js_escape.lib.php'; if (! PMA_isValid($_GET['url']) || ! preg_match('/^https?:\/\/[^\n\r]*$/', $_GET['url']) @@ -24,7 +28,7 @@ if (! PMA_isValid($_GET['url']) // external site. echo ""; // Display redirecting msg on screen. From a4e8d008f407d92c7177bca799c54525ba9032ad Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Wed, 3 Dec 2014 08:50:14 -0500 Subject: [PATCH 2/3] bug #4611 [security] DOS attack with long passwords Signed-off-by: Marc Delisle --- ChangeLog | 1 + libraries/common.inc.php | 5 +++++ libraries/plugins/AuthenticationPlugin.class.php | 9 +++++++++ libraries/plugins/auth/AuthenticationCookie.class.php | 10 ++++++++++ 4 files changed, 25 insertions(+) diff --git a/ChangeLog b/ChangeLog index 4d465fc284..17e4e2e8b4 100644 --- a/ChangeLog +++ b/ChangeLog @@ -67,6 +67,7 @@ phpMyAdmin - ChangeLog 4.2.13.1 (2014-12-03) - bug #4612 [security] XSS vulnerability in redirection mechanism +- bug #4611 [security] DOS attack with long passwords 4.2.13.0 (2014-11-30) - bug #4604 Query history not being deleted diff --git a/libraries/common.inc.php b/libraries/common.inc.php index 8df703181e..00c466e943 100644 --- a/libraries/common.inc.php +++ b/libraries/common.inc.php @@ -858,6 +858,9 @@ if (! defined('PMA_MINIMUM_COMMON')) { . ' ' . $cfg['Server']['auth_type'] ); } + if (isset($_REQUEST['pma_password'])) { + $_REQUEST['pma_password'] = substr($_REQUEST['pma_password'], 0, 256); + } include_once './libraries/plugins/auth/' . $auth_class . '.class.php'; // todo: add plugin manager $plugin_manager = null; @@ -986,6 +989,8 @@ if (! defined('PMA_MINIMUM_COMMON')) { $controllink = $userlink; } + $auth_plugin->storeUserCredentials(); + /* Log success */ PMA_logUser($cfg['Server']['user']); diff --git a/libraries/plugins/AuthenticationPlugin.class.php b/libraries/plugins/AuthenticationPlugin.class.php index 8ba6679c39..457de4ca71 100644 --- a/libraries/plugins/AuthenticationPlugin.class.php +++ b/libraries/plugins/AuthenticationPlugin.class.php @@ -38,6 +38,15 @@ abstract class AuthenticationPlugin */ abstract public function authSetUser(); + /** + * Stores user credentials after successful login. + * + * @return void + */ + public function storeUserCredentials() + { + } + /** * User is not allowed to login to MySQL -> authentication failed * diff --git a/libraries/plugins/auth/AuthenticationCookie.class.php b/libraries/plugins/auth/AuthenticationCookie.class.php index 8291689fdf..a553f78305 100644 --- a/libraries/plugins/auth/AuthenticationCookie.class.php +++ b/libraries/plugins/auth/AuthenticationCookie.class.php @@ -563,6 +563,16 @@ class AuthenticationCookie extends AuthenticationPlugin } else { $_SESSION['last_access_time'] = time(); } + } + + /** + * Stores user credentials after successful login. + * + * @return void + */ + public function storeUserCredentials() + { + global $cfg; $this->createIV(); From 20d0f08c587288698d813e22bd7b8de85cfbb5a1 Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Wed, 3 Dec 2014 09:00:45 -0500 Subject: [PATCH 3/3] Deactivate this test for now Signed-off-by: Marc Delisle --- .../plugin/auth/PMA_AuthenticationCookie_test.php | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/test/classes/plugin/auth/PMA_AuthenticationCookie_test.php b/test/classes/plugin/auth/PMA_AuthenticationCookie_test.php index d77bd7b389..15a73c1638 100644 --- a/test/classes/plugin/auth/PMA_AuthenticationCookie_test.php +++ b/test/classes/plugin/auth/PMA_AuthenticationCookie_test.php @@ -803,13 +803,14 @@ class PMA_AuthenticationCookie_Test extends PHPUnit_Framework_TestCase isset($_SERVER['PHP_AUTH_PW']) ); - $this->assertTrue( - isset($_COOKIE['pmaUser-1']) - ); + // todo: Move to a distinct test for storeUserCredentials() + //$this->assertTrue( + // isset($_COOKIE['pmaUser-1']) + //); - $this->assertTrue( - isset($_COOKIE['pmaPass-1']) - ); + //$this->assertTrue( + // isset($_COOKIE['pmaPass-1']) + //); $arr['password'] = 'testPW'; $arr['host'] = 'b';