gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #12524 from devenbansod/fix_token_errors

Browse Source 
Check for token mismatches only if it's a POST request
This commit is contained in:
Michal Čihař 2016-09-02 13:32:29 +02:00 committed by GitHub
commit 2d666f0c3e
1 changed files with 19 additions and 44 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

63
libraries/common.inc.php
View File

@ -372,56 +372,31 @@ if (PMA_checkPageValidity($_REQUEST['back'], $goto_whitelist)) {
* could access this variables before we reach this point
* f.e. PMA\libraries\Config: fontsize
*
* Check for token mismatch only if the Request method is POST
* GET Requests would never have token and therefore checking
* mis-match does not make sense
*
* @todo variables should be handled by their respective owners (objects)
* f.e. lang, server, collation_connection in PMA\libraries\Config
*/
$token_mismatch = true;
$token_provided = false;
if (PMA_isValid($_REQUEST['token'])) {
$token_provided = true;
$token_mismatch = ! hash_equals($_SESSION[' PMA_token '], $_REQUEST['token']);
}
if ($token_mismatch) {
/**
* List of parameters which are allowed from unsafe source
*/
$allow_list = array(
/* needed for direct access, see FAQ 1.34
* also, server needed for cookie login screen (multi-server)
*/
'server', 'db', 'table', 'target', 'lang',
/* Session ID */
'phpMyAdmin',
/* Cookie preferences */
'pma_lang', 'pma_collation_connection',
/* Possible login form */
'pma_servername', 'pma_username', 'pma_password',
'g-recaptcha-response',
/* Needed to send the correct reply */
'ajax_request',
/* Permit to log out even if there is a token mismatch */
'old_usr',
/* Permit redirection with token-mismatch in url.php */
'url',
/* Permit session expiry flag */
'session_expired',
/* JS loading */
'scripts', 'call_done',
/* Navigation panel */
'aPath', 'vPath', 'pos', 'pos2_name', 'pos2_value', 'searchClause', 'searchClause2'
);
/**
* Allow changing themes in test/theme.php
*/
if (defined('PMA_TEST_THEME')) {
$allow_list[] = 'set_theme';
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
$token_mismatch = true;
$token_provided = false;
if (PMA_isValid($_POST['token'])) {
$token_provided = true;
$token_mismatch = ! hash_equals($_SESSION[' PMA_token '], $_POST['token']);
}
/**
* Do actual cleanup
*/
PMA\libraries\Sanitize::removeRequestVars($allow_list);
if ($token_mismatch) {
/**
* We don't allow any POST operation parameters if the token is mismatched
* or is not provided
*
*/
PMA\libraries\Sanitize::removeRequestVars(array());
}
}