From 9c1cfc855318d12f7c0a1c4fbe8f35564aa72769 Mon Sep 17 00:00:00 2001
From: Deven Bansod <devenbansod.bits@gmail.com>
Date: Thu, 1 Sep 2016 13:54:35 +0530
Subject: [PATCH] Check for Token mismatches only if it's a POST request

Checking for Token mismatches for GET requests does not make sense
because they don't contain the Token parameter

We remove all parameters from POST request in case of token mismatch

Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
---
 libraries/common.inc.php | 63 ++++++++++++----------------------------
 1 file changed, 19 insertions(+), 44 deletions(-)

diff --git a/libraries/common.inc.php b/libraries/common.inc.php
index 8bf021dc91..ef8328b023 100644
--- a/libraries/common.inc.php
+++ b/libraries/common.inc.php
@@ -372,56 +372,31 @@ if (PMA_checkPageValidity($_REQUEST['back'], $goto_whitelist)) {
  * could access this variables before we reach this point
  * f.e. PMA\libraries\Config: fontsize
  *
+ * Check for token mismatch only if the Request method is POST
+ * GET Requests would never have token and therefore checking
+ * mis-match does not make sense
+ *
  * @todo variables should be handled by their respective owners (objects)
  * f.e. lang, server, collation_connection in PMA\libraries\Config
  */
-$token_mismatch = true;
-$token_provided = false;
-if (PMA_isValid($_REQUEST['token'])) {
-    $token_provided = true;
-    $token_mismatch = ! hash_equals($_SESSION[' PMA_token '], $_REQUEST['token']);
-}
 
-if ($token_mismatch) {
-    /**
-     *  List of parameters which are allowed from unsafe source
-     */
-    $allow_list = array(
-        /* needed for direct access, see FAQ 1.34
-         * also, server needed for cookie login screen (multi-server)
-         */
-        'server', 'db', 'table', 'target', 'lang',
-        /* Session ID */
-        'phpMyAdmin',
-        /* Cookie preferences */
-        'pma_lang', 'pma_collation_connection',
-        /* Possible login form */
-        'pma_servername', 'pma_username', 'pma_password',
-        'g-recaptcha-response',
-        /* Needed to send the correct reply */
-        'ajax_request',
-        /* Permit to log out even if there is a token mismatch */
-        'old_usr',
-        /* Permit redirection with token-mismatch in url.php */
-        'url',
-        /* Permit session expiry flag */
-        'session_expired',
-        /* JS loading */
-        'scripts', 'call_done',
-        /* Navigation panel */
-        'aPath', 'vPath', 'pos', 'pos2_name', 'pos2_value', 'searchClause', 'searchClause2'
-    );
-    /**
-     * Allow changing themes in test/theme.php
-     */
-    if (defined('PMA_TEST_THEME')) {
-        $allow_list[] = 'set_theme';
+if ($_SERVER['REQUEST_METHOD'] == 'POST') {
+    $token_mismatch = true;
+    $token_provided = false;
+
+    if (PMA_isValid($_POST['token'])) {
+        $token_provided = true;
+        $token_mismatch = ! hash_equals($_SESSION[' PMA_token '], $_POST['token']);
     }
-    /**
-     * Do actual cleanup
-     */
-    PMA\libraries\Sanitize::removeRequestVars($allow_list);
 
+    if ($token_mismatch) {
+        /**
+         * We don't allow any POST operation parameters if the token is mismatched
+         * or is not provided
+         *
+         */
+        PMA\libraries\Sanitize::removeRequestVars(array());
+    }
 }