From 3ed01db704a04094b2047d997830f3bb75aed0d6 Mon Sep 17 00:00:00 2001 From: Kamil Hristov Date: Mon, 2 Nov 2020 22:15:04 +0200 Subject: [PATCH] Increase password characters limit during login - allow logging in with longer passwords, for example tokens generated by AWS RDS IAM authentication - show error message when the limit is reached instead of silently trimming the password to avoid confusion Signed-off-by: Kamil Hristov --- libraries/classes/Plugins/Auth/AuthenticationCookie.php | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/libraries/classes/Plugins/Auth/AuthenticationCookie.php b/libraries/classes/Plugins/Auth/AuthenticationCookie.php index 96e723c878..aae2a11a34 100644 --- a/libraries/classes/Plugins/Auth/AuthenticationCookie.php +++ b/libraries/classes/Plugins/Auth/AuthenticationCookie.php @@ -335,8 +335,11 @@ class AuthenticationCookie extends AuthenticationPlugin $this->user = Core::sanitizeMySQLUser($_POST['pma_username']); $password = $_POST['pma_password'] ?? ''; - if (strlen($password) > 256) { - $password = substr($password, 0, 256); + if (strlen($password) > 1000) { + $conn_error = __('Your password is too long. To prevent denial-of-service attacks, ' . + 'phpMyAdmin restricts passwords to less than 1000 characters.'); + + return false; } $this->password = $password;