From bd49edfb90aef82c20ad27de5143691f754d5a54 Mon Sep 17 00:00:00 2001
From: Deven Bansod <devenbansod.bits@gmail.com>
Date: Sat, 10 Oct 2015 22:57:07 +0530
Subject: [PATCH] Fix 11561

Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
---
 libraries/dbi/DBIDummy.class.php          |   5 +
 libraries/display_change_password.lib.php | 140 ++++++++++------------
 libraries/server_privileges.lib.php       | 122 +++++++++++++------
 3 files changed, 151 insertions(+), 116 deletions(-)

diff --git a/libraries/dbi/DBIDummy.class.php b/libraries/dbi/DBIDummy.class.php
index fd2b5f9a2c..58ab193d4e 100644
--- a/libraries/dbi/DBIDummy.class.php
+++ b/libraries/dbi/DBIDummy.class.php
@@ -653,6 +653,11 @@ $GLOBALS['dummy_queries'] = array(
     array(
         'query' => "SELECT @@lower_case_table_names",
         'result' => array()
+    ),
+    array(
+        'query' => "SELECT `PLUGIN_NAME`, `PLUGIN_DESCRIPTION` "
+            . "FROM `information_schema`.`PLUGINS` WHERE `PLUGIN_TYPE` = 'AUTHENTICATION';",
+        'result' => array()
     )
 );
 /**
diff --git a/libraries/display_change_password.lib.php b/libraries/display_change_password.lib.php
index 0b65e3d6b8..0ed22b3a9f 100644
--- a/libraries/display_change_password.lib.php
+++ b/libraries/display_change_password.lib.php
@@ -77,88 +77,74 @@ function PMA_getHtmlForChangePassword($username, $hostname)
         . $chg_evt_handler . '="nopass[1].checked = true" />'
         . '</td>'
         . '</tr>';
-    $default_auth_plugin = PMA_getCurrentAuthenticationPlugin(
-        'change', $username, $hostname
-    );
 
-    // See http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-5.html
-    if (PMA_Util::getServerType() == 'MySQL'
-        && PMA_MYSQL_INT_VERSION >= 50705
+    $html .= '<tr class="vmiddle">'
+        . '<td>' . __('Password Hashing:') . '</td>';
+
+    $serverType = PMA_Util::getServerType();
+    if (($serverType == 'MySQL'
+        && PMA_MYSQL_INT_VERSION >= 50507)
+        || ($serverType == 'MariaDB'
+        && PMA_MYSQL_INT_VERSION >= 50200)
     ) {
-        $html .= '<tr class="vmiddle">'
-            . '<td>' . __('Password Hashing:') . '</td>'
-            . '<td>'
-            . '<input type="radio" name="pw_hash" id="radio_pw_hash_mysql_native" '
-            . 'value="mysql_native_password"';
-        if ($default_auth_plugin == 'mysql_native_password') {
-            $html .= '" checked="checked"';
-        }
-        $html .= ' />'
-            . '<label for="radio_pw_hash_mysql_native">'
-            . __('MySQL native password')
-            . '</label>'
-            . '</td>'
-            . '</tr>'
-            . '<tr id="tr_element_before_generate_password">'
-            . '<td>&nbsp;</td>'
-            . '<td>'
-            . '<input type="radio" name="pw_hash" id="radio_pw_hash_sha256" '
-            . 'value="sha256_password"';
-        if ($default_auth_plugin == 'sha256_password') {
-            $html .= '" checked="checked"';
-        }
-        $html .= ' />'
-            . '<label for="radio_pw_hash_sha256">'
-            . __('SHA256 password')
-            . '</label>'
-            . '</td>'
-            . '</tr>';
-    } elseif (PMA_Util::getServerType() == 'MySQL'
-        && PMA_MYSQL_INT_VERSION >= 50606
-    ) {
-        $html .= '<tr class="vmiddle" id="tr_element_before_generate_password">'
-            . '<td>' . __('Password Hashing:') . '</td>'
-            . '<td>'
-            . '<input type="radio" name="pw_hash" id="radio_pw_hash_new" '
-            . 'value="' . $default_auth_plugin . '" checked="checked" />'
-            . '<label for="radio_pw_hash_new">' . $default_auth_plugin . '</label>'
-            . '</td>'
-            . '</tr>';
-    } else {
-        $html .= '<tr class="vmiddle">'
-            . '<td>' . __('Password Hashing:') . '</td>'
-            . '<td>'
-            . '<input type="radio" name="pw_hash" id="radio_pw_hash_new" '
-            . 'value="mysql_native_password" checked="checked" />'
-            . '<label for="radio_pw_hash_new">mysql_native_password</label>'
-            . '</td>'
-            . '</tr>'
-            . '<tr id="tr_element_before_generate_password" >'
-            . '<td>&nbsp;</td>'
-            . '<td>'
-            . '<input type="radio" name="pw_hash" id="radio_pw_hash_old" '
-            . 'value="old" />'
-            . '<label for="radio_pw_hash_old">' . __('MySQL 4.0 compatible')
-            . '</label>'
-            . '</td>'
-            . '</tr>';
-    }
 
-    $html .=  '</table>';
+        $active_auth_plugins = PMA_getActiveAuthPlugins();
 
-    $html .= '<div '
-        . ($default_auth_plugin != 'sha256_password' ? 'style="display:none"' : '')
-        . ' id="ssl_reqd_warning_cp">'
-        . PMA_Message::notice(
-            __(
-                'This method requires using an \'<i>SSL connection</i>\' '
-                . 'or an \'<i>unencrypted connection that encrypts the password '
-                . 'using RSA</i>\'; while connecting to the server.'
+        $default_auth_plugin = PMA_getCurrentAuthenticationPlugin(
+            'change', $username, $hostname
+        );
+
+        $iter = 0;
+        $total_plugins = count($active_auth_plugins);
+        foreach ($active_auth_plugins as $plugin) {
+            if ($plugin['PLUGIN_NAME'] == 'mysql_old_password') {
+                continue;
+            }
+
+            if ($iter != 0) {
+                $html .= '<td>&nbsp;</td>';
+            }
+            $html .= '<td>'
+                . '<input type="radio" name="pw_hash" value="'
+                . $plugin['PLUGIN_NAME'] . '"'
+                . ($default_auth_plugin == $plugin['PLUGIN_NAME'] ? 'checked="checked" ' : '')
+                . ' id="radio_pw_hash_' . $plugin['PLUGIN_NAME'] . '" />'
+                . '<label for="radio_pw_hash_' . $plugin['PLUGIN_NAME'] . '" >'
+                . __($plugin['PLUGIN_DESCRIPTION']) . ' </label></td></tr>';
+
+            if ($iter == $total_plugins - 2) {
+                $html .= '<tr id="tr_element_before_generate_password">';
+            } else if ($iter != $total_plugins - 1) {
+                $html .= '<tr>';
+            }
+            $iter++;
+        }
+
+        $html .= '</tr>';
+        $html .=  '</table>';
+
+        $html .= '<div '
+            . ($default_auth_plugin != 'sha256_password' ? 'style="display:none"' : '')
+            . ' id="ssl_reqd_warning_cp">'
+            . PMA_Message::notice(
+                __(
+                    'This method requires using an \'<i>SSL connection</i>\' '
+                    . 'or an \'<i>unencrypted connection that encrypts the password '
+                    . 'using RSA</i>\'; while connecting to the server.'
+                )
+                . PMA_Util::showMySQLDocu('sha256-authentication-plugin')
             )
-            . PMA_Util::showMySQLDocu('sha256-authentication-plugin')
-        )
-            ->getDisplay()
-        . '</div>';
+                ->getDisplay()
+            . '</div>';
+    } else {
+        $html .= '<td>'
+            . '<input type="radio" name="pw_hash" value="mysql_native_password"'
+            . 'checked="checked" id="radio_pw_hash_native" />'
+            . '<label for="radio_pw_hash_native" >'
+            . __('MySQL Native Authentication') . ' </label></td></tr>'
+            . '<tr id="tr_element_before_generate_password"></tr>'
+            . '</table>';
+    }
 
     $html .= '</fieldset>'
         . '<fieldset id="fieldset_change_password_footer" class="tblFooters">'
diff --git a/libraries/server_privileges.lib.php b/libraries/server_privileges.lib.php
index e46de582e4..7dd06ff4d4 100644
--- a/libraries/server_privileges.lib.php
+++ b/libraries/server_privileges.lib.php
@@ -1411,6 +1411,27 @@ function PMA_getHtmlForGlobalPrivTableWithCheckboxes(
     return $html_output;
 }
 
+/**
+ * Gets the currently active authentication plugins
+ *
+ * @return array $result  array of plugin names and descriptions
+ */
+function PMA_getActiveAuthPlugins()
+{
+    $get_plugins_query = "SELECT `PLUGIN_NAME`, `PLUGIN_DESCRIPTION`"
+        . " FROM `information_schema`.`PLUGINS` "
+        . "WHERE `PLUGIN_TYPE` = 'AUTHENTICATION';";
+    $resultset = $GLOBALS['dbi']->query($get_plugins_query);
+
+    $result = array();
+
+    while ($row = $GLOBALS['dbi']->fetchAssoc($resultset)) {
+        $result[] = $row;
+    }
+
+    return $result;
+}
+
 /**
  * Displays the fields used by the "new user" form as well as the
  * "change login information / copy user" form.
@@ -1631,10 +1652,6 @@ function PMA_getHtmlForLoginInformationFields(
         )
         . '</div>' . "\n";
 
-    $orig_auth_plugin = PMA_getCurrentAuthenticationPlugin(
-        $mode, $username, $hostname
-    );
-
     $html_output .= '<div class="item">' . "\n"
         . '<label for="select_pred_password">' . "\n"
         . '    ' . __('Password:') . "\n"
@@ -1690,38 +1707,58 @@ function PMA_getHtmlForLoginInformationFields(
         . '/>' . "\n"
         . '</div>' . "\n"
         . '<div class="item" id="authentication_plugin_div">'
-        . '<label for="select_authentication_plugin" >'
-        . __('Authentication Plugin')
-        . '</label><span class="options">&nbsp;</span>' . "\n"
-        . '<select id="select_authentication_plugin" name="authentication_plugin" '
-        . 'title="' . __('Authentication Plugin') . '" >'
-        . '<option value="mysql_native_password" '
-        . ($orig_auth_plugin == 'mysql_native_password' ? 'selected ' : '')
-        . '>' . __('MySQL native password') . '</option>';
+        . '<label for="select_authentication_plugin" >';
 
-    // sha256 auth plugin exists only for 5.6.6+
-    if (PMA_Util::getServerType() == 'MySQL'
-        && PMA_MYSQL_INT_VERSION >= 50606
+    $serverType = PMA_Util::getServerType();
+
+    if (($serverType == 'MySQL'
+        && PMA_MYSQL_INT_VERSION >= 50507)
+        || ($serverType == 'MariaDB'
+        && PMA_MYSQL_INT_VERSION >= 50200)
     ) {
-        $html_output .= '<option value="sha256_password" '
-        . ($orig_auth_plugin == 'sha256_password' ? ' selected ' : '')
-        . ' >' . __('SHA256 password') . '</option>';
-    }
+        $html_output .= __('Authentication Plugin')
+        . '</label><span class="options">&nbsp;</span>' . "\n"
+        . '<select id="select_authentication_plugin" name="authentication_plugin" >';
 
-    $html_output .= '</select>'
-        . '<div id="ssl_reqd_warning" '
-        . ($orig_auth_plugin == 'sha256_password' ? '' : ' style="display:none"')
-        . ' >'
-        . PMA_Message::notice(
-            __(
-                'This method requires using an \'<i>SSL connection</i>\' '
-                . 'or an \'<i>unencrypted connection that encrypts the password '
-                . 'using RSA</i>\'; while connecting to the server.'
-            )
-            . PMA_Util::showMySQLDocu('sha256-authentication-plugin')
-        )->getDisplay()
-        . '</div>'
-        . '</div>' . "\n"
+        $active_auth_plugins = PMA_getActiveAuthPlugins();
+
+        $orig_auth_plugin = PMA_getCurrentAuthenticationPlugin(
+            $mode, $username, $hostname
+        );
+
+        foreach ($active_auth_plugins as $plugin) {
+            if ($plugin['PLUGIN_NAME'] == 'mysql_old_password') {
+                continue;
+            }
+
+            $html_output .= '<option value="' . $plugin['PLUGIN_NAME'] . '"'
+                . ($orig_auth_plugin == $plugin['PLUGIN_NAME'] ? 'selected ' : '')
+                . '>' . __($plugin['PLUGIN_DESCRIPTION']) . '</option>';
+        }
+
+        $html_output .= '</select>'
+            . '<div id="ssl_reqd_warning" '
+            . ($orig_auth_plugin == 'sha256_password' ? '' : ' style="display:none"')
+            . ' >'
+            . PMA_Message::notice(
+                __(
+                    'This method requires using an \'<i>SSL connection</i>\' '
+                    . 'or an \'<i>unencrypted connection that encrypts the password '
+                    . 'using RSA</i>\'; while connecting to the server.'
+                )
+                . PMA_Util::showMySQLDocu('sha256-authentication-plugin')
+            )->getDisplay()
+            . '</div>';
+    } else {
+        $html_output .= __('Password Hashing Method')
+            . '</label><span class="options">&nbsp;</span>' . "\n"
+            . '<select id="select_authentication_plugin" '
+            . 'name="authentication_plugin" >'
+            . '<option value="mysql_native_password" >'
+            . __('MySQL Native Authentication') . '</option>'
+            . '</select>';
+    }
+    $html_output .= '</div>' . "\n"
        // Generate password added here via jQuery
        . '</fieldset>' . "\n";
 
@@ -1883,7 +1920,9 @@ function PMA_updatePassword($err_url, $username, $hostname)
             $local_query = $query_prefix
                 . PMA_Util::sqlAddSlashes($_POST['pma_pw']) . "'";
         } else {
-            if (! empty($_REQUEST['pw_hash']) && $_REQUEST['pw_hash'] == 'old') {
+            if (! empty($_REQUEST['pw_hash'])
+                && $_REQUEST['pw_hash'] == 'mysql_old_password'
+            ) {
                 $hashing_function = 'OLD_PASSWORD';
             } elseif (! empty($_REQUEST['pw_hash'])
                 && $_REQUEST['pw_hash'] == 'sha256_password'
@@ -4108,6 +4147,8 @@ function PMA_setProperPasswordHashing($auth_plugin)
     // to be of type depending upon $authentication_plugin
     if ($auth_plugin == 'sha256_password') {
         $GLOBALS['dbi']->tryQuery('SET `old_passwords` = 2');
+    } else if ($auth_plugin == 'mysql_old_password') {
+        $GLOBALS['dbi']->tryQuery('SET `old_passwords` = 1');
     } else {
         $GLOBALS['dbi']->tryQuery('SET `old_passwords` = 0');
     }
@@ -4968,6 +5009,13 @@ function PMA_getSqlQueriesForDisplayAndAddUser($username, $hostname, $password)
     );
     $real_sql_query = $sql_query = $sql_query_stmt;
 
+    // Set the proper hashing method
+    if (isset($_REQUEST['authentication_plugin'])) {
+        PMA_setProperPasswordHashing(
+            $_REQUEST['authentication_plugin']
+        );
+    }
+
     // Use 'SET PASSWORD' for pre-5.7.6 MySQL versions
     // and pre-5.2.0 MariaDB
     if (($serverType == 'MySQL'
@@ -4975,6 +5023,7 @@ function PMA_getSqlQueriesForDisplayAndAddUser($username, $hostname, $password)
         || ($serverType == 'MariaDB'
         && PMA_MYSQL_INT_VERSION < 50200)
     ) {
+
         if ($_POST['pred_password'] == 'keep') {
             $password_set_real = sprintf(
                 $password_set_stmt,
@@ -5000,11 +5049,6 @@ function PMA_getSqlQueriesForDisplayAndAddUser($username, $hostname, $password)
     } else {
         $password_set_real = null;
 
-        // Set the proper hashing method
-        PMA_setProperPasswordHashing(
-            $_REQUEST['authentication_plugin']
-        );
-
         // Required for binding '%' with '%s'
         $create_user_stmt = str_replace(
             '%', '%%', $create_user_stmt