gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #277 from phpmyadmin/security/issue-276

Browse Source 
Fix CSRF Vulnerability in login form
This commit is contained in:
Isaac Bennetch 2019-06-04 10:31:16 -04:00 committed by GitHub
commit 4b5e04d0a1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 24 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
doc/faq.rst
View File

@ -1167,20 +1167,18 @@ name is defined in the config file.
4.8 Which parameters can I use in the URL that starts phpMyAdmin?
-----------------------------------------------------------------
When starting phpMyAdmin, you can use the ``db``, ``pma_username``,
``pma_password`` and ``server`` parameters. This last one can contain
When starting phpMyAdmin, you can use the ``db``
and ``server`` parameters. This last one can contain
either the numeric host index (from ``$i`` of the configuration file)
or one of the host names present in the configuration file. Using
``pma_username`` and ``pma_password`` has been tested along with the
usage of 'cookie' ``auth_type``.
or one of the host names present in the configuration file.
For example direct login URL can be constructed as
``https://example.com/phpmyadmin/?pma_username=user&pma_password=password``.
For example, to jump directly to a particular database, a URL can be constructed as
``https://example.com/phpmyadmin/?db=sakila``.
.. warning::
.. versionchanged:: 4.9.0
Passing password and username in URL is insecure and should not be used in
production environments.
Support for using the ``pma_username`` and ``pma_password`` parameters was removed
in phpMyAdmin 4.9.0 (see `PMASA-2019-4 <https://www.phpmyadmin.net/security/PMASA-2019-4/>`_).
.. _faqbrowsers:

6
libraries/classes/Plugins/Auth/AuthenticationCookie.php
View File

@ -275,7 +275,7 @@ class AuthenticationCookie extends AuthenticationPlugin
$this->user = $this->password = '';
$GLOBALS['from_cookie'] = false;
if (isset($_REQUEST['pma_username']) && strlen($_REQUEST['pma_username']) > 0) {
if (isset($_POST['pma_username']) && strlen($_POST['pma_username']) > 0) {
// Verify Captcha if it is required.
if (! empty($GLOBALS['cfg']['CaptchaLoginPrivateKey'])
@ -323,8 +323,8 @@ class AuthenticationCookie extends AuthenticationPlugin
}
// The user just logged in
$this->user = Core::sanitizeMySQLUser($_REQUEST['pma_username']);
$this->password = isset($_REQUEST['pma_password']) ? $_REQUEST['pma_password'] : '';
$this->user = Core::sanitizeMySQLUser($_POST['pma_username']);
$this->password = isset($_POST['pma_password']) ? $_POST['pma_password'] : '';
if ($GLOBALS['cfg']['AllowArbitraryServer']
&& isset($_REQUEST['pma_servername'])
) {

4
libraries/common.inc.php
View File

@ -343,8 +343,8 @@ if (! defined('PMA_MINIMUM_COMMON')) {
. ' ' . $cfg['Server']['auth_type']
);
}
if (isset($_REQUEST['pma_password']) && strlen($_REQUEST['pma_password']) > 256) {
$_REQUEST['pma_password'] = substr($_REQUEST['pma_password'], 0, 256);
if (isset($_POST['pma_password']) && strlen($_POST['pma_password']) > 256) {
$_POST['pma_password'] = substr($_POST['pma_password'], 0, 256);
}
$auth_plugin = new $auth_class();

22
test/classes/Plugins/Auth/AuthenticationCookieTest.php
View File

@ -42,7 +42,7 @@ class AuthenticationCookieTest extends PmaTestCase
$GLOBALS['text_dir'] = 'ltr';
$GLOBALS['db'] = 'db';
$GLOBALS['table'] = 'table';
$_REQUEST['pma_password'] = '';
$_POST['pma_password'] = '';
$this->object = new AuthenticationCookie();
$GLOBALS['PMA_PHP_SELF'] = '/phpmyadmin/';
}
@ -388,7 +388,7 @@ class AuthenticationCookieTest extends PmaTestCase
$GLOBALS['cfg']['CaptchaLoginPrivateKey'] = 'testprivkey';
$GLOBALS['cfg']['CaptchaLoginPublicKey'] = 'testpubkey';
$_POST["g-recaptcha-response"] = '';
$_REQUEST['pma_username'] = 'testPMAUser';
$_POST['pma_username'] = 'testPMAUser';
$this->assertFalse(
$this->object->readCredentials()
@ -462,9 +462,9 @@ class AuthenticationCookieTest extends PmaTestCase
$GLOBALS['cfg']['CaptchaLoginPrivateKey'] = '';
$GLOBALS['cfg']['CaptchaLoginPublicKey'] = '';
$_REQUEST['old_usr'] = '';
$_REQUEST['pma_username'] = 'testPMAUser';
$_POST['pma_username'] = 'testPMAUser';
$_REQUEST['pma_servername'] = 'testPMAServer';
$_REQUEST['pma_password'] = 'testPMAPSWD';
$_POST['pma_password'] = 'testPMAPSWD';
$GLOBALS['cfg']['AllowArbitraryServer'] = true;
$this->assertTrue(
@ -501,8 +501,8 @@ class AuthenticationCookieTest extends PmaTestCase
{
$GLOBALS['cfg']['AllowArbitraryServer'] = true;
$_REQUEST['pma_servername'] = 'testPMAServer';
$_REQUEST['pma_password'] = 'testPMAPSWD';
$_REQUEST['pma_username'] = '';
$_POST['pma_password'] = 'testPMAPSWD';
$_POST['pma_username'] = '';
$GLOBALS['server'] = 1;
$_COOKIE['pmaUser-1'] = '';
$_COOKIE['pma_iv-1'] = base64_encode('testiv09testiv09');
@ -542,7 +542,7 @@ class AuthenticationCookieTest extends PmaTestCase
{
$GLOBALS['server'] = 1;
$_REQUEST['old_usr'] = '';
$_REQUEST['pma_username'] = '';
$_POST['pma_username'] = '';
$_COOKIE['pmaServer-1'] = 'pmaServ1';
$_COOKIE['pmaUser-1'] = 'pmaUser1';
$_COOKIE['pma_iv-1'] = base64_encode('testiv09testiv09');
@ -580,7 +580,7 @@ class AuthenticationCookieTest extends PmaTestCase
{
$GLOBALS['server'] = 1;
$_REQUEST['old_usr'] = '';
$_REQUEST['pma_username'] = '';
$_POST['pma_username'] = '';
$_COOKIE['pmaServer-1'] = 'pmaServ1';
$_COOKIE['pmaUser-1'] = 'pmaUser1';
$_COOKIE['pmaAuth-1'] = 'pmaAuth1';
@ -625,7 +625,7 @@ class AuthenticationCookieTest extends PmaTestCase
{
$GLOBALS['server'] = 1;
$_REQUEST['old_usr'] = '';
$_REQUEST['pma_username'] = '';
$_POST['pma_username'] = '';
$_COOKIE['pmaServer-1'] = 'pmaServ1';
$_COOKIE['pmaUser-1'] = 'pmaUser1';
$_COOKIE['pma_iv-1'] = base64_encode('testiv09testiv09');
@ -1143,8 +1143,8 @@ class AuthenticationCookieTest extends PmaTestCase
$GLOBALS['cfg']['Server']['AllowRoot'] = false;
$GLOBALS['cfg']['Server']['AllowNoPassword'] = false;
$_REQUEST['old_usr'] = '';
$_REQUEST['pma_username'] = 'testUser';
$_REQUEST['pma_password'] = 'testPassword';
$_POST['pma_username'] = 'testUser';
$_POST['pma_password'] = 'testPassword';
ob_start();
$this->object->authenticate();