From 54e3434c0fc79737927e6f5f4e227a19daef5197 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Fri, 16 Sep 2016 09:35:08 +0200 Subject: [PATCH] Do not try to keep alive session even after expiry MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit There is no sense in sending keepalive requests even after potential session expiry. So limit sending of these only as long we're not idle over cookie login validity. Fixes #12550 Signed-off-by: Michal Čihař --- ChangeLog | 1 + js/functions.js | 12 ++++++------ 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/ChangeLog b/ChangeLog index 5f3ae63570..b687d9d18b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -28,6 +28,7 @@ phpMyAdmin - ChangeLog - issue #11628 Proper parsing of INSERT ... ON DUPLICATE KEY queries - issue #12545 Proper parsing of CREATE TABLE ... PARTITION queries - issue #12473 Code can throw unhandled exception +- issue #12550 Do not try to keep alive session even after expiry 4.6.4 (2016-08-16) - issue [security] Weaknesses with cookie encryption, see PMASA-2016-29 diff --git a/js/functions.js b/js/functions.js index 99eff84673..9fa445f314 100644 --- a/js/functions.js +++ b/js/functions.js @@ -903,13 +903,13 @@ AJAX.registerOnload('functions.js', function () { data: params, success: function (data) { if (data.success) { - if (PMA_commonParams.get('LoginCookieValidity')-_idleSecondsCounter > 5) { - var interval = (PMA_commonParams.get('LoginCookieValidity') - _idleSecondsCounter - 5) * 1000; - if (interval > Math.pow(2, 31) - 1) { // max value for setInterval() function - interval = Math.pow(2, 31) - 1; - } + var remaining = PMA_commonParams.get('LoginCookieValidity') - _idleSecondsCounter; + if (remaining > 5) { + // max value for setInterval() function + var interval = min(remaining * 1000, Math.pow(2, 31) - 1); updateTimeout = window.setTimeout(UpdateIdleTime, interval); - } else { + } else if (remaining > 0) { + // We're close to session expiry updateTimeout = window.setTimeout(UpdateIdleTime, 2000); } } else { //timeout occurred