From 6619fe9196be13bb09accc5cf858b0e5f02eb763 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@cihar.com>
Date: Fri, 20 Oct 2017 19:11:04 +0200
Subject: [PATCH] Check return value from cookieDecrypt
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This can return false and we should fail early once this happens.

Signed-off-by: Michal Čihař <michal@cihar.com>
---
 .../Plugins/Auth/AuthenticationCookie.php     | 24 ++++++++++++-------
 .../Plugins/Auth/AuthenticationCookieTest.php |  7 +++++-
 2 files changed, 21 insertions(+), 10 deletions(-)

diff --git a/libraries/classes/Plugins/Auth/AuthenticationCookie.php b/libraries/classes/Plugins/Auth/AuthenticationCookie.php
index 86836fedac..6af0669f2f 100644
--- a/libraries/classes/Plugins/Auth/AuthenticationCookie.php
+++ b/libraries/classes/Plugins/Auth/AuthenticationCookie.php
@@ -386,11 +386,16 @@ class AuthenticationCookie extends AuthenticationPlugin
             return false;
         }
 
-        $this->user = $this->cookieDecrypt(
+        $value = $this->cookieDecrypt(
             $_COOKIE['pmaUser-' . $GLOBALS['server']],
             $this->_getEncryptionSecret()
         );
 
+        if ($value === false) {
+            return false;
+        }
+
+        $this->user = $value;
         // user was never logged in since session start
         if (empty($_SESSION['browser_access_time'])) {
             return false;
@@ -427,14 +432,15 @@ class AuthenticationCookie extends AuthenticationPlugin
         if (empty($_COOKIE['pmaAuth-' . $GLOBALS['server']])) {
             return false;
         }
-
-        $auth_data = json_decode(
-            $this->cookieDecrypt(
-                $_COOKIE['pmaAuth-' . $GLOBALS['server']],
-                $this->_getSessionEncryptionSecret()
-            ),
-            true
+        $value = $this->cookieDecrypt(
+            $_COOKIE['pmaAuth-' . $GLOBALS['server']],
+            $this->_getSessionEncryptionSecret()
         );
+        if ($value === false) {
+            return false;
+        }
+
+        $auth_data = json_decode($value, true);
 
         if (! is_array($auth_data) || ! isset($auth_data['password'])) {
             return false;
@@ -777,7 +783,7 @@ class AuthenticationCookie extends AuthenticationPlugin
      * @param string $encdata encrypted data
      * @param string $secret  the secret
      *
-     * @return string|bool original data, false on error
+     * @return string|false original data, false on error
      */
     public function cookieDecrypt($encdata, $secret)
     {
diff --git a/test/classes/Plugins/Auth/AuthenticationCookieTest.php b/test/classes/Plugins/Auth/AuthenticationCookieTest.php
index 3dd3b2c57a..e0e48f46ea 100644
--- a/test/classes/Plugins/Auth/AuthenticationCookieTest.php
+++ b/test/classes/Plugins/Auth/AuthenticationCookieTest.php
@@ -645,9 +645,14 @@ class AuthenticationCookieTest extends PmaTestCase
         // mock for blowfish function
         $this->object = $this->getMockBuilder('PhpMyAdmin\Plugins\Auth\AuthenticationCookie')
             ->disableOriginalConstructor()
-            ->setMethods(array('showFailure'))
+            ->setMethods(array('showFailure', 'cookieDecrypt'))
             ->getMock();
 
+        $this->object->expects($this->once())
+            ->method('cookieDecrypt')
+            ->will($this->returnValue('testBF'));
+
+
         $this->object->expects($this->once())
             ->method('showFailure');