gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Check if sessions are working and report failures

Browse Source 
- Always check for session_start erorrs and report them, this catches
  completely broken session storage or no free inodes for files
- Check whether session can be written, this catches the full disk case

Fixes #12204

Signed-off-by: Michal Čihař <michal@cihar.com>
This commit is contained in:
Michal Čihař 2016-04-21 11:50:28 +02:00
parent 9ba7d44c18
commit 7e19be3a10
3 changed files with 53 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
ChangeLog
View File

@ -18,6 +18,7 @@ phpMyAdmin - ChangeLog
- issue #12202 Fixed setting of language from user configuration
- issue #12200 Fixed check for ndb version
- issue #12206 Fixed loading of configuration file
- issue #12204 Check if sessions are working and report failures
4.6.0.0 (2016-03-22)
+ issue #11456 Disabled storage engines

4
libraries/Util.php
View File

@ -208,8 +208,10 @@ class Util
if (array_key_exists($class, $sprites)) {
$is_sprite = true;
$url = (defined('PMA_TEST_THEME') ? '../' : '') . 'themes/dot.gif';
} else {
} elseif (isset($GLOBALS['pmaThemeImage'])) {
$url = $GLOBALS['pmaThemeImage'] . $image;
} else {
$url = './themes/pmahomme/' . $image;
}
// set class attribute

72
libraries/session.inc.php
View File

@ -70,36 +70,48 @@ session_cache_limiter('private');
// on some servers (for example, sourceforge.net), we get a permission error
// on the session data directory, so I add some "@"
function PMA_sessionFailed($errors)
{
$messages = array();
foreach ($errors as $error) {
$messages[] = $error->getMessage();
}
/*
* Session initialization is done before selecting language, so we
* can not use translations here.
*/
PMA_fatalError(
'Error during session start; please check your PHP and/or '
. 'webserver log file and configure your PHP '
. 'installation properly. Also ensure that cookies are enabled '
. 'in your browser.'
. '<br /><br />'
. implode('<br /><br />', $messages)
);
}
// See bug #1538132. This would block normal behavior on a cluster
//ini_set('session.save_handler', 'files');
$session_name = 'phpMyAdmin';
@session_name($session_name);
if (! isset($_COOKIE[$session_name])) {
// on first start of session we check for errors
// f.e. session dir cannot be accessed - session file not created
$orig_error_count = $GLOBALS['error_handler']->countErrors();
$session_result = session_start();
if ($session_result !== true
|| $orig_error_count != $GLOBALS['error_handler']->countErrors()
) {
setcookie($session_name, '', 1);
/*
* Session initialization is done before selecting language, so we
* can not use translations here.
*/
PMA_fatalError(
'Error during session start; please check your PHP and/or '
. 'webserver log file and configure your PHP '
. 'installation properly. Also ensure that cookies are enabled '
. 'in your browser.'
);
}
unset($orig_error_count, $session_result);
} else {
session_start();
// on first start of session we check for errors
// f.e. session dir cannot be accessed - session file not created
$orig_error_count = $GLOBALS['error_handler']->countErrors();
$session_result = session_start();
if ($session_result !== true
|| $orig_error_count != $GLOBALS['error_handler']->countErrors()
) {
setcookie($session_name, '', 1);
$errors = $GLOBALS['error_handler']->sliceErrors($orig_error_count);
PMA_sessionFailed($errors);
}
unset($orig_error_count, $session_result);
/**
* Disable setting of session cookies for further session_start() calls.
@ -116,6 +128,20 @@ if (! isset($_SESSION[' PMA_token '])) {
} else {
$_SESSION[' PMA_token '] = bin2hex(openssl_random_pseudo_bytes(16));
}
/**
* Check for disk space on session storage by trying to write it.
*
* This seems to be most reliable approach to test if sessions are working,
* otherwise the check would fail with custom session backends.
*/
$orig_error_count = $GLOBALS['error_handler']->countErrors();
session_write_close();
if ($GLOBALS['error_handler']->countErrors() > $orig_error_count) {
$errors = $GLOBALS['error_handler']->sliceErrors($orig_error_count);
PMA_sessionFailed($errors);
}
session_start();
}
/**
* Check if token is properly generated (both above functions can return false).