From 7e19be3a1082c3c603ae52d0ecb74a97fc9bcf2c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@cihar.com>
Date: Thu, 21 Apr 2016 11:50:28 +0200
Subject: [PATCH] Check if sessions are working and report failures
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Always check for session_start erorrs and report them, this catches
  completely broken session storage or no free inodes for files
- Check whether session can be written, this catches the full disk case

Fixes #12204

Signed-off-by: Michal Čihař <michal@cihar.com>
---
 ChangeLog                 |  1 +
 libraries/Util.php        |  4 ++-
 libraries/session.inc.php | 72 ++++++++++++++++++++++++++-------------
 3 files changed, 53 insertions(+), 24 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 4d2e2efd5a..0ac5f8efd7 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -18,6 +18,7 @@ phpMyAdmin - ChangeLog
 - issue #12202 Fixed setting of language from user configuration
 - issue #12200 Fixed check for ndb version
 - issue #12206 Fixed loading of configuration file
+- issue #12204 Check if sessions are working and report failures
 
 4.6.0.0 (2016-03-22)
 + issue #11456 Disabled storage engines
diff --git a/libraries/Util.php b/libraries/Util.php
index 78e585be77..4dc6ad335e 100644
--- a/libraries/Util.php
+++ b/libraries/Util.php
@@ -208,8 +208,10 @@ class Util
         if (array_key_exists($class, $sprites)) {
             $is_sprite = true;
             $url = (defined('PMA_TEST_THEME') ? '../' : '') . 'themes/dot.gif';
-        } else {
+        } elseif (isset($GLOBALS['pmaThemeImage'])) {
             $url = $GLOBALS['pmaThemeImage'] . $image;
+        } else {
+            $url = './themes/pmahomme/' . $image;
         }
 
         // set class attribute
diff --git a/libraries/session.inc.php b/libraries/session.inc.php
index 4b81d3e2e1..9fd7b50f1a 100644
--- a/libraries/session.inc.php
+++ b/libraries/session.inc.php
@@ -70,36 +70,48 @@ session_cache_limiter('private');
 // on some servers (for example, sourceforge.net), we get a permission error
 // on the session data directory, so I add some "@"
 
+
+function PMA_sessionFailed($errors)
+{
+    $messages = array();
+    foreach ($errors as $error) {
+        $messages[] = $error->getMessage();
+    }
+
+    /*
+     * Session initialization is done before selecting language, so we
+     * can not use translations here.
+     */
+    PMA_fatalError(
+        'Error during session start; please check your PHP and/or '
+        . 'webserver log file and configure your PHP '
+        . 'installation properly. Also ensure that cookies are enabled '
+        . 'in your browser.'
+        . '<br /><br />'
+        . implode('<br /><br />', $messages)
+    );
+}
+
 // See bug #1538132. This would block normal behavior on a cluster
 //ini_set('session.save_handler', 'files');
 
 $session_name = 'phpMyAdmin';
 @session_name($session_name);
 
-if (! isset($_COOKIE[$session_name])) {
-    // on first start of session we check for errors
-    // f.e. session dir cannot be accessed - session file not created
-    $orig_error_count = $GLOBALS['error_handler']->countErrors();
-    $session_result = session_start();
-    if ($session_result !== true
-        || $orig_error_count != $GLOBALS['error_handler']->countErrors()
-    ) {
-        setcookie($session_name, '', 1);
-        /*
-         * Session initialization is done before selecting language, so we
-         * can not use translations here.
-         */
-        PMA_fatalError(
-            'Error during session start; please check your PHP and/or '
-            . 'webserver log file and configure your PHP '
-            . 'installation properly. Also ensure that cookies are enabled '
-            . 'in your browser.'
-        );
-    }
-    unset($orig_error_count, $session_result);
-} else {
-    session_start();
+// on first start of session we check for errors
+// f.e. session dir cannot be accessed - session file not created
+$orig_error_count = $GLOBALS['error_handler']->countErrors();
+
+$session_result = session_start();
+
+if ($session_result !== true
+    || $orig_error_count != $GLOBALS['error_handler']->countErrors()
+) {
+    setcookie($session_name, '', 1);
+    $errors = $GLOBALS['error_handler']->sliceErrors($orig_error_count);
+    PMA_sessionFailed($errors);
 }
+unset($orig_error_count, $session_result);
 
 /**
  * Disable setting of session cookies for further session_start() calls.
@@ -116,6 +128,20 @@ if (! isset($_SESSION[' PMA_token '])) {
     } else {
         $_SESSION[' PMA_token '] = bin2hex(openssl_random_pseudo_bytes(16));
     }
+
+    /**
+     * Check for disk space on session storage by trying to write it.
+     *
+     * This seems to be most reliable approach to test if sessions are working,
+     * otherwise the check would fail with custom session backends.
+     */
+    $orig_error_count = $GLOBALS['error_handler']->countErrors();
+    session_write_close();
+    if ($GLOBALS['error_handler']->countErrors() > $orig_error_count) {
+        $errors = $GLOBALS['error_handler']->sliceErrors($orig_error_count);
+        PMA_sessionFailed($errors);
+    }
+    session_start();
 }
 /**
  * Check if token is properly generated (both above functions can return false).