Improved handling of logout with disabled LoginCookieDeleteAll

- avoid removing session for cookie auth if LoginCookieDeleteAll is
  disabled
- redirect user to other server rather than to login page
- show message about partial logout
- adjust tests
- this is based on #13221

Fixes #12301

Signed-off-by: Michal Čihař <michal@cihar.com>

ChangeLog

@@ -15,6 +15,7 @@ phpMyAdmin - ChangeLog
 - issue #13154 Fixed PHP error on password change
 - issue #13219 Fix Refresh of Process List
 - issue #13182 Fix refresh of long queries
+- issue #12301 Improved handling of logout with disabled LoginCookieDeleteAll
 
 4.7.0 (2017-03-28)
 - patch #12233 [Display] Improve message when renaming database to same name

index.php

@@ -5,6 +5,7 @@
  *
  * @package PhpMyAdmin
  */
+use PMA\libraries\Message;
 use PMA\libraries\Response;
 use PMA\libraries\RecentFavoriteTable;
 use PMA\libraries\URL;
@@ -110,6 +111,12 @@ if (! empty($message)) {
     echo PMA\libraries\Util::getMessage($message);
     unset($message);
 }
+if (isset($_SESSION['partial_logout'])) {
+    Message::success(
+        __('You were logged out from one server, to logout completely from phpMyAdmin, you need to logout from all servers.')
+    )->display();
+    unset($_SESSION['partial_logout']);
+}
 
 $common_url_query =  URL::getCommon();
 $mysql_cur_user_and_host = '';

libraries/plugins/AuthenticationPlugin.php

@@ -8,6 +8,7 @@
 namespace PMA\libraries\plugins;
 
 use PMA\libraries\Sanitize;
+use PMA\libraries\URL;
 
 /**
  * Provides a common interface that will have to be implemented by all of the
@@ -74,22 +75,36 @@ abstract class AuthenticationPlugin
         $PHP_AUTH_USER = '';
         $PHP_AUTH_PW = '';
 
-        /* Get a logged-in server count */
-        $servers = 0;
+        /*
+         * Get a logged-in server count in case of LoginCookieDeleteAll is disabled.
+         */
+        $server = 0;
+        if ($GLOBALS['cfg']['LoginCookieDeleteAll'] === false
+            && $GLOBALS['cfg']['Server']['auth_type'] == 'cookie'
+        ) {
             foreach ($GLOBALS['cfg']['Servers'] as $key => $val) {
                 if (isset($_COOKIE['pmaAuth-' . $key])) {
-                $servers++;
+                    $server = $key;
+                }
             }
         }
 
+        if ($server === 0) {
             /* delete user's choices that were stored in session */
-        if ($servers === 0 and ! defined('TESTSUITE')) {
+            if (! defined('TESTSUITE')) {
                 $_SESSION = array();
                 session_destroy();
             }
 
             /* Redirect to login form (or configured URL) */
             PMA_sendHeaderLocation($redirect_url);
+        } else {
+            /* Redirect to other autenticated server */
+            $_SESSION['partial_logout'] = true;
+            PMA_sendHeaderLocation(
+                './index.php' . URL::getCommonRaw(array('server' => $server))
+            );
+        }
     }
 
     /**

test/classes/plugin/auth/AuthenticationCookieTest.php

@@ -352,6 +352,27 @@ class AuthenticationCookieTest extends PMATestCase
         $this->mockResponse('Location: https://example.com/logout');
 
         $GLOBALS['cfg']['Server']['LogoutURL'] = 'https://example.com/logout';
+        $GLOBALS['cfg']['Server']['auth_type'] = 'cookie';
+
+        $this->object->logOut();
+    }
+
+    /**
+     * Test for PMA\libraries\plugins\auth\AuthenticationConfig::auth with headers
+     *
+     * @return void
+     */
+    public function testAuthHeaderPartial()
+    {
+        $GLOBALS['cfg']['LoginCookieDeleteAll'] = false;
+        $GLOBALS['cfg']['Servers'] = array(1, 2, 3);
+        $GLOBALS['cfg']['Server']['LogoutURL'] = 'https://example.com/logout';
+        $GLOBALS['cfg']['Server']['auth_type'] = 'cookie';
+        $GLOBALS['collation_connection'] = 'utf-8';
+
+        $_COOKIE['pmaAuth-2'] = '';
+
+        $this->mockResponse('Location: /phpmyadmin/index.php?server=2&lang=en&collation_connection=utf-8');
 
         $this->object->logOut();
     }
@@ -417,6 +438,7 @@ class AuthenticationCookieTest extends PMATestCase
         $GLOBALS['PMA_Config']->set('PmaAbsoluteUri', '');
         $GLOBALS['cfg']['Servers'] = array(1);
         $GLOBALS['server'] = 1;
+        $GLOBALS['cfg']['Server'] = array('auth_type' => 'cookie');
 
         $_COOKIE['pmaAuth-1'] = 'test';
 

test/classes/plugin/auth/AuthenticationHttpTest.php

@@ -32,6 +32,7 @@ class AuthenticationHttpTest extends PMATestCase
     {
         $GLOBALS['PMA_Config'] = new PMA\libraries\Config;
         $GLOBALS['PMA_Config']->enableBc();
+        $GLOBALS['cfg']['Servers'] = array();
         $GLOBALS['server'] = 0;
         $GLOBALS['lang'] = "en";
         $GLOBALS['text_dir'] = "ltr";