Merge remote-tracking branch 'upstream/master'

ChangeLog

@@ -55,6 +55,8 @@ phpMyAdmin - ChangeLog
 - issue #11907 Avoid displaying UPDATE query twice
 - issue #11850 Fixed CSV import
 - issue        Fix SQL syntax highlighting in database search page
+- issue #12056 Fix error when we can not generate random string
+- issue #12055 Fixed PHP syntax error in templates
 
 4.5.5.1 (2016-02-29)
 - issue #11971 CREATE UNIQUE INDEX index type is not recognized by parser.

libraries/Header.php

@@ -639,6 +639,7 @@ class Header
     private function _getMetaTags()
     {
         $retval  = '<meta charset="utf-8" />';
+        $retval .= '<meta name="referrer" content="no-referrer" />';
         $retval .= '<meta name="robots" content="noindex,nofollow" />';
         $retval .= '<meta http-equiv="X-UA-Compatible" content="IE=Edge">';
         if (! $GLOBALS['cfg']['AllowThirdPartyFraming']) {

libraries/Util.php

@@ -194,8 +194,11 @@ class Util
 
         // If it's the first time this function is called
         if (! isset($sprites)) {
+            $sprites = array();
             // Try to load the list of sprites
-            $sprites = $_SESSION['PMA_Theme']->getSpriteData();
+            if (isset($_SESSION['PMA_Theme'])) {
+                $sprites = $_SESSION['PMA_Theme']->getSpriteData();
+            }
         }
 
         // Check if we have the requested image as a sprite

libraries/core.lib.php

@@ -238,8 +238,8 @@ function PMA_fatalError(
         } else {
             $error_header = 'Error';
         }
-        $lang = $GLOBALS['lang'];
-        $dir = $GLOBALS['text_dir'];
+        $lang = isset($GLOBALS['lang']) ? $GLOBALS['lang'] : 'en';
+        $dir = isset($GLOBALS['text_dir']) ? $GLOBALS['text_dir'] : 'ltr';
 
         // on fatal errors it cannot hurt to always delete the current session
         if ($delete_session

libraries/plugins/auth/AuthenticationCookie.php

@@ -692,11 +692,7 @@ class AuthenticationCookie extends AuthenticationPlugin
      */
     public static function useOpenSSL()
     {
-        return (
-            function_exists('openssl_encrypt')
-            && function_exists('openssl_decrypt')
-            && function_exists('openssl_random_pseudo_bytes')
-        );
+        return ! class_exists('phpseclib\Crypt\Random');
     }
 
     /**

libraries/session.inc.php

@@ -13,6 +13,8 @@ if (! defined('PHPMYADMIN')) {
     exit;
 }
 
+require_once 'libraries/session.lib.php';
+
 // verify if PHP supports session, die if it does not
 
 if (!@function_exists('session_name')) {
@@ -111,11 +113,13 @@ if (! isset($_COOKIE[$session_name])) {
  * (we use "space PMA_token space" to prevent overwriting)
  */
 if (! isset($_SESSION[' PMA_token '])) {
-    if (! function_exists('openssl_random_pseudo_bytes')) {
-        $_SESSION[' PMA_token '] = bin2hex(phpseclib\Crypt\Random::string(16));
-    } else {
-        $_SESSION[' PMA_token '] = bin2hex(openssl_random_pseudo_bytes(16));
-    }
+    PMA_generateToken();
+}
+/**
+ * Check if token is properly generated (both above functions can return false).
+ */
+if (empty($_SESSION[' PMA_token '])) {
+    PMA_fatalError(
+        'Failed to generate random CSRF token!'
+    );
 }
-
-require_once 'libraries/session.lib.php';

libraries/session.lib.php

@@ -19,7 +19,18 @@ function PMA_secureSession()
     if (session_status() === PHP_SESSION_ACTIVE) {
         session_regenerate_id(true);
     }
-    if (! function_exists('openssl_random_pseudo_bytes')) {
+    PMA_generateToken();
+}
+
+
+/**
+ * Generates PMA_token session variable.
+ *
+ * @return void
+ */
+function PMA_generateToken()
+{
+    if (class_exists('phpseclib\Crypt\Random')) {
         $_SESSION[' PMA_token '] = bin2hex(phpseclib\Crypt\Random::string(16));
     } else {
         $_SESSION[' PMA_token '] = bin2hex(openssl_random_pseudo_bytes(16));