gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Always use UTC time in HTTP headers

Browse Source 
Using timezones in this context can cause problem when DST changes
apply.

Also this can be information leak of server timezone.

Signed-off-by: Michal Čihař <michal@cihar.com>
This commit is contained in:
Michal Čihař 2016-08-18 17:07:00 +02:00
parent 717adf40f3
commit c44f5ab080
4 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
ChangeLog
View File

@ -7,6 +7,7 @@ phpMyAdmin - ChangeLog
- issue #12384 Fix expanding of navigation pane when clicking on database
- issue #12430 Impove partitioning support
- issue #12374 Reintroduced simplified PmaAbsoluteUri configuration directive
- issue Always use UTC time in HTTP headers
4.6.4 (2016-08-16)
- issue [security] Weaknesses with cookie encryption, see PMASA-2016-29

4
libraries/core.lib.php
View File

@ -556,7 +556,7 @@ function PMA_noCacheHeader()
return;
}
// rfc2616 - Section 14.21
header('Expires: ' . date(DATE_RFC1123));
header('Expires: ' . gmdate(DATE_RFC1123));
// HTTP/1.1
header(
'Cache-Control: no-store, no-cache, must-revalidate,'
@ -579,7 +579,7 @@ function PMA_noCacheHeader()
// test case: exporting a database into a .gz file with Safari
// would produce files not having the current time
// (added this header for Safari but should not harm other browsers)
header('Last-Modified: ' . date(DATE_RFC1123));
header('Last-Modified: ' . gmdate(DATE_RFC1123));
}

2
setup/lib/ConfigGenerator.php
View File

@ -37,7 +37,7 @@ class ConfigGenerator
. ' * Generated by: phpMyAdmin '
. $GLOBALS['PMA_Config']->get('PMA_VERSION')
. ' setup script' . $crlf
. ' * Date: ' . date(DATE_RFC1123) . $crlf
. ' * Date: ' . gmdate(DATE_RFC1123) . $crlf
. ' */' . $crlf . $crlf;
//servers

4
show_config_errors.php
View File

@ -7,7 +7,7 @@
*/
// rfc2616 - Section 14.21
header('Expires: ' . date(DATE_RFC1123));
header('Expires: ' . gmdate(DATE_RFC1123));
// HTTP/1.1
header(
'Cache-Control: no-store, no-cache, must-revalidate,'
@ -24,7 +24,7 @@ if (isset($_SERVER['HTTP_USER_AGENT'])
// test case: exporting a database into a .gz file with Safari
// would produce files not having the current time
// (added this header for Safari but should not harm other browsers)
header('Last-Modified: ' . date(DATE_RFC1123));
header('Last-Modified: ' . gmdate(DATE_RFC1123));
}
header('Content-Type: text/html; charset=utf-8');