Merge remote-tracking branch 'origin/QA_4_3' into QA_4_3

ChangeLog

@@ -68,6 +68,7 @@ phpMyAdmin - ChangeLog
 - bug #4243 Super slow page rendering with tens of thousands of DBs
 - bug #4391 Upgraded to 4.2.0, insanely slow now
 + rfe #1537 PHP OpenSSL support for cookie encryption/decryption
+- bug #4227 Token mismatch when using HTTP AUTH and the SESSION expires
 
 4.2.13.0 (not yet released)
 - bug #4604 Query history not being deleted

js/ajax.js

@@ -445,6 +445,10 @@ var AJAX = {
                 // add one more GET param to display session expiry msg
                 window.location.href += '&session_expired=1';
                 window.location.reload();
+            } else if (parseInt(data.reload_flag) == 1) {
+                // remove the token param and reload
+                window.location.href = window.location.href.replace(/&?token=[^&#]*/g, "");
+                window.location.reload();
             }
             if (data.fieldWithError) {
                 $(':input.error').removeClass("error");

libraries/common.inc.php

@@ -470,7 +470,9 @@ if (PMA_checkPageValidity($_REQUEST['back'], $goto_whitelist)) {
  * f.e. lang, server, collation_connection in PMA_Config
  */
 $token_mismatch = true;
+$token_provided = false;
 if (PMA_isValid($_REQUEST['token'])) {
+    $token_provided = true;
     $token_mismatch = ($_SESSION[' PMA_token '] != $_REQUEST['token']);
 }
 

libraries/plugins/auth/AuthenticationConfig.class.php

@@ -27,6 +27,17 @@ class AuthenticationConfig extends AuthenticationPlugin
      */
     public function auth()
     {
+        $response = PMA_Response::getInstance();
+        if ($response->isAjax()) {
+            $response->isSuccess(false);
+            // reload_flag removes the token parameter from the URL and reload
+            $response->addJSON('reload_flag', '1');
+            if (defined('TESTSUITE')) {
+                return true;
+            } else {
+                exit;
+            }
+        }
         return true;
     }
 
@@ -37,6 +48,9 @@ class AuthenticationConfig extends AuthenticationPlugin
      */
     public function authCheck()
     {
+        if ($GLOBALS['token_provided'] && $GLOBALS['token_mismatch']) {
+            return false;
+        }
         return true;
     }
 

libraries/plugins/auth/AuthenticationCookie.class.php

@@ -62,11 +62,8 @@ class AuthenticationCookie extends AuthenticationPlugin
         $response = PMA_Response::getInstance();
         if ($response->isAjax()) {
             $response->isSuccess(false);
-
-            $response->addJSON(
-                'redirect_flag',
-                '1'
-            );
+            // redirect_flag redirects to the loging page
+            $response->addJSON('redirect_flag', '1');
             if (defined('TESTSUITE')) {
                 return true;
             } else {

libraries/plugins/auth/AuthenticationHttp.class.php

@@ -32,6 +32,18 @@ class AuthenticationHttp extends AuthenticationPlugin
      */
     public function auth()
     {
+        $response = PMA_Response::getInstance();
+        if ($response->isAjax()) {
+            $response->isSuccess(false);
+            // reload_flag removes the token parameter from the URL and reload
+            $response->addJSON('reload_flag', '1');
+            if (defined('TESTSUITE')) {
+                return true;
+            } else {
+                exit;
+            }
+        }
+
         /* Perform logout to custom URL */
         if (! empty($_REQUEST['old_usr'])
             && ! empty($GLOBALS['cfg']['Server']['LogoutURL'])
@@ -115,6 +127,10 @@ class AuthenticationHttp extends AuthenticationPlugin
     {
         global $PHP_AUTH_USER, $PHP_AUTH_PW;
 
+        if ($GLOBALS['token_provided'] && $GLOBALS['token_mismatch']) {
+            return false;
+        }
+
         // Grabs the $PHP_AUTH_USER variable whatever are the values of the
         // 'register_globals' and the 'variables_order' directives
         if (empty($PHP_AUTH_USER)) {

test/classes/plugin/auth/PMA_AuthenticationConfig_test.php

@@ -35,6 +35,8 @@ class PMA_AuthenticationConfig_Test extends PHPUnit_Framework_TestCase
         $GLOBALS['PMA_Config'] = new PMA_Config();
         $GLOBALS['PMA_Config']->enableBc();
         $GLOBALS['server'] = 0;
+        $GLOBALS['token_provided'] = true;
+        $GLOBALS['token_mismatch'] = false;
         $this->object = new AuthenticationConfig();
     }
 

test/classes/plugin/auth/PMA_AuthenticationHttp_test.php

@@ -44,6 +44,8 @@ class PMA_AuthenticationHttp_Test extends PHPUnit_Framework_TestCase
             "en" => array("English", "US-ENGLISH"),
             "ch" => array("Chinese", "TW-Chinese")
         );
+        $GLOBALS['token_provided'] = true;
+        $GLOBALS['token_mismatch'] = false;
         $this->object = new AuthenticationHttp();
     }