From b92d3e104786ac58661632965e8a969a23f1983a Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Thu, 20 Nov 2014 17:37:39 +0530 Subject: [PATCH 1/4] Workaround for token mismatch error on server session timeout for config and http authentication types Signed-off-by: Madhura Jayaratne --- js/ajax.js | 4 +++- libraries/common.inc.php | 2 ++ .../plugins/auth/AuthenticationConfig.class.php | 13 +++++++++++++ .../plugins/auth/AuthenticationCookie.class.php | 6 +----- .../plugins/auth/AuthenticationHttp.class.php | 15 +++++++++++++++ .../plugin/auth/PMA_AuthenticationConfig_test.php | 2 ++ .../plugin/auth/PMA_AuthenticationHttp_test.php | 2 ++ 7 files changed, 38 insertions(+), 6 deletions(-) diff --git a/js/ajax.js b/js/ajax.js index 0f46062f1d..8aaef8f77e 100644 --- a/js/ajax.js +++ b/js/ajax.js @@ -443,7 +443,9 @@ var AJAX = { AJAX.xhr = null; if (parseInt(data.redirect_flag) == 1) { // add one more GET param to display session expiry msg - window.location.href += '&session_expired=1'; + var url = window.location.href; + var tokenlessUrl = url.replace(/&?token=[^&#]*/g, ""); + window.location.href = tokenlessUrl + '&session_expired=1'; window.location.reload(); } if (data.fieldWithError) { diff --git a/libraries/common.inc.php b/libraries/common.inc.php index 8df703181e..15b028e0e4 100644 --- a/libraries/common.inc.php +++ b/libraries/common.inc.php @@ -470,7 +470,9 @@ if (PMA_checkPageValidity($_REQUEST['back'], $goto_whitelist)) { * f.e. lang, server, collation_connection in PMA_Config */ $token_mismatch = true; +$token_provided = false; if (PMA_isValid($_REQUEST['token'])) { + $token_provided = true; $token_mismatch = ($_SESSION[' PMA_token '] != $_REQUEST['token']); } diff --git a/libraries/plugins/auth/AuthenticationConfig.class.php b/libraries/plugins/auth/AuthenticationConfig.class.php index c6ec919715..1b104d4eb6 100644 --- a/libraries/plugins/auth/AuthenticationConfig.class.php +++ b/libraries/plugins/auth/AuthenticationConfig.class.php @@ -27,6 +27,16 @@ class AuthenticationConfig extends AuthenticationPlugin */ public function auth() { + $response = PMA_Response::getInstance(); + if ($response->isAjax()) { + $response->isSuccess(false); + $response->addJSON('redirect_flag', '1'); + if (defined('TESTSUITE')) { + return true; + } else { + exit; + } + } return true; } @@ -37,6 +47,9 @@ class AuthenticationConfig extends AuthenticationPlugin */ public function authCheck() { + if ($GLOBALS['token_provided'] && $GLOBALS['token_mismatch']) { + return false; + } return true; } diff --git a/libraries/plugins/auth/AuthenticationCookie.class.php b/libraries/plugins/auth/AuthenticationCookie.class.php index 8291689fdf..1269c4c8c6 100644 --- a/libraries/plugins/auth/AuthenticationCookie.class.php +++ b/libraries/plugins/auth/AuthenticationCookie.class.php @@ -62,11 +62,7 @@ class AuthenticationCookie extends AuthenticationPlugin $response = PMA_Response::getInstance(); if ($response->isAjax()) { $response->isSuccess(false); - - $response->addJSON( - 'redirect_flag', - '1' - ); + $response->addJSON('redirect_flag', '1'); if (defined('TESTSUITE')) { return true; } else { diff --git a/libraries/plugins/auth/AuthenticationHttp.class.php b/libraries/plugins/auth/AuthenticationHttp.class.php index a0b73c3c7a..2c1fee8f2a 100644 --- a/libraries/plugins/auth/AuthenticationHttp.class.php +++ b/libraries/plugins/auth/AuthenticationHttp.class.php @@ -32,6 +32,17 @@ class AuthenticationHttp extends AuthenticationPlugin */ public function auth() { + $response = PMA_Response::getInstance(); + if ($response->isAjax()) { + $response->isSuccess(false); + $response->addJSON('redirect_flag', '1'); + if (defined('TESTSUITE')) { + return true; + } else { + exit; + } + } + /* Perform logout to custom URL */ if (! empty($_REQUEST['old_usr']) && ! empty($GLOBALS['cfg']['Server']['LogoutURL']) @@ -115,6 +126,10 @@ class AuthenticationHttp extends AuthenticationPlugin { global $PHP_AUTH_USER, $PHP_AUTH_PW; + if ($GLOBALS['token_provided'] && $GLOBALS['token_mismatch']) { + return false; + } + // Grabs the $PHP_AUTH_USER variable whatever are the values of the // 'register_globals' and the 'variables_order' directives if (empty($PHP_AUTH_USER)) { diff --git a/test/classes/plugin/auth/PMA_AuthenticationConfig_test.php b/test/classes/plugin/auth/PMA_AuthenticationConfig_test.php index 3c39ccd3b1..5653bda9c1 100644 --- a/test/classes/plugin/auth/PMA_AuthenticationConfig_test.php +++ b/test/classes/plugin/auth/PMA_AuthenticationConfig_test.php @@ -35,6 +35,8 @@ class PMA_AuthenticationConfig_Test extends PHPUnit_Framework_TestCase $GLOBALS['PMA_Config'] = new PMA_Config(); $GLOBALS['PMA_Config']->enableBc(); $GLOBALS['server'] = 0; + $GLOBALS['token_provided'] = true; + $GLOBALS['token_mismatch'] = false; $this->object = new AuthenticationConfig(); } diff --git a/test/classes/plugin/auth/PMA_AuthenticationHttp_test.php b/test/classes/plugin/auth/PMA_AuthenticationHttp_test.php index a6cbfb24e6..e898d7713f 100644 --- a/test/classes/plugin/auth/PMA_AuthenticationHttp_test.php +++ b/test/classes/plugin/auth/PMA_AuthenticationHttp_test.php @@ -44,6 +44,8 @@ class PMA_AuthenticationHttp_Test extends PHPUnit_Framework_TestCase "en" => array("English", "US-ENGLISH"), "ch" => array("Chinese", "TW-Chinese") ); + $GLOBALS['token_provided'] = true; + $GLOBALS['token_mismatch'] = false; $this->object = new AuthenticationHttp(); } From 5e1ab952b88098f6482064499d1b8c12af54aa5a Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Wed, 26 Nov 2014 08:41:33 +0530 Subject: [PATCH 2/4] Use a separate flag to avoid confusion Signed-off-by: Madhura Jayaratne --- js/ajax.js | 8 +++++--- libraries/plugins/auth/AuthenticationConfig.class.php | 2 +- libraries/plugins/auth/AuthenticationHttp.class.php | 2 +- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/js/ajax.js b/js/ajax.js index 8aaef8f77e..2f83f31a69 100644 --- a/js/ajax.js +++ b/js/ajax.js @@ -443,9 +443,11 @@ var AJAX = { AJAX.xhr = null; if (parseInt(data.redirect_flag) == 1) { // add one more GET param to display session expiry msg - var url = window.location.href; - var tokenlessUrl = url.replace(/&?token=[^&#]*/g, ""); - window.location.href = tokenlessUrl + '&session_expired=1'; + window.location.href += '&session_expired=1'; + window.location.reload(); + } else if (parseInt(data.reload_flag) == 1) { + // remove the token param and reload + window.location.href = window.location.href.replace(/&?token=[^&#]*/g, ""); window.location.reload(); } if (data.fieldWithError) { diff --git a/libraries/plugins/auth/AuthenticationConfig.class.php b/libraries/plugins/auth/AuthenticationConfig.class.php index 1b104d4eb6..30385472ba 100644 --- a/libraries/plugins/auth/AuthenticationConfig.class.php +++ b/libraries/plugins/auth/AuthenticationConfig.class.php @@ -30,7 +30,7 @@ class AuthenticationConfig extends AuthenticationPlugin $response = PMA_Response::getInstance(); if ($response->isAjax()) { $response->isSuccess(false); - $response->addJSON('redirect_flag', '1'); + $response->addJSON('reload_flag', '1'); if (defined('TESTSUITE')) { return true; } else { diff --git a/libraries/plugins/auth/AuthenticationHttp.class.php b/libraries/plugins/auth/AuthenticationHttp.class.php index 2c1fee8f2a..6fc2654bc8 100644 --- a/libraries/plugins/auth/AuthenticationHttp.class.php +++ b/libraries/plugins/auth/AuthenticationHttp.class.php @@ -35,7 +35,7 @@ class AuthenticationHttp extends AuthenticationPlugin $response = PMA_Response::getInstance(); if ($response->isAjax()) { $response->isSuccess(false); - $response->addJSON('redirect_flag', '1'); + $response->addJSON('reload_flag', '1'); if (defined('TESTSUITE')) { return true; } else { From ea7ca462e56c83792ddc6c9320215a3566ffbba2 Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Wed, 26 Nov 2014 09:39:16 +0530 Subject: [PATCH 3/4] Document what these flags do Signed-off-by: Madhura Jayaratne --- libraries/plugins/auth/AuthenticationConfig.class.php | 1 + libraries/plugins/auth/AuthenticationCookie.class.php | 1 + libraries/plugins/auth/AuthenticationHttp.class.php | 1 + 3 files changed, 3 insertions(+) diff --git a/libraries/plugins/auth/AuthenticationConfig.class.php b/libraries/plugins/auth/AuthenticationConfig.class.php index 30385472ba..bf7c7af76c 100644 --- a/libraries/plugins/auth/AuthenticationConfig.class.php +++ b/libraries/plugins/auth/AuthenticationConfig.class.php @@ -30,6 +30,7 @@ class AuthenticationConfig extends AuthenticationPlugin $response = PMA_Response::getInstance(); if ($response->isAjax()) { $response->isSuccess(false); + // reload_flag removes the token parameter from the URL and reload $response->addJSON('reload_flag', '1'); if (defined('TESTSUITE')) { return true; diff --git a/libraries/plugins/auth/AuthenticationCookie.class.php b/libraries/plugins/auth/AuthenticationCookie.class.php index 1269c4c8c6..63575674d9 100644 --- a/libraries/plugins/auth/AuthenticationCookie.class.php +++ b/libraries/plugins/auth/AuthenticationCookie.class.php @@ -62,6 +62,7 @@ class AuthenticationCookie extends AuthenticationPlugin $response = PMA_Response::getInstance(); if ($response->isAjax()) { $response->isSuccess(false); + // redirect_flag redirects to the loging page $response->addJSON('redirect_flag', '1'); if (defined('TESTSUITE')) { return true; diff --git a/libraries/plugins/auth/AuthenticationHttp.class.php b/libraries/plugins/auth/AuthenticationHttp.class.php index 6fc2654bc8..685315618d 100644 --- a/libraries/plugins/auth/AuthenticationHttp.class.php +++ b/libraries/plugins/auth/AuthenticationHttp.class.php @@ -35,6 +35,7 @@ class AuthenticationHttp extends AuthenticationPlugin $response = PMA_Response::getInstance(); if ($response->isAjax()) { $response->isSuccess(false); + // reload_flag removes the token parameter from the URL and reload $response->addJSON('reload_flag', '1'); if (defined('TESTSUITE')) { return true; From 5c02da89bef87ff7161914662ebb9bf9449d97b2 Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Fri, 28 Nov 2014 11:01:18 +0530 Subject: [PATCH 4/4] ChangeLog entry for bug #4227 Signed-off-by: Madhura Jayaratne --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index f4d3f6379c..6c6de04320 100644 --- a/ChangeLog +++ b/ChangeLog @@ -68,6 +68,7 @@ phpMyAdmin - ChangeLog - bug #4243 Super slow page rendering with tens of thousands of DBs - bug #4391 Upgraded to 4.2.0, insanely slow now + rfe #1537 PHP OpenSSL support for cookie encryption/decryption +- bug #4227 Token mismatch when using HTTP AUTH and the SESSION expires 4.2.13.0 (not yet released) - bug #4604 Query history not being deleted