gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #11686 from devenbansod/fix_11684

Browse Source 
Fix issue #11684
This commit is contained in:
Deven Bansod 2015-11-26 08:56:05 +05:30
commit fa36f00198
3 changed files with 84 additions and 50 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

88
libraries/server_privileges.lib.php
View File

@ -1949,18 +1949,25 @@ function PMA_updatePassword($err_url, $username, $hostname)
if (empty($message)) {
$hashing_function = 'PASSWORD';
$serverType = PMA_Util::getServerType();
$authentication_plugin =
(isset($_REQUEST['authentication_plugin'])
? $_REQUEST['authentication_plugin']
: PMA_getCurrentAuthenticationPlugin(
'change',
$username,
$hostname
));
// Use 'ALTER USER ...' syntax for MySQL 5.7.6+
if ($serverType == 'MySQL'
&& PMA_MYSQL_INT_VERSION >= 50706
) {
if (isset($_REQUEST['authentication_plugin'])
&& $_REQUEST['authentication_plugin'] != 'mysql_old_password'
) {
if ($authentication_plugin != 'mysql_old_password') {
$query_prefix = "ALTER USER '"
. PMA_Util::sqlAddSlashes($username)
. "'@'" . PMA_Util::sqlAddSlashes($hostname) . "'"
. " IDENTIFIED WITH "
. $_REQUEST['authentication_plugin']
. $authentication_plugin
. " BY '";
} else {
$query_prefix = "ALTER USER '"
@ -1974,20 +1981,49 @@ function PMA_updatePassword($err_url, $username, $hostname)
$local_query = $query_prefix
. PMA_Util::sqlAddSlashes($_POST['pma_pw']) . "'";
} else if (($serverType == 'MySQL'
&& PMA_MYSQL_INT_VERSION >= 50507)
|| ($serverType == 'MariaDB'
&& PMA_MYSQL_INT_VERSION >= 50200)
} else if ($serverType == 'MariaDB'
&& PMA_MYSQL_INT_VERSION >= 50200
&& $is_superuser
) {
// Use 'UPDATE `mysql`.`user` ...' Syntax for MariaDB 5.2+
if ($authentication_plugin == 'mysql_native_password') {
// Set the hashing method used by PASSWORD()
// to be 'mysql_native_password' type
$GLOBALS['dbi']->tryQuery('SET old_passwords = 0;');
} else if ($authentication_plugin == 'sha256_password') {
// Set the hashing method used by PASSWORD()
// to be 'sha256_password' type
$GLOBALS['dbi']->tryQuery('SET `old_passwords` = 2;');
}
$hashedPassword = PMA_getHashedPassword($_POST['pma_pw']);
$sql_query = 'SET PASSWORD FOR \''
. PMA_Util::sqlAddSlashes($username)
. '\'@\'' . PMA_Util::sqlAddSlashes($hostname) . '\' = '
. (($_POST['pma_pw'] == '')
? '\'\''
: $hashing_function . '(\''
. preg_replace('@.@s', '*', $_POST['pma_pw']) . '\')');
$local_query = "UPDATE `mysql`.`user` SET "
. " `authentication_string` = '" . $hashedPassword
. "', `Password` = '', "
. " `plugin` = '" . $authentication_plugin . "'"
. " WHERE `User` = '" . $username . "' AND Host = '"
. $hostname . "';";
$GLOBALS['dbi']->tryQuery("FLUSH PRIVILEGES;");
} else {
// USE 'SET PASSWORD ...' syntax for rest of the versions
// Backup the old value, to be reset later
$row = $GLOBALS['dbi']->fetchSingleRow(
'SELECT @@old_passwords;'
);
$orig_value = $row['@@old_passwords'];
$update_plugin_query = "UPDATE `mysql`.`user` SET"
. " `plugin` = '" . $_REQUEST['authentication_plugin'] . "'"
. " `plugin` = '" . $authentication_plugin . "'"
. " WHERE `User` = '" . $username . "' AND Host = '"
. $hostname . "';";
@ -1998,24 +2034,16 @@ function PMA_updatePassword($err_url, $username, $hostname)
$update_plugin_query,
false, $err_url
);
$GLOBALS['dbi']->tryQuery("FLUSH PRIVILEGES;");
if (isset($_REQUEST['authentication_plugin'])
&& $_REQUEST['authentication_plugin'] == 'mysql_native_password'
) {
if ($authentication_plugin == 'mysql_native_password') {
// Set the hashing method used by PASSWORD()
// to be 'mysql_native_password' type
$GLOBALS['dbi']->tryQuery('SET old_passwords = 0;');
} else if (isset($_REQUEST['authentication_plugin'])
&& $_REQUEST['authentication_plugin'] == 'sha256_password'
) {
} else if ($authentication_plugin == 'sha256_password') {
// Set the hashing method used by PASSWORD()
// to be 'sha256_password' type
$GLOBALS['dbi']->tryQuery('SET `old_passwords` = 2;');
}
$sql_query = 'SET PASSWORD FOR \''
. PMA_Util::sqlAddSlashes($username)
. '\'@\'' . PMA_Util::sqlAddSlashes($hostname) . '\' = '
@ -2023,26 +2051,6 @@ function PMA_updatePassword($err_url, $username, $hostname)
? '\'\''
: $hashing_function . '(\''
. preg_replace('@.@s', '*', $_POST['pma_pw']) . '\')');
$local_query = 'SET PASSWORD FOR \''
. PMA_Util::sqlAddSlashes($username)
. '\'@\'' . PMA_Util::sqlAddSlashes($hostname) . '\' = '
. (($_POST['pma_pw'] == '') ? '\'\'' : $hashing_function
. '(\'' . PMA_Util::sqlAddSlashes($_POST['pma_pw']) . '\')');
} else {
if (isset($_REQUEST['authentication_plugin'])
&& $_REQUEST['authentication_plugin'] == 'mysql_native_password'
) {
$GLOBALS['dbi']->tryQuery('SET `old_passwords` = 0;');
}
$sql_query = 'SET PASSWORD FOR \''
. PMA_Util::sqlAddSlashes($username)
. '\'@\'' . PMA_Util::sqlAddSlashes($hostname) . '\' = '
. (($_POST['pma_pw'] == '')
? '\'\''
: $hashing_function . '(\''
. preg_replace('@.@s', '*', $_POST['pma_pw']) . '\')');
$local_query = 'SET PASSWORD FOR \''
. PMA_Util::sqlAddSlashes($username)
. '\'@\'' . PMA_Util::sqlAddSlashes($hostname) . '\' = '

1
test/libraries/PMA_server_privileges_test.php
View File

@ -714,6 +714,7 @@ class PMA_ServerPrivileges_Test extends PHPUnit_Framework_TestCase
$hostname = 'pma_hostname';
$err_url = "error.php";
$_POST['pma_pw'] = 'pma_pw';
$_REQUEST['authentication_plugin'] = 'mysql_native_password';
$message = PMA_updatePassword(
$err_url, $username, $hostname

45
user_password.php
View File

@ -156,7 +156,7 @@ function PMA_changePassword($password, $message, $change_password_message)
);
}
if ($serverType === 'MySQL'
if ($serverType == 'MySQL'
&& PMA_MYSQL_INT_VERSION >= 50706
) {
$sql_query = 'ALTER USER \'' . $username . '\'@\'' . $hostname
@ -210,25 +210,50 @@ function PMA_changePassHashingFunction()
/**
* Generate the error url and submit the query
*
* @param string $username Username
* @param string $hostname Hostname
* @param string $password Password
* @param string $sql_query SQL query
* @param string $hashing_function Hashing function
* @param string $auth_plugin Authentication Plugin
* @param string $username Username
* @param string $hostname Hostname
* @param string $password Password
* @param string $sql_query SQL query
* @param string $hashing_function Hashing function
* @param string $orig_auth_plugin Original Authentication Plugin
*
* @return void
*/
function PMA_changePassUrlParamsAndSubmitQuery(
$username, $hostname, $password, $sql_query, $hashing_function, $auth_plugin
$username, $hostname, $password, $sql_query, $hashing_function, $orig_auth_plugin
) {
$err_url = 'user_password.php' . PMA_URL_getCommon();
if (PMA_Util::getServerType() === 'MySQL' && PMA_MYSQL_INT_VERSION >= 50706) {
$serverType = PMA_Util::getServerType();
if ($serverType == 'MySQL' && PMA_MYSQL_INT_VERSION >= 50706) {
$local_query = 'ALTER USER \'' . $username . '\'@\'' . $hostname . '\''
. ' IDENTIFIED with ' . $auth_plugin . ' BY '
. ' IDENTIFIED with ' . $orig_auth_plugin . ' BY '
. (($password == '')
? '\'\''
: '\'' . PMA_Util::sqlAddSlashes($password) . '\'');
} else if ($serverType == 'MariaDB'
&& PMA_MYSQL_INT_VERSION >= 50200
) {
if ($orig_auth_plugin == 'mysql_native_password') {
// Set the hashing method used by PASSWORD()
// to be 'mysql_native_password' type
$GLOBALS['dbi']->tryQuery('SET old_passwords = 0;');
} else if ($orig_auth_plugin == 'sha256_password') {
// Set the hashing method used by PASSWORD()
// to be 'sha256_password' type
$GLOBALS['dbi']->tryQuery('SET `old_passwords` = 2;');
}
$hashedPassword = PMA_getHashedPassword($_POST['pma_pw']);
$local_query = "UPDATE `mysql`.`user` SET"
. " `authentication_string` = '" . $hashedPassword
. "', `Password` = '', "
. " `plugin` = '" . $orig_auth_plugin . "'"
. " WHERE `User` = '" . $username . "' AND Host = '"
. $hostname . "';";
$GLOBALS['dbi']->tryQuery("FLUSH PRIVILEGES;");
} else {
$local_query = 'SET password = ' . (($password == '')
? '\'\''