gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Verify value of access_time to avoid unwanted session extension

Browse Source 
We need to ansure the access_time parameter is in valid range to avoid
possibility of remotely extending session validity.

Signed-off-by: Michal Čihař <michal@cihar.com>
This commit is contained in:
Michal Čihař 2016-09-19 11:43:08 +02:00
parent 161e408ab7
commit fbad6b9b4d
4 changed files with 25 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
libraries/plugins/AuthenticationPlugin.php
View File

@ -134,4 +134,26 @@ abstract class AuthenticationPlugin
public function handlePasswordChange($password)
{
}
/**
* Store session access time in session.
*
* Tries to workaround PHP 5 session garbage collection which
* looks at the session file's last modified time
*
* @return void
*/
public function setSessionAccessTime()
{
if (isset($_REQUEST['access_time'])) {
// Ensure access_time is in range <0, LoginCookieValidity + 1>
// to avoid excessive extension of validity.
//
// Negative values can cause session expiry extension
// Too big values can cause overflow and lead to same
$_SESSION['last_access_time'] = time() - min(max(0, intval($_REQUEST['access_time'])), $GLOBALS['cfg']['LoginCookieValidity'] + 1);
} else {
$_SESSION['last_access_time'] = time();
}
}
}

8
libraries/plugins/auth/AuthenticationConfig.php
View File

@ -61,13 +61,7 @@ class AuthenticationConfig extends AuthenticationPlugin
*/
public function authSetUser()
{
// try to workaround PHP 5 session garbage collection which
// looks at the session file's last modified time
if (isset($_REQUEST['access_time'])) {
$_SESSION['last_access_time'] = time() - $_REQUEST['access_time'];
} else {
$_SESSION['last_access_time'] = time();
}
$this->setSessionAccessTime();
return true;
}

6
libraries/plugins/auth/AuthenticationCookie.php
View File

@ -450,11 +450,7 @@ class AuthenticationCookie extends AuthenticationPlugin
// Avoid showing the password in phpinfo()'s output
unset($GLOBALS['PHP_AUTH_PW']);
unset($_SERVER['PHP_AUTH_PW']);
if (isset($_REQUEST['access_time'])) {
$_SESSION['last_access_time'] = time() - $_REQUEST['access_time'];
} else {
$_SESSION['last_access_time'] = time();
}
$this->setSessionAccessTime();
}
/**

4
libraries/plugins/auth/AuthenticationHttp.php
View File

@ -228,9 +228,7 @@ class AuthenticationHttp extends AuthenticationPlugin
unset($GLOBALS['PHP_AUTH_PW']);
unset($_SERVER['PHP_AUTH_PW']);
// try to workaround PHP 5 session garbage collection which
// looks at the session file's last modified time
$_SESSION['last_access_time'] = time();
$this->setSessionAccessTime();
return true;
}