gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
109,918 Commits 12 Branches 481 Tags 2.4 GiB
QA_4_7
Commit Graph

31 Commits

Author SHA1 Message Date
Michal Čihař
9835791bff Fix empty password login for http authetication 
Fixes #12828

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-19 16:01:00 +01:00
Michal Čihař
945e615253 Merge branch 'QA_4_6' 2016-12-19 15:23:31 +01:00
Michal Čihař
7d361806c3 Share code for rendering custom header and footer 
Fixes #12802

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-19 15:20:12 +01:00
Isaac Bennetch
e3a4bfe757 Fix display of custom header and footer in certain edge cases. 
Issues #12801 and #12802

Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-12-14 12:32:42 -05:00
Isaac Bennetch
1f24e5c755 Merge branch 'master-security' 2016-11-25 01:22:59 -05:00
Isaac Bennetch
253894e299 Resolve merge conflicts with ChangeLog 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-11-24 11:03:58 -05:00
Michal Čihař
cf7a731ca1 Merge branch 'QA_4_6' 2016-11-18 11:01:10 +01:00
Michal Čihař
53f07e7179 Remove protection against < in HTTP Authorization header 
It really doesn't make sense here as the username can potentionally
contain < anyway and we need to deal with it later (and we do).

Fixes #12710

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-11-18 11:00:11 +01:00
Michal Čihař
5a1854c2b7 Merge branch 'QA_4_6-security' into master-security 2016-09-19 11:53:49 +02:00
Michal Čihař
fbad6b9b4d Verify value of access_time to avoid unwanted session extension 
We need to ansure the access_time parameter is in valid range to avoid
possibility of remotely extending session validity.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-09-19 11:53:07 +02:00
Michal Čihař
9816dc66af Merge branch 'QA_4_6-security' into master-security 2016-08-18 09:50:57 +02:00
Michal Čihař
c83b2b0872 Use hash_equals for checking username 
This makes the comparison happen in constant time and makes it
impossible to use it to guess stored usernames.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 09:41:21 +02:00
Michal Čihař
b2ea7205fb Merge branch 'QA_4_6-security' into master-security 2016-08-18 09:12:49 +02:00
Michal Čihař
9dbe520e90 Strip null bytes from MySQL username 
In old PHP versions this could lead to allow/deny rules bypass.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 09:11:45 +02:00
Michal Čihař
e6ff157dda The session_destroy is already called on logout 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-08 15:30:55 +02:00
Michal Čihař
e3d650a2bb Merge branch 'QA_4_6' 2016-05-23 13:05:01 +02:00
Michal Čihař
11eb574242 Improve handling of logout 
- add separate script for handling logout
- no longer require old_usr for all authentication methods
  (this avoids potential information leak)
- require valid token for logout

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 13:02:21 +02:00
Michal Čihař
f8ead4738e Merge branch 'QA_4_6' 2016-03-17 11:32:22 +01:00
Michal Čihař
1523985bce Fix login after logout with http authentication 
We can not check token here as it's always there (in the URL) after
logout.

Fixes #12098

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-03-17 11:31:06 +01:00
Michal Čihař
f5393eff61 Remove code mentioning register_globals 
This was removed in PHP 5.4.0 so we really do not have to care anymore.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-03-08 15:30:24 +01:00
Michal Čihař
5042b65398 Merge branch 'QA_4_5' into QA_4_6 2016-02-12 10:45:43 +01:00
Michal Čihař
c2b41b829a Wrap header() and headers_sent() in response 
This allows us to test the code without using runkit. Currenly only
AuthenticationHttp is migrated to new code, but others will follow.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-03 19:49:05 +01:00
Michal Čihař
431450a237 Make test run even without runkit 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-03 19:49:05 +01:00
Michal Čihař
db6af1be82 Simplify code 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-03 17:57:19 +01:00
Michal Čihař
46a70dba88 Remove unused method (parent class defines it) 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2015-12-01 13:54:04 +01:00
Hugues Peccatte
37d2a661c0 Make PHPCS happy. 
Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2015-10-07 22:49:49 +02:00
Hugues Peccatte
6f4676cdfc Merge remote-tracking branch 'origin/master' into useNamespaces_master 2015-10-04 18:04:49 +02:00
Hugues Peccatte
70acefd180 Replace Response calls by short calls. 
Add missing require.

Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2015-09-05 23:39:02 +02:00
Hugues Peccatte
6c594eb0cf Fix calls. 
Remove useless PHPDoc.
Add missing require.
Add missing 'use'.

Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2015-09-05 22:58:47 +02:00
Hugues Peccatte
178a6edd38 Add namespace on part of plugins classes. 
Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2015-09-05 00:33:42 +02:00
Hugues Peccatte
04b4f723d8 Move libraries/plugins/auth and export classes into a namespace. 
Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2015-09-05 00:09:30 +02:00