gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
109,918 Commits 12 Branches 481 Tags 2.4 GiB
QA_4_7
Commit Graph

165 Commits

Author SHA1 Message Date
Michal Čihař
edd929216a Bring back token validation to GET requests 
This is necessary to avoid CSRF on SQL queries. This is really more a
short term fix, proper fix (to be implemented in master) is to avoid
accepting SQL queries from GET requests.

This reverts commits:

* dae3390a02
* ea73fded71
* 90433788d6
* f797a8d87d
* 9c1cfc8553

Signed-off-by: Michal Čihař <michal@cihar.com>
 2017-12-14 17:27:22 +01:00
Michal Čihař
8d6b1dce57 Improved handling of logout with disabled LoginCookieDeleteAll 
- avoid removing session for cookie auth if LoginCookieDeleteAll is
  disabled
- redirect user to other server rather than to login page
- show message about partial logout
- adjust tests
- this is based on #13221

Fixes #12301

Signed-off-by: Michal Čihař <michal@cihar.com>
 2017-04-28 16:02:11 +02:00
Michal Čihař
82f13e34d0 Better handle multiple open browser windows 
Calculate session expiry per browser (tracking is based on
sessionStorage which is unique per tab). With this we're able to detect
that there is another window open and actively used and avoid logging it
out by inactive one.

Issue #11231

Signed-off-by: Michal Čihař <michal@cihar.com>
 2017-02-14 17:00:44 +01:00
Michal Čihař
1b7914a4e5 Remove connect_type setting 
It is really not necessary as MySQL decides connection type rather based
on hostname than on anything else.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2017-02-02 16:08:44 +01:00
Michal Čihař
d2ade81788 Assert for language selection only in case locales are available 
Fixes #12911

Signed-off-by: Michal Čihař <michal@cihar.com>
 2017-01-21 12:46:42 +01:00
Michal Čihař
815149c3f9 Share more of response mocking 
Issue #12079

Signed-off-by: Michal Čihař <michal@cihar.com>
 2017-01-18 16:32:19 +01:00
Michal Čihař
028f32da5f Share more code for reponse mocking 
Issue #12079

Signed-off-by: Michal Čihař <michal@cihar.com>
 2017-01-18 16:14:25 +01:00
osaid
f98832c691 remove tab and unused code 
Signed-off-by: osaid <osaid.nasir@gmail.com>
 2017-01-08 19:21:47 +05:30
osaid
528d702e6b use shared response mock 
Signed-off-by: osaid <osaid.nasir@gmail.com>
 2017-01-08 19:04:03 +05:30
Michal Čihař
3c2867c02a Use shared response mock in cookie auth tests 
Issue #12079

Signed-off-by: Michal Čihař <michal@cihar.com>
 2017-01-08 10:51:25 +01:00
Michal Čihař
10416615cd Merge remote-tracking branch 'origin/pull/12799' 2017-01-02 16:15:58 +01:00
Michal Čihař
92aa487c54 Merge branch 'QA_4_6' 2016-12-20 14:44:03 +01:00
Michal Čihař
09da5eb49f Test both with and without phpseclib 
This ensures we generate compatible data in both cases.

Issue #12293

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-20 14:40:31 +01:00
Michal Čihař
30cd5fc358 Use same encryption key with openssl and phpseclib 
Issue #12293

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-20 14:38:34 +01:00
Michal Čihař
6bf4f3bf39 Merge branch 'QA_4_6' 2016-12-19 16:20:57 +01:00
Michal Čihař
a856a61c9d Fix HTTP auth test expectations 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-19 16:20:51 +01:00
Ashus
40825597df Fixed tests for SignonCookieParams parameter 
Signed-off-by: Ashus <github.com@ashus.net>
 2016-12-10 17:19:25 +01:00
Ashus
e63ffe1ab8 Added SignonCookieParams parameter 
Signed-off-by: Ashus <github.com@ashus.net>
 2016-12-10 15:52:44 +01:00
Michal Čihař
23e01d306a Merge branch 'QA_4_6' 2016-08-17 15:38:22 +02:00
Michal Čihař
83476322ba Use PmaAbsolueUri for cookie path 
Issue #12374

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-17 15:35:15 +02:00
Michal Čihař
7ef6fecb87 Merge branch 'master' into master-security 2016-08-01 11:07:33 +02:00
Michal Čihař
ea73fded71 Adjust tests to token removal from GET 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-28 11:22:45 +02:00
Michal Čihař
360b8e8a11 Merge branch 'master' into master-security 2016-07-28 09:44:08 +02:00
Michal Čihař
d31ff5a1e7 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-28 09:43:26 +02:00
Michal Čihař
6d8e1d7935 Merge branch 'QA_4_6' 2016-07-28 09:38:08 +02:00
Michal Čihař
4072c1d29a Use example.com for sample test urls 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-28 09:12:01 +02:00
Michal Čihař
d15490088c Merge branch 'QA_4_6' 2016-07-27 16:30:47 +02:00
Michal Čihař
af337d2054 Use https to access phpmyadmin.net 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-27 16:29:08 +02:00
Michal Čihař
f5015c2ea3 Merge branch 'QA_4_6-security' into master-security 2016-07-26 16:31:21 +02:00
Michal Čihař
99492bf42a Merge branch 'QA_4_6' into QA_4_6-security 2016-07-26 16:29:07 +02:00
Michal Čihař
22c4ede46d Merge branch 'QA_4_6' 2016-07-26 16:26:57 +02:00
Michal Čihař
6c95b73f90 Do not append session IDs to all URLs in redirect 
There is no need to do that as we rely on session cookies anyway. Also
appending sesson ID to external URLs is not a good idea.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:20:04 +02:00
Michal Čihař
45aedabbe6 Fix test errors 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:47:28 +02:00
Michal Čihař
f72572708f Merge branch 'QA_4_6-security' into master-security 2016-07-22 14:42:09 +02:00
Michal Čihař
9106b33933 Improve secrets splitting 
- ensure it has 16 bytes
- extends it by copying content if original is too short
- correctly handle corner cases (eg. 1 byte secret)

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:10:28 +02:00
Michal Čihař
643681ee68 Use consistent iv and encrypted text concatenation as other libs 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 13:46:51 +02:00
Michal Čihař
2adf1ca83e Merge branch 'QA_4_6-security' into master-security 2016-07-22 11:35:14 +02:00
Michal Čihař
3ee65fc8bf Use MAC to verify IV as well 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:29:46 +02:00
Michal Čihař
ef03daf658 Remove hashing of blowfish secret 
New code doesn't have problems with longer secrets.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:59:02 +02:00
Michal Čihař
d29df46b3a Do not generate too long session secret 
We need 16+16 bytes, generating 256 is not really needed.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:58:39 +02:00
Michal Čihař
e2a25d773d Merge pmaServer and pmaPass cookies 
This addresses several issues:

- makes server name encrypted and authenticated, so that it can not be
  tampered
- reduces cookie usage
- reduces overhead of encryption/authentication

The pmaUser cookie is still separate to avoid different lifetime
(pmaUser has month lifetime, while pmaAuth is session only by default).

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
2a2d865d50 Validate input data from cookies 
We expect strings only, so not accept anything else.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
3ba8a026fc Use hash_hmac for MAC rather than plain SHA1 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:56:52 +02:00
Michal Čihař
3f98ad5414 Merge branch 'QA_4_6-security' into master-security 2016-07-18 16:24:12 +02:00
Michal Čihař
1543be7138 Use https to access phpmyadmin.net 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:22:33 +02:00
Michal Čihař
fc6ef261eb Remove Swekey support 
It is buggy and their servers are no longer working.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-11 09:02:58 +02:00
Michal Čihař
6f75f8a261 Merge branch 'QA_4_6-security' into master-security 2016-07-09 09:14:12 +02:00
Michal Čihař
a97be3a604 Improve cookie encryption 
- use MAC to validate content before decryption
- create unique IV for every cookie

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-08 17:40:05 +02:00
Michal Čihař
9b7a6967a8 Merge branch 'QA_4_6' 2016-06-15 11:46:29 +02:00
Michal Čihař
8a142aba73 Adjust tests to new behavior 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-15 11:45:16 +02:00