Calculate session expiry per browser (tracking is based on
sessionStorage which is unique per tab). With this we're able to detect
that there is another window open and actively used and avoid logging it
out by inactive one.
Issue #11231
Signed-off-by: Michal Čihař <michal@cihar.com>
Move the check from template to the code, so that the selection is
completely hidden when there is nothing to select.
Fixes#12988
Signed-off-by: Michal Čihař <michal@cihar.com>
It is really not necessary as MySQL decides connection type rather based
on hostname than on anything else.
Signed-off-by: Michal Čihař <michal@cihar.com>
This can happen from corrupted cookies, by invalid encryption parameters
used in older phpMyAdmin versions or by wrong openSSL configuration.
In neither case the error is useful to user, but we need to clear the
error buffer as otherwise the errors would pop up later, for example
during MySQL SSL setup.
Fixes#12924
Signed-off-by: Michal Čihař <michal@cihar.com>
Without calling openssl_error_string() we pollute openssl global state
and some other library might report this as failure (eg. mysqlnd driver
when connecting to SSL enabled server).
Fixes#12293
Signed-off-by: Michal Čihař <michal@cihar.com>
We need to ansure the access_time parameter is in valid range to avoid
possibility of remotely extending session validity.
Signed-off-by: Michal Čihař <michal@cihar.com>
This makes the comparison happen in constant time and makes it
impossible to use it to guess stored usernames.
Signed-off-by: Michal Čihař <michal@cihar.com>
We can not set same cookie twice, so we have to avoid sending auth
cookie when we're about to change the password.
Signed-off-by: Michal Čihař <michal@cihar.com>
- ensure it has 16 bytes
- extends it by copying content if original is too short
- correctly handle corner cases (eg. 1 byte secret)
Signed-off-by: Michal Čihař <michal@cihar.com>
This addresses several issues:
- makes server name encrypted and authenticated, so that it can not be
tampered
- reduces cookie usage
- reduces overhead of encryption/authentication
The pmaUser cookie is still separate to avoid different lifetime
(pmaUser has month lifetime, while pmaAuth is session only by default).
Signed-off-by: Michal Čihař <michal@cihar.com>
