gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
106,953 Commits 12 Branches 481 Tags 2.4 GiB
b2ea7205fb
Commit Graph

69 Commits

Author SHA1 Message Date
Michal Čihař
b2ea7205fb Merge branch 'QA_4_6-security' into master-security 2016-08-18 09:12:49 +02:00
Michal Čihař
9dbe520e90 Strip null bytes from MySQL username 
In old PHP versions this could lead to allow/deny rules bypass.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 09:11:45 +02:00
Michal Čihař
1cd7b757bf Merge branch 'master' into master-security 2016-08-02 08:45:23 +02:00
Michal Čihař
493ece49ee Merge branch 'QA_4_6' into QA_4_6-security 2016-08-02 08:45:16 +02:00
Michal Čihař
696eeb463d Merge branch 'QA_4_6' 2016-08-02 08:43:22 +02:00
Michal Čihař
38b73180fd Fix password change in cookie auth 
We can not set same cookie twice, so we have to avoid sending auth
cookie when we're about to change the password.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-02 08:42:44 +02:00
Michal Čihař
690202368b Merge branch 'QA_4_6-security' into master-security 2016-07-26 16:47:52 +02:00
Michal Čihař
cc9d0f128c Merge branch 'QA_4_6' into QA_4_6-security 2016-07-26 16:47:44 +02:00
Michal Čihař
e14c334d7a Merge branch 'QA_4_6' 2016-07-26 16:47:33 +02:00
Michal Čihař
16c4ca0daa Properly escape configuration parameters when rendering 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:47:01 +02:00
Michal Čihař
7de035439d Merge branch 'QA_4_6' 2016-07-22 16:42:58 +02:00
Michal Čihař
76e87c3e33 Do not use mb_strlen on data we know are bytes 
Issue #12397

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 16:39:12 +02:00
Michal Čihař
f72572708f Merge branch 'QA_4_6-security' into master-security 2016-07-22 14:42:09 +02:00
Michal Čihař
024a924b38 Avoid calculating strlen twice 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:12:45 +02:00
Michal Čihař
9106b33933 Improve secrets splitting 
- ensure it has 16 bytes
- extends it by copying content if original is too short
- correctly handle corner cases (eg. 1 byte secret)

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:10:28 +02:00
Michal Čihař
643681ee68 Use consistent iv and encrypted text concatenation as other libs 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 13:46:51 +02:00
Michal Čihař
2adf1ca83e Merge branch 'QA_4_6-security' into master-security 2016-07-22 11:35:14 +02:00
Michal Čihař
3ee65fc8bf Use MAC to verify IV as well 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:29:46 +02:00
Michal Čihař
ef03daf658 Remove hashing of blowfish secret 
New code doesn't have problems with longer secrets.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:59:02 +02:00
Michal Čihař
d29df46b3a Do not generate too long session secret 
We need 16+16 bytes, generating 256 is not really needed.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:58:39 +02:00
Michal Čihař
e2a25d773d Merge pmaServer and pmaPass cookies 
This addresses several issues:

- makes server name encrypted and authenticated, so that it can not be
  tampered
- reduces cookie usage
- reduces overhead of encryption/authentication

The pmaUser cookie is still separate to avoid different lifetime
(pmaUser has month lifetime, while pmaAuth is session only by default).

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
2a2d865d50 Validate input data from cookies 
We expect strings only, so not accept anything else.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
f45b8cd49c Use different secret for MAC than encryption 
Generated using string splitting.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:29 +02:00
Michal Čihař
3ba8a026fc Use hash_hmac for MAC rather than plain SHA1 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:56:52 +02:00
Michal Čihař
5299b36983 Merge branch 'QA_4_6-security' into master-security 2016-07-12 15:15:15 +02:00
Michal Čihař
767195e197 Sanitize MySQL host name before connecting 
It can contain p: prefix which we don't want to honor.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 15:14:57 +02:00
Michal Čihař
fc6ef261eb Remove Swekey support 
It is buggy and their servers are no longer working.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-11 09:02:58 +02:00
Michal Čihař
2b59fa3bf9 Use PMA_getIp instead of REMOTE_ADDR to get user address 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-11 08:38:16 +02:00
Michal Čihař
6f75f8a261 Merge branch 'QA_4_6-security' into master-security 2016-07-09 09:14:12 +02:00
Michal Čihař
a97be3a604 Improve cookie encryption 
- use MAC to validate content before decryption
- create unique IV for every cookie

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-08 17:40:05 +02:00
Michal Čihař
dce94f229f More consistency for URL::getCommon 
Now URL::getCommon always returns HTML encoded string, if you want
unencded one, use URL::getCommonRaw. This makes it easier to review the
code if uses correct variant.

Also I've fixed several wrong uses of the HTML encoded variant in
Location header.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-17 12:44:29 +02:00
Michal Čihař
efc89f9fbc Merge branch 'QA_4_6' 2016-05-23 14:28:33 +02:00
Michal Čihař
f978e347fb Add missing requie once for testsuite 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 14:28:28 +02:00
Michal Čihař
b52bd77987 Merge branch 'QA_4_6' 2016-05-23 13:49:00 +02:00
Michal Čihař
f9d6c40939 Safer handling of sessions during authentication 
- always generate new session for login form
- always generate new session when authenticated using cookie auth

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 13:48:25 +02:00
Michal Čihař
e3d650a2bb Merge branch 'QA_4_6' 2016-05-23 13:05:01 +02:00
Michal Čihař
11eb574242 Improve handling of logout 
- add separate script for handling logout
- no longer require old_usr for all authentication methods
  (this avoids potential information leak)
- require valid token for logout

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 13:02:21 +02:00
Michal Čihař
21db724c85 Remove need for having define for test 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 12:09:36 +02:00
Michal Čihař
56b683b32d Remove session data before calling destroy 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-17 09:56:47 +02:00
Michal Čihař
9d57ab4f2b Remove unused code 
This was used only in testsuite and quite some portion of tests existed
just to test this.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-04-07 09:51:49 +02:00
Michal Čihař
f4e16addb7 Merge remote-tracking branch 'origin/pull/12147' into tmp 2016-04-07 09:39:21 +02:00
Madhura Jayaratne
e6a3e76cfb Fix #12143 Cannot login with certain password 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-03-31 21:00:59 +11:00
Michal Čihař
b856502d64 Prefer phpseclib if avaible 
It does better decisions about which backend to use than simply using
openssl.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-03-01 15:49:05 +01:00
Durgesh
0b64827930 Refactored url parmeters generating, Issue #11990 
Signed-off-by: Durgesh <007durgesh219@gmail.com>
 2016-02-22 14:36:41 +05:30
Michal Čihař
d4820d1ebe Use recaptcha library from Packagist instead of own copy 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-22 08:05:29 +01:00
Michal Čihař
2fffee3093 Merge remote-tracking branch 'origin/pull/11986' 2016-02-22 07:56:50 +01:00
chintan zaveri
2b74163914 Removal of Swekey 
Signed-off-by: Chintan Zaveri <zaveri_chintan@rediff.com>

master rebased

Signed-off-by: Chintan Zaveri <zaveri_chintan@rediff.com>
 2016-02-20 21:41:07 +05:30
Michal Čihař
5042b65398 Merge branch 'QA_4_5' into QA_4_6 2016-02-12 10:45:43 +01:00
Michal Čihař
2148e7cad8 Implement test for Cookie auth without runkit 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-03 20:21:40 +01:00
Michal Čihař
2a9fb73f92 Remove PmaAbsoluteUri from redirects 
This is no longer needed as per RFC 7231.

Issue #11412

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-03 14:32:14 +01:00