gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
108,671 Commits 12 Branches 481 Tags 2.4 GiB
be4eaf5243
Commit Graph

57 Commits

Author SHA1 Message Date
Michal Čihař
d2ade81788 Assert for language selection only in case locales are available 
Fixes #12911

Signed-off-by: Michal Čihař <michal@cihar.com>
 2017-01-21 12:46:42 +01:00
Michal Čihař
028f32da5f Share more code for reponse mocking 
Issue #12079

Signed-off-by: Michal Čihař <michal@cihar.com>
 2017-01-18 16:14:25 +01:00
Michal Čihař
3c2867c02a Use shared response mock in cookie auth tests 
Issue #12079

Signed-off-by: Michal Čihař <michal@cihar.com>
 2017-01-08 10:51:25 +01:00
Michal Čihař
92aa487c54 Merge branch 'QA_4_6' 2016-12-20 14:44:03 +01:00
Michal Čihař
09da5eb49f Test both with and without phpseclib 
This ensures we generate compatible data in both cases.

Issue #12293

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-20 14:40:31 +01:00
Michal Čihař
30cd5fc358 Use same encryption key with openssl and phpseclib 
Issue #12293

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-20 14:38:34 +01:00
Michal Čihař
23e01d306a Merge branch 'QA_4_6' 2016-08-17 15:38:22 +02:00
Michal Čihař
83476322ba Use PmaAbsolueUri for cookie path 
Issue #12374

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-17 15:35:15 +02:00
Michal Čihař
7ef6fecb87 Merge branch 'master' into master-security 2016-08-01 11:07:33 +02:00
Michal Čihař
ea73fded71 Adjust tests to token removal from GET 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-28 11:22:45 +02:00
Michal Čihař
360b8e8a11 Merge branch 'master' into master-security 2016-07-28 09:44:08 +02:00
Michal Čihař
d31ff5a1e7 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-28 09:43:26 +02:00
Michal Čihař
6d8e1d7935 Merge branch 'QA_4_6' 2016-07-28 09:38:08 +02:00
Michal Čihař
4072c1d29a Use example.com for sample test urls 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-28 09:12:01 +02:00
Michal Čihař
d15490088c Merge branch 'QA_4_6' 2016-07-27 16:30:47 +02:00
Michal Čihař
af337d2054 Use https to access phpmyadmin.net 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-27 16:29:08 +02:00
Michal Čihař
f5015c2ea3 Merge branch 'QA_4_6-security' into master-security 2016-07-26 16:31:21 +02:00
Michal Čihař
99492bf42a Merge branch 'QA_4_6' into QA_4_6-security 2016-07-26 16:29:07 +02:00
Michal Čihař
22c4ede46d Merge branch 'QA_4_6' 2016-07-26 16:26:57 +02:00
Michal Čihař
6c95b73f90 Do not append session IDs to all URLs in redirect 
There is no need to do that as we rely on session cookies anyway. Also
appending sesson ID to external URLs is not a good idea.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:20:04 +02:00
Michal Čihař
45aedabbe6 Fix test errors 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:47:28 +02:00
Michal Čihař
f72572708f Merge branch 'QA_4_6-security' into master-security 2016-07-22 14:42:09 +02:00
Michal Čihař
9106b33933 Improve secrets splitting 
- ensure it has 16 bytes
- extends it by copying content if original is too short
- correctly handle corner cases (eg. 1 byte secret)

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:10:28 +02:00
Michal Čihař
643681ee68 Use consistent iv and encrypted text concatenation as other libs 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 13:46:51 +02:00
Michal Čihař
2adf1ca83e Merge branch 'QA_4_6-security' into master-security 2016-07-22 11:35:14 +02:00
Michal Čihař
3ee65fc8bf Use MAC to verify IV as well 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:29:46 +02:00
Michal Čihař
ef03daf658 Remove hashing of blowfish secret 
New code doesn't have problems with longer secrets.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:59:02 +02:00
Michal Čihař
d29df46b3a Do not generate too long session secret 
We need 16+16 bytes, generating 256 is not really needed.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:58:39 +02:00
Michal Čihař
e2a25d773d Merge pmaServer and pmaPass cookies 
This addresses several issues:

- makes server name encrypted and authenticated, so that it can not be
  tampered
- reduces cookie usage
- reduces overhead of encryption/authentication

The pmaUser cookie is still separate to avoid different lifetime
(pmaUser has month lifetime, while pmaAuth is session only by default).

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
2a2d865d50 Validate input data from cookies 
We expect strings only, so not accept anything else.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
3ba8a026fc Use hash_hmac for MAC rather than plain SHA1 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:56:52 +02:00
Michal Čihař
3f98ad5414 Merge branch 'QA_4_6-security' into master-security 2016-07-18 16:24:12 +02:00
Michal Čihař
1543be7138 Use https to access phpmyadmin.net 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:22:33 +02:00
Michal Čihař
fc6ef261eb Remove Swekey support 
It is buggy and their servers are no longer working.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-11 09:02:58 +02:00
Michal Čihař
6f75f8a261 Merge branch 'QA_4_6-security' into master-security 2016-07-09 09:14:12 +02:00
Michal Čihař
a97be3a604 Improve cookie encryption 
- use MAC to validate content before decryption
- create unique IV for every cookie

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-08 17:40:05 +02:00
Michal Čihař
9b7a6967a8 Merge branch 'QA_4_6' 2016-06-15 11:46:29 +02:00
Michal Čihař
8a142aba73 Adjust tests to new behavior 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-15 11:45:16 +02:00
Michal Čihař
e3d650a2bb Merge branch 'QA_4_6' 2016-05-23 13:05:01 +02:00
Michal Čihař
11eb574242 Improve handling of logout 
- add separate script for handling logout
- no longer require old_usr for all authentication methods
  (this avoids potential information leak)
- require valid token for logout

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 13:02:21 +02:00
Michal Čihař
381c80dda4 Split test cases to avoid huge test methods 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 12:35:13 +02:00
Michal Čihař
21db724c85 Remove need for having define for test 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 12:09:36 +02:00
Michal Čihař
9d57ab4f2b Remove unused code 
This was used only in testsuite and quite some portion of tests existed
just to test this.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-04-07 09:51:49 +02:00
Michal Čihař
0227caf067 Adjust tests to new processing of password 
Issue #12147, #12143

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-04-07 09:47:34 +02:00
Durgesh
6650f7b07d Refactor text sanitization and javascript escaping, Issue #11989, #11988 
Signed-off-by: Durgesh <007durgesh219@gmail.com>
 2016-02-22 14:45:19 +05:30
Michal Čihař
2fffee3093 Merge remote-tracking branch 'origin/pull/11986' 2016-02-22 07:56:50 +01:00
chintan zaveri
2b74163914 Removal of Swekey 
Signed-off-by: Chintan Zaveri <zaveri_chintan@rediff.com>

master rebased

Signed-off-by: Chintan Zaveri <zaveri_chintan@rediff.com>
 2016-02-20 21:41:07 +05:30
Madhura Jayaratne
6f547b5d9a Remove superfluous white spaces 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2016-02-19 22:38:56 +11:00
Michal Čihař
86d3d0bc04 Define theme for all tests 
This allows to unify environment.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-12 15:14:39 +01:00
Michal Čihař
2148e7cad8 Implement test for Cookie auth without runkit 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-03 20:21:40 +01:00