gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
96,581 Commits 12 Branches 481 Tags 2.4 GiB
c293ebfb6a
Commit Graph

158 Commits

Author SHA1 Message Date
Robert Scheck
d9468e3fff Bug #4623 Incomplete PHP OpenSSL support 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2014-12-07 06:37:15 -05:00
Marc Delisle
41c02abc41 Merge branch 'MAINT_4_3_0' into QA_4_3 2014-12-03 09:02:25 -05:00
Madhura Jayaratne
a4e8d008f4 bug #4611 [security] DOS attack with long passwords 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2014-12-03 08:50:14 -05:00
Madhura Jayaratne
eb79ad9181 Fix typo 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2014-11-28 11:09:04 +05:30
Madhura Jayaratne
ea7ca462e5 Document what these flags do 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2014-11-28 10:57:19 +05:30
Madhura Jayaratne
5e1ab952b8 Use a separate flag to avoid confusion 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2014-11-28 10:56:52 +05:30
Madhura Jayaratne
b92d3e1047 Workaround for token mismatch error on server session timeout for config and http authentication types 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2014-11-28 10:56:28 +05:30
Michal Čihař
8fc377d83a Share code for resetting IV size 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-11-20 10:27:01 +01:00
Michal Čihař
5f1a5a78bc Shared check for OpenSSL support 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-11-20 10:14:47 +01:00
Robert Scheck
491c426623 Patch by Robert Scheck <robert@fedoraproject.org> for phpMyAdmin 4.2.6 
which enhances cookie encryption/decryption by the optional usage of
PHP OpenSSL. Unfortunately PHP Mcrypt is not shipped by all Linux
distributions however PHP OpenSSL is often enabled by default.
PHP < 5.3.4 does not support passing an IV, thus this has been added as
a requirement. I could have used 'BF-CBC' rather 'AES-128-CBC' but Blowfish
(even it is fast) is seen by experts as weaker algorithm than
AES. If this should be a show-stopper for upstream merging just replace
'AES-128-CBC' by 'BF-CBC', please.

Patch adapted for 4.3.x and tests modified by Marc Delisle

Signed-off-by: Marc Delisle <marc@infomarc.info>
 2014-11-19 07:38:32 -05:00
Madhura Jayaratne
0bca6a096f Determine the databases the user has access to based on GRANTs and query only for them 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2014-11-06 08:13:58 +05:30
Hugues Peccatte
42e0bdd47a Fix typos. 
Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2014-11-02 18:32:42 +01:00
Hugues Peccatte
fd7f02f929 Fix typos. 
Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2014-11-02 14:33:41 +01:00
Hugues Peccatte
58ed27560c Reverse modification to fix PHPUnit issue. 
Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2014-11-01 22:10:51 +01:00
Hugues Peccatte
bdb5f333d7 Fix PHPCS issues. 
PHPDoc updates.
Minor coding style modifications.

Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2014-11-01 22:07:18 +01:00
Hugues Peccatte
e17de11c74 Improve multibytes string manipulation performances. 
Review SQL import process.

Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2014-10-30 17:40:09 +01:00
Hugues Peccatte
74f0beda8f Fix syntax error. 
Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2014-10-20 20:56:12 +02:00
Ann + J.M
a540e6ba87 More fixes to new PMA_URL_getCommon style 
Signed-off-by: Ann + J.M <phpMyAdmin@ZweiSteinSoft.de>
 2014-10-18 19:42:39 +02:00
Ann + J.M
b1a7039ae3 Convert PMA_URL_getCommon calls to new style 
Rewritten tests need validation
Signed-Off-By: Ann + J.M. <phpMyAdmin@ZweiSteinSoft.de>
 2014-10-18 19:42:29 +02:00
Madhura Jayaratne
ae148f37e6 Merge branch 'QA_4_2' 2014-10-17 13:16:45 +05:30
Madhura Jayaratne
bdd76f18ce bug #4259 reCaptcha sound session expired problem 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2014-10-17 13:14:28 +05:30
Hugues Peccatte
70a21ec25c Merge from master. 
Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2014-10-08 21:49:37 +02:00
Madhura Jayaratne
f96841ebf4 Merge branch 'QA_4_2' 2014-10-02 11:44:45 +05:30
Madhura Jayaratne
43ec83fbda bug #4259 reCaptcha sound session expired problem 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2014-10-02 11:42:44 +05:30
Hugues Peccatte
3de88162ff Replace PMA_String uses by mb_* calls. 
Remove part of unused  variables.

Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2014-09-28 20:53:01 +02:00
Smita Kumari
42223e1bf6 avoid session timeout when user is active FR#1529 
Signed-off-by: Smita Kumari <kumarismita62@gmail.com>
 2014-09-13 03:10:40 +05:30
Hugues Peccatte
9b77d746ab Mass modifications to use PMA_String. 
Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2014-09-06 10:44:03 +02:00
Michal Čihař
7089858ab0 Allow to use system phpseclib 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-07-08 16:29:54 +02:00
Michal Čihař
6be21dcb47 Merge pull request #1251 from WhaleWatching/console 
PMA console, history and bookmarks.
 2014-06-25 15:37:29 +02:00
Edward Cheng
fb14e92d62 PMA console, history and bookmarks. 
Modified: resizer of navigation bar: whole-time-bind events removed.

Signed-off-by: Edward Cheng <c4150221@gmail.com>
 2014-06-25 21:22:33 +08:00
Michal Čihař
34fec13115 Merge pull request #1252 from nijel/remove-observer 
Remove plugin manager and observer classes
 2014-06-25 14:27:45 +02:00
Michal Čihař
06b1ffc8da Fix comments 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-25 14:11:01 +02:00
Michal Čihař
e6f6dab3b0 Fixed cookie based login for installations without mcrypt 
bug #4469

Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-25 14:08:03 +02:00
Michal Čihař
dca981481d Remove plugin manager and observer classes 
We don't really need the observer pattern, so let's simplify the code.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-25 09:25:59 +02:00
Ann + J.M
6b778e09d9 Fix coding style 
Signed-off-by: Ann + J.M <phpMyAdmin@ZweiSteinSoft.de>
 2014-06-22 16:34:34 +02:00
Dhananjay Nakrani
7b8006651b Make "Ignore All" button work on login page. 
Signed-off-by: Dhananjay Nakrani <dhananjaynakrani@gmail.com>
 2014-06-16 11:50:52 +05:30
Michal Čihař
bd4cccc039 Move password change handling to authenticaton plugins 
We should not care about plugin type while changing password, we should
just notify it and the plugin should be responsible for anything needed.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 14:43:10 +02:00
Michal Čihař
92a10d0968 Factor out cookie storing to separate methods 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 14:43:10 +02:00
Michal Čihař
e433d8189b Use phpseclib for generating session encryption key 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 14:43:10 +02:00
Michal Čihař
da047efbd1 Use random per session key for encrypting password 
This makes it impossible to decrypt cookies later if the key would be
compromised.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 14:43:10 +02:00
Michal Čihař
5e51f178dd Remove some blowfish mentions 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 14:43:10 +02:00
Michal Čihař
cd4d54395b Remove another reference to Blowfish 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 14:43:10 +02:00
Michal Čihař
96977c994e Use require here 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 10:50:52 +02:00
Michal Čihař
20640592f0 Always use phpseclib for cookie encryption 
- it provides fallback in case mcrypt is not found
- we now use AES in both mcrypt and PHP code case
- cleanup the code by removing mcrypt conditials
- rename some methods and cookies so that they don't refer to
  implementation details
- switching encryption implementations no longer invalidates the
  credentials

Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 10:39:52 +02:00
Michal Čihař
0652ca9ccd Merge remote-tracking branch 'origin/QA_4_2' 2014-06-12 10:19:00 +02:00
Michal Čihař
bc60315023 Adjust tests to new IV logic 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 10:18:45 +02:00
Michal Čihař
c6e76422c4 Allow to use system phpseclib 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 10:06:20 +02:00
Michal Čihař
716f6d4c55 Merge remote-tracking branch 'origin/QA_4_2' 2014-06-12 09:47:17 +02:00
Michal Čihař
953c7415ad Separate check for password cookie 
Otherwise it would not be possible to recall user name.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 09:47:04 +02:00
Michal Čihař
5d39998a86 Merge commit '7cba81de271d62bdf93ded7598709702a96f92d7' 
Conflicts:
	libraries/plugins/auth/AuthenticationCookie.class.php
 2014-06-12 09:45:13 +02:00