Commit Graph

1150 Commits

Author SHA1 Message Date
Michal Čihař
8d6b1dce57 Improved handling of logout with disabled LoginCookieDeleteAll
- avoid removing session for cookie auth if LoginCookieDeleteAll is
  disabled
- redirect user to other server rather than to login page
- show message about partial logout
- adjust tests
- this is based on #13221

Fixes #12301

Signed-off-by: Michal Čihař <michal@cihar.com>
2017-04-28 16:02:11 +02:00
Harro Verton
cde775bd2b Don't destroy the session if logins are still present. fixes #12301
If you are logged-in into multiple database servers, logOut() logs you
out of all of them. This fix will prevent that, and will only destroy
the session when you log out of the last server.

Signed-off-by: Michal Čihař <michal@cihar.com>
Signed-off-by: Harro Verton <wanwizard@wanwizard.eu>
2017-04-28 15:27:24 +02:00
Michal Čihař
ebaf126501 Do not use empty() for checking submitted username
The empty() function is evil and will you block from login with username
"0".

Signed-off-by: Michal Čihař <michal@cihar.com>
2017-03-27 11:28:16 +02:00
Michal Čihař
59e9856200 Fixed OpenDocument exports
Fixes #13002

Signed-off-by: Michal Čihař <michal@cihar.com>
2017-02-20 08:44:03 +01:00
Michal Čihař
82f13e34d0 Better handle multiple open browser windows
Calculate session expiry per browser (tracking is based on
sessionStorage which is unique per tab). With this we're able to detect
that there is another window open and actively used and avoid logging it
out by inactive one.

Issue #11231

Signed-off-by: Michal Čihař <michal@cihar.com>
2017-02-14 17:00:44 +01:00
Michal Čihař
924aabf652 Do not show language selector without choices
Move the check from template to the code, so that the selection is
completely hidden when there is nothing to select.

Fixes #12988

Signed-off-by: Michal Čihař <michal@cihar.com>
2017-02-13 11:22:43 +01:00
Michal Čihař
1b7914a4e5 Remove connect_type setting
It is really not necessary as MySQL decides connection type rather based
on hostname than on anything else.

Signed-off-by: Michal Čihař <michal@cihar.com>
2017-02-02 16:08:44 +01:00
Michal Čihař
5022ff9560 Do not show errors from OpenSSL cookie encryption/decryption
This can happen from corrupted cookies, by invalid encryption parameters
used in older phpMyAdmin versions or by wrong openSSL configuration.

In neither case the error is useful to user, but we need to clear the
error buffer as otherwise the errors would pop up later, for example
during MySQL SSL setup.

Fixes #12924

Signed-off-by: Michal Čihař <michal@cihar.com>
2017-02-02 13:43:51 +01:00
Michal Čihař
fe39fbfe1a Merge branch 'QA_4_6' 2017-01-25 10:07:33 +01:00
Michal Čihař
31084a09f6 Improve error message for cookie encryption
- make it localized
- correctly report that it's about cookies

Issue #12924

Signed-off-by: Michal Čihař <michal@cihar.com>
2017-01-25 10:07:19 +01:00
Michal Čihař
75ad097c36 Replace Util::whichCrlf() with PHP_EOL
It's available since PHP 5.0.2 so it's really time to use it.

Signed-off-by: Michal Čihař <michal@cihar.com>
2017-01-23 15:59:52 +01:00
Michal Čihař
27fb0b58af Merge branch 'QA_4_6'
Signed-off-by: Michal Čihař <michal@cihar.com>
2017-01-23 14:07:29 +01:00
Michal Čihař
e4bf536906 Update to SQL Parser 4.0.1
It now follows PSR-4 and uses PhpMyAdmin namespace prefix.

See https://github.com/phpmyadmin/sql-parser/issues/126

Signed-off-by: Michal Čihař <michal@cihar.com>
2017-01-23 13:56:35 +01:00
Michal Čihař
b87362b7d2 Update to use shapefile 2.0
It uses PSR-4 prefix for PhpMyAdmin namespace.

See https://github.com/phpmyadmin/sql-parser/issues/126

Signed-off-by: Michal Čihař <michal@cihar.com>
2017-01-23 12:56:24 +01:00
Isaac Bennetch
77c33d0444 Rename Relations to Relationships in many places; Fixes issue #12536
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
2017-01-13 18:20:30 -05:00
Michal Čihař
10416615cd Merge remote-tracking branch 'origin/pull/12799' 2017-01-02 16:15:58 +01:00
Ashus
10e93cea0c CRLF fix
Signed-off-by: Ashus <github.com@ashus.net>
2016-12-29 19:22:45 +01:00
Ashus
32f3203ed0 Documentation added, default configuration values altered to match default PHP values.
Signed-off-by: Ashus <github.com@ashus.net>
2016-12-29 19:17:19 +01:00
Michal Čihař
92aa487c54 Merge branch 'QA_4_6' 2016-12-20 14:44:03 +01:00
Michal Čihař
30cd5fc358 Use same encryption key with openssl and phpseclib
Issue #12293

Signed-off-by: Michal Čihař <michal@cihar.com>
2016-12-20 14:38:34 +01:00
Michal Čihař
03bc52f6dc Correctly report OpenSSL errors from cookie encryption
Without calling openssl_error_string() we pollute openssl global state
and some other library might report this as failure (eg. mysqlnd driver
when connecting to SSL enabled server).

Fixes #12293

Signed-off-by: Michal Čihař <michal@cihar.com>
2016-12-20 14:38:03 +01:00
Michal Čihař
b866371b9a Determine whether to use openssl just once
Issue #12293

Signed-off-by: Michal Čihař <michal@cihar.com>
2016-12-20 14:30:51 +01:00
Michal Čihař
9835791bff Fix empty password login for http authetication
Fixes #12828

Signed-off-by: Michal Čihař <michal@cihar.com>
2016-12-19 16:01:00 +01:00
Michal Čihař
945e615253 Merge branch 'QA_4_6' 2016-12-19 15:23:31 +01:00
Michal Čihař
7d361806c3 Share code for rendering custom header and footer
Fixes #12802

Signed-off-by: Michal Čihař <michal@cihar.com>
2016-12-19 15:20:12 +01:00
Isaac Bennetch
e3a4bfe757 Fix display of custom header and footer in certain edge cases.
Issues #12801 and #12802

Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
2016-12-14 12:32:42 -05:00
Michal Čihař
48144987d8 Ensure font size is integer, we do further calculations with it
Signed-off-by: Michal Čihař <michal@cihar.com>
2016-12-13 08:29:40 +01:00
Ashus
e63ffe1ab8 Added SignonCookieParams parameter
Signed-off-by: Ashus <github.com@ashus.net>
2016-12-10 15:52:44 +01:00
Michal Čihař
308c9d7951 Simplify Response object handling
- always use use and short name
- avoid calling getInstance() several times in one script

Signed-off-by: Michal Čihař <michal@cihar.com>
2016-12-07 18:17:59 +01:00
Michal Čihař
081843aa5c Fixed SQL export with newlines
Remove manual escaping where we do proper escaping through MySQL
extension.

Fixes #12765

Signed-off-by: Michal Čihař <michal@cihar.com>
2016-12-05 16:08:03 -05:00
Michal Čihař
9772df3518 Merge branch 'QA_4_6' 2016-12-01 11:49:37 +01:00
Michal Čihař
e61b2135da Fixed SQL export with newlines
Remove manual escaping where we do proper escaping through MySQL
extension.

Fixes #12765

Signed-off-by: Michal Čihař <michal@cihar.com>
2016-12-01 11:02:04 +01:00
Michal Čihař
3bd6d4c645 Merge branch 'QA_4_6' 2016-11-30 13:38:38 +01:00
Michal Čihař
05a258778f ReCaptcha now works without allow_url_fopen
Fixes #12588

Signed-off-by: Michal Čihař <michal@cihar.com>
2016-11-30 13:37:46 +01:00
Isaac Bennetch
1f24e5c755 Merge branch 'master-security' 2016-11-25 01:22:59 -05:00
Isaac Bennetch
253894e299 Resolve merge conflicts with ChangeLog
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
2016-11-24 11:03:58 -05:00
Michal Čihař
cf7a731ca1 Merge branch 'QA_4_6' 2016-11-18 11:01:10 +01:00
Michal Čihař
53f07e7179 Remove protection against < in HTTP Authorization header
It really doesn't make sense here as the username can potentionally
contain < anyway and we need to deal with it later (and we do).

Fixes #12710

Signed-off-by: Michal Čihař <michal@cihar.com>
2016-11-18 11:00:11 +01:00
Deven Bansod
0fa45dae24 Merge branch 'QA_4_6' 2016-11-14 11:07:06 +05:30
Deven Bansod
ea1e3e3a6f Remove old sqlAddslashes call
Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
2016-11-14 10:45:10 +05:30
Michal Čihař
df0d8a06d3 Merge branch 'master' into master-security 2016-11-10 11:09:32 +01:00
Michal Čihař
970de0ac7a Merge branch 'QA_4_6' into QA_4_6-security 2016-11-10 11:09:21 +01:00
Michal Čihař
dad93483c1 Merge branch 'QA_4_6' 2016-11-10 11:08:36 +01:00
Michal Čihař
daae30499f Merge branch 'master' into master-security 2016-11-08 15:59:39 +01:00
Deven Bansod
e2dac31bdb Refactor the language selector display into a template
Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
2016-10-31 09:02:59 +05:30
Deven Bansod
f14cffdbe7 Properly escape strings in MySQL statement values
Use *_real_escape string functions provided by connectors to escape strings while exporting

Fix #12453

Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>

Conflicts:
	libraries/server_privileges.lib.php
2016-10-29 10:45:12 +05:30
Michal Čihař
2ed64c3c6a Merge branch 'master' into master-security 2016-10-24 13:55:39 +02:00
Michal Čihař
47078395c2 Merge branch 'QA_4_6' into QA_4_6-security 2016-10-24 13:55:29 +02:00
Michal Čihař
75a5fde46d Use secure.php.net for PHP documentation links
This avoids unnecessary redirect on the way (I still think this website
setup is weird, but that's all I can do about it).

Signed-off-by: Michal Čihař <michal@cihar.com>
2016-10-18 11:13:24 +02:00
Deven Bansod
c00cf34886 Use IF EXISTS with DROP Database while exporting to prevent error while importing this dump
Fix #12634

Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
2016-10-14 10:00:50 +05:30