gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
106,003 Commits 12 Branches 481 Tags 2.4 GiB
e0923d54e2
Commit Graph

45 Commits

Author SHA1 Message Date
Michal Čihař
6faa1fe46a Add rel="noopener noreferrer" to all external target="_blank" links 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 17:35:20 +02:00
Michal Čihař
493ece49ee Merge branch 'QA_4_6' into QA_4_6-security 2016-08-02 08:45:16 +02:00
Michal Čihař
38b73180fd Fix password change in cookie auth 
We can not set same cookie twice, so we have to avoid sending auth
cookie when we're about to change the password.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-02 08:42:44 +02:00
Michal Čihař
cc9d0f128c Merge branch 'QA_4_6' into QA_4_6-security 2016-07-26 16:47:44 +02:00
Michal Čihař
16c4ca0daa Properly escape configuration parameters when rendering 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:47:01 +02:00
Michal Čihař
76e87c3e33 Do not use mb_strlen on data we know are bytes 
Issue #12397

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 16:39:12 +02:00
Michal Čihař
024a924b38 Avoid calculating strlen twice 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:12:45 +02:00
Michal Čihař
9106b33933 Improve secrets splitting 
- ensure it has 16 bytes
- extends it by copying content if original is too short
- correctly handle corner cases (eg. 1 byte secret)

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:10:28 +02:00
Michal Čihař
643681ee68 Use consistent iv and encrypted text concatenation as other libs 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 13:46:51 +02:00
Michal Čihař
3ee65fc8bf Use MAC to verify IV as well 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:29:46 +02:00
Michal Čihař
ef03daf658 Remove hashing of blowfish secret 
New code doesn't have problems with longer secrets.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:59:02 +02:00
Michal Čihař
d29df46b3a Do not generate too long session secret 
We need 16+16 bytes, generating 256 is not really needed.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:58:39 +02:00
Michal Čihař
e2a25d773d Merge pmaServer and pmaPass cookies 
This addresses several issues:

- makes server name encrypted and authenticated, so that it can not be
  tampered
- reduces cookie usage
- reduces overhead of encryption/authentication

The pmaUser cookie is still separate to avoid different lifetime
(pmaUser has month lifetime, while pmaAuth is session only by default).

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
2a2d865d50 Validate input data from cookies 
We expect strings only, so not accept anything else.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
f45b8cd49c Use different secret for MAC than encryption 
Generated using string splitting.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:29 +02:00
Michal Čihař
3ba8a026fc Use hash_hmac for MAC rather than plain SHA1 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:56:52 +02:00
Michal Čihař
767195e197 Sanitize MySQL host name before connecting 
It can contain p: prefix which we don't want to honor.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-12 15:14:57 +02:00
Michal Čihař
fc6ef261eb Remove Swekey support 
It is buggy and their servers are no longer working.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-11 09:02:58 +02:00
Michal Čihař
a97be3a604 Improve cookie encryption 
- use MAC to validate content before decryption
- create unique IV for every cookie

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-08 17:40:05 +02:00
Michal Čihař
f978e347fb Add missing requie once for testsuite 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 14:28:28 +02:00
Michal Čihař
f9d6c40939 Safer handling of sessions during authentication 
- always generate new session for login form
- always generate new session when authenticated using cookie auth

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 13:48:25 +02:00
Michal Čihař
11eb574242 Improve handling of logout 
- add separate script for handling logout
- no longer require old_usr for all authentication methods
  (this avoids potential information leak)
- require valid token for logout

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 13:02:21 +02:00
Michal Čihař
21db724c85 Remove need for having define for test 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 12:09:36 +02:00
Michal Čihař
5042b65398 Merge branch 'QA_4_5' into QA_4_6 2016-02-12 10:45:43 +01:00
Michal Čihař
2148e7cad8 Implement test for Cookie auth without runkit 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-03 20:21:40 +01:00
Michal Čihař
2a9fb73f92 Remove PmaAbsoluteUri from redirects 
This is no longer needed as per RFC 7231.

Issue #11412

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-03 14:32:14 +01:00
Michal Čihař
ac9714cf6a Autoloading for phpseclib 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-01 21:53:53 +01:00
Michal Čihař
7b58acf62e Merge branch 'QA_4_5' 2016-02-01 21:46:33 +01:00
Michal Čihař
b69fa1499f Bring back file inclustion, just remove version check from it 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-28 17:08:19 +01:00
Michal Čihař
072ff0b38a Remove checks for PHP versions we no longer support 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-28 16:08:47 +01:00
Michal Čihař
37004337ab Merge commit 'a478437e0ee4d74ec5036cb32e165da002303dd1' 2016-01-14 09:10:43 +01:00
Michal Čihař
55b317c699 Remove /*overload*/ prefix from mb_* calls 
I believe this was temporary flagging to see which code is migrated and
can be safely removed now.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-04 16:35:28 +01:00
Marc Delisle
66c15daba0 Remove some unnecessary string concatenations 
https://github.com/dseguy/clearPHP/blob/master/rules/no-unnecessary-string-concatenation.md

Signed-off-by: Marc Delisle <marc@infomarc.info>
 2015-12-06 08:01:07 -05:00
Marc Delisle
357b1b4757 Remove some unnecessary string concatenations 
https://github.com/dseguy/clearPHP/blob/master/rules/no-unnecessary-string-concatenation.md

Signed-off-by: Marc Delisle <marc@infomarc.info>
 2015-12-04 09:05:42 -05:00
Marc Delisle
2607023281 Remove some unnecessary string concatenations 
https://github.com/dseguy/clearPHP/blob/master/rules/no-unnecessary-string-concatenation.md

Signed-off-by: Marc Delisle <marc@infomarc.info>
 2015-12-03 11:00:01 -05:00
Marc Delisle
9ee3931c09 Remove some unnecessary string concatenations 
https://github.com/dseguy/clearPHP/blob/master/rules/no-unnecessary-string-concatenation.md

Signed-off-by: Marc Delisle <marc@infomarc.info>
 2015-12-03 10:43:10 -05:00
Deven Bansod
77f220cee5 Merge branch 'QA_4_5' 
Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>

Conflicts:
	libraries/plugins/auth/AuthenticationCookie.php
 2015-11-26 19:29:18 +05:30
Marc Delisle
8e666ec1b5 Fix merge conflicts 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2015-10-24 16:35:58 -04:00
Hugues Peccatte
6f4676cdfc Merge remote-tracking branch 'origin/master' into useNamespaces_master 2015-10-04 18:04:49 +02:00
Hugues Peccatte
71b62bcef9 Merge remote-tracking branch 'origin/master' into useNamespaces_master 2015-09-26 13:50:49 +02:00
Hugues Peccatte
914cdaa984 Merge remote-tracking branch 'origin/master' into useNamespaces_master 2015-09-19 22:31:36 +02:00
Hugues Peccatte
7185d61649 Set uses instead of absolute namespace. 
Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2015-09-12 15:43:39 +02:00
Hugues Peccatte
42c0ebac85 Merge branch 'master' into useNamespaces_master 2015-09-09 22:05:00 +02:00
Hugues Peccatte
6c594eb0cf Fix calls. 
Remove useless PHPDoc.
Add missing require.
Add missing 'use'.

Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2015-09-05 22:58:47 +02:00
Hugues Peccatte
04b4f723d8 Move libraries/plugins/auth and export classes into a namespace. 
Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2015-09-05 00:09:30 +02:00