gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
93,239 Commits 12 Branches 481 Tags 2.4 GiB
e433d8189b
Commit Graph

120 Commits

Author SHA1 Message Date
Michal Čihař
e433d8189b Use phpseclib for generating session encryption key 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 14:43:10 +02:00
Michal Čihař
da047efbd1 Use random per session key for encrypting password 
This makes it impossible to decrypt cookies later if the key would be
compromised.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 14:43:10 +02:00
Michal Čihař
5e51f178dd Remove some blowfish mentions 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 14:43:10 +02:00
Michal Čihař
cd4d54395b Remove another reference to Blowfish 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 14:43:10 +02:00
Michal Čihař
96977c994e Use require here 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 10:50:52 +02:00
Michal Čihař
20640592f0 Always use phpseclib for cookie encryption 
- it provides fallback in case mcrypt is not found
- we now use AES in both mcrypt and PHP code case
- cleanup the code by removing mcrypt conditials
- rename some methods and cookies so that they don't refer to
  implementation details
- switching encryption implementations no longer invalidates the
  credentials

Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 10:39:52 +02:00
Michal Čihař
0652ca9ccd Merge remote-tracking branch 'origin/QA_4_2' 2014-06-12 10:19:00 +02:00
Michal Čihař
bc60315023 Adjust tests to new IV logic 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 10:18:45 +02:00
Michal Čihař
c6e76422c4 Allow to use system phpseclib 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 10:06:20 +02:00
Michal Čihař
716f6d4c55 Merge remote-tracking branch 'origin/QA_4_2' 2014-06-12 09:47:17 +02:00
Michal Čihař
953c7415ad Separate check for password cookie 
Otherwise it would not be possible to recall user name.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 09:47:04 +02:00
Michal Čihař
5d39998a86 Merge commit '7cba81de271d62bdf93ded7598709702a96f92d7' 
Conflicts:
	libraries/plugins/auth/AuthenticationCookie.class.php
 2014-06-12 09:45:13 +02:00
Michal Čihař
7cba81de27 Regenerate cookie encryption IV for every session 
The IV for cookie encryption was generated just once for every browser
and kept in a cookie. Generating it for every session is much better to
avoid information leaks (eg. that same user has logged in).

Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 09:41:27 +02:00
Michal Čihař
b252cb9981 Use better source of entropy for mcrypt IV 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 09:16:20 +02:00
Marc Delisle
a6d379caf2 Since PHP 5.3.0, it's not longer required to call srand() before 
mcrypt_create_iv().

Signed-off-by: Marc Delisle <marc@infomarc.info>
 2014-06-11 08:31:23 -04:00
Michal Čihař
1efadc8e7c We already check for empty value, remove todo 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-06 15:46:34 +02:00
Marc Delisle
84f135d048 Fix coding style 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2014-06-03 12:40:21 -04:00
Michal Čihař
650e0512de Share code for getting error message 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-05-09 15:05:36 +02:00
Michal Čihař
82b4549176 Remove unused parameter of PMA_Util::cacheUnset 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-05-09 14:21:12 +02:00
Marc Delisle
89f21f5109 About bug #4280: try to workaround PHP 5 session garbage collection 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2014-04-24 09:15:03 -04:00
Marc Delisle
bab0572c1e Fix coding style 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2014-03-21 12:42:10 -04:00
Hugues Peccatte
c38b78defb PHPCS updates. 
Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2014-03-15 11:46:16 +01:00
Hugues Peccatte
9b1f025fb7 PHPCS updates. 
Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2014-03-14 23:06:46 +01:00
Dhananjay Nakrani
76c57710f0 Display session expiry msg after auto-redirect. 
Signed-off-by: Dhananjay Nakrani <dhananjaynakrani@gmail.com>
 2014-03-03 11:49:17 +05:30
Chirayu Chiripal
dec30ffd6d Feature Request #1460 Redirect to login page after session has expired 
Signed-off-by: Chirayu Chiripal <chirayu.chiripal@gmail.com>
 2014-02-27 17:45:46 +05:30
Madhura Jayaratne
f65ac8803e Merge branch 'QA_4_1' 2014-02-08 13:06:10 +05:30
Madhura Jayaratne
59e3c9474a bug #4278 reCaptcha re-login requires double effort 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2014-02-08 13:04:32 +05:30
Marc Delisle
f5ba57c290 Revert "Avoid using hard-coded argument separator, see https://sourceforge.net/p/phpmyadmin/bugs/3733" 
This reverts commit 36e544ce9e.

Signed-off-by: Marc Delisle <marc@infomarc.info>
 2014-02-03 10:11:44 -05:00
Marc Delisle
c406599995 Revert "Avoid using hard-coded argument separator, see https://sourceforge.net/p/phpmyadmin/bugs/3733" 
This reverts commit 36e544ce9e.

Signed-off-by: Marc Delisle <marc@infomarc.info>
 2014-02-03 10:10:53 -05:00
Marc Delisle
464616c26b Merge commit '36e544c' 2014-02-03 08:44:37 -05:00
Marc Delisle
36e544ce9e Avoid using hard-coded argument separator, see https://sourceforge.net/p/phpmyadmin/bugs/3733 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2014-02-03 08:42:39 -05:00
Michal Čihař
396991a194 Merge remote-tracking branch 'origin/QA_4_1' 2014-02-03 09:01:55 +01:00
Michal Čihař
c6969bfb9e Properly encode & in URL 
Signed-off-by: Michal Čihař <mcihar@suse.cz>
 2014-02-03 09:00:05 +01:00
Madhura Jayaratne
a5c6f555f9 Merge branch 'QA_4_1' 2014-02-02 22:56:55 +05:30
Madhura Jayaratne
22c851d1b8 bug #4259 reCaptcha sound session expired problem 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2014-02-02 22:53:11 +05:30
Madhura Jayaratne
fc34716720 reCaptcha theme 'while' matches better with PMA themes 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2014-02-02 22:22:53 +05:30
Madhura Jayaratne
d1af87b7e6 Merge branch 'QA_4_1' 2014-02-02 22:18:49 +05:30
Madhura Jayaratne
6a7d3f9ed7 bug #4260 reCaptcha is ignoring language settings 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2014-02-02 22:15:56 +05:30
Michal Čihař
b4d03dc9f5 Correct punctuation for sentences 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-02-02 11:30:39 +01:00
Michal Čihař
1d76d52baf Missing punctuation at the end of sentences 2014-01-29 15:21:02 +01:00
Hugues Peccatte
ae0c9218ce PHPDoc update. 
Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2014-01-09 20:51:40 +01:00
Madhura Jayaratne
74aebe629b Spaces around . operator 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2014-01-08 18:06:02 +05:30
Madhura Jayaratne
84e9ce4946 Spaces around . operator 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2014-01-08 17:26:27 +05:30
Hugues Peccatte
d27076392c Fix PHPCS errors. 
Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2013-12-11 20:44:12 +01:00
Hugues Peccatte
20ab7112bb Fix PHPCS errors/warnings from Jenkins. 
Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2013-12-10 21:57:17 +01:00
Marc Delisle
7411185bd6 Fix coding style 2013-12-03 06:18:14 -05:00
Marc Delisle
9ad4e64719 Fix coding style 2013-11-22 05:26:45 -05:00
Hugues Peccatte
464ec23ad8 Huge PHPDoc update. 2013-11-10 23:04:58 +01:00
Hugues Peccatte
ca8eb087cc Revert third party modifications. 2013-11-09 11:04:52 +01:00
Hugues Peccatte
1f09a22281 Fix PHPDoc. 2013-11-08 22:41:05 +01:00