Share one directory for Twig cache, SHP import and file uploads.
The code now also validates the cache directory and creates it on the
fly, so it properly detects if the directory can not be used.
Also the documentation has been improved to document securing this
directory.
Fixes#13225Fixes#13226
Signed-off-by: Michal Čihař <michal@cihar.com>
- avoid removing session for cookie auth if LoginCookieDeleteAll is
disabled
- redirect user to other server rather than to login page
- show message about partial logout
- adjust tests
- this is based on #13221Fixes#12301
Signed-off-by: Michal Čihař <michal@cihar.com>
If you are logged-in into multiple database servers, logOut() logs you
out of all of them. This fix will prevent that, and will only destroy
the session when you log out of the last server.
Signed-off-by: Michal Čihař <michal@cihar.com>
Signed-off-by: Harro Verton <wanwizard@wanwizard.eu>
This can happen in both directions which both can have undesired side
effects:
- when server thinks it's serving HTTPS, but it's not, the cookies are
set as secure and thus never returned back by client
- whene server thinks it's not serving HTTPS, the secure flag for
cookies is not set, making it possible to leak them over HTTP
Fixes#13110
Signed-off-by: Michal Čihař <michal@cihar.com>
Calculate session expiry per browser (tracking is based on
sessionStorage which is unique per tab). With this we're able to detect
that there is another window open and actively used and avoid logging it
out by inactive one.
Issue #11231
Signed-off-by: Michal Čihař <michal@cihar.com>
Move the check from template to the code, so that the selection is
completely hidden when there is nothing to select.
Fixes#12988
Signed-off-by: Michal Čihař <michal@cihar.com>
It is really not necessary as MySQL decides connection type rather based
on hostname than on anything else.
Signed-off-by: Michal Čihař <michal@cihar.com>
This can happen from corrupted cookies, by invalid encryption parameters
used in older phpMyAdmin versions or by wrong openSSL configuration.
In neither case the error is useful to user, but we need to clear the
error buffer as otherwise the errors would pop up later, for example
during MySQL SSL setup.
Fixes#12924
Signed-off-by: Michal Čihař <michal@cihar.com>
Without calling openssl_error_string() we pollute openssl global state
and some other library might report this as failure (eg. mysqlnd driver
when connecting to SSL enabled server).
Fixes#12293
Signed-off-by: Michal Čihař <michal@cihar.com>
