gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
106,070 Commits 12 Branches 481 Tags 2.4 GiB
ef6a76abe8
Commit Graph

123 Commits

Author SHA1 Message Date
Michal Čihař
83476322ba Use PmaAbsolueUri for cookie path 
Issue #12374

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-17 15:35:15 +02:00
Michal Čihař
d31ff5a1e7 Merge branch 'QA_4_6' into QA_4_6-security 2016-07-28 09:43:26 +02:00
Michal Čihař
4072c1d29a Use example.com for sample test urls 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-28 09:12:01 +02:00
Michal Čihař
af337d2054 Use https to access phpmyadmin.net 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-27 16:29:08 +02:00
Michal Čihař
99492bf42a Merge branch 'QA_4_6' into QA_4_6-security 2016-07-26 16:29:07 +02:00
Michal Čihař
6c95b73f90 Do not append session IDs to all URLs in redirect 
There is no need to do that as we rely on session cookies anyway. Also
appending sesson ID to external URLs is not a good idea.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-26 16:20:04 +02:00
Michal Čihař
9106b33933 Improve secrets splitting 
- ensure it has 16 bytes
- extends it by copying content if original is too short
- correctly handle corner cases (eg. 1 byte secret)

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 14:10:28 +02:00
Michal Čihař
643681ee68 Use consistent iv and encrypted text concatenation as other libs 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 13:46:51 +02:00
Michal Čihař
3ee65fc8bf Use MAC to verify IV as well 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:29:46 +02:00
Michal Čihař
ef03daf658 Remove hashing of blowfish secret 
New code doesn't have problems with longer secrets.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:59:02 +02:00
Michal Čihař
d29df46b3a Do not generate too long session secret 
We need 16+16 bytes, generating 256 is not really needed.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:58:39 +02:00
Michal Čihař
e2a25d773d Merge pmaServer and pmaPass cookies 
This addresses several issues:

- makes server name encrypted and authenticated, so that it can not be
  tampered
- reduces cookie usage
- reduces overhead of encryption/authentication

The pmaUser cookie is still separate to avoid different lifetime
(pmaUser has month lifetime, while pmaAuth is session only by default).

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
2a2d865d50 Validate input data from cookies 
We expect strings only, so not accept anything else.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
3ba8a026fc Use hash_hmac for MAC rather than plain SHA1 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:56:52 +02:00
Michal Čihař
1543be7138 Use https to access phpmyadmin.net 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:22:33 +02:00
Michal Čihař
fc6ef261eb Remove Swekey support 
It is buggy and their servers are no longer working.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-11 09:02:58 +02:00
Michal Čihař
a97be3a604 Improve cookie encryption 
- use MAC to validate content before decryption
- create unique IV for every cookie

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-08 17:40:05 +02:00
Michal Čihař
8a142aba73 Adjust tests to new behavior 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-15 11:45:16 +02:00
Michal Čihař
adfd5a22b9 Avoid double redirects in signon auth on logout 
Also adjusts tests to no longer rely on runkit.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 13:23:16 +02:00
Michal Čihař
11eb574242 Improve handling of logout 
- add separate script for handling logout
- no longer require old_usr for all authentication methods
  (this avoids potential information leak)
- require valid token for logout

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 13:02:21 +02:00
Michal Čihař
381c80dda4 Split test cases to avoid huge test methods 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 12:35:13 +02:00
Michal Čihař
21db724c85 Remove need for having define for test 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 12:09:36 +02:00
Michal Čihař
1c081f9087 Fix test to not depend on variables set elsewhere 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 11:47:40 +02:00
Michal Čihař
574fee04f7 Fix test failures after changing links 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-17 10:44:54 +02:00
Michal Čihař
a28cc6d2de Ensure we always restore original instance even on failure 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-03 20:41:00 +01:00
Michal Čihař
2148e7cad8 Implement test for Cookie auth without runkit 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-03 20:21:40 +01:00
Michal Čihař
be8b4ccd76 Add mising separator 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-03 19:57:42 +01:00
Michal Čihař
e3843ab1a9 Test with SID if set 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-03 19:56:26 +01:00
Michal Čihař
c2b41b829a Wrap header() and headers_sent() in response 
This allows us to test the code without using runkit. Currenly only
AuthenticationHttp is migrated to new code, but others will follow.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-03 19:49:05 +01:00
Michal Čihař
431450a237 Make test run even without runkit 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-03 19:49:05 +01:00
Michal Čihař
ae1ccf3e6a Remove PmaAbsoluteUri configuration directive 
Fixes #11412

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-03 17:41:29 +01:00
Michal Čihař
b450e58dbb Remove require of libraries included in test bootstrap 
There is no need to specify them in every test when we already do it
globally.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-12 16:43:16 +01:00
Michal Čihař
908c44c027 Remove no longer used variables 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-12 14:51:08 +01:00
Michal Čihař
19f9e830eb Remove no longer needed code for language selection 
Issue #11847

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-12 14:51:08 +01:00
Madhura Jayaratne
9e38e02593 Update auth plugin tests 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2015-12-18 17:36:05 +11:00
Hugues Peccatte
0e5de28eaa Remove side effects in declaration files. 
Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2015-11-15 17:31:53 +01:00
Madhura Jayaratne
ab49273856 Rename test classes 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2015-10-15 20:57:27 +11:00
Hugues Peccatte
6f4676cdfc Merge remote-tracking branch 'origin/master' into useNamespaces_master 2015-10-04 18:04:49 +02:00
Marc Delisle
fd7c8522ea Clarify method name 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2015-10-03 10:14:29 -04:00
Hugues Peccatte
00e743eb32 Fix unit test. 
Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2015-09-20 13:25:34 +02:00
Hugues Peccatte
72dd9426ef Add require needed to get GLOBALS. 
Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2015-09-09 22:16:12 +02:00
Hugues Peccatte
42c0ebac85 Merge branch 'master' into useNamespaces_master 2015-09-09 22:05:00 +02:00
Marc Delisle
337658a927 Fix merge conflict 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2015-09-08 11:38:50 -04:00
Madhura Jayaratne
785f4e2711 Fix reCaptcha bypass 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2015-09-08 07:13:24 +10:00
Hugues Peccatte
79439963cd Skipping unit test. 
Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2015-09-05 23:58:16 +02:00
Hugues Peccatte
04b4f723d8 Move libraries/plugins/auth and export classes into a namespace. 
Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2015-09-05 00:09:30 +02:00
Hugues Peccatte
7f8f34e89d Remove classes require_once. 
Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2015-09-01 21:30:22 +02:00
Hugues Peccatte
58b10807c8 Rename classes files. 
Rename classes.

Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2015-09-01 21:30:22 +02:00
Hugues Peccatte
0761fb1801 Rename classes files. 
Rename classes.

Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2015-09-01 21:30:21 +02:00
Hugues Peccatte
f0ba28fc1d Set namespace on Advisor, Config, Console and Util classes. 
Set namespace on DbQbe.
Set namespace to 'DbSearch'.
Split Advisor.class.php file.
Change Advisor namespace.
Rename DbQbe class and file.
Set namespace on DisplayResults.
Set namespace on Error.
Use namespace for ErrorHandler.
Add class autoloader.
Change ErrorHandler filename.
Remove some require.
Update Config namespace path.
Update PMA_Util to PMA\libraries\Util.
Rename Font and File classes files.
Use namespace for Footer.
Set namespace in all libraries classes.
Namespace OutputBuffering.
Export SubPartition.
Rename Partition file.
Namespace PDF.
Namespace RecentFavoriteTable.
Replace PMA_Response by Response and PMA_Message by Message.
Update uses and calls.
Fix unit tests.
Fix SqlParser autoload.

Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2015-09-01 21:22:52 +02:00