gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
109,896 Commits 12 Branches 481 Tags 2.4 GiB
f509d9c3be
Commit Graph

37 Commits

Author SHA1 Message Date
Michal Čihař
e7a09fe7db Bring back missing hash.lib.php requires 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2017-06-08 18:20:29 +02:00
Michal Čihař
fec1886d9b Remove core library to hash 
It now contains only hash polyfills, so let's have clear name.

Also remove no needed requires (it is already loaded from common).

Signed-off-by: Michal Čihař <michal@cihar.com>
 2017-06-08 15:58:18 +02:00
Maurício Meneghini Fauth
e330402b5b Refactor the core functions into static methods 
Signed-off-by: Maurício Meneghini Fauth <mauriciofauth@gmail.com>
 2017-06-03 00:52:22 -03:00
Maurício Meneghini Fauth
290b183d03 Fix errors detected by PHP_CodeSniffer 
Signed-off-by: Maurício Meneghini Fauth <mauriciofauth@gmail.com>
 2017-04-15 00:05:19 -03:00
Michal Čihař
4ca1f8bd27 Remove no longer needed code in authentication 
The code is incosistent between auth methods and I don't see any purpose
for it.

Fixes #12478
Fixes #13003

Signed-off-by: Michal Čihař <michal@cihar.com>
 2017-02-20 17:39:21 +01:00
Shreyas Sinha
1dfce55965 Incorrect protocol number at 401/303 headers (#12920) 
Shared code for handling HTTP response codes and correctly
set it based on PHP SAPI.

Signed-off-by: Shreyas Sinha <shreyas.sinha14@gmail.com>
 2017-02-14 13:20:13 +01:00
Michal Čihař
9835791bff Fix empty password login for http authetication 
Fixes #12828

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-19 16:01:00 +01:00
Michal Čihař
945e615253 Merge branch 'QA_4_6' 2016-12-19 15:23:31 +01:00
Michal Čihař
7d361806c3 Share code for rendering custom header and footer 
Fixes #12802

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-12-19 15:20:12 +01:00
Isaac Bennetch
e3a4bfe757 Fix display of custom header and footer in certain edge cases. 
Issues #12801 and #12802

Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-12-14 12:32:42 -05:00
Isaac Bennetch
1f24e5c755 Merge branch 'master-security' 2016-11-25 01:22:59 -05:00
Isaac Bennetch
253894e299 Resolve merge conflicts with ChangeLog 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
 2016-11-24 11:03:58 -05:00
Michal Čihař
cf7a731ca1 Merge branch 'QA_4_6' 2016-11-18 11:01:10 +01:00
Michal Čihař
53f07e7179 Remove protection against < in HTTP Authorization header 
It really doesn't make sense here as the username can potentionally
contain < anyway and we need to deal with it later (and we do).

Fixes #12710

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-11-18 11:00:11 +01:00
Michal Čihař
5a1854c2b7 Merge branch 'QA_4_6-security' into master-security 2016-09-19 11:53:49 +02:00
Michal Čihař
fbad6b9b4d Verify value of access_time to avoid unwanted session extension 
We need to ansure the access_time parameter is in valid range to avoid
possibility of remotely extending session validity.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-09-19 11:53:07 +02:00
Michal Čihař
9816dc66af Merge branch 'QA_4_6-security' into master-security 2016-08-18 09:50:57 +02:00
Michal Čihař
c83b2b0872 Use hash_equals for checking username 
This makes the comparison happen in constant time and makes it
impossible to use it to guess stored usernames.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 09:41:21 +02:00
Michal Čihař
b2ea7205fb Merge branch 'QA_4_6-security' into master-security 2016-08-18 09:12:49 +02:00
Michal Čihař
9dbe520e90 Strip null bytes from MySQL username 
In old PHP versions this could lead to allow/deny rules bypass.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-08-18 09:11:45 +02:00
Michal Čihař
e6ff157dda The session_destroy is already called on logout 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-08 15:30:55 +02:00
Michal Čihař
e3d650a2bb Merge branch 'QA_4_6' 2016-05-23 13:05:01 +02:00
Michal Čihař
11eb574242 Improve handling of logout 
- add separate script for handling logout
- no longer require old_usr for all authentication methods
  (this avoids potential information leak)
- require valid token for logout

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 13:02:21 +02:00
Michal Čihař
f8ead4738e Merge branch 'QA_4_6' 2016-03-17 11:32:22 +01:00
Michal Čihař
1523985bce Fix login after logout with http authentication 
We can not check token here as it's always there (in the URL) after
logout.

Fixes #12098

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-03-17 11:31:06 +01:00
Michal Čihař
f5393eff61 Remove code mentioning register_globals 
This was removed in PHP 5.4.0 so we really do not have to care anymore.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-03-08 15:30:24 +01:00
Michal Čihař
5042b65398 Merge branch 'QA_4_5' into QA_4_6 2016-02-12 10:45:43 +01:00
Michal Čihař
c2b41b829a Wrap header() and headers_sent() in response 
This allows us to test the code without using runkit. Currenly only
AuthenticationHttp is migrated to new code, but others will follow.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-03 19:49:05 +01:00
Michal Čihař
431450a237 Make test run even without runkit 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-03 19:49:05 +01:00
Michal Čihař
db6af1be82 Simplify code 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-03 17:57:19 +01:00
Michal Čihař
46a70dba88 Remove unused method (parent class defines it) 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2015-12-01 13:54:04 +01:00
Hugues Peccatte
37d2a661c0 Make PHPCS happy. 
Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2015-10-07 22:49:49 +02:00
Hugues Peccatte
6f4676cdfc Merge remote-tracking branch 'origin/master' into useNamespaces_master 2015-10-04 18:04:49 +02:00
Hugues Peccatte
70acefd180 Replace Response calls by short calls. 
Add missing require.

Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2015-09-05 23:39:02 +02:00
Hugues Peccatte
6c594eb0cf Fix calls. 
Remove useless PHPDoc.
Add missing require.
Add missing 'use'.

Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2015-09-05 22:58:47 +02:00
Hugues Peccatte
178a6edd38 Add namespace on part of plugins classes. 
Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2015-09-05 00:33:42 +02:00
Hugues Peccatte
04b4f723d8 Move libraries/plugins/auth and export classes into a namespace. 
Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2015-09-05 00:09:30 +02:00