', $result); self::assertStringContainsString( '

', $result, ); self::assertStringContainsString( '', $result, ); self::assertStringContainsString( '', $result, ); self::assertStringContainsString( '', $result, ); self::assertStringContainsString('', $result); self::assertStringContainsString('', $result); } public function testAuthCaptcha(): void { $_REQUEST['old_usr'] = ''; $config = Config::getInstance(); $config->set('AllowArbitraryServer', false); $config->set('CaptchaRequestParam', 'g-recaptcha'); $config->set('CaptchaResponseParam', 'g-recaptcha-response'); $config->set('CaptchaLoginPrivateKey', 'testprivkey'); $config->set('CaptchaLoginPublicKey', 'testpubkey'); Current::$server = 2; $response = $this->object->showLoginForm(); $result = (string) $response->getBody(); self::assertStringContainsString('id="imLogo"', $result); // Check for language selection if locales are there $loc = LOCALE_PATH . '/cs/LC_MESSAGES/phpmyadmin.mo'; if (is_readable($loc)) { self::assertStringContainsString( '', $result, ); } self::assertStringContainsString( '', $result, ); self::assertStringContainsString('', $result); self::assertStringContainsString( '', $result, ); self::assertStringContainsString( '', $result, ); } public function testAuthCaptchaCheckbox(): void { $_REQUEST['old_usr'] = ''; $config = Config::getInstance(); $config->set('AllowArbitraryServer', false); $config->set('Servers', [1]); $config->set('CaptchaRequestParam', 'g-recaptcha'); $config->set('CaptchaResponseParam', 'g-recaptcha-response'); $config->set('CaptchaLoginPrivateKey', 'testprivkey'); $config->set('CaptchaLoginPublicKey', 'testpubkey'); $config->set('CaptchaMethod', 'checkbox'); Current::$server = 2; $response = $this->object->showLoginForm(); $result = (string) $response->getBody(); self::assertStringContainsString('id="imLogo"', $result); // Check for language selection if locales are there $loc = LOCALE_PATH . '/cs/LC_MESSAGES/phpmyadmin.mo'; if (is_readable($loc)) { self::assertStringContainsString( '', $result, ); } self::assertStringContainsString( '', $result, ); self::assertStringContainsString('', $result); self::assertStringContainsString( '', $result, ); self::assertStringContainsString('

', $result); self::assertStringContainsString( '', $result, ); } public function testAuthHeader(): void { $config = Config::getInstance(); $config->set('LoginCookieDeleteAll', false); $config->settings['Servers'] = [1]; $config->selectedServer['LogoutURL'] = 'https://example.com/logout'; $config->selectedServer['auth_type'] = 'cookie'; $response = $this->object->logOut(); self::assertSame(['https://example.com/logout'], $response->getHeader('Location')); self::assertSame(302, $response->getStatusCode()); } public function testAuthHeaderPartial(): void { $config = Config::getInstance(); $config->set('LoginCookieDeleteAll', false); $config->settings['Servers'] = [1, 2, 3]; $config->selectedServer['LogoutURL'] = 'https://example.com/logout'; $config->selectedServer['auth_type'] = 'cookie'; $_COOKIE['pmaAuth-2'] = ''; $response = $this->object->logOut(); self::assertSame(['/phpmyadmin/index.php?route=/&server=2&lang=en'], $response->getHeader('Location')); self::assertSame(302, $response->getStatusCode()); } public function testAuthCheckCaptcha(): void { $config = Config::getInstance(); $config->set('CaptchaRequestParam', 'g-recaptcha'); $config->set('CaptchaResponseParam', 'g-recaptcha-response'); $config->set('CaptchaLoginPrivateKey', 'testprivkey'); $config->set('CaptchaLoginPublicKey', 'testpubkey'); $_POST['g-recaptcha-response'] = ''; $_POST['pma_username'] = 'testPMAUser'; self::assertFalse( $this->object->readCredentials(), ); self::assertSame( 'Missing Captcha verification, maybe it has been blocked by adblock?', AuthenticationCookie::$connectionError, ); } public function testLogoutDelete(): void { $config = Config::getInstance(); $config->set('LoginCookieDeleteAll', true); $config->set('PmaAbsoluteUri', ''); $config->settings['Servers'] = [1]; $_COOKIE['pmaAuth-0'] = 'test'; $response = $this->object->logOut(); self::assertSame(['/phpmyadmin/index.php?route=/'], $response->getHeader('Location')); self::assertSame(302, $response->getStatusCode()); self::assertArrayNotHasKey('pmaAuth-0', $_COOKIE); } public function testLogout(): void { $config = Config::getInstance(); $config->set('LoginCookieDeleteAll', false); $config->set('PmaAbsoluteUri', ''); $config->settings['Servers'] = [1]; $config->selectedServer = ['auth_type' => 'cookie']; $_COOKIE['pmaAuth-1'] = 'test'; $response = $this->object->logOut(); self::assertSame(['/phpmyadmin/index.php?route=/'], $response->getHeader('Location')); self::assertSame(302, $response->getStatusCode()); self::assertArrayNotHasKey('pmaAuth-1', $_COOKIE); } public function testAuthCheckArbitrary(): void { $config = Config::getInstance(); $config->set('AllowArbitraryServer', true); $_REQUEST['old_usr'] = ''; $_POST['pma_username'] = 'testPMAUser'; $_REQUEST['pma_servername'] = 'testPMAServer'; $_POST['pma_password'] = 'testPMAPSWD'; self::assertTrue( $this->object->readCredentials(), ); self::assertSame('testPMAUser', $this->object->user); self::assertSame('testPMAPSWD', $this->object->password); self::assertSame('testPMAServer', AuthenticationCookie::$authServer); self::assertArrayNotHasKey('pmaAuth-1', $_COOKIE); } public function testAuthCheckInvalidCookie(): void { Config::getInstance()->settings['AllowArbitraryServer'] = true; $_REQUEST['pma_servername'] = 'testPMAServer'; $_POST['pma_password'] = 'testPMAPSWD'; $_POST['pma_username'] = ''; $_COOKIE['pmaUser-1'] = ''; $_COOKIE['pma_iv-1'] = base64_encode('testiv09testiv09'); self::assertFalse( $this->object->readCredentials(), ); } public function testAuthCheckExpires(): void { $_COOKIE['pmaServer-1'] = 'pmaServ1'; $_COOKIE['pmaUser-1'] = 'pmaUser1'; $_COOKIE['pma_iv-1'] = base64_encode('testiv09testiv09'); $_COOKIE['pmaAuth-1'] = ''; $config = Config::getInstance(); $_SESSION['last_access_time'] = time() - 1000; $config->set('LoginCookieValidity', 1440); self::assertFalse( $this->object->readCredentials(), ); } public function testAuthCheckDecryptUser(): void { $_REQUEST['old_usr'] = ''; $_POST['pma_username'] = ''; $_COOKIE['pmaServer-1'] = 'pmaServ1'; $_COOKIE['pmaUser-1'] = 'pmaUser1'; $_COOKIE['pma_iv-1'] = base64_encode('testiv09testiv09'); $_SESSION['last_access_time'] = ''; // mock for blowfish function $this->object = $this->getMockBuilder(AuthenticationCookie::class) ->disableOriginalConstructor() ->onlyMethods(['cookieDecrypt']) ->getMock(); $this->object->expects(self::once()) ->method('cookieDecrypt') ->willReturn('testBF'); self::assertFalse( $this->object->readCredentials(), ); self::assertSame('testBF', $this->object->user); } public function testAuthCheckDecryptPassword(): void { $_REQUEST['old_usr'] = ''; $_POST['pma_username'] = ''; $_COOKIE['pmaServer-1'] = 'pmaServ1'; $_COOKIE['pmaUser-1'] = 'pmaUser1'; $_COOKIE['pmaAuth-1'] = 'pmaAuth1'; $_COOKIE['pma_iv-1'] = base64_encode('testiv09testiv09'); $config = Config::getInstance(); $_SESSION['browser_access_time']['default'] = time() - 1000; $config->set('LoginCookieValidity', 1440); // mock for blowfish function $this->object = $this->getMockBuilder(AuthenticationCookie::class) ->disableOriginalConstructor() ->onlyMethods(['cookieDecrypt']) ->getMock(); $this->object->expects(self::exactly(2)) ->method('cookieDecrypt') ->willReturn('{"password":""}'); self::assertTrue( $this->object->readCredentials(), ); self::assertTrue(AuthenticationCookie::$fromCookie); self::assertSame('', $this->object->password); } public function testAuthCheckAuthFails(): void { $_REQUEST['old_usr'] = ''; $_POST['pma_username'] = ''; $_COOKIE['pmaServer-1'] = 'pmaServ1'; $_COOKIE['pmaUser-1'] = 'pmaUser1'; $_COOKIE['pma_iv-1'] = base64_encode('testiv09testiv09'); $_SESSION['last_access_time'] = 1; $_SESSION['browser_access_time']['default'] = -1; // mock for blowfish function $this->object = $this->getMockBuilder(AuthenticationCookie::class) ->disableOriginalConstructor() ->onlyMethods(['cookieDecrypt']) ->getMock(); $this->object->expects(self::once()) ->method('cookieDecrypt') ->willReturn('testBF'); $this->expectExceptionObject(AuthenticationFailure::loggedOutDueToInactivity()); $this->object->readCredentials(); } public function testAuthSetUser(): void { $this->object->user = 'pmaUser2'; $arr = ['host' => 'a', 'port' => 1, 'socket' => true, 'ssl' => true, 'user' => 'pmaUser2']; $config = Config::getInstance(); $config->selectedServer = $arr; $config->selectedServer['user'] = 'pmaUser'; $config->settings['Servers'][1] = $arr; $config->set('AllowArbitraryServer', true); AuthenticationCookie::$authServer = 'b 2'; $this->object->password = 'testPW'; Current::$server = 2; $config->set('LoginCookieStore', 100); AuthenticationCookie::$fromCookie = true; $this->object->storeCredentials(); $this->object->rememberCredentials(); self::assertArrayHasKey('pmaUser-2', $_COOKIE); self::assertArrayHasKey('pmaAuth-2', $_COOKIE); $arr['password'] = 'testPW'; $arr['host'] = 'b'; $arr['port'] = '2'; self::assertSame($arr, $config->selectedServer); } public function testAuthSetUserWithHeaders(): void { $this->object->user = 'pmaUser2'; $config = Config::getInstance(); $config->selectedServer['host'] = 'b'; $config->selectedServer['user'] = 'pmaUser'; $config->settings['AllowArbitraryServer'] = true; $config->set('PmaAbsoluteUri', 'http://localhost/phpmyadmin'); AuthenticationCookie::$authServer = 'b 2'; $this->object->password = 'testPW'; $config->settings['LoginCookieStore'] = 100; AuthenticationCookie::$fromCookie = false; $this->object->storeCredentials(); $response = $this->object->rememberCredentials(); self::assertNotNull($response); self::assertSame(StatusCodeInterface::STATUS_FOUND, $response->getStatusCode()); self::assertStringEndsWith( '/phpmyadmin/index.php?route=/&db=db&table=table&lang=en', $response->getHeaderLine('Location'), ); } public function testAuthFailsNoPass(): void { $responseRenderer = new ResponseRendererStub(); $this->object = $this->getMockBuilder(AuthenticationCookie::class) ->setConstructorArgs([$responseRenderer]) ->onlyMethods(['showLoginForm']) ->getMock(); $this->object->expects(self::exactly(1)) ->method('showLoginForm') ->willThrowException(new ExitException()); $_COOKIE['pmaAuth-2'] = 'pass'; try { $this->object->showFailure(AuthenticationFailure::emptyPasswordDeniedByConfiguration()); } catch (Throwable $throwable) { } self::assertInstanceOf(ExitException::class, $throwable ?? null); $response = $responseRenderer->getResponse(); self::assertSame(['no-store, no-cache, must-revalidate'], $response->getHeader('Cache-Control')); self::assertSame(['no-cache'], $response->getHeader('Pragma')); self::assertSame(200, $response->getStatusCode()); self::assertSame( 'Login without a password is forbidden by configuration (see AllowNoPassword).', AuthenticationCookie::$connectionError, ); } /** @return array */ public static function dataProviderPasswordLength(): array { return [ [ str_repeat('a', 2001), false, 'Your password is too long. To prevent denial-of-service attacks,' . ' phpMyAdmin restricts passwords to less than 2000 characters.', ], [ str_repeat('a', 3000), false, 'Your password is too long. To prevent denial-of-service attacks,' . ' phpMyAdmin restricts passwords to less than 2000 characters.', ], [str_repeat('a', 256), true, ''], ['', true, ''], ]; } #[DataProvider('dataProviderPasswordLength')] public function testAuthFailsTooLongPass(string $password, bool $expected, string $connError): void { $_POST['pma_username'] = str_shuffle('123456987rootfoobar'); $_POST['pma_password'] = $password; self::assertSame( $expected, $this->object->readCredentials(), ); self::assertSame($connError, AuthenticationCookie::$connectionError); } public function testAuthFailsDeny(): void { $responseRenderer = new ResponseRendererStub(); $this->object = $this->getMockBuilder(AuthenticationCookie::class) ->setConstructorArgs([$responseRenderer]) ->onlyMethods(['showLoginForm']) ->getMock(); $this->object->expects(self::exactly(1)) ->method('showLoginForm') ->willThrowException(new ExitException()); $_COOKIE['pmaAuth-2'] = 'pass'; try { $this->object->showFailure(AuthenticationFailure::deniedByAllowDenyRules()); } catch (Throwable $throwable) { } self::assertInstanceOf(ExitException::class, $throwable ?? null); $response = $responseRenderer->getResponse(); self::assertSame(['no-store, no-cache, must-revalidate'], $response->getHeader('Cache-Control')); self::assertSame(['no-cache'], $response->getHeader('Pragma')); self::assertSame(200, $response->getStatusCode()); self::assertSame('Access denied!', AuthenticationCookie::$connectionError); } public function testAuthFailsActivity(): void { $responseRenderer = new ResponseRendererStub(); $this->object = $this->getMockBuilder(AuthenticationCookie::class) ->setConstructorArgs([$responseRenderer]) ->onlyMethods(['showLoginForm']) ->getMock(); $this->object->expects(self::exactly(1)) ->method('showLoginForm') ->willThrowException(new ExitException()); $_COOKIE['pmaAuth-2'] = 'pass'; Config::getInstance()->set('LoginCookieValidity', 10); try { $this->object->showFailure(AuthenticationFailure::loggedOutDueToInactivity()); } catch (Throwable $throwable) { } self::assertInstanceOf(ExitException::class, $throwable ?? null); $response = $responseRenderer->getResponse(); self::assertSame(['no-store, no-cache, must-revalidate'], $response->getHeader('Cache-Control')); self::assertSame(['no-cache'], $response->getHeader('Pragma')); self::assertSame(200, $response->getStatusCode()); self::assertSame( 'You have been automatically logged out due to inactivity of 10 seconds.' . ' Once you log in again, you should be able to resume the work where you left off.', AuthenticationCookie::$connectionError, ); } public function testAuthFailsDBI(): void { $responseRenderer = new ResponseRendererStub(); $this->object = $this->getMockBuilder(AuthenticationCookie::class) ->setConstructorArgs([$responseRenderer]) ->onlyMethods(['showLoginForm']) ->getMock(); $this->object->expects(self::exactly(1)) ->method('showLoginForm') ->willThrowException(new ExitException()); $_COOKIE['pmaAuth-2'] = 'pass'; $dbi = $this->getMockBuilder(DatabaseInterface::class) ->disableOriginalConstructor() ->getMock(); $dbi->expects(self::once()) ->method('getError') ->willReturn(''); DatabaseInterface::$instance = $dbi; DatabaseInterface::$errorNumber = 42; try { $this->object->showFailure(AuthenticationFailure::deniedByDatabaseServer()); } catch (Throwable $throwable) { } self::assertInstanceOf(ExitException::class, $throwable ?? null); $response = $responseRenderer->getResponse(); self::assertSame(['no-store, no-cache, must-revalidate'], $response->getHeader('Cache-Control')); self::assertSame(['no-cache'], $response->getHeader('Pragma')); self::assertSame(200, $response->getStatusCode()); self::assertSame('#42 Cannot log in to the database server.', AuthenticationCookie::$connectionError); } public function testAuthFailsErrno(): void { $responseRenderer = new ResponseRendererStub(); $this->object = $this->getMockBuilder(AuthenticationCookie::class) ->setConstructorArgs([$responseRenderer]) ->onlyMethods(['showLoginForm']) ->getMock(); $this->object->expects(self::exactly(1)) ->method('showLoginForm') ->willThrowException(new ExitException()); $dbi = $this->getMockBuilder(DatabaseInterface::class) ->disableOriginalConstructor() ->getMock(); $dbi->expects(self::once()) ->method('getError') ->willReturn(''); DatabaseInterface::$instance = $dbi; $_COOKIE['pmaAuth-2'] = 'pass'; DatabaseInterface::$errorNumber = null; try { $this->object->showFailure(AuthenticationFailure::deniedByDatabaseServer()); } catch (Throwable $throwable) { } self::assertInstanceOf(ExitException::class, $throwable ?? null); $response = $responseRenderer->getResponse(); self::assertSame(['no-store, no-cache, must-revalidate'], $response->getHeader('Cache-Control')); self::assertSame(['no-cache'], $response->getHeader('Pragma')); self::assertSame(200, $response->getStatusCode()); self::assertSame('Cannot log in to the database server.', AuthenticationCookie::$connectionError); } public function testGetEncryptionSecretEmpty(): void { $method = new ReflectionMethod(AuthenticationCookie::class, 'getEncryptionSecret'); $_SESSION['encryption_key'] = ''; $result = $method->invoke($this->object, null); self::assertSame($result, $_SESSION['encryption_key']); self::assertSame(SODIUM_CRYPTO_SECRETBOX_KEYBYTES, mb_strlen($result, '8bit')); } public function testGetEncryptionSecretConfigured(): void { $method = new ReflectionMethod(AuthenticationCookie::class, 'getEncryptionSecret'); $key = str_repeat('a', SODIUM_CRYPTO_SECRETBOX_KEYBYTES); Config::getInstance()->set('blowfish_secret', $key); $_SESSION['encryption_key'] = ''; $result = $method->invoke($this->object, null); self::assertSame($key, $result); } public function testGetSessionEncryptionSecretConfigured(): void { $method = new ReflectionMethod(AuthenticationCookie::class, 'getEncryptionSecret'); $key = str_repeat('a', SODIUM_CRYPTO_SECRETBOX_KEYBYTES); $_SESSION['encryption_key'] = $key; $result = $method->invoke($this->object, null); self::assertSame($key, $result); } public function testCookieEncryption(): void { $key = random_bytes(SODIUM_CRYPTO_SECRETBOX_KEYBYTES); $encrypted = $this->object->cookieEncrypt('data123', $key); self::assertNotFalse(base64_decode($encrypted, true)); self::assertSame('data123', $this->object->cookieDecrypt($encrypted, $key)); } public function testCookieDecryptInvalid(): void { self::assertNull($this->object->cookieDecrypt('', '')); $key = random_bytes(SODIUM_CRYPTO_SECRETBOX_KEYBYTES); $encrypted = $this->object->cookieEncrypt('data123', $key); self::assertSame('data123', $this->object->cookieDecrypt($encrypted, $key)); self::assertNull($this->object->cookieDecrypt('', $key)); self::assertNull($this->object->cookieDecrypt($encrypted, '')); self::assertNull($this->object->cookieDecrypt($encrypted, random_bytes(SODIUM_CRYPTO_SECRETBOX_KEYBYTES))); } /** @throws ReflectionException */ public function testPasswordChange(): void { $newPassword = 'PMAPASSWD2'; $config = Config::getInstance(); $config->set('AllowArbitraryServer', true); AuthenticationCookie::$authServer = 'b 2'; $_SESSION['encryption_key'] = ''; $_COOKIE = []; $this->object->handlePasswordChange($newPassword); $payload = ['password' => $newPassword, 'server' => 'b 2']; /** @psalm-suppress EmptyArrayAccess */ self::assertIsString($_COOKIE['pmaAuth-' . Current::$server]); $decryptedCookie = $this->object->cookieDecrypt( $_COOKIE['pmaAuth-' . Current::$server], $_SESSION['encryption_key'], ); self::assertSame(json_encode($payload), $decryptedCookie); } public function testAuthenticate(): void { $config = Config::getInstance(); $config->selectedServer['AllowRoot'] = false; $config->selectedServer['AllowNoPassword'] = false; $_REQUEST['old_usr'] = ''; $_POST['pma_username'] = 'testUser'; $_POST['pma_password'] = 'testPassword'; ob_start(); $response = $this->object->authenticate(); $result = ob_get_clean(); self::assertNull($response); /* Nothing should be printed */ self::assertSame('', $result); /* Verify readCredentials worked */ self::assertSame('testUser', $this->object->user); self::assertSame('testPassword', $this->object->password); /* Verify storeCredentials worked */ self::assertSame('testUser', $config->selectedServer['user']); self::assertSame('testPassword', $config->selectedServer['password']); } /** * @param string $user user * @param string $pass pass * @param string $ip ip * @param bool $root root * @param bool $nopass nopass * @param mixed[] $rules rules * @param string $expected expected result */ #[DataProvider('checkRulesProvider')] public function testCheckRules( string $user, string $pass, string $ip, bool $root, bool $nopass, array $rules, string $expected, ): void { $this->object->user = $user; $this->object->password = $pass; $this->object->storeCredentials(); $_SERVER['REMOTE_ADDR'] = $ip; $config = Config::getInstance(); $config->selectedServer['AllowRoot'] = $root; $config->selectedServer['AllowNoPassword'] = $nopass; $config->selectedServer['AllowDeny'] = $rules; $exception = null; try { $this->object->checkRules(); } catch (AuthenticationFailure $exception) { } if ($expected === '') { self::assertNull($exception, 'checkRules() should not throw an exception.'); return; } self::assertInstanceOf(AuthenticationFailure::class, $exception); self::assertSame($expected, $exception->failureType); } /** @return array, string}> */ public static function checkRulesProvider(): array { return [ 'nopass-ok' => ['testUser', '', '1.2.3.4', true, true, [], ''], 'nopass' => ['testUser', '', '1.2.3.4', true, false, [], AuthenticationFailure::EMPTY_DENIED], 'root-ok' => ['root', 'root', '1.2.3.4', true, true, [], ''], 'root' => ['root', 'root', '1.2.3.4', false, true, [], AuthenticationFailure::ROOT_DENIED], 'rules-deny-allow-ok' => [ 'root', 'root', '1.2.3.4', true, true, ['order' => 'deny,allow', 'rules' => ['allow root 1.2.3.4', 'deny % from all']], '', ], 'rules-deny-allow-reject' => [ 'user', 'root', '1.2.3.4', true, true, ['order' => 'deny,allow', 'rules' => ['allow root 1.2.3.4', 'deny % from all']], AuthenticationFailure::ALLOW_DENIED, ], 'rules-allow-deny-ok' => [ 'root', 'root', '1.2.3.4', true, true, ['order' => 'allow,deny', 'rules' => ['deny user from all', 'allow root 1.2.3.4']], '', ], 'rules-allow-deny-reject' => [ 'user', 'root', '1.2.3.4', true, true, ['order' => 'allow,deny', 'rules' => ['deny user from all', 'allow root 1.2.3.4']], AuthenticationFailure::ALLOW_DENIED, ], 'rules-explicit-ok' => [ 'root', 'root', '1.2.3.4', true, true, ['order' => 'explicit', 'rules' => ['deny user from all', 'allow root 1.2.3.4']], '', ], 'rules-explicit-reject' => [ 'user', 'root', '1.2.3.4', true, true, ['order' => 'explicit', 'rules' => ['deny user from all', 'allow root 1.2.3.4']], AuthenticationFailure::ALLOW_DENIED, ], ]; } }