webapp/phpmyadmin
1
0
Fork 0
mirror of https://github.com/phpmyadmin/phpmyadmin.git synced 2026-10-31 10:54:46 +03:00
Code Activity
93,239 Commits 12 Branches 481 Tags
e433d8189bb9cf00a17602cf183334bbf8684fc9
Commit Graph

86 Commits

Author SHA1 Message Date
Michal Čihař
e433d8189b Use phpseclib for generating session encryption key 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 14:43:10 +02:00
Michal Čihař
da047efbd1 Use random per session key for encrypting password 
This makes it impossible to decrypt cookies later if the key would be
compromised.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 14:43:10 +02:00
Michal Čihař
5e51f178dd Remove some blowfish mentions 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 14:43:10 +02:00
Michal Čihař
cd4d54395b Remove another reference to Blowfish 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 14:43:10 +02:00
Michal Čihař
96977c994e Use require here 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 10:50:52 +02:00
Michal Čihař
20640592f0 Always use phpseclib for cookie encryption 
- it provides fallback in case mcrypt is not found
- we now use AES in both mcrypt and PHP code case
- cleanup the code by removing mcrypt conditials
- rename some methods and cookies so that they don't refer to
  implementation details
- switching encryption implementations no longer invalidates the
  credentials

Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 10:39:52 +02:00
Michal Čihař
0652ca9ccd Merge remote-tracking branch 'origin/QA_4_2' 2014-06-12 10:19:00 +02:00
Michal Čihař
bc60315023 Adjust tests to new IV logic 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 10:18:45 +02:00
Michal Čihař
c6e76422c4 Allow to use system phpseclib 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 10:06:20 +02:00
Michal Čihař
716f6d4c55 Merge remote-tracking branch 'origin/QA_4_2' 2014-06-12 09:47:17 +02:00
Michal Čihař
953c7415ad Separate check for password cookie 
Otherwise it would not be possible to recall user name.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 09:47:04 +02:00
Michal Čihař
5d39998a86 Merge commit '7cba81de271d62bdf93ded7598709702a96f92d7' 
Conflicts:
	libraries/plugins/auth/AuthenticationCookie.class.php
 2014-06-12 09:45:13 +02:00
Michal Čihař
7cba81de27 Regenerate cookie encryption IV for every session 
The IV for cookie encryption was generated just once for every browser
and kept in a cookie. Generating it for every session is much better to
avoid information leaks (eg. that same user has logged in).

Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 09:41:27 +02:00
Michal Čihař
b252cb9981 Use better source of entropy for mcrypt IV 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-12 09:16:20 +02:00
Marc Delisle
a6d379caf2 Since PHP 5.3.0, it's not longer required to call srand() before 
mcrypt_create_iv().

Signed-off-by: Marc Delisle <marc@infomarc.info>
 2014-06-11 08:31:23 -04:00
Michal Čihař
1efadc8e7c We already check for empty value, remove todo 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-06-06 15:46:34 +02:00
Michal Čihař
650e0512de Share code for getting error message 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-05-09 15:05:36 +02:00
Michal Čihař
82b4549176 Remove unused parameter of PMA_Util::cacheUnset 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-05-09 14:21:12 +02:00
Hugues Peccatte
9b1f025fb7 PHPCS updates. 
Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2014-03-14 23:06:46 +01:00
Dhananjay Nakrani
76c57710f0 Display session expiry msg after auto-redirect. 
Signed-off-by: Dhananjay Nakrani <dhananjaynakrani@gmail.com>
 2014-03-03 11:49:17 +05:30
Chirayu Chiripal
dec30ffd6d Feature Request #1460 Redirect to login page after session has expired 
Signed-off-by: Chirayu Chiripal <chirayu.chiripal@gmail.com>
 2014-02-27 17:45:46 +05:30
Madhura Jayaratne
f65ac8803e Merge branch 'QA_4_1' 2014-02-08 13:06:10 +05:30
Madhura Jayaratne
59e3c9474a bug #4278 reCaptcha re-login requires double effort 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2014-02-08 13:04:32 +05:30
Marc Delisle
f5ba57c290 Revert "Avoid using hard-coded argument separator, see https://sourceforge.net/p/phpmyadmin/bugs/3733" 
This reverts commit 36e544ce9e.

Signed-off-by: Marc Delisle <marc@infomarc.info>
 2014-02-03 10:11:44 -05:00
Marc Delisle
c406599995 Revert "Avoid using hard-coded argument separator, see https://sourceforge.net/p/phpmyadmin/bugs/3733" 
This reverts commit 36e544ce9e.

Signed-off-by: Marc Delisle <marc@infomarc.info>
 2014-02-03 10:10:53 -05:00
Marc Delisle
464616c26b Merge commit '36e544c' 2014-02-03 08:44:37 -05:00
Marc Delisle
36e544ce9e Avoid using hard-coded argument separator, see https://sourceforge.net/p/phpmyadmin/bugs/3733 
Signed-off-by: Marc Delisle <marc@infomarc.info>
 2014-02-03 08:42:39 -05:00
Michal Čihař
396991a194 Merge remote-tracking branch 'origin/QA_4_1' 2014-02-03 09:01:55 +01:00
Michal Čihař
c6969bfb9e Properly encode & in URL 
Signed-off-by: Michal Čihař <mcihar@suse.cz>
 2014-02-03 09:00:05 +01:00
Madhura Jayaratne
a5c6f555f9 Merge branch 'QA_4_1' 2014-02-02 22:56:55 +05:30
Madhura Jayaratne
22c851d1b8 bug #4259 reCaptcha sound session expired problem 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2014-02-02 22:53:11 +05:30
Madhura Jayaratne
fc34716720 reCaptcha theme 'while' matches better with PMA themes 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2014-02-02 22:22:53 +05:30
Madhura Jayaratne
d1af87b7e6 Merge branch 'QA_4_1' 2014-02-02 22:18:49 +05:30
Madhura Jayaratne
6a7d3f9ed7 bug #4260 reCaptcha is ignoring language settings 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2014-02-02 22:15:56 +05:30
Michal Čihař
b4d03dc9f5 Correct punctuation for sentences 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2014-02-02 11:30:39 +01:00
Michal Čihař
1d76d52baf Missing punctuation at the end of sentences 2014-01-29 15:21:02 +01:00
Madhura Jayaratne
74aebe629b Spaces around . operator 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2014-01-08 18:06:02 +05:30
Marc Delisle
9ad4e64719 Fix coding style 2013-11-22 05:26:45 -05:00
Hugues Peccatte
1f09a22281 Fix PHPDoc. 2013-11-08 22:41:05 +01:00
Dieter Adriaenssens
0b86704892 fix coding style : wrap long lines 2013-09-24 15:33:21 +02:00
Michal Čihař
0a3d1d5be8 Better names for URL generating functions 2013-08-07 10:58:17 +02:00
ayushchd
7312cd5b01 Tests for AuthenticationConfig and AuthenticationCookie 2013-07-16 21:44:49 +05:45
Michal Čihař
31a1167f19 End sentence with a stop 2013-07-12 14:58:09 +02:00
Michal Čihař
c0ce163e05 Drop some unused local variables 
Found by PMD on our CI server
 2013-07-10 14:53:05 +02:00
Michal Čihař
9bcf95f235 Remove extra parenthesis 2013-06-12 10:57:00 +02:00
Michal Čihař
fab879f924 Simplify reCaptcha configuration 
Once private and public keys are in place, it is enabled. I see no need
for per server setup.
 2013-06-12 09:38:10 +02:00
Michal Čihař
3a7139db70 Use shorter notion of server array 2013-06-11 16:00:22 +02:00
Michal Čihař
dfb81b4b92 Coding style improvements 2013-06-11 15:59:23 +02:00
Michal Čihař
d08730780a Consistent config naming with other config options (issue #369) 2013-06-11 15:30:14 +02:00
Michal Čihař
65a083f6d4 Merge branch 'RECAPTCHA2' of git://github.com/pbojan/phpmyadmin into pbojan-RECAPTCHA2 
Conflicts:
	libraries/Header.class.php
 2013-06-11 15:28:19 +02:00