' . implode('

', $messages); throw new SessionHandlerException($errorMessage); } /** @throws SessionHandlerException */ public static function setUp(Config $config, ErrorHandler $errorHandler): void { if (ini_get('session.auto_start') && session_name() !== 'phpMyAdmin' && session_id()) { // Do not delete the existing non empty session, it might be used by // other applications; instead just close it. if ($_SESSION === []) { // Ignore errors as this might have been destroyed in other // request meanwhile @session_destroy(); } else { // do not use session_write_close, see issue #13392 session_abort(); } } $cookieSameSite = $config->config->CookieSameSite; $cookiePath = $config->getRootPath(); session_set_cookie_params([ 'lifetime' => 0, 'path' => $cookiePath, 'domain' => '', 'secure' => $config->isHttps(), 'httponly' => true, 'samesite' => $cookieSameSite, ]); // cookies are safer (use ini_set() in case this function is disabled) ini_set('session.use_cookies', 'true'); // optionally set session_save_path $path = $config->config->SessionSavePath; if ($path !== '') { session_save_path($path); // We can not do this unconditionally as this would break // any more complex setup (eg. cluster), see // https://github.com/phpmyadmin/phpmyadmin/issues/8346 ini_set('session.save_handler', 'files'); } // use cookies only ini_set('session.use_only_cookies', '1'); // strict session mode (do not accept random string as session ID) ini_set('session.use_strict_mode', '1'); // make the session cookie HttpOnly ini_set('session.cookie_httponly', '1'); // add SameSite to the session cookie ini_set('session.cookie_samesite', $cookieSameSite); // do not force transparent session ids ini_set('session.use_trans_sid', '0'); // delete session/cookies when browser is closed ini_set('session.cookie_lifetime', '0'); // some pages (e.g. stylesheet) may be cached on clients, but not in shared // proxy servers session_cache_limiter('private'); $httpCookieName = $config->getCookieName('phpMyAdmin'); session_name($httpCookieName); // Restore correct session ID (it might have been reset by auto started session if ($config->issetCookie('phpMyAdmin')) { session_id($config->getCookie('phpMyAdmin')); } // on first start of session we check for errors // f.e. session dir cannot be accessed - session file not created $origErrorCount = $errorHandler->countErrors(false); $sessionResult = session_start(); if (! $sessionResult || $origErrorCount !== $errorHandler->countErrors(false)) { setcookie($httpCookieName, '', 1); $errors = $errorHandler->sliceErrors($origErrorCount); self::sessionFailed($errors); } if (self::getToken() !== '') { return; } self::generateToken(); /** * Check for disk space on session storage by trying to write it. * * This seems to be most reliable approach to test if sessions are working, * otherwise the check would fail with custom session backends. */ $origErrorCount = $errorHandler->countErrors(); session_write_close(); if ($errorHandler->countErrors() > $origErrorCount) { $errors = $errorHandler->sliceErrors($origErrorCount); self::sessionFailed($errors); } // PHP will send the same cookie again, but there is no way to stop it // A third cookie will be sent by session_regenerate_id() which will override these two session_start(); if (self::getToken() !== '') { return; } throw new SessionHandlerException( 'Failed to store CSRF token in session! Probably sessions are not working properly.', ); } }