You've already forked phpmyadmin
mirror of
https://github.com/phpmyadmin/phpmyadmin.git
synced 2026-10-31 10:54:46 +03:00
13c0f7bc3c
- Move Advisor to PhpMyAdmin namespace - Move Bookmark to PhpMyAdmin namespace - Move Charsets to PhpMyAdmin namespace - Move Config class to PhpMyAdmin namespace - Move Console class to PhpMyAdmin namespace - Move Core to PhpMyAdmin namespace - Move DatabaseInterface to PhpMyAdmin namespace - Move DbList to PhpMyAdmin namespace - Move DbQbe to PhpMyAdmin namespace - Move DbSearch to PhpMyAdmin namespace - Move DisplayResults to PhpMyAdmin namespace - Move Encoding to PhpMyAdmin namespace - Move Error to PhpMyAdmin namespace - Move ErrorHandler to PhpMyAdmin namespace - Move File to PhpMyAdmin namespace - Move Font to PhpMyAdmin namespace - Move Footer to PhpMyAdmin namespace - Move Header to PhpMyAdmin namespace - Move Index to PhpMyAdmin namespace - Move IndexColumn to PhpMyAdmin namespace - Move LanguageManager to PhpMyAdmin namespace - Move Language to PhpMyAdmin namespace - Move Linter to PhpMyAdmin namespace - Move ListAbstract to PhpMyAdmin namespace - Move ListDatabase to PhpMyAdmin namespace Signed-off-by: Maurício Meneghini Fauth <mauriciofauth@gmail.com>
48 lines
1015 B
PHP
48 lines
1015 B
PHP
<?php
|
|
/* vim: set expandtab sw=4 ts=4 sts=4: */
|
|
/**
|
|
* session library
|
|
*
|
|
* @package PhpMyAdmin
|
|
*/
|
|
|
|
use PhpMyAdmin\Core;
|
|
use PMA\libraries\Util;
|
|
|
|
/**
|
|
* tries to secure session from hijacking and fixation
|
|
* should be called before login and after successful login
|
|
* (only required if sensitive information stored in session)
|
|
*
|
|
* @return void
|
|
*/
|
|
function PMA_secureSession()
|
|
{
|
|
// prevent session fixation and XSS
|
|
if (session_status() === PHP_SESSION_ACTIVE && ! defined('TESTSUITE')) {
|
|
session_regenerate_id(true);
|
|
}
|
|
PMA_generateToken();
|
|
}
|
|
|
|
|
|
/**
|
|
* Generates PMA_token session variable.
|
|
*
|
|
* @return void
|
|
*/
|
|
function PMA_generateToken()
|
|
{
|
|
$_SESSION[' PMA_token '] = Util::generateRandom(16);
|
|
|
|
/**
|
|
* Check if token is properly generated (the generation can fail, for example
|
|
* due to missing /dev/random for openssl).
|
|
*/
|
|
if (empty($_SESSION[' PMA_token '])) {
|
|
Core::fatalError(
|
|
'Failed to generate random CSRF token!'
|
|
);
|
|
}
|
|
}
|