diff --git a/ChangeLog b/ChangeLog
index abb124cff..192ca0379 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -12,6 +12,8 @@ $HeadURL: https://phpmyadmin.svn.sourceforge.net/svnroot/phpmyadmin/trunk/phpMyA
thanks to Thijs Kinkhorst - kink
+ new setup script, thanks to Piotr Przybylski (work in progress)
- rfe #1892243 [export] more links to documentation
++ [auth] cookie auth now autogenerates blowfish_secret, but it has some
+ limitations and you still should set it in config file
3.0.0.0 (not yet released)
+ [export] properly handle line breaks for YAML, thanks to Dan Barry -
diff --git a/Documentation.html b/Documentation.html
index 02baf93eb..a0e69a717 100644
--- a/Documentation.html
+++ b/Documentation.html
@@ -597,7 +597,12 @@ since this link provides funding for phpMyAdmin.
If you are using the "cookie" auth_type, enter here a random
passphrase of your choice. It will be used internally by the blowfish
algorithm: you won’t be prompted for this passphrase. The maximum
- number of characters for this parameter seems to be 46.
+ number of characters for this parameter seems to be 46.
+
+ Since version 3.1.0 phpMyAdmin can generate this on the fly, but it
+ makes a bit weaker security as this generated secret is stored in
+ session and furthermore it makes impossible to recall user name from
+ cookie.
$cfg['Servers'] array
Since version 1.4.2, phpMyAdmin supports the administration of multiple
@@ -1180,7 +1185,11 @@ ALTER TABLE `pma_column_comments`
$cfg['LoginCookieRecall'] boolean
Define whether the previous login should be recalled or not in cookie
- authentication mode.
+ authentication mode.
+
+ This is automatically diabled if you do not have configured
+ $cfg['blowfish_secret'].
+
$cfg['LoginCookieValidity'] integer [number of seconds]
Define how long is login cookie valid.
diff --git a/libraries/auth/cookie.auth.lib.php b/libraries/auth/cookie.auth.lib.php
index a858f44ec..765c73668 100644
--- a/libraries/auth/cookie.auth.lib.php
+++ b/libraries/auth/cookie.auth.lib.php
@@ -75,6 +75,24 @@ if (function_exists('mcrypt_encrypt')) {
trigger_error(PMA_sanitize(sprintf($strCantLoad, 'mcrypt')), E_USER_WARNING);
}
+/**
+ * Returns blowfish secret or generates one if needed.
+ * @uses $cfg['blowfish_secret']
+ * @uses $_SESSION['auto_blowfish_secret']
+ *
+ * @access public
+ */
+function PMA_get_blowfish_secret() {
+ if (empty($GLOBALS['cfg']['blowfish_secret'])) {
+ if (empty($_SESSION['auto_blowfish_secret'])) {
+ $_SESSION['auto_blowfish_secret'] = uniqid('', true);
+ }
+ return $_SESSION['auto_blowfish_secret'];
+ } else {
+ return $GLOBALS['cfg']['blowfish_secret'];
+ }
+}
+
/**
* Displays authentication form
*
@@ -133,7 +151,8 @@ function PMA_auth()
exit;
}
- if ($GLOBALS['cfg']['LoginCookieRecall']) {
+ /* No recall if blowfish secret is not configured as it would produce garbage */
+ if ($GLOBALS['cfg']['LoginCookieRecall'] && !empty($GLOBALS['cfg']['blowfish_secret'])) {
$default_user = $GLOBALS['PHP_AUTH_USER'];
$default_server = $GLOBALS['pma_auth_server'];
$autocomplete = '';
@@ -203,22 +222,6 @@ if (top != self) {
PMA_select_language(true, false);
}
- // Displays the warning message and the login form
- if (empty($GLOBALS['cfg']['blowfish_secret'])) {
- PMA_Message::error('strSecretRequired')->display();
- if ($GLOBALS['error_handler']->hasDisplayErrors()) {
- echo '';
- $GLOBALS['error_handler']->dispErrors();
- echo '
';
- }
- echo '' . "\n";
- if (file_exists('./config.footer.inc.php')) {
- require './config.footer.inc.php';
- }
- echo '