nettika/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bug #1909711 [security] Sensitive data in session files

Browse Source
This commit is contained in:
Marc Delisle
2008-03-29 06:06:35 +00:00
parent 7dff073750
commit b26c7438ad
3 changed files with 23 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
ChangeLog
View File

@@ -5,6 +5,9 @@ phpMyAdmin - ChangeLog
$Id$
$HeadURL: https://phpmyadmin.svn.sourceforge.net/svnroot/phpmyadmin/trunk/phpMyAdmin/ChangeLog $
2.11.5.1 (2008-03-29)
- bug #1909711 [security] Sensitive data in session files
2.11.5.0 (2008-03-01)
- bug #1862661 [GUI] Warn about rename deleting database
- bug #1866041 [interface] Incorrect sorting with AS

5
libraries/Config.class.php
View File

@@ -886,8 +886,9 @@ class PMA_Config
*/
function enableBc()
{
$GLOBALS['cfg'] =& $this->settings;
$GLOBALS['default_server'] =& $this->default_server;
$GLOBALS['cfg'] = $this->settings;
$GLOBALS['default_server'] = $this->default_server;
unset($this->default_server);
$GLOBALS['collation_connection'] = $this->get('collation_connection');
$GLOBALS['is_upload'] = $this->get('enable_upload');
$GLOBALS['max_upload_size'] = $this->get('max_upload_size');

35
libraries/common.inc.php
View File

@@ -463,26 +463,20 @@ $_REQUEST['js_frame'] = PMA_ifSetOr($_REQUEST['js_frame'], '');
/******************************************************************************/
/* parsing configuration file LABEL_parsing_config_file */
if (empty($_SESSION['PMA_Config'])) {
/**
* We really need this one!
*/
if (! function_exists('preg_replace')) {
PMA_fatalError('strCantLoad', 'pcre');
}
/**
* @global PMA_Config $_SESSION['PMA_Config']
*/
$_SESSION['PMA_Config'] = new PMA_Config('./config.inc.php');
} elseif (version_compare(phpversion(), '5', 'lt')) {
/**
* @todo move all __wakeup() functionality into session.inc.php
*/
$_SESSION['PMA_Config']->__wakeup();
/**
* We really need this one!
*/
if (! function_exists('preg_replace')) {
PMA_fatalError('strCantLoad', 'pcre');
}
/**
* @global PMA_Config $_SESSION['PMA_Config']
* force reading of config file, because we removed sensitive values
* in the previous iteration
*/
$_SESSION['PMA_Config'] = new PMA_Config('./config.inc.php');
if (!defined('PMA_MINIMUM_COMMON')) {
$_SESSION['PMA_Config']->checkPmaAbsoluteUri();
}
@@ -901,6 +895,11 @@ if (! defined('PMA_MINIMUM_COMMON')) {
} // end if !defined('PMA_MINIMUM_COMMON')
// remove sensitive values from session
$_SESSION['PMA_Config']->set('blowfish_secret', '');
$_SESSION['PMA_Config']->set('Servers', '');
$_SESSION['PMA_Config']->set('default_server', '');
if (!empty($__redirect) && in_array($__redirect, $goto_whitelist)) {
/**
* include subform target page