Skip to content

Commit 003f092

Browse files
jacekbareckijacekbarecki
authored
Fix #17262 - Add warning when setting a password to a blank value if AllowNoPassword is false (#19315)
* Fix #17262 - Add warning when setting a password to a blank value if AllowNoPassword is false Closes #17262 Signed-off-by: Jacek Barecki <jacek.barecki@gmail.com> Signed-off-by: Maurício Meneghini Fauth <mauricio@mfauth.net>
1 parent 720de70 commit 003f092

File tree

11 files changed

+83
-19
lines changed

11 files changed

+83
-19
lines changed

‎app/services.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -158,7 +158,7 @@
158158
'server_plugins' => ['class' => Plugins::class, 'arguments' => ['@dbi']],
159159
'server_privileges' => [
160160
'class' => Privileges::class,
161-
'arguments' => ['@template', '@dbi', '@relation', '@relation_cleanup', '@server_plugins'],
161+
'arguments' => ['@template', '@dbi', '@relation', '@relation_cleanup', '@server_plugins', '@config'],
162162
],
163163
'server_privileges_account_locking' => [
164164
'class' => AccountLocking::class,

‎app/services_controllers.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -700,6 +700,7 @@
700700
'$relation' => '@relation',
701701
'$dbi' => '@dbi',
702702
'$userPrivilegesFactory' => '@' . UserPrivilegesFactory::class,
703+
'$config' => '@config',
703704
],
704705
],
705706
Server\ReplicationController::class => [

‎resources/js/src/modules/functions.ts‎

Lines changed: 29 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1974,6 +1974,10 @@ export function checkPassword ($theForm) {
19741974
return true;
19751975
}
19761976

1977+
export function shouldShowEmptyPasswordWarning (form): boolean {
1978+
return (form.find('#nopass_1').is(':checked') && form.data('allowNoPassword') === 0);
1979+
}
1980+
19771981
export function onloadChangePasswordEvents (): void {
19781982
/* Handler for hostname type */
19791983
$(document).on('change', '#select_pred_hostname', function () {
@@ -2067,25 +2071,35 @@ export function onloadChangePasswordEvents (): void {
20672071
*/
20682072
var thisValue = $(this).val();
20692073

2070-
var $msgbox = ajaxShowMessage(window.Messages.strProcessingRequest);
2071-
$theForm.append('<input type="hidden" name="ajax_request" value="true">');
2074+
var submitForm = function () {
2075+
var $msgbox = ajaxShowMessage(window.Messages.strProcessingRequest);
2076+
$theForm.append('<input type="hidden" name="ajax_request" value="true">');
20722077

2073-
$.post($theForm.attr('action'), $theForm.serialize() + CommonParams.get('arg_separator') + 'change_pw=' + thisValue, function (data) {
2074-
if (typeof data === 'undefined' || data.success !== true) {
2075-
ajaxShowMessage(data.error, false);
2078+
$.post($theForm.attr('action'), $theForm.serialize() + CommonParams.get('arg_separator') + 'change_pw=' + thisValue, function (data) {
2079+
if (typeof data === 'undefined' || data.success !== true) {
2080+
ajaxShowMessage(data.error, false);
20762081

2077-
return;
2078-
}
2082+
return;
2083+
}
20792084

2080-
var $pageContent = $('#page_content');
2081-
$pageContent.prepend(data.message);
2082-
highlightSql($pageContent);
2083-
$('#change_password_dialog').hide().remove();
2084-
$('#edit_user_dialog').dialog('close').remove();
2085-
ajaxRemoveMessage($msgbox);
2086-
}); // end $.post()
2085+
var $pageContent = $('#page_content');
2086+
$pageContent.prepend(data.message);
2087+
highlightSql($pageContent);
2088+
$('#change_password_dialog').hide().remove();
2089+
$('#edit_user_dialog').dialog('close').remove();
2090+
ajaxRemoveMessage($msgbox);
2091+
}); // end $.post()
2092+
2093+
$('#changePasswordModal').modal('hide');
2094+
};
20872095

2088-
$('#changePasswordModal').modal('hide');
2096+
if (shouldShowEmptyPasswordWarning($theForm)) {
2097+
$(this).confirm(window.Messages.strPasswordEmptyWhenAllowNoPasswordIsEnabled, '', function () {
2098+
submitForm();
2099+
});
2100+
} else {
2101+
submitForm();
2102+
}
20892103
});
20902104

20912105
$.get($(this).attr('href'), { 'ajax_request': true }, function (data) {

‎resources/js/src/server/privileges.ts‎

Lines changed: 29 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,13 @@
11
import $ from 'jquery';
22
import { AJAX } from '../modules/ajax.ts';
3-
import { checkPassword, checkPasswordStrength, checkboxesSel, displayPasswordGenerateButton, getSqlEditor } from '../modules/functions.ts';
3+
import {
4+
checkPassword,
5+
checkPasswordStrength,
6+
checkboxesSel,
7+
displayPasswordGenerateButton,
8+
getSqlEditor,
9+
shouldShowEmptyPasswordWarning
10+
} from '../modules/functions.ts';
411
import { CommonParams } from '../modules/common.ts';
512
import { Navigation } from '../modules/navigation.ts';
613
import { ajaxRemoveMessage, ajaxShowMessage } from '../modules/ajax-message.ts';
@@ -475,6 +482,26 @@ const CheckAddUser = {
475482
}
476483
};
477484

485+
const CheckEmptyPasswordWhenAllowNoPasswordIsEnabled = {
486+
handleEvent: function () {
487+
const theForm = this;
488+
489+
if (shouldShowEmptyPasswordWarning($(theForm))) {
490+
$(this).confirm(window.Messages.strPasswordEmptyWhenAllowNoPasswordIsEnabled, '', function () {
491+
theForm.submit();
492+
493+
return true;
494+
});
495+
496+
return false;
497+
} else {
498+
theForm.submit();
499+
500+
return true;
501+
}
502+
}
503+
};
504+
478505
const selectPasswordRadioWhenChangingPassword = () => {
479506
$('#nopass_0').prop('checked', true);
480507
};
@@ -561,4 +588,5 @@ AJAX.registerOnload('server/privileges.js', function () {
561588

562589
$('#addUsersForm').on('submit', CheckAddUser.handleEvent);
563590
$('#copyUserForm').on('submit', CheckAddUser.handleEvent);
591+
$('#change_password_form').on('submit', CheckEmptyPasswordWhenAllowNoPasswordIsEnabled.handleEvent);
564592
});

‎resources/templates/server/privileges/change_password.twig‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<form method="post" id="change_password_form" action="
2-
{{- is_privileges ? url('/server/privileges') : url('/user-password') }}" name="chgPassword" class="{{ is_privileges ? 'submenu-item' }}" autocomplete="off">
2+
{{- is_privileges ? url('/server/privileges') : url('/user-password') }}" name="chgPassword" class="{{ is_privileges ? 'submenu-item' }}" autocomplete="off" data-allow-no-password="{{ allow_no_password ? 1 : 0 }}">
33
{{ get_hidden_inputs() }}
44
{% if is_privileges %}
55
<input type="hidden" name="username" value="{{ username }}">

‎src/Controllers/JavaScriptMessagesController.php‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,11 @@ private function getMessages(): array
143143
'strUserEmpty' => __('The user name is empty!'),
144144
'strPasswordEmpty' => __('The password is empty!'),
145145
'strPasswordNotSame' => __('The passwords aren\'t the same!'),
146+
'strPasswordEmptyWhenAllowNoPasswordIsEnabled' => __(
147+
'You are trying to set this account to log in with no password, but the configuration directive ' .
148+
'<code>AllowNoPassword</code> is false. If you proceed, the account will not be able to log in ' .
149+
'through phpMyAdmin.',
150+
),
146151
'strRemovingSelectedUsers' => __('Removing Selected Users'),
147152
'strClose' => __('Close'),
148153
'strLock' => _pgettext('Lock the account.', 'Lock'),

‎src/Controllers/Server/PrivilegesController.php‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44

55
namespace PhpMyAdmin\Controllers\Server;
66

7+
use PhpMyAdmin\Config;
78
use PhpMyAdmin\ConfigStorage\Relation;
89
use PhpMyAdmin\ConfigStorage\RelationCleanup;
910
use PhpMyAdmin\Controllers\InvocableController;
@@ -38,6 +39,7 @@ public function __construct(
3839
private readonly Relation $relation,
3940
private readonly DatabaseInterface $dbi,
4041
private readonly UserPrivilegesFactory $userPrivilegesFactory,
42+
private readonly Config $config,
4143
) {
4244
}
4345

@@ -62,6 +64,7 @@ public function __invoke(ServerRequest $request): Response
6264
$this->relation,
6365
$relationCleanup,
6466
new Plugins($this->dbi),
67+
$this->config,
6568
);
6669

6770
$this->response->addHTML('<div class="container-fluid">');

‎src/Server/Privileges.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@ public function __construct(
7676
public Relation $relation,
7777
private RelationCleanup $relationCleanup,
7878
private Plugins $plugins,
79+
private readonly Config $config,
7980
) {
8081
}
8182

@@ -3270,6 +3271,7 @@ public function getFormForChangePassword(
32703271
'has_more_auth_plugins' => $hasMoreAuthPlugins,
32713272
'active_auth_plugins' => $activeAuthPlugins,
32723273
'orig_auth_plugin' => $origAuthPlugin,
3274+
'allow_no_password' => $this->config->selectedServer['AllowNoPassword'],
32733275
]);
32743276
}
32753277

‎tests/unit/Controllers/Server/PrivilegesControllerTest.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@ public function testPrivilegesController(): void
7575
new Relation($this->dbi),
7676
$this->dbi,
7777
new UserPrivilegesFactory($this->dbi),
78+
new Config(),
7879
))($request);
7980

8081
$actual = $response->getHTMLResult();

‎tests/unit/Server/PrivilegesTest.php‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1889,6 +1889,7 @@ public function testGetUserPrivileges(): void
18891889
$relation,
18901890
new RelationCleanup($this->dbi, $relation),
18911891
new Plugins($this->dbi),
1892+
new Config(),
18921893
);
18931894
$method = new ReflectionMethod(Privileges::class, 'getUserPrivileges');
18941895

@@ -1902,7 +1903,14 @@ private function getPrivileges(DatabaseInterface $dbi): Privileges
19021903
{
19031904
$relation = new Relation($dbi);
19041905

1905-
return new Privileges(new Template(), $dbi, $relation, new RelationCleanup($dbi, $relation), new Plugins($dbi));
1906+
return new Privileges(
1907+
new Template(),
1908+
$dbi,
1909+
$relation,
1910+
new RelationCleanup($dbi, $relation),
1911+
new Plugins($dbi),
1912+
new Config(),
1913+
);
19061914
}
19071915

19081916
/**

0 commit comments

Comments
 (0)