Skip to content

Commit 86eeab5

Browse files
MauricioFauthMauricioFauth
authored
Merge pull request #20135 from kamil-tekiela/Session-getToken
Create a oneliner Session::getToken() Fixes #20112
2 parents aa1dd0d + 520c016 commit 86eeab5

File tree

8 files changed

+27
-32
lines changed

8 files changed

+27
-32
lines changed

‎phpstan-baseline.neon‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -6990,12 +6990,6 @@ parameters:
69906990
count: 1
69916991
path: src/Http/Middleware/StatementHistory.php
69926992

6993-
-
6994-
message: '#^Parameter \#1 \$known_string of function hash_equals expects string, mixed given\.$#'
6995-
identifier: argument.type
6996-
count: 1
6997-
path: src/Http/Middleware/TokenRequestParamChecking.php
6998-
69996993
-
70006994
message: '#^Method PhpMyAdmin\\Http\\ServerRequest\:\:getAttributes\(\) return type has no value type specified in iterable type array\.$#'
70016995
identifier: missingType.iterableValue
@@ -11619,12 +11613,6 @@ parameters:
1161911613
count: 1
1162011614
path: src/Server/SysInfo/WindowsNt.php
1162111615

11622-
-
11623-
message: '#^Construct empty\(\) is not allowed\. Use more strict comparison\.$#'
11624-
identifier: empty.notAllowed
11625-
count: 3
11626-
path: src/Session.php
11627-
1162811616
-
1162911617
message: '#^Only booleans are allowed in &&, string\|false given on the left side\.$#'
1163011618
identifier: booleanAnd.leftNotBoolean

‎psalm-baseline.xml‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4897,11 +4897,6 @@
48974897
<code><![CDATA[Current::$sqlQuery]]></code>
48984898
</MixedArgument>
48994899
</file>
4900-
<file src="src/Http/Middleware/TokenRequestParamChecking.php">
4901-
<MixedArgument>
4902-
<code><![CDATA[$_SESSION[' PMA_token ']]]></code>
4903-
</MixedArgument>
4904-
</file>
49054900
<file src="src/Http/Middleware/UriSchemeUpdating.php">
49064901
<PossiblyUnusedMethod>
49074902
<code><![CDATA[__construct]]></code>
@@ -8466,7 +8461,6 @@
84668461
<code><![CDATA[$params['server']]]></code>
84678462
<code><![CDATA[$params['server']]]></code>
84688463
<code><![CDATA[$value]]></code>
8469-
<code><![CDATA[$values['token']]]></code>
84708464
</MixedAssignment>
84718465
</file>
84728466
<file src="src/UserPassword.php">

‎src/Controllers/Setup/HomeController.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
use PhpMyAdmin\Http\ServerRequest;
1515
use PhpMyAdmin\I18n\LanguageManager;
1616
use PhpMyAdmin\ResponseRenderer;
17+
use PhpMyAdmin\Session;
1718
use PhpMyAdmin\Setup\Index;
1819
use PhpMyAdmin\Setup\SetupHelper;
1920
use PhpMyAdmin\Template;
@@ -104,7 +105,7 @@ public function __invoke(ServerRequest $request): Response
104105
'auth_type' => $configFile->getValue('Servers/' . $id . '/auth_type'),
105106
'dsn' => $configFile->getServerDSN($id),
106107
'params' => [
107-
'token' => $_SESSION[' PMA_token '],
108+
'token' => Session::getToken(),
108109
'edit' => ['page' => 'servers', 'mode' => 'edit', 'id' => $id],
109110
'remove' => ['page' => 'servers', 'mode' => 'remove', 'id' => $id],
110111
],

‎src/Header.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ public function getJsParams(): array
122122
'server' => Current::$server,
123123
'table' => Current::$table,
124124
'db' => Current::$database,
125-
'token' => $_SESSION[' PMA_token '],
125+
'token' => Session::getToken(),
126126
'text_dir' => LanguageManager::$textDirection->value,
127127
'LimitChars' => $this->config->config->limitChars,
128128
'pftext' => $pftext,

‎src/Http/Middleware/TokenRequestParamChecking.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
use PhpMyAdmin\Http\ServerRequest;
99
use PhpMyAdmin\Message;
1010
use PhpMyAdmin\ResponseRenderer;
11+
use PhpMyAdmin\Session;
1112
use Psr\Http\Message\ResponseInterface;
1213
use Psr\Http\Message\ServerRequestInterface;
1314
use Psr\Http\Server\MiddlewareInterface;
@@ -49,7 +50,7 @@ public function process(ServerRequestInterface $request, RequestHandlerInterface
4950
public function checkTokenRequestParam(ServerRequest $request): ResponseInterface|null
5051
{
5152
$token = $request->getParsedBodyParamAsString('token', '');
52-
if ($token !== '' && hash_equals($_SESSION[' PMA_token '], $token)) {
53+
if ($token !== '' && hash_equals(Session::getToken(), $token)) {
5354
return null;
5455
}
5556

‎src/Plugins/Auth/AuthenticationCookie.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ public function showLoginForm(): Response
8888
*/
8989
if ($sessionExpired) {
9090
$this->responseRenderer->setRequestStatus(false);
91-
$this->responseRenderer->addJSON('new_token', $_SESSION[' PMA_token ']);
91+
$this->responseRenderer->addJSON('new_token', Session::getToken());
9292
}
9393

9494
/**
@@ -453,7 +453,7 @@ public function rememberCredentials(): Response|null
453453
if (isset($_REQUEST['session_timedout'])) {
454454
$this->responseRenderer->addJSON('logged_in', 1);
455455
$this->responseRenderer->addJSON('success', 1);
456-
$this->responseRenderer->addJSON('new_token', $_SESSION[' PMA_token ']);
456+
$this->responseRenderer->addJSON('new_token', Session::getToken());
457457

458458
return $this->responseRenderer->response();
459459
}

‎src/Session.php‎

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
use function implode;
1313
use function ini_get;
1414
use function ini_set;
15+
use function is_string;
1516
use function preg_replace;
1617
use function session_abort;
1718
use function session_cache_limiter;
@@ -38,20 +39,33 @@ class Session
3839
*/
3940
private static function generateToken(): void
4041
{
42+
/**
43+
* Token which is used for authenticating access queries.
44+
* (we use "space PMA_token space" to prevent overwriting)
45+
*/
4146
$_SESSION[' PMA_token '] = Util::generateRandom(16, true);
4247
$_SESSION[' HMAC_secret '] = Util::generateRandom(16);
4348

4449
/**
4550
* Check if token is properly generated (the generation can fail, for example
4651
* due to missing /dev/random for openssl).
4752
*/
48-
if (! empty($_SESSION[' PMA_token '])) {
53+
if (self::getToken() !== '') {
4954
return;
5055
}
5156

5257
throw new SessionHandlerException('Failed to generate random CSRF token!');
5358
}
5459

60+
public static function getToken(): string
61+
{
62+
if (isset($_SESSION[' PMA_token ']) && is_string($_SESSION[' PMA_token '])) {
63+
return $_SESSION[' PMA_token '];
64+
}
65+
66+
return '';
67+
}
68+
5569
/**
5670
* tries to secure session from hijacking and fixation
5771
* should be called before login and after successful login
@@ -192,11 +206,7 @@ public static function setUp(Config $config, ErrorHandler $errorHandler): void
192206
self::sessionFailed($errors);
193207
}
194208

195-
/**
196-
* Token which is used for authenticating access queries.
197-
* (we use "space PMA_token space" to prevent overwriting)
198-
*/
199-
if (! empty($_SESSION[' PMA_token '])) {
209+
if (self::getToken() !== '') {
200210
return;
201211
}
202212

@@ -219,7 +229,7 @@ public static function setUp(Config $config, ErrorHandler $errorHandler): void
219229
// A third cookie will be sent by session_regenerate_id() which will override these two
220230
session_start();
221231

222-
if (! empty($_SESSION[' PMA_token '])) {
232+
if (self::getToken() !== '') {
223233
return;
224234
}
225235

‎src/Url.php‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -124,8 +124,9 @@ public static function getHiddenFields(array $values, string $pre = '', bool $is
124124
$fields = '';
125125

126126
/* Always include token in plain forms */
127-
if ($isToken === false && isset($_SESSION[' PMA_token '])) {
128-
$values['token'] = $_SESSION[' PMA_token '];
127+
$token = Session::getToken();
128+
if ($isToken === false && $token !== '') {
129+
$values['token'] = $token;
129130
}
130131

131132
foreach ($values as $name => $value) {

0 commit comments

Comments
 (0)