Gecko [ unitednationsplay.com ]

Name	Size	Permission	Date
Charsets	[ DIR ]	drwxr-xr-x	2020-10-15 12:07
Config	[ DIR ]	drwxr-xr-x	2020-10-15 12:07
Controllers	[ DIR ]	drwxr-xr-x	2020-10-15 12:07
Database	[ DIR ]	drwxr-xr-x	2020-10-15 12:07
Dbi	[ DIR ]	drwxr-xr-x	2020-10-15 12:07
Di	[ DIR ]	drwxr-xr-x	2020-10-15 12:07
Display	[ DIR ]	drwxr-xr-x	2020-10-15 12:07
Engines	[ DIR ]	drwxr-xr-x	2020-10-15 12:07
Gis	[ DIR ]	drwxr-xr-x	2020-10-15 12:07
Navigation	[ DIR ]	drwxr-xr-x	2020-10-15 12:07
Plugins	[ DIR ]	drwxr-xr-x	2020-10-15 12:07
Properties	[ DIR ]	drwxr-xr-x	2020-10-15 12:07
Rte	[ DIR ]	drwxr-xr-x	2020-10-15 12:07
Server	[ DIR ]	drwxr-xr-x	2020-10-15 12:07
Setup	[ DIR ]	drwxr-xr-x	2020-10-15 12:07
Twig	[ DIR ]	drwxr-xr-x	2020-10-15 12:07
Utils	[ DIR ]	drwxr-xr-x	2020-10-15 12:07
Advisor.php	19.56 KB	-rw-r--r--	2021-02-05 18:26
Bookmark.php	10.74 KB	-rw-r--r--	2021-02-05 18:26
BrowseForeigners.php	11.15 KB	-rw-r--r--	2021-02-05 18:26
CentralColumns.php	44.19 KB	-rw-r--r--	2021-02-05 18:26
Charsets.php	6.14 KB	-rw-r--r--	2021-02-05 18:26
CheckUserPrivileges.php	12.59 KB	-rw-r--r--	2021-02-05 18:26
Config.php	57.38 KB	-rw-r--r--	2021-02-05 18:26
Console.php	3.69 KB	-rw-r--r--	2021-02-05 18:26
Core.php	38.31 KB	-rw-r--r--	2021-02-05 18:26
CreateAddField.php	17.91 KB	-rw-r--r--	2021-02-05 18:26
DatabaseInterface.php	104.47 KB	-rw-r--r--	2021-02-05 18:26
Encoding.php	8.68 KB	-rw-r--r--	2021-02-05 18:26
Error.php	13.34 KB	-rw-r--r--	2021-02-05 18:26
ErrorHandler.php	17.17 KB	-rw-r--r--	2021-02-05 18:26
ErrorReport.php	8.92 KB	-rw-r--r--	2021-02-05 18:26
Export.php	42.76 KB	-rw-r--r--	2021-02-05 18:26
File.php	21.29 KB	-rw-r--r--	2021-02-05 18:26
FileListing.php	2.83 KB	-rw-r--r--	2021-02-05 18:26
Font.php	5.54 KB	-rw-r--r--	2021-02-05 18:26
Footer.php	10.6 KB	-rw-r--r--	2021-02-05 18:26
Header.php	21.87 KB	-rw-r--r--	2021-02-05 18:26
Import.php	56.56 KB	-rw-r--r--	2021-02-05 18:26
Index.php	24.5 KB	-rw-r--r--	2021-02-05 18:26
IndexColumn.php	4.44 KB	-rw-r--r--	2021-02-05 18:26
InsertEdit.php	129.31 KB	-rw-r--r--	2021-02-05 18:26
InternalRelations.php	17.42 KB	-rw-r--r--	2021-02-05 18:26
IpAllowDeny.php	9.57 KB	-rw-r--r--	2021-02-05 18:26
Language.php	4.31 KB	-rw-r--r--	2021-02-05 18:26
LanguageManager.php	23.71 KB	-rw-r--r--	2021-02-05 18:26
Linter.php	5.21 KB	-rw-r--r--	2021-02-05 18:26
ListAbstract.php	2.51 KB	-rw-r--r--	2021-02-05 18:26
ListDatabase.php	4.34 KB	-rw-r--r--	2021-02-05 18:26
Logging.php	2.6 KB	-rw-r--r--	2021-02-05 18:26
Menu.php	22.36 KB	-rw-r--r--	2021-02-05 18:26
Message.php	19.32 KB	-rw-r--r--	2021-02-05 18:26
Mime.php	916 B	-rw-r--r--	2021-02-05 18:26
MultSubmits.php	23.64 KB	-rw-r--r--	2021-02-05 18:26
Normalization.php	40.41 KB	-rw-r--r--	2021-02-05 18:26
OpenDocument.php	8.52 KB	-rw-r--r--	2021-02-05 18:26
Operations.php	81.25 KB	-rw-r--r--	2021-02-05 18:26
OutputBuffering.php	3.71 KB	-rw-r--r--	2021-02-05 18:26
ParseAnalyze.php	2.55 KB	-rw-r--r--	2021-02-05 18:26
Partition.php	7.27 KB	-rw-r--r--	2021-02-05 18:26
Pdf.php	4.37 KB	-rw-r--r--	2021-02-05 18:26
Plugins.php	22.95 KB	-rw-r--r--	2021-02-05 18:27
RecentFavoriteTable.php	12.04 KB	-rw-r--r--	2021-02-05 18:27
Relation.php	79.64 KB	-rw-r--r--	2021-02-05 18:27
RelationCleanup.php	15 KB	-rw-r--r--	2021-02-05 18:27
Replication.php	5.75 KB	-rw-r--r--	2021-02-05 18:27
ReplicationGui.php	21.23 KB	-rw-r--r--	2021-02-05 18:27
Response.php	16.14 KB	-rw-r--r--	2021-02-05 18:27
Sanitize.php	14.51 KB	-rw-r--r--	2021-02-05 18:27
SavedSearches.php	11.94 KB	-rw-r--r--	2021-02-05 18:27
Scripts.php	3.65 KB	-rw-r--r--	2021-02-05 18:27
Session.php	7.62 KB	-rw-r--r--	2021-02-05 18:27
Sql.php	82.09 KB	-rw-r--r--	2021-02-05 18:27
SqlQueryForm.php	17.63 KB	-rw-r--r--	2021-02-05 18:27
StorageEngine.php	13.75 KB	-rw-r--r--	2021-02-05 18:27
SubPartition.php	3.55 KB	-rw-r--r--	2021-02-05 18:27
SysInfo.php	1.61 KB	-rw-r--r--	2021-02-05 18:27
SysInfoBase.php	822 B	-rw-r--r--	2021-02-05 18:27
SysInfoLinux.php	2.16 KB	-rw-r--r--	2021-02-05 18:27
SysInfoSunOS.php	1.89 KB	-rw-r--r--	2021-02-05 18:27
SysInfoWINNT.php	3.27 KB	-rw-r--r--	2021-02-05 18:27
SystemDatabase.php	3.97 KB	-rw-r--r--	2021-02-05 18:27
Table.php	94.87 KB	-rw-r--r--	2021-02-05 18:27
TablePartitionDefinition.php	6.64 KB	-rw-r--r--	2021-02-05 18:27
Template.php	4.02 KB	-rw-r--r--	2021-02-05 18:27
Theme.php	8.62 KB	-rw-r--r--	2021-02-05 18:27
ThemeManager.php	10.42 KB	-rw-r--r--	2021-02-05 18:27
Tracker.php	30.13 KB	-rw-r--r--	2021-02-05 18:27
Tracking.php	40.26 KB	-rw-r--r--	2021-02-05 18:27
Transformations.php	16.27 KB	-rw-r--r--	2021-02-05 18:27
TwoFactor.php	7.14 KB	-rw-r--r--	2021-02-05 18:27
Types.php	24.93 KB	-rw-r--r--	2021-02-05 18:27
Url.php	8.32 KB	-rw-r--r--	2021-02-05 18:27
UserPassword.php	9 KB	-rw-r--r--	2021-02-05 18:27
UserPreferences.php	8.62 KB	-rw-r--r--	2021-02-05 18:27
UserPreferencesHeader.php	4.13 KB	-rw-r--r--	2021-02-05 18:27
Util.php	168.02 KB	-rw-r--r--	2021-02-05 18:27
VersionInformation.php	6.92 KB	-rw-r--r--	2021-02-05 18:27
ZipExtension.php	10.25 KB	-rw-r--r--	2021-02-05 18:27

Rename

<?php
/* vim: set expandtab sw=4 ts=4 sts=4: */
/**
 * Session handling
 *
 * @package PhpMyAdmin
 *
 * @see     https://www.php.net/manual/en/features.sessions.php
 */
declare(strict_types=1);

namespace PhpMyAdmin;

use PhpMyAdmin\Config;
use PhpMyAdmin\Core;
use PhpMyAdmin\ErrorHandler;
use PhpMyAdmin\Util;

/**
 * Session class
 *
 * @package PhpMyAdmin
 */
class Session
{
    /**
     * Generates PMA_token session variable.
     *
     * @return void
     */
    private static function generateToken()
    {
        $_SESSION[' PMA_token '] = Util::generateRandom(16, true);
        $_SESSION[' HMAC_secret '] = Util::generateRandom(16);

/**
         * Check if token is properly generated (the generation can fail, for example
         * due to missing /dev/random for openssl).
         */
        if (empty($_SESSION[' PMA_token '])) {
            Core::fatalError(
                'Failed to generate random CSRF token!'
            );
        }
    }

/**
     * tries to secure session from hijacking and fixation
     * should be called before login and after successful login
     * (only required if sensitive information stored in session)
     *
     * @return void
     */
    public static function secure()
    {
        // prevent session fixation and XSS
        if (session_status() === PHP_SESSION_ACTIVE && ! defined('TESTSUITE')) {
            session_regenerate_id(true);
        }
        // continue with empty session
        session_unset();
        self::generateToken();
    }

/**
     * Session failed function
     *
     * @param array $errors PhpMyAdmin\ErrorHandler array
     *
     * @return void
     */
    private static function sessionFailed(array $errors)
    {
        $messages = [];
        foreach ($errors as $error) {
            /*
             * Remove path from open() in error message to avoid path disclossure
             *
             * This can happen with PHP 5 when nonexisting session ID is provided,
             * since PHP 7, session existence is checked first.
             *
             * This error can also happen in case of session backed error (eg.
             * read only filesystem) on any PHP version.
             *
             * The message string is currently hardcoded in PHP, so hopefully it
             * will not change in future.
             */
            $messages[] = preg_replace(
                '/open$.*, O_RDWR$/',
                'open(SESSION_FILE, O_RDWR)',
                htmlspecialchars($error->getMessage())
            );
        }

/*
         * Session initialization is done before selecting language, so we
         * can not use translations here.
         */
        Core::fatalError(
            'Error during session start; please check your PHP and/or '
            . 'webserver log file and configure your PHP '
            . 'installation properly. Also ensure that cookies are enabled '
            . 'in your browser.'
            . '<br><br>'
            . implode('<br><br>', $messages)
        );
    }

/**
     * Set up session
     *
     * @param Config       $config       Configuration handler
     * @param ErrorHandler $errorHandler Error handler
     * @return void
     */
    public static function setUp(Config $config, ErrorHandler $errorHandler)
    {
        // verify if PHP supports session, die if it does not
        if (! function_exists('session_name')) {
            Core::warnMissingExtension('session', true);
        } elseif (! empty(ini_get('session.auto_start'))
            && session_name() != 'phpMyAdmin'
            && ! empty(session_id())) {
            // Do not delete the existing non empty session, it might be used by
            // other applications; instead just close it.
            if (empty($_SESSION)) {
                // Ignore errors as this might have been destroyed in other
                // request meanwhile
                @session_destroy();
            } elseif (function_exists('session_abort')) {
                // PHP 5.6 and newer
                session_abort();
            } else {
                session_write_close();
            }
        }

// session cookie settings
        session_set_cookie_params(
            0,
            $config->getRootPath(),
            '',
            $config->isHttps(),
            true
        );

// cookies are safer (use ini_set() in case this function is disabled)
        ini_set('session.use_cookies', 'true');

// optionally set session_save_path
        $path = $config->get('SessionSavePath');
        if (! empty($path)) {
            session_save_path($path);
            // We can not do this unconditionally as this would break
            // any more complex setup (eg. cluster), see
            // https://github.com/phpmyadmin/phpmyadmin/issues/8346
            ini_set('session.save_handler', 'files');
        }

// use cookies only
        ini_set('session.use_only_cookies', '1');
        // strict session mode (do not accept random string as session ID)
        ini_set('session.use_strict_mode', '1');
        // make the session cookie HttpOnly
        ini_set('session.cookie_httponly', '1');
        // do not force transparent session ids
        ini_set('session.use_trans_sid', '0');

// delete session/cookies when browser is closed
        ini_set('session.cookie_lifetime', '0');

// some pages (e.g. stylesheet) may be cached on clients, but not in shared
        // proxy servers
        session_cache_limiter('private');

$httpCookieName = $config->getCookieName('phpMyAdmin');
        @session_name($httpCookieName);

// Restore correct sesion ID (it might have been reset by auto started session
        if ($config->issetCookie('phpMyAdmin')) {
            session_id($config->getCookie('phpMyAdmin'));
        }

// on first start of session we check for errors
        // f.e. session dir cannot be accessed - session file not created
        $orig_error_count = $errorHandler->countErrors(false);

$session_result = session_start();

if ($session_result !== true
            || $orig_error_count != $errorHandler->countErrors(false)
        ) {
            setcookie($httpCookieName, '', 1);
            $errors = $errorHandler->sliceErrors($orig_error_count);
            self::sessionFailed($errors);
        }
        unset($orig_error_count, $session_result);

/**
         * Disable setting of session cookies for further session_start() calls.
         */
        if (session_status() !== PHP_SESSION_ACTIVE) {
            ini_set('session.use_cookies', 'true');
        }

/**
         * Token which is used for authenticating access queries.
         * (we use "space PMA_token space" to prevent overwriting)
         */
        if (empty($_SESSION[' PMA_token '])) {
            self::generateToken();

/**
             * Check for disk space on session storage by trying to write it.
             *
             * This seems to be most reliable approach to test if sessions are working,
             * otherwise the check would fail with custom session backends.
             */
            $orig_error_count = $errorHandler->countErrors();
            session_write_close();
            if ($errorHandler->countErrors() > $orig_error_count) {
                $errors = $errorHandler->sliceErrors($orig_error_count);
                self::sessionFailed($errors);
            }
            session_start();
            if (empty($_SESSION[' PMA_token '])) {
                Core::fatalError(
                    'Failed to store CSRF token in session! ' .
                    'Probably sessions are not working properly.'
                );
            }
        }
    }
}