beenull/adminerevo
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

Save bytes

Browse source
This commit is contained in:
Jakub Vrana 2013-08-10 19:11:35 -07:00
parent c0fe3a6ff7
commit 1bdb65c4dc
1 changed files with 15 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
adminer/include/auth.inc.php
View file

@ -17,21 +17,26 @@ if ($_COOKIE["adminer_permanent"]) {
$auth = $_POST["auth"]; $auth = $_POST["auth"];
if ($auth) { if ($auth) {
session_regenerate_id(); // defense against session fixation session_regenerate_id(); // defense against session fixation
set_password($auth["driver"], $auth["server"], $auth["username"], $auth["password"]); $driver = $auth["driver"];
$_SESSION["db"][$auth["driver"]][$auth["server"]][$auth["username"]][$auth["db"]] = true; $server = $auth["server"];
if ($auth["permanent"]) { $username = $auth["username"];
$key = base64_encode($auth["driver"]) . "-" . base64_encode($auth["server"]) . "-" . base64_encode($auth["username"]) . "-" . base64_encode($auth["db"]); $password = $auth["password"];
$db = $auth["db"];
set_password($driver, $server, $username, $password);
$_SESSION["db"][$driver][$server][$username][$db] = true;
if ($permanent) {
$key = base64_encode($driver) . "-" . base64_encode($server) . "-" . base64_encode($username) . "-" . base64_encode($db);
$private = $adminer->permanentLogin(true); $private = $adminer->permanentLogin(true);
$permanent[$key] = "$key:" . base64_encode($private ? encrypt_string($auth["password"], $private) : ""); $permanent[$key] = "$key:" . base64_encode($private ? encrypt_string($password, $private) : "");
cookie("adminer_permanent", implode(" ", $permanent)); cookie("adminer_permanent", implode(" ", $permanent));
} }
if (count($_POST) == 1 // 1 - auth if (count($_POST) == 1 // 1 - auth
|| DRIVER != $auth["driver"] || DRIVER != $driver
|| SERVER != $auth["server"] || SERVER != $server
|| $_GET["username"] !== $auth["username"] // "0" == "00" || $_GET["username"] !== $username // "0" == "00"
|| DB != $auth["db"] || DB != $db
) { ) {
redirect(auth_url($auth["driver"], $auth["server"], $auth["username"], $auth["db"])); redirect(auth_url($driver, $server, $username, $db));
} }
} elseif ($_POST["logout"]) { } elseif ($_POST["logout"]) {