FM / classes

/usr/share/phpmyadmin/libraries/classes/

/usr/share/phpmyadmin/libraries/classes

Name	Size	Mode	Actions
Charsets/	-	0755	rm
Command/	-	0755	rm
Config/	-	0755	rm
Controllers/	-	0755	rm
Database/	-	0755	rm
Dbal/	-	0755	rm
Display/	-	0755	rm
Engines/	-	0755	rm
Exceptions/	-	0755	rm
Export/	-	0755	rm
Gis/	-	0755	rm
Html/	-	0755	rm
Import/	-	0755	rm
Navigation/	-	0755	rm
Plugins/	-	0755	rm
Properties/	-	0755	rm
Providers/	-	0755	rm
Query/	-	0755	rm
Server/	-	0755	rm
Setup/	-	0755	rm
Table/	-	0755	rm
Twig/	-	0755	rm
Utils/	-	0755	rm
Advisor.php	12517	0644	edit dl rm
Bookmark.php	10944	0644	edit dl rm
BrowseForeigners.php	11083	0644	edit dl rm
Charsets.php	7267	0644	edit dl rm
CheckUserPrivileges.php	12230	0644	edit dl rm
Config.php	46456	0644	edit dl rm
Console.php	3460	0644	edit dl rm
Core.php	43344	0644	edit dl rm
CreateAddField.php	17993	0644	edit dl rm
DatabaseInterface.php	76802	0644	edit dl rm
DbTableExists.php	3287	0644	edit dl rm
Encoding.php	8715	0644	edit dl rm
Error.php	14304	0644	edit dl rm
ErrorHandler.php	17557	0644	edit dl rm
ErrorReport.php	9364	0644	edit dl rm
Export.php	47351	0644	edit dl rm
File.php	21786	0644	edit dl rm
FileListing.php	2923	0644	edit dl rm
Font.php	5718	0644	edit dl rm
Footer.php	10794	0644	edit dl rm
Git.php	18381	0644	edit dl rm
Header.php	21967	0644	edit dl rm
Import.php	58840	0644	edit dl rm
Index.php	15428	0644	edit dl rm
IndexColumn.php	4331	0644	edit dl rm
InsertEdit.php	133309	0644	edit dl rm
InternalRelations.php	17730	0644	edit dl rm
IpAllowDeny.php	9997	0644	edit dl rm
Language.php	4568	0644	edit dl rm
LanguageManager.php	24532	0644	edit dl rm
Linter.php	5374	0644	edit dl rm
ListAbstract.php	1814	0644	edit dl rm
ListDatabase.php	4402	0644	edit dl rm
Logging.php	2781	0644	edit dl rm
Menu.php	21812	0644	edit dl rm
Message.php	19547	0644	edit dl rm
Mime.php	916	0644	edit dl rm
Normalization.php	42475	0644	edit dl rm
OpenDocument.php	8617	0644	edit dl rm
Operations.php	38748	0644	edit dl rm
OutputBuffering.php	4074	0644	edit dl rm
ParseAnalyze.php	2429	0644	edit dl rm
Partition.php	7340	0644	edit dl rm
Pdf.php	4449	0644	edit dl rm
Plugins.php	25783	0644	edit dl rm
Profiling.php	2317	0644	edit dl rm
RecentFavoriteTable.php	12297	0644	edit dl rm
Relation.php	79247	0644	edit dl rm
RelationCleanup.php	15051	0644	edit dl rm
Replication.php	4843	0644	edit dl rm
ReplicationGui.php	22038	0644	edit dl rm
ReplicationInfo.php	4943	0644	edit dl rm
Response.php	16864	0644	edit dl rm
Routing.php	5845	0644	edit dl rm
Sanitize.php	12418	0644	edit dl rm
SavedSearches.php	12221	0644	edit dl rm
Scripts.php	3726	0644	edit dl rm
Session.php	8198	0644	edit dl rm
Sql.php	68272	0644	edit dl rm
SqlQueryForm.php	7286	0644	edit dl rm
StorageEngine.php	12828	0644	edit dl rm
SubPartition.php	3398	0644	edit dl rm
SystemDatabase.php	3748	0644	edit dl rm
Table.php	97961	0644	edit dl rm
TablePartitionDefinition.php	6664	0644	edit dl rm
Template.php	3962	0644	edit dl rm
Theme.php	8969	0644	edit dl rm
ThemeManager.php	9815	0644	edit dl rm
Tracker.php	30497	0644	edit dl rm
Tracking.php	38141	0644	edit dl rm
Transformations.php	16685	0644	edit dl rm
TwoFactor.php	6968	0644	edit dl rm
Types.php	25805	0644	edit dl rm
Url.php	8973	0644	edit dl rm
UserPassword.php	7284	0644	edit dl rm
UserPreferences.php	8657	0644	edit dl rm
Util.php	104768	0644	edit dl rm
Version.php	533	0644	edit dl rm
VersionInformation.php	7319	0644	edit dl rm
ZipExtension.php	11017	0644	edit dl rm

Edit: /usr/share/phpmyadmin/libraries/classes/Session.php (8198B)

<?php
/**
 * Session handling
 *
 * @see     https://www.php.net/manual/en/features.sessions.php
 */

declare(strict_types=1);

namespace PhpMyAdmin;

use const PHP_SESSION_ACTIVE;
use function defined;
use function function_exists;
use function htmlspecialchars;
use function implode;
use function ini_get;
use function ini_set;
use function preg_replace;
use function session_abort;
use function session_cache_limiter;
use function session_destroy;
use function session_id;
use function session_name;
use function session_regenerate_id;
use function session_save_path;
use function session_set_cookie_params;
use function session_start;
use function session_status;
use function session_unset;
use function session_write_close;
use function setcookie;

/**
 * Session class
 */
class Session
{
    /**
     * Generates PMA_token session variable.
     *
     * @return void
     */
    private static function generateToken()
    {
        $_SESSION[' PMA_token '] = Util::generateRandom(16, true);
        $_SESSION[' HMAC_secret '] = Util::generateRandom(16);

/**
         * Check if token is properly generated (the generation can fail, for example
         * due to missing /dev/random for openssl).
         */
        if (! empty($_SESSION[' PMA_token '])) {
            return;
        }

Core::fatalError(
            'Failed to generate random CSRF token!'
        );
    }

/**
     * tries to secure session from hijacking and fixation
     * should be called before login and after successful login
     * (only required if sensitive information stored in session)
     *
     * @return void
     */
    public static function secure()
    {
        // prevent session fixation and XSS
        if (session_status() === PHP_SESSION_ACTIVE && ! defined('TESTSUITE')) {
            session_regenerate_id(true);
        }
        // continue with empty session
        session_unset();
        self::generateToken();
    }

/**
     * Session failed function
     *
     * @param array $errors PhpMyAdmin\ErrorHandler array
     *
     * @return void
     */
    private static function sessionFailed(array $errors)
    {
        $messages = [];
        foreach ($errors as $error) {
            /*
             * Remove path from open() in error message to avoid path disclossure
             *
             * This can happen with PHP 5 when nonexisting session ID is provided,
             * since PHP 7, session existence is checked first.
             *
             * This error can also happen in case of session backed error (eg.
             * read only filesystem) on any PHP version.
             *
             * The message string is currently hardcoded in PHP, so hopefully it
             * will not change in future.
             */
            $messages[] = preg_replace(
                '/open$.*, O_RDWR$/',
                'open(SESSION_FILE, O_RDWR)',
                htmlspecialchars($error->getMessage())
            );
        }

/*
         * Session initialization is done before selecting language, so we
         * can not use translations here.
         */
        Core::fatalError(
            'Error during session start; please check your PHP and/or '
            . 'webserver log file and configure your PHP '
            . 'installation properly. Also ensure that cookies are enabled '
            . 'in your browser.'
            . '<br><br>'
            . implode('<br><br>', $messages)
        );
    }

/**
     * Set up session
     *
     * @param Config       $config       Configuration handler
     * @param ErrorHandler $errorHandler Error handler
     *
     * @return void
     */
    public static function setUp(Config $config, ErrorHandler $errorHandler)
    {
        // verify if PHP supports session, die if it does not
        if (! function_exists('session_name')) {
            Core::warnMissingExtension('session', true);
        } elseif (! empty(ini_get('session.auto_start'))
            && session_name() !== 'phpMyAdmin'
            && ! empty(session_id())
        ) {
            // Do not delete the existing non empty session, it might be used by
            // other applications; instead just close it.
            if (empty($_SESSION)) {
                // Ignore errors as this might have been destroyed in other
                // request meanwhile
                @session_destroy();
            } elseif (function_exists('session_abort')) {
                // PHP 5.6 and newer
                session_abort();
            } else {
                session_write_close();
            }
        }

// session cookie settings
        session_set_cookie_params(
            0,
            $config->getRootPath(),
            '',
            $config->isHttps(),
            true
        );

// cookies are safer (use ini_set() in case this function is disabled)
        ini_set('session.use_cookies', 'true');

// optionally set session_save_path
        $path = $config->get('SessionSavePath');
        if (! empty($path)) {
            session_save_path($path);
            // We can not do this unconditionally as this would break
            // any more complex setup (eg. cluster), see
            // https://github.com/phpmyadmin/phpmyadmin/issues/8346
            ini_set('session.save_handler', 'files');
        }

// use cookies only
        ini_set('session.use_only_cookies', '1');
        // strict session mode (do not accept random string as session ID)
        ini_set('session.use_strict_mode', '1');
        // make the session cookie HttpOnly
        ini_set('session.cookie_httponly', '1');
        // do not force transparent session ids
        ini_set('session.use_trans_sid', '0');

// delete session/cookies when browser is closed
        ini_set('session.cookie_lifetime', '0');

// some pages (e.g. stylesheet) may be cached on clients, but not in shared
        // proxy servers
        session_cache_limiter('private');

$httpCookieName = $config->getCookieName('phpMyAdmin');
        @session_name($httpCookieName);

// Restore correct session ID (it might have been reset by auto started session
        if ($config->issetCookie('phpMyAdmin')) {
            session_id($config->getCookie('phpMyAdmin'));
        }

// on first start of session we check for errors
        // f.e. session dir cannot be accessed - session file not created
        $orig_error_count = $errorHandler->countErrors(false);

$session_result = session_start();

if ($session_result !== true
            || $orig_error_count != $errorHandler->countErrors(false)
        ) {
            setcookie($httpCookieName, '', 1);
            $errors = $errorHandler->sliceErrors($orig_error_count);
            self::sessionFailed($errors);
        }
        unset($orig_error_count, $session_result);

/**
         * Disable setting of session cookies for further session_start() calls.
         */
        if (session_status() !== PHP_SESSION_ACTIVE) {
            ini_set('session.use_cookies', 'true');
        }

/**
         * Token which is used for authenticating access queries.
         * (we use "space PMA_token space" to prevent overwriting)
         */
        if (! empty($_SESSION[' PMA_token '])) {
            return;
        }

self::generateToken();

/**
         * Check for disk space on session storage by trying to write it.
         *
         * This seems to be most reliable approach to test if sessions are working,
         * otherwise the check would fail with custom session backends.
         */
        $orig_error_count = $errorHandler->countErrors();
        session_write_close();
        if ($errorHandler->countErrors() > $orig_error_count) {
            $errors = $errorHandler->sliceErrors($orig_error_count);
            self::sessionFailed($errors);
        }
        session_start();
        if (! empty($_SESSION[' PMA_token '])) {
            return;
        }

Core::fatalError(
            'Failed to store CSRF token in session! ' .
            'Probably sessions are not working properly.'
        );
    }
}

cmd: