Gecko [ 35.178.45.201 ]

Name	Size	Permission
Advisory	[ DIR ]	drwxr-xr-x
Bookmarks	[ DIR ]	drwxr-xr-x
Charsets	[ DIR ]	drwxr-xr-x
Command	[ DIR ]	drwxr-xr-x
Config	[ DIR ]	drwxr-xr-x
ConfigStorage	[ DIR ]	drwxr-xr-x
Container	[ DIR ]	drwxr-xr-x
Controllers	[ DIR ]	drwxr-xr-x
Crypto	[ DIR ]	drwxr-xr-x
Database	[ DIR ]	drwxr-xr-x
Dbal	[ DIR ]	drwxr-xr-x
Display	[ DIR ]	drwxr-xr-x
Engines	[ DIR ]	drwxr-xr-x
Error	[ DIR ]	drwxr-xr-x
Exceptions	[ DIR ]	drwxr-xr-x
Export	[ DIR ]	drwxr-xr-x
Favorites	[ DIR ]	drwxr-xr-x
Gis	[ DIR ]	drwxr-xr-x
Html	[ DIR ]	drwxr-xr-x
Http	[ DIR ]	drwxr-xr-x
Identifiers	[ DIR ]	drwxr-xr-x
Image	[ DIR ]	drwxr-xr-x
Import	[ DIR ]	drwxr-xr-x
Navigation	[ DIR ]	drwxr-xr-x
Partitioning	[ DIR ]	drwxr-xr-x
Plugins	[ DIR ]	drwxr-xr-x
Properties	[ DIR ]	drwxr-xr-x
Providers	[ DIR ]	drwxr-xr-x
Query	[ DIR ]	drwxr-xr-x
Replication	[ DIR ]	drwxr-xr-x
Routing	[ DIR ]	drwxr-xr-x
Server	[ DIR ]	drwxr-xr-x
Setup	[ DIR ]	drwxr-xr-x
Table	[ DIR ]	drwxr-xr-x
Theme	[ DIR ]	drwxr-xr-x
Tracking	[ DIR ]	drwxr-xr-x
Triggers	[ DIR ]	drwxr-xr-x
Twig	[ DIR ]	drwxr-xr-x
Utils	[ DIR ]	drwxr-xr-x
WebAuthn	[ DIR ]	drwxr-xr-x
Application.php	6.31 KB	-rw-r--r--
BrowseForeigners.php	10.24 KB	-rw-r--r--
Cache.php	1.44 KB	-rw-r--r--
Charsets.php	7.08 KB	-rw-r--r--
Column.php	363 B	-rw-r--r--
ColumnFull.php	500 B	-rw-r--r--
Config.php	38.1 KB	-rw-r--r--
Console.php	3.14 KB	-rw-r--r--
Core.php	22.22 KB	-rw-r--r--
CreateAddField.php	14.6 KB	-rw-r--r--
Current.php	228 B	-rw-r--r--
DatabaseInterface.php	66.01 KB	-rw-r--r--
DbTableExists.php	1.4 KB	-rw-r--r--
EditField.php	495 B	-rw-r--r--
Encoding.php	7.97 KB	-rw-r--r--
FieldMetadata.php	10.64 KB	-rw-r--r--
File.php	19.72 KB	-rw-r--r--
FileListing.php	3.04 KB	-rw-r--r--
FlashMessages.php	1.23 KB	-rw-r--r--
Font.php	4.26 KB	-rw-r--r--
Footer.php	6.82 KB	-rw-r--r--
Git.php	18.5 KB	-rw-r--r--
Header.php	19.81 KB	-rw-r--r--
Index.php	14.45 KB	-rw-r--r--
IndexColumn.php	4.7 KB	-rw-r--r--
InsertEdit.php	73.25 KB	-rw-r--r--
InsertEditColumn.php	1.96 KB	-rw-r--r--
InternalRelations.php	17 KB	-rw-r--r--
IpAllowDeny.php	9 KB	-rw-r--r--
Language.php	4.12 KB	-rw-r--r--
LanguageManager.php	22.27 KB	-rw-r--r--
Linter.php	4.89 KB	-rw-r--r--
ListDatabase.php	4.93 KB	-rw-r--r--
Logging.php	2.79 KB	-rw-r--r--
Menu.php	19.9 KB	-rw-r--r--
Message.php	14.58 KB	-rw-r--r--
Mime.php	893 B	-rw-r--r--
Normalization.php	39.54 KB	-rw-r--r--
OpenDocument.php	8.78 KB	-rw-r--r--
Operations.php	34.63 KB	-rw-r--r--
ParseAnalyze.php	2.23 KB	-rw-r--r--
Pdf.php	3.89 KB	-rw-r--r--
Plugins.php	22.28 KB	-rw-r--r--
Profiling.php	2.17 KB	-rw-r--r--
Release.php	298 B	-rw-r--r--
ResponseRenderer.php	13.03 KB	-rw-r--r--
Sanitize.php	8.62 KB	-rw-r--r--
Scripts.php	3.7 KB	-rw-r--r--
Session.php	7.88 KB	-rw-r--r--
ShowGrants.php	2.06 KB	-rw-r--r--
Sql.php	60.06 KB	-rw-r--r--
SqlQueryForm.php	6.93 KB	-rw-r--r--
StorageEngine.php	15.08 KB	-rw-r--r--
SystemColumn.php	267 B	-rw-r--r--
SystemDatabase.php	4.62 KB	-rw-r--r--
Template.php	3.98 KB	-rw-r--r--
Transformations.php	17.2 KB	-rw-r--r--
TwoFactor.php	7.61 KB	-rw-r--r--
Types.php	23.88 KB	-rw-r--r--
UniqueCondition.php	8.26 KB	-rw-r--r--
Url.php	10.54 KB	-rw-r--r--
UrlRedirector.php	1.43 KB	-rw-r--r--
UserPassword.php	8.25 KB	-rw-r--r--
UserPreferences.php	10.22 KB	-rw-r--r--
UserPrivileges.php	520 B	-rw-r--r--
UserPrivilegesFactory.php	8.61 KB	-rw-r--r--
Util.php	68.74 KB	-rw-r--r--
Version.php	554 B	-rw-r--r--
VersionInformation.php	7.18 KB	-rw-r--r--
ZipExtension.php	10.01 KB	-rw-r--r--

Code Editor : Session.php

<?php

declare(strict_types=1);

namespace PhpMyAdmin;

use PhpMyAdmin\Error\ErrorHandler;
use PhpMyAdmin\Exceptions\SessionHandlerException;

use function htmlspecialchars;
use function implode;
use function ini_get;
use function ini_set;
use function preg_replace;
use function session_abort;
use function session_cache_limiter;
use function session_destroy;
use function session_id;
use function session_name;
use function session_regenerate_id;
use function session_save_path;
use function session_set_cookie_params;
use function session_start;
use function session_status;
use function session_unset;
use function session_write_close;
use function setcookie;

use const PHP_SESSION_ACTIVE;

class Session
{
    /**
     * Generates PMA_token session variable.
     *
     * @throws SessionHandlerException
     */
    private static function generateToken(): void
    {
        $_SESSION[' PMA_token '] = Util::generateRandom(16, true);
        $_SESSION[' HMAC_secret '] = Util::generateRandom(16);

/**
         * Check if token is properly generated (the generation can fail, for example
         * due to missing /dev/random for openssl).
         */
        if (! empty($_SESSION[' PMA_token '])) {
            return;
        }

throw new SessionHandlerException('Failed to generate random CSRF token!');
    }

/**
     * tries to secure session from hijacking and fixation
     * should be called before login and after successful login
     * (only required if sensitive information stored in session)
     *
     * @throws SessionHandlerException
     */
    public static function secure(): void
    {
        // prevent session fixation and XSS
        if (session_status() === PHP_SESSION_ACTIVE) {
            session_regenerate_id(true);
        }

// continue with empty session
        session_unset();
        self::generateToken();
    }

/**
     * Session failed function
     *
     * @param mixed[] $errors PhpMyAdmin\Error\ErrorHandler array
     *
     * @throws SessionHandlerException
     */
    private static function sessionFailed(array $errors): void
    {
        $messages = [];
        foreach ($errors as $error) {
            /**
             * Remove path from open() in error message to avoid path disclossure
             *
             * This can happen with PHP 5 when nonexisting session ID is provided,
             * since PHP 7, session existence is checked first.
             *
             * This error can also happen in case of session backed error (eg.
             * read only filesystem) on any PHP version.
             *
             * The message string is currently hardcoded in PHP, so hopefully it
             * will not change in future.
             */
            $messages[] = preg_replace(
                '/open$.*, O_RDWR$/',
                'open(SESSION_FILE, O_RDWR)',
                htmlspecialchars($error->getMessage()),
            );
        }

// Session initialization is done before selecting language, so we can not use translations here.
        $errorMessage = 'Error during session start; please check your PHP and/or '
            . 'webserver log file and configure your PHP '
            . 'installation properly. Also ensure that cookies are enabled '
            . 'in your browser.'
            . '<br><br>'
            . implode('<br><br>', $messages);

throw new SessionHandlerException($errorMessage);
    }

/** @throws SessionHandlerException */
    public static function setUp(Config $config, ErrorHandler $errorHandler): void
    {
        if (! empty(ini_get('session.auto_start')) && session_name() !== 'phpMyAdmin' && ! empty(session_id())) {
            // Do not delete the existing non empty session, it might be used by
            // other applications; instead just close it.
            if ($_SESSION === []) {
                // Ignore errors as this might have been destroyed in other
                // request meanwhile
                @session_destroy();
            } else {
                // do not use session_write_close, see issue #13392
                session_abort();
            }
        }

/** @psalm-var 'Lax'|'Strict'|'None' $cookieSameSite */
        $cookieSameSite = $config->get('CookieSameSite') ?? 'Strict';
        $cookiePath = $config->getRootPath();

session_set_cookie_params([
            'lifetime' => 0,
            'path' => $cookiePath,
            'domain' => '',
            'secure' => $config->isHttps(),
            'httponly' => true,
            'samesite' => $cookieSameSite,
        ]);

// cookies are safer (use ini_set() in case this function is disabled)
        ini_set('session.use_cookies', 'true');

// optionally set session_save_path
        $path = $config->get('SessionSavePath');
        if (! empty($path)) {
            session_save_path($path);
            // We can not do this unconditionally as this would break
            // any more complex setup (eg. cluster), see
            // https://github.com/phpmyadmin/phpmyadmin/issues/8346
            ini_set('session.save_handler', 'files');
        }

// use cookies only
        ini_set('session.use_only_cookies', '1');
        // strict session mode (do not accept random string as session ID)
        ini_set('session.use_strict_mode', '1');
        // make the session cookie HttpOnly
        ini_set('session.cookie_httponly', '1');
        // add SameSite to the session cookie
        ini_set('session.cookie_samesite', $cookieSameSite);

// do not force transparent session ids
        ini_set('session.use_trans_sid', '0');

// delete session/cookies when browser is closed
        ini_set('session.cookie_lifetime', '0');

// some pages (e.g. stylesheet) may be cached on clients, but not in shared
        // proxy servers
        session_cache_limiter('private');

$httpCookieName = $config->getCookieName('phpMyAdmin');
        @session_name($httpCookieName);

// Restore correct session ID (it might have been reset by auto started session
        if ($config->issetCookie('phpMyAdmin')) {
            session_id($config->getCookie('phpMyAdmin'));
        }

// on first start of session we check for errors
        // f.e. session dir cannot be accessed - session file not created
        $origErrorCount = $errorHandler->countErrors(false);

$sessionResult = session_start();

if (! $sessionResult || $origErrorCount !== $errorHandler->countErrors(false)) {
            setcookie($httpCookieName, '', 1);
            $errors = $errorHandler->sliceErrors($origErrorCount);
            self::sessionFailed($errors);
        }

unset($origErrorCount, $sessionResult);

/**
         * Disable setting of session cookies for further session_start() calls.
         */
        if (session_status() !== PHP_SESSION_ACTIVE) {
            ini_set('session.use_cookies', 'true');
        }

/**
         * Token which is used for authenticating access queries.
         * (we use "space PMA_token space" to prevent overwriting)
         */
        if (! empty($_SESSION[' PMA_token '])) {
            return;
        }

self::generateToken();

/**
         * Check for disk space on session storage by trying to write it.
         *
         * This seems to be most reliable approach to test if sessions are working,
         * otherwise the check would fail with custom session backends.
         */
        $origErrorCount = $errorHandler->countErrors();
        session_write_close();
        if ($errorHandler->countErrors() > $origErrorCount) {
            $errors = $errorHandler->sliceErrors($origErrorCount);
            self::sessionFailed($errors);
        }

session_start();
        if (! empty($_SESSION[' PMA_token '])) {
            return;
        }

throw new SessionHandlerException(
            'Failed to store CSRF token in session! Probably sessions are not working properly.',
        );
    }
}

${this.title}

Code Editor : Session.php