Disable session.use_trans_sid to preserve export result

Do not depend on session.use_trans_sid without cookies

git-svn-id: https://adminer.svn.sourceforge.net/svnroot/adminer/trunk@1050 7c3ca157-0c34-0410-bff1-cbf682f78f5c

diff --git a/adminer/include/adminer.inc.php b/adminer/include/adminer.inc.php
index 1c8002f036d50e929061651ce0ba82ea8fc4ab10..2233032af9fe7c7da1c8e35a2439581a6f6db4e0 100644 (file)
--- a/adminer/include/adminer.inc.php
+++ b/adminer/include/adminer.inc.php
@@ -425,7 +425,9 @@ class Adminer {
 </p>
 </form>
 <form action="">
-<p><?php if (strlen($_GET["server"])) { ?><input type="hidden" name="server" value="<?php echo h($_GET["server"]); ?>"><?php } ?>
+<p>
+<?php if (SID) { ?><input type="hidden" name="<?php echo session_name(); ?>" value="<?php echo h(session_id()); ?>"><?php } ?>
+<?php if (strlen($_GET["server"])) { ?><input type="hidden" name="server" value="<?php echo h($_GET["server"]); ?>"><?php } ?>
 <?php if ($databases) { ?>
 <select name="db" onchange="this.form.submit();"><option value="">(<?php echo lang('database'); ?>)<?php echo optionlist($databases, DB); ?></select>
 <?php } else { ?>

diff --git a/adminer/include/auth.inc.php b/adminer/include/auth.inc.php
index 5d94b5604cb1128ed5c2cd4eeaca2bc124d96193..0202cea292306eb865779c9437aef57ff485de99 100644 (file)
--- a/adminer/include/auth.inc.php
+++ b/adminer/include/auth.inc.php
@@ -1,26 +1,21 @@
 <?php
 $ignore = array("server", "username", "password");
 $session_name = session_name();
-if (ini_get("session.use_trans_sid") && isset($_POST[$session_name])) {
-       $ignore[] = $session_name;
-}
 if (isset($_POST["server"])) {
-       if (isset($_COOKIE[$session_name]) || isset($_POST[$session_name])) {
-               session_regenerate_id(); // defense against session fixation
-               $_SESSION["usernames"][$_POST["server"]] = $_POST["username"];
-               $_SESSION["passwords"][$_POST["server"]] = $_POST["password"];
-               $_SESSION["tokens"][$_POST["server"]] = rand(1, 1e6); // defense against cross-site request forgery
-               if (count($_POST) == count($ignore)) {
-                       $location = ((string) $_GET["server"] === $_POST["server"] ? remove_from_uri() : preg_replace('~^[^?]*/([^?]*).*~', '\\1', $_SERVER["REQUEST_URI"]) . (strlen($_POST["server"]) ? '?server=' . urlencode($_POST["server"]) : ''));
-                       if (!isset($_COOKIE[$session_name])) {
-                               $location .= (strpos($location, "?") === false ? "?" : "&") . SID;
-                       }
-                       header("Location: " . (strlen($location) ? $location : "."));
-                       exit;
-               }
-               if ($_POST["token"]) {
-                       $_POST["token"] = $_SESSION["tokens"][$_POST["server"]];
+       session_regenerate_id(); // defense against session fixation
+       $_SESSION["usernames"][$_POST["server"]] = $_POST["username"];
+       $_SESSION["passwords"][$_POST["server"]] = $_POST["password"];
+       $_SESSION["tokens"][$_POST["server"]] = rand(1, 1e6); // defense against cross-site request forgery
+       if (count($_POST) == count($ignore)) {
+               $location = ((string) $_GET["server"] === $_POST["server"] ? remove_from_uri() : preg_replace('~^[^?]*/([^?]*).*~', '\\1', $_SERVER["REQUEST_URI"]) . (strlen($_POST["server"]) ? '?server=' . urlencode($_POST["server"]) : ''));
+               if (!isset($_COOKIE[$session_name])) {
+                       $location .= (strpos($location, "?") === false ? "?" : "&") . SID;
                }
+               header("Location: " . (strlen($location) ? $location : "."));
+               exit;
+       }
+       if ($_POST["token"]) {
+               $_POST["token"] = $_SESSION["tokens"][$_POST["server"]];
        }
        $_GET["server"] = $_POST["server"];
 } elseif (isset($_POST["logout"])) {

diff --git a/adminer/include/bootstrap.inc.php b/adminer/include/bootstrap.inc.php
index 86d8d108b9bc93cb87b96eb1500f079b3c4fe751..92ac974a9f2834072bb719a7fcee05082160ab3a 100644 (file)
--- a/adminer/include/bootstrap.inc.php
+++ b/adminer/include/bootstrap.inc.php
@@ -45,6 +45,7 @@ if (!isset($_SERVER["REQUEST_URI"])) {
 
 if (!ini_get("session.auto_start")) {
        // use specific session name to get own namespace
+       @ini_set("session.use_trans_sid", false); // @ - may be disabled
        session_name("adminer_sid");
        session_set_cookie_params(0, preg_replace('~\\?.*~', '', $_SERVER["REQUEST_URI"])); //! use HttpOnly in PHP 5
        session_start();
@@ -70,7 +71,7 @@ set_magic_quotes_runtime(false);
 @set_time_limit(0); // @ - can be disabled
 
 define("DB", $_GET["db"]); // for the sake of speed and size
-define("ME", preg_replace('~^[^?]*/([^?]*).*~', '\\1', $_SERVER["REQUEST_URI"]) . '?' . (strlen($_GET["server"]) ? 'server=' . urlencode($_GET["server"]) . '&' : '') . (strlen(DB) ? 'db=' . urlencode(DB) . '&' : ''));
+define("ME", preg_replace('~^[^?]*/([^?]*).*~', '\\1', $_SERVER["REQUEST_URI"]) . '?' . (SID ? SID . '&' : '') . (strlen($_GET["server"]) ? 'server=' . urlencode($_GET["server"]) . '&' : '') . (strlen(DB) ? 'db=' . urlencode(DB) . '&' : ''));
 $on_actions = array("RESTRICT", "CASCADE", "SET NULL", "NO ACTION"); // used in foreign_keys()
 
 include "../adminer/include/version.inc.php";

diff --git a/adminer/include/functions.inc.php b/adminer/include/functions.inc.php
index 93cb694c6df9841523905ac01c5eabe6d6c488ef..5cf70955c43f5347463ca79dbe8c236c9792c78f 100644 (file)
--- a/adminer/include/functions.inc.php
+++ b/adminer/include/functions.inc.php
@@ -104,10 +104,6 @@ function redirect($location, $message = null) {
        if (isset($message)) {
                $_SESSION["messages"][] = $message;
        }
-       if (strlen(SID)) {
-               // append SID if session cookies are disabled
-               $location .= (strpos($location, "?") === false ? "?" : "&") . SID;
-       }
        header("Location: " . (strlen($location) ? $location : "."));
        exit;
 }

diff --git a/adminer/privileges.inc.php b/adminer/privileges.inc.php
index 5107e470b6745e59df4c13c6736b8ddcd1532ee9..03e0e595826911cdf466623b310607bc39bb350d 100644 (file)
--- a/adminer/privileges.inc.php
+++ b/adminer/privileges.inc.php
@@ -6,6 +6,7 @@ $result = $dbh->query("SELECT User, Host FROM mysql.user ORDER BY Host, User");
 if (!$result) {
        ?>
        <form action=""><p>
+       <?php if (SID) { ?><input type="hidden" name="<?php echo session_name(); ?>" value="<?php echo h(session_id()); ?>"><?php } ?>
        <?php if (strlen($_GET["server"])) { ?><input type="hidden" name="server" value="<?php echo h($_GET["server"]); ?>"><?php } ?>
        <?php echo lang('Username'); ?>: <input name="user">
        <?php echo lang('Server'); ?>: <input name="host" value="localhost">