Move $token to get_token()

diff --git a/adminer/include/auth.inc.php b/adminer/include/auth.inc.php
index baa36588fdbf0fe4c1c7df1eb4d26db2db5c4f66..048266ed7ce94eac989dbb2f3ffc5eefaffe0100 100644 (file)
--- a/adminer/include/auth.inc.php
+++ b/adminer/include/auth.inc.php
@@ -7,7 +7,6 @@ $has_token = $_SESSION["token"];
 if (!$has_token) {
        $_SESSION["token"] = rand(1, 1e6); // defense against cross-site request forgery
 }
-$token = get_token(); ///< @var string CSRF protection
 
 $permanent = array();
 if ($_COOKIE["adminer_permanent"]) {
@@ -204,7 +203,7 @@ if ($_POST["logout"] && $has_token && !verify_token()) {
 }
 
 if ($auth && $_POST["token"]) {
-       $_POST["token"] = $token; // reset token after explicit login
+       $_POST["token"] = get_token(); // reset token after explicit login
 }
 
 $error = ''; ///< @var string

diff --git a/adminer/include/bootstrap.inc.php b/adminer/include/bootstrap.inc.php
index 9fd82101467dfae03337a6cf48bb3295665594ff..d547739782e88ece39f81a6c45a5f0c29b7f2c98 100644 (file)
--- a/adminer/include/bootstrap.inc.php
+++ b/adminer/include/bootstrap.inc.php
@@ -39,7 +39,7 @@ if ($_GET["script"] == "version") {
        exit;
 }
 
-global $adminer, $connection, $driver, $drivers, $error, $permanent, $has_token, $token, $translations; // allows including Adminer inside a function
+global $adminer, $connection, $driver, $drivers, $error, $permanent, $has_token, $translations; // allows including Adminer inside a function
 
 if (!$_SERVER["REQUEST_URI"]) { // IIS 5 compatibility
        $_SERVER["REQUEST_URI"] = $_SERVER["ORIG_PATH_INFO"];

diff --git a/adminer/include/design.inc.php b/adminer/include/design.inc.php
index 916a9861a2e9f00c910a0dff75656ad8e8ccba96..8df772659a1128f8947630a9adf7d8933c93e9fc 100644 (file)
--- a/adminer/include/design.inc.php
+++ b/adminer/include/design.inc.php
@@ -77,7 +77,7 @@ fQIDAQAB
                }
        }
        echo script("mixin(document.body, {onkeydown: bodyKeydown, onclick: bodyClick"
-               . (isset($_COOKIE["adminer_version"]) ? "" : ", onload: partial(verifyVersion, '" . VERSION . "', '" . js_escape(ME) . "', '" . get_token() . "')") // $token may be empty in auth.inc.php
+               . (isset($_COOKIE["adminer_version"]) ? "" : ", onload: partial(verifyVersion, '" . VERSION . "', '" . js_escape(ME) . "', '" . get_token() . "')")
                . "});
 document.body.classList.replace('nojs', 'js');
 const offlineMessage = '" . js_escape(lang('You are offline.')) . "';

diff --git a/adminer/include/functions.inc.php b/adminer/include/functions.inc.php
index 615717e609b6f22030bcef6545979a6e44e7b814..6771549f660f14b60de0a0181348a1b82befa8c9 100644 (file)
--- a/adminer/include/functions.inc.php
+++ b/adminer/include/functions.inc.php
@@ -850,7 +850,7 @@ function count_rows(string $table, array $where, bool $is_group, array $group):
 * @return string[]
 */
 function slow_query(string $query): array {
-       global $adminer, $token, $driver;
+       global $adminer, $driver;
        $db = $adminer->database();
        $timeout = $adminer->queryTimeout();
        $slow_query = $driver->slowQuery($query, $timeout);
@@ -859,7 +859,7 @@ function slow_query(string $query): array {
                $connection2 = connect($adminer->credentials());
                if (is_object($connection2) && ($db == "" || $connection2->select_db($db))) {
                        $kill = get_val(connection_id(), 0, $connection2); // MySQL and MySQLi can use thread_id but it's not in PDO_MySQL
-                       echo script("const timeout = setTimeout(() => { ajax('" . js_escape(ME) . "script=kill', function () {}, 'kill=$kill&token=$token'); }, 1000 * $timeout);");
+                       echo script("const timeout = setTimeout(() => { ajax('" . js_escape(ME) . "script=kill', function () {}, 'kill=$kill&token=" . get_token() . "'); }, 1000 * $timeout);");
                }
        }
        ob_flush();

diff --git a/adminer/include/html.inc.php b/adminer/include/html.inc.php
index c91e650a00160369ddc20b7cd1a5273a9a86da44..f56a62ffdfb2346ee9f8d654a309bf3cf30338b9 100644 (file)
--- a/adminer/include/html.inc.php
+++ b/adminer/include/html.inc.php
@@ -24,13 +24,11 @@ function input_hidden(string $name, $value = ""): string {
        return "<input type='hidden' name='" . h($name) . "' value='" . h($value) . "'>\n";
 }
 
-/** Get <input type="hidden" name="token">
-* @param string $special token to use instead of global $token
+/** Get CSRF <input type="hidden" name="token">
 * @return string HTML
 */
-function input_token(string $special = ""): string {
-       global $token;
-       return input_hidden("token", ($special ?: $token));
+function input_token(): string {
+       return input_hidden("token", get_token());
 }
 
 /** Get a target="_blank" attribute */

diff --git a/adminer/include/lang.inc.php b/adminer/include/lang.inc.php
index e4f2a92058dd0f8f53b55f5af76e0e6024f893fc..cf98bb34eff9275550f4f4ddc9fe83f4a07e128c 100644 (file)
--- a/adminer/include/lang.inc.php
+++ b/adminer/include/lang.inc.php
@@ -92,7 +92,7 @@ function switch_lang(): void {
        echo "<form action='' method='post'>\n<div id='lang'>";
        echo lang('Language') . ": " . html_select("lang", langs(), LANG, "this.form.submit();");
        echo " <input type='submit' value='" . lang('Use') . "' class='hidden'>\n";
-       echo input_token(get_token()); // $token may be empty in auth.inc.php
+       echo input_token();
        echo "</div>\n</form>\n";
 }
 

diff --git a/phpstan.neon b/phpstan.neon
index 2b16c4b095fd4fdbfb7f0c3600a8a6938a2e688e..de880356f4caf87dfd9ff3cceebb5b091a2f6225 100644 (file)
--- a/phpstan.neon
+++ b/phpstan.neon
@@ -12,7 +12,7 @@ parameters:
                - identifier: includeOnce.fileNotFound # ./adminer-plugins.php
                - "~^Function (set_magic_quotes_runtime|mysql_)~" # PHP < 7 functions
                - "~an unknown class OCI-?Lob~" # this looks like PHPStan bug
-               - "~^Variable \\$(adminer|connection|driver|drivers|error|permanent|has_token|token|translations) might not be defined~" # declared in bootstrap.inc.php
+               - "~^Variable \\$(adminer|connection|driver|drivers|error|permanent|has_token|translations) might not be defined~" # declared in bootstrap.inc.php
                - "~expects int, float given~" # this will work
                - "~expects bool~" # truthy values
                - "~fread expects int<1, max>, 100000~" # 1e6