From e219ef9ad1723b40356a6a25c41fbe85151dddfe Mon Sep 17 00:00:00 2001 From: Jakub Vrana Date: Fri, 28 Mar 2025 18:49:26 +0100 Subject: [PATCH] Move $token to get_token() --- adminer/include/auth.inc.php | 3 +-- adminer/include/bootstrap.inc.php | 2 +- adminer/include/design.inc.php | 2 +- adminer/include/functions.inc.php | 4 ++-- adminer/include/html.inc.php | 8 +++----- adminer/include/lang.inc.php | 2 +- phpstan.neon | 2 +- 7 files changed, 10 insertions(+), 13 deletions(-) diff --git a/adminer/include/auth.inc.php b/adminer/include/auth.inc.php index baa36588..048266ed 100644 --- a/adminer/include/auth.inc.php +++ b/adminer/include/auth.inc.php @@ -7,7 +7,6 @@ $has_token = $_SESSION["token"]; if (!$has_token) { $_SESSION["token"] = rand(1, 1e6); // defense against cross-site request forgery } -$token = get_token(); ///< @var string CSRF protection $permanent = array(); if ($_COOKIE["adminer_permanent"]) { @@ -204,7 +203,7 @@ if ($_POST["logout"] && $has_token && !verify_token()) { } if ($auth && $_POST["token"]) { - $_POST["token"] = $token; // reset token after explicit login + $_POST["token"] = get_token(); // reset token after explicit login } $error = ''; ///< @var string diff --git a/adminer/include/bootstrap.inc.php b/adminer/include/bootstrap.inc.php index 9fd82101..d5477397 100644 --- a/adminer/include/bootstrap.inc.php +++ b/adminer/include/bootstrap.inc.php @@ -39,7 +39,7 @@ if ($_GET["script"] == "version") { exit; } -global $adminer, $connection, $driver, $drivers, $error, $permanent, $has_token, $token, $translations; // allows including Adminer inside a function +global $adminer, $connection, $driver, $drivers, $error, $permanent, $has_token, $translations; // allows including Adminer inside a function if (!$_SERVER["REQUEST_URI"]) { // IIS 5 compatibility $_SERVER["REQUEST_URI"] = $_SERVER["ORIG_PATH_INFO"]; diff --git a/adminer/include/design.inc.php b/adminer/include/design.inc.php index 916a9861..8df77265 100644 --- a/adminer/include/design.inc.php +++ b/adminer/include/design.inc.php @@ -77,7 +77,7 @@ fQIDAQAB } } echo script("mixin(document.body, {onkeydown: bodyKeydown, onclick: bodyClick" - . (isset($_COOKIE["adminer_version"]) ? "" : ", onload: partial(verifyVersion, '" . VERSION . "', '" . js_escape(ME) . "', '" . get_token() . "')") // $token may be empty in auth.inc.php + . (isset($_COOKIE["adminer_version"]) ? "" : ", onload: partial(verifyVersion, '" . VERSION . "', '" . js_escape(ME) . "', '" . get_token() . "')") . "}); document.body.classList.replace('nojs', 'js'); const offlineMessage = '" . js_escape(lang('You are offline.')) . "'; diff --git a/adminer/include/functions.inc.php b/adminer/include/functions.inc.php index 615717e6..6771549f 100644 --- a/adminer/include/functions.inc.php +++ b/adminer/include/functions.inc.php @@ -850,7 +850,7 @@ function count_rows(string $table, array $where, bool $is_group, array $group): * @return string[] */ function slow_query(string $query): array { - global $adminer, $token, $driver; + global $adminer, $driver; $db = $adminer->database(); $timeout = $adminer->queryTimeout(); $slow_query = $driver->slowQuery($query, $timeout); @@ -859,7 +859,7 @@ function slow_query(string $query): array { $connection2 = connect($adminer->credentials()); if (is_object($connection2) && ($db == "" || $connection2->select_db($db))) { $kill = get_val(connection_id(), 0, $connection2); // MySQL and MySQLi can use thread_id but it's not in PDO_MySQL - echo script("const timeout = setTimeout(() => { ajax('" . js_escape(ME) . "script=kill', function () {}, 'kill=$kill&token=$token'); }, 1000 * $timeout);"); + echo script("const timeout = setTimeout(() => { ajax('" . js_escape(ME) . "script=kill', function () {}, 'kill=$kill&token=" . get_token() . "'); }, 1000 * $timeout);"); } } ob_flush(); diff --git a/adminer/include/html.inc.php b/adminer/include/html.inc.php index c91e650a..f56a62ff 100644 --- a/adminer/include/html.inc.php +++ b/adminer/include/html.inc.php @@ -24,13 +24,11 @@ function input_hidden(string $name, $value = ""): string { return "\n"; } -/** Get -* @param string $special token to use instead of global $token +/** Get CSRF * @return string HTML */ -function input_token(string $special = ""): string { - global $token; - return input_hidden("token", ($special ?: $token)); +function input_token(): string { + return input_hidden("token", get_token()); } /** Get a target="_blank" attribute */ diff --git a/adminer/include/lang.inc.php b/adminer/include/lang.inc.php index e4f2a920..cf98bb34 100644 --- a/adminer/include/lang.inc.php +++ b/adminer/include/lang.inc.php @@ -92,7 +92,7 @@ function switch_lang(): void { echo "
\n
"; echo lang('Language') . ": " . html_select("lang", langs(), LANG, "this.form.submit();"); echo " \n"; - echo input_token(get_token()); // $token may be empty in auth.inc.php + echo input_token(); echo "
\n
\n"; } diff --git a/phpstan.neon b/phpstan.neon index 2b16c4b0..de880356 100644 --- a/phpstan.neon +++ b/phpstan.neon @@ -12,7 +12,7 @@ parameters: - identifier: includeOnce.fileNotFound # ./adminer-plugins.php - "~^Function (set_magic_quotes_runtime|mysql_)~" # PHP < 7 functions - "~an unknown class OCI-?Lob~" # this looks like PHPStan bug - - "~^Variable \\$(adminer|connection|driver|drivers|error|permanent|has_token|token|translations) might not be defined~" # declared in bootstrap.inc.php + - "~^Variable \\$(adminer|connection|driver|drivers|error|permanent|has_token|translations) might not be defined~" # declared in bootstrap.inc.php - "~expects int, float given~" # this will work - "~expects bool~" # truthy values - "~fread expects int<1, max>, 100000~" # 1e6