CVE-2016-5730

@@ -98,9 +98,9 @@ function Show_page($contents)
 }
 
 /* Grab identifier */
-if (isset($_POST['identifier'])) {
+if (isset($_POST['identifier']) && is_string($_POST['identifier'])) {
     $identifier = $_POST['identifier'];
-} else if (isset($_SESSION['identifier'])) {
+} else if (isset($_SESSION['identifier']) && is_string($_SESSION['identifier'])) {
     $identifier = $_SESSION['identifier'];
 } else {
     $identifier = null;
@@ -109,7 +109,7 @@ function Show_page($contents)
 /* Create OpenID object */
 try {
     $o = new OpenID_RelyingParty($returnTo, $realm, $identifier);
-} catch (OpenID_Exception $e) {
+} catch (Exception $e) {
     $contents = "<div class='relyingparty_results'>\n";
     $contents .= "<pre>" . $e->getMessage() . "</pre>\n";
     $contents .= "</div class='relyingparty_results'>";

@@ -15,6 +15,24 @@
 
 require './libraries/config/setup.forms.php';
 
+/**
+ * Loads configuration file path
+ *
+ * Do this in a function to avoid messing up with global $cfg
+ *
+ * @param string $config_file_path
+ *
+ * @return array
+ */
+function loadConfig($config_file_path)
+{
+    $cfg = array();
+    if (file_exists($config_file_path)) {
+        include $config_file_path;
+    }
+    return $cfg;
+}
+
 $form_display = new FormDisplay($GLOBALS['ConfigFile']);
 $form_display->registerForm('_config.php', $forms['_config.php']);
 $form_display->save('_config.php');
@@ -44,20 +62,25 @@
     //
     // Save generated config file on the server
     //
-    file_put_contents(
+    $result = @file_put_contents(
         $config_file_path,
         ConfigGenerator::getConfigFile($GLOBALS['ConfigFile'])
     );
+    if ($result === false) {
+        $state = 'config_not_saved';
+    } else {
+        $state = 'config_saved';
+    }
     header('HTTP/1.1 303 See Other');
-    header('Location: index.php' . PMA_URL_getCommon() . '&action_done=config_saved');
+    header('Location: index.php' . PMA_URL_getCommon() . '&action_done=' . $state);
     exit;
 } elseif (PMA_ifSetOr($_POST['submit_load'], '')) {
     //
     // Load config file from the server
     //
-    $cfg = array();
-    include $config_file_path;
-    $GLOBALS['ConfigFile']->setConfigData($cfg);
+    $GLOBALS['ConfigFile']->setConfigData(
+        loadConfig($config_file_path)
+    );
     header('HTTP/1.1 303 See Other');
     header('Location: index.php' . PMA_URL_getCommon());
     exit;

@@ -126,6 +126,20 @@
         )
     );
     break;
+case 'config_not_saved':
+    /* Use uniqid to display this message every time configuration is saved */
+    PMA_messagesSet(
+        'notice', uniqid('config_not_saved'), __('Configuration not saved!'),
+        PMA_sanitize(
+            __(
+                'Please create web server writable folder [em]config[/em] in '
+                . 'phpMyAdmin top level directory as described in '
+                . '[doc@setup_script]documentation[/doc]. Otherwise you will be '
+                . 'only able to download or display it.'
+            )
+        )
+    );
+    break;
 default:
     break;
 }

@@ -8,6 +8,7 @@
 namespace PMA\libraries\config;
 
 use PMA\libraries\DatabaseInterface;
+use PMA\libraries\Util;
 
 /**
  * Validation class for various validation functions
@@ -280,6 +281,11 @@ public static function validateServer($path, $values)
             'Servers/1/SignonURL' => ''
         );
         $error = false;
+        if (empty($values['Servers/1/auth_type'])) {
+            $values['Servers/1/auth_type'] = '';
+            $result['Servers/1/auth_type'] = __('Invalid authentication type!');
+            $error = true;
+        }
         if ($values['Servers/1/auth_type'] == 'config'
             && empty($values['Servers/1/user'])
         ) {
@@ -308,14 +314,14 @@ public static function validateServer($path, $values)
         }
 
         if (! $error && $values['Servers/1/auth_type'] == 'config') {
-            $password = $values['Servers/1/nopassword'] ? null
-                : $values['Servers/1/password'];
+            $password = !empty($values['Servers/1/nopassword']) && $values['Servers/1/nopassword'] ? null
+                : (empty($values['Servers/1/password']) ? '' : $values['Servers/1/password']);
             $test = static::testDBConnection(
-                $values['Servers/1/connect_type'],
-                $values['Servers/1/host'],
-                $values['Servers/1/port'],
-                $values['Servers/1/socket'],
-                $values['Servers/1/user'],
+                empty($values['Servers/1/connect_type']) ? '' : $values['Servers/1/connect_type'],
+                empty($values['Servers/1/host']) ? '' : $values['Servers/1/host'],
+                empty($values['Servers/1/port']) ? '' : $values['Servers/1/port'],
+                empty($values['Servers/1/socket']) ? '' : $values['Servers/1/socket'],
+                empty($values['Servers/1/user']) ? '' : $values['Servers/1/user'],
                 $password,
                 'Server'
             );
@@ -345,19 +351,19 @@ public static function validatePMAStorage($path, $values)
         );
         $error = false;
 
-        if ($values['Servers/1/pmadb'] == '') {
+        if (empty($values['Servers/1/pmadb'])) {
             return $result;
         }
 
         $result = array();
-        if ($values['Servers/1/controluser'] == '') {
+        if (empty($values['Servers/1/controluser'])) {
             $result['Servers/1/controluser'] = __(
                 'Empty phpMyAdmin control user while using phpMyAdmin configuration '
                 . 'storage!'
             );
             $error = true;
         }
-        if ($values['Servers/1/controlpass'] == '') {
+        if (empty($values['Servers/1/controlpass'])) {
             $result['Servers/1/controlpass'] = __(
                 'Empty phpMyAdmin control user password while using phpMyAdmin '
                 . 'configuration storage!'
@@ -366,10 +372,13 @@ public static function validatePMAStorage($path, $values)
         }
         if (! $error) {
             $test = static::testDBConnection(
-                $values['Servers/1/connect_type'],
-                $values['Servers/1/host'], $values['Servers/1/port'],
-                $values['Servers/1/socket'], $values['Servers/1/controluser'],
-                $values['Servers/1/controlpass'], 'Server_pmadb'
+                empty($values['Servers/1/connect_type']) ? '' : $values['Servers/1/connect_type'],
+                empty($values['Servers/1/host']) ? '' : $values['Servers/1/host'],
+                empty($values['Servers/1/port']) ? '' : $values['Servers/1/port'],
+                empty($values['Servers/1/socket']) ? '' : $values['Servers/1/socket'],
+                empty($values['Servers/1/controluser']) ? '' : $values['Servers/1/controluser'],
+                empty($values['Servers/1/controlpass']) ? '' : $values['Servers/1/controlpass'],
+                'Server_pmadb'
             );
             if ($test !== true) {
                 $result = array_merge($result, $test);
@@ -391,7 +400,7 @@ public static function validateRegex($path, $values)
     {
         $result = array($path => '');
 
-        if ($values[$path] == '') {
+        if (empty($values[$path])) {
             return $result;
         }
 
@@ -400,7 +409,7 @@ public static function validateRegex($path, $values)
         $matches = array();
         // in libraries/ListDatabase.php _checkHideDatabase(),
         // a '/' is used as the delimiter for hide_db
-        preg_match('/' . $values[$path] . '/', '', $matches);
+        preg_match('/' . Util::requestString($values[$path]) . '/', '', $matches);
 
         static::testPHPErrorMsg(false);
 
@@ -428,10 +437,11 @@ public static function validateTrustedProxies($path, $values)
             return $result;
         }
 
-        if (is_array($values[$path])) {
+        if (is_array($values[$path]) || is_object($values[$path])) {
             // value already processed by FormDisplay::save
             $lines = array();
             foreach ($values[$path] as $ip => $v) {
+                $v = Util::requestString($v);
                 $lines[] = preg_match('/^-\d+$/', $ip)
                     ? $v
                     : $ip . ': ' . $v;
@@ -483,14 +493,16 @@ public static function validateNumber(
         $max_value,
         $error_string
     ) {
-        if ($values[$path] === '') {
+        if (empty($values[$path])) {
             return '';
         }
 
-        if (intval($values[$path]) != $values[$path]
-            || (! $allow_neg && $values[$path] < 0)
-            || (! $allow_zero && $values[$path] == 0)
-            || $values[$path] > $max_value
+        $value = Util::requestString($values[$path]);
+
+        if (intval($value) != $value
+            || (! $allow_neg && $value < 0)
+            || (! $allow_zero && $value == 0)
+            || $value > $max_value
         ) {
             return $error_string;
         }
@@ -576,7 +588,10 @@ public static function validateNonNegativeNumber($path, $values)
      */
     public static function validateByRegex($path, $values, $regex)
     {
-        $result = preg_match($regex, $values[$path]);
+        if (!isset($values[$path])) {
+            return '';
+        }
+        $result = preg_match($regex, Util::requestString($values[$path]));
         return array($path => ($result ? '' : __('Incorrect value!')));
     }
 

@@ -26,6 +26,9 @@
 $values = (array)$values;
 $result = PMA\libraries\config\Validator::validate($GLOBALS['ConfigFile'], $vids, $values, true);
 if ($result === false) {
-    $result = 'Wrong data or no validation for ' . $vids;
+    $result = sprintf(
+        __('Wrong data or no validation for %s'),
+        implode(',', $vids)
+    );
 }
 echo $result !== true ? json_encode($result) : '';

@@ -639,12 +639,12 @@ public function save($forms, $allow_partial_save = true)
                 // cast variables to correct type
                 switch ($type) {
                 case 'double':
-                    settype($_POST[$key], 'float');
+                    settype($this->_trimString($_POST[$key]), 'float');
                     break;
                 case 'boolean':
                 case 'integer':
                     if ($_POST[$key] !== '') {
-                        settype($_POST[$key], $type);
+                        settype($this->_trimString($_POST[$key]), $type);
                     }
                     break;
                 case 'select':
@@ -660,7 +660,7 @@ public function save($forms, $allow_partial_save = true)
                     break;
                 case 'string':
                 case 'short_string':
-                    $_POST[$key] = trim($_POST[$key]);
+                    $_POST[$key] = $this->_trimString($_POST[$key]);
                     break;
                 case 'array':
                     // eliminate empty values and ensure we have an array
@@ -876,10 +876,25 @@ private function _setComments($system_path, array &$opts)
     private function _fillPostArrayParameters($post_values, $key)
     {
         foreach ($post_values as $v) {
-            $v = trim($v);
+            $v = $this->_trimString($v);
             if ($v !== '') {
                 $_POST[$key][] = $v;
             }
         }
     }
+
+    /*
+     * Converts given (request) paramter to string
+     *
+     * @param mixed $value Value to convert
+     *
+     * @return string
+     */
+    private function _trimString($value)
+    {
+        while (is_array($value)) {
+            $value = reset($value);
+        }
+        return trim((string)$value);
+    }
 }