user_password.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * displays and handles the form where the user can change his password
   5  * linked from index.php
   6  *
   7  * @package PhpMyAdmin
   8  */
   9 use PMA\libraries\URL;
  10 use PMA\libraries\Response;
  11
  12 /**
  13  * Gets some core libraries
  14  */
  15 require_once './libraries/common.inc.php';
  16
  17 /**
  18  * Libraries needed for some functions
  19  */
  20 require_once './libraries/server_privileges.lib.php';
  21
  22 $response = Response::getInstance();
  23 $header   = $response->getHeader();
  24 $scripts  = $header->getScripts();
  25 $scripts->addFile('server_privileges.js');
  26 $scripts->addFile('zxcvbn.js');
  27
  28 /**
  29  * Displays an error message and exits if the user isn't allowed to use this
  30  * script
  31  */
  32 if (! $GLOBALS['cfg']['ShowChgPassword']) {
  33     $GLOBALS['cfg']['ShowChgPassword'] = $GLOBALS['dbi']->selectDb('mysql');
  34 }
  35 if ($cfg['Server']['auth_type'] == 'config' || ! $cfg['ShowChgPassword']) {
  36     PMA\libraries\Message::error(
  37         __('You don\'t have sufficient privileges to be here right now!')
  38     )->display();
  39     exit;
  40 } // end if
  41
  42 /**
  43  * If the "change password" form has been submitted, checks for valid values
  44  * and submit the query or logout
  45  */
  46 if (isset($_REQUEST['nopass'])) {
  47     if ($_REQUEST['nopass'] == '1') {
  48         $password = '';
  49     } else {
  50         $password = $_REQUEST['pma_pw'];
  51     }
  52     $change_password_message = PMA_setChangePasswordMsg();
  53     $msg = $change_password_message['msg'];
  54     if (! $change_password_message['error']) {
  55         PMA_changePassword($password, $msg, $change_password_message);
  56     } else {
  57         PMA_getChangePassMessage($change_password_message);
  58     }
  59 }
  60
  61 /**
  62  * If the "change password" form hasn't been submitted or the values submitted
  63  * aren't valid -> displays the form
  64  */
  65
  66 // Displays an error message if required
  67 if (isset($msg)) {
  68     $msg->display();
  69     unset($msg);
  70 }
  71
  72 require_once './libraries/display_change_password.lib.php';
  73
  74 echo PMA_getHtmlForChangePassword('change_pw', $username, $hostname);
  75 exit;
  76
  77 /**
  78  * Send the message as an ajax request
  79  *
  80  * @param array  $change_password_message Message to display
  81  * @param string $sql_query               SQL query executed
  82  *
  83  * @return void
  84  */
  85 function PMA_getChangePassMessage($change_password_message, $sql_query = '')
  86 {
  87     if ($response->isAjax()) {
  88         /**
  89          * If in an Ajax request, we don't need to show the rest of the page
  90          */
  91         $response = Response::getInstance();
  92         if ($change_password_message['error']) {
  93             $response->addJSON('message', $change_password_message['msg']);
  94             $response->setRequestStatus(false);
  95         } else {
  96             $sql_query = PMA\libraries\Util::getMessage(
  97                 $change_password_message['msg'],
  98                 $sql_query,
  99                 'success'
 100             );
 101             $response->addJSON('message', $sql_query);
 102         }
 103         exit;
 104     }
 105 }
 106
 107 /**
 108  * Generate the message
 109  *
 110  * @return array   error value and message
 111  */
 112 function PMA_setChangePasswordMsg()
 113 {
 114     $error = false;
 115     $message = PMA\libraries\Message::success(__('The profile has been updated.'));
 116
 117     if (($_REQUEST['nopass'] != '1')) {
 118         if (strlen($_REQUEST['pma_pw']) === 0 || strlen($_REQUEST['pma_pw2']) === 0) {
 119             $message = PMA\libraries\Message::error(__('The password is empty!'));
 120             $error = true;
 121         } elseif ($_REQUEST['pma_pw'] !== $_REQUEST['pma_pw2']) {
 122             $message = PMA\libraries\Message::error(
 123                 __('The passwords aren\'t the same!')
 124             );
 125             $error = true;
 126         } elseif (strlen($_REQUEST['pma_pw']) > 256) {
 127             $message = PMA_Message::error(__('Password is too long!'));
 128             $error = true;
 129         }
 130     }
 131     return array('error' => $error, 'msg' => $message);
 132 }
 133
 134 /**
 135  * Change the password
 136  *
 137  * @param string $password                New password
 138  * @param string $message                 Message
 139  * @param array  $change_password_message Message to show
 140  *
 141  * @return void
 142  */
 143 function PMA_changePassword($password, $message, $change_password_message)
 144 {
 145     global $auth_plugin;
 146
 147     $hashing_function = PMA_changePassHashingFunction();
 148
 149     list($username, $hostname) = $GLOBALS['dbi']->getCurrentUserAndHost();
 150
 151     $serverType = PMA\libraries\Util::getServerType();
 152
 153     if (isset($_REQUEST['authentication_plugin'])
 154         && ! empty($_REQUEST['authentication_plugin'])
 155     ) {
 156         $orig_auth_plugin = $_REQUEST['authentication_plugin'];
 157     } else {
 158         $orig_auth_plugin = PMA_getCurrentAuthenticationPlugin(
 159             'change', $username, $hostname
 160         );
 161     }
 162
 163     $sql_query = 'SET password = '
 164         . (($password == '') ? '\'\'' : $hashing_function . '(\'***\')');
 165
 166     if ($serverType == 'MySQL'
 167         && PMA_MYSQL_INT_VERSION >= 50706
 168     ) {
 169         $sql_query = 'ALTER USER \'' . $username . '\'@\'' . $hostname
 170             . '\' IDENTIFIED WITH ' . $orig_auth_plugin . ' BY '
 171             . (($password == '') ? '\'\'' : '\'***\'');
 172     } else if (($serverType == 'MySQL'
 173         && PMA_MYSQL_INT_VERSION >= 50507)
 174         || ($serverType == 'MariaDB'
 175         && PMA_MYSQL_INT_VERSION >= 50200)
 176     ) {
 177         // For MySQL versions 5.5.7+ and MariaDB versions 5.2+,
 178         // explicitly set value of `old_passwords` so that
 179         // it does not give an error while using
 180         // the PASSWORD() function
 181         if ($orig_auth_plugin == 'sha256_password') {
 182             $value = 2;
 183         } else {
 184             $value = 0;
 185         }
 186         $GLOBALS['dbi']->tryQuery('SET `old_passwords` = ' . $value . ';');
 187     }
 188
 189     PMA_changePassUrlParamsAndSubmitQuery(
 190         $username, $hostname, $password,
 191         $sql_query, $hashing_function, $orig_auth_plugin
 192     );
 193
 194     $auth_plugin->handlePasswordChange($password);
 195     PMA_getChangePassMessage($change_password_message, $sql_query);
 196     PMA_changePassDisplayPage($message, $sql_query);
 197 }
 198
 199 /**
 200  * Generate the hashing function
 201  *
 202  * @return string  $hashing_function
 203  */
 204 function PMA_changePassHashingFunction()
 205 {
 206     if (PMA_isValid(
 207         $_REQUEST['authentication_plugin'], 'identical', 'mysql_old_password'
 208     )) {
 209         $hashing_function = 'OLD_PASSWORD';
 210     } else {
 211         $hashing_function = 'PASSWORD';
 212     }
 213     return $hashing_function;
 214 }
 215
 216 /**
 217  * Changes password for a user
 218  *
 219  * @param string $username         Username
 220  * @param string $hostname         Hostname
 221  * @param string $password         Password
 222  * @param string $sql_query        SQL query
 223  * @param string $hashing_function Hashing function
 224  * @param string $orig_auth_plugin Original Authentication Plugin
 225  *
 226  * @return void
 227  */
 228 function PMA_changePassUrlParamsAndSubmitQuery(
 229     $username, $hostname, $password, $sql_query, $hashing_function, $orig_auth_plugin
 230 ) {
 231     $err_url = 'user_password.php' . URL::getCommon();
 232
 233     $serverType = PMA\libraries\Util::getServerType();
 234
 235     if ($serverType == 'MySQL' && PMA_MYSQL_INT_VERSION >= 50706) {
 236         $local_query = 'ALTER USER \'' . $username . '\'@\'' . $hostname . '\''
 237             . ' IDENTIFIED with ' . $orig_auth_plugin . ' BY '
 238             . (($password == '')
 239             ? '\'\''
 240             : '\'' . $GLOBALS['dbi']->escapeString($password) . '\'');
 241     } else if ($serverType == 'MariaDB'
 242         && PMA_MYSQL_INT_VERSION >= 50200
 243         && PMA_MYSQL_INT_VERSION < 100100
 244         && $orig_auth_plugin !== ''
 245     ) {
 246         if ($orig_auth_plugin == 'mysql_native_password') {
 247             // Set the hashing method used by PASSWORD()
 248             // to be 'mysql_native_password' type
 249             $GLOBALS['dbi']->tryQuery('SET old_passwords = 0;');
 250         } else if ($orig_auth_plugin == 'sha256_password') {
 251             // Set the hashing method used by PASSWORD()
 252             // to be 'sha256_password' type
 253             $GLOBALS['dbi']->tryQuery('SET `old_passwords` = 2;');
 254         }
 255
 256         $hashedPassword = PMA_getHashedPassword($_POST['pma_pw']);
 257
 258         $local_query = "UPDATE `mysql`.`user` SET"
 259             . " `authentication_string` = '" . $hashedPassword
 260             . "', `Password` = '', "
 261             . " `plugin` = '" . $orig_auth_plugin . "'"
 262             . " WHERE `User` = '" . $username . "' AND Host = '"
 263             . $hostname . "';";
 264     } else {
 265         $local_query = 'SET password = ' . (($password == '')
 266             ? '\'\''
 267             : $hashing_function . '(\''
 268                 . $GLOBALS['dbi']->escapeString($password) . '\')');
 269     }
 270     if (! @$GLOBALS['dbi']->tryQuery($local_query)) {
 271         PMA\libraries\Util::mysqlDie(
 272             $GLOBALS['dbi']->getError(),
 273             $sql_query,
 274             false,
 275             $err_url
 276         );
 277     }
 278
 279     // Flush privileges after successful password change
 280     $GLOBALS['dbi']->tryQuery("FLUSH PRIVILEGES;");
 281 }
 282
 283 /**
 284  * Display the page
 285  *
 286  * @param string $message   Message
 287  * @param string $sql_query SQL query
 288  *
 289  * @return void
 290  */
 291 function PMA_changePassDisplayPage($message, $sql_query)
 292 {
 293     echo '<h1>' , __('Change password') , '</h1>' , "\n\n";
 294     echo PMA\libraries\Util::getMessage(
 295         $message, $sql_query, 'success'
 296     );
 297     echo '<a href="index.php' , URL::getCommon()
 298         , ' target="_parent">' , "\n"
 299         , '<strong>' , __('Back') , '</strong></a>';
 300     exit;
 301 }