Fix #14321 - leaked HTML on auth_type=signon before redirect occurs a…

…nd on error page when SignonURL is not set

This fix also fixes the display when SignonURL is empty at configuration time.

When the user was redirected there was HTML in the output that could leak some interesting details about the server or the user.

Signed-off-by: William Desportes <williamdes@wdes.fr>

libraries/classes/Plugins/Auth/AuthenticationSignon.php

@@ -10,6 +10,7 @@
 
 use PhpMyAdmin\Core;
 use PhpMyAdmin\Plugins\AuthenticationPlugin;
+use PhpMyAdmin\Response;
 use PhpMyAdmin\Util;
 
 /**
@@ -26,6 +27,7 @@ class AuthenticationSignon extends AuthenticationPlugin
      */
     public function showLoginForm()
     {
+        Response::getInstance()->disable();
         unset($_SESSION['LAST_SIGNON_URL']);
         if (empty($GLOBALS['cfg']['Server']['SignonURL'])) {
             Core::fatalError('You must set SignonURL!');