Add 2-factor authentication support for phpMyAdmin. #13495

Achilles-96 · 2017-07-16T11:38:05Z

Signed-off-by: Raghuram raghuram.4350@gmail.com

Before submitting pull request, please check that every commit:

Has proper Signed-Off-By
Has commit message which describes it
Is needed on it's own, if you have just minor fixes to previous commits, you can squash them
Any new functionality is covered by tests

Achilles-96 · 2017-07-16T11:47:01Z

I described the procedure for setting it up 2-factor authentication in my blog post.

As I mentioned there, I need advice on where to place the link to access setup2FA.php.

nijel

I've quickly gone through your code, some general remarks:

Please include documentation, having it in the blog is great, but it really should be part of our documentation.
Any reason for not integrating 2FA into existing Settings tab?

nijel · 2017-07-17T15:23:23Z

js/get_scripts.js.php

@@ -7,6 +7,8 @@
 * @package PhpMyAdmin
 */

+/* var_dump($_GET['scripts']); */
+/* exit; */


I guess this is not intentional...

nijel · 2017-07-17T15:25:08Z

libraries/phpqrcode.php

+ * PHP QR Code encoder
+ *
+ * This file contains MERGED version of PHP QR Code library.
+ * It was auto-generated from full version for your convenience.


Please do not include third party libraries, can't this be loaded using composer? Also including generated code without source doesn't really play well with GPL, so we would have to distribute the source code as well.

nijel · 2017-07-17T15:26:37Z

libraries/session.inc.php

@@ -138,18 +138,19 @@ function PMA_sessionFailed($errors)

 // on first start of session we check for errors
 // f.e. session dir cannot be accessed - session file not created
-$orig_error_count = $GLOBALS['error_handler']->countErrors(false);
+if (!isset($_SESSION)){


What is purpose of this change? If really needed, please do that in separate commit explaining why it is needed.

@nijel are you satisfied with this change?

I'd prefer to have the documentation in the code as well, not only in the commit message, but thanks for documenting this.

nijel · 2017-07-17T15:28:15Z

libraries/plugins/auth/AuthenticationCookie.php

+            PMA_secureSession();
+            $this->auth();
+        }
+        $check_2FA_db_query = 'SELECT `pma_user`, `secret` FROM `pma__2fa_secrets` WHERE `pma_user` LIKE \'' . $GLOBALS['PHP_AUTH_USER'] . '\';';


Please do not hardcode table name, see how others are handled.

Why using LIKE when doing exact match?

nijel · 2017-07-17T15:29:25Z

libraries/plugins/auth/AuthenticationCookie.php

+        }
+        $controllink = $GLOBALS['dbi']->connect(
+            DatabaseInterface::CONNECT_CONTROL
+        );


I think this can fail, so you should handle false return value here.

nijel · 2017-07-17T15:31:33Z

libraries/plugins/auth/AuthenticationCookie.php

+            $conn_error = $GLOBALS['dbi']->getError($controllink);
+            return false;
+        }
+        $check_2FA_db_query = 'SELECT `pma_user` FROM `pma__2fa_secrets` WHERE `pma_user` LIKE \'' . $GLOBALS['PHP_AUTH_USER'] . '\';';


Same as with auth2FA. Also these seem to share quite some amount of code, so you might want to factor that out.

nijel · 2017-07-17T15:31:53Z

setup2FA.php

+        if (isset($_REQUEST['logincheck']) && $_REQUEST['logincheck'] == 'true') {
+            $_SESSION['2FAVerified'] = true;
+        }
+        echo 'true';


nijel · 2017-07-17T15:32:04Z

setup2FA.php

+        }
+        echo 'true';
+    } else {
+        echo 'Sorry. The key does not match. Please ensure that server time and your app\'s time are in sync.' . $_SESSION['secret'];


Should be localized, also there is probably no point in showing the secret here. Especially not unescaped as it seems to be user input.

nijel · 2017-07-17T15:33:23Z

setup2FA.php

+    $response = PhpMyAdmin\Response::getInstance();
+    if (!$GLOBALS['dbi']->selectDb('phpmyadmin', $GLOBALS['controllink'])) {
+        $response->disable();
+        echo $GLOBALS['dbi']->getError($GLOBALS['controllink']);


In case you want to pass the error details to client, please use JSON. Definitely do not output unescaped error messages.

Achilles-96 · 2017-07-18T13:50:31Z

@nijel, I addressed most of the issues you raised. I left comments for the rest. Please verify.

Achilles-96 · 2017-07-18T13:51:15Z

setup2FA.php

+        $_SESSION['2FAVerified'] = true;
+        echo 'true';
+    } else {
+        echo htmlspecialchars('Sorry. The key does not match. Please ensure that server time and your app\'s time are in sync.');


By this time, translations may not be possible.

Could you please add a comment to the code as well stating that translations may not be possible?

~~Hmm, maybe this should be part of the setup script in the end (which we indeed do not localize)?~~

Edit: I think there is no reason why the localization wound not work here, why it doesn't work here? You should just include common.inc.php (what you should do anyway for authentication and CSRF protection) and localization will work.

Also it should probably display proper error message, not just plain text...

By this time, the user would not have been completely authenticated i.e., he/she is in the middle of authentication. Including common.inc.php is not possible because it will circularly check for 2-factor authentication again.

This part is accessed only by ajax request and the error message is displayed in standard PMA error dialog once received.

Maybe it would be better to closer integrate this to the authentication so that it can use the authentication API to show the form

Authentication form is shown by auth2FA function in AuthenticationCookie.php. This is for verification. Do you mean I should move verification to a different file.

ibennetch · 2017-07-18T15:07:14Z

setup2FA.php

+                echo htmlspecialchars($GLOBALS['dbi']->getError($GLOBALS['controllink']));
+                exit;
+            }
+            $add_secret_query = 'INSERT INTO ' . $cfg_2fa_table . ' VALUES (\'' . $GLOBALS['PHP_AUTH_USER'] . '\' ,\'' . $_SESSION['secret'] . '\');';


Forgive me if I missed you doing it earlier, but I think you need to escape PHP_AUTH_USER and secret here; you could use the Dbi function escapeString for that.

ibennetch · 2017-07-18T15:22:31Z

I tried opening my main phpMyAdmin after pulling your branch (without configuring any user for 2FA or setting up config.inc.php) and got a number of errors. We should be more graceful about failing if the user hasn't configured their system for this.

Error
SQL query: DocumentationEdit Edit

SELECT `pma_user` FROM `` WHERE `pma_user` = 'root';
MySQL said: Documentation

#1103 - Incorrect table name ''
Open new phpMyAdmin window
Notice in ./libraries/plugins/auth/AuthenticationCookie.php#570
Undefined index: 2fa_secrets

Backtrace

./libraries/plugins/auth/AuthenticationCookie.php#547: PMA\libraries\plugins\auth\AuthenticationCookie->check2FA()
./libraries/common.inc.php#656: PMA\libraries\plugins\auth\AuthenticationCookie->authCheck()
./index.php#22: require_once(./libraries/common.inc.php)
Warning in ./libraries/dbi/DBIMysqli.php#556
mysqli_real_escape_string() expects parameter 1 to be mysqli, boolean given

Backtrace

./libraries/dbi/DBIMysqli.php#556: mysqli_real_escape_string(
boolean false,
string '',
)
./libraries/classes/DatabaseInterface.php#2743: PMA\libraries\dbi\DBIMysqli->escapeString(
boolean false,
string '',
)
./libraries/navigation/nodes/Node.php#437: PhpMyAdmin\DatabaseInterface->escapeString(string '_')
./libraries/navigation/NavigationTree.php#289: PMA\libraries\navigation\nodes\Node->getData(
string 'databases',
integer 0,
string '',
)
./libraries/navigation/NavigationTree.php#847: PMA\libraries\navigation\NavigationTree->_buildPath()
./libraries/navigation/Navigation.php#45: PMA\libraries\navigation\NavigationTree->renderState()
./libraries/classes/Header.php#433: PMA\libraries\navigation\Navigation->getDisplay()
./libraries/classes/Response.php#266: PhpMyAdmin\Header->getDisplay()
./libraries/classes/Response.php#279: PhpMyAdmin\Response->_getDisplay()
./libraries/classes/Response.php#438: PhpMyAdmin\Response->_htmlResponse()
PhpMyAdmin\Response->response()
Warning in ./libraries/dbi/DBIMysqli.php#556
mysqli_real_escape_string() expects parameter 1 to be mysqli, boolean given

Backtrace

./libraries/dbi/DBIMysqli.php#556: mysqli_real_escape_string(
boolean false,
string '',
)
./libraries/classes/DatabaseInterface.php#2743: PMA\libraries\dbi\DBIMysqli->escapeString(
boolean false,
string '',
)
./libraries/navigation/nodes/Node.php#447: PhpMyAdmin\DatabaseInterface->escapeString(string '_')
./libraries/navigation/NavigationTree.php#289: PMA\libraries\navigation\nodes\Node->getData(
string 'databases',
integer 0,
string '',
)
./libraries/navigation/NavigationTree.php#847: PMA\libraries\navigation\NavigationTree->_buildPath()
./libraries/navigation/Navigation.php#45: PMA\libraries\navigation\NavigationTree->renderState()
./libraries/classes/Header.php#433: PMA\libraries\navigation\Navigation->getDisplay()
./libraries/classes/Response.php#266: PhpMyAdmin\Header->getDisplay()
./libraries/classes/Response.php#279: PhpMyAdmin\Response->_getDisplay()
./libraries/classes/Response.php#438: PhpMyAdmin\Response->_htmlResponse()
PhpMyAdmin\Response->response()
Warning in ./libraries/dbi/DBIMysqli.php#556
mysqli_real_escape_string() expects parameter 1 to be mysqli, boolean given

Backtrace

./libraries/dbi/DBIMysqli.php#556: mysqli_real_escape_string(
boolean false,
string '',
)
./libraries/classes/DatabaseInterface.php#2743: PMA\libraries\dbi\DBIMysqli->escapeString(
boolean false,
string '',
)
./libraries/navigation/nodes/Node.php#449: PhpMyAdmin\DatabaseInterface->escapeString(string '_')
./libraries/navigation/NavigationTree.php#289: PMA\libraries\navigation\nodes\Node->getData(
string 'databases',
integer 0,
string '',
)
./libraries/navigation/NavigationTree.php#847: PMA\libraries\navigation\NavigationTree->_buildPath()
./libraries/navigation/Navigation.php#45: PMA\libraries\navigation\NavigationTree->renderState()
./libraries/classes/Header.php#433: PMA\libraries\navigation\Navigation->getDisplay()
./libraries/classes/Response.php#266: PhpMyAdmin\Header->getDisplay()
./libraries/classes/Response.php#279: PhpMyAdmin\Response->_getDisplay()
./libraries/classes/Response.php#438: PhpMyAdmin\Response->_htmlResponse()
PhpMyAdmin\Response->response()

ibennetch · 2017-07-19T14:30:07Z

We'll have to deal gracefully with situations where the user either hasn't configured it or the table doesn't exist.

You can also see for instance libraries/classes/Bookmark.php:114 for an example of how we might deal with this. We have to test the array to make sure $cfgRelation['2fa_secret'] (or whatever configuration directive you use) isn't empty first, before trying to use it. We initialize it as part of the default configuration to an empty value, so before using we'll test if the user has configured it.

Also, you should add the new directive to libraries/config.default.php with a blank assignment such as $cfg['Servers'][$i]['2fa_secret'] = '';. You can add it right after the export_template area around line 503.

We should also add this new directive to libraries/relation.lib.php around line 353; this file is used by chk_rel.php which warns the user if their table structure is outdated.

Can you add the structure for the 2fa_secrets table to sql/create_tables.sql?

Instead of manually running the SQL, it might be more efficient to use PMA_queryAsControlUser such as

$sql_query
    = " SELECT `tables` FROM " . $this->_getPmaTable() .
    " WHERE `username` = '" . $GLOBALS['dbi']->escapeString($GLOBALS['cfg']['Server']['user']) . "'";
$result = PMA_queryAsControlUser($sql_query, false);

nijel · 2017-07-21T11:41:11Z

setup2FA.php

+use RobThree\Auth\Providers\Qr\IQRCodeProvider;
+use PHPQRCode;
+
+class PMAQRProvider implements IQRCodeProvider {


Can you please place the class to separate file and include tests for it?

ibennetch · 2017-08-23T01:09:00Z

Could you rebase this against current master to reflect the changes Maurício has done?

This is required because we start in setup2FA.php while checking for 2-factor authentication. session variable for accessing secret. We also need that libraries/common.inc.php should not be loaded by this time. Signed-off-by: Raghuram <raghuram.4350@gmail.com>

codecov · 2017-08-23T18:57:43Z

Codecov Report

Merging #13495 into master will decrease coverage by 0.2%.
The diff coverage is 2.09%.

@@            Coverage Diff             @@
##           master   #13495      +/-   ##
==========================================
- Coverage   53.17%   52.96%   -0.21%     
==========================================
  Files         468      470       +2     
  Lines       81619    81953     +334     
==========================================
+ Hits        43404    43410       +6     
- Misses      38215    38543     +328

Signed-off-by: Raghuram <raghuram.4350@gmail.com>

stale · 2017-10-23T06:39:49Z

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

Achilles-96 force-pushed the Add-2FA-support branch from 7677411 to c62bcbc Compare July 16, 2017 11:42

nijel suggested changes Jul 17, 2017

View reviewed changes

Achilles-96 force-pushed the Add-2FA-support branch 2 times, most recently from 474825f to 6238513 Compare July 18, 2017 13:48

Achilles-96 commented Jul 18, 2017

View reviewed changes

ibennetch reviewed Jul 18, 2017

View reviewed changes

ibennetch self-assigned this Jul 19, 2017

nijel reviewed Jul 21, 2017

View reviewed changes

Achilles-96 force-pushed the Add-2FA-support branch 5 times, most recently from 3ae9916 to d9934cc Compare July 22, 2017 20:41

Achilles-96 force-pushed the Add-2FA-support branch from d9934cc to 0c0648f Compare August 23, 2017 12:14

Achilles-96 force-pushed the Add-2FA-support branch from 0c0648f to d9d7bbe Compare August 23, 2017 12:34

Achilles-96 force-pushed the Add-2FA-support branch 2 times, most recently from c3b5a95 to 6087fe4 Compare August 24, 2017 06:38

Add 2-factor authentication support for phpMyAdmin.

6087fe4

Signed-off-by: Raghuram <raghuram.4350@gmail.com>

stale bot added the wontfix label Oct 23, 2017

stale bot closed this Oct 30, 2017

williamdes removed the wontfix label Dec 23, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add 2-factor authentication support for phpMyAdmin. #13495

Add 2-factor authentication support for phpMyAdmin. #13495

Achilles-96 commented Jul 16, 2017 •

edited

Loading

Achilles-96 commented Jul 16, 2017 •

edited

Loading

nijel left a comment

nijel Jul 17, 2017

nijel Jul 17, 2017

nijel Jul 17, 2017

ibennetch Aug 9, 2017

nijel Aug 9, 2017

nijel Jul 17, 2017

nijel Jul 17, 2017

nijel Jul 17, 2017

nijel Jul 17, 2017

nijel Jul 17, 2017

nijel Jul 17, 2017

Achilles-96 commented Jul 18, 2017

Achilles-96 Jul 18, 2017

ibennetch Jul 18, 2017

nijel Jul 21, 2017 •

edited

Loading

Achilles-96 Jul 22, 2017 •

edited

Loading

nijel Jul 24, 2017

Achilles-96 Jul 25, 2017

ibennetch Jul 18, 2017

ibennetch commented Jul 18, 2017 •

edited

Loading

ibennetch commented Jul 19, 2017

nijel Jul 21, 2017

ibennetch commented Aug 23, 2017

codecov bot commented Aug 23, 2017 •

edited

Loading

stale bot commented Oct 23, 2017

Add 2-factor authentication support for phpMyAdmin. #13495

Add 2-factor authentication support for phpMyAdmin. #13495

Conversation

Achilles-96 commented Jul 16, 2017 • edited Loading

Achilles-96 commented Jul 16, 2017 • edited Loading

nijel left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Achilles-96 commented Jul 18, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nijel Jul 21, 2017 • edited Loading

Choose a reason for hiding this comment

Achilles-96 Jul 22, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ibennetch commented Jul 18, 2017 • edited Loading

ibennetch commented Jul 19, 2017

Choose a reason for hiding this comment

ibennetch commented Aug 23, 2017

codecov bot commented Aug 23, 2017 • edited Loading

Codecov Report

stale bot commented Oct 23, 2017

Achilles-96 commented Jul 16, 2017 •

edited

Loading

Achilles-96 commented Jul 16, 2017 •

edited

Loading

nijel Jul 21, 2017 •

edited

Loading

Achilles-96 Jul 22, 2017 •

edited

Loading

ibennetch commented Jul 18, 2017 •

edited

Loading

codecov bot commented Aug 23, 2017 •

edited

Loading