phpMyAdmin

"since the config.inc.php now is always loaded there is no need to have
*any* static config data in the session file at all (IMHO)"

yes, this is what I meant in my message "we could avoid storing in session
everything that is in config"

sorry,
ignore my last post regarding "blowfish" - I only examined the $_SESSION -
Array, not the file.

>for example we have to get the blowfish secret from somewhere,
>now that it's no longer in the session data

hmm,
the blowfish secret is still in the session file when you are on the
welcome/login page ...

since the config.inc.php now is always loaded there is no need to have
*any* static config data in the session file at all (IMHO)

We have not yet found a way to avoid this reloading (for example we have
to get the blowfish secret from somewhere, now that it's no longer in the
session data).

With more code changes, now we could avoid storing in session everything
that is in config, to keep only temporary data in session.

ok,
issue fixed but now config.inc.php seems to be read and stored in the
session on each and every page loading (like in the old days) - is this
intended/inevitable?

Thanks Jim,
new file uploaded with correct name and comments inside.
File Added: sensitive.diff

Marc,

I used your patch as guidance to modify phpMyAdmin 2.10.1 files. It works
fine.

Thanks.

Jim

BTW, the english word is sensitive (of a highly secret or delicate
nature), not sensible (having good sense or sound judgment). It's a great
patch by any name.

Yesterday I proposed a patch to the dev team, to remove this sensible data
from the session. I am waiting for their feedback. I am attaching the patch
here.
File Added: sensible.diff

What did you decide?

Jim

I marked this support request as private, we'll discuss it and come back
to you.
The old identified problem was about storing user and password in cookies
and this was solved a long time ago by using encryption with the blowfish
algorith, but you are right about the password being in clear in session
data.