security - Fix - 2FA/U2F can be disabled without any code change

Signed-off-by: William Desportes <williamdes@wdes.fr>

1 files changed, 16 insertions, 11 deletions

diff --git a/libraries/classes/DatabaseInterface.php b/libraries/classes/DatabaseInterface.php
index 47e1946c89..7ab5d754fb 100644
--- a/libraries/classes/DatabaseInterface.php
+++ b/libraries/classes/DatabaseInterface.php
@@ -1563,17 +1563,22 @@ class DatabaseInterface
      */
     public function initRelationParamsCache()
     {
-        if (strlen($GLOBALS['db'])) {
-            $cfgRelation = $this->relation->getRelationsParam();
-            if (empty($cfgRelation['db'])) {
-                $this->relation->fixPmaTables($GLOBALS['db'], false);
-            }
-        }
-        $cfgRelation = $this->relation->getRelationsParam();
-        if (empty($cfgRelation['db']) && isset($GLOBALS['dblist'])) {
-            if ($GLOBALS['dblist']->databases->exists('phpmyadmin')) {
-                $this->relation->fixPmaTables('phpmyadmin', false);
-            }
+        $storageDbName = $GLOBALS['cfg']['Server']['pmadb'] ?? '';
+        // Use "phpmyadmin" as a default database name to check to keep the behavior consistent
+        $storageDbName = $storageDbName !== null
+                            && is_string($storageDbName)
+                            && $storageDbName !== '' ? $storageDbName : 'phpmyadmin';
+
+        // This will make users not having explicitly listed databases
+        // have config values filled by the default phpMyAdmin storage table name values
+        $this->relation->fixPmaTables($storageDbName, false);
+
+        // This global will be changed if fixPmaTables did find one valid table
+        $storageDbName = $GLOBALS['cfg']['Server']['pmadb'] ?? '';
+
+        // Empty means that until now no pmadb was found eligible
+        if (empty($storageDbName)) {
+            $this->relation->fixPmaTables($GLOBALS['db'], false);
         }
     }