From 1e6b740e6feace1a7be44a19a980477ce62fdded Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@cihar.com>
Date: Sat, 23 Jul 2016 08:59:02 +0200
Subject: [PATCH] Enable LOAD DATA LOCAL INFILE only when needed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There is no need to have this feature allowed for normal SQL queries, it
can lead to leaking sensitive files from the web server. It's enough to
enable it only in LDI import plugin, where we control what queries are
executed.

Signed-off-by: Michal Čihař <michal@cihar.com>
---
 import.php                  |  5 +++++
 libraries/dbi/DBIMysql.php  | 10 ++++++----
 libraries/dbi/DBIMysqli.php |  6 +++++-
 3 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/import.php b/import.php
index a43eff6b63..0e752c7851 100644
--- a/import.php
+++ b/import.php
@@ -7,6 +7,11 @@
  */
 use PMA\libraries\plugins\ImportPlugin;
 
+/* Enable LOAD DATA LOCAL INFILE for LDI plugin */
+if (isset($_POST['format']) && $_POST['format'] == 'ldi') {
+    define('PMA_ENABLE_LDI', 1);
+}
+
 /**
  * Get the variables sent or posted to this script and a core script
  */
diff --git a/libraries/dbi/DBIMysql.php b/libraries/dbi/DBIMysql.php
index f44b9bfa27..b5763df63a 100644
--- a/libraries/dbi/DBIMysql.php
+++ b/libraries/dbi/DBIMysql.php
@@ -124,10 +124,12 @@ class DBIMysql implements DBIExtension
 
         $client_flags = 0;
 
-        // always use CLIENT_LOCAL_FILES as defined in mysql_com.h
-        // for the case where the client library was not compiled
-        // with --enable-local-infile
-        $client_flags |= 128;
+        if (defined('PMA_ENABLE_LDI')) {
+            // use CLIENT_LOCAL_FILES as defined in mysql_com.h
+            // for the case where the client library was not compiled
+            // with --enable-local-infile
+            $client_flags |= 128;
+        }
 
         /* Optionally compress connection */
         if (defined('MYSQL_CLIENT_COMPRESS') && $cfg['Server']['compress']) {
diff --git a/libraries/dbi/DBIMysqli.php b/libraries/dbi/DBIMysqli.php
index 41d4665f9e..a1eabf40f7 100644
--- a/libraries/dbi/DBIMysqli.php
+++ b/libraries/dbi/DBIMysqli.php
@@ -138,7 +138,11 @@ class DBIMysqli implements DBIExtension
 
         $link = mysqli_init();
 
-        mysqli_options($link, MYSQLI_OPT_LOCAL_INFILE, true);
+        if (defined('PMA_ENABLE_LDI')) {
+            mysqli_options($link, MYSQLI_OPT_LOCAL_INFILE, true);
+        } else {
+            mysqli_options($link, MYSQLI_OPT_LOCAL_INFILE, false);
+        }
 
         $client_flags = 0;