diff --git a/ChangeLog b/ChangeLog index 973ef62d7a..5b3581417b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -28,7 +28,9 @@ phpMyAdmin - ChangeLog - issue #16197 Replace the master/slave terminology - issue #17257 Replace libraries/vendor_config.php constants with an array -5.1.3 (not yet released) +5.1.4 (not yet released) + +5.1.3 (2022-02-10) - issue #17308 Fix broken pagination links in the navigation sidebar - issue #17331 Fix MariaDB has no support for system variable "disabled_storage_engines" - issue #17315 Fix unsupported operand types in Results.php when running "SHOW PROCESSLIST" SQL query @@ -38,6 +40,7 @@ phpMyAdmin - ChangeLog - issue #17298 Fixed import of email-adresses or links from ODS results in empty contents - issue #17344 Fixed a type error on ODS import with non string values - issue #17239 Fixed header row show/hide columns buttons on each line after hover are shown on each row +- issue [security] Fix for path disclosure under certain server configurations (if display_errors is on, for instance) 5.1.2 (2022-01-20) - issue Replaced MySQL documentation redirected links diff --git a/doc/config.rst b/doc/config.rst index 87f891bd06..ae1515bd6e 100644 --- a/doc/config.rst +++ b/doc/config.rst @@ -174,6 +174,12 @@ Basic settings :type: string :default: ``'ask'`` + Valid values are: + + * ``ask`` + * ``always`` + * ``never`` + Sets the default behavior for JavaScript error reporting. Whenever an error is detected in the JavaScript execution, an error report @@ -266,7 +272,7 @@ Server connection settings .. seealso:: :config:option:`$cfg['Servers'][$i]['port']`, - + .. config:option:: $cfg['Servers'][$i]['port'] @@ -286,7 +292,7 @@ Server connection settings .. seealso:: :config:option:`$cfg['Servers'][$i]['host']`, - + .. config:option:: $cfg['Servers'][$i]['socket'] @@ -306,7 +312,7 @@ Server connection settings .. seealso:: :config:option:`$cfg['Servers'][$i]['host']`, - + .. config:option:: $cfg['Servers'][$i]['ssl'] @@ -325,6 +331,7 @@ Server connection settings :ref:`ssl`, :ref:`example-google-ssl`, + :ref:`example-aws-ssl`, :config:option:`$cfg['Servers'][$i]['ssl_key']`, :config:option:`$cfg['Servers'][$i]['ssl_cert']`, :config:option:`$cfg['Servers'][$i]['ssl_ca']`, @@ -350,6 +357,7 @@ Server connection settings :ref:`ssl`, :ref:`example-google-ssl`, + :ref:`example-aws-ssl`, :config:option:`$cfg['Servers'][$i]['ssl']`, :config:option:`$cfg['Servers'][$i]['ssl_cert']`, :config:option:`$cfg['Servers'][$i]['ssl_ca']`, @@ -369,6 +377,7 @@ Server connection settings :ref:`ssl`, :ref:`example-google-ssl`, + :ref:`example-aws-ssl`, :config:option:`$cfg['Servers'][$i]['ssl']`, :config:option:`$cfg['Servers'][$i]['ssl_key']`, :config:option:`$cfg['Servers'][$i]['ssl_ca']`, @@ -387,6 +396,7 @@ Server connection settings :ref:`ssl`, :ref:`example-google-ssl`, + :ref:`example-aws-ssl`, :config:option:`$cfg['Servers'][$i]['ssl']`, :config:option:`$cfg['Servers'][$i]['ssl_key']`, :config:option:`$cfg['Servers'][$i]['ssl_cert']`, @@ -405,6 +415,7 @@ Server connection settings :ref:`ssl`, :ref:`example-google-ssl`, + :ref:`example-aws-ssl`, :config:option:`$cfg['Servers'][$i]['ssl']`, :config:option:`$cfg['Servers'][$i]['ssl_key']`, :config:option:`$cfg['Servers'][$i]['ssl_cert']`, @@ -423,6 +434,7 @@ Server connection settings :ref:`ssl`, :ref:`example-google-ssl`, + :ref:`example-aws-ssl`, :config:option:`$cfg['Servers'][$i]['ssl']`, :config:option:`$cfg['Servers'][$i]['ssl_key']`, :config:option:`$cfg['Servers'][$i]['ssl_cert']`, @@ -461,6 +473,7 @@ Server connection settings :ref:`ssl`, :ref:`example-google-ssl`, + :ref:`example-aws-ssl`, :config:option:`$cfg['Servers'][$i]['ssl']`, :config:option:`$cfg['Servers'][$i]['ssl_key']`, :config:option:`$cfg['Servers'][$i]['ssl_cert']`, @@ -755,6 +768,8 @@ Server connection settings :type: string or false :default: ``''`` + .. versionadded:: 2.2.0 + Since release 2.2.0 phpMyAdmin allows users to bookmark queries. This can be useful for queries you often run. To allow the usage of this functionality: @@ -770,6 +785,8 @@ Server connection settings :type: string or false :default: ``''`` + .. versionadded:: 2.2.4 + Since release 2.2.4 you can describe, in a special 'relation' table, which column is a key in another table (a foreign key). phpMyAdmin currently uses this to: @@ -811,6 +828,8 @@ Server connection settings :type: string or false :default: ``''`` + .. versionadded:: 2.3.0 + Since release 2.3.0 you can describe, in a special 'table\_info' table, which column is to be displayed as a tool-tip when moving the cursor over the corresponding key. This configuration variable will @@ -845,6 +864,8 @@ Server connection settings :type: string or false :default: ``''`` + .. versionadded:: 2.3.0 + Since release 2.3.0 you can have phpMyAdmin create :term:`PDF` pages showing the relations between your tables. Further, the designer interface permits visually managing the relations. To do this it needs two tables @@ -887,6 +908,8 @@ Server connection settings :type: string or false :default: ``''`` + .. versionadded:: 2.3.0 + This part requires a content update! Since release 2.3.0 you can store comments to describe each column for each table. These will then be shown on the "printview". @@ -939,7 +962,7 @@ Server connection settings For auto-upgrade functionality to work, your :config:option:`$cfg['Servers'][$i]['controluser']` must have ALTER privilege on ``phpmyadmin`` database. See the `MySQL documentation for GRANT - `_ on how to + `_ on how to ``GRANT`` privileges to a user. .. _history: @@ -948,6 +971,8 @@ Server connection settings :type: string or false :default: ``''`` + .. versionadded:: 2.5.0 + Since release 2.5.0 you can store your :term:`SQL` history, which means all queries you entered manually into the phpMyAdmin interface. If you don't want to use a table-based history, you can use the JavaScript-based @@ -975,6 +1000,8 @@ Server connection settings :type: string or false :default: ``''`` + .. versionadded:: 3.5.0 + Since release 3.5.0 you can show recently used tables in the navigation panel. It helps you to jump across table directly, without the need to select the database, and then select the table. Using @@ -999,6 +1026,8 @@ Server connection settings :type: string or false :default: ``''`` + .. versionadded:: 4.2.0 + Since release 4.2.0 you can show a list of selected tables in the navigation panel. It helps you to jump to the table directly, without the need to select the database, and then select the table. When you @@ -1027,6 +1056,8 @@ Server connection settings :type: string or false :default: ``''`` + .. versionadded:: 3.5.0 + Since release 3.5.0 phpMyAdmin can be configured to remember several things (sorted column :config:option:`$cfg['RememberSorting']`, column order, and column visibility from a database table) for browsing tables. Without @@ -1055,6 +1086,8 @@ Server connection settings :type: string or false :default: ``''`` + .. versionadded:: 4.1.0 + Since release 4.1.0 you can create different user groups with menu items attached to them. Users can be assigned to these groups and the logged in user would only see menu items configured to the usergroup they are assigned to. @@ -1078,6 +1111,8 @@ Server connection settings :type: string or false :default: ``''`` + .. versionadded:: 4.1.0 + Since release 4.1.0 you can hide/show items in the navigation tree. To allow the usage of this functionality: @@ -1094,6 +1129,8 @@ Server connection settings :type: string or false :default: ``''`` + .. versionadded:: 4.3.0 + Since release 4.3.0 you can have a central list of columns per database. You can add/remove columns to the list as per your requirement. These columns in the central list will be available to use while you create a new column for @@ -1115,6 +1152,8 @@ Server connection settings :type: string or false :default: ``''`` + .. versionadded:: 4.5.0 + Since release 4.5.0 your designer settings can be remembered. Your choice regarding 'Angular/Direct Links', 'Snap to Grid', 'Toggle Relation Lines', 'Small/Big All', 'Move Menu' and 'Pin Text' can be remembered persistently. @@ -1133,6 +1172,8 @@ Server connection settings :type: string or false :default: ``''`` + .. versionadded:: 4.2.0 + Since release 4.2.0 you can save and load query-by-example searches from the Database > Query panel. To allow the usage of this functionality: @@ -1149,6 +1190,8 @@ Server connection settings :type: string or false :default: ``''`` + .. versionadded:: 4.5.0 + Since release 4.5.0 you can save and load export templates. To allow the usage of this functionality: @@ -1165,6 +1208,8 @@ Server connection settings :type: string or false :default: ``''`` + .. versionadded:: 3.3.x + Since release 3.3.x a tracking mechanism is available. It helps you to track every :term:`SQL` command which is executed by phpMyAdmin. The mechanism supports logging of data @@ -1225,7 +1270,7 @@ Server connection settings :type: boolean :default: true - Whether a DROP VIEW IF EXISTS statement will be added as first line to + Whether a `DROP VIEW IF EXISTS` statement will be added as first line to the log when creating a view. .. _tracking5: @@ -1234,7 +1279,7 @@ Server connection settings :type: boolean :default: true - Whether a DROP TABLE IF EXISTS statement will be added as first line + Whether a `DROP TABLE IF EXISTS` statement will be added as first line to the log when creating a table. .. _tracking6: @@ -1243,7 +1288,7 @@ Server connection settings :type: boolean :default: true - Whether a DROP DATABASE IF EXISTS statement will be added as first + Whether a `DROP DATABASE IF EXISTS` statement will be added as first line to the log when creating a database. .. _userconfig: @@ -1252,6 +1297,8 @@ Server connection settings :type: string or false :default: ``''`` + .. versionadded:: 3.4.x + Since release 3.4.x phpMyAdmin allows users to set most preferences by themselves and store them in the database. @@ -1288,7 +1335,7 @@ Server connection settings Sets the time zone used by phpMyAdmin. Leave blank to use the time zone of your database server. Possible values are explained at - https://dev.mysql.com/doc/refman/5.7/en/time-zone-support.html + https://dev.mysql.com/doc/refman/8.0/en/time-zone-support.html This is useful when your database server uses a time zone which is different from the time zone you want to use in phpMyAdmin. @@ -1550,7 +1597,7 @@ Generic settings .. config:option:: $cfg['ProxyUrl'] :type: string - :default: "" + :default: ``''`` The url of the proxy to be used when phpmyadmin needs to access the outside internet such as when retrieving the latest version info or submitting error @@ -1561,7 +1608,7 @@ Generic settings .. config:option:: $cfg['ProxyUser'] :type: string - :default: "" + :default: ``''`` The username for authenticating with the proxy. By default, no authentication is performed. If a username is supplied, Basic @@ -1571,7 +1618,7 @@ Generic settings .. config:option:: $cfg['ProxyPass'] :type: string - :default: "" + :default: ``''`` The password for authenticating with the proxy. @@ -1616,13 +1663,11 @@ Generic settings :default: false Whether `persistent connections `_ should be used or not. Works with - following extensions: + .persistent-connections.php>`_ should be used or not. - * mysql (`mysql\_pconnect `_), - * mysqli (requires PHP 5.3.0 or newer, `more information - `_). +.. seealso:: + + `mysqli documentation for persistent connections `_ .. config:option:: $cfg['ForceSSL'] @@ -2018,6 +2063,8 @@ Cookie authentication options reCaptcha will be then used in :ref:`cookie`. + .. versionadded:: 4.1.0 + .. config:option:: $cfg['CaptchaLoginPrivateKey'] :type: string @@ -2030,6 +2077,8 @@ Cookie authentication options reCaptcha will be then used in :ref:`cookie`. + .. versionadded:: 4.1.0 + .. config:option:: $cfg['CaptchaSiteVerifyURL'] :type: string @@ -2407,7 +2456,7 @@ Database structure :type: boolean :default: true - Defines whether the table structure actions are hidden under a "More" + Defines whether the table structure actions are hidden under a ":guilabel:`More`" drop-down. .. config:option:: $cfg['ShowColumnComments'] @@ -2451,7 +2500,7 @@ Browse mode :type: boolean :default: false - Defines whether a user should be displayed a "Show all" button in browse + Defines whether a user should be displayed a ":guilabel:`Show all`" button in browse mode or not in all cases. By default it is shown only on small tables (less than 500 rows) to avoid performance issues while getting too many rows. @@ -2461,8 +2510,8 @@ Browse mode :default: 25 Number of rows displayed when browsing a result set and no LIMIT - clause is used. If the result set contains more rows, "Previous" and - "Next" links will be shown. Possible values: 25,50,100,250,500. + clause is used. If the result set contains more rows, ":guilabel:`Previous`" and + ":guilabel:`Next`" links will be shown. Possible values: 25,50,100,250,500. .. config:option:: $cfg['Order'] @@ -3036,7 +3085,7 @@ Design customization This will define the first day of week in the calendar. The number can be set from 0 to 6, which represents the seven days of the week, Sunday to Saturday respectively. This value can also be configured by the user - in server settings -> features -> general -> First Day calendar field. + in :guilabel:`Settings` -> :guilabel:`Features` -> :guilabel:`General` -> :guilabel:`First day of calendar` field. Text fields ----------- @@ -3382,6 +3431,8 @@ Various display setting :type: boolean :default: false + .. versionadded:: 3.4.0 + Activates in the user preferences a tab containing options for developers of phpMyAdmin. @@ -3648,7 +3699,7 @@ Developer It currently changes following behavior: * There is welcome message on the main page. - * There is footer information about demo server and used git revision. + * There is footer information about demo server and used Git revision. * The setup script is enabled even with existing configuration. * The setup does not try to connect to the MySQL server. @@ -3706,7 +3757,7 @@ for a password when accessing remotely, you can achieve it using following snipp .. code-block:: php - if ($_SERVER["REMOTE_ADDR"] == "127.0.0.1") { + if ($_SERVER['REMOTE_ADDR'] === '127.0.0.1') { $cfg['Servers'][$i]['auth_type'] = 'config'; $cfg['Servers'][$i]['user'] = 'root'; $cfg['Servers'][$i]['password'] = 'yourpassword'; @@ -3728,8 +3779,8 @@ following example shows two of them: .. code-block:: php +.. _example-aws-ssl: + +Amazon RDS Aurora with SSL +++++++++++++++++++++++++++ + +To connect phpMyAdmin to an Amazon RDS Aurora MySQL database instance using SSL, +download the CA server certificate and tell phpMyAdmin to use it: + +.. code-block:: php + + // Address of your instance + $cfg['Servers'][$i]['host'] = 'replace-me-custer-name.cluster-replace-me-id.replace-me-region.rds.amazonaws.com'; + // Use SSL for connection + $cfg['Servers'][$i]['ssl'] = true; + // You need to have the region CA file and the authority CA file (2019 edition CA for example) in the PEM bundle for it to work + $cfg['Servers'][$i]['ssl_ca'] = '../rds-combined-ca-bundle.pem'; + // Enable SSL verification + $cfg['Servers'][$i]['ssl_verify'] = true; + +.. seealso:: + + :ref:`ssl`, + :config:option:`$cfg['Servers'][$i]['ssl']`, + :config:option:`$cfg['Servers'][$i]['ssl_ca']`, + :config:option:`$cfg['Servers'][$i]['ssl_verify']` + +.. seealso:: + + - Current RDS CA bundle for all regions https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem + - The RDS CA (2019 edition) for the region `eu-west-3` without the parent CA https://s3.amazonaws.com/rds-downloads/rds-ca-2019-eu-west-3.pem + - `List of available Amazon RDS CA files `_ + - `Amazon MySQL Aurora security guide `_ + - `Amazon certificates bundles per region `_ + reCaptcha using hCaptcha ++++++++++++++++++++++++ diff --git a/doc/setup.rst b/doc/setup.rst index 3df207e410..a2f918cb8d 100644 --- a/doc/setup.rst +++ b/doc/setup.rst @@ -1134,6 +1134,7 @@ you can use :config:option:`$cfg['MysqlSslWarningSafeHosts']` to explicitly list .. seealso:: :ref:`example-google-ssl`, + :ref:`example-aws-ssl`, :config:option:`$cfg['Servers'][$i]['ssl']`, :config:option:`$cfg['Servers'][$i]['ssl_key']`, :config:option:`$cfg['Servers'][$i]['ssl_cert']`, diff --git a/libraries/classes/ErrorHandler.php b/libraries/classes/ErrorHandler.php index 87d0b18d81..dc47230195 100644 --- a/libraries/classes/ErrorHandler.php +++ b/libraries/classes/ErrorHandler.php @@ -16,6 +16,7 @@ use function htmlspecialchars; use function set_error_handler; use function trigger_error; +use Throwable; use const E_COMPILE_ERROR; use const E_COMPILE_WARNING; use const E_CORE_ERROR; @@ -68,6 +69,7 @@ class ErrorHandler * rely on PHPUnit doing it's own error handling which we break here. */ if (! defined('TESTSUITE')) { + set_exception_handler([$this, 'handleException']); set_error_handler([$this, 'handleError']); } @@ -224,6 +226,22 @@ class ErrorHandler $this->addError($errstr, $errno, $errfile, $errline, true); } + /** + * Hides exception if it's not in the development environment. + * + * @throws Throwable + */ + public function handleException(Throwable $exception): void + { + $config = $GLOBALS['PMA_Config'] ?? null; + $environment = $config instanceof Config ? $config->get('environment') : 'production'; + if ($environment !== 'development') { + return; + } + + throw $exception; + } + /** * Add an error; can also be called directly (with or without escaping) * diff --git a/libraries/classes/Routing.php b/libraries/classes/Routing.php index 54d62e03fc..945f070aac 100644 --- a/libraries/classes/Routing.php +++ b/libraries/classes/Routing.php @@ -21,6 +21,7 @@ use function is_array; use function is_readable; use function is_writable; use function mb_strlen; +use function is_string; use function rawurldecode; use function sprintf; use function trigger_error; @@ -119,21 +120,25 @@ class Routing return @file_put_contents(self::ROUTES_CACHE_FILE, $cacheContents) !== false; } + /** + * @psalm-return non-empty-string + */ public static function getCurrentRoute(): string { - /** @var string $route */ $route = $_GET['route'] ?? $_POST['route'] ?? '/'; + if (! is_string($route) || $route === '') { + $route = '/'; + } /** * See FAQ 1.34. * * @see https://docs.phpmyadmin.net/en/latest/faq.html#faq1-34 */ - if (($route === '/' || $route === '') && isset($_GET['db']) && mb_strlen($_GET['db']) !== 0) { - $route = '/database/structure'; - if (isset($_GET['table']) && mb_strlen($_GET['table']) !== 0) { - $route = '/sql'; - } + $db = isset($_GET['db']) && is_string($_GET['db']) ? $_GET['db'] : ''; + if ($route === '/' && $db !== '') { + $table = isset($_GET['table']) && is_string($_GET['table']) ? $_GET['table'] : ''; + $route = $table === '' ? '/database/structure' : '/sql'; } return $route;