From 07b0f092321dd9801e4da773a168b04efca4b1c1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@cihar.com>
Date: Mon, 26 Sep 2016 13:35:41 +0200
Subject: [PATCH] Clarify documentation on ArbitraryServerRegexp
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- recommend using start/end of string in regexp
- add examples
- add note mentioning port inclusion in the match
- fixes #12511

Signed-off-by: Michal Čihař <michal@cihar.com>
---
 ChangeLog      |  1 +
 doc/config.rst | 24 ++++++++++++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index 2f469510ad..e9e43ffc13 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -44,6 +44,7 @@ phpMyAdmin - ChangeLog
 - issue #12382 Bug in zoom search
 - issue #12321 Assign LIMIT clause only to syntactically correct queries
 - issue #12461 Can't Execute SQL With Sub-Query Due To "LIMIT 0,25" Inserted At Wrong Place
+- issue #12511 Clarify documentation on ArbitraryServerRegexp
 
 4.6.4 (2016-08-16)
 - issue        [security] Weaknesses with cookie encryption, see PMASA-2016-29
diff --git a/doc/config.rst b/doc/config.rst
index b9534ac22f..9ea10df8f4 100644
--- a/doc/config.rst
+++ b/doc/config.rst
@@ -1547,6 +1547,30 @@ Cookie authentication options
     to the given regular expression. The regular expression must be enclosed
     with a delimiter character.
 
+    It is recommended to include start and end symbols in the regullar
+    expression, so that you can avoid partial matches on the string.
+
+    **Examples:**
+
+    .. code-block:: php
+
+        // Allow connection to three listed servers:
+        $cfg['ArbitraryServerRegexp'] = '/^(server|another|yetdifferent)$/'; 
+
+        // Allow connection to range of IP addresses:
+        $cfg['ArbitraryServerRegexp'] = '@^192.168.0.[0-9]{1,}$@';
+
+        // Allow connection to server name ending with -mysql:
+        $cfg['ArbitraryServerRegexp'] = '@^[^:]\-mysql$@';
+
+    .. note::
+
+        The whole server name is matched, it can include port as well. Due to
+        way MySQL is permissive in connection parameters, it is possible to use
+        connection strings as ```server:3306-mysql```. This can be used to
+        bypass regullar expression by the suffix, while connecting to another
+        server.
+
 .. config:option:: $cfg['CaptchaLoginPublicKey']
 
     :type: string