diff --git a/ChangeLog b/ChangeLog index 9f5f2443ff..4f901128dd 100644 --- a/ChangeLog +++ b/ChangeLog @@ -49,7 +49,7 @@ phpMyAdmin - ChangeLog - issue #12901 Use server returned table name on renaming table - issue #12918 Always use \r\n as newline when editing fields -4.6.6 (not yet released) +4.6.6 (2017-01-23) - issue #12759 Fix Notice regarding 'Undefined index: old_usergroup' - issue #12760 Fix Notice regarding 'Undefined index: users' - issue #12762 Fixed parsing of SQL with BINARY function @@ -87,7 +87,14 @@ phpMyAdmin - ChangeLog - issue #12881 Fix database search with newer php-gettext - issue #12894 Fix linter error on unterminated variable name - issue #12732 Fixed filtering for active processes - +- issue [security] Multiple vulnerabilities in setup script, see PMASA-2016-44. +- issue [security] Open redirect, see PMASA-2017-1. +- issue [security] php-gettext code execution, see PMASA-2017-2. +- issue [security] DOS vulnerabiltiy in table editing, see PMASA-2017-3. +- issue [security] CSS injection in themes, see PMASA-2017-4. +- issue [security] Cookie attribute injection attack, see PMASA-2017-5. +- issue [security] SSRF in replication, see PMASA-2017-6. +- issue [security] DOS in replication status, see PMASA-2017-7. --- Older ChangeLogs can be found on our project website --- https://www.phpmyadmin.net/old-stuff/ChangeLogs/ diff --git a/doc/setup.rst b/doc/setup.rst index 7ac546ed51..d5fb832c68 100644 --- a/doc/setup.rst +++ b/doc/setup.rst @@ -375,57 +375,13 @@ Using Setup script ------------------ Instead of manually editing :file:`config.inc.php`, you can use phpMyAdmin's -setup feature. First you must manually create a folder ``config`` -in the phpMyAdmin directory. This is a security measure. On a -Linux/Unix system you can use the following commands: - -.. code-block:: sh - - - cd phpMyAdmin - mkdir config # create directory for saving - chmod o+rw config # give it world writable permissions - -.. note:: - - Following documentation covers default behavior of phpMyAdmin. Some - distributions have changed this, please check following sections for - information on this topic. - -And to edit an existing configuration, copy it over first: - -.. code-block:: sh - - - cp config.inc.php config/ # copy current configuration for editing - chmod o+w config/config.inc.php # give it world writable permissions - -On other platforms, simply create the folder and ensure that your web -server has read and write access to it. :ref:`faq1_26` can help with -this. - -Next, open your browser and visit the location where you installed phpMyAdmin, with the ``/setup`` suffix. If you have an existing configuration, -use the ``Load`` button to bring its content inside the setup panel. -Note that **changes are not saved to disk until you explicitly choose ``Save``** -from the *Configuration* area of the screen. Normally the script saves the new -:file:`config.inc.php` to the ``config/`` directory, but if the webserver does -not have the proper permissions you may see the error "Cannot load or -save configuration." Ensure that the ``config/`` directory exists and -has the proper permissions - or use the ``Download`` link to save the -config file locally and upload it (via FTP or some similar means) to the -proper location. - -Once the file has been saved, it must be moved out of the ``config/`` -directory and the permissions must be reset, again as a security -measure: - -.. code-block:: sh - - - mv config/config.inc.php . # move file to current directory - chmod o-rw config.inc.php # remove world read and write permissions - rm -rf config # remove not needed directory +setup feature. The file can be generated using the setup and you can download it +for upload to the server. +Next, open your browser and visit the location where you installed phpMyAdmin, +with the ``/setup`` suffix. The changes are not saved to the server, you need to +use the :guilabel:`Download` button to save them to your computer and then upload +to the server. Now the file is ready to be used. You can choose to review or edit the file with your favorite editor, if you prefer to set some advanced diff --git a/libraries/Theme.php b/libraries/Theme.php index fad3820e90..0896473dcc 100644 --- a/libraries/Theme.php +++ b/libraries/Theme.php @@ -479,9 +479,6 @@ class Theme if (!is_null($fs)) { return $fs; } - if (isset($_COOKIE['pma_fontsize'])) { - return htmlspecialchars($_COOKIE['pma_fontsize']); - } return '82%'; } diff --git a/libraries/config/ConfigFile.php b/libraries/config/ConfigFile.php index 68683f4f23..5b8be33bcc 100644 --- a/libraries/config/ConfigFile.php +++ b/libraries/config/ConfigFile.php @@ -480,16 +480,6 @@ class ConfigFile } } - /** - * Returns config file path, relative to phpMyAdmin's root path - * - * @return string - */ - public function getFilePath() - { - return SETUP_CONFIG_FILE; - } - /** * Returns configuration array (full, multidimensional format) * diff --git a/libraries/config/PageSettings.php b/libraries/config/PageSettings.php index ff7784a69f..48a20aa704 100644 --- a/libraries/config/PageSettings.php +++ b/libraries/config/PageSettings.php @@ -114,7 +114,10 @@ class PageSettings $result = PMA_saveUserprefs($cf->getConfigArray()); if ($result === true) { // reload page - header('Location: ' . $_SERVER['REQUEST_URI']); + $response = Response::getInstance(); + PMA_sendHeaderLocation( + $response->getFooter()->getSelfUrl('unencoded') + ); exit(); } else { $error = $result; diff --git a/libraries/controllers/database/DatabaseStructureController.php b/libraries/controllers/database/DatabaseStructureController.php index 5439bde969..e8efd15e33 100644 --- a/libraries/controllers/database/DatabaseStructureController.php +++ b/libraries/controllers/database/DatabaseStructureController.php @@ -904,7 +904,7 @@ class DatabaseStructureController extends DatabaseController if ($this->db == PMA_extractDbOrTable($db_table) && preg_match( "@^" . - mb_substr(PMA_extractDbOrTable($db_table, 'table'), 0, -1) . "@", + preg_quote(mb_substr(PMA_extractDbOrTable($db_table, 'table'), 0, -1)) . "@", $truename ) ) { diff --git a/libraries/core.lib.php b/libraries/core.lib.php index 183b42cd93..90e1555ed5 100644 --- a/libraries/core.lib.php +++ b/libraries/core.lib.php @@ -873,6 +873,10 @@ function PMA_cleanupPathInfo() } $_PATH_INFO = PMA_getenv('PATH_INFO'); if (! empty($_PATH_INFO) && ! empty($PMA_PHP_SELF)) { + $question_pos = mb_strpos($PMA_PHP_SELF, '?'); + if ($question_pos != false) { + $PMA_PHP_SELF = mb_substr($PMA_PHP_SELF, 0, $question_pos); + } $path_info_pos = mb_strrpos($PMA_PHP_SELF, $_PATH_INFO); if ($path_info_pos !== false) { $path_info_part = mb_substr($PMA_PHP_SELF, $path_info_pos, mb_strlen($_PATH_INFO)); @@ -881,7 +885,24 @@ function PMA_cleanupPathInfo() } } } - $PMA_PHP_SELF = htmlspecialchars($PMA_PHP_SELF); + + $path = []; + foreach(explode('/', $PMA_PHP_SELF) as $part) { + // ignore parts that have no value + if (empty($part) || $part === '.') continue; + + if ($part !== '..') { + // cool, we found a new part + array_push($path, $part); + } else if (count($path) > 0) { + // going back up? sure + array_pop($path); + } + // Here we intentionall ignore case where we go too up + // as there is nothing sane to do + } + + $PMA_PHP_SELF = htmlspecialchars('/' . join('/', $path)); } /** diff --git a/libraries/navigation/NavigationTree.php b/libraries/navigation/NavigationTree.php index 5767479236..6bd1bcf5ec 100644 --- a/libraries/navigation/NavigationTree.php +++ b/libraries/navigation/NavigationTree.php @@ -174,10 +174,13 @@ class NavigationTree * @todo describe a scenario where this code is executed */ if (!$GLOBALS['cfg']['Server']['DisableIS']) { + $dbSeparator = $GLOBALS['dbi']->escapeString( + $GLOBALS['cfg']['NavigationTreeDbSeparator'] + ); $query = "SELECT (COUNT(DB_first_level) DIV %d) * %d "; $query .= "from ( "; $query .= " SELECT distinct SUBSTRING_INDEX(SCHEMA_NAME, "; - $query .= " '" . $GLOBALS['dbi']->escapeString($GLOBALS['cfg']['NavigationTreeDbSeparator']) . "', 1) "; + $query .= " '%s', 1) "; $query .= " DB_first_level "; $query .= " FROM INFORMATION_SCHEMA.SCHEMATA "; $query .= " WHERE `SCHEMA_NAME` < '%s' "; @@ -188,6 +191,7 @@ class NavigationTree $query, (int)$GLOBALS['cfg']['FirstLevelNavigationItems'], (int)$GLOBALS['cfg']['FirstLevelNavigationItems'], + $dbSeparator, $GLOBALS['dbi']->escapeString($GLOBALS['db']) ) ); diff --git a/libraries/navigation/nodes/Node.php b/libraries/navigation/nodes/Node.php index f265fca288..c5ee89d9d8 100644 --- a/libraries/navigation/nodes/Node.php +++ b/libraries/navigation/nodes/Node.php @@ -424,7 +424,9 @@ class Node return $retval; } - $dbSeparator = $GLOBALS['cfg']['NavigationTreeDbSeparator']; + $dbSeparator = $GLOBALS['dbi']->escapeString( + $GLOBALS['cfg']['NavigationTreeDbSeparator'] + ); if (isset($GLOBALS['cfg']['Server']['DisableIS']) && !$GLOBALS['cfg']['Server']['DisableIS'] ) { @@ -434,7 +436,7 @@ class Node $query .= "SELECT DB_first_level "; $query .= "FROM ( "; $query .= "SELECT DISTINCT SUBSTRING_INDEX(SCHEMA_NAME, "; - $query .= "'" . $GLOBALS['dbi']->escapeString($dbSeparator) . "', 1) "; + $query .= "'%s', 1) "; $query .= "DB_first_level "; $query .= "FROM INFORMATION_SCHEMA.SCHEMATA "; $query .= $this->_getWhereClause('SCHEMA_NAME', $searchClause); @@ -444,11 +446,19 @@ class Node $query .= ") t2 "; $query .= $this->_getWhereClause('SCHEMA_NAME', $searchClause); $query .= "AND 1 = LOCATE(CONCAT(DB_first_level, "; - $query .= "'" . $GLOBALS['dbi']->escapeString($dbSeparator) . "'), "; + $query .= "'%s'), "; $query .= "CONCAT(SCHEMA_NAME, "; - $query .= "'" . $GLOBALS['dbi']->escapeString($dbSeparator) . "')) "; + $query .= "'%s')) "; $query .= "ORDER BY SCHEMA_NAME ASC"; - $retval = $GLOBALS['dbi']->fetchResult($query); + + $retval = $GLOBALS['dbi']->fetchResult( + sprintf( + $query, + $dbSeparator, + $dbSeparator, + $dbSeparator + ) + ); return $retval; } diff --git a/libraries/replication_gui.lib.php b/libraries/replication_gui.lib.php index 89a88a3ba2..88f83fcde7 100644 --- a/libraries/replication_gui.lib.php +++ b/libraries/replication_gui.lib.php @@ -900,7 +900,10 @@ function PMA_handleControlRequest() $messageSuccess = null; $messageError = null; - if (isset($_REQUEST['slave_changemaster'])) { + if (isset($_REQUEST['slave_changemaster']) && ! $GLOBALS['cfg']['AllowArbitraryServer']) { + $_SESSION['replication']['sr_action_status'] = 'error'; + $_SESSION['replication']['sr_action_info'] = __('Connection to server is disabled, please enable $cfg[\'AllowArbitraryServer\'] in phpMyAdmin configuration.'); + } elseif (isset($_REQUEST['slave_changemaster'])) { $result = PMA_handleRequestForSlaveChangeMaster(); } elseif (isset($_REQUEST['sr_slave_server_control'])) { $result = PMA_handleRequestForSlaveServerControl(); diff --git a/libraries/vendor_config.php b/libraries/vendor_config.php index cafdc9bbc1..e07aaf1fe4 100644 --- a/libraries/vendor_config.php +++ b/libraries/vendor_config.php @@ -25,17 +25,6 @@ define('CHANGELOG_FILE', './ChangeLog'); */ define('LICENSE_FILE', './LICENSE'); -/** - * Path to config file generated using setup script. - */ -define('SETUP_CONFIG_FILE', './config/config.inc.php'); - -/** - * Whether setup requires writable directory where config - * file will be generated. - */ -define('SETUP_DIR_WRITABLE', true); - /** * Directory where SQL scripts to create/upgrade configuration storage reside. */ diff --git a/setup/config.php b/setup/config.php index 4145e4279a..3bc5d56a58 100644 --- a/setup/config.php +++ b/setup/config.php @@ -16,28 +16,9 @@ require './lib/common.inc.php'; require './libraries/config/setup.forms.php'; -/** - * Loads configuration file path - * - * Do this in a function to avoid messing up with global $cfg - * - * @param string $config_file_path - * - * @return array - */ -function loadConfig($config_file_path) -{ - $cfg = array(); - if (file_exists($config_file_path)) { - include $config_file_path; - } - return $cfg; -} - $form_display = new FormDisplay($GLOBALS['ConfigFile']); $form_display->registerForm('_config.php', $forms['_config.php']); $form_display->save('_config.php'); -$config_file_path = $GLOBALS['ConfigFile']->getFilePath(); if (isset($_POST['eol'])) { $_SESSION['eol'] = ($_POST['eol'] == 'unix') ? 'unix' : 'win'; @@ -59,40 +40,6 @@ if (PMA_ifSetOr($_POST['submit_clear'], '')) { PMA_downloadHeader('config.inc.php', 'text/plain'); echo ConfigGenerator::getConfigFile($GLOBALS['ConfigFile']); exit; -} elseif (PMA_ifSetOr($_POST['submit_save'], '')) { - // - // Save generated config file on the server - // - $result = @file_put_contents( - $config_file_path, - ConfigGenerator::getConfigFile($GLOBALS['ConfigFile']) - ); - if ($result === false) { - $state = 'config_not_saved'; - } else { - $state = 'config_saved'; - } - header('HTTP/1.1 303 See Other'); - header('Location: index.php' . URL::getCommonRaw() . '&action_done=' . $state); - exit; -} elseif (PMA_ifSetOr($_POST['submit_load'], '')) { - // - // Load config file from the server - // - $GLOBALS['ConfigFile']->setConfigData( - loadConfig($config_file_path) - ); - header('HTTP/1.1 303 See Other'); - header('Location: index.php' . URL::getCommonRaw()); - exit; -} elseif (PMA_ifSetOr($_POST['submit_delete'], '')) { - // - // Delete config file on the server - // - @unlink($config_file_path); - header('HTTP/1.1 303 See Other'); - header('Location: index.php' . URL::getCommonRaw()); - exit; } else { // // Show generated config file in a