Merge remote-tracking branch 'origin/master'

doc/config.rst

@@ -1384,8 +1384,18 @@ Cookie authentication options
     .. note::
 
         Please use this carefully, as this may allow users access to MySQL servers
-        behind the firewall where your :term:`HTTP`
-        server is placed.
+        behind the firewall where your :term:`HTTP` server is placed.
+        See also :config:option:`$cfg['ArbitraryServerRegexp']`.
+
+.. config:option:: $cfg['ArbitraryServerRegexp']
+
+    :type: string
+    :default: ``''``
+
+    Restricts the MySQL servers to which the user can log in when
+    :config:option:`$cfg['AllowArbitraryServer']` is enabled by
+    matching the :term:`IP` or the hostname of the MySQL server
+    to the given regular expression.
 
 .. config:option:: $cfg['CaptchaLoginPublicKey']
 

libraries/config.default.php

@@ -808,6 +808,14 @@ $cfg['IgnoreMultiSubmitErrors'] = false;
  */
 $cfg['AllowArbitraryServer'] = false;
 
+/**
+ * restrict by IP (with regular expression) the MySQL servers the user can enter
+ * when $cfg['AllowArbitraryServer'] = true
+ *
+ * @global string $cfg['ArbitraryServerRegexp']
+ */
+$cfg['ArbitraryServerRegexp'] = '';
+
 /**
  * if reCaptcha is enabled it needs public key to connect with the service
  *

libraries/config/ServerConfigChecks.class.php

@@ -368,11 +368,14 @@ class ServerConfigChecks
      */
     protected static function defineMessages()
     {
-        $sAllowArbitraryServerWarn = __('This %soption%s should be disabled as it allows attackers to bruteforce login to any MySQL server. If you feel this is necessary, use %strusted proxies list%s. However, IP-based protection may not be reliable if your IP belongs to an ISP where thousands of users, including you, are connected to.');
+        $sAllowArbitraryServerWarn = __('This %soption%s should be disabled as it allows attackers to bruteforce login to any MySQL server. If you feel this is necessary, use %srestrict login to MySQL server%s or %strusted proxies list%s. However, IP-based protection with trusted proxies list may not be reliable if your IP belongs to an ISP where thousands of users, including you, are connected to.');
         $sAllowArbitraryServerWarn = sprintf(
             $sAllowArbitraryServerWarn,
             '[a@?page=form&formset=Features#tab_Security]',
-            '[/a]', '[a@?page=form&formset=Features#tab_Security]',
+            '[/a]',
+            '[a@?page=form&formset=Features#tab_Security]',
+            '[/a]',
+            '[a@?page=form&formset=Features#tab_Security]',
             '[/a]'
         );
         $sBlowfishSecretMsg = __('You didn\'t have blowfish secret set and have enabled [kbd]cookie[/kbd] authentication, so a key was automatically generated for you. It is used to encrypt cookies; you don\'t need to remember it.');

libraries/config/messages.inc.php

@@ -17,6 +17,12 @@ if (!function_exists('__')) {
 $strConfigAllowArbitraryServer_desc
     = __('If enabled, user can enter any MySQL server in login form for cookie auth.');
 $strConfigAllowArbitraryServer_name = __('Allow login to any MySQL server');
+$strConfigArbitraryServerRegexp_desc = __(
+    'Restricts the MySQL servers the user can enter when login to an arbitrary '
+    . 'MySQL server is enabled by matching the IP of the MySQL server to the given '
+    . 'regular expression.'
+);
+$strConfigArbitraryServerRegexp_name = __('Restrict login to MySQL server');
 $strConfigAllowThirdPartyFraming_desc = __(
     'Enabling this allows a page located on a different domain to call phpMyAdmin '
     . 'inside a frame, and is a potential [strong]security hole[/strong] allowing '

libraries/config/setup.forms.php

@@ -108,6 +108,7 @@ $forms['Features']['Security'] = array(
     'TrustedProxies',
     'AllowUserDropDatabase',
     'AllowArbitraryServer',
+    'ArbitraryServerRegexp',
     'LoginCookieRecall',
     'LoginCookieValidity',
     'LoginCookieStore',

libraries/plugins/auth/AuthenticationCookie.class.php

@@ -406,6 +406,24 @@ class AuthenticationCookie extends AuthenticationPlugin
             if ($GLOBALS['cfg']['AllowArbitraryServer']
                 && isset($_REQUEST['pma_servername'])
             ) {
+                if ($GLOBALS['cfg']['ArbitraryServerRegexp']) {
+                    $parts = explode(' ', $_REQUEST['pma_servername']);
+                    if (count($parts) == 2) {
+                        $tmp_host = $parts[0];
+                    } else {
+                        $tmp_host = $_REQUEST['pma_servername'];
+                    }
+
+                    $match = preg_match(
+                        $GLOBALS['cfg']['ArbitraryServerRegexp'], $tmp_host
+                    );
+                    if (! $match) {
+                        $conn_error = __(
+                            'You are not allowed to log in to this MySQL server!'
+                        );
+                        return false;
+                    }
+                }
                 $GLOBALS['pma_auth_server'] = $_REQUEST['pma_servername'];
             }
             return true;
@@ -847,7 +865,7 @@ class AuthenticationCookie extends AuthenticationPlugin
      *
      * @param string $password New password to set
      *
-     * @return void 
+     * @return void
      */
     public function handlePasswordChange($password)
     {