From 1b939fb3d3640d3bfe9fac6e023ae74cfc28862c Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Wed, 25 Feb 2015 13:22:25 +0530 Subject: [PATCH] rfe #1441 Add regexp match when using AllowArbitraryServer Signed-off-by: Madhura Jayaratne --- doc/config.rst | 14 +++++++++++-- libraries/config.default.php | 8 ++++++++ libraries/config/ServerConfigChecks.class.php | 7 +++++-- libraries/config/messages.inc.php | 6 ++++++ libraries/config/setup.forms.php | 1 + .../auth/AuthenticationCookie.class.php | 20 ++++++++++++++++++- 6 files changed, 51 insertions(+), 5 deletions(-) diff --git a/doc/config.rst b/doc/config.rst index 26e0739d55..ebe71a7763 100644 --- a/doc/config.rst +++ b/doc/config.rst @@ -1384,8 +1384,18 @@ Cookie authentication options .. note:: Please use this carefully, as this may allow users access to MySQL servers - behind the firewall where your :term:`HTTP` - server is placed. + behind the firewall where your :term:`HTTP` server is placed. + See also :config:option:`$cfg['ArbitraryServerRegexp']`. + +.. config:option:: $cfg['ArbitraryServerRegexp'] + + :type: string + :default: ``''`` + + Restricts the MySQL servers to which the user can log in when + :config:option:`$cfg['AllowArbitraryServer']` is enabled by + matching the :term:`IP` or the hostname of the MySQL server + to the given regular expression. .. config:option:: $cfg['CaptchaLoginPublicKey'] diff --git a/libraries/config.default.php b/libraries/config.default.php index 817ac73869..3542577111 100644 --- a/libraries/config.default.php +++ b/libraries/config.default.php @@ -808,6 +808,14 @@ $cfg['IgnoreMultiSubmitErrors'] = false; */ $cfg['AllowArbitraryServer'] = false; +/** + * restrict by IP (with regular expression) the MySQL servers the user can enter + * when $cfg['AllowArbitraryServer'] = true + * + * @global string $cfg['ArbitraryServerRegexp'] + */ +$cfg['ArbitraryServerRegexp'] = ''; + /** * if reCaptcha is enabled it needs public key to connect with the service * diff --git a/libraries/config/ServerConfigChecks.class.php b/libraries/config/ServerConfigChecks.class.php index 6612a76aa9..5315797083 100644 --- a/libraries/config/ServerConfigChecks.class.php +++ b/libraries/config/ServerConfigChecks.class.php @@ -368,11 +368,14 @@ class ServerConfigChecks */ protected static function defineMessages() { - $sAllowArbitraryServerWarn = __('This %soption%s should be disabled as it allows attackers to bruteforce login to any MySQL server. If you feel this is necessary, use %strusted proxies list%s. However, IP-based protection may not be reliable if your IP belongs to an ISP where thousands of users, including you, are connected to.'); + $sAllowArbitraryServerWarn = __('This %soption%s should be disabled as it allows attackers to bruteforce login to any MySQL server. If you feel this is necessary, use %srestrict login to MySQL server%s or %strusted proxies list%s. However, IP-based protection with trusted proxies list may not be reliable if your IP belongs to an ISP where thousands of users, including you, are connected to.'); $sAllowArbitraryServerWarn = sprintf( $sAllowArbitraryServerWarn, '[a@?page=form&formset=Features#tab_Security]', - '[/a]', '[a@?page=form&formset=Features#tab_Security]', + '[/a]', + '[a@?page=form&formset=Features#tab_Security]', + '[/a]', + '[a@?page=form&formset=Features#tab_Security]', '[/a]' ); $sBlowfishSecretMsg = __('You didn\'t have blowfish secret set and have enabled [kbd]cookie[/kbd] authentication, so a key was automatically generated for you. It is used to encrypt cookies; you don\'t need to remember it.'); diff --git a/libraries/config/messages.inc.php b/libraries/config/messages.inc.php index a4c219882b..b9654e61ba 100644 --- a/libraries/config/messages.inc.php +++ b/libraries/config/messages.inc.php @@ -17,6 +17,12 @@ if (!function_exists('__')) { $strConfigAllowArbitraryServer_desc = __('If enabled, user can enter any MySQL server in login form for cookie auth.'); $strConfigAllowArbitraryServer_name = __('Allow login to any MySQL server'); +$strConfigArbitraryServerRegexp_desc = __( + 'Restricts the MySQL servers the user can enter when login to an arbitrary ' + . 'MySQL server is enabled by matching the IP of the MySQL server to the given ' + . 'regular expression.' +); +$strConfigArbitraryServerRegexp_name = __('Restrict login to MySQL server'); $strConfigAllowThirdPartyFraming_desc = __( 'Enabling this allows a page located on a different domain to call phpMyAdmin ' . 'inside a frame, and is a potential [strong]security hole[/strong] allowing ' diff --git a/libraries/config/setup.forms.php b/libraries/config/setup.forms.php index fa22ba0bc8..1409066982 100644 --- a/libraries/config/setup.forms.php +++ b/libraries/config/setup.forms.php @@ -108,6 +108,7 @@ $forms['Features']['Security'] = array( 'TrustedProxies', 'AllowUserDropDatabase', 'AllowArbitraryServer', + 'ArbitraryServerRegexp', 'LoginCookieRecall', 'LoginCookieValidity', 'LoginCookieStore', diff --git a/libraries/plugins/auth/AuthenticationCookie.class.php b/libraries/plugins/auth/AuthenticationCookie.class.php index bd134ca402..94e24f7933 100644 --- a/libraries/plugins/auth/AuthenticationCookie.class.php +++ b/libraries/plugins/auth/AuthenticationCookie.class.php @@ -406,6 +406,24 @@ class AuthenticationCookie extends AuthenticationPlugin if ($GLOBALS['cfg']['AllowArbitraryServer'] && isset($_REQUEST['pma_servername']) ) { + if ($GLOBALS['cfg']['ArbitraryServerRegexp']) { + $parts = explode(' ', $_REQUEST['pma_servername']); + if (count($parts) == 2) { + $tmp_host = $parts[0]; + } else { + $tmp_host = $_REQUEST['pma_servername']; + } + + $match = preg_match( + $GLOBALS['cfg']['ArbitraryServerRegexp'], $tmp_host + ); + if (! $match) { + $conn_error = __( + 'You are not allowed to log in to this MySQL server!' + ); + return false; + } + } $GLOBALS['pma_auth_server'] = $_REQUEST['pma_servername']; } return true; @@ -847,7 +865,7 @@ class AuthenticationCookie extends AuthenticationPlugin * * @param string $password New password to set * - * @return void + * @return void */ public function handlePasswordChange($password) {