gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/QA_3_5'

Browse Source
This commit is contained in:
Michal Čihař 2012-02-13 13:25:10 +01:00
commit b31a42509e
2 changed files with 38 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
Documentation.html
View File

@ -312,7 +312,7 @@ rm -rf config # remove not needed directory
authentication mode.</li>
<li>You should deny access to the <tt>./libraries</tt> and
<tt>./setup/lib</tt> subfolders in your webserver configuration. For
Apache you can use supplied .htaccess file in that folder, for other
Apache you can use supplied <a href="#glossary"><i>.htaccess</i></a> file in that folder, for other
webservers, you should configure this yourself. Such configuration
prevents from possible path exposure and cross side scripting
vulnerabilities that might happen to be found in that code.</li>
@ -320,9 +320,8 @@ rm -rf config # remove not needed directory
It is generally good idea to protect public phpMyAdmin installation
against access by robots as they usually can not do anything good
there. You can do this using <code>robots.txt</code> file in root of
your webserver or limit access by web server configuration. You can
find example <code>.htaccess</code> file which can help you achieve
this in <code>contrib</code> directory in phpMyAdmin.
your webserver or limit access by web server configuration, see
<a href="#faq1_42">FAQ 1.42</a>.
</li>
</ol>
@ -480,7 +479,7 @@ GRANT ALL PRIVILEGES ON user_base.* TO 'real_user'@localhost IDENTIFIED BY 'real
1.35</a>.</li>
<li>See also <a href="#faq4_4">
<abbr title="Frequently Asked Questions">FAQ</abbr> 4.4</a> about not
using the <i>.htaccess</i> mechanism along with
using the <a href="#glossary"><i>.htaccess</i></a> mechanism along with
'<abbr title="HyperText Transfer Protocol">HTTP</abbr>' authentication
mode.</li>
</ul>
@ -538,7 +537,7 @@ GRANT ALL PRIVILEGES ON user_base.* TO 'real_user'@localhost IDENTIFIED BY 'real
<li>Unlike cookie and http, does not require a user to log in when first
loading the phpMyAdmin site. This is by design but could allow any
user to access your installation. Use of some restriction method is
suggested, perhaps a <a href="#glossary">.htaccess</a> file with the
suggested, perhaps a <a href="#glossary"><i>.htaccess</i></a> file with the
HTTP-AUTH directive or disallowing incoming HTTP requests at
one&#8217;s router or firewall will suffice (both of which
are beyond the scope of this manual but easily searchable with Google).</li>
@ -3061,7 +3060,7 @@ the order of the server paragraph in <tt>config.inc.php</tt>.
<code>Options FollowSymLinks</code> and <code>AllowOverride
FileInfo</code> enabled for directory where phpMyAdmin is installed and
you need mod_rewrite to be enabled. Then you just need to create following
<code>.htaccess</code> file in root folder of phpMyAdmin installation
<a href="#glossary"><i>.htaccess</i></a> file in root folder of phpMyAdmin installation
(don't forget to change directory name inside of it):</p>
<pre>
@ -3183,6 +3182,35 @@ ProxyPassReverseCookiePath /%7Euser/phpmyadmin /mirror/foo
<p> The MySQL server's privilege tables are not up to date, you need to run
the <tt>mysql_upgrade</tt> command on the server.</p>
<h4 id="faq1_42">
<a href="#faq1_42">1.42 How can I prevent robots from accessing phpMyAdmin?</a></h4>
<p>You can add various rules to <a href="#glossary"><i>.htaccess</i></a> to filter access
based on user agent field. This is quite easy to circumvent, but could prevent at least
some robots accessing your installation.</p>
<pre>
RewriteEngine on
# Allow only GET and POST verbs
RewriteCond %{REQUEST_METHOD} !^(GET|POST)$ [NC,OR]
# Ban Typical Vulnerability Scanners and others
# Kick out Script Kiddies
RewriteCond %{HTTP_USER_AGENT} ^(java|curl|wget).* [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(libwww-perl|curl|wget|python|nikto|wkito|pikto|scan|acunetix).* [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner).* [NC,OR]
# Ban Search Engines, Crawlers to your administrative panel
# No reasons to access from bots
# Ultimately Better than the useless robots.txt
# Did google respect robots.txt?
# Try google: intitle:phpMyAdmin intext:"Welcome to phpMyAdmin *.*.*" intext:"Log in" -wiki -forum -forums -questions intext:"Cookies must be enabled"
RewriteCond %{HTTP_USER_AGENT} ^.*(AdsBot-Google|ia_archiver|Scooter|Ask.Jeeves|Baiduspider|Exabot|FAST.Enterprise.Crawler|FAST-WebCrawler|www\.neomo\.de|Gigabot|Mediapartners-Google|Google.Desktop|Feedfetcher-Google|Googlebot|heise-IT-Markt-Crawler|heritrix|ibm.com\cs/crawler|ICCrawler|ichiro|MJ12bot|MetagerBot|msnbot-NewsBlogs|msnbot|msnbot-media|NG-Search|lucene.apache.org|NutchCVS|OmniExplorer_Bot|online.link.validator|psbot0|Seekbot|Sensis.Web.Crawler|SEO.search.Crawler|Seoma.\[SEO.Crawler\]|SEOsearch|Snappy|www.urltrends.com|www.tkl.iis.u-tokyo.ac.jp/~crawler|SynooBot|crawleradmin.t-info@telekom.de|TurnitinBot|voyager|W3.SiteSearch.Crawler|W3C-checklink|W3C_Validator|www.WISEnutbot.com|yacybot|Yahoo-MMCrawler|Yahoo\!.DE.Slurp|Yahoo\!.Slurp|YahooSeeker).* [NC]
RewriteRule .* - [F]
</pre>
<h3 id="faqconfig">Configuration</h3>
@ -3584,7 +3612,7 @@ have either the <a href="http://pecl.php.net/package/APC">APC</a> extension
This depends on your system.<br />
If you're running a server which cannot be accessed by other people, it's
sufficient to use the directory protection bundled with your webserver
(with Apache you can use <i>.htaccess</i> files, for example).<br />
(with Apache you can use <a href="#glossary"><i>.htaccess</i></a> files, for example).<br />
If other people have telnet access to your server, you should use
phpMyAdmin's <abbr title="HyperText Transfer Protocol">HTTP</abbr> or cookie authentication features.
<br /><br />
@ -3628,7 +3656,7 @@ have either the <a href="http://pecl.php.net/package/APC">APC</a> extension
are wrong.</li>
<li>The username/password you specify in the login dialog are invalid.</li>
<li>You have already setup a security mechanism for the
phpMyAdmin-directory, eg. a .htaccess file. This would interfere with
phpMyAdmin-directory, eg. a <a href="#glossary"><i>.htaccess</i></a> file. This would interfere with
phpMyAdmin's authentication, so remove it.</li>
</ul>
@ -3644,7 +3672,7 @@ have either the <a href="http://pecl.php.net/package/APC">APC</a> extension
<h4 id="faq4_6">
<a href="#faq4_6">4.6 How can I use the Host-based authentication additions?</a></h4>
<p> If you have existing rules from an old .htaccess file, you can take them
<p> If you have existing rules from an old <a href="#glossary"><i>.htaccess</i></a> file, you can take them
and add a username between the <tt>'deny'</tt>/<tt>'allow'</tt> and
<tt>'from'</tt> strings. Using the username wildcard of <tt>'%'</tt> would
be a major benefit here if your installation is suited to using it. Then

19
contrib/htaccess
View File

@ -1,19 +0,0 @@
RewriteEngine on
# Allow only GET and POST verbs
RewriteCond %{REQUEST_METHOD} !^(GET|POST)$ [NC,OR]
# Ban Typical Vulnerability Scanners and others
# Kick out Script Kiddies
RewriteCond %{HTTP_USER_AGENT} ^(java|curl|wget).* [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(libwww-perl|curl|wget|python|nikto|wkito|pikto|scan|acunetix).* [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner).* [NC,OR]
# Ban Search Engines, Crawlers to your administrative panel
# No reasons to access from bots
# Ultimately Better than the useless robots.txt
# Did google respect robots.txt?
# Try google: intitle:phpMyAdmin intext:"Welcome to phpMyAdmin *.*.*" intext:"Log in" -wiki -forum -forums -questions intext:"Cookies must be enabled"
RewriteCond %{HTTP_USER_AGENT} ^.*(AdsBot-Google|ia_archiver|Scooter|Ask.Jeeves|Baiduspider|Exabot|FAST.Enterprise.Crawler|FAST-WebCrawler|www\.neomo\.de|Gigabot|Mediapartners-Google|Google.Desktop|Feedfetcher-Google|Googlebot|heise-IT-Markt-Crawler|heritrix|ibm.com\cs/crawler|ICCrawler|ichiro|MJ12bot|MetagerBot|msnbot-NewsBlogs|msnbot|msnbot-media|NG-Search|lucene.apache.org|NutchCVS|OmniExplorer_Bot|online.link.validator|psbot0|Seekbot|Sensis.Web.Crawler|SEO.search.Crawler|Seoma.\[SEO.Crawler\]|SEOsearch|Snappy|www.urltrends.com|www.tkl.iis.u-tokyo.ac.jp/~crawler|SynooBot|crawleradmin.t-info@telekom.de|TurnitinBot|voyager|W3.SiteSearch.Crawler|W3C-checklink|W3C_Validator|www.WISEnutbot.com|yacybot|Yahoo-MMCrawler|Yahoo\!.DE.Slurp|Yahoo\!.Slurp|YahooSeeker).* [NC]
RewriteRule .* - [F]