gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge #16466 - Fix #15584 - Implement MysqlSslWarningSafeHosts

Browse Source 
Fixes: #15584
Pull-request: #16466



Signed-off-by: William Desportes <williamdes@wdes.fr>
This commit is contained in:
William Desportes 2020-11-08 14:03:52 +01:00
commit c25720a3ff
No known key found for this signature in database
GPG Key ID: 90A0EF1B8251A889
4 changed files with 132 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
doc/config.rst
View File

@ -1607,6 +1607,27 @@ Generic settings
have to set :config:option:`$cfg['PmaAbsoluteUri']` for correct
redirection.
.. config:option:: $cfg['MysqlSslWarningSafeHosts']
:type: array
:default: ``['127.0.0.1', 'localhost']``
This search is case-sensitive and will match the exact string only.
If your setup does not use SSL but is safe because you are using a
local connection or private network, you can add your hostname or :term:`IP` to the list.
You can also remove the default entries to only include yours.
This check uses the value of :config:option:`$cfg['Servers'][$i]['host']`.
.. versionadded:: 5.1.0
Example configuration
.. code-block:: php
$cfg['MysqlSslWarningSafeHosts'] = ['127.0.0.1', 'localhost', 'mariadb.local'];
.. config:option:: $cfg['ExecTimeLimit']
:type: integer [number of seconds]

2
libraries/classes/Html/Generator.php
View File

@ -301,7 +301,7 @@ class Generator
$class = 'caution';
if (! $server['ssl']) {
$message = __('SSL is not being used');
if (! empty($server['socket']) || $server['host'] === '127.0.0.1' || $server['host'] === 'localhost') {
if (! empty($server['socket']) || in_array($server['host'], $GLOBALS['cfg']['MysqlSslWarningSafeHosts'])) {
$class = '';
}
} elseif (! $server['ssl_verify']) {

7
libraries/config.default.php
View File

@ -718,6 +718,13 @@ $cfg['ExecTimeLimit'] = 300;
*/
$cfg['SessionSavePath'] = '';
/**
* Hosts or IPs to consider safe when checking if SSL is used or not
*
* @global array $cfg['MysqlSslWarningSafeHosts']
*/
$cfg['MysqlSslWarningSafeHosts'] = ['127.0.0.1', 'localhost'];
/**
* maximum allocated bytes ('-1' for no limit, '0' for no change)
* this is a string because '16M' is a valid value; we must put here

103
test/classes/Html/GeneratorTest.php
View File

@ -282,4 +282,107 @@ class GeneratorTest extends AbstractTestCase
Generator::formatSql('SELECT 1 < 2', true)
);
}
/**
* Test for getServerSSL
*/
public function testGetServerSSL(): void
{
global $cfg;
$sslNotUsed = '<span class="">SSL is not being used</span>'
. ' <a href="./url.php?url=https%3A%2F%2Fdocs.phpmyadmin.net%2Fen%2Flatest%2Fsetup.html%23ssl"'
. ' target="documentation"><img src="themes/dot.gif" title="Documentation" alt="Documentation"'
. ' class="icon ic_b_help"></a>';
$sslNotUsedCaution = '<span class="caution">SSL is not being used</span>'
. ' <a href="./url.php?url=https%3A%2F%2Fdocs.phpmyadmin.net%2Fen%2Flatest%2Fsetup.html%23ssl"'
. ' target="documentation"><img src="themes/dot.gif" title="Documentation" alt="Documentation"'
. ' class="icon ic_b_help"></a>';
$cfg['Server'] = [
'ssl' => false,
'host' => '127.0.0.1',
];
$this->assertEquals(
$sslNotUsed,
Generator::getServerSSL()
);
$cfg['Server'] = [
'ssl' => false,
'host' => 'custom.host',
];
$cfg['MysqlSslWarningSafeHosts'] = ['localhost', '127.0.0.1'];
$this->assertEquals(
$sslNotUsedCaution,
Generator::getServerSSL()
);
$cfg['Server'] = [
'ssl' => false,
'host' => 'custom.host',
];
$cfg['MysqlSslWarningSafeHosts'] = ['localhost', '127.0.0.1', 'custom.host'];
$this->assertEquals(
$sslNotUsed,
Generator::getServerSSL()
);
$cfg['Server'] = [
'ssl' => false,
'ssl_verify' => true,
'host' => 'custom.host',
];
$this->assertEquals(
$sslNotUsed,
Generator::getServerSSL()
);
$cfg['Server'] = [
'ssl' => true,
'ssl_verify' => false,
'host' => 'custom.host',
];
$this->assertEquals(
'<span class="caution">SSL is used with disabled verification</span>'
. ' <a href="./url.php?url=https%3A%2F%2Fdocs.phpmyadmin.net%2Fen%2Flatest%2Fsetup.html%23ssl"'
. ' target="documentation"><img src="themes/dot.gif" title="Documentation" alt="Documentation"'
. ' class="icon ic_b_help"></a>',
Generator::getServerSSL()
);
$cfg['Server'] = [
'ssl' => true,
'ssl_verify' => true,
'host' => 'custom.host',
];
$this->assertEquals(
'<span class="caution">SSL is used without certification authority</span>'
. ' <a href="./url.php?url=https%3A%2F%2Fdocs.phpmyadmin.net%2Fen%2Flatest%2Fsetup.html%23ssl"'
. ' target="documentation"><img src="themes/dot.gif" title="Documentation" alt="Documentation"'
. ' class="icon ic_b_help"></a>',
Generator::getServerSSL()
);
$cfg['Server'] = [
'ssl' => true,
'ssl_verify' => true,
'ssl_ca' => '/etc/ssl/ca.crt',
'host' => 'custom.host',
];
$this->assertEquals(
'<span class="">SSL is used</span>'
. ' <a href="./url.php?url=https%3A%2F%2Fdocs.phpmyadmin.net%2Fen%2Flatest%2Fsetup.html%23ssl"'
. ' target="documentation"><img src="themes/dot.gif" title="Documentation" alt="Documentation"'
. ' class="icon ic_b_help"></a>',
Generator::getServerSSL()
);
}
}