diff --git a/doc/config.rst b/doc/config.rst
index 458c1a93c7..58a02cad81 100644
--- a/doc/config.rst
+++ b/doc/config.rst
@@ -1607,6 +1607,27 @@ Generic settings
have to set :config:option:`$cfg['PmaAbsoluteUri']` for correct
redirection.
+.. config:option:: $cfg['MysqlSslWarningSafeHosts']
+
+ :type: array
+ :default: ``['127.0.0.1', 'localhost']``
+
+ This search is case-sensitive and will match the exact string only.
+ If your setup does not use SSL but is safe because you are using a
+ local connection or private network, you can add your hostname or :term:`IP` to the list.
+ You can also remove the default entries to only include yours.
+
+ This check uses the value of :config:option:`$cfg['Servers'][$i]['host']`.
+
+ .. versionadded:: 5.1.0
+
+ Example configuration
+
+ .. code-block:: php
+
+ $cfg['MysqlSslWarningSafeHosts'] = ['127.0.0.1', 'localhost', 'mariadb.local'];
+
+
.. config:option:: $cfg['ExecTimeLimit']
:type: integer [number of seconds]
diff --git a/libraries/classes/Html/Generator.php b/libraries/classes/Html/Generator.php
index 15f5596dab..8d7e964d1d 100644
--- a/libraries/classes/Html/Generator.php
+++ b/libraries/classes/Html/Generator.php
@@ -301,7 +301,7 @@ class Generator
$class = 'caution';
if (! $server['ssl']) {
$message = __('SSL is not being used');
- if (! empty($server['socket']) || $server['host'] === '127.0.0.1' || $server['host'] === 'localhost') {
+ if (! empty($server['socket']) || in_array($server['host'], $GLOBALS['cfg']['MysqlSslWarningSafeHosts'])) {
$class = '';
}
} elseif (! $server['ssl_verify']) {
diff --git a/libraries/config.default.php b/libraries/config.default.php
index 0e2840cd0d..acfe09dd9f 100644
--- a/libraries/config.default.php
+++ b/libraries/config.default.php
@@ -718,6 +718,13 @@ $cfg['ExecTimeLimit'] = 300;
*/
$cfg['SessionSavePath'] = '';
+/**
+ * Hosts or IPs to consider safe when checking if SSL is used or not
+ *
+ * @global array $cfg['MysqlSslWarningSafeHosts']
+ */
+$cfg['MysqlSslWarningSafeHosts'] = ['127.0.0.1', 'localhost'];
+
/**
* maximum allocated bytes ('-1' for no limit, '0' for no change)
* this is a string because '16M' is a valid value; we must put here
diff --git a/test/classes/Html/GeneratorTest.php b/test/classes/Html/GeneratorTest.php
index 42377b3274..5fd5cdb273 100644
--- a/test/classes/Html/GeneratorTest.php
+++ b/test/classes/Html/GeneratorTest.php
@@ -282,4 +282,107 @@ class GeneratorTest extends AbstractTestCase
Generator::formatSql('SELECT 1 < 2', true)
);
}
+
+ /**
+ * Test for getServerSSL
+ */
+ public function testGetServerSSL(): void
+ {
+ global $cfg;
+
+ $sslNotUsed = 'SSL is not being used'
+ . '
';
+
+ $sslNotUsedCaution = 'SSL is not being used'
+ . '
';
+
+ $cfg['Server'] = [
+ 'ssl' => false,
+ 'host' => '127.0.0.1',
+ ];
+ $this->assertEquals(
+ $sslNotUsed,
+ Generator::getServerSSL()
+ );
+
+ $cfg['Server'] = [
+ 'ssl' => false,
+ 'host' => 'custom.host',
+ ];
+ $cfg['MysqlSslWarningSafeHosts'] = ['localhost', '127.0.0.1'];
+
+ $this->assertEquals(
+ $sslNotUsedCaution,
+ Generator::getServerSSL()
+ );
+
+ $cfg['Server'] = [
+ 'ssl' => false,
+ 'host' => 'custom.host',
+ ];
+ $cfg['MysqlSslWarningSafeHosts'] = ['localhost', '127.0.0.1', 'custom.host'];
+
+ $this->assertEquals(
+ $sslNotUsed,
+ Generator::getServerSSL()
+ );
+
+ $cfg['Server'] = [
+ 'ssl' => false,
+ 'ssl_verify' => true,
+ 'host' => 'custom.host',
+ ];
+
+ $this->assertEquals(
+ $sslNotUsed,
+ Generator::getServerSSL()
+ );
+
+ $cfg['Server'] = [
+ 'ssl' => true,
+ 'ssl_verify' => false,
+ 'host' => 'custom.host',
+ ];
+
+ $this->assertEquals(
+ 'SSL is used with disabled verification'
+ . '
',
+ Generator::getServerSSL()
+ );
+
+ $cfg['Server'] = [
+ 'ssl' => true,
+ 'ssl_verify' => true,
+ 'host' => 'custom.host',
+ ];
+
+ $this->assertEquals(
+ 'SSL is used without certification authority'
+ . '
',
+ Generator::getServerSSL()
+ );
+
+ $cfg['Server'] = [
+ 'ssl' => true,
+ 'ssl_verify' => true,
+ 'ssl_ca' => '/etc/ssl/ca.crt',
+ 'host' => 'custom.host',
+ ];
+
+ $this->assertEquals(
+ 'SSL is used'
+ . '
',
+ Generator::getServerSSL()
+ );
+ }
}