From b2c885908d69cc604a0de7ec7e080b9b53ca6630 Mon Sep 17 00:00:00 2001 From: William Desportes Date: Sun, 8 Nov 2020 01:02:03 +0100 Subject: [PATCH 1/2] Implement MysqlSslWarningSafeHosts to fix #15584 Fixes: #15584 Signed-off-by: William Desportes --- doc/config.rst | 21 +++++++++++++++++++++ libraries/classes/Html/Generator.php | 2 +- libraries/config.default.php | 7 +++++++ 3 files changed, 29 insertions(+), 1 deletion(-) diff --git a/doc/config.rst b/doc/config.rst index 458c1a93c7..58a02cad81 100644 --- a/doc/config.rst +++ b/doc/config.rst @@ -1607,6 +1607,27 @@ Generic settings have to set :config:option:`$cfg['PmaAbsoluteUri']` for correct redirection. +.. config:option:: $cfg['MysqlSslWarningSafeHosts'] + + :type: array + :default: ``['127.0.0.1', 'localhost']`` + + This search is case-sensitive and will match the exact string only. + If your setup does not use SSL but is safe because you are using a + local connection or private network, you can add your hostname or :term:`IP` to the list. + You can also remove the default entries to only include yours. + + This check uses the value of :config:option:`$cfg['Servers'][$i]['host']`. + + .. versionadded:: 5.1.0 + + Example configuration + + .. code-block:: php + + $cfg['MysqlSslWarningSafeHosts'] = ['127.0.0.1', 'localhost', 'mariadb.local']; + + .. config:option:: $cfg['ExecTimeLimit'] :type: integer [number of seconds] diff --git a/libraries/classes/Html/Generator.php b/libraries/classes/Html/Generator.php index 15f5596dab..8d7e964d1d 100644 --- a/libraries/classes/Html/Generator.php +++ b/libraries/classes/Html/Generator.php @@ -301,7 +301,7 @@ class Generator $class = 'caution'; if (! $server['ssl']) { $message = __('SSL is not being used'); - if (! empty($server['socket']) || $server['host'] === '127.0.0.1' || $server['host'] === 'localhost') { + if (! empty($server['socket']) || in_array($server['host'], $GLOBALS['cfg']['MysqlSslWarningSafeHosts'])) { $class = ''; } } elseif (! $server['ssl_verify']) { diff --git a/libraries/config.default.php b/libraries/config.default.php index 0e2840cd0d..acfe09dd9f 100644 --- a/libraries/config.default.php +++ b/libraries/config.default.php @@ -718,6 +718,13 @@ $cfg['ExecTimeLimit'] = 300; */ $cfg['SessionSavePath'] = ''; +/** + * Hosts or IPs to consider safe when checking if SSL is used or not + * + * @global array $cfg['MysqlSslWarningSafeHosts'] + */ +$cfg['MysqlSslWarningSafeHosts'] = ['127.0.0.1', 'localhost']; + /** * maximum allocated bytes ('-1' for no limit, '0' for no change) * this is a string because '16M' is a valid value; we must put here From fa53ce1723cdb6fef6793a39259e65d2066d6482 Mon Sep 17 00:00:00 2001 From: William Desportes Date: Sun, 8 Nov 2020 13:10:55 +0100 Subject: [PATCH 2/2] Add tests for Generator::getServerSSL() Signed-off-by: William Desportes --- test/classes/Html/GeneratorTest.php | 103 ++++++++++++++++++++++++++++ 1 file changed, 103 insertions(+) diff --git a/test/classes/Html/GeneratorTest.php b/test/classes/Html/GeneratorTest.php index 42377b3274..5fd5cdb273 100644 --- a/test/classes/Html/GeneratorTest.php +++ b/test/classes/Html/GeneratorTest.php @@ -282,4 +282,107 @@ class GeneratorTest extends AbstractTestCase Generator::formatSql('SELECT 1 < 2', true) ); } + + /** + * Test for getServerSSL + */ + public function testGetServerSSL(): void + { + global $cfg; + + $sslNotUsed = 'SSL is not being used' + . ' Documentation'; + + $sslNotUsedCaution = 'SSL is not being used' + . ' Documentation'; + + $cfg['Server'] = [ + 'ssl' => false, + 'host' => '127.0.0.1', + ]; + $this->assertEquals( + $sslNotUsed, + Generator::getServerSSL() + ); + + $cfg['Server'] = [ + 'ssl' => false, + 'host' => 'custom.host', + ]; + $cfg['MysqlSslWarningSafeHosts'] = ['localhost', '127.0.0.1']; + + $this->assertEquals( + $sslNotUsedCaution, + Generator::getServerSSL() + ); + + $cfg['Server'] = [ + 'ssl' => false, + 'host' => 'custom.host', + ]; + $cfg['MysqlSslWarningSafeHosts'] = ['localhost', '127.0.0.1', 'custom.host']; + + $this->assertEquals( + $sslNotUsed, + Generator::getServerSSL() + ); + + $cfg['Server'] = [ + 'ssl' => false, + 'ssl_verify' => true, + 'host' => 'custom.host', + ]; + + $this->assertEquals( + $sslNotUsed, + Generator::getServerSSL() + ); + + $cfg['Server'] = [ + 'ssl' => true, + 'ssl_verify' => false, + 'host' => 'custom.host', + ]; + + $this->assertEquals( + 'SSL is used with disabled verification' + . ' Documentation', + Generator::getServerSSL() + ); + + $cfg['Server'] = [ + 'ssl' => true, + 'ssl_verify' => true, + 'host' => 'custom.host', + ]; + + $this->assertEquals( + 'SSL is used without certification authority' + . ' Documentation', + Generator::getServerSSL() + ); + + $cfg['Server'] = [ + 'ssl' => true, + 'ssl_verify' => true, + 'ssl_ca' => '/etc/ssl/ca.crt', + 'host' => 'custom.host', + ]; + + $this->assertEquals( + 'SSL is used' + . ' Documentation', + Generator::getServerSSL() + ); + } }