diff --git a/libraries/config/ServerConfigChecks.class.php b/libraries/config/ServerConfigChecks.class.php new file mode 100644 index 0000000000..7d3486b0c1 --- /dev/null +++ b/libraries/config/ServerConfigChecks.class.php @@ -0,0 +1,570 @@ +cfg = $cfg; + } + + /** + * Perform config checks + * + * @return void + */ + public function performConfigChecks() + { + $blowfishSecret = $this->cfg->get('blowfish_secret'); + $blowfishSecretSet = false; + $cookieAuthUsed = false; + + list( + $sAllowArbitraryServerWarn, $sBlowfishSecretMsg, + $sBZipDumpWarn, $sDirectoryNotice, $sForceSSLNotice, + $sGZipDumpWarn, $sLoginCookieValidityWarn, + $sLoginCookieValidityWarn2, $sLoginCookieValidityWarn3, + $sSecurityInfoMsg, $sSrvAuthCfgMsg, $sZipDumpExportWarn, + $sZipDumpImportWarn + ) = self::defineMessages(); + + list($cookieAuthUsed, $blowfishSecret, $blowfishSecretSet) + = $this->performConfigChecksServers( + $cookieAuthUsed, $blowfishSecret, $sSrvAuthCfgMsg, + $sSecurityInfoMsg, $blowfishSecretSet + ); + + $this->performConfigChecksCookieAuthUsed( + $cookieAuthUsed, $blowfishSecretSet, $sBlowfishSecretMsg, + $blowfishSecret + ); + + // + // $cfg['ForceSSL'] + // should be enabled if possible + // + if (!$this->cfg->getValue('ForceSSL')) { + PMA_messagesSet( + 'notice', + 'ForceSSL', + PMA_lang(PMA_langName('ForceSSL')), + PMA_lang($sForceSSLNotice) + ); + } + + // + // $cfg['AllowArbitraryServer'] + // should be disabled + // + if ($this->cfg->getValue('AllowArbitraryServer')) { + PMA_messagesSet( + 'notice', + 'AllowArbitraryServer', + PMA_lang(PMA_langName('AllowArbitraryServer')), + PMA_lang($sAllowArbitraryServerWarn) + ); + } + + $this->performConfigChecksLoginCookie( + $sLoginCookieValidityWarn, $sLoginCookieValidityWarn2, + $sLoginCookieValidityWarn3 + ); + + // + // $cfg['SaveDir'] + // should not be world-accessible + // + if ($this->cfg->getValue('SaveDir') != '') { + PMA_messagesSet( + 'notice', + 'SaveDir', + PMA_lang(PMA_langName('SaveDir')), + PMA_lang($sDirectoryNotice) + ); + } + + // + // $cfg['TempDir'] + // should not be world-accessible + // + if ($this->cfg->getValue('TempDir') != '') { + PMA_messagesSet( + 'notice', + 'TempDir', + PMA_lang(PMA_langName('TempDir')), + PMA_lang($sDirectoryNotice) + ); + } + + $this->performConfigChecksZips( + $sGZipDumpWarn, $sBZipDumpWarn, $sZipDumpImportWarn, + $sZipDumpExportWarn + ); + } + + /** + * Check config of servers + * + * @param boolean $cookieAuthUsed Cookie auth is used + * @param string $blowfishSecret Blowfish secret + * @param string $sServerAuthCfgMsg Message for server auth config + * @param string $sSecurityInfoMsg Message for security information + * @param boolean $blowfishSecretSet Blowfish secret set + * + * @return array + */ + protected function performConfigChecksServers( + $cookieAuthUsed, $blowfishSecret, $sServerAuthCfgMsg, + $sSecurityInfoMsg, $blowfishSecretSet + ) { + for ($i = 1, $serverCnt = $this->cfg->getServerCount(); $i <= $serverCnt; $i++) { + $cookieAuthServer = ($this->cfg->getValue("Servers/$i/auth_type") == 'cookie'); + $cookieAuthUsed |= $cookieAuthServer; + $serverName = $this->performConfigChecksServersGetServerName( + $this->cfg->getServerName($i), $i + ); + $serverName = htmlspecialchars($serverName); + + list($blowfishSecret, $blowfishSecretSet) + = $this->performConfigChecksServersSetBlowfishSecret( + $blowfishSecret, $cookieAuthServer, $blowfishSecretSet + ); + + // + // $cfg['Servers'][$i]['ssl'] + // should be enabled if possible + // + if (!$this->cfg->getValue("Servers/$i/ssl")) { + $title = PMA_lang(PMA_langName('Servers/1/ssl')) . " ($serverName)"; + PMA_messagesSet( + 'notice', + "Servers/$i/ssl", + $title, + __('You should use SSL connections if your database server supports it.') + ); + } + + // + // $cfg['Servers'][$i]['auth_type'] + // warn about full user credentials if 'auth_type' is 'config' + // + if ($this->cfg->getValue("Servers/$i/auth_type") == 'config' + && $this->cfg->getValue("Servers/$i/user") != '' + && $this->cfg->getValue("Servers/$i/password") != '' + ) { + $title = PMA_lang(PMA_langName('Servers/1/auth_type')) + . " ($serverName)"; + PMA_messagesSet( + 'notice', + "Servers/$i/auth_type", + $title, + PMA_lang($sServerAuthCfgMsg, $i) . ' ' + . PMA_lang($sSecurityInfoMsg, $i) + ); + } + + // + // $cfg['Servers'][$i]['AllowRoot'] + // $cfg['Servers'][$i]['AllowNoPassword'] + // serious security flaw + // + if ($this->cfg->getValue("Servers/$i/AllowRoot") + && $this->cfg->getValue("Servers/$i/AllowNoPassword") + ) { + $title = PMA_lang(PMA_langName('Servers/1/AllowNoPassword')) + . " ($serverName)"; + PMA_messagesSet( + 'notice', + "Servers/$i/AllowNoPassword", + $title, + __('You allow for connecting to the server without a password.') . ' ' + . PMA_lang($sSecurityInfoMsg, $i) + ); + } + } + return array($cookieAuthUsed, $blowfishSecret, $blowfishSecretSet); + } + + /** + * Set blowfish secret + * + * @param string $blowfishSecret Blowfish secret + * @param boolean $cookieAuthServer Cookie auth is used + * @param boolean $blowfishSecretSet Blowfish secret set + * + * @return array + */ + protected function performConfigChecksServersSetBlowfishSecret( + $blowfishSecret, $cookieAuthServer, $blowfishSecretSet + ) { + if ($cookieAuthServer && $blowfishSecret === null) { + $blowfishSecret = uniqid('', true); + $blowfishSecretSet = true; + $this->cfg->set('blowfish_secret', $blowfishSecret); + return array($blowfishSecret, $blowfishSecretSet); + } + return array($blowfishSecret, $blowfishSecretSet); + } + + /** + * Define server name + * + * @param string $serverName Server name + * @param int $serverId Server id + * + * @return string Server name + */ + protected function performConfigChecksServersGetServerName( + $serverName, $serverId + ) { + if ($serverName == 'localhost') { + $serverName .= " [$serverId]"; + return $serverName; + } + return $serverName; + } + + /** + * Perform config checks for zip part. + * + * @param string $sGZipDumpWarning Gzip dump warning + * @param string $sBZipDumpWarning Bzip dump warning + * @param string $sZipDumpImportWarn Zip dump import warning + * @param string $sZipDumpExportWarn Zip dump export warning + * + * @return void + */ + protected function performConfigChecksZips( + $sGZipDumpWarning, $sBZipDumpWarning, $sZipDumpImportWarn, + $sZipDumpExportWarn + ) { + $this->performConfigChecksServerGZipdump($sGZipDumpWarning); + $this->performConfigChecksServerBZipdump($sBZipDumpWarning); + $this->performConfigChecksServersZipdump( + $sZipDumpImportWarn, $sZipDumpExportWarn + ); + } + + /** + * Perform config checks for zip part. + * + * @param string $sZipDumpImportWarn Zip dump import warning + * @param string $sZipDumpExportWarn Zip dump export warning + * + * @return void + */ + protected function performConfigChecksServersZipdump( + $sZipDumpImportWarn, $sZipDumpExportWarn + ) { + // + // $cfg['ZipDump'] + // requires zip_open in import + // + if ($this->cfg->getValue('ZipDump') && !@function_exists('zip_open')) { + PMA_messagesSet( + 'error', + 'ZipDump_import', + PMA_lang(PMA_langName('ZipDump')), + PMA_lang($sZipDumpImportWarn, 'zip_open') + ); + } + + // + // $cfg['ZipDump'] + // requires gzcompress in export + // + if ($this->cfg->getValue('ZipDump') && !@function_exists('gzcompress')) { + PMA_messagesSet( + 'error', + 'ZipDump_export', + PMA_lang(PMA_langName('ZipDump')), + PMA_lang($sZipDumpExportWarn, 'gzcompress') + ); + } + } + + /** + * Check config of servers + * + * @param boolean $cookieAuthUsed Cookie auth is used + * @param boolean $blowfishSecretSet Blowfish secret set + * @param string $sBlowfishSecretMsg Blowfish secret message + * @param string $blowfishSecret Blowfish secret + * + * @return array + */ + protected function performConfigChecksCookieAuthUsed( + $cookieAuthUsed, $blowfishSecretSet, $sBlowfishSecretMsg, + $blowfishSecret + ) { + // + // $cfg['blowfish_secret'] + // it's required for 'cookie' authentication + // + if ($cookieAuthUsed) { + if ($blowfishSecretSet) { + // 'cookie' auth used, blowfish_secret was generated + PMA_messagesSet( + 'notice', + 'blowfish_secret_created', + PMA_lang(PMA_langName('blowfish_secret')), + $sBlowfishSecretMsg + ); + } else { + $blowfishWarnings = array(); + // check length + if (strlen($blowfishSecret) < 8) { + // too short key + $blowfishWarnings[] = __('Key is too short, it should have at least 8 characters.'); + } + // check used characters + $hasDigits = (bool)preg_match('/\d/', $blowfishSecret); + $hasChars = (bool)preg_match('/\S/', $blowfishSecret); + $hasNonword = (bool)preg_match('/\W/', $blowfishSecret); + if (!$hasDigits || !$hasChars || !$hasNonword) { + $blowfishWarnings[] = PMA_lang(__('Key should contain letters, numbers [em]and[/em] special characters.')); + } + if (!empty($blowfishWarnings)) { + PMA_messagesSet( + 'error', + 'blowfish_warnings' . count($blowfishWarnings), + PMA_lang(PMA_langName('blowfish_secret')), + implode('
', $blowfishWarnings) + ); + } + } + } + } + + /** + * Define all messages + * + * @return array + */ + protected static function defineMessages() + { + $sAllowArbitraryServerWarn = __('This %soption%s should be disabled as it allows attackers to bruteforce login to any MySQL server. If you feel this is necessary, use %strusted proxies list%s. However, IP-based protection may not be reliable if your IP belongs to an ISP where thousands of users, including you, are connected to.'); + $sAllowArbitraryServerWarn = sprintf( + $sAllowArbitraryServerWarn, + '[a@?page=form&formset=Features#tab_Security]', + '[/a]', '[a@?page=form&formset=Features#tab_Security]', + '[/a]' + ); + $sBlowfishSecretMsg = __('You didn\'t have blowfish secret set and have enabled cookie authentication, so a key was automatically generated for you. It is used to encrypt cookies; you don\'t need to remember it.'); + $sBZipDumpWarning = __('%sBzip2 compression and decompression%s requires functions (%s) which are unavailable on this system.'); + $sBZipDumpWarning = sprintf( + $sBZipDumpWarning, + '[a@?page=form&formset=Features#tab_Import_export]', + '[/a]', '%s' + ); + $sDirectoryNotice = __('This value should be double checked to ensure that this directory is neither world accessible nor readable or writable by other users on your server.'); + $sForceSSLNotice = __('This %soption%s should be enabled if your web server supports it.'); + $sForceSSLNotice = sprintf( + $sForceSSLNotice, + '[a@?page=form&formset=Features#tab_Security]', + '[/a]' + ); + $sGZipDumpWarning = __('%sGZip compression and decompression%s requires functions (%s) which are unavailable on this system.'); + $sGZipDumpWarning = sprintf( + $sGZipDumpWarning, + '[a@?page=form&formset=Features#tab_Import_export]', + '[/a]', + '%s' + ); + $sLoginCookieValidityWarn = __('%sLogin cookie validity%s greater than %ssession.gc_maxlifetime%s may cause random session invalidation (currently session.gc_maxlifetime is %d).'); + $sLoginCookieValidityWarn = sprintf( + $sLoginCookieValidityWarn, + '[a@?page=form&formset=Features#tab_Security]', + '[/a]', + '[a@' . PMA_getPHPDocLink( + 'session.configuration.php#ini.session.gc-maxlifetime' + ) . ']', + '[/a]', + ini_get('session.gc_maxlifetime') + ); + $sLoginCookieValidityWarn2 = __('%sLogin cookie validity%s should be set to 1800 seconds (30 minutes) at most. Values larger than 1800 may pose a security risk such as impersonation.'); + $sLoginCookieValidityWarn2 = sprintf( + $sLoginCookieValidityWarn2, + '[a@?page=form&formset=Features#tab_Security]', + '[/a]' + ); + $sLoginCookieValidityWarn3 = __('If using cookie authentication and %sLogin cookie store%s is not 0, %sLogin cookie validity%s must be set to a value less or equal to it.'); + $sLoginCookieValidityWarn3 = sprintf( + $sLoginCookieValidityWarn3, + '[a@?page=form&formset=Features#tab_Security]', + '[/a]', '[a@?page=form&formset=Features#tab_Security]', + '[/a]' + ); + $sSecurityInfoMsg = __('If you feel this is necessary, use additional protection settings - %shost authentication%s settings and %strusted proxies list%s. However, IP-based protection may not be reliable if your IP belongs to an ISP where thousands of users, including you, are connected to.'); + $sSecurityInfoMsg = sprintf( + $sSecurityInfoMsg, + '[a@?page=servers&mode=edit&id=%1$d#tab_Server_config]', + '[/a]', + '[a@?page=form&formset=Features#tab_Security]', + '[/a]' + ); + $sServerAuthConfigMsg = __('You set the [kbd]config[/kbd] authentication type and included username and password for auto-login, which is not a desirable option for live hosts. Anyone who knows or guesses your phpMyAdmin URL can directly access your phpMyAdmin panel. Set %sauthentication type%s to [kbd]cookie[/kbd] or [kbd]http[/kbd].'); + $sServerAuthConfigMsg = sprintf( + $sServerAuthConfigMsg, + '[a@?page=servers&mode=edit&id=%1$d#tab_Server]', + '[/a]' + ); + $sZipDumpExportWarn = __('%sZip compression%s requires functions (%s) which are unavailable on this system.'); + $sZipDumpExportWarn = sprintf( + $sZipDumpExportWarn, + '[a@?page=form&formset=Features#tab_Import_export]', + '[/a]', + '%s' + ); + $sZipDumpImportWarn = __('%sZip decompression%s requires functions (%s) which are unavailable on this system.'); + $sZipDumpImportWarn = sprintf( + $sZipDumpImportWarn, + '[a@?page=form&formset=Features#tab_Import_export]', + '[/a]', + '%s' + ); + return array( + $sAllowArbitraryServerWarn, $sBlowfishSecretMsg, $sBZipDumpWarning, + $sDirectoryNotice, $sForceSSLNotice, $sGZipDumpWarning, + $sLoginCookieValidityWarn, $sLoginCookieValidityWarn2, + $sLoginCookieValidityWarn3, $sSecurityInfoMsg, $sServerAuthConfigMsg, + $sZipDumpExportWarn, $sZipDumpImportWarn + ); + } + + /** + * Check configuration for login cookie + * + * @param string $sLoginCookieValidityWarn Warning 1 for login cookie validity + * @param string $sLoginCookieValidityWarn2 Warning 2 for login cookie validity + * @param string $sLoginCookieValidityWarn3 Warning 3 for login cookie validity + * + * @return void + */ + protected function performConfigChecksLoginCookie( + $sLoginCookieValidityWarn, $sLoginCookieValidityWarn2, + $sLoginCookieValidityWarn3 + ) { + // + // $cfg['LoginCookieValidity'] + // value greater than session.gc_maxlifetime will cause + // random session invalidation after that time + if ($this->cfg->getValue('LoginCookieValidity') > ini_get('session.gc_maxlifetime') + ) { + PMA_messagesSet( + 'error', + 'LoginCookieValidity', + PMA_lang(PMA_langName('LoginCookieValidity')), + PMA_lang($sLoginCookieValidityWarn) + ); + } + + // + // $cfg['LoginCookieValidity'] + // should be at most 1800 (30 min) + // + if ($this->cfg->getValue('LoginCookieValidity') > 1800) { + PMA_messagesSet( + 'notice', + 'LoginCookieValidity', + PMA_lang(PMA_langName('LoginCookieValidity')), + PMA_lang($sLoginCookieValidityWarn2) + ); + } + + // + // $cfg['LoginCookieValidity'] + // $cfg['LoginCookieStore'] + // LoginCookieValidity must be less or equal to LoginCookieStore + // + if ($this->cfg->getValue('LoginCookieStore') != 0 + && $this->cfg->getValue('LoginCookieValidity') > $this->cfg->getValue('LoginCookieStore') + ) { + PMA_messagesSet( + 'error', + 'LoginCookieValidity', + PMA_lang(PMA_langName('LoginCookieValidity')), + PMA_lang($sLoginCookieValidityWarn3) + ); + } + } + + /** + * Check GZipDump configuration + * + * @param string $sBZipDumpWarn Warning for BZipDumpWarning + * + * @return void + */ + protected function performConfigChecksServerBZipdump($sBZipDumpWarn) + { + // + // $cfg['BZipDump'] + // requires bzip2 functions + // + if ($this->cfg->getValue('BZipDump') + && (!@function_exists('bzopen') || !@function_exists('bzcompress')) + ) { + $functions = @function_exists('bzopen') + ? '' : + 'bzopen'; + $functions .= @function_exists('bzcompress') + ? '' + : ($functions ? ', ' : '') . 'bzcompress'; + PMA_messagesSet( + 'error', + 'BZipDump', + PMA_lang(PMA_langName('BZipDump')), + PMA_lang($sBZipDumpWarn, $functions) + ); + } + } + + /** + * Check GZipDump configuration + * + * @param string $sGZipDumpWarn Warning for GZipDumpWarning + * + * @return void + */ + protected function performConfigChecksServerGZipdump($sGZipDumpWarn) + { + // + // $cfg['GZipDump'] + // requires zlib functions + // + if ($this->cfg->getValue('GZipDump') + && (@!function_exists('gzopen') || @!function_exists('gzencode')) + ) { + PMA_messagesSet( + 'error', + 'GZipDump', + PMA_lang(PMA_langName('GZipDump')), + PMA_lang($sGZipDumpWarn, 'gzencode') + ); + } + } +} diff --git a/setup/frames/index.inc.php b/setup/frames/index.inc.php index bbd2d7e18e..a24d058ef9 100644 --- a/setup/frames/index.inc.php +++ b/setup/frames/index.inc.php @@ -15,6 +15,7 @@ if (!defined('PHPMYADMIN')) { */ require_once './libraries/display_select_lang.lib.php'; require_once './libraries/config/FormDisplay.class.php'; +require_once './libraries/config/ServerConfigChecks.class.php'; require_once './setup/lib/index.lib.php'; // prepare unfiltered language list @@ -37,7 +38,8 @@ if (isset($_GET['version_check'])) { // // Perform various security, compatibility and consistency checks // -PMA_performConfigChecks(); +$configChecker = new ServerConfigChecks($GLOBALS['ConfigFile']); +$configChecker->performConfigChecks(); // // Check whether we can read/write configuration diff --git a/setup/lib/index.lib.php b/setup/lib/index.lib.php index 265850cc83..c34c58785d 100644 --- a/setup/lib/index.lib.php +++ b/setup/lib/index.lib.php @@ -199,363 +199,3 @@ function PMA_checkConfigRw(&$is_readable, &$is_writable, &$file_exists) $is_writable = $is_writable && is_writable($file_path); } } - -/** - * Performs various compatibility, security and consistency checks on current config - * - * Outputs results to message list, must be called between PMA_messagesBegin() - * and PMA_messagesEnd() - * - * @return void - */ -function PMA_performConfigChecks() -{ - $cf = $GLOBALS['ConfigFile']; - $blowfish_secret = $cf->get('blowfish_secret'); - $blowfish_secret_set = false; - $cookie_auth_used = false; - - $strAllowArbitraryServerWarning = __('This %soption%s should be disabled as it allows attackers to bruteforce login to any MySQL server. If you feel this is necessary, use %strusted proxies list%s. However, IP-based protection may not be reliable if your IP belongs to an ISP where thousands of users, including you, are connected to.'); - $strAllowArbitraryServerWarning = sprintf( - $strAllowArbitraryServerWarning, - '[a@?page=form&formset=Features#tab_Security]', - '[/a]', '[a@?page=form&formset=Features#tab_Security]', - '[/a]' - ); - $strBlowfishSecretMsg = __('You didn\'t have blowfish secret set and have enabled cookie authentication, so a key was automatically generated for you. It is used to encrypt cookies; you don\'t need to remember it.'); - $strBZipDumpWarning = __('%sBzip2 compression and decompression%s requires functions (%s) which are unavailable on this system.'); - $strBZipDumpWarning = sprintf( - $strBZipDumpWarning, - '[a@?page=form&formset=Features#tab_Import_export]', - '[/a]', '%s' - ); - $strDirectoryNotice = __('This value should be double checked to ensure that this directory is neither world accessible nor readable or writable by other users on your server.'); - $strForceSSLNotice = __('This %soption%s should be enabled if your web server supports it.'); - $strForceSSLNotice = sprintf( - $strForceSSLNotice, - '[a@?page=form&formset=Features#tab_Security]', - '[/a]' - ); - $strGZipDumpWarning = __('%sGZip compression and decompression%s requires functions (%s) which are unavailable on this system.'); - $strGZipDumpWarning = sprintf( - $strGZipDumpWarning, - '[a@?page=form&formset=Features#tab_Import_export]', - '[/a]', - '%s' - ); - $strLoginCookieValidityWarning = __('%sLogin cookie validity%s greater than %ssession.gc_maxlifetime%s may cause random session invalidation (currently session.gc_maxlifetime is %d).'); - $strLoginCookieValidityWarning = sprintf( - $strLoginCookieValidityWarning, - '[a@?page=form&formset=Features#tab_Security]', - '[/a]', - '[a@' . PMA_getPHPDocLink( - 'session.configuration.php#ini.session.gc-maxlifetime' - ) . ']', - '[/a]', - ini_get('session.gc_maxlifetime') - ); - $strLoginCookieValidityWarning2 = __('%sLogin cookie validity%s should be set to 1800 seconds (30 minutes) at most. Values larger than 1800 may pose a security risk such as impersonation.'); - $strLoginCookieValidityWarning2 = sprintf( - $strLoginCookieValidityWarning2, - '[a@?page=form&formset=Features#tab_Security]', - '[/a]' - ); - $strLoginCookieValidityWarning3 = __('If using cookie authentication and %sLogin cookie store%s is not 0, %sLogin cookie validity%s must be set to a value less or equal to it.'); - $strLoginCookieValidityWarning3 = sprintf( - $strLoginCookieValidityWarning3, - '[a@?page=form&formset=Features#tab_Security]', - '[/a]', '[a@?page=form&formset=Features#tab_Security]', - '[/a]' - ); - $strSecurityInfoMsg = __('If you feel this is necessary, use additional protection settings - %shost authentication%s settings and %strusted proxies list%s. However, IP-based protection may not be reliable if your IP belongs to an ISP where thousands of users, including you, are connected to.'); - $strSecurityInfoMsg = sprintf( - $strSecurityInfoMsg, - '[a@?page=servers&mode=edit&id=%1$d#tab_Server_config]', - '[/a]', - '[a@?page=form&formset=Features#tab_Security]', - '[/a]' - ); - $strServerAuthConfigMsg = __('You set the [kbd]config[/kbd] authentication type and included username and password for auto-login, which is not a desirable option for live hosts. Anyone who knows or guesses your phpMyAdmin URL can directly access your phpMyAdmin panel. Set %sauthentication type%s to [kbd]cookie[/kbd] or [kbd]http[/kbd].'); - $strServerAuthConfigMsg = sprintf( - $strServerAuthConfigMsg, - '[a@?page=servers&mode=edit&id=%1$d#tab_Server]', - '[/a]' - ); - $strZipDumpExportWarning = __('%sZip compression%s requires functions (%s) which are unavailable on this system.'); - $strZipDumpExportWarning = sprintf( - $strZipDumpExportWarning, - '[a@?page=form&formset=Features#tab_Import_export]', - '[/a]', - '%s' - ); - $strZipDumpImportWarning = __('%sZip decompression%s requires functions (%s) which are unavailable on this system.'); - $strZipDumpImportWarning = sprintf( - $strZipDumpImportWarning, - '[a@?page=form&formset=Features#tab_Import_export]', - '[/a]', - '%s' - ); - - for ($i = 1, $server_cnt = $cf->getServerCount(); $i <= $server_cnt; $i++) { - $cookie_auth_server = ($cf->getValue("Servers/$i/auth_type") == 'cookie'); - $cookie_auth_used |= $cookie_auth_server; - $server_name = $cf->getServerName($i); - if ($server_name == 'localhost') { - $server_name .= " [$i]"; - } - $server_name = htmlspecialchars($server_name); - - if ($cookie_auth_server && $blowfish_secret === null) { - $blowfish_secret = uniqid('', true); - $blowfish_secret_set = true; - $cf->set('blowfish_secret', $blowfish_secret); - } - - // - // $cfg['Servers'][$i]['ssl'] - // should be enabled if possible - // - if (!$cf->getValue("Servers/$i/ssl")) { - $title = PMA_lang(PMA_langName('Servers/1/ssl')) . " ($server_name)"; - PMA_messagesSet( - 'notice', - "Servers/$i/ssl", - $title, - __('You should use SSL connections if your database server supports it.') - ); - } - - // - // $cfg['Servers'][$i]['auth_type'] - // warn about full user credentials if 'auth_type' is 'config' - // - if ($cf->getValue("Servers/$i/auth_type") == 'config' - && $cf->getValue("Servers/$i/user") != '' - && $cf->getValue("Servers/$i/password") != '' - ) { - $title = PMA_lang(PMA_langName('Servers/1/auth_type')) - . " ($server_name)"; - PMA_messagesSet( - 'notice', - "Servers/$i/auth_type", - $title, - PMA_lang($strServerAuthConfigMsg, $i) . ' ' - . PMA_lang($strSecurityInfoMsg, $i) - ); - } - - // - // $cfg['Servers'][$i]['AllowRoot'] - // $cfg['Servers'][$i]['AllowNoPassword'] - // serious security flaw - // - if ($cf->getValue("Servers/$i/AllowRoot") - && $cf->getValue("Servers/$i/AllowNoPassword") - ) { - $title = PMA_lang(PMA_langName('Servers/1/AllowNoPassword')) - . " ($server_name)"; - PMA_messagesSet( - 'notice', - "Servers/$i/AllowNoPassword", - $title, - __('You allow for connecting to the server without a password.') . ' ' - . PMA_lang($strSecurityInfoMsg, $i) - ); - } - } - - // - // $cfg['blowfish_secret'] - // it's required for 'cookie' authentication - // - if ($cookie_auth_used) { - if ($blowfish_secret_set) { - // 'cookie' auth used, blowfish_secret was generated - PMA_messagesSet( - 'notice', - 'blowfish_secret_created', - PMA_lang(PMA_langName('blowfish_secret')), - $strBlowfishSecretMsg - ); - } else { - $blowfish_warnings = array(); - // check length - if (strlen($blowfish_secret) < 8) { - // too short key - $blowfish_warnings[] = __('Key is too short, it should have at least 8 characters.'); - } - // check used characters - $has_digits = (bool) preg_match('/\d/', $blowfish_secret); - $has_chars = (bool) preg_match('/\S/', $blowfish_secret); - $has_nonword = (bool) preg_match('/\W/', $blowfish_secret); - if (!$has_digits || !$has_chars || !$has_nonword) { - $blowfish_warnings[] = PMA_lang(__('Key should contain letters, numbers [em]and[/em] special characters.')); - } - if (!empty($blowfish_warnings)) { - PMA_messagesSet( - 'error', - 'blowfish_warnings' . count($blowfish_warnings), - PMA_lang(PMA_langName('blowfish_secret')), - implode('
', $blowfish_warnings) - ); - } - } - } - - // - // $cfg['ForceSSL'] - // should be enabled if possible - // - if (!$cf->getValue('ForceSSL')) { - PMA_messagesSet( - 'notice', - 'ForceSSL', - PMA_lang(PMA_langName('ForceSSL')), - PMA_lang($strForceSSLNotice) - ); - } - - // - // $cfg['AllowArbitraryServer'] - // should be disabled - // - if ($cf->getValue('AllowArbitraryServer')) { - PMA_messagesSet( - 'notice', - 'AllowArbitraryServer', - PMA_lang(PMA_langName('AllowArbitraryServer')), - PMA_lang($strAllowArbitraryServerWarning) - ); - } - - // - // $cfg['LoginCookieValidity'] - // value greater than session.gc_maxlifetime will cause - // random session invalidation after that time - if ($cf->getValue('LoginCookieValidity') > ini_get('session.gc_maxlifetime')) { - PMA_messagesSet( - 'error', - 'LoginCookieValidity', - PMA_lang(PMA_langName('LoginCookieValidity')), - PMA_lang($strLoginCookieValidityWarning) - ); - } - - // - // $cfg['LoginCookieValidity'] - // should be at most 1800 (30 min) - // - if ($cf->getValue('LoginCookieValidity') > 1800) { - PMA_messagesSet( - 'notice', - 'LoginCookieValidity', - PMA_lang(PMA_langName('LoginCookieValidity')), - PMA_lang($strLoginCookieValidityWarning2) - ); - } - - // - // $cfg['LoginCookieValidity'] - // $cfg['LoginCookieStore'] - // LoginCookieValidity must be less or equal to LoginCookieStore - // - if ($cf->getValue('LoginCookieStore') != 0 - && $cf->getValue('LoginCookieValidity') > $cf->getValue('LoginCookieStore') - ) { - PMA_messagesSet( - 'error', - 'LoginCookieValidity', - PMA_lang(PMA_langName('LoginCookieValidity')), - PMA_lang($strLoginCookieValidityWarning3) - ); - } - - // - // $cfg['SaveDir'] - // should not be world-accessible - // - if ($cf->getValue('SaveDir') != '') { - PMA_messagesSet( - 'notice', - 'SaveDir', - PMA_lang(PMA_langName('SaveDir')), - PMA_lang($strDirectoryNotice) - ); - } - - // - // $cfg['TempDir'] - // should not be world-accessible - // - if ($cf->getValue('TempDir') != '') { - PMA_messagesSet( - 'notice', - 'TempDir', - PMA_lang(PMA_langName('TempDir')), - PMA_lang($strDirectoryNotice) - ); - } - - // - // $cfg['GZipDump'] - // requires zlib functions - // - if ($cf->getValue('GZipDump') - && (@!function_exists('gzopen') || @!function_exists('gzencode')) - ) { - PMA_messagesSet( - 'error', - 'GZipDump', - PMA_lang(PMA_langName('GZipDump')), - PMA_lang($strGZipDumpWarning, 'gzencode') - ); - } - - // - // $cfg['BZipDump'] - // requires bzip2 functions - // - if ($cf->getValue('BZipDump') - && (!@function_exists('bzopen') || !@function_exists('bzcompress')) - ) { - $functions = @function_exists('bzopen') - ? '' : - 'bzopen'; - $functions .= @function_exists('bzcompress') - ? '' - : ($functions ? ', ' : '') . 'bzcompress'; - PMA_messagesSet( - 'error', - 'BZipDump', - PMA_lang(PMA_langName('BZipDump')), - PMA_lang($strBZipDumpWarning, $functions) - ); - } - - // - // $cfg['ZipDump'] - // requires zip_open in import - // - if ($cf->getValue('ZipDump') && !@function_exists('zip_open')) { - PMA_messagesSet( - 'error', - 'ZipDump_import', - PMA_lang(PMA_langName('ZipDump')), - PMA_lang($strZipDumpImportWarning, 'zip_open') - ); - } - - // - // $cfg['ZipDump'] - // requires gzcompress in export - // - if ($cf->getValue('ZipDump') && !@function_exists('gzcompress')) { - PMA_messagesSet( - 'error', - 'ZipDump_export', - PMA_lang(PMA_langName('ZipDump')), - PMA_lang($strZipDumpExportWarning, 'gzcompress') - ); - } -} -?> diff --git a/test/libraries/PMA_SetupIndex_test.php b/test/libraries/PMA_SetupIndex_test.php index 727354e9be..b11540d28b 100644 --- a/test/libraries/PMA_SetupIndex_test.php +++ b/test/libraries/PMA_SetupIndex_test.php @@ -15,6 +15,7 @@ require_once 'libraries/config/config_functions.lib.php'; require_once 'libraries/config/ConfigFile.class.php'; require_once 'libraries/core.lib.php'; require_once 'libraries/Util.class.php'; +require_once 'libraries/config/ServerConfigChecks.class.php'; require_once 'setup/lib/index.lib.php'; require_once 'libraries/php-gettext/gettext.inc'; require_once 'libraries/sanitizing.lib.php'; @@ -385,11 +386,11 @@ class PMA_SetupIndex_Test extends PHPUnit_Framework_TestCase } /** - * Test for PMA_performConfigChecks + * Test for ServerConfigChecks::performConfigChecks * * @return void */ - public function testPMAPerformConfigChecks() + public function testServerConfigChecksPerformConfigChecks() { $GLOBALS['cfg']['AvailableCharsets'] = array(); @@ -457,7 +458,8 @@ class PMA_SetupIndex_Test extends PHPUnit_Framework_TestCase $errorArrayKeys[] = 'ZipDump_export'; } - PMA_performConfigChecks(); + $configChecker = new ServerConfigChecks($GLOBALS['ConfigFile']); + $configChecker->performConfigChecks(); foreach ($noticeArrayKeys as $noticeKey) { $this->assertArrayHasKey( @@ -499,7 +501,9 @@ class PMA_SetupIndex_Test extends PHPUnit_Framework_TestCase $_SESSION[$sessionID]['BZipDump'] = false; $_SESSION[$sessionID]['ZipDump'] = false; - PMA_performConfigChecks(); + $configChecker = new ServerConfigChecks($GLOBALS['ConfigFile']); + $configChecker->performConfigChecks(); + $this->assertArrayHasKey( 'blowfish_secret_created', $_SESSION['messages']['notice'] @@ -527,12 +531,14 @@ class PMA_SetupIndex_Test extends PHPUnit_Framework_TestCase 'auth_type' => 'cookie' ) ); - PMA_performConfigChecks(); + + $configChecker = new ServerConfigChecks($GLOBALS['ConfigFile']); + $configChecker->performConfigChecks(); + $this->assertArrayHasKey( 'blowfish_warnings2', $_SESSION['messages']['error'] ); - } } ?>