gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enable LOAD DATA LOCAL INFILE only when needed

Browse Source 
There is no need to have this feature allowed for normal SQL queries, it
can lead to leaking sensitive files from the web server. It's enough to
enable it only in LDI import plugin, where we control what queries are
executed.

Signed-off-by: Michal Čihař <michal@cihar.com>
This commit is contained in:
Michal Čihař 2016-07-23 08:59:02 +02:00
parent f261abbdf9
commit d03954bf9c
3 changed files with 16 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
import.php
View File

@ -6,6 +6,11 @@
* @package PhpMyAdmin
*/
/* Enable LOAD DATA LOCAL INFILE for LDI plugin */
if (isset($_POST['format']) && $_POST['format'] == 'ldi') {
define('PMA_ENABLE_LDI', 1);
}
/**
* Get the variables sent or posted to this script and a core script
*/

10
libraries/dbi/mysql.dbi.lib.php
View File

@ -114,10 +114,12 @@ function PMA_DBI_connect(
$client_flags = 0;
// always use CLIENT_LOCAL_FILES as defined in mysql_com.h
// for the case where the client library was not compiled
// with --enable-local-infile
$client_flags |= 128;
if (defined('PMA_ENABLE_LDI')) {
// use CLIENT_LOCAL_FILES as defined in mysql_com.h
// for the case where the client library was not compiled
// with --enable-local-infile
$client_flags |= 128;
}
/* Optionally compress connection */
if (defined('MYSQL_CLIENT_COMPRESS') && $cfg['Server']['compress']) {

6
libraries/dbi/mysqli.dbi.lib.php
View File

@ -147,7 +147,11 @@ function PMA_DBI_connect(
$link = mysqli_init();
mysqli_options($link, MYSQLI_OPT_LOCAL_INFILE, true);
if (defined('PMA_ENABLE_LDI')) {
mysqli_options($link, MYSQLI_OPT_LOCAL_INFILE, true);
} else {
mysqli_options($link, MYSQLI_OPT_LOCAL_INFILE, false);
}
$client_flags = 0;