From d03954bf9ca3b1cc4037214e7983617732282872 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@cihar.com>
Date: Sat, 23 Jul 2016 08:59:02 +0200
Subject: [PATCH] Enable LOAD DATA LOCAL INFILE only when needed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There is no need to have this feature allowed for normal SQL queries, it
can lead to leaking sensitive files from the web server. It's enough to
enable it only in LDI import plugin, where we control what queries are
executed.

Signed-off-by: Michal Čihař <michal@cihar.com>
---
 import.php                       |  5 +++++
 libraries/dbi/mysql.dbi.lib.php  | 10 ++++++----
 libraries/dbi/mysqli.dbi.lib.php |  6 +++++-
 3 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/import.php b/import.php
index 90b15554b9..2a493af219 100644
--- a/import.php
+++ b/import.php
@@ -6,6 +6,11 @@
  * @package PhpMyAdmin
  */
 
+/* Enable LOAD DATA LOCAL INFILE for LDI plugin */
+if (isset($_POST['format']) && $_POST['format'] == 'ldi') {
+    define('PMA_ENABLE_LDI', 1);
+}
+
 /**
  * Get the variables sent or posted to this script and a core script
  */
diff --git a/libraries/dbi/mysql.dbi.lib.php b/libraries/dbi/mysql.dbi.lib.php
index 6a7e15df5f..438905c50f 100644
--- a/libraries/dbi/mysql.dbi.lib.php
+++ b/libraries/dbi/mysql.dbi.lib.php
@@ -114,10 +114,12 @@ function PMA_DBI_connect(
 
     $client_flags = 0;
 
-    // always use CLIENT_LOCAL_FILES as defined in mysql_com.h
-    // for the case where the client library was not compiled
-    // with --enable-local-infile
-    $client_flags |= 128;
+    if (defined('PMA_ENABLE_LDI')) {
+        // use CLIENT_LOCAL_FILES as defined in mysql_com.h
+        // for the case where the client library was not compiled
+        // with --enable-local-infile
+        $client_flags |= 128;
+    }
 
     /* Optionally compress connection */
     if (defined('MYSQL_CLIENT_COMPRESS') && $cfg['Server']['compress']) {
diff --git a/libraries/dbi/mysqli.dbi.lib.php b/libraries/dbi/mysqli.dbi.lib.php
index bf485212de..7ed1e9b3d1 100644
--- a/libraries/dbi/mysqli.dbi.lib.php
+++ b/libraries/dbi/mysqli.dbi.lib.php
@@ -147,7 +147,11 @@ function PMA_DBI_connect(
 
     $link = mysqli_init();
 
-    mysqli_options($link, MYSQLI_OPT_LOCAL_INFILE, true);
+    if (defined('PMA_ENABLE_LDI')) {
+        mysqli_options($link, MYSQLI_OPT_LOCAL_INFILE, true);
+    } else {
+        mysqli_options($link, MYSQLI_OPT_LOCAL_INFILE, false);
+    }
 
     $client_flags = 0;