diff --git a/ChangeLog b/ChangeLog index 2cbb89bbdd..e51e0bc874 100644 --- a/ChangeLog +++ b/ChangeLog @@ -6,6 +6,7 @@ phpMyAdmin - ChangeLog - issue #12459 Display read only fields as read only when editing - issue #12384 Fix expanding of navigation pane when clicking on database - issue #12430 Impove partitioning support +- issue #12374 Reintroduced simplified PmaAbsoluteUri configuration directive 4.6.4 (2016-08-16) - issue [security] Weaknesses with cookie encryption, see PMASA-2016-29 diff --git a/doc/config.rst b/doc/config.rst index 19166f07cf..b9534ac22f 100644 --- a/doc/config.rst +++ b/doc/config.rst @@ -41,10 +41,9 @@ Basic settings :type: string :default: ``''`` - .. deprecated:: 4.6.0 + .. versionchanged:: 4.6.5 - This setting is no longer available since phpMyAdmin 4.6.0. Please - adjust your webserver instead. + This setting was not available in phpMyAdmin 4.6.0 - 4.6.4. Sets here the complete :term:`URL` (with full path) to your phpMyAdmin installation's directory. E.g. @@ -63,7 +62,7 @@ Basic settings fails to detect your path, please post a bug report on our bug tracker so we can improve the code. - .. seealso:: :ref:`faq1_40` + .. seealso:: :ref:`faq1_40`, :ref:`faq2_5`, :ref:`faq4_7`, :ref:`faq5_16` .. config:option:: $cfg['PmaNoRelation_DisableWarning'] diff --git a/doc/faq.rst b/doc/faq.rst index 0499e845be..3ce1554964 100644 --- a/doc/faq.rst +++ b/doc/faq.rst @@ -561,7 +561,7 @@ This is not specific to phpmyadmin, it's just the behavior of Apache. ProxyPassReverse /mirror/foo/ http://backend.example.com/%7Euser/phpmyadmin ProxyPassReverseCookiePath /%7Euser/phpmyadmin /mirror/foo -.. seealso:: +.. seealso:: , :config:option:`$cfg['PmaAbsoluteUri']` .. _faq1_41: @@ -714,9 +714,9 @@ revision. Check your webserver setup if it correctly fills in either PHP_SELF or REQUEST_URI variables. -If you are running phpMyAdmin older than 4.6.0, you can also check the value -you set for the :config:option:`$cfg['PmaAbsoluteUri']` directive in the -phpMyAdmin configuration file. +If you are running phpMyAdmin behind reverse proxy, please set the +:config:option:`$cfg['PmaAbsoluteUri']` directive in the phpMyAdmin +configuration file to match your setup. .. _faq2_6: diff --git a/js/functions.js b/js/functions.js index 4ab6a93497..72a560c522 100644 --- a/js/functions.js +++ b/js/functions.js @@ -299,7 +299,7 @@ function PMA_clearSelection() { * * @param $elements jQuery object representing the elements * @param item the item - * (see http://api.jqueryui.com/tooltip/#option-items) + * (see https://api.jqueryui.com/tooltip/#option-items) * @param myContent content of the tooltip * @param additionalOptions to override the default options * diff --git a/libraries/Config.php b/libraries/Config.php index c90bd1f3d3..8b674ff10d 100644 --- a/libraries/Config.php +++ b/libraries/Config.php @@ -1357,8 +1357,12 @@ class Config return $this->get('is_https'); } + $url = $this->get('PmaAbsoluteUri'); + $is_https = false; - if (strtolower(PMA_getenv('HTTP_SCHEME')) == 'https') { + if (! empty($url) && parse_url($url, PHP_URL_SCHEME) === 'https') { + $is_https = true; + } elseif (strtolower(PMA_getenv('HTTP_SCHEME')) == 'https') { $is_https = true; } elseif (strtolower(PMA_getenv('HTTPS')) == 'on') { $is_https = true; @@ -1381,11 +1385,11 @@ class Config } /** - * Get cookie path + * Get phpMyAdmin root path * * @return string */ - public function getCookiePath() + public function getRootPath() { static $cookie_path = null; @@ -1393,6 +1397,18 @@ class Config return $cookie_path; } + $url = $this->get('PmaAbsoluteUri'); + + if (! empty($url)) { + $path = parse_url($url, PHP_URL_PATH); + if (! empty($path)) { + if (substr($path, -1) != '/') { + return $path . '/'; + } + return $path; + } + } + $parsed_url = parse_url($GLOBALS['PMA_PHP_SELF']); $parts = explode( @@ -1577,7 +1593,7 @@ class Config $cookie, '', time() - 3600, - $this->getCookiePath(), + $this->getRootPath(), '', $this->isHttps() ); @@ -1631,7 +1647,7 @@ class Config $cookie, $value, $validity, - $this->getCookiePath(), + $this->getRootPath(), '', $this->isHttps(), $httponly diff --git a/libraries/config.default.php b/libraries/config.default.php index 035026e1c2..33460c134a 100644 --- a/libraries/config.default.php +++ b/libraries/config.default.php @@ -19,6 +19,25 @@ * @package PhpMyAdmin */ +/** + * Your phpMyAdmin URL. + * + * Complete the variable below with the full URL ie + * http://www.your_web.net/path_to_your_phpMyAdmin_directory/ + * + * It must contain characters that are valid for a URL, and the path is + * case sensitive on some Web servers, for example Unix-based servers. + * + * In most cases you can leave this variable empty, as the correct value + * will be detected automatically. However, we recommend that you do + * test to see that the auto-detection code works in your system. A good + * test is to browse a table, then edit a row and save it. There will be + * an error message if phpMyAdmin cannot auto-detect the correct value. + * + * @global string $cfg['PmaAbsoluteUri'] + */ +$cfg['PmaAbsoluteUri'] = ''; + /** * Disable the default warning that is displayed on the DB Details Structure page if * any of the required Tables for the configuration storage could not be found diff --git a/libraries/core.lib.php b/libraries/core.lib.php index 2e17236368..87aefa2210 100644 --- a/libraries/core.lib.php +++ b/libraries/core.lib.php @@ -356,7 +356,7 @@ function PMA_getTableCount($db) /** * Converts numbers like 10M into bytes - * Used with permission from Moodle (http://moodle.org) by Martin Dougiamas + * Used with permission from Moodle (https://moodle.org) by Martin Dougiamas * (renamed with PMA prefix to avoid double definition when embedded * in Moodle) * @@ -503,7 +503,7 @@ function PMA_sendHeaderLocation($uri, $use_refresh = false) * like /phpmyadmin/index.php/ which some web servers happily accept. */ if ($uri[0] == '.') { - $uri = $GLOBALS['PMA_Config']->getCookiePath() . substr($uri, 2); + $uri = $GLOBALS['PMA_Config']->getRootPath() . substr($uri, 2); } $response = PMA\libraries\Response::getInstance(); diff --git a/libraries/session.inc.php b/libraries/session.inc.php index cf2ceb9672..f1e6370df5 100644 --- a/libraries/session.inc.php +++ b/libraries/session.inc.php @@ -28,7 +28,7 @@ if (!@function_exists('session_name')) { // session cookie settings session_set_cookie_params( - 0, $GLOBALS['PMA_Config']->getCookiePath(), + 0, $GLOBALS['PMA_Config']->getRootPath(), '', $GLOBALS['PMA_Config']->isHttps(), true ); diff --git a/test/.htaccess b/test/.htaccess index d4984c298b..0970a23a97 100644 --- a/test/.htaccess +++ b/test/.htaccess @@ -2,5 +2,5 @@ # In most cases the tests included here will be run from a command line interface. # (the following directive denies access by default) -# For more information see: http://httpd.apache.org/docs/current/mod/mod_authz_host.html#allow +# For more information see: https://httpd.apache.org/docs/current/mod/mod_authz_host.html#allow Order allow,deny diff --git a/test/classes/ConfigTest.php b/test/classes/ConfigTest.php index 7beaf01c84..729efb570a 100644 --- a/test/classes/ConfigTest.php +++ b/test/classes/ConfigTest.php @@ -641,76 +641,110 @@ class ConfigTest extends PMATestCase } /** - * Test for getting cookie path + * Test for getting root path * + * @param string $request The request URL used for phpMyAdmin * @param string $absolute The absolute URL used for phpMyAdmin - * @param string $expected Expected cookie path + * @param string $expected Expected root path * * @return void * - * @dataProvider cookieUris + * @dataProvider rootUris */ - public function testGetCookiePath($absolute, $expected) + public function testGetRootPath($request, $absolute, $expected) { - $GLOBALS['PMA_PHP_SELF'] = $absolute; - $this->assertEquals($expected, $this->object->getCookiePath()); + $GLOBALS['PMA_PHP_SELF'] = $request; + $this->object->set('PmaAbsoluteUri', $absolute); + $this->assertEquals($expected, $this->object->getRootPath()); } /** - * Data provider for testGetCookiePath + * Data provider for testGetRootPath * - * @return array data for testGetCookiePath + * @return array data for testGetRootPath */ - public function cookieUris() + public function rootUris() { return array( array( + '', '', '/', ), array( '/', + '', '/', ), array( '/index.php', + '', '/', ), array( '\\index.php', + '', '/', ), array( '\\', + '', '/', ), array( '\\path\\to\\index.php', + '', '/path/to/', ), array( '/foo/bar/phpmyadmin/index.php', + '', '/foo/bar/phpmyadmin/', ), array( '/foo/bar/phpmyadmin/', + '', '/foo/bar/phpmyadmin/', ), array( 'https://example.net/baz/phpmyadmin/', + '', '/baz/phpmyadmin/', ), array( 'http://example.net/baz/phpmyadmin/', + '', '/baz/phpmyadmin/', ), array( + 'http://example.net/phpmyadmin/', + '', + '/phpmyadmin/', + ), + array( + 'http://example.net/', + '', + '/', + ), + array( + 'http://example.net/', 'http://example.net/phpmyadmin/', '/phpmyadmin/', ), array( 'http://example.net/', - '/', + 'http://example.net/phpmyadmin', + '/phpmyadmin/', + ), + array( + 'http://example.net/', + '/phpmyadmin2', + '/phpmyadmin2/', + ), + array( + 'http://example.net/', + '/phpmyadmin3/', + '/phpmyadmin3/', ), ); } diff --git a/test/classes/plugin/auth/AuthenticationCookieTest.php b/test/classes/plugin/auth/AuthenticationCookieTest.php index 073c96b739..dbee3ccfb5 100644 --- a/test/classes/plugin/auth/AuthenticationCookieTest.php +++ b/test/classes/plugin/auth/AuthenticationCookieTest.php @@ -456,6 +456,7 @@ class AuthenticationCookieTest extends PMATestCase $GLOBALS['cfg']['CaptchaLoginPrivateKey'] = ''; $GLOBALS['cfg']['CaptchaLoginPublicKey'] = ''; $GLOBALS['cfg']['LoginCookieDeleteAll'] = true; + $GLOBALS['PMA_Config']->set('PmaAbsoluteUri', ''); $GLOBALS['cfg']['Servers'] = array(1); $_COOKIE['pmaAuth-0'] = 'test'; @@ -497,6 +498,7 @@ class AuthenticationCookieTest extends PMATestCase $GLOBALS['cfg']['CaptchaLoginPrivateKey'] = ''; $GLOBALS['cfg']['CaptchaLoginPublicKey'] = ''; $GLOBALS['cfg']['LoginCookieDeleteAll'] = false; + $GLOBALS['PMA_Config']->set('PmaAbsoluteUri', ''); $GLOBALS['cfg']['Servers'] = array(1); $GLOBALS['server'] = 1; diff --git a/test/libraries/PMA_user_preferences_test.php b/test/libraries/PMA_user_preferences_test.php index 49a10cb4e3..6f8598c287 100644 --- a/test/libraries/PMA_user_preferences_test.php +++ b/test/libraries/PMA_user_preferences_test.php @@ -360,6 +360,7 @@ class PMA_User_Preferences_Test extends PHPUnit_Framework_TestCase 'Cannot redefine constant/function - missing runkit extension' ); } + $GLOBALS['PMA_Config']->set('PmaAbsoluteUri', ''); $GLOBALS['cfg']['ServerDefault'] = 1; $GLOBALS['lang'] = ''; diff --git a/user_password.php b/user_password.php index 79060293ce..5c0f6299bd 100644 --- a/user_password.php +++ b/user_password.php @@ -112,10 +112,10 @@ function PMA_setChangePasswordMsg() $message = PMA\libraries\Message::success(__('The profile has been updated.')); if (($_REQUEST['nopass'] != '1')) { - if (empty($_REQUEST['pma_pw']) || empty($_REQUEST['pma_pw2'])) { + if (strlen($_REQUEST['pma_pw']) === 0 || strlen($_REQUEST['pma_pw2']) === 0) { $message = PMA\libraries\Message::error(__('The password is empty!')); $error = true; - } elseif ($_REQUEST['pma_pw'] != $_REQUEST['pma_pw2']) { + } elseif ($_REQUEST['pma_pw'] !== $_REQUEST['pma_pw2']) { $message = PMA\libraries\Message::error( __('The passwords aren\'t the same!') );