From 311be7515c8c280041565594ca853f31a4177082 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Wed, 17 Aug 2016 13:17:41 +0200 Subject: [PATCH 1/9] Use https when available MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- js/functions.js | 2 +- libraries/core.lib.php | 2 +- test/.htaccess | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/js/functions.js b/js/functions.js index 4ab6a93497..72a560c522 100644 --- a/js/functions.js +++ b/js/functions.js @@ -299,7 +299,7 @@ function PMA_clearSelection() { * * @param $elements jQuery object representing the elements * @param item the item - * (see http://api.jqueryui.com/tooltip/#option-items) + * (see https://api.jqueryui.com/tooltip/#option-items) * @param myContent content of the tooltip * @param additionalOptions to override the default options * diff --git a/libraries/core.lib.php b/libraries/core.lib.php index 2e17236368..2ae59e58ca 100644 --- a/libraries/core.lib.php +++ b/libraries/core.lib.php @@ -356,7 +356,7 @@ function PMA_getTableCount($db) /** * Converts numbers like 10M into bytes - * Used with permission from Moodle (http://moodle.org) by Martin Dougiamas + * Used with permission from Moodle (https://moodle.org) by Martin Dougiamas * (renamed with PMA prefix to avoid double definition when embedded * in Moodle) * diff --git a/test/.htaccess b/test/.htaccess index d4984c298b..0970a23a97 100644 --- a/test/.htaccess +++ b/test/.htaccess @@ -2,5 +2,5 @@ # In most cases the tests included here will be run from a command line interface. # (the following directive denies access by default) -# For more information see: http://httpd.apache.org/docs/current/mod/mod_authz_host.html#allow +# For more information see: https://httpd.apache.org/docs/current/mod/mod_authz_host.html#allow Order allow,deny From 76a471a790bf31873f469866374dfbab63e5f40c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Wed, 17 Aug 2016 13:18:45 +0200 Subject: [PATCH 2/9] Avoid problems with PHP comparison MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - allow password where empty returns true - compare using === Signed-off-by: Michal Čihař --- user_password.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/user_password.php b/user_password.php index 79060293ce..5c0f6299bd 100644 --- a/user_password.php +++ b/user_password.php @@ -112,10 +112,10 @@ function PMA_setChangePasswordMsg() $message = PMA\libraries\Message::success(__('The profile has been updated.')); if (($_REQUEST['nopass'] != '1')) { - if (empty($_REQUEST['pma_pw']) || empty($_REQUEST['pma_pw2'])) { + if (strlen($_REQUEST['pma_pw']) === 0 || strlen($_REQUEST['pma_pw2']) === 0) { $message = PMA\libraries\Message::error(__('The password is empty!')); $error = true; - } elseif ($_REQUEST['pma_pw'] != $_REQUEST['pma_pw2']) { + } elseif ($_REQUEST['pma_pw'] !== $_REQUEST['pma_pw2']) { $message = PMA\libraries\Message::error( __('The passwords aren\'t the same!') ); From b53fff29b20ebdc04aa34515e3c3a7940c2e065e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Wed, 17 Aug 2016 14:44:21 +0200 Subject: [PATCH 3/9] Crossreference docs for PmaAbsoluteUri MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Issue #12374 Signed-off-by: Michal Čihař --- doc/config.rst | 2 +- doc/faq.rst | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/config.rst b/doc/config.rst index 19166f07cf..fda8be5ee5 100644 --- a/doc/config.rst +++ b/doc/config.rst @@ -63,7 +63,7 @@ Basic settings fails to detect your path, please post a bug report on our bug tracker so we can improve the code. - .. seealso:: :ref:`faq1_40` + .. seealso:: :ref:`faq1_40`, :ref:`faq2_5`, :ref:`faq4_7`, :ref:`faq5_16` .. config:option:: $cfg['PmaNoRelation_DisableWarning'] diff --git a/doc/faq.rst b/doc/faq.rst index 0499e845be..ba5e98e272 100644 --- a/doc/faq.rst +++ b/doc/faq.rst @@ -561,7 +561,7 @@ This is not specific to phpmyadmin, it's just the behavior of Apache. ProxyPassReverse /mirror/foo/ http://backend.example.com/%7Euser/phpmyadmin ProxyPassReverseCookiePath /%7Euser/phpmyadmin /mirror/foo -.. seealso:: +.. seealso:: , :config:option:`$cfg['PmaAbsoluteUri']` .. _faq1_41: From 1099f68c1a94c39e1f04baa6403152f00b3ee345 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Wed, 17 Aug 2016 15:14:46 +0200 Subject: [PATCH 4/9] Reintroduce PmaAbsoluteUri setting MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It has no affect yet. Issue #12374 Signed-off-by: Michal Čihař --- doc/config.rst | 5 ++--- doc/faq.rst | 6 +++--- libraries/config.default.php | 19 +++++++++++++++++++ 3 files changed, 24 insertions(+), 6 deletions(-) diff --git a/doc/config.rst b/doc/config.rst index fda8be5ee5..b9534ac22f 100644 --- a/doc/config.rst +++ b/doc/config.rst @@ -41,10 +41,9 @@ Basic settings :type: string :default: ``''`` - .. deprecated:: 4.6.0 + .. versionchanged:: 4.6.5 - This setting is no longer available since phpMyAdmin 4.6.0. Please - adjust your webserver instead. + This setting was not available in phpMyAdmin 4.6.0 - 4.6.4. Sets here the complete :term:`URL` (with full path) to your phpMyAdmin installation's directory. E.g. diff --git a/doc/faq.rst b/doc/faq.rst index ba5e98e272..3ce1554964 100644 --- a/doc/faq.rst +++ b/doc/faq.rst @@ -714,9 +714,9 @@ revision. Check your webserver setup if it correctly fills in either PHP_SELF or REQUEST_URI variables. -If you are running phpMyAdmin older than 4.6.0, you can also check the value -you set for the :config:option:`$cfg['PmaAbsoluteUri']` directive in the -phpMyAdmin configuration file. +If you are running phpMyAdmin behind reverse proxy, please set the +:config:option:`$cfg['PmaAbsoluteUri']` directive in the phpMyAdmin +configuration file to match your setup. .. _faq2_6: diff --git a/libraries/config.default.php b/libraries/config.default.php index 035026e1c2..33460c134a 100644 --- a/libraries/config.default.php +++ b/libraries/config.default.php @@ -19,6 +19,25 @@ * @package PhpMyAdmin */ +/** + * Your phpMyAdmin URL. + * + * Complete the variable below with the full URL ie + * http://www.your_web.net/path_to_your_phpMyAdmin_directory/ + * + * It must contain characters that are valid for a URL, and the path is + * case sensitive on some Web servers, for example Unix-based servers. + * + * In most cases you can leave this variable empty, as the correct value + * will be detected automatically. However, we recommend that you do + * test to see that the auto-detection code works in your system. A good + * test is to browse a table, then edit a row and save it. There will be + * an error message if phpMyAdmin cannot auto-detect the correct value. + * + * @global string $cfg['PmaAbsoluteUri'] + */ +$cfg['PmaAbsoluteUri'] = ''; + /** * Disable the default warning that is displayed on the DB Details Structure page if * any of the required Tables for the configuration storage could not be found From 83476322ba5a31caf17651ac57256da54b3cda10 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Wed, 17 Aug 2016 15:15:20 +0200 Subject: [PATCH 5/9] Use PmaAbsolueUri for cookie path MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Issue #12374 Signed-off-by: Michal Čihař --- libraries/Config.php | 9 +++++++++ test/classes/plugin/auth/AuthenticationCookieTest.php | 2 ++ test/libraries/PMA_user_preferences_test.php | 1 + 3 files changed, 12 insertions(+) diff --git a/libraries/Config.php b/libraries/Config.php index c90bd1f3d3..668d3da3a4 100644 --- a/libraries/Config.php +++ b/libraries/Config.php @@ -1393,6 +1393,15 @@ class Config return $cookie_path; } + $url = $this->get('PmaAbsoluteUri'); + + if (! empty($url)) { + $path = parse_url($url, PHP_URL_PATH); + if (! empty($path)) { + return $path; + } + } + $parsed_url = parse_url($GLOBALS['PMA_PHP_SELF']); $parts = explode( diff --git a/test/classes/plugin/auth/AuthenticationCookieTest.php b/test/classes/plugin/auth/AuthenticationCookieTest.php index 073c96b739..dbee3ccfb5 100644 --- a/test/classes/plugin/auth/AuthenticationCookieTest.php +++ b/test/classes/plugin/auth/AuthenticationCookieTest.php @@ -456,6 +456,7 @@ class AuthenticationCookieTest extends PMATestCase $GLOBALS['cfg']['CaptchaLoginPrivateKey'] = ''; $GLOBALS['cfg']['CaptchaLoginPublicKey'] = ''; $GLOBALS['cfg']['LoginCookieDeleteAll'] = true; + $GLOBALS['PMA_Config']->set('PmaAbsoluteUri', ''); $GLOBALS['cfg']['Servers'] = array(1); $_COOKIE['pmaAuth-0'] = 'test'; @@ -497,6 +498,7 @@ class AuthenticationCookieTest extends PMATestCase $GLOBALS['cfg']['CaptchaLoginPrivateKey'] = ''; $GLOBALS['cfg']['CaptchaLoginPublicKey'] = ''; $GLOBALS['cfg']['LoginCookieDeleteAll'] = false; + $GLOBALS['PMA_Config']->set('PmaAbsoluteUri', ''); $GLOBALS['cfg']['Servers'] = array(1); $GLOBALS['server'] = 1; diff --git a/test/libraries/PMA_user_preferences_test.php b/test/libraries/PMA_user_preferences_test.php index 49a10cb4e3..6f8598c287 100644 --- a/test/libraries/PMA_user_preferences_test.php +++ b/test/libraries/PMA_user_preferences_test.php @@ -360,6 +360,7 @@ class PMA_User_Preferences_Test extends PHPUnit_Framework_TestCase 'Cannot redefine constant/function - missing runkit extension' ); } + $GLOBALS['PMA_Config']->set('PmaAbsoluteUri', ''); $GLOBALS['cfg']['ServerDefault'] = 1; $GLOBALS['lang'] = ''; From 01b9db6b1c6f986ee38b814b37879082cd2d4520 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Wed, 17 Aug 2016 15:22:46 +0200 Subject: [PATCH 6/9] Rename getCookiePath() to getRootPath() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It is not used only for cookies, so generic name makes more sense. Issue #12374 Signed-off-by: Michal Čihař --- libraries/Config.php | 8 ++++---- libraries/core.lib.php | 2 +- libraries/session.inc.php | 2 +- test/classes/ConfigTest.php | 37 ++++++++++++++++++++++++++++--------- 4 files changed, 34 insertions(+), 15 deletions(-) diff --git a/libraries/Config.php b/libraries/Config.php index 668d3da3a4..0da7500578 100644 --- a/libraries/Config.php +++ b/libraries/Config.php @@ -1381,11 +1381,11 @@ class Config } /** - * Get cookie path + * Get phpMyAdmin root path * * @return string */ - public function getCookiePath() + public function getRootPath() { static $cookie_path = null; @@ -1586,7 +1586,7 @@ class Config $cookie, '', time() - 3600, - $this->getCookiePath(), + $this->getRootPath(), '', $this->isHttps() ); @@ -1640,7 +1640,7 @@ class Config $cookie, $value, $validity, - $this->getCookiePath(), + $this->getRootPath(), '', $this->isHttps(), $httponly diff --git a/libraries/core.lib.php b/libraries/core.lib.php index 2ae59e58ca..87aefa2210 100644 --- a/libraries/core.lib.php +++ b/libraries/core.lib.php @@ -503,7 +503,7 @@ function PMA_sendHeaderLocation($uri, $use_refresh = false) * like /phpmyadmin/index.php/ which some web servers happily accept. */ if ($uri[0] == '.') { - $uri = $GLOBALS['PMA_Config']->getCookiePath() . substr($uri, 2); + $uri = $GLOBALS['PMA_Config']->getRootPath() . substr($uri, 2); } $response = PMA\libraries\Response::getInstance(); diff --git a/libraries/session.inc.php b/libraries/session.inc.php index cf2ceb9672..f1e6370df5 100644 --- a/libraries/session.inc.php +++ b/libraries/session.inc.php @@ -28,7 +28,7 @@ if (!@function_exists('session_name')) { // session cookie settings session_set_cookie_params( - 0, $GLOBALS['PMA_Config']->getCookiePath(), + 0, $GLOBALS['PMA_Config']->getRootPath(), '', $GLOBALS['PMA_Config']->isHttps(), true ); diff --git a/test/classes/ConfigTest.php b/test/classes/ConfigTest.php index 7beaf01c84..b364e0c5bb 100644 --- a/test/classes/ConfigTest.php +++ b/test/classes/ConfigTest.php @@ -641,77 +641,96 @@ class ConfigTest extends PMATestCase } /** - * Test for getting cookie path + * Test for getting root path * + * @param string $request The request URL used for phpMyAdmin * @param string $absolute The absolute URL used for phpMyAdmin - * @param string $expected Expected cookie path + * @param string $expected Expected root path * * @return void * - * @dataProvider cookieUris + * @dataProvider rootUris */ - public function testGetCookiePath($absolute, $expected) + public function testGetRootPath($request, $absolute, $expected) { - $GLOBALS['PMA_PHP_SELF'] = $absolute; - $this->assertEquals($expected, $this->object->getCookiePath()); + $GLOBALS['PMA_PHP_SELF'] = $request; + $this->object->set('PmaAbsoluteUri', $absolute); + $this->assertEquals($expected, $this->object->getRootPath()); } /** - * Data provider for testGetCookiePath + * Data provider for testGetRootPath * - * @return array data for testGetCookiePath + * @return array data for testGetRootPath */ - public function cookieUris() + public function rootUris() { return array( array( + '', '', '/', ), array( '/', + '', '/', ), array( '/index.php', + '', '/', ), array( '\\index.php', + '', '/', ), array( '\\', + '', '/', ), array( '\\path\\to\\index.php', + '', '/path/to/', ), array( '/foo/bar/phpmyadmin/index.php', + '', '/foo/bar/phpmyadmin/', ), array( '/foo/bar/phpmyadmin/', + '', '/foo/bar/phpmyadmin/', ), array( 'https://example.net/baz/phpmyadmin/', + '', '/baz/phpmyadmin/', ), array( 'http://example.net/baz/phpmyadmin/', + '', '/baz/phpmyadmin/', ), array( 'http://example.net/phpmyadmin/', + '', '/phpmyadmin/', ), array( 'http://example.net/', + '', '/', ), + array( + 'http://example.net/', + 'http://example.net/phpmyadmin/', + '/phpmyadmin/', + ), ); } From a458b704127c0cd1b21d8111842a7ff86043d74e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Wed, 17 Aug 2016 15:26:29 +0200 Subject: [PATCH 7/9] Use PmaAbsoluteUri for isHttps MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Issue #12374 Signed-off-by: Michal Čihař --- libraries/Config.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libraries/Config.php b/libraries/Config.php index 0da7500578..d5bed568c7 100644 --- a/libraries/Config.php +++ b/libraries/Config.php @@ -1357,8 +1357,12 @@ class Config return $this->get('is_https'); } + $url = $this->get('PmaAbsoluteUri'); + $is_https = false; - if (strtolower(PMA_getenv('HTTP_SCHEME')) == 'https') { + if (! empty($url) && parse_url($url, PHP_URL_SCHEME) === 'https') { + $is_https = true; + } elseif (strtolower(PMA_getenv('HTTP_SCHEME')) == 'https') { $is_https = true; } elseif (strtolower(PMA_getenv('HTTPS')) == 'on') { $is_https = true; From f6a64ed83518aad7985942158fc492d7e6cbec62 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Wed, 17 Aug 2016 15:27:19 +0200 Subject: [PATCH 8/9] Reintroduced simplified PmaAbsoluteUri configuration directive MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes #12374 Signed-off-by: Michal Čihař --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 2cbb89bbdd..e51e0bc874 100644 --- a/ChangeLog +++ b/ChangeLog @@ -6,6 +6,7 @@ phpMyAdmin - ChangeLog - issue #12459 Display read only fields as read only when editing - issue #12384 Fix expanding of navigation pane when clicking on database - issue #12430 Impove partitioning support +- issue #12374 Reintroduced simplified PmaAbsoluteUri configuration directive 4.6.4 (2016-08-16) - issue [security] Weaknesses with cookie encryption, see PMASA-2016-29 From 7898060916b7b9d82ef35d73117228c7246f510a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Wed, 17 Aug 2016 15:37:20 +0200 Subject: [PATCH 9/9] Ensure PmaAbsoluteUri ends with / MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This was probably most frequest user error we want to fix. Issue #12374 Signed-off-by: Michal Čihař --- libraries/Config.php | 3 +++ test/classes/ConfigTest.php | 15 +++++++++++++++ 2 files changed, 18 insertions(+) diff --git a/libraries/Config.php b/libraries/Config.php index d5bed568c7..8b674ff10d 100644 --- a/libraries/Config.php +++ b/libraries/Config.php @@ -1402,6 +1402,9 @@ class Config if (! empty($url)) { $path = parse_url($url, PHP_URL_PATH); if (! empty($path)) { + if (substr($path, -1) != '/') { + return $path . '/'; + } return $path; } } diff --git a/test/classes/ConfigTest.php b/test/classes/ConfigTest.php index b364e0c5bb..729efb570a 100644 --- a/test/classes/ConfigTest.php +++ b/test/classes/ConfigTest.php @@ -731,6 +731,21 @@ class ConfigTest extends PMATestCase 'http://example.net/phpmyadmin/', '/phpmyadmin/', ), + array( + 'http://example.net/', + 'http://example.net/phpmyadmin', + '/phpmyadmin/', + ), + array( + 'http://example.net/', + '/phpmyadmin2', + '/phpmyadmin2/', + ), + array( + 'http://example.net/', + '/phpmyadmin3/', + '/phpmyadmin3/', + ), ); }