Merge remote-tracking branch 'origin/pull/12875' into QA_4_6

doc/config.rst

@@ -1850,6 +1850,11 @@ Main panel
     You can additionally hide more information by using
     :config:option:`$cfg['Servers'][$i]['verbose']`.
 
+.. config:option:: $cfg['ShowPhpInfo']
+
+    :type: boolean
+    :default: false
+
 .. config:option:: $cfg['ShowChgPassword']
 
     :type: boolean
@@ -1860,11 +1865,26 @@ Main panel
     :type: boolean
     :default: true
 
-    Defines whether to display the 
+    Defines whether to display the :guilabel:`PHP information` and
     :guilabel:`Change password` links and form for creating database or not at
     the starting main (right) frame. This setting does not check MySQL commands
     entered directly.
 
+    Please note that to block the usage of ``phpinfo()`` in scripts, you have to
+    put this in your :file:`php.ini`:
+
+    .. code-block:: ini
+
+        disable_functions = phpinfo()
+
+    .. warning::
+
+        Enabling phpinfo page will leak quite a lot of information about server
+        setup. Is it not recommended to enable this on shared installations.
+
+        This might also make easier some remote attacks on your installations,
+        so enable this only when needed.
+
     Also note that enabling the :guilabel:`Change password` link has no effect
     with config authentication mode: because of the hard coded password value
     in the configuration file, end users can't be allowed to change their

index.php

@@ -317,7 +317,7 @@ if ($server > 0 && $GLOBALS['cfg']['ShowServerInfo']) {
        . ' </div>';
 }
 
-if ($GLOBALS['cfg']['ShowServerInfo']) {
+if ($GLOBALS['cfg']['ShowServerInfo'] || $GLOBALS['cfg']['ShowPhpInfo']) {
     echo '<div class="group">';
     echo '<h2>' , __('Web server') , '</h2>';
     echo '<ul>';
@@ -357,6 +357,15 @@ if ($GLOBALS['cfg']['ShowServerInfo']) {
         }
     }
 
+    if ($cfg['ShowPhpInfo']) {
+        PMA_printListItem(
+            __('Show PHP information'),
+            'li_phpinfo',
+            'phpinfo.php' . $common_url_query,
+            null,
+            '_blank'
+        );
+    }
     echo '  </ul>';
     echo ' </div>';
 }

libraries/common.inc.php

@@ -294,9 +294,6 @@ $GLOBALS['url_params'] = array();
  * @global array $goto_whitelist
  */
 $goto_whitelist = array(
-    //'browse_foreigners.php',
-    //'changelog.php',
-    //'chk_rel.php',
     'db_datadict.php',
     'db_sql.php',
     'db_events.php',
@@ -310,9 +307,6 @@ $goto_whitelist = array(
     'db_routines.php',
     'export.php',
     'import.php',
-    //'index.php',
-    //'navigation.php',
-    //'license.php',
     'index.php',
     'pdf_pages.php',
     'pdf_schema.php',
@@ -345,7 +339,6 @@ $goto_whitelist = array(
     'tbl_row_action.php',
     'tbl_select.php',
     'tbl_zoom_select.php',
-    //'themes.php',
     'transformation_overview.php',
     'transformation_wrapper.php',
     'user_password.php',

libraries/config.default.php

@@ -1057,6 +1057,13 @@ $cfg['NavigationTreeShowEvents'] = true;
  */
 $cfg['ShowStats'] = true;
 
+/**
+ * show PHP info link
+ *
+ * @global boolean $cfg['ShowPhpInfo']
+ */
+$cfg['ShowPhpInfo'] = false;
+
 /**
  * show MySQL server and web server information
  *

libraries/config/messages.inc.php

@@ -865,6 +865,11 @@ $strConfigShowFunctionFields_desc = __(
 $strConfigShowFunctionFields_name = __('Show function fields');
 $strConfigShowHint_desc = __('Whether to show hint or not.');
 $strConfigShowHint_name = __('Show hint');
+$strConfigShowPhpInfo_desc = __(
+    'Shows link to [a@https://php.net/manual/function.phpinfo.php]phpinfo()[/a] ' .
+    'output.'
+);
+$strConfigShowPhpInfo_name = __('Show phpinfo() link');
 $strConfigShowServerInfo_name = __('Show detailed MySQL server information');
 $strConfigShowSQL_desc = __(
     'Defines whether SQL queries generated by phpMyAdmin should be displayed.'

libraries/config/setup.forms.php

@@ -203,6 +203,7 @@ $forms['Main_panel']['Startup'] = array(
     'ShowCreateDb',
     'ShowStats',
     'ShowServerInfo',
+    'ShowPhpInfo',
     'ShowChgPassword');
 $forms['Main_panel']['DbStructure'] = array(
     'ShowDbStructureComment',

phpinfo.php

@@ -0,0 +1,22 @@
+<?php
+/* vim: set expandtab sw=4 ts=4 sts=4: */
+/**
+ * phpinfo() wrapper to allow displaying only when configured to do so.
+ *
+ * @package PhpMyAdmin
+ */
+
+/**
+ * Gets core libraries and defines some variables
+ */
+require_once 'libraries/common.inc.php';
+$response = PMA\libraries\Response::getInstance();
+$response->disable();
+$response->getHeader()->sendHttpHeaders();
+
+/**
+ * Displays PHP information
+ */
+if ($GLOBALS['cfg']['ShowPhpInfo']) {
+    phpinfo(INFO_GENERAL | INFO_CONFIGURATION | INFO_MODULES);
+}