From 93e354c2e33347a138234d236b2e987a7f092b14 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Sat, 7 Jan 2017 14:22:14 +0100 Subject: [PATCH 1/4] Revert "Remove option to show phpinfo() ($cfg['ShowPhpInfo'])" This reverts commit e67e69229a1df3a26df12b1bae89065834fd85b4. --- doc/config.rst | 14 +++++++++++++- index.php | 11 ++++++++++- libraries/common.inc.php | 1 + libraries/config.default.php | 7 +++++++ libraries/config/messages.inc.php | 5 +++++ libraries/config/setup.forms.php | 1 + phpinfo.php | 22 ++++++++++++++++++++++ 7 files changed, 59 insertions(+), 2 deletions(-) create mode 100644 phpinfo.php diff --git a/doc/config.rst b/doc/config.rst index dc464797e1..b167a05695 100644 --- a/doc/config.rst +++ b/doc/config.rst @@ -1850,6 +1850,11 @@ Main panel You can additionally hide more information by using :config:option:`$cfg['Servers'][$i]['verbose']`. +.. config:option:: $cfg['ShowPhpInfo'] + + :type: boolean + :default: false + .. config:option:: $cfg['ShowChgPassword'] :type: boolean @@ -1860,11 +1865,18 @@ Main panel :type: boolean :default: true - Defines whether to display the + Defines whether to display the :guilabel:`PHP information` and :guilabel:`Change password` links and form for creating database or not at the starting main (right) frame. This setting does not check MySQL commands entered directly. + Please note that to block the usage of ``phpinfo()`` in scripts, you have to + put this in your :file:`php.ini`: + + .. code-block:: ini + + disable_functions = phpinfo() + Also note that enabling the :guilabel:`Change password` link has no effect with config authentication mode: because of the hard coded password value in the configuration file, end users can't be allowed to change their diff --git a/index.php b/index.php index 7643c68407..c7fc9d1225 100644 --- a/index.php +++ b/index.php @@ -317,7 +317,7 @@ if ($server > 0 && $GLOBALS['cfg']['ShowServerInfo']) { . ' '; } -if ($GLOBALS['cfg']['ShowServerInfo']) { +if ($GLOBALS['cfg']['ShowServerInfo'] || $GLOBALS['cfg']['ShowPhpInfo']) { echo '
'; echo '

' , __('Web server') , '

'; echo ''; echo '
'; } diff --git a/libraries/common.inc.php b/libraries/common.inc.php index 8a2cbbf8de..bcdb8b573f 100644 --- a/libraries/common.inc.php +++ b/libraries/common.inc.php @@ -316,6 +316,7 @@ $goto_whitelist = array( 'index.php', 'pdf_pages.php', 'pdf_schema.php', + //'phpinfo.php', 'server_binlog.php', 'server_collations.php', 'server_databases.php', diff --git a/libraries/config.default.php b/libraries/config.default.php index 9d91c999c8..ea91e0ab0d 100644 --- a/libraries/config.default.php +++ b/libraries/config.default.php @@ -1057,6 +1057,13 @@ $cfg['NavigationTreeShowEvents'] = true; */ $cfg['ShowStats'] = true; +/** + * show PHP info link + * + * @global boolean $cfg['ShowPhpInfo'] + */ +$cfg['ShowPhpInfo'] = false; + /** * show MySQL server and web server information * diff --git a/libraries/config/messages.inc.php b/libraries/config/messages.inc.php index 418bfdd66d..49a23e9b03 100644 --- a/libraries/config/messages.inc.php +++ b/libraries/config/messages.inc.php @@ -865,6 +865,11 @@ $strConfigShowFunctionFields_desc = __( $strConfigShowFunctionFields_name = __('Show function fields'); $strConfigShowHint_desc = __('Whether to show hint or not.'); $strConfigShowHint_name = __('Show hint'); +$strConfigShowPhpInfo_desc = __( + 'Shows link to [a@https://php.net/manual/function.phpinfo.php]phpinfo()[/a] ' . + 'output.' +); +$strConfigShowPhpInfo_name = __('Show phpinfo() link'); $strConfigShowServerInfo_name = __('Show detailed MySQL server information'); $strConfigShowSQL_desc = __( 'Defines whether SQL queries generated by phpMyAdmin should be displayed.' diff --git a/libraries/config/setup.forms.php b/libraries/config/setup.forms.php index c8743d4e1c..cfffe9d5d1 100644 --- a/libraries/config/setup.forms.php +++ b/libraries/config/setup.forms.php @@ -203,6 +203,7 @@ $forms['Main_panel']['Startup'] = array( 'ShowCreateDb', 'ShowStats', 'ShowServerInfo', + 'ShowPhpInfo', 'ShowChgPassword'); $forms['Main_panel']['DbStructure'] = array( 'ShowDbStructureComment', diff --git a/phpinfo.php b/phpinfo.php new file mode 100644 index 0000000000..6ac84c7ea4 --- /dev/null +++ b/phpinfo.php @@ -0,0 +1,22 @@ +disable(); +$response->getHeader()->sendHttpHeaders(); + +/** + * Displays PHP information + */ +if ($GLOBALS['cfg']['ShowPhpInfo']) { + phpinfo(); +} From 1089a7d67e39f9017ae96c92b922f89648dff240 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Sat, 7 Jan 2017 14:23:28 +0100 Subject: [PATCH 2/4] Limit what we display in phpinfo MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - general information - configuration - modules This way we avoid displaying sensitive things (such as httpOnly cookies from environment of variables). Signed-off-by: Michal Čihař --- phpinfo.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/phpinfo.php b/phpinfo.php index 6ac84c7ea4..0daa5f9f65 100644 --- a/phpinfo.php +++ b/phpinfo.php @@ -18,5 +18,5 @@ $response->getHeader()->sendHttpHeaders(); * Displays PHP information */ if ($GLOBALS['cfg']['ShowPhpInfo']) { - phpinfo(); + phpinfo(INFO_GENERAL | INFO_CONFIGURATION | INFO_MODULES); } From fdbef2dcc8e027155e3e5f3af8e460482830c9e0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Sat, 7 Jan 2017 14:30:37 +0100 Subject: [PATCH 3/4] Add warning about enabling phpinfo MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- doc/config.rst | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/doc/config.rst b/doc/config.rst index b167a05695..8aeb0560b7 100644 --- a/doc/config.rst +++ b/doc/config.rst @@ -1877,6 +1877,14 @@ Main panel disable_functions = phpinfo() + .. warning:: + + Enabling phpinfo page will leak quite a lot of information about server + setup. Is it not recommended to enable this on shared installations. + + This might also make easier some remote attacks on your installations, + so enable this only when needed. + Also note that enabling the :guilabel:`Change password` link has no effect with config authentication mode: because of the hard coded password value in the configuration file, end users can't be allowed to change their From 4abbe78a071d46283c5db485f38d8db691322e18 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Sat, 7 Jan 2017 16:09:57 +0100 Subject: [PATCH 4/4] Remove unused entries from goto whitelist MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- libraries/common.inc.php | 8 -------- 1 file changed, 8 deletions(-) diff --git a/libraries/common.inc.php b/libraries/common.inc.php index bcdb8b573f..9326b1f936 100644 --- a/libraries/common.inc.php +++ b/libraries/common.inc.php @@ -294,9 +294,6 @@ $GLOBALS['url_params'] = array(); * @global array $goto_whitelist */ $goto_whitelist = array( - //'browse_foreigners.php', - //'changelog.php', - //'chk_rel.php', 'db_datadict.php', 'db_sql.php', 'db_events.php', @@ -310,13 +307,9 @@ $goto_whitelist = array( 'db_routines.php', 'export.php', 'import.php', - //'index.php', - //'navigation.php', - //'license.php', 'index.php', 'pdf_pages.php', 'pdf_schema.php', - //'phpinfo.php', 'server_binlog.php', 'server_collations.php', 'server_databases.php', @@ -346,7 +339,6 @@ $goto_whitelist = array( 'tbl_row_action.php', 'tbl_select.php', 'tbl_zoom_select.php', - //'themes.php', 'transformation_overview.php', 'transformation_wrapper.php', 'user_password.php',