Merge branch 'MAINT_4_0_5' into QA_4_0

doc/config.rst

@@ -119,6 +119,15 @@ Basic settings
 
     Show warning about incomplete translations on certain threshold.
 
+.. config:option:: $cfg['AllowThirdPartyFraming']
+
+    :type: boolean
+    :default: false
+    
+    Setting this to ``true`` allows phpMyAdmin to be included inside a frame,
+    and is a potential security hole allowing cross-frame scripting attacks or
+    clickjacking.
+
 Server connection settings
 --------------------------
 

js/cross_framing_protection.js

@@ -0,0 +1,9 @@
+/* vim: set expandtab sw=4 ts=4 sts=4: */
+/**
+ * Conditionally included if framing is not allowed
+ */
+if(self == top) {
+    document.documentElement.style.display = 'block' ;
+} else {
+    top.location = self.location ;
+}

libraries/Header.class.php

@@ -158,6 +158,12 @@ class PMA_Header
         $this->_scripts->addFile('jquery/jquery.ba-hashchange-1.3.js');
         $this->_scripts->addFile('jquery/jquery.debounce-1.0.5.js');
         $this->_scripts->addFile('jquery/jquery.menuResizer-1.0.js');
+
+        // Cross-framing protection
+        if ($GLOBALS['cfg']['AllowThirdPartyFraming'] === false) {
+            $this->_scripts->addFile('cross_framing_protection.js');
+        }
+
         $this->_scripts->addFile('rte.js');
 
         // Here would not be a good place to add CodeMirror because
@@ -449,6 +455,12 @@ class PMA_Header
          */
         $GLOBALS['now'] = gmdate('D, d M Y H:i:s') . ' GMT';
         if (! defined('TESTSUITE')) {
+            /* Prevent against ClickJacking by disabling framing */
+            if (! $GLOBALS['cfg']['AllowThirdPartyFraming']) {
+                header(
+                    'X-Frame-Options: DENY'
+                );
+            }
             header(
                 "X-Content-Security-Policy: default-src 'self' "
                 . $GLOBALS['cfg']['CSPAllow'] . ';'
@@ -519,6 +531,7 @@ class PMA_Header
         $retval  = '<meta charset="utf-8" />';
         $retval .= '<meta name="robots" content="noindex,nofollow" />';
         $retval .= '<meta http-equiv="X-UA-Compatible" content="IE=Edge">';
+        $retval .= '<style>html{display: none;}</style>';
         return $retval;
     }
 

libraries/Scripts.class.php

@@ -129,6 +129,7 @@ class PMA_Scripts
             || strpos($filename, 'ajax.js') !== false
             || strpos($filename, 'navigation.js') !== false
             || strpos($filename, 'get_image.js.php') !== false
+            || strpos($filename, 'cross_framing_protection.js') !== false
         ) {
             return 0;
         } else {

libraries/config.default.php

@@ -83,6 +83,14 @@ $cfg['ReservedWordDisableWarning'] = false;
  */
 $cfg['TranslationWarningThreshold'] = 80;
 
+/**
+ * Allows phpMyAdmin to be included from a other document in a frame;
+ * setting this to true is a potential security hole
+ *
+ * @global boolean $cfg['AllowThirdPartyFraming']
+ */
+$cfg['AllowThirdPartyFraming'] = false;
+
 /**
  * The 'cookie' auth_type uses blowfish algorithm to encrypt the password. If
  * at least one server configuration uses 'cookie' auth_type, enter here a

libraries/config/messages.inc.php

@@ -16,6 +16,8 @@ if (!function_exists('__')) {
 
 $strConfigAllowArbitraryServer_desc = __('If enabled user can enter any MySQL server in login form for cookie auth');
 $strConfigAllowArbitraryServer_name = __('Allow login to any MySQL server');
+$strConfigAllowThirdPartyFraming_desc = __('Enabling this allows a page located on a different domain to call phpMyAdmin inside a frame, and is a potential [strong]security hole[/strong] allowing cross-frame scripting attacks');
+$strConfigAllowThirdPartyFraming_name = __('Allow third party framing');
 $strConfigAllowUserDropDatabase_name = __('Show "Drop database" link to normal users');
 $strConfigblowfish_secret_desc = __('Secret passphrase used for encrypting cookies in [kbd]cookie[/kbd] authentication');
 $strConfigblowfish_secret_name = __('Blowfish secret');

libraries/config/setup.forms.php

@@ -136,7 +136,8 @@ $forms['Features']['Other_core_settings'] = array(
     'MemoryLimit',
     'SkipLockedTables',
     'DisableMultiTableMaintenance',
-    'UseDbSearch');
+    'UseDbSearch',
+    'AllowThirdPartyFraming');
 $forms['Sql_queries']['Sql_queries'] = array(
     'ShowSQL',
     'Confirm',