Skip to content

Commit 801485a

Browse files
nijelnijel
committed
Remove setup download/load/delete features
This removes risk of third party manipulating with the configuration as there was race condition between editing and using the file. Downloading the file should not be big hassle and this really makes the whole setup a bit simpler. Signed-off-by: Michal Čihař <michal@cihar.com>
1 parent f8ad5bd commit 801485a

File tree

7 files changed

+8
-184
lines changed

7 files changed

+8
-184
lines changed

‎doc/setup.rst‎

Lines changed: 8 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -92,51 +92,14 @@ For a full explanation of possible configuration values, see the
9292
Using Setup script
9393
------------------
9494
95-
Instead of manually editing :file:`config.inc.php`, you can use the `Setup
96-
Script <setup/>`_. First you must manually create a folder ``config``
97-
in the phpMyAdmin directory. This is a security measure. On a
98-
Linux/Unix system you can use the following commands:
99-
100-
.. code-block:: sh
101-
102-
103-
cd phpMyAdmin
104-
mkdir config # create directory for saving
105-
chmod o+rw config # give it world writable permissions
106-
107-
And to edit an existing configuration, copy it over first:
108-
109-
.. code-block:: sh
110-
111-
112-
cp config.inc.php config/ # copy current configuration for editing
113-
chmod o+w config/config.inc.php # give it world writable permissions
114-
115-
On other platforms, simply create the folder and ensure that your web
116-
server has read and write access to it. :ref:`faq1_26` can help with
117-
this.
118-
119-
Next, open ``setup/`` in your browser. If you have an existing configuration,
120-
use the ``Load`` button to bring its content inside the setup panel.
121-
Note that **changes are not saved to disk until explicitly choose ``Save``**
122-
from the *Configuration* area of the screen. Normally the script saves the new
123-
:file:`config.inc.php` to the ``config/`` directory, but if the webserver does
124-
not have the proper permissions you may see the error "Cannot load or
125-
save configuration." Ensure that the ``config/`` directory exists and
126-
has the proper permissions - or use the ``Download`` link to save the
127-
config file locally and upload it (via FTP or some similar means) to the
128-
proper location.
129-
130-
Once the file has been saved, it must be moved out of the ``config/``
131-
directory and the permissions must be reset, again as a security
132-
measure:
133-
134-
.. code-block:: sh
135-
136-
137-
mv config/config.inc.php . # move file to current directory
138-
chmod o-rw config.inc.php # remove world read and write permissions
139-
rm -rf config # remove not needed directory
95+
Instead of manually editing :file:`config.inc.php`, you can use phpMyAdmin's
96+
setup feature. The file can be generated using the setup and you can download it
97+
for upload to the server.
98+
99+
Next, open your browser and visit the location where you installed phpMyAdmin,
100+
with the ``/setup`` suffix. The changes are not saved to the server, you need to
101+
use the :guilabel:`Download` button to save them to your computer and then upload
102+
to the server.
140103
141104
Now the file is ready to be used. You can choose to review or edit the
142105
file with your favorite editor, if you prefer to set some advanced

‎libraries/config/ConfigFile.class.php‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -486,21 +486,6 @@ public function removeServer($server)
486486
}
487487
}
488488

489-
/**
490-
* Returns config file path, relative to phpMyAdmin's root path
491-
*
492-
* @return string
493-
*/
494-
public function getFilePath()
495-
{
496-
// Load paths
497-
if (!defined('SETUP_CONFIG_FILE')) {
498-
include_once './libraries/vendor_config.php';
499-
}
500-
501-
return SETUP_CONFIG_FILE;
502-
}
503-
504489
/**
505490
* Returns configuration array (full, multidimensional format)
506491
*

‎libraries/vendor_config.php‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -25,17 +25,6 @@
2525
*/
2626
define('LICENSE_FILE', './LICENSE');
2727

28-
/**
29-
* Path to config file generated using setup script.
30-
*/
31-
define('SETUP_CONFIG_FILE', './config/config.inc.php');
32-
33-
/**
34-
* Whether setup requires writable directory where config
35-
* file will be generated.
36-
*/
37-
define('SETUP_DIR_WRITABLE', true);
38-
3928
/**
4029
* Directory where configuration files are stored.
4130
* It is not used directly in code, just a convenient

‎setup/config.php‎

Lines changed: 0 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -16,28 +16,9 @@
1616

1717
require './libraries/config/setup.forms.php';
1818

19-
/**
20-
* Loads configuration file path
21-
*
22-
* Do this in a function to avoid messing up with global $cfg
23-
*
24-
* @param string $config_file_path
25-
*
26-
* @return array
27-
*/
28-
function loadConfig($config_file_path)
29-
{
30-
$cfg = array();
31-
if (file_exists($config_file_path)) {
32-
include $config_file_path;
33-
}
34-
return $cfg;
35-
}
36-
3719
$form_display = new FormDisplay();
3820
$form_display->registerForm('_config.php', $forms['_config.php']);
3921
$form_display->save('_config.php');
40-
$config_file_path = ConfigFile::getInstance()->getFilePath();
4122

4223
if (isset($_POST['eol'])) {
4324
$_SESSION['eol'] = ($_POST['eol'] == 'unix') ? 'unix' : 'win';
@@ -59,40 +40,6 @@ function loadConfig($config_file_path)
5940
PMA_downloadHeader('config.inc.php', 'text/plain');
6041
echo ConfigGenerator::getConfigFile();
6142
exit;
62-
} elseif (PMA_ifSetOr($_POST['submit_save'], '')) {
63-
//
64-
// Save generated config file on the server
65-
//
66-
$result = @file_put_contents(
67-
$config_file_path,
68-
ConfigGenerator::getConfigFile()
69-
);
70-
if ($result === false) {
71-
$state = 'config_not_saved';
72-
} else {
73-
$state = 'config_saved';
74-
}
75-
header('HTTP/1.1 303 See Other');
76-
header('Location: index.php?action_done=' . $state);
77-
exit;
78-
} elseif (PMA_ifSetOr($_POST['submit_load'], '')) {
79-
//
80-
// Load config file from the server
81-
//
82-
ConfigFile::getInstance()->setConfigData(
83-
loadConfig($config_file_path)
84-
);
85-
header('HTTP/1.1 303 See Other');
86-
header('Location: index.php');
87-
exit;
88-
} elseif (PMA_ifSetOr($_POST['submit_delete'], '')) {
89-
//
90-
// Delete config file on the server
91-
//
92-
@unlink($config_file_path);
93-
header('HTTP/1.1 303 See Other');
94-
header('Location: index.php');
95-
exit;
9643
} else {
9744
//
9845
// Show generated config file in a <textarea>

‎setup/frames/config.inc.php‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,6 @@
1717
require_once './setup/lib/index.lib.php';
1818
require_once './setup/lib/ConfigGenerator.class.php';
1919

20-
$config_readable = false;
21-
$config_writable = false;
22-
$config_exists = false;
23-
check_config_rw($config_readable, $config_writable, $config_exists);
2420
?>
2521
<h2><?php echo __('Configuration file') ?></h2>
2622
<?php PMA_displayFormTop('config.php'); ?>
@@ -36,10 +32,6 @@
3632
<tr>
3733
<td class="lastrow" style="text-align: left">
3834
<input type="submit" name="submit_download" value="<?php echo __('Download') ?>" class="green" />
39-
<input type="submit" name="submit_save" value="<?php echo __('Save') ?>"<?php
40-
if (!$config_writable) {
41-
echo ' disabled="disabled"';
42-
} ?> />
4335
</td>
4436
</tr>
4537
<?php

‎setup/frames/index.inc.php‎

Lines changed: 0 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -39,19 +39,6 @@
3939
//
4040
perform_config_checks();
4141

42-
//
43-
// Check whether we can read/write configuration
44-
//
45-
$config_readable = false;
46-
$config_writable = false;
47-
$config_exists = false;
48-
check_config_rw($config_readable, $config_writable, $config_exists);
49-
if (!$config_writable || !$config_readable) {
50-
messages_set(
51-
'error', 'config_rw', __('Cannot load or save configuration'),
52-
PMA_lang(__('Please create web server writable folder [em]config[/em] in phpMyAdmin top level directory as described in [doc@setup_script]documentation[/doc]. Otherwise you will be only able to download or display it.'))
53-
);
54-
}
5542
//
5643
// Check https connection
5744
//
@@ -259,20 +246,6 @@
259246
<td colspan="2" class="lastrow" style="text-align: left">
260247
<input type="submit" name="submit_display" value="<?php echo __('Display') ?>" />
261248
<input type="submit" name="submit_download" value="<?php echo __('Download') ?>" />
262-
&nbsp; &nbsp;
263-
<input type="submit" name="submit_save" value="<?php echo __('Save') ?>"<?php
264-
if (!$config_writable) {
265-
echo ' disabled="disabled"';
266-
} ?> />
267-
<input type="submit" name="submit_load" value="<?php echo __('Load') ?>"<?php
268-
if (!$config_exists) {
269-
echo ' disabled="disabled"';
270-
} ?> />
271-
<input type="submit" name="submit_delete" value="<?php echo __('Delete')
272-
?>"<?php
273-
if (!$config_exists || !$config_writable) {
274-
echo ' disabled="disabled"';
275-
} ?> />
276249
&nbsp; &nbsp;
277250
<input type="submit" name="submit_clear" value="<?php echo __('Clear')
278251
?>" class="red" />

‎setup/lib/index.lib.php‎

Lines changed: 0 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -255,31 +255,6 @@ function version_to_int($version)
255255
return $matches[1] * 1000000 + $matches[2] * 10000 + $matches[3] * 100 + $added;
256256
}
257257

258-
/**
259-
* Checks whether config file is readable/writable
260-
*
261-
* @param bool &$is_readable
262-
* @param bool &$is_writable
263-
* @param bool &$file_exists
264-
*
265-
* @return void
266-
*/
267-
function check_config_rw(&$is_readable, &$is_writable, &$file_exists)
268-
{
269-
$file_path = ConfigFile::getInstance()->getFilePath();
270-
$file_dir = dirname($file_path);
271-
$is_readable = true;
272-
$is_writable = is_dir($file_dir);
273-
if (SETUP_DIR_WRITABLE) {
274-
$is_writable = $is_writable && is_writable($file_dir);
275-
}
276-
$file_exists = file_exists($file_path);
277-
if ($file_exists) {
278-
$is_readable = is_readable($file_path);
279-
$is_writable = $is_writable && is_writable($file_path);
280-
}
281-
}
282-
283258
/**
284259
* Performs various compatibility, security and consistency checks on current config
285260
*

0 commit comments

Comments
 (0)