Scope phpMyAdmin SSO to one database, fix logout, reset create form

After live testing on the real server, three follow-up issues surfaced:

- PhpMyAdminSso granted the temporary SSO MySQL role access to every
  database the account owns, not just the one the "Zaloguj do bazy"
  button was clicked for, so phpMyAdmin showed all databases. Extract
  determineGrantTargets() and scope the GRANT to only the requested
  database; also set phpMyAdmin's only_db from the SSO session so the
  UI itself only shows that database.

- phpMyAdmin's LogoutURL pointed at da_login.php with no ticket, which
  always produced "Missing or invalid phpMyAdmin login ticket." on
  logout. Add a DIRECTADMIN_PANEL_PORT setting (default 2222) and
  point LogoutURL at the plugin's own database list
  (/CMD_PLUGINS/alt-mysql/index.html) instead.

- The create-database form kept echoing back the just-submitted
  values after a successful creation, forcing manual clearing before
  creating the next database. Clear the relevant $_POST keys once
  creation succeeds so the form resets while still preserving sticky
  values on validation failure.

Bump version to 1.2.14 and rebuild the release archive.

tests/package_archive_test.sh

@@ -2,7 +2,7 @@
 set -euo pipefail
 
 PLUGIN_DIR="$(cd "$(dirname "$0")/.." && pwd)"
-ARCHIVE="${1:-$(cd "$PLUGIN_DIR/.." && pwd)/archives/1.2.13/alt-mysql.tar.gz}"
+ARCHIVE="${1:-$(cd "$PLUGIN_DIR/.." && pwd)/archives/1.2.14/alt-mysql.tar.gz}"
 
 fail() {
   echo "FAIL: $*" >&2
@@ -37,7 +37,7 @@ fi
 CONF="$(tar -xOzf "$ARCHIVE" ./plugin.conf 2>/dev/null || tar -xOzf "$ARCHIVE" plugin.conf)"
 printf '%s\n' "$CONF" | grep -Fxq "name=alt-mysql" || fail "archive plugin name is not alt-mysql"
 printf '%s\n' "$CONF" | grep -Fxq "id=alt-mysql" || fail "archive plugin id is not alt-mysql"
-printf '%s\n' "$CONF" | grep -Fxq "version=1.2.13" || fail "archive plugin version is not 1.2.13"
+printf '%s\n' "$CONF" | grep -Fxq "version=1.2.14" || fail "archive plugin version is not 1.2.14"
 
 SETTINGS="$(tar -xOzf "$ARCHIVE" ./plugin-settings.conf 2>/dev/null || tar -xOzf "$ARCHIVE" plugin-settings.conf)"
 printf '%s\n' "$SETTINGS" | grep -Fxq "PHPMYADMIN_INSTALL_DIR=/var/www/html/alt-mysql-phpmyadmin" \

tests/phpmyadmin_install_test.sh

@@ -116,11 +116,30 @@ php -r '
       fwrite(STDERR, "SignonURL mismatch\n");
       exit(5);
   }
-  if (($server["LogoutURL"] ?? "") !== "https://panel.example.test/alt-mysql-phpmyadmin/da_login.php") {
-      fwrite(STDERR, "LogoutURL mismatch\n");
+  if (($server["LogoutURL"] ?? "") !== "https://panel.example.test:2222/CMD_PLUGINS/alt-mysql/index.html") {
+      fwrite(STDERR, "LogoutURL mismatch, got: " . ($server["LogoutURL"] ?? "(empty)") . "\n");
       exit(6);
   }
 ' "$SERVER_JSON" || fail "phpMyAdmin config does not target alt-mariadb TCP endpoint"
+
+# config.inc.php must restrict phpMyAdmin's visible database to the one the
+# SSO ticket was issued for, not show every database the account can reach.
+mkdir -p "$SESSION_DIR"
+ONLY_DB="$(php -d session.save_path="$SESSION_DIR" -r '
+  session_name("DA_MYSQL_PHPMYADMIN");
+  session_id("onlydbtest");
+  session_start();
+  $_SESSION["DA_MYSQL_PHPMYADMIN_AUTH"] = ["user" => "x", "password" => "y", "db" => "demo_target_db"];
+  session_write_close();
+
+  $_COOKIE["DA_MYSQL_PHPMYADMIN"] = "onlydbtest";
+  $cfg = [];
+  include $argv[1];
+  echo $cfg["Servers"][1]["only_db"] ?? "";
+' "$CONFIG_INC")"
+[ "$ONLY_DB" = "demo_target_db" ] \
+  || fail "config.inc.php only_db should be scoped to the SSO ticket's database, got: '$ONLY_DB'"
+
 grep -Fq 'return [$username, $password];' "$SIGNON_SCRIPT" \
   || fail "signon script should return username/password only"
 php -d display_errors=1 -r 'set_error_handler(static function($errno, $errstr) { fwrite(STDERR, $errstr . "\n"); exit(9); }); $cfg=[]; include $argv[1]; include $argv[2];' "$CONFIG_INC" "$SIGNON_SCRIPT" \

tests/phpmyadmin_sso_test.php

@@ -38,6 +38,17 @@ function load_settings(string $contents): Settings
     return $settings;
 }
 
+// --- phpMyAdmin logout must know the DirectAdmin panel port to build a valid return URL ---
+
+$defaultPanelPortSettings = load_settings('');
+assert_same('2222', $defaultPanelPortSettings->directAdminPanelPort(), 'DIRECTADMIN_PANEL_PORT should default to 2222');
+
+$customPanelPortSettings = load_settings("DIRECTADMIN_PANEL_PORT=2280\n");
+assert_same('2280', $customPanelPortSettings->directAdminPanelPort(), 'DIRECTADMIN_PANEL_PORT should be configurable');
+
+$invalidPanelPortSettings = load_settings("DIRECTADMIN_PANEL_PORT=not-a-port\n");
+assert_same('2222', $invalidPanelPortSettings->directAdminPanelPort(), 'a non-numeric DIRECTADMIN_PANEL_PORT should fall back to 2222');
+
 // --- Temporary SSO role must be host-scoped, not wildcard '%' ---
 
 $mysqlServiceSource = (string)file_get_contents($pluginDir . '/exec/lib/MySQLService.php');
@@ -50,6 +61,24 @@ $mysqlServiceClass = new ReflectionClass(MySQLService::class);
 assert_true($mysqlServiceClass->hasConstant('TMP_ROLE_HOST'), 'MySQLService must define a TMP_ROLE_HOST constant');
 assert_same('127.0.0.1', $mysqlServiceClass->getConstant('TMP_ROLE_HOST'), 'TMP_ROLE_HOST must scope the temporary SSO role to the phpMyAdmin app host');
 
+// --- phpMyAdmin SSO must only grant access to the database being logged into, not every database the account owns ---
+
+$ssoClassForGrants = new ReflectionClass(PhpMyAdminSso::class);
+assert_true($ssoClassForGrants->hasMethod('determineGrantTargets'), 'PhpMyAdminSso must expose a determineGrantTargets() decision method');
+$determineGrantTargets = $ssoClassForGrants->getMethod('determineGrantTargets');
+$determineGrantTargets->setAccessible(true);
+
+assert_same(
+    ['demo_target'],
+    $determineGrantTargets->invoke(null, 'demo_target', ['demo_target', 'demo_other']),
+    'issuing a ticket for one database must only grant that database, not every database the user owns'
+);
+assert_same(
+    [],
+    $determineGrantTargets->invoke(null, 'not_owned', ['demo_target', 'demo_other']),
+    'a target database that is not in the owned list must never be granted'
+);
+
 // --- phpMyAdmin login ticket files must not be world-readable ---
 
 $ssoDir = sys_get_temp_dir() . '/altmysql-pma-sso-' . bin2hex(random_bytes(4));

tests/plugin_identity_test.sh

@@ -14,7 +14,7 @@ case "$(basename "$PLUGIN_DIR")" in
 esac
 grep -Fxq "name=alt-mysql" "$PLUGIN_DIR/plugin.conf" || fail "plugin.conf name is not alt-mysql"
 grep -Fxq "id=alt-mysql" "$PLUGIN_DIR/plugin.conf" || fail "plugin.conf id is not alt-mysql"
-grep -Fxq "version=1.2.13" "$PLUGIN_DIR/plugin.conf" || fail "plugin.conf version is not 1.2.13"
+grep -Fxq "version=1.2.14" "$PLUGIN_DIR/plugin.conf" || fail "plugin.conf version is not 1.2.14"
 grep -Fq "return '/CMD_PLUGINS/alt-mysql';" "$PLUGIN_DIR/exec/lib/AppContext.php" \
   || fail "AppContext base URL is not alt-mysql"
 grep -Fq "\$pluginId = 'alt-mysql';" "$PLUGIN_DIR/exec/lib/DirectAdminUser.php" \