stageRestoreUploadFromDirectAdminTemp() accepted the raw
source_file_upload POST value as a literal filesystem path with only
an is_file() check - no ownership or allowed-root validation, unlike
the sibling queueRestoreFromFilePath(). isAllowedSqlFile() only checks
the attacker-controlled display filename, never the real source path.
Since the whole plugin runs as root, any authenticated DirectAdmin user
could stage and restore-import any file readable by root on the
server (e.g. other users' alt-mysql.conf credentials), leaking its
contents via MySQL import error output or the resulting database.
Remove the unsafe raw-path candidate entirely; only accept files whose
basename matches one inside the already-safe, fixed set of known
DirectAdmin/system temp directories.
The top-nav PHPMYADMIN button intentionally omits adminer_db to request
access to every database. determineGrantTargets() and the ticket's new
restrict_db field now distinguish that case from a specific per-row
database request instead of collapsing both into single-database scope.
After live testing on the real server, three follow-up issues surfaced:
- PhpMyAdminSso granted the temporary SSO MySQL role access to every
database the account owns, not just the one the "Zaloguj do bazy"
button was clicked for, so phpMyAdmin showed all databases. Extract
determineGrantTargets() and scope the GRANT to only the requested
database; also set phpMyAdmin's only_db from the SSO session so the
UI itself only shows that database.
- phpMyAdmin's LogoutURL pointed at da_login.php with no ticket, which
always produced "Missing or invalid phpMyAdmin login ticket." on
logout. Add a DIRECTADMIN_PANEL_PORT setting (default 2222) and
point LogoutURL at the plugin's own database list
(/CMD_PLUGINS/alt-mysql/index.html) instead.
- The create-database form kept echoing back the just-submitted
values after a successful creation, forcing manual clearing before
creating the next database. Clear the relevant $_POST keys once
creation succeeds so the form resets while still preserving sticky
values on validation failure.
Bump version to 1.2.14 and rebuild the release archive.
phpMyAdmin login was broken because phpmyadmin_install.sh never wired
the private phpMyAdmin copy into the web server: no Apache Alias was
registered via DirectAdmin CustomBuild, so the SSO redirect target was
unreachable. Add configure_apache_alias()/apply_apache_alias() (Alias +
Directory blocks, ./build rewrite_confs, httpd reload), detect the real
Apache group instead of hardcoding diradmin:diradmin, stop silently
swallowing chown/chmod failures, and verify an optional SHA256 for the
downloaded phpMyAdmin tarball. Extend phpmyadmin_health_check.sh to
detect a missing/incorrect Apache alias and to probe HTTP reachability.
Security hardening: scope temporary phpMyAdmin SSO MySQL roles to
127.0.0.1 instead of '%', tighten SSO ticket file permissions to 0640
(they contain a plaintext MySQL password), and log MySQL connection
failures for diagnosis instead of swallowing them silently.
Bump version to 1.2.12 and rebuild the release archive.
Marek Miklewicz