extract_payload_from_archive() relied entirely on tar's own default
path-traversal protection when extracting a DirectAdmin restore
archive to locate the plugin's backup/alt_mysql payload. Explicitly
inspect the archive listing first and refuse to extract at all if any
member has an absolute path or a ".." segment, rather than trusting
that the wildcard extraction pattern happens to filter out an unsafe
member.
alt_mysql_restore_payload.sh (the DirectAdmin native-restore hook that
imports a plugin-origin backup payload into alt-mariadb) had zero
behavioral test coverage - only hook-installation plumbing was tested.
Add a fake mariadb/mariadb-dump client stub (tracking a simple
existing-databases state file) to exercise the real script end-to-end
without a live server, covering: checksum mismatch rejection,
overwrite=deny enforcement against an existing database, and the
happy-path restore. Add a DA_ALT_MYSQL_SETTINGS_FILE override (same
pattern as worker.sh's PLUGIN_DIR) so the script's settings file can be
pointed at a test fixture instead of the real system one.
Also extend da_integration_install_test.sh to check hook-symlink
install/uninstall coverage for database_delete_pre.sh,
database_user_password_change_pre.sh, database_user_create_post.sh,
and database_destroy_user_post.sh, which were previously untested
(only database_create_pre.sh was checked).
The mkdir-based worker lock had no staleness detection at all, unlike
BackupQueueService::withQueueLock()'s 120s override for its own queue
lock. If the root cron-driven worker was ever killed ungracefully (OOM,
kill -9, reboot mid-job), the lock directory was left behind forever -
every subsequent cron tick would silently exit without processing any
job, so backups/restores would queue forever with no visible error.
Track the owning PID inside the lock directory and reclaim the lock
when that PID is no longer running, or when the lock has no PID file
and is older than WORKER_LOCK_STALE_SECONDS (default 300s). Log to
stderr on both the "held by a live worker" and "reclaiming stale lock"
paths instead of exiting silently either way. cleanup() now uses rm -rf
since the lock directory holds a pid file, not just an empty marker.
da_login.php now stores the ticket's restrict_db into
DA_MYSQL_PHPMYADMIN_RESTRICT_DB, and config.inc.php's only_db builder
reads that key instead of the landing-page db field, so an
all-databases login (empty restrict_db) leaves phpMyAdmin unrestricted.
After live testing on the real server, three follow-up issues surfaced:
- PhpMyAdminSso granted the temporary SSO MySQL role access to every
database the account owns, not just the one the "Zaloguj do bazy"
button was clicked for, so phpMyAdmin showed all databases. Extract
determineGrantTargets() and scope the GRANT to only the requested
database; also set phpMyAdmin's only_db from the SSO session so the
UI itself only shows that database.
- phpMyAdmin's LogoutURL pointed at da_login.php with no ticket, which
always produced "Missing or invalid phpMyAdmin login ticket." on
logout. Add a DIRECTADMIN_PANEL_PORT setting (default 2222) and
point LogoutURL at the plugin's own database list
(/CMD_PLUGINS/alt-mysql/index.html) instead.
- The create-database form kept echoing back the just-submitted
values after a successful creation, forcing manual clearing before
creating the next database. Clear the relevant $_POST keys once
creation succeeds so the form resets while still preserving sticky
values on validation failure.
Bump version to 1.2.14 and rebuild the release archive.
Live testing on a real DirectAdmin/CustomBuild server showed the Apache
alias fix alone wasn't enough: the default vhost serving /var/www/html
uses `SuexecUserGroup webapps webapps`, so PHP for the private phpMyAdmin
copy actually executes as user/group "webapps" - not as Apache's own
httpd.conf "Group" (typically "apache"), which is what
detect_apache_group() was reading. SSO ticket files ended up owned
root:apache with mode 0640, unreadable by the webapps-executing
da_login.php, producing "The phpMyAdmin login ticket is not available
or has already been used." even though the ticket really was written.
detect_apache_group() now checks the default vhost's SuexecUserGroup
directive first (the actual PHP-execution identity under SuExec), and
only falls back to the plain Apache Group directive when no
SuexecUserGroup is configured.
Bump version to 1.2.13 and rebuild the release archive.
phpMyAdmin login was broken because phpmyadmin_install.sh never wired
the private phpMyAdmin copy into the web server: no Apache Alias was
registered via DirectAdmin CustomBuild, so the SSO redirect target was
unreachable. Add configure_apache_alias()/apply_apache_alias() (Alias +
Directory blocks, ./build rewrite_confs, httpd reload), detect the real
Apache group instead of hardcoding diradmin:diradmin, stop silently
swallowing chown/chmod failures, and verify an optional SHA256 for the
downloaded phpMyAdmin tarball. Extend phpmyadmin_health_check.sh to
detect a missing/incorrect Apache alias and to probe HTTP reachability.
Security hardening: scope temporary phpMyAdmin SSO MySQL roles to
127.0.0.1 instead of '%', tighten SSO ticket file permissions to 0640
(they contain a plaintext MySQL password), and log MySQL connection
failures for diagnosis instead of swallowing them silently.
Bump version to 1.2.12 and rebuild the release archive.
Marek Miklewicz