Marek Miklewicz
ba64342702
phpMyAdmin login was broken because phpmyadmin_install.sh never wired the private phpMyAdmin copy into the web server: no Apache Alias was registered via DirectAdmin CustomBuild, so the SSO redirect target was unreachable. Add configure_apache_alias()/apply_apache_alias() (Alias + Directory blocks, ./build rewrite_confs, httpd reload), detect the real Apache group instead of hardcoding diradmin:diradmin, stop silently swallowing chown/chmod failures, and verify an optional SHA256 for the downloaded phpMyAdmin tarball. Extend phpmyadmin_health_check.sh to detect a missing/incorrect Apache alias and to probe HTTP reachability. Security hardening: scope temporary phpMyAdmin SSO MySQL roles to 127.0.0.1 instead of '%', tighten SSO ticket file permissions to 0640 (they contain a plaintext MySQL password), and log MySQL connection failures for diagnosis instead of swallowing them silently. Bump version to 1.2.12 and rebuild the release archive.
78 lines
3.8 KiB
Bash
78 lines
3.8 KiB
Bash
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
PHPMYADMIN_DIR="${PHPMYADMIN_PRIVATE_DIR:-${PHPMYADMIN_DIR:-/var/www/html/alt-mysql-phpmyadmin}}"
|
|
PHPMYADMIN_URL_PATH="${PHPMYADMIN_URL_PATH:-/alt-mysql-phpmyadmin}"
|
|
CONFIG_INC="${PHPMYADMIN_DIR}/config.inc.php"
|
|
SIGNON_SCRIPT="${PHPMYADMIN_DIR}/da_signon.php"
|
|
SIGNON_URL_PAGE="${PHPMYADMIN_DIR}/da_login.php"
|
|
RUNTIME_CONFIG="${PHPMYADMIN_DIR}/runtime/config.json"
|
|
CUSTOMBUILD_DIR="${CUSTOMBUILD_DIR:-/usr/local/directadmin/custombuild}"
|
|
APACHE_ALIAS_CUSTOM="${CUSTOMBUILD_DIR}/custom/ap2/conf/extra/httpd-alias.conf"
|
|
|
|
fail() {
|
|
printf 'phpMyAdmin alt-mysql health: %s\n' "$*" >&2
|
|
exit 1
|
|
}
|
|
|
|
warn() {
|
|
printf 'phpMyAdmin alt-mysql health: WARNING: %s\n' "$*" >&2
|
|
}
|
|
|
|
[ -d "$PHPMYADMIN_DIR" ] || fail "phpMyAdmin directory not found: $PHPMYADMIN_DIR"
|
|
[ -r "$PHPMYADMIN_DIR/index.php" ] || fail "phpMyAdmin index.php is not readable: $PHPMYADMIN_DIR/index.php"
|
|
[ -r "$CONFIG_INC" ] || fail "config.inc.php is not readable: $CONFIG_INC"
|
|
[ -r "$SIGNON_SCRIPT" ] || fail "signon script is not readable: $SIGNON_SCRIPT"
|
|
[ -r "$SIGNON_URL_PAGE" ] || fail "SignonURL page is not readable: $SIGNON_URL_PAGE"
|
|
grep -Fq "DA_MYSQL_PMA_DEFAULT_CONF" "$CONFIG_INC" || fail "config.inc.php does not configure alt-mysql endpoint"
|
|
grep -Fq "auth_type'] = 'signon" "$CONFIG_INC" || fail "config.inc.php does not configure signon auth"
|
|
grep -Fq "SignonURL'] = da_mysql_phpmyadmin_signon_url" "$CONFIG_INC" || fail "config.inc.php does not configure dynamic SignonURL"
|
|
grep -Fq "da_mysql_login_consume_ticket" "$SIGNON_URL_PAGE" || fail "da_login.php does not consume SSO tickets"
|
|
grep -Fq "DA_MYSQL_DEFAULT_CONF = '/usr/local/directadmin/conf/alt-mysql.conf'" "$SIGNON_SCRIPT" \
|
|
|| fail "signon script does not default to alt-mysql.conf"
|
|
|
|
[ -r "$APACHE_ALIAS_CUSTOM" ] \
|
|
|| fail "Apache alias config not found: $APACHE_ALIAS_CUSTOM - phpMyAdmin is not reachable over HTTP, run phpmyadmin_install.sh"
|
|
grep -Fq "# BEGIN ALT_MYSQL_PHPMYADMIN" "$APACHE_ALIAS_CUSTOM" \
|
|
|| fail "Apache alias block missing in $APACHE_ALIAS_CUSTOM - phpMyAdmin is not reachable over HTTP, run phpmyadmin_install.sh"
|
|
grep -Fq "Alias ${PHPMYADMIN_URL_PATH} ${PHPMYADMIN_DIR}" "$APACHE_ALIAS_CUSTOM" \
|
|
|| fail "Apache alias in $APACHE_ALIAS_CUSTOM does not point at $PHPMYADMIN_DIR"
|
|
|
|
if [ -r "$RUNTIME_CONFIG" ] && command -v php >/dev/null 2>&1; then
|
|
php -r '
|
|
$path = $argv[1];
|
|
$data = json_decode(file_get_contents($path), true);
|
|
if (!is_array($data)) {
|
|
fwrite(STDERR, "runtime config is not valid JSON\n");
|
|
exit(2);
|
|
}
|
|
if (($data["credentials_file"] ?? "") === "/usr/local/directadmin/conf/mysql.conf") {
|
|
fwrite(STDERR, "runtime config points to native DirectAdmin mysql.conf\n");
|
|
exit(3);
|
|
}
|
|
' "$RUNTIME_CONFIG" || fail "runtime config validation failed"
|
|
fi
|
|
|
|
if [ -r "$RUNTIME_CONFIG" ] && command -v php >/dev/null 2>&1 && command -v curl >/dev/null 2>&1; then
|
|
PROBE_URL="$(php -r '
|
|
$data = json_decode(file_get_contents($argv[1]), true);
|
|
$base = trim((string)($data["phpmyadmin_public_base_url"] ?? ""));
|
|
$path = trim((string)($data["phpmyadmin_url_path"] ?? ""));
|
|
if ($base === "" || $path === "") {
|
|
exit(0);
|
|
}
|
|
echo rtrim($base, "/") . $path . "/da_login.php";
|
|
' "$RUNTIME_CONFIG" 2>/dev/null || true)"
|
|
|
|
if [ -n "$PROBE_URL" ]; then
|
|
HTTP_CODE="$(curl -s -o /dev/null -m 5 -w '%{http_code}' "$PROBE_URL" 2>/dev/null || true)"
|
|
if [ -z "$HTTP_CODE" ] || [ "$HTTP_CODE" = "000" ]; then
|
|
warn "could not reach $PROBE_URL over HTTP (no response) - verify the webserver serves the Apache alias"
|
|
elif [ "$HTTP_CODE" = "404" ]; then
|
|
warn "$PROBE_URL returned HTTP 404 - the Apache alias may not be applied yet, run: cd ${CUSTOMBUILD_DIR} && ./build rewrite_confs && systemctl reload httpd"
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
echo "phpMyAdmin alt-mysql health: OK"
|