Marek Miklewicz
ba64342702
phpMyAdmin login was broken because phpmyadmin_install.sh never wired the private phpMyAdmin copy into the web server: no Apache Alias was registered via DirectAdmin CustomBuild, so the SSO redirect target was unreachable. Add configure_apache_alias()/apply_apache_alias() (Alias + Directory blocks, ./build rewrite_confs, httpd reload), detect the real Apache group instead of hardcoding diradmin:diradmin, stop silently swallowing chown/chmod failures, and verify an optional SHA256 for the downloaded phpMyAdmin tarball. Extend phpmyadmin_health_check.sh to detect a missing/incorrect Apache alias and to probe HTTP reachability. Security hardening: scope temporary phpMyAdmin SSO MySQL roles to 127.0.0.1 instead of '%', tighten SSO ticket file permissions to 0640 (they contain a plaintext MySQL password), and log MySQL connection failures for diagnosis instead of swallowing them silently. Bump version to 1.2.12 and rebuild the release archive.
105 lines
6.0 KiB
Bash
105 lines
6.0 KiB
Bash
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
PLUGIN_DIR="$(cd "$(dirname "$0")/.." && pwd)"
|
|
ARCHIVE="${1:-$(cd "$PLUGIN_DIR/.." && pwd)/archives/1.2.12/alt-mysql.tar.gz}"
|
|
|
|
fail() {
|
|
echo "FAIL: $*" >&2
|
|
exit 1
|
|
}
|
|
|
|
[ -s "$ARCHIVE" ] || fail "archive does not exist or is empty: $ARCHIVE"
|
|
|
|
LIST="$(tar -tzf "$ARCHIVE")"
|
|
printf '%s\n' "$LIST" | grep -Eq '^(\./)?plugin\.conf$' \
|
|
|| fail "archive does not contain plugin.conf at tar root"
|
|
if printf '%s\n' "$LIST" | grep -Eq '^(\./)?alt-mysql/'; then
|
|
fail "archive contains parent alt-mysql directory"
|
|
fi
|
|
if printf '%s\n' "$LIST" | grep -Eiq 'postgres|postgresql|pgsql|phppgadmin'; then
|
|
fail "archive contains PostgreSQL/phpPgAdmin leftovers"
|
|
fi
|
|
if printf '%s\n' "$LIST" | grep -Eq '^(\./)?tests/'; then
|
|
fail "archive contains local test suite"
|
|
fi
|
|
if printf '%s\n' "$LIST" | grep -Eq '(^|/)\._[^/]+$|(^|/)\.DS_Store$|__MACOSX'; then
|
|
fail "archive contains macOS AppleDouble or Finder metadata"
|
|
fi
|
|
printf '%s\n' "$LIST" | grep -Eq '^(\./)?scripts/setup/phpmyadmin_private_install\.sh$' \
|
|
|| fail "archive does not contain private phpMyAdmin installer"
|
|
printf '%s\n' "$LIST" | grep -Eq '^(\./)?scripts/install_db\.sh$' \
|
|
|| fail "archive does not contain install_db.sh at scripts/"
|
|
if printf '%s\n' "$LIST" | grep -Eq '(^|/)install-alt-mariadb\.sh$'; then
|
|
fail "archive contains old install-alt-mariadb.sh"
|
|
fi
|
|
|
|
CONF="$(tar -xOzf "$ARCHIVE" ./plugin.conf 2>/dev/null || tar -xOzf "$ARCHIVE" plugin.conf)"
|
|
printf '%s\n' "$CONF" | grep -Fxq "name=alt-mysql" || fail "archive plugin name is not alt-mysql"
|
|
printf '%s\n' "$CONF" | grep -Fxq "id=alt-mysql" || fail "archive plugin id is not alt-mysql"
|
|
printf '%s\n' "$CONF" | grep -Fxq "version=1.2.12" || fail "archive plugin version is not 1.2.12"
|
|
|
|
SETTINGS="$(tar -xOzf "$ARCHIVE" ./plugin-settings.conf 2>/dev/null || tar -xOzf "$ARCHIVE" plugin-settings.conf)"
|
|
printf '%s\n' "$SETTINGS" | grep -Fxq "PHPMYADMIN_INSTALL_DIR=/var/www/html/alt-mysql-phpmyadmin" \
|
|
|| fail "archive settings do not point to private phpMyAdmin install dir"
|
|
printf '%s\n' "$SETTINGS" | grep -Fxq "PHPMYADMIN_URL_PATH=/alt-mysql-phpmyadmin" \
|
|
|| fail "archive settings do not point to private phpMyAdmin URL"
|
|
printf '%s\n' "$SETTINGS" | grep -Fxq "always_enabled=1" \
|
|
|| fail "archive settings do not enable always_enabled by default"
|
|
|
|
INSTALL_SCRIPT="$(tar -xOzf "$ARCHIVE" ./scripts/install.sh 2>/dev/null || tar -xOzf "$ARCHIVE" scripts/install.sh)"
|
|
printf '%s\n' "$INSTALL_SCRIPT" | grep -Fq 'always_enabled()' \
|
|
|| fail "archive install script does not read always_enabled"
|
|
printf '%s\n' "$INSTALL_SCRIPT" | grep -Fq 'if always_enabled; then' \
|
|
|| fail "archive install script does not hide custom package fields when always_enabled is on"
|
|
|
|
DB_INSTALLER="$(tar -xOzf "$ARCHIVE" ./scripts/install_db.sh 2>/dev/null || tar -xOzf "$ARCHIVE" scripts/install_db.sh)"
|
|
printf '%s\n' "$DB_INSTALLER" | grep -Fq 'apply_cli_args "$@"' \
|
|
|| fail "archive install_db.sh does not apply positional arguments"
|
|
printf '%s\n' "$DB_INSTALLER" | grep -Fq 'MARIADB_VERSION="$1"' \
|
|
|| fail "archive install_db.sh does not accept MariaDB version as first argument"
|
|
printf '%s\n' "$DB_INSTALLER" | grep -Fq 'PORT="$2"' \
|
|
|| fail "archive install_db.sh does not accept TCP port as second argument"
|
|
printf '%s\n' "$DB_INSTALLER" | grep -Fq 'rerun_plugin_install_if_available' \
|
|
|| fail "archive install_db.sh does not refresh plugin install.sh after DB setup"
|
|
printf '%s\n' "$DB_INSTALLER" | grep -Fq 'SKIP_PLUGIN_INSTALL_REFRESH' \
|
|
|| fail "archive install_db.sh does not expose a test/maintenance escape hatch for plugin refresh"
|
|
printf '%s\n' "$DB_INSTALLER" | grep -Fq '[[ $# -eq 0 ]]' \
|
|
|| fail "archive install_db.sh does not show usage when called without arguments"
|
|
printf '%s\n' "$DB_INSTALLER" | grep -Fq '<MARIADB_VERSION> <PORT>' \
|
|
|| fail "archive install_db.sh usage does not require version and port"
|
|
|
|
INSTALLER="$(tar -xOzf "$ARCHIVE" ./scripts/setup/phpmyadmin_install.sh 2>/dev/null || tar -xOzf "$ARCHIVE" scripts/setup/phpmyadmin_install.sh)"
|
|
printf '%s\n' "$INSTALLER" | grep -Fq "\$cfg['Servers'][\$i]['SignonURL'] = da_mysql_phpmyadmin_signon_url(\$runtimeConfig);" \
|
|
|| fail "archive phpMyAdmin installer does not configure SignonURL"
|
|
printf '%s\n' "$INSTALLER" | grep -Fq 'SIGNON_URL_PAGE="${PHPMYADMIN_PRIVATE_DIR}/da_login.php"' \
|
|
|| fail "archive phpMyAdmin installer does not create SignonURL page"
|
|
printf '%s\n' "$INSTALLER" | grep -Fq 'DA_MYSQL_PHPMYADMIN_AUTH' \
|
|
|| fail "archive phpMyAdmin installer does not create ticket-based da_login.php"
|
|
printf '%s\n' "$INSTALLER" | grep -Fq 'da_mysql_signon_read_auth' \
|
|
|| fail "archive phpMyAdmin installer does not isolate phpMyAdmin and SSO sessions"
|
|
|
|
OPEN_HANDLER="$(tar -xOzf "$ARCHIVE" ./exec/handlers/open_phpmyadmin.php 2>/dev/null || tar -xOzf "$ARCHIVE" exec/handlers/open_phpmyadmin.php)"
|
|
printf '%s\n' "$OPEN_HANDLER" | grep -Fq 'phpmyadmin_health_check.sh' \
|
|
|| fail "archive open phpMyAdmin handler does not run health check"
|
|
printf '%s\n' "$OPEN_HANDLER" | grep -Fq 'phpmyadmin_repair.sh' \
|
|
|| fail "archive open phpMyAdmin handler does not run repair before redirect"
|
|
printf '%s\n' "$OPEN_HANDLER" | grep -Fq 'HTTP/1.1 302 Found' \
|
|
|| fail "archive open phpMyAdmin raw handler does not emit an HTTP redirect"
|
|
printf '%s\n' "$OPEN_HANDLER" | grep -Fq 'Location: ' \
|
|
|| fail "archive open phpMyAdmin raw handler does not emit a Location header"
|
|
if printf '%s\n' "$OPEN_HANDLER" | grep -Fq 'meta http-equiv="refresh"'; then
|
|
fail "archive open phpMyAdmin raw handler still uses meta refresh"
|
|
fi
|
|
if printf '%s\n' "$OPEN_HANDLER" | grep -Fq 'Set-Cookie: '; then
|
|
fail "archive open phpMyAdmin handler still tries to pass SSO through DirectAdmin PHP session cookie"
|
|
fi
|
|
|
|
SSO_CLASS="$(tar -xOzf "$ARCHIVE" ./exec/lib/PhpMyAdminSso.php 2>/dev/null || tar -xOzf "$ARCHIVE" exec/lib/PhpMyAdminSso.php)"
|
|
printf '%s\n' "$SSO_CLASS" | grep -Fq 'writeLoginTicket' \
|
|
|| fail "archive phpMyAdmin SSO class does not write login tickets"
|
|
printf '%s\n' "$SSO_CLASS" | grep -Fq '/da_login.php?' \
|
|
|| fail "archive phpMyAdmin SSO class does not target da_login.php ticket flow"
|
|
|
|
echo "package_archive_test: OK"
|