initial commit of file from CVS for smeserver-phpmyadmin on Sat Sep 7 20:52:31 AEST 2024

This commit is contained in:
Trevor Batley
2024-09-07 20:52:31 +10:00
parent 593593a214
commit ee4370dd8c
34 changed files with 1327 additions and 2 deletions

View File

@@ -0,0 +1 @@
reserved

View File

@@ -0,0 +1 @@
phpmyadmin

View File

@@ -0,0 +1 @@
phpmyadmin

View File

@@ -0,0 +1 @@
500M

View File

@@ -0,0 +1 @@
100M

View File

@@ -0,0 +1 @@
100M

View File

@@ -0,0 +1 @@
private

View File

@@ -0,0 +1 @@
enabled

View File

@@ -0,0 +1 @@
disabled

View File

@@ -0,0 +1 @@
enabled

View File

@@ -0,0 +1 @@
configuration

View File

@@ -0,0 +1,32 @@
{
my $rec = $DB->get('phpmyadmin')
|| $DB->new_record('phpmyadmin', {type => 'configuration'});
my $pw = $rec->prop('BlowfishSecret');
if (not $pw or length($pw) < 57){
my $pw = gen_pw();
$rec->set_prop('BlowfishSecret', $pw);
}
sub gen_pw {
use MIME::Base64 qw(encode_base64);
my $p = "not set due to error";
if ( open( RANDOM, "/dev/urandom" ) ){
my $buf;
# 57 bytes is a full line of Base64 coding, and contains
# 456 bits of randomness - given a perfectly random /dev/random
if ( read( RANDOM, $buf, 57 ) != 57 ){
warn("Short read from /dev/random: $!");
}
else{
$p = encode_base64($buf);
chomp $p;
}
close RANDOM;
}
else{
warn "Could not open /dev/urandom: $!";
}
return $p;
}
}

View File

@@ -0,0 +1,37 @@
{
my $rec = $DB->get('phpmyadmin')
|| $DB->new_record('phpmyadmin', {type => 'configuration'});
my $pw = $rec->prop('DbPassword');
if (not $pw or length($pw) < 57){
my $pw = gen_pw();
$rec->set_prop('DbPassword', $pw);
}
$pw = $rec->prop('sqladminPassword');
if (not $pw or length($pw) < 57){
my $pw = gen_pw();
$rec->set_prop('sqladminPassword', $pw);
}
sub gen_pw {
use MIME::Base64 qw(encode_base64);
my $p = "not set due to error";
if ( open( RANDOM, "/dev/urandom" ) ){
my $buf;
# 57 bytes is a full line of Base64 coding, and contains
# 456 bits of randomness - given a perfectly random /dev/random
if ( read( RANDOM, $buf, 57 ) != 57 ){
warn("Short read from /dev/random: $!");
}
else{
$p = encode_base64($buf);
chomp $p;
}
close RANDOM;
}
else{
warn "Could not open /dev/urandom: $!";
}
return $p;
}
}

View File

@@ -0,0 +1 @@
PERMS=0750

View File

@@ -0,0 +1,3 @@
UID="root"
GID="www"
PERMS=0640

View File

@@ -0,0 +1,51 @@
{
my $db = $phpmyadmin{'DbName'} || 'phpmyadmin';
my $user = $phpmyadmin{'DbUser'} || 'phpmyadmin';
my $pass = $phpmyadmin{'DbPassword'} || 'phpmyadmin';
my $admpass = $phpmyadmin{'sqladminPassword'} || 'adminpass';
my $dbstruct = `rpm -qd smeserver-phpmyadmin | grep phpmyadmin.sql`;
$OUT .= <<"END";
#! /bin/sh
if [ ! -d /var/lib/mysql/$db ]; then
/usr/bin/mysql -e 'create database $db'
/usr/bin/mysql $db < $dbstruct
fi
/usr/bin/mysql <<EOF
USE mysql;
REPLACE INTO user (
host,
user,
password)
VALUES (
'localhost',
'$user',
PASSWORD ('$pass'));
REPLACE INTO db (
host,
db,
user,
select_priv, insert_priv, update_priv, delete_priv,
create_priv, alter_priv, index_priv, drop_priv, create_tmp_table_priv,
grant_priv, lock_tables_priv, references_priv)
VALUES (
'localhost',
'$db',
'$user',
'Y', 'Y', 'Y', 'Y',
'Y', 'Y', 'Y', 'Y', 'Y',
'N', 'Y', 'Y');
GRANT ALL ON *.* TO 'sqladmin'\@'localhost' IDENTIFIED BY '$admpass'
WITH GRANT OPTION;
FLUSH PRIVILEGES;
EOF
END
}

View File

@@ -0,0 +1,98 @@
{
# phpmyadmin
my $status = $phpmyadmin{'status'} || 'disabled';
if ($status eq 'enabled')
{
$OUT .="#-------------------------------------------------\n";
$OUT .="# phpMyAdmin settings from smeserver-phpmyadmin\n";
$OUT .="#-------------------------------------------------\n";
$OUT .="\n";
my $adminaccess = ($phpmyadmin{'adminaccess'} || 'enabled');
my $multiaccess = ($phpmyadmin{'multiaccess'} || 'disabled');
if (("$adminaccess" eq "enabled") || ("$multiaccess" eq "enabled"))
{
$OUT .= "Alias /phpmyadmin /usr/share/phpMyAdmin\n";
}
else
{
$OUT .= "# phpMyAdmin Admin access disabled\n";
}
if ("$multiaccess" eq "enabled")
{
$OUT .= "Alias /phpmyadmin-multi /usr/share/phpMyAdmin\n";
}
else
{
$OUT .= "# phpMyAdmin Multiuser access disabled\n";
}
# Location overrides Directory for access control and default is RequireAny
# we need to repeat the Require ip section for both context to filter both admin and multiuser access.
$OUT .= qq(
<Location /phpmyadmin>
AuthName "phpmyadmin"
AuthType Basic
AuthBasicProvider external
AuthExternal pwauth
<RequireAll>
require user admin
);
$OUT .= (($phpmyadmin{access} || 'private' ) eq "public" ) ? " Require all granted": " Require ip $localAccess $externalSSLAccess";
$OUT .= qq(
</RequireAll>
</Location>) if "$adminaccess" eq "enabled";
$OUT .= qq(
<Directory /usr/share/phpMyAdmin>
SSLRequireSSL
Options -Indexes
AllowOverride None
<RequireAll>
);
$OUT .= (($phpmyadmin{access} || 'private' ) eq "public" ) ? " Require all granted": " Require ip $localAccess $externalSSLAccess";
$OUT .= qq(
</RequireAll>
);
# we do not want people to mess with this for the moment
my $version = '74';
$OUT .= qq(
AddType application/x-httpd-php .php
<FilesMatch .php\$\>
SetHandler "proxy:unix:/var/run/php-fpm/php$version-phpmyadmin.sock|fcgi://localhost"
</FilesMatch>
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=\$1
</Directory>
# These directories do not require access over HTTP - taken from the original
# phpMyAdmin upstream tarball
#
<Directory /usr/share/phpMyAdmin/setup/>
Require all denied
</Directory>
<Directory /usr/share/phpMyAdmin/libraries/>
Require all denied
</Directory>
<Directory /usr/share/phpMyAdmin/setup/lib/>
Require all denied
</Directory>
<Directory /usr/share/phpMyAdmin/setup/frames/>
Require all denied
</Directory>);
}
else
{
$OUT .= "# phpmyadmin is disabled";
}
}

View File

@@ -0,0 +1,21 @@
#
# 30phpmyadmin
#
{
$haveSSL = (exists ${modSSL}{status} and ${modSSL}{status} eq "enabled") ? 'yes' : 'no';
my $adminaccess = ($phpmyadmin{'adminaccess'} || 'enabled');
my $multiaccess = ($phpmyadmin{'multiaccess'} || 'disabled');
if (($port eq $httpPort) && ($haveSSL eq 'yes') && ("$adminaccess" eq "enabled" || "$multiaccess" eq "enabled"))
{
$OUT .= " RewriteRule ^/phpmyadmin(/.*|\$) https://%{HTTP_HOST}/phpmyadmin\$1 [L,R]\n";
}
if (($port eq $httpPort) && ($haveSSL eq 'yes') && ( "$multiaccess" eq "enabled"))
{
$OUT .= " RewriteRule ^/phpmyadmin-multi(/.*|\$) https://%{HTTP_HOST}/phpmyadmin-multi\$1 [L,R]\n";
}
}

View File

@@ -0,0 +1,74 @@
{
if ($PHP_VERSION eq '74'){
if (($phpmyadmin{'status'} || 'disabled') eq 'enabled'){
my $max_upload_size = ($phpmyadmin{MaxUploadSize} || '100M');# 104857600 bytes
$max_upload_size .= 'M' if ($max_upload_size =~ m/^\d+$/);
my $memory_limit = ($phpmyadmin{MemoryLimit} || '512M');
$memory_limit .= 'M' if ($memory_limit =~ m/^\d+$/);
my $open_basedir= $phpmyadmin{PHPBaseDir} || '';
$open_basedir = "/etc/phpMyAdmin/:/usr/share/phpMyAdmin:/var/lib/php/phpmyadmin:".
"/var/lib/phpMyAdmin/temp:/var/lib/phpMyAdmin/save/:/var/lib/phpMyAdmin/upload:/var/lib/phpMyAdmin/cache/:".
"/usr/share/php/:/usr/share/php-williamdes-mariadb-mysql-kbs:".
"/usr/share/phpMyAdmin/doc:".
"/var/log/php/phpmyadmin:/usr/share/php/gettext/:/dev/urandom:/proc/meminfo:$open_basedir";
my $max_children = $phpmyadmin{'PHPmaxChildren'} || 20;
my $min_spare_servers = $phpmyadmin{'PHPminServers'} || 4;
my $start_servers = $phpmyadmin{'PHPstartServers'} || 6;
my $max_spare_servers = $phpmyadmin{'PHPmaxServers'} || 8;
my $max_requests = $phpmyadmin{'PHPmaxRequests'} || 1000;
$min_spare_servers = ( $min_spare_servers > $max_spare_servers ) ? printf("%.0f",$max_spare_servers/2) : $min_spare_servers;
$start_servers = ( $start_servers > $max_spare_servers ) ? printf("%.0f", $max_spare_servers /2 + $min_spare_servers/2 ) : $start_servers;
my $id = 'phpmyadmin'; # Note the package is phpMyAdmin
$OUT .=<<"_EOF";
[php$PHP_VERSION-$id]
user = www
group = www
listen.owner = root
listen.group = www
listen.mode = 0660
listen = /var/run/php-fpm/php$PHP_VERSION-$id.sock
pm = dynamic
pm.max_children = $max_children
pm.start_servers = $start_servers
pm.min_spare_servers = $min_spare_servers
pm.max_spare_servers = $max_spare_servers
pm.max_requests = $max_requests
; Used in nextcloud
php_admin_value[session.save_path] = /var/lib/php/$id/session
php_admin_value[session.gc_maxlifetime] = 86400
php_admin_value[opcache.file_cache] = /var/lib/php/$id/opcache
php_admin_value[upload_tmp_dir] = /var/lib/php/$id/tmp
php_admin_value[sys_temp_dir] = /var/lib/php/$id/tmp
php_admin_value[error_log] = /var/log/php/$id/error.log
slowlog = /var/log/php/$id/slow.log
php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f php@{ $DomainName }
php_admin_flag[display_errors] = off
php_admin_flag[log_errors] = on
php_admin_value[memory_limit] = $memory_limit
php_admin_value[max_execution_time] = 3600
php_admin_value[post_max_size] = $max_upload_size
php_admin_value[upload_max_filesize] = $max_upload_size
php_admin_value[disable_functions] = system, show_source, symlink, exec, dl, shell_exec, passthru, phpinfo, escapeshellarg, escapeshellcmd
php_admin_value[open_basedir] = $open_basedir
php_admin_flag[allow_url_fopen] = on
php_admin_flag[file_upload] = on
php_admin_flag[session.cookie_httponly] = on
php_admin_flag[allow_url_include] = off
php_admin_value[session.save_handler] = files
php_admin_flag[output_buffering] = off
php_admin_value[auto_prepend_file] = /usr/share/php/auth_translation.php
php_flag[session.use_trans_sid] = off
php_flag[track_vars] = on
php_flag[magic_quotes_gpc] = off
_EOF
}
else{
$OUT .= '; phpmyadmin is disabled';
}
}
}

View File

@@ -0,0 +1,122 @@
/* Servers configuration */
$i = 0;
/* Server localhost (config:root) [1] */
$i++;
$cfg['Servers'][$i]['host'] = 'localhost';
$cfg['Servers'][$i]['extension'] = 'mysqli';
$cfg['Servers'][$i]['port'] = '';
$cfg['Servers'][$i]['socket'] = '/var/lib/mysql/mysql.sock';
$cfg['Servers'][$i]['connect_type'] = 'socket';
$cfg['Servers'][$i]['compress'] = false;
# standalone or login mode
$scriptname=end(explode('/',$_SERVER['PHP_SELF']));
$scriptpath=str_replace($scriptname,'',$_SERVER['PHP_SELF']);
# standalone login part
{
my $adminaccess = ($phpmyadmin{'adminaccess'} || 'enabled');
my $multiaccess = ($phpmyadmin{'multiaccess'} || 'disabled');
# this one could be tricky, with fpm we need to translate the auth from httpd
# we need to have this in httpd.conf in the directory of phpmyadmin :
# SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=\$1
# also need in the fpm pool this (and the file in the open base dir )
# php_admin_value[auto_prepend_file] = /usr/share/php/auth_translation.php
# the line here could help debug :
# error_log("current user: REDIRECT". $_SERVER['REDIRECT_REMOTE_USER'] ."REMOTE". $_SERVER['REMOTE_USER'] . " PHP_AUTH_USER". $_SERVER['PHP_AUTH_USER'] );
if (("$adminaccess" eq "enabled"))
{
$OUT .="if (\$scriptpath==\"/phpmyadmin/\" && \$_SERVER['PHP_AUTH_USER']=='admin')\n";
$OUT .="{\n";
$OUT .="\$cfg['Servers'][\$i]['auth_type'] = 'config';\n";
$OUT .="\$cfg['Servers'][\$i]['user'] = 'root';\n";
open (PW, "/etc/openldap/ldap.pw")
|| die "Could not read LDAP password.\n";
my $pw = <PW>;
chomp ($pw);
close PW;
$OUT .="\$cfg['Servers'][\$i]['password'] = '$pw';\n";
$OUT .="}";
}
else
{
$OUT .="# standalone admin configuration disabled";
}
}
# end of standalone login part
# multiuser login part
{
my $adminaccess = ($phpmyadmin{'adminaccess'} || 'enabled');
my $multiaccess = ($phpmyadmin{'multiaccess'} || 'disabled');
$OUT .="\n";
if (("$multiaccess" eq "enabled") && ("$adminaccess" eq "enabled"))
{
$OUT .="if (\$scriptpath==\"/phpmyadmin-multi/\")\n";
$OUT .="{\n";
}
if (("$multiaccess" eq "enabled"))
{
$OUT .="\$cfg['Servers'][\$i]['auth_type'] = 'cookie';\n";
my $secret = ${'httpd-admin'}{TKTAuthSecret} || "34322500-7330-4400-423A-3A00434F5245";
$OUT .="\$cfg['blowfish_secret'] = '$secret';\n";
}
else
{
$OUT .="# multiuser disabled\n";
}
if (("$multiaccess" eq "enabled") && ("$adminaccess" eq "enabled"))
{
$OUT .="}\n";
}
}
# end of multiuser login part
{
use esmith::util;
#we retrieve values for settings options below
our $dbname = $phpmyadmin{'DbName'} || 'phpmyadmin';
our $dbuser = $phpmyadmin{'DbUser'} || 'phpmyadmin';
our $dbpass = $phpmyadmin{'DbPassword'} || 'phpmyadmin';
$OUT .= '';
}
/* enhanced servers configuration */
$cfg['Servers'][$i]['pmadb'] = '{$dbname}';
$cfg['Servers'][$i]['controluser'] = '{$dbuser}';
$cfg['Servers'][$i]['controlpass'] = '{$dbpass}';
$cfg['Servers'][$i]['bookmarktable'] = 'pma_bookmark';
$cfg['Servers'][$i]['relation'] = 'pma_relation';
$cfg['Servers'][$i]['userconfig'] = 'pma_userconfig';
$cfg['Servers'][$i]['table_info'] = 'pma_table_info';
$cfg['Servers'][$i]['column_info'] = 'pma_column_info';
$cfg['Servers'][$i]['history'] = 'pma_history';
$cfg['Servers'][$i]['recent'] = 'pma_recent';
$cfg['Servers'][$i]['table_uiprefs'] = 'pma_table_uiprefs';
$cfg['Servers'][$i]['tracking'] = 'pma_tracking';
$cfg['Servers'][$i]['table_coords'] = 'pma_table_coords';
$cfg['Servers'][$i]['pdf_pages'] = 'pma_pdf_pages';
$cfg['Servers'][$i]['designer_coords'] = 'pma_designer_coords';
$cfg['Servers'][$i]['AllowRoot'] = TRUE;
$cfg['Servers'][$i]['AllowDeny']['rules'] = array();
$cfg['Servers'][$i]['AllowNoPassword'] = FALSE;
$cfg['Servers'][$i]['bs_garbage_threshold'] = 50;
$cfg['Servers'][$i]['bs_repository_threshold'] = '32M';
$cfg['Servers'][$i]['bs_temp_blob_timeout'] = 600;
$cfg['Servers'][$i]['bs_temp_log_threshold'] = '32M';
/* End of servers configuration */

View File

@@ -0,0 +1,19 @@
/*
* Directories for saving/loading files from server
*/
$cfg['UploadDir'] = '/var/lib/phpMyAdmin/upload';
$cfg['SaveDir'] = '/var/lib/phpMyAdmin/save';
$cfg['SessionSavePath'] = '/var/lib/php/phpmyadmin/session';
$cfg['VersionCheck'] = false;
$cfg['RetainQueryBox'] = true;
$cfg['ServerDefault'] = 1;
/*
* Disable the default warning that is displayed on the DB Details Structure
* page if any of the required Tables for the relation features is not found
*/
$cfg['PmaNoRelation_DisableWarning'] = TRUE;
{
$OUT .= "\$cfg['blowfish_secret'] = '$phpmyadmin{'BlowfishSecret'}';/* YOU MUST FILL IN THIS FOR COOKIE AUTH! */\n"
}

View File

@@ -0,0 +1,14 @@
{
$OUT = <<HERE;
<?php
/*
HERE
$OUT .=
Text::Template::_load_text("/etc/e-smith/templates-default/template-begin");
$OUT .= <<HERE;
*/
HERE
}

View File

@@ -0,0 +1,11 @@
#Moved to php pool
#magic_quotes_gpc= on
#track_vars= on
#open_basedir=/usr/share/php:/usr/share/phpMyAdmin:/etc/phpMyAdmin:/var/lib/phpMyAdmin
#session.save_path=/var/lib/phpMyAdmin/tmp
#post_max_size=100M
#upload_max_filesize=100M
#memory_limit=500M
#session.use_trans_sid=0
#upload_tmp_dir=/var/lib/phpMyAdmin/tmp