Add PHP 8 support on Apache2 conf

Bug #2016015 reported by William Desportes
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
phpmyadmin (Debian)
Fix Released
Undecided
William Desportes
phpmyadmin (Ubuntu)
Fix Released
Undecided
Unassigned
Jammy
Confirmed
Undecided
Unassigned
Kinetic
Won't Fix
Undecided
Unassigned

Bug Description

[ Impact ]

In Focal, the apache2 configuration file shipped with phpmyadmin sets 2 php.ini directives through "php_admin_value": upload_tmp_dir and open_basedir.

After the PHP 8 transition an unintentional regression was introduced and these directives are no longer being set. As a consequence, the temporary phpmyadmin directory at /var/lib/phpmyadmin/tmp is no longer being used as the temporary path for uploads. Instead, the system temp path is used.

Moreover (and more relevant), open_basedir is set to NULL, meaning that the php process running phpmyadmin can easily read files outside of the phpmyadmin package scope.

However, due to the notes in https://www.php.net/manual/en/ini.core.php#ini.open-basedir, it is arguable whether this should be treated as a security threat [1,2,3,4].

[1] https://externals.io/message/105606
[2] https://externals.io/message/115406
[3] https://wiki.php.net/security#not_a_security_issue
[4] https://www.php.net/manual/en/ini.core.php#ini.open-basedir

Finally, this regression could also cause crashes when users set open_basedir globally for apache2 somehow, as discussed in https://github.com/phpmyadmin/phpmyadmin/issues/18299.

[ Test Plan ]

 * From a fresh ubuntu installation:
   - install phpmyadmin and libapache2-mod-php
   - browse to http://localhost/phpmyadmin and verify that the UI is working as expected (i.e., you see a login page).
   - append "php_admin_value open_basedir ." to /etc/apache2/conf-enabled/phpmyadmin.conf
   - restart Apache2
   - browse to http://localhost/phpmyadmin again and verify that the UI is no longer working as expected. You now see a blank page and /var/log/apache2/error.log has an error like

PHP Fatal error: Uncaught Error: Failed opening required 'PhpMyAdmin/MoTranslator/autoload.php' (include_path='.:/usr/share/php')

    - Perform all the steps above, now with a phpmyadmin package with the proposed fix
    - verify that the error no longer occurs.

ALTERNATIVELY:

Append the following code snippet to the beginning of /usr/share/phpmyadmin/index.php, right after the imports (i.e., "use ...")

$secret_file = '/etc/hosts';
$secret = file_get_contents($secret_file);
if ($secret) {
 error_log($secret);
}

Restart apache2 and browse to http://localhost/phpmyadmin.

Now, check /var/log/apache2/error.log.

Affected systems will contain en entry with the contents of /etc/hosts, while patched systems will contain

file_get_contents(): open_basedir restriction in effect....
file_get_contents(/etc/hosts): Failed to open stream: Operation not permitted ...

[ Where problems could occur ]

Some users may be relying on the upload_tmp_dir being set to /tmp to perform additional verification or collect metrics during phpmyadmin runtime. This would create a regression for those users.

Moreover, users could be extending phpmyadmin in unusual ways by relying on the fact that open_basedir is not set (being able to access the whole filesystem through its php process). This would also create a regression for those users.

[ Other Info ]

This issue has been fixed from lunar and on.

See: (https://github.com/phpmyadmin/phpmyadmin/issues/18299
See: https://bugs.launchpad.net/ubuntu/+source/phpmyadmin/+bug/2013402

Related branches

tags: removed: patch sru-release verification-needed-jammy
Changed in phpmyadmin (Debian):
assignee: nobody → William Desportes (williamdes)
status: New → Fix Released
Changed in phpmyadmin (Ubuntu):
status: New → Fix Released
summary: - [SRU] add PHP 8 on Apache2 conf
+ Add PHP 8 support on Apache2 conf
description: updated
description: updated
Revision history for this message
Steve Langasek (vorlon) wrote : Proposed package upload rejected

An upload of phpmyadmin to kinetic-proposed has been rejected from the upload queue for the following reason: "incomplete Recommends fix (LP: #2016017)".

Revision history for this message
Steve Langasek (vorlon) wrote :

An upload of phpmyadmin to jammy-proposed has been rejected from the upload queue for the following reason: "incomplete Recommends fix (LP: #2016017)".

Revision history for this message
Athos Ribeiro (athos-ribeiro) wrote :

Re-uploaded the jammy fix without the recommends patch.

Changed in phpmyadmin (Ubuntu Kinetic):
status: New → Won't Fix
Changed in phpmyadmin (Ubuntu Jammy):
status: New → In Progress
Revision history for this message
Chris Halse Rogers (raof) wrote : Please test proposed package

Hello William, or anyone else affected,

Accepted phpmyadmin into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/phpmyadmin/4:5.1.1+dfsg1-5ubuntu1.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in phpmyadmin (Ubuntu Jammy):
status: In Progress → Fix Committed
tags: added: verification-needed verification-needed-jammy
Revision history for this message
Athos Ribeiro (athos-ribeiro) wrote :

In a fresh jammy install, I followed the test plan described above without the package in -proposed and verified the blank screen and the error log as described.

In another fresh jammy install, I followed the same steps above, but with the package in -proposed (4:5.1.1+dfsg1-5ubuntu1.1) and the blank screen + error message issue is no longer happening.

This should be enough to verify this one.

tags: added: verification-done verification-done-jammy
removed: verification-needed verification-needed-jammy
Revision history for this message
Chris Halse Rogers (raof) wrote : Proposed package removed from archive

The version of phpmyadmin in the proposed pocket of Jammy that was purported to fix this bug report has been removed because one or more bugs that were to be fixed by the upload have failed verification and been in this state for more than 10 days.

Changed in phpmyadmin (Ubuntu Jammy):
status: Fix Committed → Confirmed
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.