phpPgAdmin

Read and respond to this message at: 
https://sourceforge.net/forum/message.php?msg_id=5837629
By: ioguix

Hi,

It seems to me PPA's ask you for your password again and again cause it couldn't
find your PHP session information.

As the php session ID is usualy stored in cookies, you probably have a problem
with them. Check if your browser allow cookies for your phpPgAdmin's domain.

______________________________________________________________________
You are receiving this email because you elected to monitor this forum.
To stop monitoring this forum, login to SourceForge.net and visit: 
https://sourceforge.net/forum/unmonitor.php?forum_id=115884

Read and respond to this message at: 
https://sourceforge.net/forum/message.php?msg_id=5921912
By: nobody

I'm having the same problems and the cookies are just fine. They are being set.

So ... any other explanation?

______________________________________________________________________
You are receiving this email because you elected to monitor this forum.
To stop monitoring this forum, login to SourceForge.net and visit: 
https://sourceforge.net/forum/unmonitor.php?forum_id=115884

Read and respond to this message at: 
https://sourceforge.net/forum/message.php?msg_id=5924396
By: ioguix

Hi,

I understand your cookies are enabled on your browser, but let me explain clearly
how it should work.

As I said, PPA keeps your login information on the server thanks to your PHP
session. This way it can find your auth credentials if you are already loged
and you don't have to resend them everytime across the network.

Usualy, PHP handle session with a session key stored in cookies so it can bind
your HTTP session to the PHP session (but some PHP setup put this key in the
URL as well).

So, as your cookies are enabled in your browser and are not rejected for PPA,
I think your problem could be on the PHP side. Check your PHP configuration
about sessions.

______________________________________________________________________
You are receiving this email because you elected to monitor this forum.
To stop monitoring this forum, login to SourceForge.net and visit: 
https://sourceforge.net/forum/unmonitor.php?forum_id=115884

Read and respond to this message at: 
https://sourceforge.net/forum/message.php?msg_id=5924335
By: ioguix

Hi,

Yes, it is possible.

Please, read instructions in your conf/config.inc.php. You can add as many server
you want in the "$conf['servers']" subarray.

You should already have some lines about your first server begining with
$conf['servers'][0]. Just add and tweak the same lines but with $conf['servers'][1]
for your second server, $conf['servers'][2] for the third, etc.

______________________________________________________________________
You are receiving this email because you elected to monitor this forum.
To stop monitoring this forum, login to SourceForge.net and visit: 
https://sourceforge.net/forum/unmonitor.php?forum_id=115884

Read and respond to this message at: 
https://sourceforge.net/forum/message.php?msg_id=5803164
By: ioguix

Sorry, my last comment was a bit confusing, But I'm not withdrawing.

It wasn't about PHP and I obviously don't expect user to know PHP to use PPA.
"knowledge" here was meaning "aware about what it is".

However, I'm 100% agree with you. As I said before, we lack of doc. But we probably
not gonna explain how to set up a webserver and PHP: it seems to me it's a bit
out of our buisness.

So to answer your question, you need to put the PPA files where your webserver
can find them and run them. Optionally, you might need to reconfigure your
httpd.
Let say your httpd server is "myhttpd.com" and you dropped PPA's files in its
ppa folder, then you will have to point your browser to http://myhttpd.com/ppa

On a side note, we actually care of our users. I'm always happy to help anyone
on mailing lists or IRC if I can. We are taking on our personal free time to
write PPA and related stuff.
We lack time, we lack contributors, we lack doc.

You might want to have a look on pgAdmin3 if you don't need the "web-app" part
of PPA.

Have a good day.

______________________________________________________________________
You are receiving this email because you elected to monitor this forum.
To stop monitoring this forum, login to SourceForge.net and visit: 
https://sourceforge.net/forum/unmonitor.php?forum_id=115884

Read and respond to this message at: 
https://sourceforge.net/forum/message.php?msg_id=5865340
By: nobody

Hi Guillaume

I have the same problem than others here. I work always with phpmyadmin
on mysql.
To acceed it i just go on my browser an type http://localhost/phpmyadmin.
It seems it's not the same for phppgadmin.

I have installed it using apt-get install phppgadmin on Ubuntu. Install run
fine but... after ?
If I go in my browser with http://localhost/phppgadmin nothing append.

Ok I have found a method.
In my install on Ubuntu phppgadmin is installed in /usr/share. I have made a
copy of the folder phppgadmin in /var/www/ and all work fine.

I go through another problem What is the username password for the first access
?

______________________________________________________________________
You are receiving this email because you elected to monitor this forum.
To stop monitoring this forum, login to SourceForge.net and visit: 
https://sourceforge.net/forum/unmonitor.php?forum_id=115884

Read and respond to this message at: 
https://sourceforge.net/forum/message.php?msg_id=5867382
By: ioguix

Hi nobody ( ;) ),

This question relates more to Ubuntu policy and internal PostgreSQL
anderstanding.

Debian (so I guess Ubuntu as well) makes documentation for every package. ou
can find it under /usr/share/doc/<package_name>.

As you may already guess, there's Debian doc for phppgadmin as well. You'll
probably find everything in your own system here : /usr/share/doc/phppgadmin.

The admin super user under PostgreSQL is postgres. And default policy of Debian
is to allow connection only to the system user postgres. You'll probably have
to tweak (carrefuly) your /etc/postgresql/<version>/<clustername>/pg_hba.conf
to fit your need.

Consider using createuser to create your own first Postgres' user/admin (man
createuser).

If the Debian doc is a bit short for you, you will find further documentation
about auth here :
- http://www.postgresql.org/docs/8.3/interactive/auth-pg-hba-conf.html
- http://www.depesz.com/index.php/2007/10/04/ident/

Remember to check your PostgreSQL logs when something is going wrong.

Seasons greating !

______________________________________________________________________
You are receiving this email because you elected to monitor this forum.
To stop monitoring this forum, login to SourceForge.net and visit: 
https://sourceforge.net/forum/unmonitor.php?forum_id=115884

Read and respond to this message at: 
https://sourceforge.net/forum/message.php?msg_id=5872372
By: nobody

Is it possible to get phpPgAdmin to connect to a database server using trust
authentication for a particular subnet? I've tried editing the phpPgAdmin
configuration file to no avail.

______________________________________________________________________
You are receiving this email because you elected to monitor this forum.
To stop monitoring this forum, login to SourceForge.net and visit: 
https://sourceforge.net/forum/unmonitor.php?forum_id=115884

Read and respond to this message at: 
https://sourceforge.net/forum/message.php?msg_id=5876620
By: ioguix

Because phpPgAdmin doesn't handle the authentication itself...phpPgAdmin
authentication obviously rely on the PG's backend you want to connect to.

So you have to tune your pg_hba.conf file to do this.

See http://www.postgresql.org/docs/8.3/static/auth-pg-hba-conf.html

______________________________________________________________________
You are receiving this email because you elected to monitor this forum.
To stop monitoring this forum, login to SourceForge.net and visit: 
https://sourceforge.net/forum/unmonitor.php?forum_id=115884

Read and respond to this message at: 
https://sourceforge.net/forum/message.php?msg_id=5880267
By: nobody

Yes, but this really isn't controlled by phppgadmin, it is controlled by your
postgres server in the pg_hba.conf file. Please see the Postgres documentation
for specifics on that.

______________________________________________________________________
You are receiving this email because you elected to monitor this forum.
To stop monitoring this forum, login to SourceForge.net and visit: 
https://sourceforge.net/forum/unmonitor.php?forum_id=115884

Bugs item #2422429, was opened at 2008-12-12 14:39
Message generated for change (Settings changed) made by xzilla
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=418980&aid=2422429&group_id=37132

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Security
Group: 4.2.1
>Status: Closed
>Resolution: Fixed
>Priority: 9
Private: No
Submitted By: SeveredCross (severedcross)
>Assigned to: Robert Treat (xzilla)
Summary: Vulnerability allows remote directory traversal

Initial Comment:
Got this email this morning from my friendly local sysadmin, regarding my server box:

The remote host is running phpPgAdmin, a web-based administration tool
for PostgreSQL.

The installed version of phpPgAdmin fails to filter user-supplied
input to the '_language' parameter before using it to include PHP code
in 'libraries/lib.inc.php'. Provided PHP's 'register_globals' setting
is enabled, an unauthenticated attacker may be able to leverage this
issue to view arbitrary files or possibly to execute arbitrary PHP
code on the remote host, subject to the privileges of the web server
user id. 

PHP's register_globals must've been on (I stupidly didn't check php.ini before uninstalling php to reinstall a newer version), but even so, this vulnerability shouldn't exist.

----------------------------------------------------------------------

>Comment By: Robert Treat (xzilla)
Date: 2008-12-18 00:22

Message:
This is fixed in git repository, if you want an immediate fix, check out
http://github.com/xzilla/phppgadmin/commit/b62ff9fa11f0dbed1a28568671eb31d45a5363dd.
We will be releasing 4.2.2 shortly. 

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=418980&aid=2422429&group_id=37132

Read and respond to this message at: 
https://sourceforge.net/forum/message.php?msg_id=5787269
By: nobody

So, I got past the headache and created a simple modification that allows you
to have phpPgAdmin to automatically login to a particular postgresql server.
I'm too lazy to create a login, but if you've got questions, you can undisguise
my mail me on the contact line below.

/*
    Automatic Login
    
    (c) 2008 Tim Wood
    contact via: tmwood (at) datawranglers (dot) com
    You are free to use this code as long as this notice is retained
    
    
    Description
    
    This code allows you to configure phpPgAdmion to automatically login
    to a particular server and database with a particular default password.
    
    Please ensure that you have taken other measures to secure phpPgAdmin
    because any user selecting a server will be logged in with the specified
    username and password.


    "Installation"
    
    Add this code into lib.inc.php (usually in libraries/)
    Insert it immediately after the ini_sets (approx line 75)

    Then, modify your config.inc.php file to add a password and username.
    The two keys are default_username and default_password.
    To add a default login of john and letMeIn to server 0:
       $conf['servers'][0]['default_username'] = 'john';
       $conf['servers'][0]['default_password'] = 'letMeIn';
       
*/

        if( isset( $_REQUEST['server'] ) ) {
            // get the server info
            $_server_info = $misc->getServerInfo($_REQUEST['server']);
            // if a default username and password are set...
            if( isset( $_server_info['default_username'] ) and
                isset( $_server_info['default_password'] )            ) {
              // fake out a login request with the default info            
$_POST['loginServer'] = $_REQUEST['server'];
                unset( $_POST['server'] );
                $_POST['loginUsername'] =  $_server_info['default_username'];
                $pswd_field = 'loginPassword_'.md5($_POST['loginServer']);
                $_POST[$pswd_field] = $_server_info['default_password'];
            }
        }

______________________________________________________________________
You are receiving this email because you elected to monitor this forum.
To stop monitoring this forum, login to SourceForge.net and visit: 
https://sourceforge.net/forum/unmonitor.php?forum_id=115884

Read and respond to this message at: 
https://sourceforge.net/forum/message.php?msg_id=5787280
By: nobody

Let's try that again.  A couple of returns were mangled in my previous post:


/*
    Automatic Login
    
    (c) 2008 Tim Wood
    contact via: tmwood (at) datawranglers (dot) com
    You are free to use this code as long as this notice is retained
    
    
    Description
    
    This code allows you to configure phpPgAdmion to automatically login
    to a particular server and database with a particular default password.
    
    Please ensure that you have taken other measures to secure phpPgAdmin
    because any user selecting a server will be logged in with the specified
    username and password.


    "Installation"
    
    Add this code into lib.inc.php (usually in libraries/)
    Insert it immediately after the ini_sets (approx line 75)

    Then, modify your config.inc.php file to add a password and username.
    The two keys are default_username and default_password.
    To add a default login of john and letMeIn to server 0:
       $conf['servers'][0]['default_username'] = 'john';
       $conf['servers'][0]['default_password'] = 'letMeIn';
       
*/

        if( isset( $_REQUEST['server'] ) ) {
            // get the server info
            $_server_info = $misc->getServerInfo($_REQUEST['server']);
            // if a default username and password are set...
            if( isset( $_server_info['default_username'] ) and
                isset( $_server_info['default_password'] )
            ) {
                // fake out a login request with the default info
                $_POST['loginServer'] = $_REQUEST['server'];
                unset( $_POST['server'] );
                $_POST['loginUsername'] =  $_server_info['default_username'];
                $pswd_field = 'loginPassword_'.md5($_POST['loginServer']);
                $_POST[$pswd_field] = $_server_info['default_password'];
            }
        }

______________________________________________________________________
You are receiving this email because you elected to monitor this forum.
To stop monitoring this forum, login to SourceForge.net and visit: 
https://sourceforge.net/forum/unmonitor.php?forum_id=115884

Read and respond to this message at: 
https://sourceforge.net/forum/message.php?msg_id=5791712
By: xzilla

This doesn't actually make sense. It sounds to me like the right way to manage
this is by creating a role inside the database, and then creating individual
user accounts that inherit that role. Then when you add/remove someone, you
simply add/remove that role.

There is nothing more secure about managing usernames and password that allow
access to a system that automatically logs in, and amanging usernames and passwords
to the system it self; all you have done is add a layer of abstraction, and
I don't see why you think that is better.

Note, all of this is orthogonal to the feature requested, which I think does
have merit, we just need to figure out a good way to do it.  :-)

______________________________________________________________________
You are receiving this email because you elected to monitor this forum.
To stop monitoring this forum, login to SourceForge.net and visit: 
https://sourceforge.net/forum/unmonitor.php?forum_id=115884