#2333 (ok 2.10) Detecting missing permissions on session directory
I am a moderator from russian speaking forum about phpMyAdmin http://forum.php-myadmin.ru/. Our user have a problem that we can't help him to solve.
4.11-STABLE FreeBSD
mysql Ver 14.7 Distrib 4.1.22, for portbld-freebsd4.11 (i386) using readline 5.2
PHP 4.4.4 with Suhosin-Patch 0.9.5 (cgi-fcgi) (built: Oct 18 2006 07:26:28)
phpMyAdmin – 2.8.2.4(2.9.1.1)
Trying to create a table have a message - "The field count is empty!". Working on this problem shows us that some POST elements disapears in this part of code.
./libraries/common.lib.php
if (!isset($_REQUEST['token']) || $_SESSION['PMA_token'] != $_REQUEST['token']) {
/* List of parameters which are allowed from unsafe source */
$allow_list = array(
'db', 'table', 'lang', 'server', 'convcharset', 'collation_connection', 'target',
/* Session ID */
'phpMyAdmin',
/* Cookie preferences */
'pma_lang', 'pma_charset', 'pma_collation_connection', 'pma_convcharset',
/* Possible login form */
'pma_username', 'pma_password',
);
$keys = array_keys($_REQUEST);
/* Remove any non allowed stuff from requests */
foreach($keys as $key) {
if (!in_array($key, $allow_list)) {
unset($_REQUEST[$key]);
unset($_GET[$key]);
unset($_POST[$key]);
unset($GLOBALS[$key]);
} else {
// allowed stuff could be compromised so escape it
$_REQUEST[$key] = htmlspecialchars($_REQUEST[$key], ENT_QUOTES);
}
}
}
Commenting every unset functions solve a problem but it's hard to test is everything works fine with this changes or not.
File tbl_create.php. String 219:
PMA_mysqlDie($strTableEmpty, '', '', $err_url);
Changed on:
PMA_mysqlDie($strTableEmpty . " \$num_fields = {$num_fields}. ", '', '', $err_url);
This change shows empty $num_fields.
File libraries/common.lib.php, string 2881: havd been added element 'num_fields' to array $allow_list.
With this change script works fine with first part of creation of the table but shows "The field count is empty!" again when we trying to create fields.
I see that it is probably not a phpMyAdmin problem but may be someone have any ideas?
There was this kind of problem in this thread http://sourceforge.net/tracker/index.php?func=detail&aid=1597047&group_id=23067&atid=377409 but nobody could clear this out.
Thanks a lot.
Logged In: YES
user_id=1686741
Originator: YES
Problem solved.
In php.ini option session.save_path was changed to /home/domainname.com/tmp but chmod for this directory was 40755 and session files could not be created in this way. After changing chmod to 40757 everything start working.
The same problem we have on Windows if session.save_path option directory have incorrect permissions (NTFS) or if this directory absent (Windows, Unix), and in php.ini display_errors = Off.
To developers:
Is there any reason in unsetting requested variables if token is absent or incorrect. May be the logic could be like this.
if (!isset($_REQUEST['token']) || $_SESSION['PMA_token'] != $_REQUEST['token']) {
exit('Enable Cookie!');
}
Why script continue it's working if it's not working correctly without user's cookies or server's sessions?
On the page with error "Enable Cookie!" you can make link on documentation where describe how user can enable cookie or if it's not help, how solve problem with session.save_path directory on the server side.
Logged In: YES
user_id=210714
Originator: NO
Thanks for working on this issue.
Your user should have been seeing on the top of each page a message telling him to enable cookies.
Note: at this point in common.lib.php, we cannot just exit().
Logged In: YES
user_id=1686741
Originator: YES
Marc, please, look at the screen, that's what we saw with our user. It is how it looks like on Windows XP without write permission on folder session.save_path points to. There is no message "Cookies must be enabled past this point" because this part of code in file header.inc.php, line 161:
if (empty($_COOKIE)) {
echo '<div class="notice">' . $GLOBALS['strCookiesRequired'] . '</div>' . "\n";
}
That's how I change it (don't beat me hard :))
if (SID !== '' || $_SESSION[' PMA_token '] !== $_REQUEST['token']) {
exit('<div class="notice">' . $GLOBALS['strCookiesRequired'] . '</div>');
}
Now it looks more convenient for me. And YES! I can't live without exit(). We love each other. :)
There is another file with the same logic - cookie.auth.lib.php line 224.
File Added: phpMyAdmin.PNG
phpMyAdmin screen without sessions
Logged In: YES
user_id=1383652
Originator: NO
Hanut,
as you mentioned using hardened php:
maybe you have to adjust hphp.post.max_value_length and/or some other settings
see http://www.hardened-php.net/hphp/troubleshooting.html
Logged In: YES
user_id=210714
Originator: NO
Hanut,
why should we display a "cookies must be enabled" message when the real problem is a wrong permission on the sessions directory?
Logged In: YES
user_id=1383652
Originator: NO
plz ignore my last post, i didn't recognize that the problem was session.save_path (and solved in the meantime)
Logged In: YES
user_id=1686741
Originator: YES
> Hanut,
> why should we display a "cookies must be enabled" message when the real
> problem is a wrong permission on the sessions directory?
Marc,
the real problem I see is why script should continue its working if sessions disabled in any way (user side, server side... doesn't matter). Think it's logical to shut down the script completely if we have sessions problems.
May be during installation procees we have to check "session.save_path" directory permission? Is it what you mean?
Logged In: YES
user_id=210714
Originator: NO
Hanut,
I agree that we could detect a sessions problem but this problem should be reported with another error message, not the one about cookies. And it's not enough to detect during the installation process, permissions can change during the life of a server.
Logged In: YES
user_id=326580
Originator: NO
he would get errors if not someone introduced this EVIL @ (i think @ is even more evil than eval) in session.inc.php before session_start()
if someone introduces @ before function calls he also has to ensure that all possible errors get caught if not can be viewed by user!
Logged In: YES
user_id=326580
Originator: NO
how about something like this:
ob_start();
$old_display_errors = ini_get('display_errors');
$old_error_reporting = error_reporting(E_ALL);
ini_set('display_errors', 1);
$r = session_start();
ini_set('display_errors', $old_display_errors);
error_reporting($old_error_reporting);
unset($old_display_errors, $old_error_reporting);
$session_error = ob_get_contents();
ob_end_clean();
if ($r !== true || ! empty($session_error)) {
echo 'cannot start session without errors, please check errors given and
configure your PHP insallation properly.<br /><br />';
echo $session_error;
die();
}
of course we could also not display the error message and point to the php error log, and of course use the error.php page
Logged In: YES
user_id=1383652
Originator: NO
@Sebastian,
>$r = session_start();
This is bogus, session_start() *always* returns true!
Logged In: YES
user_id=326580
Originator: NO
yes - but who knows PHP 6 ... ;-)
did someone test the above code? or should i just checkin this piece into TRUNK?
Logged In: YES
user_id=1383652
Originator: NO
well,
to avoid calling this on *every* page i tried this in index.php:
---
// free the session file, for the other frames to be loaded
ob_start();
$old_display_errors = ini_get('display_errors');
$old_error_reporting = error_reporting(E_ALL);
ini_set('display_errors', 1);
session_write_close();
ini_set('display_errors', $old_display_errors);
error_reporting($old_error_reporting);
unset($old_display_errors, $old_error_reporting);
$session_error = ob_get_contents();
ob_end_clean();
if (! empty($session_error)) {
echo '<h1 style="color:red">Sessions are NOT working!</h1>session.save_path ';
$iniSavePath = ini_get('session.save_path');
if(empty($iniSavePath)) {
echo 'not set, using default dir = "', $_ENV['TMP'], '" ($_ENV["TMP"])';
} else {
echo '= "', $iniSavePath, '"';
}
die('<h3>folder not existing or no r/w permissions for php (see php.ini)?');
}
---
works very well (internationalized messages needed of course).
Logged In: YES
user_id=326580
Originator: NO
not all user uses frames, some directly start with server_databases or main or something similar
a locale message is not possible as locale strings are not loaded at this time: session -> config -> locale strings
Logged In: YES
user_id=326580
Originator: NO
i checked in some code to detect this error - please test SVN
Logged In: YES
user_id=1383652
Originator: NO
a)
with bad path: only a minor typo (insallation ;)
how about alink to the wiki, there are many issues especially for win users!
b.)
Warning: in /srv/http/pma.cihar.com/trunk-config/libraries/Theme.class.php on line 113
Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at /srv/http/pma.cihar.com/trunk-config/libraries/Theme.class.php:113) in /srv/http/pma.cihar.com/trunk-config/libraries/session.inc.php on line 117
Logged In: YES
user_id=1383652
Originator: NO
Warning: in /srv/http/pma.cihar.com/trunk-config/libraries/Theme.class.php on line 113
that's why there was an "@" infront of session_start() (i assume ;)
But you are right, better avoid the @ if not absolutly neccessary!
Logged In: YES
user_id=326580
Originator: NO
b.) has nothing to do with THIS bug, but you have no valid img path???
and of course - if you have display_errors enabled you will get this error if some error messages appear before sending headers ...
a.) typo fixed, about linking: we have no links to wiki in the source - all links go to local documentation, additionally we first need a function for this like for MySQL doc links
please try again - fixed typo, added locale message support, repeat check until success not only once
Logged In: YES
user_id=1383652
Originator: NO
the error msg. was from pma.cihar.com demo :P