[Phpmyadmin-devel] [Patch] Allow for "LOAD DATA INFILE" when using the PHP-bundled mysql client
Hi all, I hope this is the right place and right way to submit this patch? As you probably know, MySQL has disabled the "LOCAL" option for "LOAD DATA INFILE" statements for security reasons as of MySQL 3.23.49. To be able to use "LOAD DATA LOCAL", you will have to add local-infile = 1 to both you server's and client's my.cnf files. (Please be aware of the security implications!) However, when using the mysql client bundled with PHP, these settings don't apply. Instead, you will have to pass the appropriate flag as an extra parameter to mysql_connect. This patch adds a new config directive $cfg['Servers'][..]['infile_local'] = (TRUE | FALSE). Setting it to "TRUE" enables the mysql client bundled with PHP to use "LOAD DATA LOCAL" for this connection. Without having tested it, you should be able to use LOAD DATA LOCAL without setting this option if you compiled PHP with --with-mysql=/path/to/mysql (thus you did not use the client bundled with PHP) and setup my.cnf correctly. Even when passing the additional parameter to mysql_(p)connect, the use of open_basedir may restrict its usage. Besides that, there was a typo in mysql.dbi.lib.php that prevented passing the $client_flags to mysql_(p)connect at all; so far, that should have broken the use of MYSQL_CLIENT_COMPRESS. Best regards, Matthias
Matthias Pigulla wrote:
Hi all,
Hi Matthias,
I hope this is the right place and right way to submit this patch?
Usually, the recommended place is our patch tracker.
As you probably know, MySQL has disabled the "LOCAL" option for "LOAD DATA INFILE" statements for security reasons as of MySQL 3.23.49. To be able to use "LOAD DATA LOCAL", you will have to add
local-infile = 1
to both you server's and client's my.cnf files. (Please be aware of the security implications!)
However, when using the mysql client bundled with PHP, these settings don't apply. Instead, you will have to pass the appropriate flag as an extra parameter to mysql_connect.
This patch adds a new config directive $cfg['Servers'][..]['infile_local'] = (TRUE | FALSE). Setting it to "TRUE" enables the mysql client bundled with PHP to use "LOAD DATA LOCAL" for this connection.
I intend to test your patch. However, I suggest to not add a new config parameter to config.inc.php but always pass the 128 flag. Here is why. Reading about the security issues http://dev.mysql.com/doc/mysql/en/LOAD_DATA_LOCAL.html The first issue is not really an issue, IMO. Usually, ISPs do not let their Web server access an external MySQL server (which would have been "patched"). The second issue: well, if the ISP is concerned with this, he just has to disable the LOCAL feature into the server. And if the feature is enabled, any Web developer can code his application to use it, regardless of the setting in a "central" phpMyAdmin. Not mentionning that the user can install his own copy of phpMyAdmin and enable the feature. P.S. for mysqli, we should have a look at mysqli_options(). Thanks for the patch, Marc Delisle
Without having tested it, you should be able to use LOAD DATA LOCAL without setting this option if you compiled PHP with --with-mysql=/path/to/mysql (thus you did not use the client bundled with PHP) and setup my.cnf correctly.
Even when passing the additional parameter to mysql_(p)connect, the use of open_basedir may restrict its usage.
Besides that, there was a typo in mysql.dbi.lib.php that prevented passing the $client_flags to mysql_(p)connect at all; so far, that should have broken the use of MYSQL_CLIENT_COMPRESS.
Best regards, Matthias
------------------------------------------------------------------------
diff -ru phpMyAdmin-2.6.0-rc2/config.inc.php www/config.inc.php --- phpMyAdmin-2.6.0-rc2/config.inc.php Sat Sep 4 15:40:11 2004 +++ www/config.inc.php Mon Sep 20 12:09:00 2004 @@ -71,6 +71,7 @@ $cfg['Servers'][$i]['socket'] = ''; // Path to the socket - leave blank for default socket $cfg['Servers'][$i]['connect_type'] = 'tcp'; // How to connect to MySQL server ('tcp' or 'socket') $cfg['Servers'][$i]['extension'] = 'mysql'; // The php MySQL extension to use ('mysql' or 'mysqli') +$cfg['Servers'][$i]['infile_local'] = TRUE; // Upon mysql_connect, set client flag to allow for 'LOAD DATA LOCAL INFILE' $cfg['Servers'][$i]['compress'] = FALSE; // Use compressed protocol for the MySQL connection // (requires PHP >= 4.3.0) $cfg['Servers'][$i]['controluser'] = ''; // MySQL control user settings
diff -ru phpMyAdmin-2.6.0-rc2/libraries/dbi/mysql.dbi.lib.php www/libraries/dbi/mysql.dbi.lib.php --- phpMyAdmin-2.6.0-rc2/libraries/dbi/mysql.dbi.lib.php Sun Jul 18 00:58:31 2004 +++ www/libraries/dbi/mysql.dbi.lib.php Mon Sep 20 12:05:19 2004 @@ -47,11 +47,14 @@ ? '' : ':' . $cfg['Server']['socket'];
+ $client_flags = 0; if (PMA_MYSQL_CLIENT_API >= 32349) { - $client_flags = $cfg['Server']['compress'] && defined('MYSQL_CLIENT_COMPRESS') ? MYSQL_CLIENT_COMPRESS : 0; + $client_flags |= $cfg['Server']['compress'] && defined('MYSQL_CLIENT_COMPRESS') ? MYSQL_CLIENT_COMPRESS : 0; + $client_flags |= $cfg['Server']['infile_local'] ? 128 : 0; /* CLIENT_LOCAL_FILES as defined in PHP's /ext/mysql/libmysql/mysql_com.h */ }
- if (empty($client_clags)) { + + if (empty($client_flags)) { $connect_func = 'mysql_' . ($cfg['PersistentConnections'] ? 'p' : '') . 'connect'; $link = @$connect_func($cfg['Server']['host'] . $server_port . $server_socket, $user, $password); } else {
Matthias, I merged this: if (PMA_MYSQL_CLIENT_API >= 32349) { $client_flags = $cfg['Server']['compress'] && defined('MYSQL_CLIENT_COMPRESS') ? MYSQL_CLIENT_COMPRESS : 0; // always use CLIENT_LOCAL_FILES as defined in mysql_com.h // for the case where the client library was not compiled // with --enable-local-infile $client_flags |= 128; } IMO there was no typo (COMPRESS was working). "ORing" a new variable with 32 or setting it to 32 makes no difference. Marc Matthias Pigulla wrote:
Hi all,
I hope this is the right place and right way to submit this patch?
As you probably know, MySQL has disabled the "LOCAL" option for "LOAD DATA INFILE" statements for security reasons as of MySQL 3.23.49. To be able to use "LOAD DATA LOCAL", you will have to add
local-infile = 1
to both you server's and client's my.cnf files. (Please be aware of the security implications!)
However, when using the mysql client bundled with PHP, these settings don't apply. Instead, you will have to pass the appropriate flag as an extra parameter to mysql_connect.
This patch adds a new config directive $cfg['Servers'][..]['infile_local'] = (TRUE | FALSE). Setting it to "TRUE" enables the mysql client bundled with PHP to use "LOAD DATA LOCAL" for this connection.
Without having tested it, you should be able to use LOAD DATA LOCAL without setting this option if you compiled PHP with --with-mysql=/path/to/mysql (thus you did not use the client bundled with PHP) and setup my.cnf correctly.
Even when passing the additional parameter to mysql_(p)connect, the use of open_basedir may restrict its usage.
Besides that, there was a typo in mysql.dbi.lib.php that prevented passing the $client_flags to mysql_(p)connect at all; so far, that should have broken the use of MYSQL_CLIENT_COMPRESS.
Best regards, Matthias
------------------------------------------------------------------------
diff -ru phpMyAdmin-2.6.0-rc2/config.inc.php www/config.inc.php --- phpMyAdmin-2.6.0-rc2/config.inc.php Sat Sep 4 15:40:11 2004 +++ www/config.inc.php Mon Sep 20 12:09:00 2004 @@ -71,6 +71,7 @@ $cfg['Servers'][$i]['socket'] = ''; // Path to the socket - leave blank for default socket $cfg['Servers'][$i]['connect_type'] = 'tcp'; // How to connect to MySQL server ('tcp' or 'socket') $cfg['Servers'][$i]['extension'] = 'mysql'; // The php MySQL extension to use ('mysql' or 'mysqli') +$cfg['Servers'][$i]['infile_local'] = TRUE; // Upon mysql_connect, set client flag to allow for 'LOAD DATA LOCAL INFILE' $cfg['Servers'][$i]['compress'] = FALSE; // Use compressed protocol for the MySQL connection // (requires PHP >= 4.3.0) $cfg['Servers'][$i]['controluser'] = ''; // MySQL control user settings
diff -ru phpMyAdmin-2.6.0-rc2/libraries/dbi/mysql.dbi.lib.php www/libraries/dbi/mysql.dbi.lib.php --- phpMyAdmin-2.6.0-rc2/libraries/dbi/mysql.dbi.lib.php Sun Jul 18 00:58:31 2004 +++ www/libraries/dbi/mysql.dbi.lib.php Mon Sep 20 12:05:19 2004 @@ -47,11 +47,14 @@ ? '' : ':' . $cfg['Server']['socket'];
+ $client_flags = 0; if (PMA_MYSQL_CLIENT_API >= 32349) { - $client_flags = $cfg['Server']['compress'] && defined('MYSQL_CLIENT_COMPRESS') ? MYSQL_CLIENT_COMPRESS : 0; + $client_flags |= $cfg['Server']['compress'] && defined('MYSQL_CLIENT_COMPRESS') ? MYSQL_CLIENT_COMPRESS : 0; + $client_flags |= $cfg['Server']['infile_local'] ? 128 : 0; /* CLIENT_LOCAL_FILES as defined in PHP's /ext/mysql/libmysql/mysql_com.h */ }
- if (empty($client_clags)) { + + if (empty($client_flags)) { $connect_func = 'mysql_' . ($cfg['PersistentConnections'] ? 'p' : '') . 'connect'; $link = @$connect_func($cfg['Server']['host'] . $server_port . $server_socket, $user, $password); } else {
participants (2)
-
Marc Delisle -
Matthias Pigulla