[Phpmyadmin-devel] AllowArbitraryServer and synchronisation

[Isaac Bennetch]

Hi,

On 1/28/2011 11:33 AM, Marc Delisle wrote:
> Michal Čihař a écrit :
>> Hi all
>>
>> for security reasons we have chosen AllowArbitraryServer to be disabled
>> by default. On the other side we have synchronization feature which
>> allows to connect to arbitrary server as well and fetch any data from
>> it.
>>
>> I think this disproportion should be fixed. I can see two approaches:
>>
>> 1. The other option would be to drop AllowArbitraryServer completely as
>> right now it really does not bring any security.
>
> I'm not in favor.
>>
>> 2. Make AllowArbitraryServer really work as expected:
>> - Make AllowArbitraryServer enabled by default. I don't think the risk
>>    is too big and many people would use this feature.
>
> I'm also not in favor, because of the increased risk. By doing so by
> default we open the door to access (or try to access) any MySQL server
> reachable by this web server.
>
> I also don't like the extra "Server" question that this would bring.
>
>> - If AllowArbitraryServer is set to false, disallow synchronization
>>    with arbitrary server as well.
>
> I am in favor of this suggestion.
>
>>
>> But maybe I'm missing some other possibility. Comments?

I agree. Sounds good to me.