From 39f4b3dd408ca9a6739a99cdc739ce0cd5f5acc4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Mon, 6 Mar 2017 12:54:52 +0100 Subject: [PATCH 1/3] Use our CDN for fetching git commit information MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit We can avoid GitHub rate limiting this way as we do the requests from the website backend and they are cached by CDN. Signed-off-by: Michal Čihař --- libraries/Config.php | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/libraries/Config.php b/libraries/Config.php index 0579a4102a..ac53b34536 100644 --- a/libraries/Config.php +++ b/libraries/Config.php @@ -606,8 +606,7 @@ class Config ) { $is_remote_commit = $_SESSION['PMA_VERSION_REMOTECOMMIT_' . $hash]; } else { - $link = 'https://api.github.com/repos/phpmyadmin/phpmyadmin/git/commits/' - . $hash; + $link = 'https://www.phpmyadmin.net/api/commit/' . $hash . '/'; $is_found = Util::httpRequest($link, "GET"); switch($is_found) { case false: @@ -635,8 +634,7 @@ class Config if (isset($_SESSION['PMA_VERSION_REMOTEBRANCH_' . $hash])) { $is_remote_branch = $_SESSION['PMA_VERSION_REMOTEBRANCH_' . $hash]; } else { - $link = 'https://api.github.com/repos/phpmyadmin/phpmyadmin' - . '/git/trees/' . $branch; + $link = 'https://www.phpmyadmin.net/api/tree/' . $branch . '/'; $is_found = Util::httpRequest($link, "GET", true); switch($is_found) { case true: From 3edb0d5df0be4cb96f16d741a2252abec6553264 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Mon, 6 Mar 2017 13:00:34 +0100 Subject: [PATCH 2/3] Fold configureCurl into httpRequestCurl MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit There is no longer need to have it separate. Signed-off-by: Michal Čihař --- libraries/Util.php | 36 +++++++++++------------------------- 1 file changed, 11 insertions(+), 25 deletions(-) diff --git a/libraries/Util.php b/libraries/Util.php index 64eda190a4..aa37253be5 100644 --- a/libraries/Util.php +++ b/libraries/Util.php @@ -4170,30 +4170,6 @@ class Util } return $context; } - /** - * Updates an existing curl as necessary - * - * @param resource $curl_handle A curl_handle resource - * created by curl_init which should - * have several options set - * - * @return resource curl_handle with updated options - */ - public static function configureCurl($curl_handle) - { - if (strlen($GLOBALS['cfg']['ProxyUrl']) > 0) { - curl_setopt($curl_handle, CURLOPT_PROXY, $GLOBALS['cfg']['ProxyUrl']); - if (strlen($GLOBALS['cfg']['ProxyUser']) > 0) { - curl_setopt( - $curl_handle, - CURLOPT_PROXYUSERPWD, - $GLOBALS['cfg']['ProxyUser'] . ':' . $GLOBALS['cfg']['ProxyPass'] - ); - } - } - curl_setopt($curl_handle, CURLOPT_USERAGENT, 'phpMyAdmin/' . PMA_VERSION); - return $curl_handle; - } /** * Add fractional seconds to time, datetime and timestamp strings. @@ -4772,7 +4748,17 @@ class Util if ($curl_handle === false) { return null; } - $curl_handle = Util::configureCurl($curl_handle); + if (strlen($GLOBALS['cfg']['ProxyUrl']) > 0) { + curl_setopt($curl_handle, CURLOPT_PROXY, $GLOBALS['cfg']['ProxyUrl']); + if (strlen($GLOBALS['cfg']['ProxyUser']) > 0) { + curl_setopt( + $curl_handle, + CURLOPT_PROXYUSERPWD, + $GLOBALS['cfg']['ProxyUser'] . ':' . $GLOBALS['cfg']['ProxyPass'] + ); + } + } + curl_setopt($curl_handle, CURLOPT_USERAGENT, 'phpMyAdmin/' . PMA_VERSION); if ($method != "GET") { curl_setopt($curl_handle, CURLOPT_CUSTOMREQUEST, $method); From 47863a25b521f59c0bbb1b8908cfb28269f012d4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Mon, 6 Mar 2017 13:05:32 +0100 Subject: [PATCH 3/3] Bundle ISRG Root X1 SSL certificate and use it for verification MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This way we avoid problems with misconfigured curl in some PHP installations (WAMP), which has no trust certificates. Fixes #12846 Signed-off-by: Michal Čihař --- ChangeLog | 1 + libraries/Util.php | 8 ++++++++ libraries/isrgrootx1.pem | 31 +++++++++++++++++++++++++++++++ 3 files changed, 40 insertions(+) create mode 100644 libraries/isrgrootx1.pem diff --git a/ChangeLog b/ChangeLog index e1d82f2984..0baa6acc25 100644 --- a/ChangeLog +++ b/ChangeLog @@ -94,6 +94,7 @@ phpMyAdmin - ChangeLog - issue #13045 Properly escape MIME transformatoin names - issue #13028 Always show 100% in font selector - issue #13047 Fix query simulating for more servers +- issue #12846 Fix new version check for sites with wrongly configured curl 4.6.6 (2017-01-23) - issue #12759 Fix Notice regarding 'Undefined index: old_usergroup' diff --git a/libraries/Util.php b/libraries/Util.php index aa37253be5..3721a935bd 100644 --- a/libraries/Util.php +++ b/libraries/Util.php @@ -4774,6 +4774,14 @@ class Util curl_setopt($curl_handle, CURLOPT_SSL_VERIFYHOST, '2'); curl_setopt($curl_handle, CURLOPT_SSL_VERIFYPEER, '1'); + /** + * Configure ISRG Root X1 to be able to verify Let's Encrypt SSL + * certificates even without properly configured curl in PHP. + * + * See https://letsencrypt.org/certificates/ + */ + curl_setopt($curl_handle, CURLOPT_CAINFO, dirname(__file__) . '/' . 'isrgrootx1.pem'); + curl_setopt($curl_handle, CURLOPT_RETURNTRANSFER,true); curl_setopt($curl_handle, CURLOPT_FOLLOWLOCATION, 0); curl_setopt($curl_handle, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V4); diff --git a/libraries/isrgrootx1.pem b/libraries/isrgrootx1.pem new file mode 100644 index 0000000000..9548dc1bf6 --- /dev/null +++ b/libraries/isrgrootx1.pem @@ -0,0 +1,31 @@ +-----BEGIN CERTIFICATE----- +MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw +TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh +cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4 +WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu +ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY +MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc +h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+ +0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U +A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW +T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH +B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC +B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv +KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn +OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn +jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw +qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI +rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV +HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq +hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL +ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ +3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK +NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5 +ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur +TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC +jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc +oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq +4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA +mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d +emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc= +-----END CERTIFICATE-----