tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-02 14:18:46 +02:00
Code Issues Projects Releases Wiki Activity

Merge pull request #7233 from johndalangin/7077-add-mysql-pdo-ssl

Browse Source 
NEW Added MySQL SSL PDO Support (fixes #7077)
This commit is contained in:
Daniel Hensby 2017-08-03 12:20:51 +02:00 committed by GitHub
commit 723ae37b7d
5 changed files with 111 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
cli-script.php
View File

@ -91,6 +91,14 @@ define('SS_DATABASE_SERVER', 'localhost');
define('SS_DATABASE_USERNAME', '<user>');
define('SS_DATABASE_PASSWORD', '<password>');
define('SS_DATABASE_NAME', '<database>');
/* SSL support for MySQLPDODatabase */
/*
define('SS_DATABASE_CLASS', 'MySQLPDODatabase');
define('SS_DATABASE_SSL_KEY', '/path/to/keyfile');
define('SS_DATABASE_SSL_CERT', '/path/to/certfile');
define('SS_DATABASE_SSL_CA', '/path/to/cafile');;
*/
--------------------------------------------------
Once you have done that, run 'composer install' or './framework/sake dev/build' to create

32
conf/ConfigureFromEnv.php
View File

@ -20,6 +20,14 @@
* - SS_DATABASE_MEMORY: Use in-memory state if possible. Useful for testing, currently only
* supported by the SQLite database adapter.
*
* SSL Support (for MySQLPDODatabase)
*
* - SS_DATABASE_SSL_KEY: Path to SSL private key file
* - SS_DATABASE_SSL_CERT: Path to SSL certificate file
* - SS_DATABASE_SSL_CA: Path to SSL CA file
* - SS_DATABASE_SSL_CIPHER: Override default cipher (defaults are set per database connector)
*
*
* There is one more setting that is intended to be used by people who work on SilverStripe.
* - SS_DATABASE_CHOOSE_NAME: Boolean/Int. If set, then the system will choose a default database name for you if
* one isn't give in the $database variable. The database name will be "SS_" followed by the name of the folder
@ -116,6 +124,30 @@ if(defined('SS_DATABASE_USERNAME') && defined('SS_DATABASE_PASSWORD')) {
// For SQlite3 memory databases (mainly for testing purposes)
if(defined('SS_DATABASE_MEMORY'))
$databaseConfig["memory"] = SS_DATABASE_MEMORY;
// Add ssl parameters to databaseConfig if these are defined
if(
defined('SS_DATABASE_SSL_KEY') &&
defined('SS_DATABASE_SSL_CERT')
) {
$databaseConfig['ssl_key'] = SS_DATABASE_SSL_KEY;
$databaseConfig['ssl_cert'] = SS_DATABASE_SSL_CERT;
}
// Some databases do not require a CA so this is optional
if(defined('SS_DATABASE_SSL_CA')) {
$databaseConfig['ssl_ca'] = SS_DATABASE_SSL_CA;
}
// Cipher defaults should be set per connector
if(defined('SS_DATABASE_SSL_CIPHER')) {
$databaseConfig['ssl_cipher'] = SS_DATABASE_SSL_CIPHER;
}
}
if(defined('SS_SEND_ALL_EMAILS_TO')) {

25
dev/install/MySQLDatabaseConfigurationHelper.php
View File

@ -36,8 +36,31 @@ class MySQLDatabaseConfigurationHelper implements DatabaseConfigurationHelper {
}
case 'MySQLPDODatabase':
// May throw a PDOException if fails
// Set SSL parameters
$ssl = null;
$defaultCipher = 'DHE-RSA-AES256-SHA';
if(
array_key_exists('ssl_key', $databaseConfig) &&
array_key_exists('ssl_cert', $databaseConfig)) {
$ssl = array(
PDO::MYSQL_ATTR_SSL_KEY => $databaseConfig['ssl_key'],
PDO::MYSQL_ATTR_SSL_CERT => $databaseConfig['ssl_cert'],
);
if(array_key_exists('ssl_ca', $databaseConfig)) {
$ssl[PDO::MYSQL_ATTR_SSL_CA] = $databaseConfig['ssl_ca'];
}
// use default cipher if not provided
$ssl[PDO::MYSQL_ATTR_SSL_CA] = array_key_exists('ssl_ca', $databaseConfig) ? $databaseConfig['ssl_ca'] : $defaultCipher;
}
$conn = @new PDO('mysql:host='.$databaseConfig['server'], $databaseConfig['username'],
$databaseConfig['password']);
$databaseConfig['password'], $ssl);
if($conn) {
$conn->query("SET sql_mode = 'ANSI'");
return $conn;

20
dev/install/install.php5
View File

@ -132,6 +132,26 @@ if(isset($_REQUEST['db'])) {
"database" => $_REQUEST['db'][$type]['database'],
);
// Set SSL parameters if they exist
if(
defined('SS_DATABASE_SSL_KEY') &&
defined('SS_DATABASE_SSL_CERT')
) {
$databaseConfig['ssl_key'] = SS_DATABASE_SSL_KEY;
$databaseConfig['ssl_cert'] = SS_DATABASE_SSL_CERT;
}
if(defined('SS_DATABASE_SSL_CA')) {
$databaseConfig['ssl_ca'] = SS_DATABASE_SSL_CA;
}
if(defined('SS_DATABASE_SSL_CIPHER')) {
$databaseConfig['ssl_cipher'] = SS_DATABASE_SSL_CIPHER;
}
} else {
// Normal behaviour without the environment
$databaseConfig = $_REQUEST['db'][$type];

27
model/connect/PDOConnector.php
View File

@ -15,6 +15,14 @@ class PDOConnector extends DBConnector {
*/
private static $emulate_prepare = false;
/**
* Default strong SSL cipher to be used
*
* @config
* @var boolean
*/
private static $ssl_cipher_default = 'DHE-RSA-AES256-SHA';
/**
* The PDO connection instance
*
@ -159,6 +167,25 @@ class PDOConnector extends DBConnector {
$options = array();
if($parameters['driver'] == 'mysql') {
$options[PDO::MYSQL_ATTR_INIT_COMMAND] = 'SET NAMES ' . $charset . ' COLLATE ' . $connCollation;
// Set SSL options if they are defined
if(
array_key_exists('ssl_key', $parameters) &&
array_key_exists('ssl_cert', $parameters)) {
$options[PDO::MYSQL_ATTR_SSL_KEY] = $parameters['ssl_key'];
$options[PDO::MYSQL_ATTR_SSL_CERT] = $parameters['ssl_cert'];
if(array_key_exists('ssl_ca', $parameters)) {
$options[PDO::MYSQL_ATTR_SSL_CA] = $parameters['ssl_ca'];
}
// use default cipher if not provided
$options[PDO::MYSQL_ATTR_SSL_CIPHER] = $parameters['ssl_cipher'] ?: $this->config()->ssl_cipher_default;
}
}
if(self::is_emulate_prepare()) {
$options[PDO::ATTR_EMULATE_PREPARES] = true;