@@ -964,7 +964,7 @@ If you already had this infrastructure and:
964964and then create new tables by importing :file: `resources/sql/create_tables.sql `.
965965
966966You can use your phpMyAdmin to create the tables for you. Please be
967- aware that you may need special ( administrator) privileges to create
967+ aware that you may need administrator privileges to create
968968the database and tables, and that the script may need some tuning,
969969depending on the database name.
970970
@@ -976,9 +976,9 @@ You will also need to have a controluser
976976(:config:option: `$cfg['Servers'][$i]['controluser'] ` and
977977:config:option: `$cfg['Servers'][$i]['controlpass'] ` settings)
978978with the proper rights to those tables. For example you can create it
979- using following statement:
979+ using the following statement:
980980
981- And for any MariaDB version:
981+ For any MariaDB version:
982982
983983.. code-block :: mysql
984984
@@ -1055,17 +1055,16 @@ Using authentication modes
10551055
10561056:term: `HTTP ` and cookie authentication modes are recommended in a **multi-user
10571057environment ** where you want to give users access to their own database and
1058- don't want them to play around with others. Nevertheless, be aware that MS
1059- Internet Explorer seems to be really buggy about cookies, at least till version
1060- 6. Even in a **single-user environment **, you might prefer to use :term: `HTTP `
1058+ don't want them to play around with others.
1059+ Even in a **single-user environment **, you might prefer to use :term: `HTTP `
10611060or cookie mode so that your user/password pair are not in clear in the
10621061configuration file.
10631062
10641063:term: `HTTP ` and cookie authentication
10651064modes are more secure: the MySQL login information does not need to be
10661065set in the phpMyAdmin configuration file (except possibly for the
10671066:config:option: `$cfg['Servers'][$i]['controluser'] `).
1068- However, keep in mind that the password travels in plain text unless
1067+ However, keep in mind that the password travels in plain text between your browser and the server unless
10691068you are using the HTTPS protocol. In cookie mode, the password is
10701069stored, encrypted with the AES algorithm, in a temporary cookie.
10711070
@@ -1130,6 +1129,7 @@ HTTP authentication mode
11301129Cookie authentication mode
11311130--------------------------
11321131
1132+ * The recommended and most popular authentication type.
11331133* Username and password are stored in cookies during the session and password
11341134 is deleted when it ends.
11351135* With this mode, the user can truly log out of phpMyAdmin and log
@@ -1208,9 +1208,7 @@ Config authentication mode
12081208 loading the phpMyAdmin site. This is by design but could allow any
12091209 user to access your installation. Use of some restriction method is
12101210 suggested, perhaps a :term: `.htaccess ` file with the HTTP-AUTH directive or disallowing
1211- incoming HTTP requests at one’s router or firewall will suffice (both
1212- of which are beyond the scope of this manual but easily searchable
1213- with Google).
1211+ incoming HTTP requests at one's router or firewall.
12141212
12151213.. _securing :
12161214
@@ -1227,13 +1225,13 @@ are always ways to make your installation more secure:
12271225* Ensure your PHP setup follows recommendations for production sites, for example
12281226 `display_errors <https://www.php.net/manual/en/errorfunc.configuration.php#ini.display-errors >`_
12291227 should be disabled.
1230- * Remove the `` tests ` ` directory from phpMyAdmin, unless you are developing and need a test suite.
1231- * Remove the `` setup ` ` directory from phpMyAdmin, you will probably not
1228+ * Remove the :file: ` tests/ ` directory from phpMyAdmin, unless you are developing and need a test suite.
1229+ * Remove the :file: ` public/ setup/ ` directory from phpMyAdmin, you will probably not
12321230 use it after the initial setup.
12331231* Properly choose an authentication method - :ref: `cookie `
12341232 is probably the best choice for shared hosting.
1235- * Deny access to auxiliary files in :file: `./ libraries/ ` or
1236- :file: `. /templates/ ` subfolders in your webserver configuration.
1233+ * Deny access to auxiliary files in :file: `libraries/ ` or
1234+ :file: `resources /templates/ ` subfolders in your webserver configuration.
12371235 Such configuration prevents from possible path exposure and cross side
12381236 scripting vulnerabilities that might happen to be found in that code. For the
12391237 Apache webserver, this is often accomplished with a :term: `.htaccess ` file in
@@ -1248,6 +1246,8 @@ are always ways to make your installation more secure:
12481246 phpMyAdmin, you can use :config:option: `$cfg['Servers'][$i]['AllowDeny']['rules'] ` to limit them
12491247 or :config:option: `$cfg['Servers'][$i]['AllowRoot'] ` to deny root user access.
12501248* Enable :ref: `2fa ` for your account.
1249+ * Consider hiding connection errors from the login page by setting
1250+ :config:option: `$cfg['Servers'][$i]['hide_connection_errors'] ` to ``true ``.
12511251* Consider hiding phpMyAdmin behind an authentication proxy, so that
12521252 users need to authenticate prior to providing MySQL credentials
12531253 to phpMyAdmin. You can achieve this by configuring your web server to request
0 commit comments