From 75b1ebbbd8b5e7e090760149d9fb5a72bf4b14b8 Mon Sep 17 00:00:00 2001 From: Lukas Koszyk Date: Thu, 10 Oct 2024 13:35:54 +0000 Subject: [PATCH] Bug 36026: Use only configured TLS options for database connection Database connections with TLS require client private keys and certificates for authentication but MariaDB also supports authentication by user and password. This patch allows omitting the TLS options for certificate based client authentication. To test: 1) Configure the database to support TLS connections. 2) Set "yes" in the config section in koha-conf.xml. 3) Run "koha-plack --reload ". 4) Open Koha's staff interface in the browser. 5) Observe an internal server error. 6) Apply patch. 7) Repeat step 3 and 4. 8) Observe the error is gone. 9) Sign off. Sponsored-by: Karlsruhe Institute of Technology (KIT) --- Koha/Database.pm | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/Koha/Database.pm b/Koha/Database.pm index 8457c18e80..52ace1304d 100644 --- a/Koha/Database.pm +++ b/Koha/Database.pm @@ -77,12 +77,24 @@ sub dbh { if ($driver eq 'mysql') { my $tls = $config->get("tls"); if ($tls && $tls eq 'yes') { - $dsn .= sprintf( - ';mysql_ssl=1;mysql_ssl_client_key=%s;mysql_ssl_client_cert=%s;mysql_ssl_ca_file=%s', - $config->get('key'), - $config->get('cert'), - $config->get('ca'), - ); + + $dsn .= ';mysql_ssl=1'; + + my $mysql_ssl_client_key = $config->get('key'); + my $mysql_ssl_client_cert = $config->get('cert'); + my $mysql_ssl_ca_file = $config->get('ca'); + + if ( $mysql_ssl_client_key && $mysql_ssl_client_key ne '__DB_TLS_CLIENT_KEY__' ) { + $dsn .= sprintf( ';mysql_ssl_client_key=%s', $mysql_ssl_client_key ); + } + + if ( $mysql_ssl_client_cert && $mysql_ssl_client_cert ne '__DB_TLS_CLIENT_CERTIFICATE__' ) { + $dsn .= sprintf( ';mysql_ssl_client_cert=%s', $mysql_ssl_client_cert ); + } + + if ( $mysql_ssl_ca_file && $mysql_ssl_ca_file ne '__DB_TLS_CA_CERTIFICATE__' ) { + $dsn .= sprintf( ';mysql_ssl_ca_file=%s', $mysql_ssl_ca_file ); + } } $attr->{mysql_enable_utf8} = 1; -- 2.39.5