From 7f7172cb888d8d8cf72e6ca4135d7c6d1b1bdd95 Mon Sep 17 00:00:00 2001 From: Lukas Koszyk Date: Thu, 10 Oct 2024 13:35:54 +0000 Subject: [PATCH] Bug 36026: Use only configured TLS options for database connection Database connections with TLS require client private keys and certificates for authentication but MariaDB also supports authentication by user and password. This patch allows omitting the TLS options for certificate based client authentication. To test: 1) Configure the database to support TLS connections. 2) Set "yes" in the config section in koha-conf.xml. 3) Run "koha-plack --reload ". 4) Open Koha's staff interface in the browser. 5) Observe an internal server error. 6) Apply patch. 7) Repeat step 3 and 4. 8) Observe the error is gone. 9) Sign off. Sponsored-by: Karlsruhe Institute of Technology (KIT) Signed-off-by: Cornelius Amzar Signed-off-by: Markus John --- Koha/Database.pm | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/Koha/Database.pm b/Koha/Database.pm index 8457c18e801..52ace1304d3 100644 --- a/Koha/Database.pm +++ b/Koha/Database.pm @@ -77,12 +77,24 @@ sub dbh { if ($driver eq 'mysql') { my $tls = $config->get("tls"); if ($tls && $tls eq 'yes') { - $dsn .= sprintf( - ';mysql_ssl=1;mysql_ssl_client_key=%s;mysql_ssl_client_cert=%s;mysql_ssl_ca_file=%s', - $config->get('key'), - $config->get('cert'), - $config->get('ca'), - ); + + $dsn .= ';mysql_ssl=1'; + + my $mysql_ssl_client_key = $config->get('key'); + my $mysql_ssl_client_cert = $config->get('cert'); + my $mysql_ssl_ca_file = $config->get('ca'); + + if ( $mysql_ssl_client_key && $mysql_ssl_client_key ne '__DB_TLS_CLIENT_KEY__' ) { + $dsn .= sprintf( ';mysql_ssl_client_key=%s', $mysql_ssl_client_key ); + } + + if ( $mysql_ssl_client_cert && $mysql_ssl_client_cert ne '__DB_TLS_CLIENT_CERTIFICATE__' ) { + $dsn .= sprintf( ';mysql_ssl_client_cert=%s', $mysql_ssl_client_cert ); + } + + if ( $mysql_ssl_ca_file && $mysql_ssl_ca_file ne '__DB_TLS_CA_CERTIFICATE__' ) { + $dsn .= sprintf( ';mysql_ssl_ca_file=%s', $mysql_ssl_ca_file ); + } } $attr->{mysql_enable_utf8} = 1; -- 2.39.5