Skip to content

fix: support Adminer 6, remove custom Docker build - #54

Merged
stasadev merged 2 commits into
mainfrom
20260820_stasadev_adminer_6
Aug 20, 2026
Merged

fix: support Adminer 6, remove custom Docker build#54
stasadev merged 2 commits into
mainfrom
20260820_stasadev_adminer_6

Conversation

@stasadev

@stasadev stasadev commented Aug 20, 2026

Copy link
Copy Markdown
Member

The Issue

Adminer 6 accepts a login only with a valid CSRF token and a same-site request, so the forged login POST stopped working and the login form was served instead. No issue was filed, it showed up in the tests: https://github.com/ddev/ddev-adminer/actions/runs/32349923909

not ok 1 install from directory
# (from function `__assert_stream' in file /home/linuxbrew/.linuxbrew/lib/bats-assert/src/assert_output.bash, line 236,
#  from function `assert_output' in file /home/linuxbrew/.linuxbrew/lib/bats-assert/src/assert_output.bash, line 125,
#  from function `health_checks' in file tests/test.bats, line 49,
#  in test file tests/test.bats, line 93)
#   `health_checks' failed
#
# -- output does not contain substring --
# substring (1 lines):
#   HTTP/2 302
# output (15 lines):
#   HTTP/2 200 
#   cache-control: no-cache
#   content-security-policy: script-src 'self' 'unsafe-inline' 'nonce-MWY2NjFmMzFjNzE3Mjc4MjBhNTdkOWRmMzIyZDM5NTE=' 'strict-dynamic'; connect-src 'self' https://www.adminer.org; frame-src https://www.adminer.org; object-src 'none'; base-uri 'none'; form-action 'self'
#   content-type: text/html; charset=utf-8
#   date: Thu, 20 Aug 2026 08:43:01 GMT
#   host: test-ddev-adminer.ddev.site:9101
#   referrer-policy: origin-when-cross-origin
#   set-cookie: adminer_sid=f55e35f0751e73de961521d5e3834374; path=/; HttpOnly; SameSite=lax
#   set-cookie: adminer_key=73c2c7d333b92123aaf21d6922893b2d; path=/; HttpOnly; SameSite=lax
#   vary: Accept-Encoding
#   x-content-type-options: nosniff
#   x-frame-options: deny
#   x-powered-by: PHP/8.4.24
#   x-xss-protection: 0
#   
# --

How This PR Solves The Issue

Log in without the form: put the password where Adminer keeps it for a logged in user and redirect to the URL holding the other credentials. That is all the plugin does now, so ddev-adminer.php and the command override are gone. entrypoint.sh always enables it, ADMINER_PLUGINS is only for the plugins you add yourself.

The custom Docker build only created a user matching the host uid, which entrypoint.sh now does, so the image is used as is, pinned to adminer:6-standalone.

Manual Testing Instructions

ddev add-on get ddev/ddev-adminer --pr 54
ddev restart

Automated Testing Overview

health_checks() asserts the database page instead of the login form, that Adminer serves as the host user, and that the login is enabled once next to the plugins from ADMINER_PLUGINS. The SQLite test writes a row through Adminer, which only succeeds while the project file stays writable for it.

Release/Deployment Notes

ADMINER_PLUGINS no longer needs ddev-passwordless-login, a duplicate from an older config is ignored. SQLite needs only the driver and the database, the unused credentials no longer have to be emptied.

stasadev and others added 2 commits August 20, 2026 16:05
## The Issue

Adminer 6 accepts a login only with a valid CSRF token and a same-site
request, so the forged login POST stopped working and the login form was
served instead. No issue was filed, it showed up in the tests:
https://github.com/ddev/ddev-adminer/actions/runs/32349923909

## How This PR Solves The Issue

Log in without the form: put the password where Adminer keeps it for a
logged in user and redirect to the URL holding the other credentials.
That is all the plugin does now, so ddev-adminer.php and the command
override are gone. entrypoint.sh always enables it, ADMINER_PLUGINS is
only for the plugins you add yourself.

The custom Docker build only created a user matching the host uid, which
entrypoint.sh now does, so the image is used as is, pinned to
adminer:6-standalone.

## Manual Testing Instructions

```bash
ddev add-on get https://github.com/ddev/ddev-adminer/tarball/refs/pull/REPLACE_ME_WITH_THIS_PR_NUMBER/head
ddev restart
```

## Automated Testing Overview

health_checks() asserts the database page instead of the login form, that
Adminer serves as the host user, and that the login is enabled once next
to the plugins from ADMINER_PLUGINS. The SQLite test writes a row through
Adminer, which only succeeds while the project file stays writable for it.

## Release/Deployment Notes

ADMINER_PLUGINS no longer needs ddev-passwordless-login, a duplicate from
an older config is ignored. SQLite needs only the driver and the database,
the unused credentials no longer have to be emptied.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@stasadev
stasadev merged commit 868a818 into main Aug 20, 2026
2 checks passed
@stasadev
stasadev deleted the 20260820_stasadev_adminer_6 branch August 20, 2026 13:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant