fix: support Adminer 6, remove custom Docker build - #54
Merged
Conversation
## The Issue Adminer 6 accepts a login only with a valid CSRF token and a same-site request, so the forged login POST stopped working and the login form was served instead. No issue was filed, it showed up in the tests: https://github.com/ddev/ddev-adminer/actions/runs/32349923909 ## How This PR Solves The Issue Log in without the form: put the password where Adminer keeps it for a logged in user and redirect to the URL holding the other credentials. That is all the plugin does now, so ddev-adminer.php and the command override are gone. entrypoint.sh always enables it, ADMINER_PLUGINS is only for the plugins you add yourself. The custom Docker build only created a user matching the host uid, which entrypoint.sh now does, so the image is used as is, pinned to adminer:6-standalone. ## Manual Testing Instructions ```bash ddev add-on get https://github.com/ddev/ddev-adminer/tarball/refs/pull/REPLACE_ME_WITH_THIS_PR_NUMBER/head ddev restart ``` ## Automated Testing Overview health_checks() asserts the database page instead of the login form, that Adminer serves as the host user, and that the login is enabled once next to the plugins from ADMINER_PLUGINS. The SQLite test writes a row through Adminer, which only succeeds while the project file stays writable for it. ## Release/Deployment Notes ADMINER_PLUGINS no longer needs ddev-passwordless-login, a duplicate from an older config is ignored. SQLite needs only the driver and the database, the unused credentials no longer have to be emptied. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Issue
Adminer 6 accepts a login only with a valid CSRF token and a same-site request, so the forged login POST stopped working and the login form was served instead. No issue was filed, it showed up in the tests: https://github.com/ddev/ddev-adminer/actions/runs/32349923909
How This PR Solves The Issue
Log in without the form: put the password where Adminer keeps it for a logged in user and redirect to the URL holding the other credentials. That is all the plugin does now, so ddev-adminer.php and the command override are gone.
entrypoint.shalways enables it,ADMINER_PLUGINSis only for the plugins you add yourself.The custom Docker build only created a user matching the host uid, which
entrypoint.shnow does, so the image is used as is, pinned toadminer:6-standalone.Manual Testing Instructions
Automated Testing Overview
health_checks()asserts the database page instead of the login form, that Adminer serves as the host user, and that the login is enabled once next to the plugins fromADMINER_PLUGINS. The SQLite test writes a row through Adminer, which only succeeds while the project file stays writable for it.Release/Deployment Notes
ADMINER_PLUGINSno longer needsddev-passwordless-login, a duplicate from an older config is ignored. SQLite needs only the driver and the database, the unused credentials no longer have to be emptied.