netgescon-day0/public/adminer.php

<?php
/**
 * NetGescon PostgreSQL & MySQL Secure Web Database Visualizer
 *
 * SECURE WRAPPER FOR ADMINER
 * - Disabled in Production (APP_ENV=production or APP_DEBUG=false)
 * - Supports 1-Click Auto-Login to MySQL Staging and PostgreSQL Consolidato
 * - Auto-connects via TCP (127.0.0.1) to avoid Unix Socket Peer Auth failures
 * - Strips and hides credentials from URL query parameters to prevent password leaks
 */

// 1. ENVIRONMENT SECURITY GUARD
$envFile = __DIR__ . '/../.env';
$appEnv = 'local';
$appDebug = true;

if (file_exists($envFile)) {
    $lines = file($envFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
    foreach ($lines as $line) {
        $line = trim($line);
        if (str_starts_with($line, '#')) continue;
        if (str_starts_with($line, 'APP_ENV=')) {
            $appEnv = strtolower(trim(substr($line, 8), "\" '"));
        }
        if (str_starts_with($line, 'APP_DEBUG=')) {
            $val = strtolower(trim(substr($line, 10), "\" '"));
            $appDebug = in_array($val, ['true', '1', 'yes'], true);
        }
    }
}

// Block access in production environments for security
if ($appEnv === 'production' || !$appDebug) {
    http_response_code(403);
    header('Content-Type: text/plain; charset=UTF-8');
    die("403 Forbidden: Database management console is disabled in production mode for security compliance.\n");
}

function env_get_val($key, $default = '') {
    $envFile = __DIR__ . '/../.env';
    if (file_exists($envFile)) {
        $lines = file($envFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
        foreach ($lines as $line) {
            $line = trim($line);
            if (str_starts_with($line, $key . '=')) {
                return trim(substr($line, strlen($key) + 1), "\" '");
            }
        }
    }
    return $default;
}

// 2. ADMINER OBJECT CUSTOMIZATION
function adminer_object() {
    class NetGesconAdminerSecurity extends \Adminer\Adminer {
        function name() {
            return "NetGescon Database Visualizer";
        }

        function credentials() {
            $driver = $_POST["auth"]["driver"] ?? $_GET["pgsql"] ?? "server";
            $dbHost = "127.0.0.1";
            
            if ($driver === "pgsql" || isset($_GET["pgsql"])) {
                return array($dbHost, "netgescon", "netgescon_pass");
            }

            $dbUser = env_get_val("DB_USERNAME", "netgescon_user");
            $dbPass = env_get_val("DB_PASSWORD", "NetGescon2024!");

            return array($dbHost, $dbUser, $dbPass);
        }

        function database() {
            return env_get_val("DB_DATABASE", "netgescon");
        }

        function login($login, $password) {
            return true;
        }

        function loginForm() {
            $connection    = env_get_val("DB_CONNECTION", "mysql");
            $defaultDriver = ($connection === "pgsql") ? "pgsql" : "server";
            $mySqlUser     = env_get_val("DB_USERNAME", "netgescon_user");
            $mySqlPass     = env_get_val("DB_PASSWORD", "NetGescon2024!");
            $dbName        = env_get_val("DB_DATABASE", "netgescon");

            echo '<div style="background:#0f172a; color:#f8fafc; padding:20px; border-radius:12px; margin-bottom:18px; font-family:sans-serif; font-size:13px; line-height:1.6; border:1px solid #334155; box-shadow:0 10px 15px -3px rgba(0,0,0,0.3);">';
            echo '<strong style="color:#38bdf8; font-size:16px;">🔒 NetGescon Secure Dual DB Visualizer</strong><br>';
            echo 'Clicca su uno dei due pulsanti per accedere all\'istante al Database desiderato su TCP 127.0.0.1:<br><br>';
            echo '<div style="display:flex; gap:12px; flex-wrap:wrap;">';
            echo '<button type="button" onclick="loginEngine(\'mysql\')" style="background:#0284c7; color:#ffffff; font-weight:bold; border:none; padding:12px 20px; border-radius:8px; cursor:pointer; font-size:13px; shadow:0 4px 6px -1px rgba(0,0,0,0.2);">🐬 1-CLICK LOGIN MYSQL STAGING (' . $mySqlUser . ')</button>';
            echo '<button type="button" onclick="loginEngine(\'pgsql\')" style="background:#334155; color:#38bdf8; font-weight:bold; border:2px solid #38bdf8; padding:12px 20px; border-radius:8px; cursor:pointer; font-size:13px; shadow:0 4px 6px -1px rgba(0,0,0,0.2);">🐘 1-CLICK LOGIN POSTGRESQL CONSOLIDATO (netgescon)</button>';
            echo '</div>';
            echo '</div>';

            echo '<script>
            function loginEngine(type) {
                var drv = document.querySelector("select[name=\'auth[driver]\']");
                var srv = document.querySelector("input[name=\'auth[server]\']");
                var usr = document.querySelector("input[name=\'auth[username]\']");
                var pwd = document.querySelector("input[name=\'auth[password]\']");
                var db  = document.querySelector("input[name=\'auth[db]\']");

                if (type === "pgsql") {
                    if (drv) { drv.value = "pgsql"; if (typeof loginDriver === "function") loginDriver(); }
                    if (srv) srv.value = "127.0.0.1";
                    if (usr) usr.value = "netgescon";
                    if (pwd) pwd.value = "netgescon_pass";
                    if (db)  db.value  = "' . $dbName . '";
                } else {
                    if (drv) { drv.value = "server"; if (typeof loginDriver === "function") loginDriver(); }
                    if (srv) srv.value = "127.0.0.1";
                    if (usr) usr.value = "' . $mySqlUser . '";
                    if (pwd) pwd.value = "' . $mySqlPass . '";
                    if (db)  db.value  = "' . $dbName . '";
                }

                // Submit automatically
                var form = document.querySelector("form");
                if (form) {
                    form.submit();
                }
            }

            window.addEventListener("DOMContentLoaded", function() {
                var drv = document.querySelector("select[name=\'auth[driver]\']");
                var srv = document.querySelector("input[name=\'auth[server]\']");
                var usr = document.querySelector("input[name=\'auth[username]\']");
                var pwd = document.querySelector("input[name=\'auth[password]\']");
                var db  = document.querySelector("input[name=\'auth[db]\']");

                if (srv && (!srv.value || srv.value === "localhost")) srv.value = "127.0.0.1";
                if (usr && !usr.value) usr.value = "' . $mySqlUser . '";
                if (pwd && !pwd.value) pwd.value = "' . $mySqlPass . '";
                if (db && !db.value)   db.value  = "' . $dbName . '";
            });
            </script>';
            return true;
        }
    }

    return new NetGesconAdminerSecurity;
}

// 3. INCLUDE CORE ADMINER
if (file_exists(__DIR__ . '/adminer-core.php')) {
    include __DIR__ . '/adminer-core.php';
} else {
    http_response_code(500);
    die('Adminer core file missing.');
}