Warnings in Fedora feel Random

[SirLouen]

Describe the bug

For some reason I find that both Warnings that appear on a fresh Fedora 38 installation of PhpMyAdmin over nginx 1.24.0, PHP 8.2.17 and MariaDB 10.5.23 are completely random

To Reproduce

Steps to reproduce the behavior:

1. Do a Fresh installation of a Fedora Server 38 with Nginx 1.24.0, PHP 8.2.17 and MariaDB 10.5.23 and phpMyAdmin 5.2.1-1.fc38
2. Login

Expected behavior

No warnings as things are right

Screenshots

A video:

phpmyadmin.mp4

Server configuration

• Operating system: Fedora 38
• Web server: nginx 1.24.0
• Database version: MariaDB 10.5.23
• PHP version: PHP 8.2.17
• phpMyAdmin version: phpMyAdmin 5.2.1-1.fc38

Client configuration

• Browser: Chrome 123.0.6312.106
• Operating system: Windows 11

Additional context

There are two main warnings:

Warning The configuration file needs a valid key for cookie encryption. A temporary key was automatically generated for you. 

Doesn't make any sense. According to libraries/vendor_config.php the config.inc.php file in Fedora 38 is located at /etc/phpMyAdmin/config.inc.php. It should have a 32-bit blowfish_secret generated, for example with

openssl rand -base64 22

So basically, there is something seriously bugged here

For the other part, the warning:

Warning The $cfg['TempDir'] (/var/lib/phpMyAdmin/temp/) is not accessible. phpMyAdmin is not able to cache templates and will be slow because of this.

It is even worse. Theoretically, the system is being run via PHP-FPM with a user. The /var/lib/phpMyAdmin/temp/ dir, has 770 privileges, with both user nginx and group nginx chowned + the PHP-FPM user is part of the nginx group. I know that phpMyAdmin has perfect permissions because inside that temp folder there is a twig folder. If I remove the twig folder an refresh phpMyAdmin, the twig folder pops back.

But even worse, the fact is that the warning is not constant, appears and disappears randomly. In case it's not well shown in the video, every time I refresh the page, with F5, the warning appears and disappears as it can be observed.

[SirLouen]

After research, I've found that Fedora pack, although it seems to be a 5.2.1 it's using super-old files like show_config_errors.php that seem to be used like 3 years ago.

I've wiped the whole distribution directory at /usr/share/phpMyAdmin and uploaded the latest release one, edited the sample config.inc.php file and everything is working fine.

I have to admit that I've never understood, very well, how most distros integrate phpMyAdmin on their systems. The put the files all over the place, in /etc/phpMyAdmin, some others in /var/lib/phpMyAdmin and the rest in /usr/share/phpMyAdmin, when phpMyAdmin is just a simple project that could be placed all in one place. The problem with this is that one has to be setting permissions all over the place.

Anyway from a permissions point of view, everything is very weird.

As I previously said, I chowned the whole phpmyadmin by Nginx user and group, and add my php-fpm user to nginx group. Then I set permissions for both Owner (nginx) and Group (nginx) also, basically all directories to 750 and all files to 640 but phpmyadmin was throwing permission errors

The Reason? No idea. I check within the phpmyadmin directory, with phpinfo()or exec('whoami') and I can clearly see which system user is effectively executing (through PHP-FPM pool), and I can clearly see with users are in the group with lid -g nginx. So it doesn't make any sense to me this error. As soon as I change from 640 to 644 everything works right.

If anyone is willing to further debug, please comment and I will be back.

PS: I did a test and as expected, PHP doesn't honor Linux group permissions
https://stackoverflow.com/questions/78295788/why-php-doesnt-honor-linux-group-permissions-for-the-files

So this is not a problem of phpMyAdmin. I would like to hear a possible explanation if anyone happens to have one, because now as I recall this has broken my head for ages.