Merge branch 'master' into passfile-fix

Author: asheshv

.github/workflows/run-python-tests-epas.yml

@@ -33,6 +33,17 @@ jobs:
       matrix:
         os: [ubuntu-22.04, windows-latest]
         pgver: [14, 15, 16, 17, 18]
+        postgisver: [34]
+        exclude:
+          - pgver: 18
+            postgisver: 34
+        include:
+          - os: ubuntu-22.04
+            pgver: 18
+            postgisver: 36
+          - os: windows-latest
+            pgver: 18
+            postgisver: 36
 
     runs-on: ${{ matrix.os }}
 
@@ -53,7 +64,7 @@ jobs:
         if: ${{ matrix.os == 'ubuntu-22.04' }}
         run: |
           sudo apt update
-          sudo apt install -y libpq-dev libffi-dev libssl-dev libkrb5-dev zlib1g-dev edb-as${{ matrix.pgver }}-server edb-as${{ matrix.pgver }}-server-pldebugger edb-as${{ matrix.pgver }}-postgis34
+          sudo apt install -y libpq-dev libffi-dev libssl-dev libkrb5-dev zlib1g-dev edb-as${{ matrix.pgver }}-server edb-as${{ matrix.pgver }}-server-pldebugger edb-as${{ matrix.pgver }}-postgis${{ matrix.postgisver }}
 
       - name: Install pgagent on Linux
         if: ${{ matrix.os == 'ubuntu-22.04' &&  matrix.pgver <= 16 }}

.gitignore

@@ -59,5 +59,6 @@ auditpy.txt
 web/coverage/
 web/.coverage
 web/regression/.coverage
+.worktree/
 web/regression/covhtml/
 web/regression/htmlcov/

Dockerfile

@@ -165,7 +165,8 @@ RUN apk update && apk upgrade && \
         tzdata \
         libedit \
         libldap \
-        libcap && \
+        libcap \
+        su-exec && \
     rm -rf /var/cache/apk/*
 
 # Copy in the Python packages
@@ -197,7 +198,7 @@ RUN /venv/bin/python3 -m pip install --no-cache-dir gunicorn==23.0.0 && \
     useradd -r -u 5050 -g root -s /sbin/nologin pgadmin && \
     mkdir -p /run/pgadmin /var/lib/pgadmin && \
     chown pgadmin:root /run/pgadmin /var/lib/pgadmin && \
-    chmod g=u /var/lib/pgadmin && \
+    chmod g=u /run/pgadmin /var/lib/pgadmin && \
     touch /pgadmin4/config_distro.py && \
     chown pgadmin:root /pgadmin4/config_distro.py && \
     chmod g=u /pgadmin4/config_distro.py && \

pkg/docker/entrypoint.sh

@@ -1,12 +1,78 @@
 #!/usr/bin/env bash
 
-# Fixup the passwd file, in case we're on OpenShift
-if ! whoami > /dev/null 2>&1; then
-  if [ "$(id -u)" -ne 5050 ]; then
-    if [ -w /etc/passwd ]; then
-      echo "${USER_NAME:-pgadminr}:x:$(id -u):0:${USER_NAME:-pgadminr} user:${HOME}:/sbin/nologin" >> /etc/passwd
+########################################################################
+# PUID/PGID support
+#
+# When the container runs as root (e.g. --user root), the pgadmin user
+# is reassigned to the requested UID/GID and all initialization +
+# gunicorn run via su-exec as that user.
+#
+# When the container runs as non-root (default USER 5050, or OpenShift
+# random UID), PUID/PGID are ignored and everything runs as the
+# current user.
+########################################################################
+
+PUID=${PUID:-5050}
+PGID=${PGID:-0}
+
+# Validate PUID/PGID are numeric and in acceptable range
+if ! echo "$PUID" | grep -qE '^[0-9]+$'; then
+    echo "ERROR: PUID must be a numeric value, got '$PUID'"
+    exit 1
+fi
+if ! echo "$PGID" | grep -qE '^[0-9]+$'; then
+    echo "ERROR: PGID must be a numeric value, got '$PGID'"
+    exit 1
+fi
+if [ "$PUID" -eq 0 ]; then
+    echo "ERROR: PUID=0 (root) is not allowed. Use a non-root UID."
+    exit 1
+fi
+
+if [ "$(id -u)" = "0" ]; then
+    # Ensure a group with the target GID exists
+    if ! getent group "$PGID" > /dev/null 2>&1; then
+        if ! addgroup -g "$PGID" pggroup; then
+            echo "ERROR: Failed to create group with GID=$PGID"
+            exit 1
+        fi
+    fi
+
+    # Reassign the pgadmin user to the desired UID/GID
+    if ! usermod -o -u "$PUID" -g "$PGID" pgadmin; then
+        echo "ERROR: Failed to set pgadmin user to UID=$PUID GID=$PGID"
+        exit 1
+    fi
+
+    # Fix ownership of runtime directories BEFORE any initialization
+    for dir in /run/pgadmin /var/lib/pgadmin; do
+        if [ -d "$dir" ]; then
+            chown -R "$PUID:$PGID" "$dir"
+        fi
+    done
+
+    # Fix ownership of individual files (no -R needed)
+    if [ -e /pgadmin4/config_distro.py ]; then
+        chown "$PUID:$PGID" /pgadmin4/config_distro.py
+    fi
+
+    if [ -d /certs ]; then
+        chown -R "$PUID:$PGID" /certs
+    fi
+
+    SU_EXEC="su-exec $PUID:$PGID"
+    echo "pgAdmin will run as UID=$PUID, GID=$PGID"
+else
+    SU_EXEC=""
+
+    # Fixup the passwd file, in case we're on OpenShift
+    if ! whoami > /dev/null 2>&1; then
+        if [ "$(id -u)" -ne 5050 ]; then
+            if [ -w /etc/passwd ]; then
+                echo "${USER_NAME:-pgadminr}:x:$(id -u):0:${USER_NAME:-pgadminr} user:${HOME}:/sbin/nologin" >> /etc/passwd
+            fi
+        fi
     fi
-  fi
 fi
 
 # usage: file_env VAR [DEFAULT] ie: file_env 'XYZ_DB_PASSWORD' 'example'
@@ -74,12 +140,17 @@ EOF
         esac
         echo "${var#PGADMIN_CONFIG_} = $val" >> "${CONFIG_DISTRO_FILE_PATH}"
     done
+
+    # If running as root with custom config distro path, fix ownership
+    if [ "$(id -u)" = "0" ] && [ "${CONFIG_DISTRO_FILE_PATH}" != "/pgadmin4/config_distro.py" ]; then
+        chown "$PUID:$PGID" "${CONFIG_DISTRO_FILE_PATH}"
+    fi
 fi
 
 # Check whether the external configuration database exists if it is being used.
 external_config_db_exists="False"
 if [ -n "${PGADMIN_CONFIG_CONFIG_DATABASE_URI}" ]; then
-     external_config_db_exists=$(cd /pgadmin4/pgadmin/utils && /venv/bin/python3 -c "from check_external_config_db import check_external_config_db; val = check_external_config_db("${PGADMIN_CONFIG_CONFIG_DATABASE_URI}"); print(val)")
+     external_config_db_exists=$(cd /pgadmin4/pgadmin/utils && $SU_EXEC /venv/bin/python3 -c "from check_external_config_db import check_external_config_db; val = check_external_config_db(\"${PGADMIN_CONFIG_CONFIG_DATABASE_URI}\"); print(val)")
 fi
 
 # DRY of the code to load the PGADMIN_SERVER_JSON_FILE
@@ -96,9 +167,9 @@ function load_server_json_file() {
         # When running in Desktop mode, no user is created
         # so we have to import servers anonymously
         if [ "${PGADMIN_CONFIG_SERVER_MODE}" = "False" ]; then
-            /venv/bin/python3 /pgadmin4/setup.py load-servers "${PGADMIN_SERVER_JSON_FILE}" ${EXTRA_ARGS}
+            $SU_EXEC /venv/bin/python3 /pgadmin4/setup.py load-servers "${PGADMIN_SERVER_JSON_FILE}" ${EXTRA_ARGS}
         else
-            /venv/bin/python3 /pgadmin4/setup.py load-servers "${PGADMIN_SERVER_JSON_FILE}" --user "${PGADMIN_DEFAULT_EMAIL}" ${EXTRA_ARGS}
+            $SU_EXEC /venv/bin/python3 /pgadmin4/setup.py load-servers "${PGADMIN_SERVER_JSON_FILE}" --user "${PGADMIN_DEFAULT_EMAIL}" ${EXTRA_ARGS}
         fi
     fi
 }
@@ -124,7 +195,7 @@ if [ ! -f /var/lib/pgadmin/pgadmin4.db ] && [ "${external_config_db_exists}" = "
     fi
      email_config="{'CHECK_EMAIL_DELIVERABILITY': ${CHECK_EMAIL_DELIVERABILITY}, 'ALLOW_SPECIAL_EMAIL_DOMAINS': ${ALLOW_SPECIAL_EMAIL_DOMAINS}, 'GLOBALLY_DELIVERABLE': ${GLOBALLY_DELIVERABLE}}"
      echo "email config is ${email_config}"
-     is_valid_email=$(cd /pgadmin4/pgadmin/utils && /venv/bin/python3 -c "from validation_utils import validate_email; val = validate_email('${PGADMIN_DEFAULT_EMAIL}', ${email_config}); print(val)")
+     is_valid_email=$(cd /pgadmin4/pgadmin/utils && $SU_EXEC /venv/bin/python3 -c "from validation_utils import validate_email; val = validate_email('${PGADMIN_DEFAULT_EMAIL}', ${email_config}); print(val)")
      if echo "${is_valid_email}" | grep "False" > /dev/null; then
          echo "'${PGADMIN_DEFAULT_EMAIL}' does not appear to be a valid email address. Please reset the PGADMIN_DEFAULT_EMAIL environment variable and try again."
          echo "Validation output: ${is_valid_email}"
@@ -140,7 +211,7 @@ if [ ! -f /var/lib/pgadmin/pgadmin4.db ] && [ "${external_config_db_exists}" = "
 
     # Initialize DB before starting Gunicorn
     # Importing pgadmin4 (from this script) is enough
-    /venv/bin/python3 run_pgadmin.py
+    $SU_EXEC /venv/bin/python3 run_pgadmin.py
 
     export PGADMIN_PREFERENCES_JSON_FILE="${PGADMIN_PREFERENCES_JSON_FILE:-/pgadmin4/preferences.json}"
 
@@ -150,22 +221,30 @@ if [ ! -f /var/lib/pgadmin/pgadmin4.db ] && [ "${external_config_db_exists}" = "
     # Pre-load any required preferences
     if [ -f "${PGADMIN_PREFERENCES_JSON_FILE}" ]; then
         if [ "${PGADMIN_CONFIG_SERVER_MODE}" = "False" ]; then
-            DESKTOP_USER=$(cd /pgadmin4 && /venv/bin/python3 -c 'import config; print(config.DESKTOP_USER)')
-            /venv/bin/python3 /pgadmin4/setup.py set-prefs "${DESKTOP_USER}" --input-file "${PGADMIN_PREFERENCES_JSON_FILE}"
+            DESKTOP_USER=$(cd /pgadmin4 && $SU_EXEC /venv/bin/python3 -c 'import config; print(config.DESKTOP_USER)')
+            $SU_EXEC /venv/bin/python3 /pgadmin4/setup.py set-prefs "${DESKTOP_USER}" --input-file "${PGADMIN_PREFERENCES_JSON_FILE}"
         else
-            /venv/bin/python3 /pgadmin4/setup.py set-prefs "${PGADMIN_DEFAULT_EMAIL}" --input-file "${PGADMIN_PREFERENCES_JSON_FILE}"
+            $SU_EXEC /venv/bin/python3 /pgadmin4/setup.py set-prefs "${PGADMIN_DEFAULT_EMAIL}" --input-file "${PGADMIN_PREFERENCES_JSON_FILE}"
         fi
     fi
     # Copy the pgpass file passed using secrets
-    if [ -f "${PGPASS_FILE}" ]; then
+    if [ -n "${PGPASS_FILE}" ] && [ -f "${PGPASS_FILE}" ]; then
         if [ "${PGADMIN_CONFIG_SERVER_MODE}" = "False" ]; then
-            cp ${PGPASS_FILE} /var/lib/pgadmin/.pgpass
+            cp "${PGPASS_FILE}" /var/lib/pgadmin/.pgpass
             chmod 600 /var/lib/pgadmin/.pgpass
+            # Fix ownership when running as root
+            if [ "$(id -u)" = "0" ]; then
+                chown "$PUID:$PGID" /var/lib/pgadmin/.pgpass
+            fi
         else
             PGADMIN_USER_CONFIG_DIR=$(echo "${PGADMIN_DEFAULT_EMAIL}" | sed 's/@/_/g')
-            mkdir -p /var/lib/pgadmin/storage/${PGADMIN_USER_CONFIG_DIR}
-            cp ${PGPASS_FILE} /var/lib/pgadmin/storage/${PGADMIN_USER_CONFIG_DIR}/.pgpass
-            chmod 600 /var/lib/pgadmin/storage/${PGADMIN_USER_CONFIG_DIR}/.pgpass
+            mkdir -p "/var/lib/pgadmin/storage/${PGADMIN_USER_CONFIG_DIR}"
+            cp "${PGPASS_FILE}" "/var/lib/pgadmin/storage/${PGADMIN_USER_CONFIG_DIR}/.pgpass"
+            chmod 600 "/var/lib/pgadmin/storage/${PGADMIN_USER_CONFIG_DIR}/.pgpass"
+            # Fix ownership when running as root
+            if [ "$(id -u)" = "0" ]; then
+                chown -R "$PUID:$PGID" "/var/lib/pgadmin/storage/${PGADMIN_USER_CONFIG_DIR}"
+            fi
         fi
     fi
 # If already initialised and PGADMIN_REPLACE_SERVERS_ON_STARTUP is set to true, then load the server json file.
@@ -180,7 +259,7 @@ fi
 
 # Get the session timeout from the pgAdmin config. We'll use this (in seconds)
 # to define the Gunicorn worker timeout
-TIMEOUT=$(cd /pgadmin4 && /venv/bin/python3 -c 'import config; print(config.SESSION_EXPIRATION_TIME * 60 * 60 * 24)')
+TIMEOUT=$(cd /pgadmin4 && $SU_EXEC /venv/bin/python3 -c 'import config; print(config.SESSION_EXPIRATION_TIME * 60 * 60 * 24)')
 
 # NOTE: currently pgadmin can run only with 1 worker due to sessions implementation
 # Using --threads to have multi-threaded single-process worker
@@ -196,7 +275,7 @@ else
 fi
 
 if [ -n "${PGADMIN_ENABLE_TLS}" ]; then
-    exec /venv/bin/gunicorn --limit-request-line "${GUNICORN_LIMIT_REQUEST_LINE:-8190}" --timeout "${TIMEOUT}" --bind "${BIND_ADDRESS}" -w 1 --threads "${GUNICORN_THREADS:-25}" --access-logfile "${GUNICORN_ACCESS_LOGFILE:--}" --keyfile /certs/server.key --certfile /certs/server.cert -c gunicorn_config.py run_pgadmin:app
+    exec $SU_EXEC /venv/bin/gunicorn --limit-request-line "${GUNICORN_LIMIT_REQUEST_LINE:-8190}" --timeout "${TIMEOUT}" --bind "${BIND_ADDRESS}" -w 1 --threads "${GUNICORN_THREADS:-25}" --access-logfile "${GUNICORN_ACCESS_LOGFILE:--}" --keyfile /certs/server.key --certfile /certs/server.cert -c gunicorn_config.py run_pgadmin:app
 else
-    exec /venv/bin/gunicorn --limit-request-line "${GUNICORN_LIMIT_REQUEST_LINE:-8190}" --limit-request-fields "${GUNICORN_LIMIT_REQUEST_FIELDS:-100}" --limit-request-field_size "${GUNICORN_LIMIT_REQUEST_FIELD_SIZE:-8190}" --timeout "${TIMEOUT}" --bind "${BIND_ADDRESS}" -w 1 --threads "${GUNICORN_THREADS:-25}" --access-logfile "${GUNICORN_ACCESS_LOGFILE:--}" -c gunicorn_config.py run_pgadmin:app
+    exec $SU_EXEC /venv/bin/gunicorn --limit-request-line "${GUNICORN_LIMIT_REQUEST_LINE:-8190}" --limit-request-fields "${GUNICORN_LIMIT_REQUEST_FIELDS:-100}" --limit-request-field_size "${GUNICORN_LIMIT_REQUEST_FIELD_SIZE:-8190}" --timeout "${TIMEOUT}" --bind "${BIND_ADDRESS}" -w 1 --threads "${GUNICORN_THREADS:-25}" --access-logfile "${GUNICORN_ACCESS_LOGFILE:--}" -c gunicorn_config.py run_pgadmin:app
 fi

requirements.txt

@@ -12,14 +12,15 @@
 # relevant packages.
 ###############################################################################
 
-Authlib==1.6.9
+Authlib==1.6.*; python_version <= '3.9'
+Authlib==1.7.*; python_version > '3.9'
 azure-identity==1.25.3
 azure-mgmt-rdbms==10.1.1
 azure-mgmt-resource==25.0.0
 azure-mgmt-subscription==3.1.1
 bcrypt==5.0.*
 boto3==1.42.*
-certifi==2026.2.25
+certifi==2026.4.22
 cryptography==46.0.*
 Flask-Babel==4.0.*
 Flask-Compress==1.*
@@ -28,13 +29,14 @@ Flask-Mail==0.*
 Flask-Migrate==4.*
 Flask-Paranoid==0.*
 Flask-Security-Too==5.4.*; python_version <= '3.9'
-Flask-Security-Too==5.7.*; python_version > '3.9'
+Flask-Security-Too==5.8.*; python_version > '3.9'
 Flask-SocketIO==5.6.*
 Flask-SQLAlchemy==3.1.*
-Flask-WTF==1.2.*
+Flask-WTF==1.2.*; python_version <= '3.9'
+Flask-WTF==1.3.*; python_version > '3.9'
 Flask==3.1.*
 google-api-python-client==2.*
-google-auth-oauthlib==1.3.0
+google-auth-oauthlib==1.3.1
 gssapi==1.11.*
 jsonformatter~=0.3.4
 keyring==25.*
@@ -62,4 +64,4 @@ urllib3==2.6.*;  python_version > '3.9'
 user-agents==2.2.0
 Werkzeug==3.1.*
 WTForms==3.1.*; python_version <= '3.9'
-WTForms==3.2.*; python_version > '3.9'
+WTForms==3.2.*; python_version > '3.9'

runtime/package.json

@@ -12,13 +12,15 @@
   },
   "packageManager": "yarn@4.9.2",
   "devDependencies": {
-    "electron": "41.0.2",
-    "eslint": "^9.39.2",
-    "eslint-plugin-unused-imports": "^4.4.1"
+    "@eslint/js": "^10.0.1",
+    "electron": "^41.3.0",
+    "eslint": "^10.2.1",
+    "eslint-plugin-unused-imports": "^4.4.1",
+    "globals": "^17.5.0"
   },
   "dependencies": {
-    "axios": "^1.13.5",
-    "electron-context-menu": "^4.1.0",
+    "axios": "^1.15.2",
+    "electron-context-menu": "^4.1.2",
     "electron-store": "^11.0.2"
   }
 }

runtime/src/js/downloader.js

@@ -47,7 +47,7 @@ function updateProgress(callerWindow) {
     return;
   }
   setBadge(Object.keys(downloadQueue).length);
-  let progress = 0;
+  let progress;
   if(Object.values(downloadQueue).some((item) => item.total === null)) {
     // If any of the items in the queue does not have a total, we cannot calculate progress
     // so we return 2 to indicate that the progress is indeterminate.

runtime/src/js/misc.js

@@ -100,17 +100,13 @@ const serverLogFile = path.join(getLocalAppDataPath(), 'pgadmin4.' + (new Date()
 
 // This function is used to read the file and return the content
 export const readServerLog = () => {
-  let data = null;
-
   if (fs.existsSync(serverLogFile)) {
-    data = fs.readFileSync(serverLogFile, 'utf8');
-  } else {
-    let errMsg = 'Unable to read file ' + serverLogFile + '.';
-    console.warn(errMsg);
-    return errMsg;
+    return fs.readFileSync(serverLogFile, 'utf8');
   }
 
-  return data;
+  let errMsg = 'Unable to read file ' + serverLogFile + '.';
+  console.warn(errMsg);
+  return errMsg;
 };
 
 // This function is used to write the data into the log file