Discussion about the Online File Manager + PhpMyAdmin web access security.
I have noticed that the Online File Manager uses u= and p= GET parameters for authenticating user. the password (u=) likely a reverse emcrypted version of the 8-15 character hosting account password. Also i have noticed that the link only expires when you change the 8-15 character password from InfinityFree dashboard. The web PhpMyAdmin access is also done by a link, that doesn’t expire unless password change possibly.
I know that likely, these are not things managed by InfinityFree itself, rather iFastNet.
The file manager supports logging in with a POST request instead, submitting the login details as form data, and that’s exactly what the members area does. I’m not sure about the control panel, it may be using the GET login method instead.
phpMyAdmin does not support logging in with POST, as far as I’m aware.
I agree that it’s not the most secure authentication method. But the main risk I see is people copying the URL in the address bar and sharing that. That’s a problem for the file manager, but phpMyAdmin mitigates that by doing a redirect right after doing a login, so you’ll never actually see the data in the URL.
If you know of any other, real world risk that this introduces that a POST request doesn’t have, then please share it so we can look for a solution that effectively addresses that issue.
Thanks for the clarification. I understand that the Members Area uses POST for the file manager, and that phpMyAdmin redirects after processing the login. I agree that this reduces the risk of users accidentally sharing the credentials in the address bar.
The other concern I wanted to highlight is that sensitive query parameters can be recorded in server access logs, reverse-proxy logs, monitoring systems, and other infrastructure logs. HTTPS protects the request in transit, but it doesn’t prevent the receiving infrastructure from recording the full URL.
My other concern is the apparent lifetime of these credentials. In my tests, previously issued file-manager and phpMyAdmin links continued to work across different networks and browsers until the hosting password was changed. If those links contain reusable credentials or tokens, a copy that leaks through logs or accidental sharing could potentially remain valid for a long time. Mainly because there is a tiny time when you open a phpMyAdmin link, that previously mentioned actors can log/access and use the phpMyAdmin link accross networks. A clarifaction for the Online File Manager: i meant that when you first go to vPanel (VistaPanel) then to Online File Manager, it uses GET parameters for authentication. I have crafted example links that prove both phpMyAdmin and Online File Manager when gone trough vPanel may use GET parameters:
phpMyAdmin example:
I decided it’s better not to share it because i do not fully understand what type of information the long phpMyAdmin string has about my account/database other than the username, but i know the link is not one that really expires from my experience. But when you go trough vPanel phpMyAdmin copy the link for the ”Connect” button of preferred database, it is the link that will always open the phpMyAdmin interfaca for that DB.
Please remember that the “receiving infrastructure” is our own. We already have your hosting account password, we don’t need to record your activity to figure it out.
I don’t know exactly what’s being logged, if access logs are recorded at all, and what mitigations have been implemented to scrub sensitive tokens from them. Regardless, it’s not leaking data externally.
Yes, the login URLs are not one-time tokens, they are encoded or encrypted variations of your account password, which is how the file manager and phpMyAdmin know how to access your files and database respectively.
There is no mechanism that only allows a single use or limits the time the URL is valid.
So yeah, don’t share them.
The rest of your message looks like a whole bunch of AI generated fluff that basically just repeats everything that we’ve already discussed and agree on (no need to re-explain or demonstrate mechanics that you pointed out and I confirmed).
Your concern is noted, but unless you can point out a clear undeniable risk that this system has, no changes will be made.
then to Online File Manager, it uses GET parameters for authentication. I have crafted example links that prove both phpMyAdmin and Online File Manager when gone trough vPanel may use GET parameters: