libraries/common.inc.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * Misc stuff and REQUIRED by ALL the scripts.
   5  * MUST be included by every script
   6  *
   7  * Among other things, it contains the advanced authentication work.
   8  *
   9  * Order of sections for common.inc.php:
  10  *
  11  * the include of libraries/defines_mysql.lib.php must be after the connection
  12  * to db to get the MySql version
  13  *
  14  * the authentication libraries must be before the connection to db
  15  *
  16  * ... so the required order is:
  17  *
  18  * LABEL_variables_init
  19  *  - initialize some variables always needed
  20  * LABEL_parsing_config_file
  21  *  - parsing of the configuration file
  22  * LABEL_loading_language_file
  23  *  - loading language file
  24  * LABEL_theme_setup
  25  *  - setting up themes
  26  *
  27  * - load of MySQL extension (if necessary)
  28  * - loading of an authentication library
  29  * - db connection
  30  * - authentication work
  31  * - load of the libraries/defines_mysql.lib.php library to get the MySQL
  32  *   release number
  33  *
  34  * @version $Id$
  35  */
  36
  37 /**
  38  * For now, avoid warnings of E_STRICT mode
  39  * (this must be done before function definitions)
  40  */
  41 if (defined('E_STRICT')) {
  42     $old_error_reporting = error_reporting(0);
  43     if ($old_error_reporting & E_STRICT) {
  44         error_reporting($old_error_reporting ^ E_STRICT);
  45     } else {
  46         error_reporting($old_error_reporting);
  47     }
  48     unset($old_error_reporting);
  49 }
  50
  51 // at this point PMA_PHP_INT_VERSION is not yet defined
  52 if (version_compare(phpversion(), '6', 'lt')) {
  53     /**
  54      * Avoid object cloning errors
  55      */
  56     @ini_set('zend.ze1_compatibility_mode', false);
  57
  58     /**
  59      * Avoid problems with magic_quotes_runtime
  60      */
  61     @ini_set('magic_quotes_runtime', false);
  62 }
  63
  64 /**
  65  * core functions
  66  */
  67 require_once './libraries/core.lib.php';
  68
  69 /**
  70  * Input sanitizing
  71  */
  72 require_once './libraries/sanitizing.lib.php';
  73
  74 /**
  75  * the PMA_Theme class
  76  */
  77 require_once './libraries/Theme.class.php';
  78
  79 /**
  80  * the PMA_Theme_Manager class
  81  */
  82 require_once './libraries/Theme_Manager.class.php';
  83
  84 /**
  85  * the PMA_Config class
  86  */
  87 require_once './libraries/Config.class.php';
  88
  89 /**
  90  * the PMA_Table class
  91  */
  92 require_once './libraries/Table.class.php';
  93
  94 if (!defined('PMA_MINIMUM_COMMON')) {
  95     /**
  96      * common functions
  97      */
  98     require_once './libraries/common.lib.php';
  99
 100     /**
 101      * Java script escaping.
 102      */
 103     require_once './libraries/js_escape.lib.php';
 104
 105     /**
 106      * Include URL/hidden inputs generating.
 107      */
 108     require_once './libraries/url_generating.lib.php';
 109 }
 110
 111 /******************************************************************************/
 112 /* start procedural code                       label_start_procedural         */
 113
 114 /**
 115  * protect against older PHP versions' bug about GLOBALS overwrite
 116  * (no need to localize this message :))
 117  * but what if script.php?GLOBALS[admin]=1&GLOBALS[_REQUEST]=1 ???
 118  */
 119 if (isset($_REQUEST['GLOBALS']) || isset($_FILES['GLOBALS'])
 120   || isset($_SERVER['GLOBALS']) || isset($_COOKIE['GLOBALS'])
 121   || isset($_ENV['GLOBALS'])) {
 122     die('GLOBALS overwrite attempt');
 123 }
 124
 125 /**
 126  * protect against possible exploits - there is no need to have so much variables
 127  */
 128 if (count($_REQUEST) > 1000) {
 129     die('possible exploit');
 130 }
 131
 132 /**
 133  * Check for numeric keys
 134  * (if register_globals is on, numeric key can be found in $GLOBALS)
 135  */
 136 foreach ($GLOBALS as $key => $dummy) {
 137     if (is_numeric($key)) {
 138         die('numeric key detected');
 139     }
 140 }
 141
 142 /**
 143  * PATH_INFO could be compromised if set, so remove it from PHP_SELF
 144  * and provide a clean PHP_SELF here
 145  */
 146 $PMA_PHP_SELF = PMA_getenv('PHP_SELF');
 147 $_PATH_INFO = PMA_getenv('PATH_INFO');
 148 if (! empty($_PATH_INFO) && ! empty($PMA_PHP_SELF)) {
 149     $path_info_pos = strrpos($PMA_PHP_SELF, $_PATH_INFO);
 150     if ($path_info_pos + strlen($_PATH_INFO) === strlen($PMA_PHP_SELF)) {
 151         $PMA_PHP_SELF = substr($PMA_PHP_SELF, 0, $path_info_pos);
 152     }
 153 }
 154 $PMA_PHP_SELF = htmlspecialchars($PMA_PHP_SELF);
 155
 156
 157 /**
 158  * just to be sure there was no import (registering) before here
 159  * we empty the global space
 160  */
 161 $variables_whitelist = array (
 162     'GLOBALS',
 163     '_SERVER',
 164     '_GET',
 165     '_POST',
 166     '_REQUEST',
 167     '_FILES',
 168     '_ENV',
 169     '_COOKIE',
 170     '_SESSION',
 171     'PMA_PHP_SELF',
 172 );
 173
 174 foreach (get_defined_vars() as $key => $value) {
 175     if (! in_array($key, $variables_whitelist)) {
 176         unset($$key);
 177     }
 178 }
 179 unset($key, $value, $variables_whitelist);
 180
 181
 182 /**
 183  * Subforms - some functions need to be called by form, cause of the limited URL
 184  * length, but if this functions inside another form you cannot just open a new
 185  * form - so phpMyAdmin uses 'arrays' inside this form
 186  *
 187  * <code>
 188  * <form ...>
 189  * ... main form elments ...
 190  * <intput type="hidden" name="subform[action1][id]" value="1" />
 191  * ... other subform data ...
 192  * <intput type="submit" name="usesubform[action1]" value="do action1" />
 193  * ... other subforms ...
 194  * <intput type="hidden" name="subform[actionX][id]" value="X" />
 195  * ... other subform data ...
 196  * <intput type="submit" name="usesubform[actionX]" value="do actionX" />
 197  * ... main form elments ...
 198  * <intput type="submit" name="main_action" value="submit form" />
 199  * </form>
 200  * </code
 201  *
 202  * so we now check if a subform is submitted
 203  */
 204 $__redirect = null;
 205 if (isset($_POST['usesubform'])) {
 206     // if a subform is present and should be used
 207     // the rest of the form is deprecated
 208     $subform_id = key($_POST['usesubform']);
 209     $subform    = $_POST['subform'][$subform_id];
 210     $_POST      = $subform;
 211     $_REQUEST   = $subform;
 212     /**
 213      * some subforms need another page than the main form, so we will just
 214      * include this page at the end of this script - we use $__redirect to
 215      * track this
 216      */
 217     if (isset($_POST['redirect'])
 218       && $_POST['redirect'] != basename($PMA_PHP_SELF)) {
 219         $__redirect = $_POST['redirect'];
 220         unset($_POST['redirect']);
 221     }
 222     unset($subform_id, $subform);
 223 }
 224 // end check if a subform is submitted
 225
 226 // remove quotes added by php
 227 if (function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc()) {
 228     PMA_arrayWalkRecursive($_GET, 'stripslashes', true);
 229     PMA_arrayWalkRecursive($_POST, 'stripslashes', true);
 230     PMA_arrayWalkRecursive($_COOKIE, 'stripslashes', true);
 231     PMA_arrayWalkRecursive($_REQUEST, 'stripslashes', true);
 232 }
 233
 234 /**
 235  * clean cookies on new install or upgrade
 236  * when changing something with increment the cookie version
 237  */
 238 $pma_cookie_version = 4;
 239 if (isset($_COOKIE)
 240  && (! isset($_COOKIE['pmaCookieVer'])
 241   || $_COOKIE['pmaCookieVer'] < $pma_cookie_version)) {
 242     // delete all cookies
 243     foreach($_COOKIE as $cookie_name => $tmp) {
 244         PMA_removeCookie($cookie_name);
 245     }
 246     $_COOKIE = array();
 247     PMA_setCookie('pmaCookieVer', $pma_cookie_version);
 248 }
 249
 250 /**
 251  * include deprecated grab_globals only if required
 252  */
 253 if (empty($__redirect) && !defined('PMA_NO_VARIABLES_IMPORT')) {
 254     require './libraries/grab_globals.lib.php';
 255 }
 256
 257 /**
 258  * include session handling after the globals, to prevent overwriting
 259  */
 260 require_once './libraries/session.inc.php';
 261
 262 /**
 263  * init some variables LABEL_variables_init
 264  */
 265
 266 /**
 267  * holds errors
 268  * @global array $GLOBALS['PMA_errors']
 269  */
 270 $GLOBALS['PMA_errors'] = array();
 271
 272 /**
 273  * holds parameters to be passed to next page
 274  * @global array $GLOBALS['url_params']
 275  */
 276 $GLOBALS['url_params'] = array();
 277
 278 /**
 279  * the whitelist for $GLOBALS['goto']
 280  * @global array $goto_whitelist
 281  */
 282 $goto_whitelist = array(
 283     //'browse_foreigners.php',
 284     //'calendar.php',
 285     //'changelog.php',
 286     //'chk_rel.php',
 287     'db_create.php',
 288     'db_datadict.php',
 289     'db_sql.php',
 290     'db_export.php',
 291     'db_importdocsql.php',
 292     'db_qbe.php',
 293     'db_structure.php',
 294     'db_import.php',
 295     'db_operations.php',
 296     'db_printview.php',
 297     'db_search.php',
 298     //'Documentation.html',
 299     //'error.php',
 300     'export.php',
 301     'import.php',
 302     //'index.php',
 303     //'navigation.php',
 304     //'license.php',
 305     'main.php',
 306     'pdf_pages.php',
 307     'pdf_schema.php',
 308     //'phpinfo.php',
 309     'querywindow.php',
 310     //'readme.php',
 311     'server_binlog.php',
 312     'server_collations.php',
 313     'server_databases.php',
 314     'server_engines.php',
 315     'server_export.php',
 316     'server_import.php',
 317     'server_privileges.php',
 318     'server_processlist.php',
 319     'server_sql.php',
 320     'server_status.php',
 321     'server_variables.php',
 322     'sql.php',
 323     'tbl_addfield.php',
 324     'tbl_alter.php',
 325     'tbl_change.php',
 326     'tbl_create.php',
 327     'tbl_import.php',
 328     'tbl_indexes.php',
 329     'tbl_move_copy.php',
 330     'tbl_printview.php',
 331     'tbl_sql.php',
 332     'tbl_export.php',
 333     'tbl_operations.php',
 334     'tbl_structure.php',
 335     'tbl_relation.php',
 336     'tbl_replace.php',
 337     'tbl_row_action.php',
 338     'tbl_select.php',
 339     //'themes.php',
 340     'transformation_overview.php',
 341     'transformation_wrapper.php',
 342     'translators.html',
 343     'user_password.php',
 344 );
 345
 346 /**
 347  * check $__redirect against whitelist
 348  */
 349 if (! PMA_checkPageValidity($__redirect, $goto_whitelist)) {
 350     $__redirect = null;
 351 }
 352
 353 /**
 354  * holds page that should be displayed
 355  * @global string $GLOBALS['goto']
 356  */
 357 $GLOBALS['goto'] = '';
 358 // Security fix: disallow accessing serious server files via "?goto="
 359 if (PMA_checkPageValidity($_REQUEST['goto'], $goto_whitelist)) {
 360     $GLOBALS['goto'] = $_REQUEST['goto'];
 361     $GLOBALS['url_params']['goto'] = $_REQUEST['goto'];
 362 } else {
 363     unset($_REQUEST['goto'], $_GET['goto'], $_POST['goto'], $_COOKIE['goto']);
 364 }
 365
 366 /**
 367  * returning page
 368  * @global string $GLOBALS['back']
 369  */
 370 if (PMA_checkPageValidity($_REQUEST['back'], $goto_whitelist)) {
 371     $GLOBALS['back'] = $_REQUEST['back'];
 372 } else {
 373     unset($_REQUEST['back'], $_GET['back'], $_POST['back'], $_COOKIE['back']);
 374 }
 375
 376 /**
 377  * Check whether user supplied token is valid, if not remove any possibly
 378  * dangerous stuff from request.
 379  *
 380  * remember that some objects in the session with session_start and __wakeup()
 381  * could access this variables before we reach this point
 382  * f.e. PMA_Config: fontsize
 383  *
 384  * @todo variables should be handled by their respective owners (objects)
 385  * f.e. lang, server, convcharset, collation_connection in PMA_Config
 386  */
 387 if (! PMA_isValid($_REQUEST['token']) || $_SESSION[' PMA_token '] != $_REQUEST['token']) {
 388     /**
 389      *  List of parameters which are allowed from unsafe source
 390      */
 391     $allow_list = array(
 392         'db', 'table', 'lang', 'server', 'convcharset', 'collation_connection', 'target',
 393         /* Session ID */
 394         'phpMyAdmin',
 395         /* Cookie preferences */
 396         'pma_lang', 'pma_charset', 'pma_collation_connection',
 397         /* Possible login form */
 398         'pma_servername', 'pma_username', 'pma_password',
 399     );
 400     /**
 401      * Require cleanup functions
 402      */
 403     require_once './libraries/cleanup.lib.php';
 404     /**
 405      * Do actual cleanup
 406      */
 407     PMA_remove_request_vars($allow_list);
 408
 409 }
 410
 411
 412 /**
 413  * @global string $convcharset
 414  * @see select_lang.lib.php
 415  */
 416 if (isset($_REQUEST['convcharset'])) {
 417     $convcharset = strip_tags($_REQUEST['convcharset']);
 418 }
 419
 420 /**
 421  * current selected database
 422  * @global string $GLOBALS['db']
 423  */
 424 $GLOBALS['db'] = '';
 425 if (PMA_isValid($_REQUEST['db'])) {
 426     // can we strip tags from this?
 427     // only \ and / is not allowed in db names for MySQL
 428     $GLOBALS['db'] = $_REQUEST['db'];
 429     $GLOBALS['url_params']['db'] = $GLOBALS['db'];
 430 }
 431
 432 /**
 433  * current selected table
 434  * @global string $GLOBALS['table']
 435  */
 436 $GLOBALS['table'] = '';
 437 if (PMA_isValid($_REQUEST['table'])) {
 438     // can we strip tags from this?
 439     // only \ and / is not allowed in table names for MySQL
 440     $GLOBALS['table'] = $_REQUEST['table'];
 441     $GLOBALS['url_params']['table'] = $GLOBALS['table'];
 442 }
 443
 444 /**
 445  * SQL query to be executed
 446  * @global string $GLOBALS['sql_query']
 447  */
 448 $GLOBALS['sql_query'] = '';
 449 if (PMA_isValid($_REQUEST['sql_query'])) {
 450     $GLOBALS['sql_query'] = $_REQUEST['sql_query'];
 451 }
 452
 453 /**
 454  * avoid problems in phpmyadmin.css.php in some cases
 455  * @global string $js_frame
 456  */
 457 $_REQUEST['js_frame'] = PMA_ifSetOr($_REQUEST['js_frame'], '');
 458
 459 //$_REQUEST['set_theme'] // checked later in this file LABEL_theme_setup
 460 //$_REQUEST['server']; // checked later in this file
 461 //$_REQUEST['lang'];   // checked by LABEL_loading_language_file
 462
 463
 464
 465 /******************************************************************************/
 466 /* parsing configuration file                         LABEL_parsing_config_file      */
 467
 468 if (empty($_SESSION['PMA_Config'])) {
 469     /**
 470      * We really need this one!
 471      */
 472     if (! function_exists('preg_replace')) {
 473         PMA_fatalError('strCantLoad', 'pcre');
 474     }
 475
 476     /**
 477      * @global PMA_Config $_SESSION['PMA_Config']
 478      */
 479     $_SESSION['PMA_Config'] = new PMA_Config('./config.inc.php');
 480
 481 } elseif (version_compare(phpversion(), '5', 'lt')) {
 482     /**
 483      * @todo move all __wakeup() functionality into session.inc.php
 484      */
 485     $_SESSION['PMA_Config']->__wakeup();
 486 }
 487
 488 if (!defined('PMA_MINIMUM_COMMON')) {
 489     $_SESSION['PMA_Config']->checkPmaAbsoluteUri();
 490 }
 491
 492 /**
 493  * BC - enable backward compatibility
 494  * exports all configuration settings into $GLOBALS ($GLOBALS['cfg'])
 495  */
 496 $_SESSION['PMA_Config']->enableBc();
 497
 498
 499 /**
 500  * check HTTPS connection
 501  */
 502 if ($_SESSION['PMA_Config']->get('ForceSSL')
 503   && !$_SESSION['PMA_Config']->get('is_https')) {
 504     PMA_sendHeaderLocation(
 505         preg_replace('/^http/', 'https',
 506             $_SESSION['PMA_Config']->get('PmaAbsoluteUri'))
 507         . PMA_generate_common_url($_GET));
 508     exit;
 509 }
 510
 511
 512 /******************************************************************************/
 513 /* loading language file                       LABEL_loading_language_file    */
 514
 515 /**
 516  * Added messages while developing:
 517  */
 518 if (file_exists('./lang/added_messages.php')) {
 519     include './lang/added_messages.php';
 520 }
 521
 522 /**
 523  * Includes the language file if it hasn't been included yet
 524  */
 525 require './libraries/language.lib.php';
 526
 527
 528 /**
 529  * check for errors occurred while loading configuration
 530  * this check is done here after loading language files to present errors in locale
 531  */
 532 if ($_SESSION['PMA_Config']->error_config_file) {
 533     $GLOBALS['PMA_errors'][] = $strConfigFileError
 534         . '<br /><br />'
 535         . ($_SESSION['PMA_Config']->getSource() == './config.inc.php' ?
 536         '<a href="show_config_errors.php"'
 537         .' target="_blank">' . $_SESSION['PMA_Config']->getSource() . '</a>'
 538         :
 539         '<a href="' . $_SESSION['PMA_Config']->getSource() . '"'
 540         .' target="_blank">' . $_SESSION['PMA_Config']->getSource() . '</a>');
 541 }
 542 if ($_SESSION['PMA_Config']->error_config_default_file) {
 543     $GLOBALS['PMA_errors'][] = sprintf($strConfigDefaultFileError,
 544         $_SESSION['PMA_Config']->default_source);
 545 }
 546 if ($_SESSION['PMA_Config']->error_pma_uri) {
 547     $GLOBALS['PMA_errors'][] = sprintf($strPmaUriError);
 548 }
 549
 550 /**
 551  * current server
 552  * @global integer $GLOBALS['server']
 553  */
 554 $GLOBALS['server'] = 0;
 555
 556 /**
 557  * Servers array fixups.
 558  * $default_server comes from PMA_Config::enableBc()
 559  * @todo merge into PMA_Config
 560  */
 561 // Do we have some server?
 562 if (!isset($cfg['Servers']) || count($cfg['Servers']) == 0) {
 563     // No server => create one with defaults
 564     $cfg['Servers'] = array(1 => $default_server);
 565 } else {
 566     // We have server(s) => apply default configuration
 567     $new_servers = array();
 568
 569     foreach ($cfg['Servers'] as $server_index => $each_server) {
 570
 571         // Detect wrong configuration
 572         if (!is_int($server_index) || $server_index < 1) {
 573             $GLOBALS['PMA_errors'][] = sprintf($strInvalidServerIndex, $server_index);
 574         }
 575
 576         $each_server = array_merge($default_server, $each_server);
 577
 578         // Don't use servers with no hostname
 579         if ($each_server['connect_type'] == 'tcp' && empty($each_server['host'])) {
 580             $GLOBALS['PMA_errors'][] = sprintf($strInvalidServerHostname, $server_index);
 581         }
 582
 583         // Final solution to bug #582890
 584         // If we are using a socket connection
 585         // and there is nothing in the verbose server name
 586         // or the host field, then generate a name for the server
 587         // in the form of "Server 2", localized of course!
 588         if ($each_server['connect_type'] == 'socket' && empty($each_server['host']) && empty($each_server['verbose'])) {
 589             $each_server['verbose'] = $GLOBALS['strServer'] . $server_index;
 590         }
 591
 592         $new_servers[$server_index] = $each_server;
 593     }
 594     $cfg['Servers'] = $new_servers;
 595     unset($new_servers, $server_index, $each_server);
 596 }
 597
 598 // Cleanup
 599 unset($default_server);
 600
 601
 602 /******************************************************************************/
 603 /* setup themes                                          LABEL_theme_setup    */
 604
 605 /**
 606  * @global PMA_Theme_Manager $_SESSION['PMA_Theme_Manager']
 607  */
 608 if (! isset($_SESSION['PMA_Theme_Manager'])) {
 609     $_SESSION['PMA_Theme_Manager'] = new PMA_Theme_Manager;
 610 } else {
 611     /**
 612      * @todo move all __wakeup() functionality into session.inc.php
 613      */
 614     $_SESSION['PMA_Theme_Manager']->checkConfig();
 615 }
 616
 617 // for the theme per server feature
 618 if (isset($_REQUEST['server']) && !isset($_REQUEST['set_theme'])) {
 619     $GLOBALS['server'] = $_REQUEST['server'];
 620     $tmp = $_SESSION['PMA_Theme_Manager']->getThemeCookie();
 621     if (empty($tmp)) {
 622         $tmp = $_SESSION['PMA_Theme_Manager']->theme_default;
 623     }
 624     $_SESSION['PMA_Theme_Manager']->setActiveTheme($tmp);
 625     unset($tmp);
 626 }
 627 /**
 628  * @todo move into PMA_Theme_Manager::__wakeup()
 629  */
 630 if (isset($_REQUEST['set_theme'])) {
 631     // if user selected a theme
 632     $_SESSION['PMA_Theme_Manager']->setActiveTheme($_REQUEST['set_theme']);
 633 }
 634
 635 /**
 636  * the theme object
 637  * @global PMA_Theme $_SESSION['PMA_Theme']
 638  */
 639 $_SESSION['PMA_Theme'] = $_SESSION['PMA_Theme_Manager']->theme;
 640
 641 // BC
 642 /**
 643  * the active theme
 644  * @global string $GLOBALS['theme']
 645  */
 646 $GLOBALS['theme']           = $_SESSION['PMA_Theme']->getName();
 647 /**
 648  * the theme path
 649  * @global string $GLOBALS['pmaThemePath']
 650  */
 651 $GLOBALS['pmaThemePath']    = $_SESSION['PMA_Theme']->getPath();
 652 /**
 653  * the theme image path
 654  * @global string $GLOBALS['pmaThemeImage']
 655  */
 656 $GLOBALS['pmaThemeImage']   = $_SESSION['PMA_Theme']->getImgPath();
 657
 658 /**
 659  * load layout file if exists
 660  */
 661 if (@file_exists($_SESSION['PMA_Theme']->getLayoutFile())) {
 662     include $_SESSION['PMA_Theme']->getLayoutFile();
 663     /**
 664      * @todo remove if all themes are update use Navi instead of Left as frame name
 665      */
 666     if (! isset($GLOBALS['cfg']['NaviWidth'])
 667      && isset($GLOBALS['cfg']['LeftWidth'])) {
 668         $GLOBALS['cfg']['NaviWidth'] = $GLOBALS['cfg']['LeftWidth'];
 669     }
 670 }
 671
 672 if (! defined('PMA_MINIMUM_COMMON')) {
 673     /**
 674      * Character set conversion.
 675      */
 676     require_once './libraries/charset_conversion.lib.php';
 677
 678     /**
 679      * String handling
 680      */
 681     require_once './libraries/string.lib.php';
 682
 683     /**
 684      * Lookup server by name
 685      * by Arnold - Helder Hosting
 686      * (see FAQ 4.8)
 687      */
 688     if (! empty($_REQUEST['server']) && is_string($_REQUEST['server'])
 689      && ! is_numeric($_REQUEST['server'])) {
 690         foreach ($cfg['Servers'] as $i => $server) {
 691             if ($server['host'] == $_REQUEST['server']) {
 692                 $_REQUEST['server'] = $i;
 693                 break;
 694             }
 695         }
 696         if (is_string($_REQUEST['server'])) {
 697             unset($_REQUEST['server']);
 698         }
 699         unset($i);
 700     }
 701
 702     /**
 703      * If no server is selected, make sure that $cfg['Server'] is empty (so
 704      * that nothing will work), and skip server authentication.
 705      * We do NOT exit here, but continue on without logging into any server.
 706      * This way, the welcome page will still come up (with no server info) and
 707      * present a choice of servers in the case that there are multiple servers
 708      * and '$cfg['ServerDefault'] = 0' is set.
 709      */
 710
 711     if (isset($_REQUEST['server']) && (is_string($_REQUEST['server']) || is_numeric($_REQUEST['server'])) && ! empty($_REQUEST['server']) && ! empty($cfg['Servers'][$_REQUEST['server']])) {
 712         $GLOBALS['server'] = $_REQUEST['server'];
 713         $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
 714     } else {
 715         if (!empty($cfg['Servers'][$cfg['ServerDefault']])) {
 716             $GLOBALS['server'] = $cfg['ServerDefault'];
 717             $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
 718         } else {
 719             $GLOBALS['server'] = 0;
 720             $cfg['Server'] = array();
 721         }
 722     }
 723     $GLOBALS['url_params']['server'] = $GLOBALS['server'];
 724
 725     if (! empty($cfg['Server'])) {
 726
 727         /**
 728          * Loads the proper database interface for this server
 729          */
 730         require_once './libraries/database_interface.lib.php';
 731
 732         // Gets the authentication library that fits the $cfg['Server'] settings
 733         // and run authentication
 734
 735         // (for a quick check of path disclosure in auth/cookies:)
 736         $coming_from_common = true;
 737
 738         // to allow HTTP or http
 739         $cfg['Server']['auth_type'] = strtolower($cfg['Server']['auth_type']);
 740         if (! file_exists('./libraries/auth/' . $cfg['Server']['auth_type'] . '.auth.lib.php')) {
 741             PMA_fatalError($strInvalidAuthMethod . ' ' . $cfg['Server']['auth_type']);
 742         }
 743         /**
 744          * the required auth type plugin
 745          */
 746         require_once './libraries/auth/' . $cfg['Server']['auth_type'] . '.auth.lib.php';
 747
 748         if (!PMA_auth_check()) {
 749             PMA_auth();
 750         } else {
 751             PMA_auth_set_user();
 752         }
 753
 754         // Check IP-based Allow/Deny rules as soon as possible to reject the
 755         // user
 756         // Based on mod_access in Apache:
 757         // http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/aaa/mod_access.c?rev=1.37&content-type=text/vnd.viewcvs-markup
 758         // Look at: "static int check_dir_access(request_rec *r)"
 759         // Robbat2 - May 10, 2002
 760         if (isset($cfg['Server']['AllowDeny'])
 761           && isset($cfg['Server']['AllowDeny']['order'])) {
 762
 763             /**
 764              * ip based access library
 765              */
 766             require_once './libraries/ip_allow_deny.lib.php';
 767
 768             $allowDeny_forbidden         = false; // default
 769             if ($cfg['Server']['AllowDeny']['order'] == 'allow,deny') {
 770                 $allowDeny_forbidden     = true;
 771                 if (PMA_allowDeny('allow')) {
 772                     $allowDeny_forbidden = false;
 773                 }
 774                 if (PMA_allowDeny('deny')) {
 775                     $allowDeny_forbidden = true;
 776                 }
 777             } elseif ($cfg['Server']['AllowDeny']['order'] == 'deny,allow') {
 778                 if (PMA_allowDeny('deny')) {
 779                     $allowDeny_forbidden = true;
 780                 }
 781                 if (PMA_allowDeny('allow')) {
 782                     $allowDeny_forbidden = false;
 783                 }
 784             } elseif ($cfg['Server']['AllowDeny']['order'] == 'explicit') {
 785                 if (PMA_allowDeny('allow')
 786                   && !PMA_allowDeny('deny')) {
 787                     $allowDeny_forbidden = false;
 788                 } else {
 789                     $allowDeny_forbidden = true;
 790                 }
 791             } // end if ... elseif ... elseif
 792
 793             // Ejects the user if banished
 794             if ($allowDeny_forbidden) {
 795                PMA_auth_fails();
 796             }
 797             unset($allowDeny_forbidden); //Clean up after you!
 798         } // end if
 799
 800         // is root allowed?
 801         if (!$cfg['Server']['AllowRoot'] && $cfg['Server']['user'] == 'root') {
 802             $allowDeny_forbidden = true;
 803             PMA_auth_fails();
 804             unset($allowDeny_forbidden); //Clean up after you!
 805         }
 806
 807         $bkp_track_err = @ini_set('track_errors', 1);
 808
 809         // Try to connect MySQL with the control user profile (will be used to
 810         // get the privileges list for the current user but the true user link
 811         // must be open after this one so it would be default one for all the
 812         // scripts)
 813         $controllink = false;
 814         if ($cfg['Server']['controluser'] != '') {
 815             $controllink = PMA_DBI_connect($cfg['Server']['controluser'],
 816                 $cfg['Server']['controlpass'], true);
 817         }
 818         if (! $controllink) {
 819             $controllink = PMA_DBI_connect($cfg['Server']['user'],
 820                 $cfg['Server']['password'], true);
 821         } // end if ... else
 822
 823         // Pass #1 of DB-Config to read in master level DB-Config will go here
 824         // Robbat2 - May 11, 2002
 825
 826         // Connects to the server (validates user's login)
 827         $userlink = PMA_DBI_connect($cfg['Server']['user'],
 828             $cfg['Server']['password'], false);
 829
 830         // Pass #2 of DB-Config to read in user level DB-Config will go here
 831         // Robbat2 - May 11, 2002
 832
 833         @ini_set('track_errors', $bkp_track_err);
 834         unset($bkp_track_err);
 835
 836         /**
 837          * If we auto switched to utf-8 we need to reread messages here
 838          */
 839         if (defined('PMA_LANG_RELOAD')) {
 840             require './libraries/language.lib.php';
 841         }
 842
 843         /**
 844          * SQL Parser code
 845          */
 846         require_once './libraries/sqlparser.lib.php';
 847
 848         /**
 849          * SQL Validator interface code
 850          */
 851         require_once './libraries/sqlvalidator.lib.php';
 852
 853         /**
 854          * the PMA_List_Database class
 855          */
 856         require_once './libraries/List_Database.class.php';
 857         $PMA_List_Database = new PMA_List_Database($userlink, $controllink);
 858
 859     } // end server connecting
 860
 861     /**
 862      * Kanji encoding convert feature appended by Y.Kawada (2002/2/20)
 863      */
 864     if (@function_exists('mb_convert_encoding')
 865         && strpos(' ' . $lang, 'ja-')
 866         && file_exists('./libraries/kanji-encoding.lib.php')) {
 867         require_once './libraries/kanji-encoding.lib.php';
 868         /**
 869          * enable multibyte string support
 870          */
 871         define('PMA_MULTIBYTE_ENCODING', 1);
 872     } // end if
 873
 874     /**
 875      * save some settings in cookies
 876      * @todo should be done in PMA_Config
 877      */
 878     PMA_setCookie('pma_lang', $GLOBALS['lang']);
 879     PMA_setCookie('pma_charset', $GLOBALS['convcharset']);
 880     PMA_setCookie('pma_collation_connection', $GLOBALS['collation_connection']);
 881
 882     $_SESSION['PMA_Theme_Manager']->setThemeCookie();
 883
 884     /**
 885      * check if profiling was requested and remember it
 886      * (note: when $cfg['ServerDefault'] = 0, constant is not defined)
 887      */
 888
 889     if (defined('PMA_MYSQL_INT_VERSION') && PMA_MYSQL_INT_VERSION >= 50037 && isset($_REQUEST['profiling'])) {
 890        $_SESSION['profiling'] = true;
 891     } elseif (isset($_REQUEST['profiling_form'])) {
 892        // the checkbox was unchecked
 893             unset($_SESSION['profiling']);
 894     }
 895
 896 } // end if !defined('PMA_MINIMUM_COMMON')
 897
 898 if (!empty($__redirect) && in_array($__redirect, $goto_whitelist)) {
 899     /**
 900      * include subform target page
 901      */
 902     require $__redirect;
 903     exit();
 904 }
 905 ?>