libraries/common.inc.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * Misc stuff and REQUIRED by ALL the scripts.
   5  * MUST be included by every script
   6  *
   7  * Among other things, it contains the advanced authentication work.
   8  *
   9  * Order of sections for common.inc.php:
  10  *
  11  * the authentication libraries must be before the connection to db
  12  *
  13  * ... so the required order is:
  14  *
  15  * LABEL_variables_init
  16  *  - initialize some variables always needed
  17  * LABEL_parsing_config_file
  18  *  - parsing of the configuration file
  19  * LABEL_loading_language_file
  20  *  - loading language file
  21  * LABEL_setup_servers
  22  *  - check and setup configured servers
  23  * LABEL_theme_setup
  24  *  - setting up themes
  25  *
  26  * - load of MySQL extension (if necessary)
  27  * - loading of an authentication library
  28  * - db connection
  29  * - authentication work
  30  *
  31  * @version $Id$
  32  * @package phpMyAdmin
  33  */
  34
  35 /**
  36  * Minimum PHP version; can't call PMA_fatalError() which uses a
  37  * PHP 5 function, so cannot easily localize this message.
  38  */
  39 if (version_compare(PHP_VERSION, '5.2.0', 'lt')) {
  40     die('PHP 5.2+ is required');
  41 }
  42
  43 /**
  44   * Backward compatibility for PHP 5.2
  45   */
  46 if (!defined('E_DEPRECATED')) {
  47     define('E_DEPRECATED', 8192);
  48 }
  49
  50 /**
  51  * the error handler
  52  */
  53 require_once './libraries/Error_Handler.class.php';
  54
  55 /**
  56  * initialize the error handler
  57  */
  58 $GLOBALS['error_handler'] = new PMA_Error_Handler();
  59 $cfg['Error_Handler']['display'] = TRUE;
  60
  61 // at this point PMA_PHP_INT_VERSION is not yet defined
  62 if (version_compare(phpversion(), '6', 'lt')) {
  63     /**
  64      * Avoid object cloning errors
  65      */
  66     @ini_set('zend.ze1_compatibility_mode', false);
  67
  68     /**
  69      * Avoid problems with magic_quotes_runtime
  70      */
  71     @ini_set('magic_quotes_runtime', false);
  72 }
  73
  74 /**
  75  * for verification in all procedural scripts under libraries
  76  */
  77 define('PHPMYADMIN', true);
  78
  79 /**
  80  * core functions
  81  */
  82 require_once './libraries/core.lib.php';
  83
  84 /**
  85  * Input sanitizing
  86  */
  87 require_once './libraries/sanitizing.lib.php';
  88
  89 /**
  90  * the PMA_Theme class
  91  */
  92 require_once './libraries/Theme.class.php';
  93
  94 /**
  95  * the PMA_Theme_Manager class
  96  */
  97 require_once './libraries/Theme_Manager.class.php';
  98
  99 /**
 100  * the PMA_Config class
 101  */
 102 require_once './libraries/Config.class.php';
 103
 104 /**
 105  * the relation lib, tracker needs it
 106  */
 107 require_once './libraries/relation.lib.php';
 108
 109 /**
 110  * the PMA_Tracker class
 111  */
 112 require_once './libraries/Tracker.class.php';
 113
 114 /**
 115  * the PMA_Table class
 116  */
 117 require_once './libraries/Table.class.php';
 118
 119 if (!defined('PMA_MINIMUM_COMMON')) {
 120     /**
 121      * common functions
 122      */
 123     require_once './libraries/common.lib.php';
 124
 125     /**
 126      * Java script escaping.
 127      */
 128     require_once './libraries/js_escape.lib.php';
 129
 130     /**
 131      * Include URL/hidden inputs generating.
 132      */
 133     require_once './libraries/url_generating.lib.php';
 134 }
 135
 136 /******************************************************************************/
 137 /* start procedural code                       label_start_procedural         */
 138
 139 /**
 140  * protect against possible exploits - there is no need to have so much variables
 141  */
 142 if (count($_REQUEST) > 1000) {
 143     die('possible exploit');
 144 }
 145
 146 /**
 147  * Check for numeric keys
 148  * (if register_globals is on, numeric key can be found in $GLOBALS)
 149  */
 150 foreach ($GLOBALS as $key => $dummy) {
 151     if (is_numeric($key)) {
 152         die('numeric key detected');
 153     }
 154 }
 155 unset($dummy);
 156
 157 /**
 158  * PATH_INFO could be compromised if set, so remove it from PHP_SELF
 159  * and provide a clean PHP_SELF here
 160  */
 161 $PMA_PHP_SELF = PMA_getenv('PHP_SELF');
 162 $_PATH_INFO = PMA_getenv('PATH_INFO');
 163 if (! empty($_PATH_INFO) && ! empty($PMA_PHP_SELF)) {
 164     $path_info_pos = strrpos($PMA_PHP_SELF, $_PATH_INFO);
 165     if ($path_info_pos + strlen($_PATH_INFO) === strlen($PMA_PHP_SELF)) {
 166         $PMA_PHP_SELF = substr($PMA_PHP_SELF, 0, $path_info_pos);
 167     }
 168 }
 169 $PMA_PHP_SELF = htmlspecialchars($PMA_PHP_SELF);
 170
 171
 172 /**
 173  * just to be sure there was no import (registering) before here
 174  * we empty the global space (but avoid unsetting $variables_list
 175  * and $key in the foreach(), we still need them!)
 176  */
 177 $variables_whitelist = array (
 178     'GLOBALS',
 179     '_SERVER',
 180     '_GET',
 181     '_POST',
 182     '_REQUEST',
 183     '_FILES',
 184     '_ENV',
 185     '_COOKIE',
 186     '_SESSION',
 187     'error_handler',
 188     'PMA_PHP_SELF',
 189     'variables_whitelist',
 190     'key'
 191 );
 192
 193 foreach (get_defined_vars() as $key => $value) {
 194     if (! in_array($key, $variables_whitelist)) {
 195         unset($$key);
 196     }
 197 }
 198 unset($key, $value, $variables_whitelist);
 199
 200
 201 /**
 202  * Subforms - some functions need to be called by form, cause of the limited URL
 203  * length, but if this functions inside another form you cannot just open a new
 204  * form - so phpMyAdmin uses 'arrays' inside this form
 205  *
 206  * <code>
 207  * <form ...>
 208  * ... main form elments ...
 209  * <input type="hidden" name="subform[action1][id]" value="1" />
 210  * ... other subform data ...
 211  * <input type="submit" name="usesubform[action1]" value="do action1" />
 212  * ... other subforms ...
 213  * <input type="hidden" name="subform[actionX][id]" value="X" />
 214  * ... other subform data ...
 215  * <input type="submit" name="usesubform[actionX]" value="do actionX" />
 216  * ... main form elments ...
 217  * <input type="submit" name="main_action" value="submit form" />
 218  * </form>
 219  * </code>
 220  *
 221  * so we now check if a subform is submitted
 222  */
 223 $__redirect = null;
 224 if (isset($_POST['usesubform'])) {
 225     // if a subform is present and should be used
 226     // the rest of the form is deprecated
 227     $subform_id = key($_POST['usesubform']);
 228     $subform    = $_POST['subform'][$subform_id];
 229     $_POST      = $subform;
 230     $_REQUEST   = $subform;
 231     /**
 232      * some subforms need another page than the main form, so we will just
 233      * include this page at the end of this script - we use $__redirect to
 234      * track this
 235      */
 236     if (isset($_POST['redirect'])
 237       && $_POST['redirect'] != basename($PMA_PHP_SELF)) {
 238         $__redirect = $_POST['redirect'];
 239         unset($_POST['redirect']);
 240     }
 241     unset($subform_id, $subform);
 242 } else {
 243     // Note: here we overwrite $_REQUEST so that it does not contain cookies,
 244     // because another application for the same domain could have set
 245     // a cookie (with a compatible path) that overrides a variable
 246     // we expect from GET or POST.
 247     // We'll refer to cookies explicitly with the $_COOKIE syntax.
 248     $_REQUEST = array_merge($_GET, $_POST);
 249 }
 250 // end check if a subform is submitted
 251
 252 // remove quotes added by php
 253 if (function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc()) {
 254     PMA_arrayWalkRecursive($_GET, 'stripslashes', true);
 255     PMA_arrayWalkRecursive($_POST, 'stripslashes', true);
 256     PMA_arrayWalkRecursive($_COOKIE, 'stripslashes', true);
 257     PMA_arrayWalkRecursive($_REQUEST, 'stripslashes', true);
 258 }
 259
 260 /**
 261  * clean cookies on upgrade
 262  * when changing something related to PMA cookies, increment the cookie version
 263  */
 264 $pma_cookie_version = 4;
 265 if (isset($_COOKIE)
 266  && (isset($_COOKIE['pmaCookieVer'])
 267   && $_COOKIE['pmaCookieVer'] < $pma_cookie_version)) {
 268     // delete all cookies
 269     foreach($_COOKIE as $cookie_name => $tmp) {
 270         PMA_removeCookie($cookie_name);
 271     }
 272     $_COOKIE = array();
 273     PMA_setCookie('pmaCookieVer', $pma_cookie_version);
 274 }
 275
 276 /**
 277  * include deprecated grab_globals only if required
 278  */
 279 if (empty($__redirect) && !defined('PMA_NO_VARIABLES_IMPORT')) {
 280     require './libraries/grab_globals.lib.php';
 281 }
 282
 283 /**
 284  * check timezone setting
 285  * this could produce an E_STRICT - but only once,
 286  * if not done here it will produce E_STRICT on every date/time function
 287  *
 288  * @todo need to decide how we should handle this (without @)
 289  */
 290 date_default_timezone_set(@date_default_timezone_get());
 291
 292 /**
 293  * include session handling after the globals, to prevent overwriting
 294  */
 295 require_once './libraries/session.inc.php';
 296
 297 /**
 298  * init some variables LABEL_variables_init
 299  */
 300
 301 /**
 302  * holds parameters to be passed to next page
 303  * @global array $GLOBALS['url_params']
 304  */
 305 $GLOBALS['url_params'] = array();
 306
 307 /**
 308  * the whitelist for $GLOBALS['goto']
 309  * @global array $goto_whitelist
 310  */
 311 $goto_whitelist = array(
 312     //'browse_foreigners.php',
 313     //'calendar.php',
 314     //'changelog.php',
 315     //'chk_rel.php',
 316     'db_create.php',
 317     'db_datadict.php',
 318     'db_sql.php',
 319     'db_export.php',
 320     'db_importdocsql.php',
 321     'db_qbe.php',
 322     'db_structure.php',
 323     'db_import.php',
 324     'db_operations.php',
 325     'db_printview.php',
 326     'db_search.php',
 327     //'Documentation.html',
 328     //'error.php',
 329     'export.php',
 330     'import.php',
 331     //'index.php',
 332     //'navigation.php',
 333     //'license.php',
 334     'main.php',
 335     'pdf_pages.php',
 336     'pdf_schema.php',
 337     //'phpinfo.php',
 338     'querywindow.php',
 339     //'readme.php',
 340     'server_binlog.php',
 341     'server_collations.php',
 342     'server_databases.php',
 343     'server_engines.php',
 344     'server_export.php',
 345     'server_import.php',
 346     'server_privileges.php',
 347     'server_processlist.php',
 348     'server_sql.php',
 349     'server_status.php',
 350     'server_variables.php',
 351     'sql.php',
 352     'tbl_addfield.php',
 353     'tbl_alter.php',
 354     'tbl_change.php',
 355     'tbl_create.php',
 356     'tbl_import.php',
 357     'tbl_indexes.php',
 358     'tbl_move_copy.php',
 359     'tbl_printview.php',
 360     'tbl_sql.php',
 361     'tbl_export.php',
 362     'tbl_operations.php',
 363     'tbl_structure.php',
 364     'tbl_relation.php',
 365     'tbl_replace.php',
 366     'tbl_row_action.php',
 367     'tbl_select.php',
 368     //'themes.php',
 369     'transformation_overview.php',
 370     'transformation_wrapper.php',
 371     'translators.html',
 372     'user_password.php',
 373 );
 374
 375 /**
 376  * check $__redirect against whitelist
 377  */
 378 if (! PMA_checkPageValidity($__redirect, $goto_whitelist)) {
 379     $__redirect = null;
 380 }
 381
 382 /**
 383  * holds page that should be displayed
 384  * @global string $GLOBALS['goto']
 385  */
 386 $GLOBALS['goto'] = '';
 387 // Security fix: disallow accessing serious server files via "?goto="
 388 if (PMA_checkPageValidity($_REQUEST['goto'], $goto_whitelist)) {
 389     $GLOBALS['goto'] = $_REQUEST['goto'];
 390     $GLOBALS['url_params']['goto'] = $_REQUEST['goto'];
 391 } else {
 392     unset($_REQUEST['goto'], $_GET['goto'], $_POST['goto'], $_COOKIE['goto']);
 393 }
 394
 395 /**
 396  * returning page
 397  * @global string $GLOBALS['back']
 398  */
 399 if (PMA_checkPageValidity($_REQUEST['back'], $goto_whitelist)) {
 400     $GLOBALS['back'] = $_REQUEST['back'];
 401 } else {
 402     unset($_REQUEST['back'], $_GET['back'], $_POST['back'], $_COOKIE['back']);
 403 }
 404
 405 /**
 406  * Check whether user supplied token is valid, if not remove any possibly
 407  * dangerous stuff from request.
 408  *
 409  * remember that some objects in the session with session_start and __wakeup()
 410  * could access this variables before we reach this point
 411  * f.e. PMA_Config: fontsize
 412  *
 413  * @todo variables should be handled by their respective owners (objects)
 414  * f.e. lang, server, convcharset, collation_connection in PMA_Config
 415  */
 416 if (! PMA_isValid($_REQUEST['token']) || $_SESSION[' PMA_token '] != $_REQUEST['token']) {
 417     /**
 418      *  List of parameters which are allowed from unsafe source
 419      */
 420     $allow_list = array(
 421         /* needed for direct access, see FAQ 1.34
 422          * also, server needed for cookie login screen (multi-server)
 423          */
 424         'server', 'db', 'table', 'target',
 425         /* Session ID */
 426         'phpMyAdmin',
 427         /* Cookie preferences */
 428         'pma_lang', 'pma_charset', 'pma_collation_connection',
 429         /* Possible login form */
 430         'pma_servername', 'pma_username', 'pma_password',
 431         /* rajk - for playing blobstreamable media */
 432         'media_type', 'custom_type', 'bs_reference',
 433         /* rajk - for changing BLOB repository file MIME type */
 434         'bs_db', 'bs_table', 'bs_ref', 'bs_new_mime_type'
 435     );
 436     /**
 437      * Require cleanup functions
 438      */
 439     require_once './libraries/cleanup.lib.php';
 440     /**
 441      * Do actual cleanup
 442      */
 443     PMA_remove_request_vars($allow_list);
 444
 445 }
 446
 447
 448 /**
 449  * @global string $GLOBALS['convcharset']
 450  * @see select_lang.lib.php
 451  */
 452 if (isset($_REQUEST['convcharset'])) {
 453     $GLOBALS['convcharset'] = strip_tags($_REQUEST['convcharset']);
 454 }
 455
 456 /**
 457  * current selected database
 458  * @global string $GLOBALS['db']
 459  */
 460 $GLOBALS['db'] = '';
 461 if (PMA_isValid($_REQUEST['db'])) {
 462     // can we strip tags from this?
 463     // only \ and / is not allowed in db names for MySQL
 464     $GLOBALS['db'] = $_REQUEST['db'];
 465     $GLOBALS['url_params']['db'] = $GLOBALS['db'];
 466 }
 467
 468 /**
 469  * current selected table
 470  * @global string $GLOBALS['table']
 471  */
 472 $GLOBALS['table'] = '';
 473 if (PMA_isValid($_REQUEST['table'])) {
 474     // can we strip tags from this?
 475     // only \ and / is not allowed in table names for MySQL
 476     $GLOBALS['table'] = $_REQUEST['table'];
 477     $GLOBALS['url_params']['table'] = $GLOBALS['table'];
 478 }
 479
 480 /**
 481  * SQL query to be executed
 482  * @global string $GLOBALS['sql_query']
 483  */
 484 $GLOBALS['sql_query'] = '';
 485 if (PMA_isValid($_REQUEST['sql_query'])) {
 486     $GLOBALS['sql_query'] = $_REQUEST['sql_query'];
 487 }
 488
 489 /**
 490  * avoid problems in phpmyadmin.css.php in some cases
 491  * @global string $js_frame
 492  */
 493 $_REQUEST['js_frame'] = PMA_ifSetOr($_REQUEST['js_frame'], '');
 494
 495 //$_REQUEST['set_theme'] // checked later in this file LABEL_theme_setup
 496 //$_REQUEST['server']; // checked later in this file
 497 //$_REQUEST['lang'];   // checked by LABEL_loading_language_file
 498
 499
 500 /**
 501  * holds name of JavaScript files to be included in HTML header
 502  * @global array $js_include
 503  */
 504 $GLOBALS['js_include'] = array();
 505
 506 /**
 507  * holds locale messages required by JavaScript function
 508  * @global array $js_messages
 509  */
 510 $GLOBALS['js_messages'] = array();
 511
 512 /**
 513  * JavaScript events that will be registered
 514  * @global array $js_events
 515  */
 516 $GLOBALS['js_events'] = array();
 517
 518 /**
 519  * footnotes to be displayed ot the page bottom
 520  * @global array $footnotes
 521  */
 522 $GLOBALS['footnotes'] = array();
 523
 524 /******************************************************************************/
 525 /* parsing configuration file                         LABEL_parsing_config_file      */
 526
 527 /**
 528  * We really need this one!
 529  */
 530 if (! function_exists('preg_replace')) {
 531     PMA_fatalError('strCantLoad', 'pcre');
 532 }
 533
 534 /**
 535  * @global PMA_Config $_SESSION['PMA_Config']
 536  * force reading of config file, because we removed sensitive values
 537  * in the previous iteration
 538  */
 539 $_SESSION['PMA_Config'] = new PMA_Config('./config.inc.php');
 540
 541 if (!defined('PMA_MINIMUM_COMMON')) {
 542     $_SESSION['PMA_Config']->checkPmaAbsoluteUri();
 543 }
 544
 545 /**
 546  * BC - enable backward compatibility
 547  * exports all configuration settings into $GLOBALS ($GLOBALS['cfg'])
 548  */
 549 $_SESSION['PMA_Config']->enableBc();
 550
 551
 552 /**
 553  * check HTTPS connection
 554  */
 555 if ($_SESSION['PMA_Config']->get('ForceSSL')
 556   && !$_SESSION['PMA_Config']->get('is_https')) {
 557     PMA_sendHeaderLocation(
 558         preg_replace('/^http/', 'https',
 559             $_SESSION['PMA_Config']->get('PmaAbsoluteUri'))
 560         . PMA_generate_common_url($_GET, 'text'));
 561     // delete the current session, otherwise we get problems (see bug #2397877)
 562     PMA_removeCookie($GLOBALS['session_name']);
 563     exit;
 564 }
 565
 566
 567 /******************************************************************************/
 568 /* loading language file                       LABEL_loading_language_file    */
 569
 570 /**
 571  * Added messages while developing:
 572  */
 573 if (file_exists('./lang/added_messages.php')) {
 574     include './lang/added_messages.php';
 575 }
 576
 577 /**
 578  * lang detection is done here
 579  */
 580 require_once './libraries/select_lang.lib.php';
 581
 582 /**
 583  * check for errors occurred while loading configuration
 584  * this check is done here after loading language files to present errors in locale
 585  */
 586 if ($_SESSION['PMA_Config']->error_config_file) {
 587     $error = $strConfigFileError
 588         . '<br /><br />'
 589         . ($_SESSION['PMA_Config']->getSource() == './config.inc.php' ?
 590         '<a href="show_config_errors.php"'
 591         .' target="_blank">' . $_SESSION['PMA_Config']->getSource() . '</a>'
 592         :
 593         '<a href="' . $_SESSION['PMA_Config']->getSource() . '"'
 594         .' target="_blank">' . $_SESSION['PMA_Config']->getSource() . '</a>');
 595     trigger_error($error, E_USER_ERROR);
 596 }
 597 if ($_SESSION['PMA_Config']->error_config_default_file) {
 598     $error = sprintf($strConfigDefaultFileError,
 599         $_SESSION['PMA_Config']->default_source);
 600     trigger_error($error, E_USER_ERROR);
 601 }
 602 if ($_SESSION['PMA_Config']->error_pma_uri) {
 603     trigger_error($strPmaUriError, E_USER_ERROR);
 604 }
 605
 606
 607 /******************************************************************************/
 608 /* setup servers                                       LABEL_setup_servers    */
 609
 610 /**
 611  * current server
 612  * @global integer $GLOBALS['server']
 613  */
 614 $GLOBALS['server'] = 0;
 615
 616 /**
 617  * Servers array fixups.
 618  * $default_server comes from PMA_Config::enableBc()
 619  * @todo merge into PMA_Config
 620  */
 621 // Do we have some server?
 622 if (!isset($cfg['Servers']) || count($cfg['Servers']) == 0) {
 623     // No server => create one with defaults
 624     $cfg['Servers'] = array(1 => $default_server);
 625 } else {
 626     // We have server(s) => apply default configuration
 627     $new_servers = array();
 628
 629     foreach ($cfg['Servers'] as $server_index => $each_server) {
 630
 631         // Detect wrong configuration
 632         if (!is_int($server_index) || $server_index < 1) {
 633             trigger_error(sprintf($strInvalidServerIndex, $server_index), E_USER_ERROR);
 634         }
 635
 636         $each_server = array_merge($default_server, $each_server);
 637
 638         // Don't use servers with no hostname
 639         if ($each_server['connect_type'] == 'tcp' && empty($each_server['host'])) {
 640             trigger_error(sprintf($strInvalidServerHostname, $server_index), E_USER_ERROR);
 641         }
 642
 643         // Final solution to bug #582890
 644         // If we are using a socket connection
 645         // and there is nothing in the verbose server name
 646         // or the host field, then generate a name for the server
 647         // in the form of "Server 2", localized of course!
 648         if ($each_server['connect_type'] == 'socket' && empty($each_server['host']) && empty($each_server['verbose'])) {
 649             $each_server['verbose'] = $GLOBALS['strServer'] . $server_index;
 650         }
 651
 652         $new_servers[$server_index] = $each_server;
 653     }
 654     $cfg['Servers'] = $new_servers;
 655     unset($new_servers, $server_index, $each_server);
 656 }
 657
 658 // Cleanup
 659 unset($default_server);
 660
 661
 662 /******************************************************************************/
 663 /* setup themes                                          LABEL_theme_setup    */
 664
 665 if (isset($_REQUEST['custom_color_reset'])) {
 666     unset($_SESSION['tmp_user_values']['custom_color']);
 667     unset($_SESSION['tmp_user_values']['custom_color_rgb']);
 668 } elseif (isset($_REQUEST['custom_color'])) {
 669     $_SESSION['tmp_user_values']['custom_color'] = $_REQUEST['custom_color'];
 670     $_SESSION['tmp_user_values']['custom_color_rgb'] = $_REQUEST['custom_color_rgb'];
 671 }
 672 /**
 673  * @global PMA_Theme_Manager $_SESSION['PMA_Theme_Manager']
 674  */
 675 if (! isset($_SESSION['PMA_Theme_Manager'])) {
 676     $_SESSION['PMA_Theme_Manager'] = new PMA_Theme_Manager;
 677 } else {
 678     /**
 679      * @todo move all __wakeup() functionality into session.inc.php
 680      */
 681     $_SESSION['PMA_Theme_Manager']->checkConfig();
 682 }
 683
 684 // for the theme per server feature
 685 if (isset($_REQUEST['server']) && !isset($_REQUEST['set_theme'])) {
 686     $GLOBALS['server'] = $_REQUEST['server'];
 687     $tmp = $_SESSION['PMA_Theme_Manager']->getThemeCookie();
 688     if (empty($tmp)) {
 689         $tmp = $_SESSION['PMA_Theme_Manager']->theme_default;
 690     }
 691     $_SESSION['PMA_Theme_Manager']->setActiveTheme($tmp);
 692     unset($tmp);
 693 }
 694 /**
 695  * @todo move into PMA_Theme_Manager::__wakeup()
 696  */
 697 if (isset($_REQUEST['set_theme'])) {
 698     // if user selected a theme
 699     $_SESSION['PMA_Theme_Manager']->setActiveTheme($_REQUEST['set_theme']);
 700 }
 701
 702 /**
 703  * the theme object
 704  * @global PMA_Theme $_SESSION['PMA_Theme']
 705  */
 706 $_SESSION['PMA_Theme'] = $_SESSION['PMA_Theme_Manager']->theme;
 707
 708 // BC
 709 /**
 710  * the active theme
 711  * @global string $GLOBALS['theme']
 712  */
 713 $GLOBALS['theme']           = $_SESSION['PMA_Theme']->getName();
 714 /**
 715  * the theme path
 716  * @global string $GLOBALS['pmaThemePath']
 717  */
 718 $GLOBALS['pmaThemePath']    = $_SESSION['PMA_Theme']->getPath();
 719 /**
 720  * the theme image path
 721  * @global string $GLOBALS['pmaThemeImage']
 722  */
 723 $GLOBALS['pmaThemeImage']   = $_SESSION['PMA_Theme']->getImgPath();
 724
 725 /**
 726  * load layout file if exists
 727  */
 728 if (@file_exists($_SESSION['PMA_Theme']->getLayoutFile())) {
 729     include $_SESSION['PMA_Theme']->getLayoutFile();
 730     /**
 731      * @todo remove if all themes are update use Navi instead of Left as frame name
 732      */
 733     if (! isset($GLOBALS['cfg']['NaviWidth'])
 734      && isset($GLOBALS['cfg']['LeftWidth'])) {
 735         $GLOBALS['cfg']['NaviWidth'] = $GLOBALS['cfg']['LeftWidth'];
 736     }
 737 }
 738
 739 if (! defined('PMA_MINIMUM_COMMON')) {
 740     /**
 741      * Character set conversion.
 742      */
 743     require_once './libraries/charset_conversion.lib.php';
 744
 745     /**
 746      * String handling
 747      */
 748     require_once './libraries/string.lib.php';
 749
 750     /**
 751      * Lookup server by name
 752      * by Arnold - Helder Hosting
 753      * (see FAQ 4.8)
 754      */
 755     if (! empty($_REQUEST['server']) && is_string($_REQUEST['server'])
 756      && ! is_numeric($_REQUEST['server'])) {
 757         foreach ($cfg['Servers'] as $i => $server) {
 758             if ($server['host'] == $_REQUEST['server']) {
 759                 $_REQUEST['server'] = $i;
 760                 break;
 761             }
 762         }
 763         if (is_string($_REQUEST['server'])) {
 764             unset($_REQUEST['server']);
 765         }
 766         unset($i);
 767     }
 768
 769     /**
 770      * If no server is selected, make sure that $cfg['Server'] is empty (so
 771      * that nothing will work), and skip server authentication.
 772      * We do NOT exit here, but continue on without logging into any server.
 773      * This way, the welcome page will still come up (with no server info) and
 774      * present a choice of servers in the case that there are multiple servers
 775      * and '$cfg['ServerDefault'] = 0' is set.
 776      */
 777
 778     if (isset($_REQUEST['server']) && (is_string($_REQUEST['server']) || is_numeric($_REQUEST['server'])) && ! empty($_REQUEST['server']) && ! empty($cfg['Servers'][$_REQUEST['server']])) {
 779         $GLOBALS['server'] = $_REQUEST['server'];
 780         $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
 781     } else {
 782         if (!empty($cfg['Servers'][$cfg['ServerDefault']])) {
 783             $GLOBALS['server'] = $cfg['ServerDefault'];
 784             $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
 785         } else {
 786             $GLOBALS['server'] = 0;
 787             $cfg['Server'] = array();
 788         }
 789     }
 790     $GLOBALS['url_params']['server'] = $GLOBALS['server'];
 791
 792     /**
 793      * Kanji encoding convert feature appended by Y.Kawada (2002/2/20)
 794      */
 795     if (function_exists('mb_convert_encoding')
 796      && strpos($lang, 'ja-') !== false) {
 797         require_once './libraries/kanji-encoding.lib.php';
 798         /**
 799          * enable multibyte string support
 800          */
 801         define('PMA_MULTIBYTE_ENCODING', 1);
 802     } // end if
 803
 804     /**
 805      * save some settings in cookies
 806      * @todo should be done in PMA_Config
 807      */
 808     PMA_setCookie('pma_lang', $GLOBALS['lang']);
 809     PMA_setCookie('pma_charset', $GLOBALS['convcharset']);
 810     PMA_setCookie('pma_collation_connection', $GLOBALS['collation_connection']);
 811
 812     $_SESSION['PMA_Theme_Manager']->setThemeCookie();
 813
 814     if (! empty($cfg['Server'])) {
 815
 816         /**
 817          * Loads the proper database interface for this server
 818          */
 819         require_once './libraries/database_interface.lib.php';
 820
 821         require_once './libraries/logging.lib.php';
 822
 823         // Gets the authentication library that fits the $cfg['Server'] settings
 824         // and run authentication
 825
 826         // to allow HTTP or http
 827         $cfg['Server']['auth_type'] = strtolower($cfg['Server']['auth_type']);
 828         if (! file_exists('./libraries/auth/' . $cfg['Server']['auth_type'] . '.auth.lib.php')) {
 829             PMA_fatalError($strInvalidAuthMethod . ' ' . $cfg['Server']['auth_type']);
 830         }
 831         /**
 832          * the required auth type plugin
 833          */
 834         require_once './libraries/auth/' . $cfg['Server']['auth_type'] . '.auth.lib.php';
 835
 836         if (!PMA_auth_check()) {
 837             PMA_auth();
 838         } else {
 839             PMA_auth_set_user();
 840         }
 841
 842         // Check IP-based Allow/Deny rules as soon as possible to reject the
 843         // user
 844         // Based on mod_access in Apache:
 845         // http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/aaa/mod_access.c?rev=1.37&content-type=text/vnd.viewcvs-markup
 846         // Look at: "static int check_dir_access(request_rec *r)"
 847         // Robbat2 - May 10, 2002
 848         if (isset($cfg['Server']['AllowDeny'])
 849           && isset($cfg['Server']['AllowDeny']['order'])) {
 850
 851             /**
 852              * ip based access library
 853              */
 854             require_once './libraries/ip_allow_deny.lib.php';
 855
 856             $allowDeny_forbidden         = false; // default
 857             if ($cfg['Server']['AllowDeny']['order'] == 'allow,deny') {
 858                 $allowDeny_forbidden     = true;
 859                 if (PMA_allowDeny('allow')) {
 860                     $allowDeny_forbidden = false;
 861                 }
 862                 if (PMA_allowDeny('deny')) {
 863                     $allowDeny_forbidden = true;
 864                 }
 865             } elseif ($cfg['Server']['AllowDeny']['order'] == 'deny,allow') {
 866                 if (PMA_allowDeny('deny')) {
 867                     $allowDeny_forbidden = true;
 868                 }
 869                 if (PMA_allowDeny('allow')) {
 870                     $allowDeny_forbidden = false;
 871                 }
 872             } elseif ($cfg['Server']['AllowDeny']['order'] == 'explicit') {
 873                 if (PMA_allowDeny('allow')
 874                   && !PMA_allowDeny('deny')) {
 875                     $allowDeny_forbidden = false;
 876                 } else {
 877                     $allowDeny_forbidden = true;
 878                 }
 879             } // end if ... elseif ... elseif
 880
 881             // Ejects the user if banished
 882             if ($allowDeny_forbidden) {
 883                 PMA_log_user($cfg['Server']['user'], 'allow-denied');
 884                 PMA_auth_fails();
 885             }
 886             unset($allowDeny_forbidden); //Clean up after you!
 887         } // end if
 888
 889         // is root allowed?
 890         if (!$cfg['Server']['AllowRoot'] && $cfg['Server']['user'] == 'root') {
 891             $allowDeny_forbidden = true;
 892             PMA_log_user($cfg['Server']['user'], 'root-denied');
 893             PMA_auth_fails();
 894             unset($allowDeny_forbidden); //Clean up after you!
 895         }
 896
 897         // is a login without password allowed?
 898         if (!$cfg['Server']['AllowNoPassword'] && $cfg['Server']['password'] == '') {
 899             $login_without_password_is_forbidden = true;
 900             PMA_log_user($cfg['Server']['user'], 'empty-denied');
 901             PMA_auth_fails();
 902             unset($login_without_password_is_forbidden); //Clean up after you!
 903         }
 904
 905         // Try to connect MySQL with the control user profile (will be used to
 906         // get the privileges list for the current user but the true user link
 907         // must be open after this one so it would be default one for all the
 908         // scripts)
 909         $controllink = false;
 910         if ($cfg['Server']['controluser'] != '') {
 911             $controllink = PMA_DBI_connect($cfg['Server']['controluser'],
 912                 $cfg['Server']['controlpass'], true);
 913         }
 914
 915         // Connects to the server (validates user's login)
 916         $userlink = PMA_DBI_connect($cfg['Server']['user'],
 917             $cfg['Server']['password'], false);
 918
 919         if (! $controllink) {
 920             $controllink = $userlink;
 921         }
 922
 923         /* Log success */
 924         PMA_log_user($cfg['Server']['user']);
 925
 926         /**
 927          * with phpMyAdmin 3 we support MySQL >=5
 928          * but only production releases:
 929          *  - > 5.0.15
 930          */
 931         if (PMA_MYSQL_INT_VERSION < 50015) {
 932             PMA_fatalError('strUpgrade', array('MySQL', '5.0.15'));
 933         }
 934
 935         /**
 936          * SQL Parser code
 937          */
 938         require_once './libraries/sqlparser.lib.php';
 939
 940         /**
 941          * SQL Validator interface code
 942          */
 943         require_once './libraries/sqlvalidator.lib.php';
 944
 945         /**
 946          * the PMA_List_Database class
 947          */
 948         require_once './libraries/PMA.php';
 949         $pma = new PMA;
 950         $pma->userlink = $userlink;
 951         $pma->controllink = $controllink;
 952
 953         /**
 954          * some resetting has to be done when switching servers
 955          */
 956         if (isset($_SESSION['tmp_user_values']['previous_server']) && $_SESSION['tmp_user_values']['previous_server'] != $GLOBALS['server']) {
 957             unset($_SESSION['tmp_user_values']['navi_limit_offset']);
 958         }
 959         $_SESSION['tmp_user_values']['previous_server'] = $GLOBALS['server'];
 960
 961     } // end server connecting
 962
 963     /**
 964      * check if profiling was requested and remember it
 965      * (note: when $cfg['ServerDefault'] = 0, constant is not defined)
 966      */
 967     if (isset($_REQUEST['profiling']) && PMA_profilingSupported()) {
 968         $_SESSION['profiling'] = true;
 969     } elseif (isset($_REQUEST['profiling_form'])) {
 970         // the checkbox was unchecked
 971         unset($_SESSION['profiling']);
 972     }
 973
 974     // rajk - library file for blobstreaming
 975     require_once './libraries/blobstreaming.lib.php';
 976
 977     // rajk - checks for blobstreaming plugins and databases that support
 978     // blobstreaming (by having the necessary tables for blobstreaming)
 979     if (checkBLOBStreamingPlugins()) {
 980         checkBLOBStreamableDatabases();
 981     }
 982 } // end if !defined('PMA_MINIMUM_COMMON')
 983
 984 // remove sensitive values from session
 985 $_SESSION['PMA_Config']->set('blowfish_secret', '');
 986 $_SESSION['PMA_Config']->set('Servers', '');
 987 $_SESSION['PMA_Config']->set('default_server', '');
 988
 989 /* Tell tracker that it can actually work */
 990 PMA_Tracker::enable();
 991
 992 if (!empty($__redirect) && in_array($__redirect, $goto_whitelist)) {
 993     /**
 994      * include subform target page
 995      */
 996     require $__redirect;
 997     exit();
 998 }
 999 ?>