libraries/common.inc.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * Misc stuff and REQUIRED by ALL the scripts.
   5  * MUST be included by every script
   6  *
   7  * Among other things, it contains the advanced authentication work.
   8  *
   9  * Order of sections for common.inc.php:
  10  *
  11  * LABEL_variables_init
  12  *  - initialize some variables always needed
  13  * LABEL_parsing_config_file
  14  *  - parsing of the configuration file
  15  * LABEL_loading_language_file
  16  *  - loading language file
  17  * LABEL_theme_setup
  18  *  - setting up themes
  19  *
  20  * - load of MySQL extension (if necessary)
  21  * - loading of an authentication library
  22  * - db connection
  23  * - authentication work
  24  *
  25  * @version $Id$
  26  */
  27
  28 /**
  29  * For now, avoid warnings of E_STRICT mode
  30  * (this must be done before function definitions)
  31  */
  32 if (defined('E_STRICT')) {
  33     $old_error_reporting = error_reporting(0);
  34     if ($old_error_reporting & E_STRICT) {
  35         error_reporting($old_error_reporting ^ E_STRICT);
  36     } else {
  37         error_reporting($old_error_reporting);
  38     }
  39     unset($old_error_reporting);
  40 }
  41
  42 // at this point PMA_PHP_INT_VERSION is not yet defined
  43 if (version_compare(phpversion(), '6', 'lt')) {
  44     /**
  45      * Avoid object cloning errors
  46      */
  47     @ini_set('zend.ze1_compatibility_mode', false);
  48
  49     /**
  50      * Avoid problems with magic_quotes_runtime
  51      */
  52     @ini_set('magic_quotes_runtime', false);
  53 }
  54
  55 /**
  56  * for verification in all procedural scripts under libraries
  57  */
  58 define('PHPMYADMIN', true);
  59
  60 /**
  61  * core functions
  62  */
  63 require_once './libraries/core.lib.php';
  64
  65 /**
  66  * Input sanitizing
  67  */
  68 require_once './libraries/sanitizing.lib.php';
  69
  70 /**
  71  * the PMA_Theme class
  72  */
  73 require_once './libraries/Theme.class.php';
  74
  75 /**
  76  * the PMA_Theme_Manager class
  77  */
  78 require_once './libraries/Theme_Manager.class.php';
  79
  80 /**
  81  * the PMA_Config class
  82  */
  83 require_once './libraries/Config.class.php';
  84
  85 /**
  86  * the PMA_Table class
  87  */
  88 require_once './libraries/Table.class.php';
  89
  90 if (!defined('PMA_MINIMUM_COMMON')) {
  91     /**
  92      * common functions
  93      */
  94     require_once './libraries/common.lib.php';
  95
  96     /**
  97      * Java script escaping.
  98      */
  99     require_once './libraries/js_escape.lib.php';
 100
 101     /**
 102      * Include URL/hidden inputs generating.
 103      */
 104     require_once './libraries/url_generating.lib.php';
 105 }
 106
 107 /******************************************************************************/
 108 /* start procedural code                       label_start_procedural         */
 109
 110 /**
 111  * protect against older PHP versions' bug about GLOBALS overwrite
 112  * (no need to localize this message :))
 113  * but what if script.php?GLOBALS[admin]=1&GLOBALS[_REQUEST]=1 ???
 114  */
 115 if (isset($_REQUEST['GLOBALS']) || isset($_FILES['GLOBALS'])
 116   || isset($_SERVER['GLOBALS']) || isset($_COOKIE['GLOBALS'])
 117   || isset($_ENV['GLOBALS'])) {
 118     die('GLOBALS overwrite attempt');
 119 }
 120
 121 /**
 122  * protect against possible exploits - there is no need to have so much variables
 123  */
 124 if (count($_REQUEST) > 1000) {
 125     die('possible exploit');
 126 }
 127
 128 /**
 129  * Check for numeric keys
 130  * (if register_globals is on, numeric key can be found in $GLOBALS)
 131  */
 132 foreach ($GLOBALS as $key => $dummy) {
 133     if (is_numeric($key)) {
 134         die('numeric key detected');
 135     }
 136 }
 137 unset($dummy);
 138
 139 /**
 140  * PATH_INFO could be compromised if set, so remove it from PHP_SELF
 141  * and provide a clean PHP_SELF here
 142  */
 143 $PMA_PHP_SELF = PMA_getenv('PHP_SELF');
 144 $_PATH_INFO = PMA_getenv('PATH_INFO');
 145 if (! empty($_PATH_INFO) && ! empty($PMA_PHP_SELF)) {
 146     $path_info_pos = strrpos($PMA_PHP_SELF, $_PATH_INFO);
 147     if ($path_info_pos + strlen($_PATH_INFO) === strlen($PMA_PHP_SELF)) {
 148         $PMA_PHP_SELF = substr($PMA_PHP_SELF, 0, $path_info_pos);
 149     }
 150 }
 151 $PMA_PHP_SELF = htmlspecialchars($PMA_PHP_SELF);
 152
 153
 154 /**
 155  * just to be sure there was no import (registering) before here
 156  * we empty the global space (but avoid unsetting $variables_list
 157  * and $key in the foreach(), we still need them!)
 158  */
 159 $variables_whitelist = array (
 160     'GLOBALS',
 161     '_SERVER',
 162     '_GET',
 163     '_POST',
 164     '_REQUEST',
 165     '_FILES',
 166     '_ENV',
 167     '_COOKIE',
 168     '_SESSION',
 169     'PMA_PHP_SELF',
 170     'variables_whitelist',
 171     'key'
 172 );
 173
 174 foreach (get_defined_vars() as $key => $value) {
 175     if (! in_array($key, $variables_whitelist)) {
 176         unset($$key);
 177     }
 178 }
 179 unset($key, $value, $variables_whitelist);
 180
 181
 182 /**
 183  * Subforms - some functions need to be called by form, cause of the limited URL
 184  * length, but if this functions inside another form you cannot just open a new
 185  * form - so phpMyAdmin uses 'arrays' inside this form
 186  *
 187  * <code>
 188  * <form ...>
 189  * ... main form elments ...
 190  * <input type="hidden" name="subform[action1][id]" value="1" />
 191  * ... other subform data ...
 192  * <input type="submit" name="usesubform[action1]" value="do action1" />
 193  * ... other subforms ...
 194  * <input type="hidden" name="subform[actionX][id]" value="X" />
 195  * ... other subform data ...
 196  * <input type="submit" name="usesubform[actionX]" value="do actionX" />
 197  * ... main form elments ...
 198  * <input type="submit" name="main_action" value="submit form" />
 199  * </form>
 200  * </code
 201  *
 202  * so we now check if a subform is submitted
 203  */
 204 $__redirect = null;
 205 if (isset($_POST['usesubform'])) {
 206     // if a subform is present and should be used
 207     // the rest of the form is deprecated
 208     $subform_id = key($_POST['usesubform']);
 209     $subform    = $_POST['subform'][$subform_id];
 210     $_POST      = $subform;
 211     $_REQUEST   = $subform;
 212     /**
 213      * some subforms need another page than the main form, so we will just
 214      * include this page at the end of this script - we use $__redirect to
 215      * track this
 216      */
 217     if (isset($_POST['redirect'])
 218       && $_POST['redirect'] != basename($PMA_PHP_SELF)) {
 219         $__redirect = $_POST['redirect'];
 220         unset($_POST['redirect']);
 221     }
 222     unset($subform_id, $subform);
 223 } else {
 224     // Note: here we overwrite $_REQUEST so that it does not contain cookies,
 225     // because another application for the same domain could have set
 226     // a cookie (with a compatible path) that overrides a variable
 227     // we expect from GET or POST.
 228     // We'll refer to cookies explicitly with the $_COOKIE syntax.
 229     $_REQUEST = array_merge($_GET, $_POST);
 230 }
 231 // end check if a subform is submitted
 232
 233 // remove quotes added by php
 234 // (get_magic_quotes_gpc() is deprecated in PHP 5.3, but compare with 5.2.99
 235 // to be able to test with 5.3.0-dev)
 236 if (function_exists('get_magic_quotes_gpc') && -1 == version_compare(PHP_VERSION, '5.2.99') && get_magic_quotes_gpc()) {
 237     PMA_arrayWalkRecursive($_GET, 'stripslashes', true);
 238     PMA_arrayWalkRecursive($_POST, 'stripslashes', true);
 239     PMA_arrayWalkRecursive($_COOKIE, 'stripslashes', true);
 240     PMA_arrayWalkRecursive($_REQUEST, 'stripslashes', true);
 241 }
 242
 243 /**
 244  * clean cookies on new install or upgrade
 245  * when changing something with increment the cookie version
 246  */
 247 $pma_cookie_version = 4;
 248 if (isset($_COOKIE)
 249  && (! isset($_COOKIE['pmaCookieVer'])
 250   || $_COOKIE['pmaCookieVer'] < $pma_cookie_version)) {
 251     // delete all cookies
 252     foreach($_COOKIE as $cookie_name => $tmp) {
 253         PMA_removeCookie($cookie_name);
 254     }
 255     $_COOKIE = array();
 256     PMA_setCookie('pmaCookieVer', $pma_cookie_version);
 257 }
 258
 259 /**
 260  * include deprecated grab_globals only if required
 261  */
 262 if (empty($__redirect) && !defined('PMA_NO_VARIABLES_IMPORT')) {
 263     require './libraries/grab_globals.lib.php';
 264 }
 265
 266 /**
 267  * include session handling after the globals, to prevent overwriting
 268  */
 269 require_once './libraries/session.inc.php';
 270
 271 /**
 272  * init some variables LABEL_variables_init
 273  */
 274
 275 /**
 276  * holds errors
 277  * @global array $GLOBALS['PMA_errors']
 278  */
 279 $GLOBALS['PMA_errors'] = array();
 280
 281 /**
 282  * holds parameters to be passed to next page
 283  * @global array $GLOBALS['url_params']
 284  */
 285 $GLOBALS['url_params'] = array();
 286
 287 /**
 288  * the whitelist for $GLOBALS['goto']
 289  * @global array $goto_whitelist
 290  */
 291 $goto_whitelist = array(
 292     //'browse_foreigners.php',
 293     //'calendar.php',
 294     //'changelog.php',
 295     //'chk_rel.php',
 296     'db_create.php',
 297     'db_datadict.php',
 298     'db_sql.php',
 299     'db_export.php',
 300     'db_importdocsql.php',
 301     'db_qbe.php',
 302     'db_structure.php',
 303     'db_import.php',
 304     'db_operations.php',
 305     'db_printview.php',
 306     'db_search.php',
 307     //'Documentation.html',
 308     //'error.php',
 309     'export.php',
 310     'import.php',
 311     //'index.php',
 312     //'navigation.php',
 313     //'license.php',
 314     'main.php',
 315     'pdf_pages.php',
 316     'pdf_schema.php',
 317     //'phpinfo.php',
 318     'querywindow.php',
 319     //'readme.php',
 320     'server_binlog.php',
 321     'server_collations.php',
 322     'server_databases.php',
 323     'server_engines.php',
 324     'server_export.php',
 325     'server_import.php',
 326     'server_privileges.php',
 327     'server_processlist.php',
 328     'server_sql.php',
 329     'server_status.php',
 330     'server_variables.php',
 331     'sql.php',
 332     'tbl_addfield.php',
 333     'tbl_alter.php',
 334     'tbl_change.php',
 335     'tbl_create.php',
 336     'tbl_import.php',
 337     'tbl_indexes.php',
 338     'tbl_move_copy.php',
 339     'tbl_printview.php',
 340     'tbl_sql.php',
 341     'tbl_export.php',
 342     'tbl_operations.php',
 343     'tbl_structure.php',
 344     'tbl_relation.php',
 345     'tbl_replace.php',
 346     'tbl_row_action.php',
 347     'tbl_select.php',
 348     //'themes.php',
 349     'transformation_overview.php',
 350     'transformation_wrapper.php',
 351     'translators.html',
 352     'user_password.php',
 353 );
 354
 355 /**
 356  * check $__redirect against whitelist
 357  */
 358 if (! PMA_checkPageValidity($__redirect, $goto_whitelist)) {
 359     $__redirect = null;
 360 }
 361
 362 /**
 363  * holds page that should be displayed
 364  * @global string $GLOBALS['goto']
 365  */
 366 $GLOBALS['goto'] = '';
 367 // Security fix: disallow accessing serious server files via "?goto="
 368 if (PMA_checkPageValidity($_REQUEST['goto'], $goto_whitelist)) {
 369     $GLOBALS['goto'] = $_REQUEST['goto'];
 370     $GLOBALS['url_params']['goto'] = $_REQUEST['goto'];
 371 } else {
 372     unset($_REQUEST['goto'], $_GET['goto'], $_POST['goto'], $_COOKIE['goto']);
 373 }
 374
 375 /**
 376  * returning page
 377  * @global string $GLOBALS['back']
 378  */
 379 if (PMA_checkPageValidity($_REQUEST['back'], $goto_whitelist)) {
 380     $GLOBALS['back'] = $_REQUEST['back'];
 381 } else {
 382     unset($_REQUEST['back'], $_GET['back'], $_POST['back'], $_COOKIE['back']);
 383 }
 384
 385 /**
 386  * Check whether user supplied token is valid, if not remove any possibly
 387  * dangerous stuff from request.
 388  *
 389  * remember that some objects in the session with session_start and __wakeup()
 390  * could access this variables before we reach this point
 391  * f.e. PMA_Config: fontsize
 392  *
 393  * @todo variables should be handled by their respective owners (objects)
 394  * f.e. lang, server, convcharset, collation_connection in PMA_Config
 395  */
 396 if (! PMA_isValid($_REQUEST['token']) || $_SESSION[' PMA_token '] != $_REQUEST['token']) {
 397     /**
 398      *  List of parameters which are allowed from unsafe source
 399      */
 400     $allow_list = array(
 401         /* needed for direct access, see FAQ 1.34
 402          * also, server needed for cookie login screen (multi-server)
 403          */
 404         'server', 'db', 'table', 'target',
 405         /* to change the language on login screen or main page */
 406         'lang',
 407         /* Session ID */
 408         'phpMyAdmin',
 409         /* Cookie preferences */
 410         'pma_lang', 'pma_charset', 'pma_collation_connection',
 411         /* Possible login form */
 412         'pma_servername', 'pma_username', 'pma_password',
 413     );
 414     /**
 415      * Require cleanup functions
 416      */
 417     require_once './libraries/cleanup.lib.php';
 418     /**
 419      * Do actual cleanup
 420      */
 421     PMA_remove_request_vars($allow_list);
 422
 423 }
 424
 425
 426 /**
 427  * @global string $convcharset
 428  * @see select_lang.lib.php
 429  */
 430 if (isset($_REQUEST['convcharset'])) {
 431     $convcharset = strip_tags($_REQUEST['convcharset']);
 432 }
 433
 434 /**
 435  * current selected database
 436  * @global string $GLOBALS['db']
 437  */
 438 $GLOBALS['db'] = '';
 439 if (PMA_isValid($_REQUEST['db'])) {
 440     // can we strip tags from this?
 441     // only \ and / is not allowed in db names for MySQL
 442     $GLOBALS['db'] = $_REQUEST['db'];
 443     $GLOBALS['url_params']['db'] = $GLOBALS['db'];
 444 }
 445
 446 /**
 447  * current selected table
 448  * @global string $GLOBALS['table']
 449  */
 450 $GLOBALS['table'] = '';
 451 if (PMA_isValid($_REQUEST['table'])) {
 452     // can we strip tags from this?
 453     // only \ and / is not allowed in table names for MySQL
 454     $GLOBALS['table'] = $_REQUEST['table'];
 455     $GLOBALS['url_params']['table'] = $GLOBALS['table'];
 456 }
 457
 458 /**
 459  * SQL query to be executed
 460  * @global string $GLOBALS['sql_query']
 461  */
 462 $GLOBALS['sql_query'] = '';
 463 if (PMA_isValid($_REQUEST['sql_query'])) {
 464     $GLOBALS['sql_query'] = $_REQUEST['sql_query'];
 465 }
 466
 467 /**
 468  * avoid problems in phpmyadmin.css.php in some cases
 469  * @global string $js_frame
 470  */
 471 $_REQUEST['js_frame'] = PMA_ifSetOr($_REQUEST['js_frame'], '');
 472
 473 //$_REQUEST['set_theme'] // checked later in this file LABEL_theme_setup
 474 //$_REQUEST['server']; // checked later in this file
 475 //$_REQUEST['lang'];   // checked by LABEL_loading_language_file
 476
 477
 478
 479 /******************************************************************************/
 480 /* parsing configuration file                         LABEL_parsing_config_file      */
 481
 482 /**
 483  * We really need this one!
 484  */
 485 if (! function_exists('preg_replace')) {
 486     PMA_fatalError('strCantLoad', 'pcre');
 487 }
 488
 489 /**
 490  * @global PMA_Config $_SESSION['PMA_Config']
 491  * force reading of config file, because we removed sensitive values
 492  * in the previous iteration
 493  */
 494 $_SESSION['PMA_Config'] = new PMA_Config('./config.inc.php');
 495
 496 if (!defined('PMA_MINIMUM_COMMON')) {
 497     $_SESSION['PMA_Config']->checkPmaAbsoluteUri();
 498 }
 499
 500 /**
 501  * BC - enable backward compatibility
 502  * exports all configuration settings into $GLOBALS ($GLOBALS['cfg'])
 503  */
 504 $_SESSION['PMA_Config']->enableBc();
 505
 506
 507 /**
 508  * check HTTPS connection
 509  */
 510 if ($_SESSION['PMA_Config']->get('ForceSSL')
 511   && !$_SESSION['PMA_Config']->get('is_https')) {
 512     PMA_sendHeaderLocation(
 513         preg_replace('/^http/', 'https',
 514             $_SESSION['PMA_Config']->get('PmaAbsoluteUri'))
 515         . PMA_generate_common_url($_GET));
 516     exit;
 517 }
 518
 519
 520 /******************************************************************************/
 521 /* loading language file                       LABEL_loading_language_file    */
 522
 523 /**
 524  * Added messages while developing:
 525  */
 526 if (file_exists('./lang/added_messages.php')) {
 527     include './lang/added_messages.php';
 528 }
 529
 530 /**
 531  * Includes the language file if it hasn't been included yet
 532  */
 533 require './libraries/language.lib.php';
 534
 535
 536 /**
 537  * check for errors occurred while loading configuration
 538  * this check is done here after loading language files to present errors in locale
 539  */
 540 if ($_SESSION['PMA_Config']->error_config_file) {
 541     $GLOBALS['PMA_errors'][] = $strConfigFileError
 542         . '<br /><br />'
 543         . ($_SESSION['PMA_Config']->getSource() == './config.inc.php' ?
 544         '<a href="show_config_errors.php"'
 545         .' target="_blank">' . $_SESSION['PMA_Config']->getSource() . '</a>'
 546         :
 547         '<a href="' . $_SESSION['PMA_Config']->getSource() . '"'
 548         .' target="_blank">' . $_SESSION['PMA_Config']->getSource() . '</a>');
 549 }
 550 if ($_SESSION['PMA_Config']->error_config_default_file) {
 551     $GLOBALS['PMA_errors'][] = sprintf($strConfigDefaultFileError,
 552         $_SESSION['PMA_Config']->default_source);
 553 }
 554 if ($_SESSION['PMA_Config']->error_pma_uri) {
 555     $GLOBALS['PMA_errors'][] = sprintf($strPmaUriError);
 556 }
 557
 558 /**
 559  * current server
 560  * @global integer $GLOBALS['server']
 561  */
 562 $GLOBALS['server'] = 0;
 563
 564 /**
 565  * Servers array fixups.
 566  * $default_server comes from PMA_Config::enableBc()
 567  * @todo merge into PMA_Config
 568  */
 569 // Do we have some server?
 570 if (!isset($cfg['Servers']) || count($cfg['Servers']) == 0) {
 571     // No server => create one with defaults
 572     $cfg['Servers'] = array(1 => $default_server);
 573 } else {
 574     // We have server(s) => apply default configuration
 575     $new_servers = array();
 576
 577     foreach ($cfg['Servers'] as $server_index => $each_server) {
 578
 579         // Detect wrong configuration
 580         if (!is_int($server_index) || $server_index < 1) {
 581             $GLOBALS['PMA_errors'][] = sprintf($strInvalidServerIndex, $server_index);
 582         }
 583
 584         $each_server = array_merge($default_server, $each_server);
 585
 586         // Don't use servers with no hostname
 587         if ($each_server['connect_type'] == 'tcp' && empty($each_server['host'])) {
 588             $GLOBALS['PMA_errors'][] = sprintf($strInvalidServerHostname, $server_index);
 589         }
 590
 591         // Final solution to bug #582890
 592         // If we are using a socket connection
 593         // and there is nothing in the verbose server name
 594         // or the host field, then generate a name for the server
 595         // in the form of "Server 2", localized of course!
 596         if ($each_server['connect_type'] == 'socket' && empty($each_server['host']) && empty($each_server['verbose'])) {
 597             $each_server['verbose'] = $GLOBALS['strServer'] . $server_index;
 598         }
 599
 600         $new_servers[$server_index] = $each_server;
 601     }
 602     $cfg['Servers'] = $new_servers;
 603     unset($new_servers, $server_index, $each_server);
 604 }
 605
 606 // Cleanup
 607 unset($default_server);
 608
 609
 610 /******************************************************************************/
 611 /* setup themes                                          LABEL_theme_setup    */
 612
 613 /**
 614  * @global PMA_Theme_Manager $_SESSION['PMA_Theme_Manager']
 615  */
 616 if (! isset($_SESSION['PMA_Theme_Manager'])) {
 617     $_SESSION['PMA_Theme_Manager'] = new PMA_Theme_Manager;
 618 } else {
 619     /**
 620      * @todo move all __wakeup() functionality into session.inc.php
 621      */
 622     $_SESSION['PMA_Theme_Manager']->checkConfig();
 623 }
 624
 625 // for the theme per server feature
 626 if (isset($_REQUEST['server']) && !isset($_REQUEST['set_theme'])) {
 627     $GLOBALS['server'] = $_REQUEST['server'];
 628     $tmp = $_SESSION['PMA_Theme_Manager']->getThemeCookie();
 629     if (empty($tmp)) {
 630         $tmp = $_SESSION['PMA_Theme_Manager']->theme_default;
 631     }
 632     $_SESSION['PMA_Theme_Manager']->setActiveTheme($tmp);
 633     unset($tmp);
 634 }
 635 /**
 636  * @todo move into PMA_Theme_Manager::__wakeup()
 637  */
 638 if (isset($_REQUEST['set_theme'])) {
 639     // if user selected a theme
 640     $_SESSION['PMA_Theme_Manager']->setActiveTheme($_REQUEST['set_theme']);
 641 }
 642
 643 /**
 644  * the theme object
 645  * @global PMA_Theme $_SESSION['PMA_Theme']
 646  */
 647 $_SESSION['PMA_Theme'] = $_SESSION['PMA_Theme_Manager']->theme;
 648
 649 // BC
 650 /**
 651  * the active theme
 652  * @global string $GLOBALS['theme']
 653  */
 654 $GLOBALS['theme']           = $_SESSION['PMA_Theme']->getName();
 655 /**
 656  * the theme path
 657  * @global string $GLOBALS['pmaThemePath']
 658  */
 659 $GLOBALS['pmaThemePath']    = $_SESSION['PMA_Theme']->getPath();
 660 /**
 661  * the theme image path
 662  * @global string $GLOBALS['pmaThemeImage']
 663  */
 664 $GLOBALS['pmaThemeImage']   = $_SESSION['PMA_Theme']->getImgPath();
 665
 666 /**
 667  * load layout file if exists
 668  */
 669 if (@file_exists($_SESSION['PMA_Theme']->getLayoutFile())) {
 670     include $_SESSION['PMA_Theme']->getLayoutFile();
 671     /**
 672      * @todo remove if all themes are update use Navi instead of Left as frame name
 673      */
 674     if (! isset($GLOBALS['cfg']['NaviWidth'])
 675      && isset($GLOBALS['cfg']['LeftWidth'])) {
 676         $GLOBALS['cfg']['NaviWidth'] = $GLOBALS['cfg']['LeftWidth'];
 677     }
 678 }
 679
 680 if (! defined('PMA_MINIMUM_COMMON')) {
 681     /**
 682      * Character set conversion.
 683      */
 684     require_once './libraries/charset_conversion.lib.php';
 685
 686     /**
 687      * String handling
 688      */
 689     require_once './libraries/string.lib.php';
 690
 691     /**
 692      * Lookup server by name
 693      * by Arnold - Helder Hosting
 694      * (see FAQ 4.8)
 695      */
 696     if (! empty($_REQUEST['server']) && is_string($_REQUEST['server'])
 697      && ! is_numeric($_REQUEST['server'])) {
 698         foreach ($cfg['Servers'] as $i => $server) {
 699             if ($server['host'] == $_REQUEST['server']) {
 700                 $_REQUEST['server'] = $i;
 701                 break;
 702             }
 703         }
 704         if (is_string($_REQUEST['server'])) {
 705             unset($_REQUEST['server']);
 706         }
 707         unset($i);
 708     }
 709
 710     /**
 711      * If no server is selected, make sure that $cfg['Server'] is empty (so
 712      * that nothing will work), and skip server authentication.
 713      * We do NOT exit here, but continue on without logging into any server.
 714      * This way, the welcome page will still come up (with no server info) and
 715      * present a choice of servers in the case that there are multiple servers
 716      * and '$cfg['ServerDefault'] = 0' is set.
 717      */
 718
 719     if (isset($_REQUEST['server']) && (is_string($_REQUEST['server']) || is_numeric($_REQUEST['server'])) && ! empty($_REQUEST['server']) && ! empty($cfg['Servers'][$_REQUEST['server']])) {
 720         $GLOBALS['server'] = $_REQUEST['server'];
 721         $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
 722     } else {
 723         if (!empty($cfg['Servers'][$cfg['ServerDefault']])) {
 724             $GLOBALS['server'] = $cfg['ServerDefault'];
 725             $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
 726         } else {
 727             $GLOBALS['server'] = 0;
 728             $cfg['Server'] = array();
 729         }
 730     }
 731     $GLOBALS['url_params']['server'] = $GLOBALS['server'];
 732
 733     if (! empty($cfg['Server'])) {
 734
 735         /**
 736          * Loads the proper database interface for this server
 737          */
 738         require_once './libraries/database_interface.lib.php';
 739
 740         // Gets the authentication library that fits the $cfg['Server'] settings
 741         // and run authentication
 742
 743         // to allow HTTP or http
 744         $cfg['Server']['auth_type'] = strtolower($cfg['Server']['auth_type']);
 745         if (! file_exists('./libraries/auth/' . $cfg['Server']['auth_type'] . '.auth.lib.php')) {
 746             PMA_fatalError($strInvalidAuthMethod . ' ' . $cfg['Server']['auth_type']);
 747         }
 748         /**
 749          * the required auth type plugin
 750          */
 751         require_once './libraries/auth/' . $cfg['Server']['auth_type'] . '.auth.lib.php';
 752
 753         if (!PMA_auth_check()) {
 754             PMA_auth();
 755         } else {
 756             PMA_auth_set_user();
 757         }
 758
 759         // Check IP-based Allow/Deny rules as soon as possible to reject the
 760         // user
 761         // Based on mod_access in Apache:
 762         // http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/aaa/mod_access.c?rev=1.37&content-type=text/vnd.viewcvs-markup
 763         // Look at: "static int check_dir_access(request_rec *r)"
 764         // Robbat2 - May 10, 2002
 765         if (isset($cfg['Server']['AllowDeny'])
 766           && isset($cfg['Server']['AllowDeny']['order'])) {
 767
 768             /**
 769              * ip based access library
 770              */
 771             require_once './libraries/ip_allow_deny.lib.php';
 772
 773             $allowDeny_forbidden         = false; // default
 774             if ($cfg['Server']['AllowDeny']['order'] == 'allow,deny') {
 775                 $allowDeny_forbidden     = true;
 776                 if (PMA_allowDeny('allow')) {
 777                     $allowDeny_forbidden = false;
 778                 }
 779                 if (PMA_allowDeny('deny')) {
 780                     $allowDeny_forbidden = true;
 781                 }
 782             } elseif ($cfg['Server']['AllowDeny']['order'] == 'deny,allow') {
 783                 if (PMA_allowDeny('deny')) {
 784                     $allowDeny_forbidden = true;
 785                 }
 786                 if (PMA_allowDeny('allow')) {
 787                     $allowDeny_forbidden = false;
 788                 }
 789             } elseif ($cfg['Server']['AllowDeny']['order'] == 'explicit') {
 790                 if (PMA_allowDeny('allow')
 791                   && !PMA_allowDeny('deny')) {
 792                     $allowDeny_forbidden = false;
 793                 } else {
 794                     $allowDeny_forbidden = true;
 795                 }
 796             } // end if ... elseif ... elseif
 797
 798             // Ejects the user if banished
 799             if ($allowDeny_forbidden) {
 800                PMA_auth_fails();
 801             }
 802             unset($allowDeny_forbidden); //Clean up after you!
 803         } // end if
 804
 805         // is root allowed?
 806         if (!$cfg['Server']['AllowRoot'] && $cfg['Server']['user'] == 'root') {
 807             $allowDeny_forbidden = true;
 808             PMA_auth_fails();
 809             unset($allowDeny_forbidden); //Clean up after you!
 810         }
 811
 812         $bkp_track_err = @ini_set('track_errors', 1);
 813
 814         // Try to connect MySQL with the control user profile (will be used to
 815         // get the privileges list for the current user but the true user link
 816         // must be open after this one so it would be default one for all the
 817         // scripts)
 818         $controllink = false;
 819         if ($cfg['Server']['controluser'] != '') {
 820             $controllink = PMA_DBI_connect($cfg['Server']['controluser'],
 821                 $cfg['Server']['controlpass'], true);
 822         }
 823         if (! $controllink) {
 824             $controllink = PMA_DBI_connect($cfg['Server']['user'],
 825                 $cfg['Server']['password'], true);
 826         } // end if ... else
 827
 828         // Pass #1 of DB-Config to read in master level DB-Config will go here
 829         // Robbat2 - May 11, 2002
 830
 831         // Connects to the server (validates user's login)
 832         $userlink = PMA_DBI_connect($cfg['Server']['user'],
 833             $cfg['Server']['password'], false);
 834
 835         // Pass #2 of DB-Config to read in user level DB-Config will go here
 836         // Robbat2 - May 11, 2002
 837
 838         @ini_set('track_errors', $bkp_track_err);
 839         unset($bkp_track_err);
 840
 841         /**
 842          * If we auto switched to utf-8 we need to reread messages here
 843          */
 844         if (defined('PMA_LANG_RELOAD')) {
 845             require './libraries/language.lib.php';
 846         }
 847
 848         /**
 849          * SQL Parser code
 850          */
 851         require_once './libraries/sqlparser.lib.php';
 852
 853         /**
 854          * SQL Validator interface code
 855          */
 856         require_once './libraries/sqlvalidator.lib.php';
 857
 858         /**
 859          * the PMA_List_Database class
 860          */
 861         require_once './libraries/List_Database.class.php';
 862         $PMA_List_Database = new PMA_List_Database($userlink, $controllink);
 863
 864         /**
 865          * some resetting has to be done when switching servers
 866          */
 867         if (isset($_SESSION['userconf']['previous_server']) && $_SESSION['userconf']['previous_server'] != $GLOBALS['server']) {
 868             unset($_SESSION['userconf']['navi_limit_offset']);
 869         }
 870         $_SESSION['userconf']['previous_server'] = $GLOBALS['server'];
 871
 872     } // end server connecting
 873
 874     /**
 875      * Kanji encoding convert feature appended by Y.Kawada (2002/2/20)
 876      */
 877     if (@function_exists('mb_convert_encoding')
 878         && strpos(' ' . $lang, 'ja-')
 879         && file_exists('./libraries/kanji-encoding.lib.php')) {
 880         require_once './libraries/kanji-encoding.lib.php';
 881         /**
 882          * enable multibyte string support
 883          */
 884         define('PMA_MULTIBYTE_ENCODING', 1);
 885     } // end if
 886
 887     /**
 888      * save some settings in cookies
 889      * @todo should be done in PMA_Config
 890      */
 891     PMA_setCookie('pma_lang', $GLOBALS['lang']);
 892     PMA_setCookie('pma_charset', $GLOBALS['convcharset']);
 893     PMA_setCookie('pma_collation_connection', $GLOBALS['collation_connection']);
 894
 895     $_SESSION['PMA_Theme_Manager']->setThemeCookie();
 896
 897     /**
 898      * check if profiling was requested and remember it
 899      * (note: when $cfg['ServerDefault'] = 0, constant is not defined)
 900      */
 901
 902     if (PMA_profilingSupported() && isset($_REQUEST['profiling'])) {
 903         $_SESSION['profiling'] = true;
 904     } elseif (isset($_REQUEST['profiling_form'])) {
 905         // the checkbox was unchecked
 906         unset($_SESSION['profiling']);
 907     }
 908
 909 } // end if !defined('PMA_MINIMUM_COMMON')
 910
 911 // remove sensitive values from session
 912 $_SESSION['PMA_Config']->set('blowfish_secret', '');
 913 $_SESSION['PMA_Config']->set('Servers', '');
 914 $_SESSION['PMA_Config']->set('default_server', '');
 915
 916 if (!empty($__redirect) && in_array($__redirect, $goto_whitelist)) {
 917     /**
 918      * include subform target page
 919      */
 920     require $__redirect;
 921     exit();
 922 }
 923 ?>