libraries/common.inc.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * Misc stuff and REQUIRED by ALL the scripts.
   5  * MUST be included by every script
   6  *
   7  * Among other things, it contains the advanced authentication work.
   8  *
   9  * Order of sections for common.inc.php:
  10  *
  11  * the authentication libraries must be before the connection to db
  12  *
  13  * ... so the required order is:
  14  *
  15  * LABEL_variables_init
  16  *  - initialize some variables always needed
  17  * LABEL_parsing_config_file
  18  *  - parsing of the configuration file
  19  * LABEL_loading_language_file
  20  *  - loading language file
  21  * LABEL_setup_servers
  22  *  - check and setup configured servers
  23  * LABEL_theme_setup
  24  *  - setting up themes
  25  *
  26  * - load of MySQL extension (if necessary)
  27  * - loading of an authentication library
  28  * - db connection
  29  * - authentication work
  30  *
  31  * @package phpMyAdmin
  32  */
  33
  34 /**
  35  * Minimum PHP version; can't call PMA_fatalError() which uses a
  36  * PHP 5 function, so cannot easily localize this message.
  37  */
  38 if (version_compare(PHP_VERSION, '5.2.0', 'lt')) {
  39     die('PHP 5.2+ is required');
  40 }
  41
  42 /**
  43   * Backward compatibility for PHP 5.2
  44   */
  45 if (!defined('E_DEPRECATED')) {
  46     define('E_DEPRECATED', 8192);
  47 }
  48
  49 /**
  50  * the error handler
  51  */
  52 require './libraries/Error_Handler.class.php';
  53
  54 /**
  55  * initialize the error handler
  56  */
  57 $GLOBALS['error_handler'] = new PMA_Error_Handler();
  58 $cfg['Error_Handler']['display'] = TRUE;
  59
  60 // at this point PMA_PHP_INT_VERSION is not yet defined
  61 if (version_compare(phpversion(), '6', 'lt')) {
  62     /**
  63      * Avoid object cloning errors
  64      */
  65     @ini_set('zend.ze1_compatibility_mode', false);
  66
  67     /**
  68      * Avoid problems with magic_quotes_runtime
  69      */
  70     @ini_set('magic_quotes_runtime', false);
  71 }
  72
  73 /**
  74  * for verification in all procedural scripts under libraries
  75  */
  76 define('PHPMYADMIN', true);
  77
  78 /**
  79  * core functions
  80  */
  81 require './libraries/core.lib.php';
  82
  83 /**
  84  * Input sanitizing
  85  */
  86 require './libraries/sanitizing.lib.php';
  87
  88 /**
  89  * the PMA_Theme class
  90  */
  91 require './libraries/Theme.class.php';
  92
  93 /**
  94  * the PMA_Theme_Manager class
  95  */
  96 require './libraries/Theme_Manager.class.php';
  97
  98 /**
  99  * the PMA_Config class
 100  */
 101 require './libraries/Config.class.php';
 102
 103 /**
 104  * the relation lib, tracker needs it
 105  */
 106 require './libraries/relation.lib.php';
 107
 108 /**
 109  * the PMA_Tracker class
 110  */
 111 require './libraries/Tracker.class.php';
 112
 113 /**
 114  * the PMA_Table class
 115  */
 116 require './libraries/Table.class.php';
 117
 118 if (!defined('PMA_MINIMUM_COMMON')) {
 119     /**
 120      * common functions
 121      */
 122     require_once './libraries/common.lib.php';
 123
 124     /**
 125      * Java script escaping.
 126      */
 127     require_once './libraries/js_escape.lib.php';
 128
 129     /**
 130      * Include URL/hidden inputs generating.
 131      */
 132     require_once './libraries/url_generating.lib.php';
 133 }
 134
 135 /******************************************************************************/
 136 /* start procedural code                       label_start_procedural         */
 137
 138 /**
 139  * protect against possible exploits - there is no need to have so much variables
 140  */
 141 if (count($_REQUEST) > 1000) {
 142     die('possible exploit');
 143 }
 144
 145 /**
 146  * Check for numeric keys
 147  * (if register_globals is on, numeric key can be found in $GLOBALS)
 148  */
 149 foreach ($GLOBALS as $key => $dummy) {
 150     if (is_numeric($key)) {
 151         die('numeric key detected');
 152     }
 153 }
 154 unset($dummy);
 155
 156 /**
 157  * PATH_INFO could be compromised if set, so remove it from PHP_SELF
 158  * and provide a clean PHP_SELF here
 159  */
 160 $PMA_PHP_SELF = PMA_getenv('PHP_SELF');
 161 $_PATH_INFO = PMA_getenv('PATH_INFO');
 162 if (! empty($_PATH_INFO) && ! empty($PMA_PHP_SELF)) {
 163     $path_info_pos = strrpos($PMA_PHP_SELF, $_PATH_INFO);
 164     if ($path_info_pos + strlen($_PATH_INFO) === strlen($PMA_PHP_SELF)) {
 165         $PMA_PHP_SELF = substr($PMA_PHP_SELF, 0, $path_info_pos);
 166     }
 167 }
 168 $PMA_PHP_SELF = htmlspecialchars($PMA_PHP_SELF);
 169
 170
 171 /**
 172  * just to be sure there was no import (registering) before here
 173  * we empty the global space (but avoid unsetting $variables_list
 174  * and $key in the foreach(), we still need them!)
 175  */
 176 $variables_whitelist = array (
 177     'GLOBALS',
 178     '_SERVER',
 179     '_GET',
 180     '_POST',
 181     '_REQUEST',
 182     '_FILES',
 183     '_ENV',
 184     '_COOKIE',
 185     '_SESSION',
 186     'error_handler',
 187     'PMA_PHP_SELF',
 188     'variables_whitelist',
 189     'key'
 190 );
 191
 192 foreach (get_defined_vars() as $key => $value) {
 193     if (! in_array($key, $variables_whitelist)) {
 194         unset($$key);
 195     }
 196 }
 197 unset($key, $value, $variables_whitelist);
 198
 199
 200 /**
 201  * Subforms - some functions need to be called by form, cause of the limited URL
 202  * length, but if this functions inside another form you cannot just open a new
 203  * form - so phpMyAdmin uses 'arrays' inside this form
 204  *
 205  * <code>
 206  * <form ...>
 207  * ... main form elments ...
 208  * <input type="hidden" name="subform[action1][id]" value="1" />
 209  * ... other subform data ...
 210  * <input type="submit" name="usesubform[action1]" value="do action1" />
 211  * ... other subforms ...
 212  * <input type="hidden" name="subform[actionX][id]" value="X" />
 213  * ... other subform data ...
 214  * <input type="submit" name="usesubform[actionX]" value="do actionX" />
 215  * ... main form elments ...
 216  * <input type="submit" name="main_action" value="submit form" />
 217  * </form>
 218  * </code>
 219  *
 220  * so we now check if a subform is submitted
 221  */
 222 $__redirect = null;
 223 if (isset($_POST['usesubform'])) {
 224     // if a subform is present and should be used
 225     // the rest of the form is deprecated
 226     $subform_id = key($_POST['usesubform']);
 227     $subform    = $_POST['subform'][$subform_id];
 228     $_POST      = $subform;
 229     $_REQUEST   = $subform;
 230     /**
 231      * some subforms need another page than the main form, so we will just
 232      * include this page at the end of this script - we use $__redirect to
 233      * track this
 234      */
 235     if (isset($_POST['redirect'])
 236       && $_POST['redirect'] != basename($PMA_PHP_SELF)) {
 237         $__redirect = $_POST['redirect'];
 238         unset($_POST['redirect']);
 239     }
 240     unset($subform_id, $subform);
 241 } else {
 242     // Note: here we overwrite $_REQUEST so that it does not contain cookies,
 243     // because another application for the same domain could have set
 244     // a cookie (with a compatible path) that overrides a variable
 245     // we expect from GET or POST.
 246     // We'll refer to cookies explicitly with the $_COOKIE syntax.
 247     $_REQUEST = array_merge($_GET, $_POST);
 248 }
 249 // end check if a subform is submitted
 250
 251 // remove quotes added by php
 252 if (function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc()) {
 253     PMA_arrayWalkRecursive($_GET, 'stripslashes', true);
 254     PMA_arrayWalkRecursive($_POST, 'stripslashes', true);
 255     PMA_arrayWalkRecursive($_COOKIE, 'stripslashes', true);
 256     PMA_arrayWalkRecursive($_REQUEST, 'stripslashes', true);
 257 }
 258
 259 /**
 260  * include deprecated grab_globals only if required
 261  */
 262 if (empty($__redirect) && !defined('PMA_NO_VARIABLES_IMPORT')) {
 263     require './libraries/grab_globals.lib.php';
 264 }
 265
 266 /**
 267  * check timezone setting
 268  * this could produce an E_STRICT - but only once,
 269  * if not done here it will produce E_STRICT on every date/time function
 270  *
 271  * @todo need to decide how we should handle this (without @)
 272  */
 273 date_default_timezone_set(@date_default_timezone_get());
 274
 275 /******************************************************************************/
 276 /* parsing configuration file                         LABEL_parsing_config_file      */
 277
 278 /**
 279  * We really need this one!
 280  */
 281 if (! function_exists('preg_replace')) {
 282     PMA_warnMissingExtension('pcre', true);
 283 }
 284
 285 /**
 286  * @global PMA_Config $GLOBALS['PMA_Config']
 287  * force reading of config file, because we removed sensitive values
 288  * in the previous iteration
 289  */
 290 $GLOBALS['PMA_Config'] = new PMA_Config(CONFIG_FILE);
 291
 292 if (!defined('PMA_MINIMUM_COMMON')) {
 293     $GLOBALS['PMA_Config']->checkPmaAbsoluteUri();
 294 }
 295
 296 /**
 297  * BC - enable backward compatibility
 298  * exports all configuration settings into $GLOBALS ($GLOBALS['cfg'])
 299  */
 300 $GLOBALS['PMA_Config']->enableBc();
 301
 302 /**
 303  * clean cookies on upgrade
 304  * when changing something related to PMA cookies, increment the cookie version
 305  */
 306 $pma_cookie_version = 4;
 307 if (isset($_COOKIE)
 308  && (isset($_COOKIE['pmaCookieVer'])
 309   && $_COOKIE['pmaCookieVer'] < $pma_cookie_version)) {
 310     // delete all cookies
 311     foreach($_COOKIE as $cookie_name => $tmp) {
 312         $GLOBALS['PMA_Config']->removeCookie($cookie_name);
 313     }
 314     $_COOKIE = array();
 315     $GLOBALS['PMA_Config']->setCookie('pmaCookieVer', $pma_cookie_version);
 316 }
 317
 318
 319 /**
 320  * check HTTPS connection
 321  */
 322 if ($GLOBALS['PMA_Config']->get('ForceSSL')
 323   && !$GLOBALS['PMA_Config']->get('is_https')) {
 324     PMA_sendHeaderLocation(
 325         preg_replace('/^http/', 'https',
 326             $GLOBALS['PMA_Config']->get('PmaAbsoluteUri'))
 327         . PMA_generate_common_url($_GET, 'text'));
 328     // delete the current session, otherwise we get problems (see bug #2397877)
 329     $GLOBALS['PMA_Config']->removeCookie($GLOBALS['session_name']);
 330     exit;
 331 }
 332
 333
 334 /**
 335  * include session handling after the globals, to prevent overwriting
 336  */
 337 require './libraries/session.inc.php';
 338
 339 /**
 340  * init some variables LABEL_variables_init
 341  */
 342
 343 /**
 344  * holds parameters to be passed to next page
 345  * @global array $GLOBALS['url_params']
 346  */
 347 $GLOBALS['url_params'] = array();
 348
 349 /**
 350  * the whitelist for $GLOBALS['goto']
 351  * @global array $goto_whitelist
 352  */
 353 $goto_whitelist = array(
 354     //'browse_foreigners.php',
 355     //'calendar.php',
 356     //'changelog.php',
 357     //'chk_rel.php',
 358     'db_create.php',
 359     'db_datadict.php',
 360     'db_sql.php',
 361     'db_export.php',
 362     'db_importdocsql.php',
 363     'db_qbe.php',
 364     'db_structure.php',
 365     'db_import.php',
 366     'db_operations.php',
 367     'db_printview.php',
 368     'db_search.php',
 369     //'Documentation.html',
 370     //'error.php',
 371     'export.php',
 372     'import.php',
 373     //'index.php',
 374     //'navigation.php',
 375     //'license.php',
 376     'main.php',
 377     'pdf_pages.php',
 378     'pdf_schema.php',
 379     //'phpinfo.php',
 380     'querywindow.php',
 381     //'readme.php',
 382     'server_binlog.php',
 383     'server_collations.php',
 384     'server_databases.php',
 385     'server_engines.php',
 386     'server_export.php',
 387     'server_import.php',
 388     'server_privileges.php',
 389     'server_processlist.php',
 390     'server_sql.php',
 391     'server_status.php',
 392     'server_variables.php',
 393     'sql.php',
 394     'tbl_addfield.php',
 395     'tbl_alter.php',
 396     'tbl_change.php',
 397     'tbl_create.php',
 398     'tbl_import.php',
 399     'tbl_indexes.php',
 400     'tbl_move_copy.php',
 401     'tbl_printview.php',
 402     'tbl_sql.php',
 403     'tbl_export.php',
 404     'tbl_operations.php',
 405     'tbl_structure.php',
 406     'tbl_relation.php',
 407     'tbl_replace.php',
 408     'tbl_row_action.php',
 409     'tbl_select.php',
 410     //'themes.php',
 411     'transformation_overview.php',
 412     'transformation_wrapper.php',
 413     'translators.html',
 414     'user_password.php',
 415 );
 416
 417 /**
 418  * check $__redirect against whitelist
 419  */
 420 if (! PMA_checkPageValidity($__redirect, $goto_whitelist)) {
 421     $__redirect = null;
 422 }
 423
 424 /**
 425  * holds page that should be displayed
 426  * @global string $GLOBALS['goto']
 427  */
 428 $GLOBALS['goto'] = '';
 429 // Security fix: disallow accessing serious server files via "?goto="
 430 if (PMA_checkPageValidity($_REQUEST['goto'], $goto_whitelist)) {
 431     $GLOBALS['goto'] = $_REQUEST['goto'];
 432     $GLOBALS['url_params']['goto'] = $_REQUEST['goto'];
 433 } else {
 434     unset($_REQUEST['goto'], $_GET['goto'], $_POST['goto'], $_COOKIE['goto']);
 435 }
 436
 437 /**
 438  * returning page
 439  * @global string $GLOBALS['back']
 440  */
 441 if (PMA_checkPageValidity($_REQUEST['back'], $goto_whitelist)) {
 442     $GLOBALS['back'] = $_REQUEST['back'];
 443 } else {
 444     unset($_REQUEST['back'], $_GET['back'], $_POST['back'], $_COOKIE['back']);
 445 }
 446
 447 /**
 448  * Check whether user supplied token is valid, if not remove any possibly
 449  * dangerous stuff from request.
 450  *
 451  * remember that some objects in the session with session_start and __wakeup()
 452  * could access this variables before we reach this point
 453  * f.e. PMA_Config: fontsize
 454  *
 455  * @todo variables should be handled by their respective owners (objects)
 456  * f.e. lang, server, collation_connection in PMA_Config
 457  */
 458 if (! PMA_isValid($_REQUEST['token']) || $_SESSION[' PMA_token '] != $_REQUEST['token']) {
 459     /**
 460      *  List of parameters which are allowed from unsafe source
 461      */
 462     $allow_list = array(
 463         /* needed for direct access, see FAQ 1.34
 464          * also, server needed for cookie login screen (multi-server)
 465          */
 466         'server', 'db', 'table', 'target',
 467         /* Session ID */
 468         'phpMyAdmin',
 469         /* Cookie preferences */
 470         'pma_lang', 'pma_collation_connection',
 471         /* Possible login form */
 472         'pma_servername', 'pma_username', 'pma_password',
 473         /* for playing blobstreamable media */
 474         'media_type', 'custom_type', 'bs_reference',
 475         /* for changing BLOB repository file MIME type */
 476         'bs_db', 'bs_table', 'bs_ref', 'bs_new_mime_type'
 477     );
 478     /**
 479      * Require cleanup functions
 480      */
 481     require './libraries/cleanup.lib.php';
 482     /**
 483      * Do actual cleanup
 484      */
 485     PMA_remove_request_vars($allow_list);
 486
 487 }
 488
 489
 490 /**
 491  * current selected database
 492  * @global string $GLOBALS['db']
 493  */
 494 $GLOBALS['db'] = '';
 495 if (PMA_isValid($_REQUEST['db'])) {
 496     // can we strip tags from this?
 497     // only \ and / is not allowed in db names for MySQL
 498     $GLOBALS['db'] = $_REQUEST['db'];
 499     $GLOBALS['url_params']['db'] = $GLOBALS['db'];
 500 }
 501
 502 /**
 503  * current selected table
 504  * @global string $GLOBALS['table']
 505  */
 506 $GLOBALS['table'] = '';
 507 if (PMA_isValid($_REQUEST['table'])) {
 508     // can we strip tags from this?
 509     // only \ and / is not allowed in table names for MySQL
 510     $GLOBALS['table'] = $_REQUEST['table'];
 511     $GLOBALS['url_params']['table'] = $GLOBALS['table'];
 512 }
 513
 514 /**
 515  * SQL query to be executed
 516  * @global string $GLOBALS['sql_query']
 517  */
 518 $GLOBALS['sql_query'] = '';
 519 if (PMA_isValid($_REQUEST['sql_query'])) {
 520     $GLOBALS['sql_query'] = $_REQUEST['sql_query'];
 521 }
 522
 523 /**
 524  * avoid problems in phpmyadmin.css.php in some cases
 525  * @global string $js_frame
 526  */
 527 $_REQUEST['js_frame'] = PMA_ifSetOr($_REQUEST['js_frame'], '');
 528
 529 //$_REQUEST['set_theme'] // checked later in this file LABEL_theme_setup
 530 //$_REQUEST['server']; // checked later in this file
 531 //$_REQUEST['lang'];   // checked by LABEL_loading_language_file
 532
 533
 534 /**
 535  * holds name of JavaScript files to be included in HTML header
 536  * @global array $js_include
 537  */
 538 $GLOBALS['js_include'] = array();
 539 $GLOBALS['js_include'][] = 'jquery/jquery-1.4.2.js';
 540 $GLOBALS['js_include'][] = 'update-location.js';
 541
 542 /**
 543  * JavaScript events that will be registered
 544  * @global array $js_events
 545  */
 546 $GLOBALS['js_events'] = array();
 547
 548 /**
 549  * footnotes to be displayed ot the page bottom
 550  * @global array $footnotes
 551  */
 552 $GLOBALS['footnotes'] = array();
 553
 554 /******************************************************************************/
 555 /* loading language file                       LABEL_loading_language_file    */
 556
 557 /**
 558  * lang detection is done here
 559  */
 560 require './libraries/select_lang.lib.php';
 561
 562 /**
 563  * check for errors occurred while loading configuration
 564  * this check is done here after loading language files to present errors in locale
 565  */
 566 if ($GLOBALS['PMA_Config']->error_config_file) {
 567     $error = __('phpMyAdmin was unable to read your configuration file!<br />This might happen if PHP finds a parse error in it or PHP cannot find the file.<br />Please call the configuration file directly using the link below and read the PHP error message(s) that you receive. In most cases a quote or a semicolon is missing somewhere.<br />If you receive a blank page, everything is fine.')
 568         . '<br /><br />'
 569         . ($GLOBALS['PMA_Config']->getSource() == CONFIG_FILE ?
 570         '<a href="show_config_errors.php"'
 571         .' target="_blank">' . $GLOBALS['PMA_Config']->getSource() . '</a>'
 572         :
 573         '<a href="' . $GLOBALS['PMA_Config']->getSource() . '"'
 574         .' target="_blank">' . $GLOBALS['PMA_Config']->getSource() . '</a>');
 575     trigger_error($error, E_USER_ERROR);
 576 }
 577 if ($GLOBALS['PMA_Config']->error_config_default_file) {
 578     $error = sprintf(__('Could not load default configuration from: %1$s'),
 579         $GLOBALS['PMA_Config']->default_source);
 580     trigger_error($error, E_USER_ERROR);
 581 }
 582 if ($GLOBALS['PMA_Config']->error_pma_uri) {
 583     trigger_error(__('The <tt>$cfg[\'PmaAbsoluteUri\']</tt> directive MUST be set in your configuration file!'), E_USER_ERROR);
 584 }
 585
 586
 587 /******************************************************************************/
 588 /* setup servers                                       LABEL_setup_servers    */
 589
 590 /**
 591  * current server
 592  * @global integer $GLOBALS['server']
 593  */
 594 $GLOBALS['server'] = 0;
 595
 596 /**
 597  * Servers array fixups.
 598  * $default_server comes from PMA_Config::enableBc()
 599  * @todo merge into PMA_Config
 600  */
 601 // Do we have some server?
 602 if (!isset($cfg['Servers']) || count($cfg['Servers']) == 0) {
 603     // No server => create one with defaults
 604     $cfg['Servers'] = array(1 => $default_server);
 605 } else {
 606     // We have server(s) => apply default configuration
 607     $new_servers = array();
 608
 609     foreach ($cfg['Servers'] as $server_index => $each_server) {
 610
 611         // Detect wrong configuration
 612         if (!is_int($server_index) || $server_index < 1) {
 613             trigger_error(sprintf(__('Invalid server index: %s'), $server_index), E_USER_ERROR);
 614         }
 615
 616         $each_server = array_merge($default_server, $each_server);
 617
 618         // Don't use servers with no hostname
 619         if ($each_server['connect_type'] == 'tcp' && empty($each_server['host'])) {
 620             trigger_error(sprintf(__('Invalid hostname for server %1$s. Please review your configuration.'), $server_index), E_USER_ERROR);
 621         }
 622
 623         // Final solution to bug #582890
 624         // If we are using a socket connection
 625         // and there is nothing in the verbose server name
 626         // or the host field, then generate a name for the server
 627         // in the form of "Server 2", localized of course!
 628         if ($each_server['connect_type'] == 'socket' && empty($each_server['host']) && empty($each_server['verbose'])) {
 629             $each_server['verbose'] = __('Server') . $server_index;
 630         }
 631
 632         $new_servers[$server_index] = $each_server;
 633     }
 634     $cfg['Servers'] = $new_servers;
 635     unset($new_servers, $server_index, $each_server);
 636 }
 637
 638 // Cleanup
 639 unset($default_server);
 640
 641
 642 /******************************************************************************/
 643 /* setup themes                                          LABEL_theme_setup    */
 644
 645 if (isset($_REQUEST['custom_color_reset'])) {
 646     unset($_SESSION['tmp_user_values']['custom_color']);
 647 } elseif (isset($_REQUEST['custom_color'])) {
 648     $_SESSION['tmp_user_values']['custom_color'] = $_REQUEST['custom_color'];
 649 }
 650 /**
 651  * @global PMA_Theme_Manager $_SESSION['PMA_Theme_Manager']
 652  */
 653 if (! isset($_SESSION['PMA_Theme_Manager'])) {
 654     $_SESSION['PMA_Theme_Manager'] = new PMA_Theme_Manager;
 655 } else {
 656     /**
 657      * @todo move all __wakeup() functionality into session.inc.php
 658      */
 659     $_SESSION['PMA_Theme_Manager']->checkConfig();
 660 }
 661
 662 // for the theme per server feature
 663 if (isset($_REQUEST['server']) && !isset($_REQUEST['set_theme'])) {
 664     $GLOBALS['server'] = $_REQUEST['server'];
 665     $tmp = $_SESSION['PMA_Theme_Manager']->getThemeCookie();
 666     if (empty($tmp)) {
 667         $tmp = $_SESSION['PMA_Theme_Manager']->theme_default;
 668     }
 669     $_SESSION['PMA_Theme_Manager']->setActiveTheme($tmp);
 670     unset($tmp);
 671 }
 672 /**
 673  * @todo move into PMA_Theme_Manager::__wakeup()
 674  */
 675 if (isset($_REQUEST['set_theme'])) {
 676     // if user selected a theme
 677     $_SESSION['PMA_Theme_Manager']->setActiveTheme($_REQUEST['set_theme']);
 678 }
 679
 680 /**
 681  * the theme object
 682  * @global PMA_Theme $_SESSION['PMA_Theme']
 683  */
 684 $_SESSION['PMA_Theme'] = $_SESSION['PMA_Theme_Manager']->theme;
 685
 686 // BC
 687 /**
 688  * the active theme
 689  * @global string $GLOBALS['theme']
 690  */
 691 $GLOBALS['theme']           = $_SESSION['PMA_Theme']->getName();
 692 /**
 693  * the theme path
 694  * @global string $GLOBALS['pmaThemePath']
 695  */
 696 $GLOBALS['pmaThemePath']    = $_SESSION['PMA_Theme']->getPath();
 697 /**
 698  * the theme image path
 699  * @global string $GLOBALS['pmaThemeImage']
 700  */
 701 $GLOBALS['pmaThemeImage']   = $_SESSION['PMA_Theme']->getImgPath();
 702
 703 /**
 704  * load layout file if exists
 705  */
 706 if (@file_exists($_SESSION['PMA_Theme']->getLayoutFile())) {
 707     include $_SESSION['PMA_Theme']->getLayoutFile();
 708     /**
 709      * @todo remove if all themes are update use Navi instead of Left as frame name
 710      */
 711     if (! isset($GLOBALS['cfg']['NaviWidth'])
 712      && isset($GLOBALS['cfg']['LeftWidth'])) {
 713         $GLOBALS['cfg']['NaviWidth'] = $GLOBALS['cfg']['LeftWidth'];
 714     }
 715 }
 716
 717 if (! defined('PMA_MINIMUM_COMMON')) {
 718     /**
 719      * Character set conversion.
 720      */
 721     require_once './libraries/charset_conversion.lib.php';
 722
 723     /**
 724      * String handling
 725      */
 726     require_once './libraries/string.lib.php';
 727
 728     /**
 729      * Lookup server by name
 730      * by Arnold - Helder Hosting
 731      * (see FAQ 4.8)
 732      */
 733     if (! empty($_REQUEST['server']) && is_string($_REQUEST['server'])
 734      && ! is_numeric($_REQUEST['server'])) {
 735         foreach ($cfg['Servers'] as $i => $server) {
 736             if ($server['host'] == $_REQUEST['server']) {
 737                 $_REQUEST['server'] = $i;
 738                 break;
 739             }
 740         }
 741         if (is_string($_REQUEST['server'])) {
 742             unset($_REQUEST['server']);
 743         }
 744         unset($i);
 745     }
 746
 747     /**
 748      * If no server is selected, make sure that $cfg['Server'] is empty (so
 749      * that nothing will work), and skip server authentication.
 750      * We do NOT exit here, but continue on without logging into any server.
 751      * This way, the welcome page will still come up (with no server info) and
 752      * present a choice of servers in the case that there are multiple servers
 753      * and '$cfg['ServerDefault'] = 0' is set.
 754      */
 755
 756     if (isset($_REQUEST['server']) && (is_string($_REQUEST['server']) || is_numeric($_REQUEST['server'])) && ! empty($_REQUEST['server']) && ! empty($cfg['Servers'][$_REQUEST['server']])) {
 757         $GLOBALS['server'] = $_REQUEST['server'];
 758         $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
 759     } else {
 760         if (!empty($cfg['Servers'][$cfg['ServerDefault']])) {
 761             $GLOBALS['server'] = $cfg['ServerDefault'];
 762             $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
 763         } else {
 764             $GLOBALS['server'] = 0;
 765             $cfg['Server'] = array();
 766         }
 767     }
 768     $GLOBALS['url_params']['server'] = $GLOBALS['server'];
 769
 770     /**
 771      * Kanji encoding convert feature appended by Y.Kawada (2002/2/20)
 772      */
 773     if (function_exists('mb_convert_encoding')
 774      && $lang == 'ja') {
 775         require_once './libraries/kanji-encoding.lib.php';
 776         /**
 777          * enable multibyte string support
 778          */
 779         define('PMA_MULTIBYTE_ENCODING', 1);
 780     } // end if
 781
 782     /**
 783      * save some settings in cookies
 784      * @todo should be done in PMA_Config
 785      */
 786     $GLOBALS['PMA_Config']->setCookie('pma_lang', $GLOBALS['lang']);
 787     $GLOBALS['PMA_Config']->setCookie('pma_collation_connection', $GLOBALS['collation_connection']);
 788
 789     $_SESSION['PMA_Theme_Manager']->setThemeCookie();
 790
 791     if (! empty($cfg['Server'])) {
 792
 793         /**
 794          * Loads the proper database interface for this server
 795          */
 796         require_once './libraries/database_interface.lib.php';
 797
 798         require_once './libraries/logging.lib.php';
 799
 800        // Gets the authentication library that fits the $cfg['Server'] settings
 801         // and run authentication
 802
 803         // to allow HTTP or http
 804         $cfg['Server']['auth_type'] = strtolower($cfg['Server']['auth_type']);
 805         if (! file_exists('./libraries/auth/' . $cfg['Server']['auth_type'] . '.auth.lib.php')) {
 806             PMA_fatalError(__('Invalid authentication method set in configuration:') . ' ' . $cfg['Server']['auth_type']);
 807         }
 808         /**
 809          * the required auth type plugin
 810          */
 811         require_once './libraries/auth/' . $cfg['Server']['auth_type'] . '.auth.lib.php';
 812         if (!PMA_auth_check()) {
 813             PMA_auth();
 814         } else {
 815             PMA_auth_set_user();
 816         }
 817
 818          // Check IP-based Allow/Deny rules as soon as possible to reject the
 819         // user
 820         // Based on mod_access in Apache:
 821         // http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/aaa/mod_access.c?rev=1.37&content-type=text/vnd.viewcvs-markup
 822         // Look at: "static int check_dir_access(request_rec *r)"
 823         // Robbat2 - May 10, 2002
 824         if (isset($cfg['Server']['AllowDeny'])
 825           && isset($cfg['Server']['AllowDeny']['order'])) {
 826
 827             /**
 828              * ip based access library
 829              */
 830             require_once './libraries/ip_allow_deny.lib.php';
 831
 832             $allowDeny_forbidden         = false; // default
 833             if ($cfg['Server']['AllowDeny']['order'] == 'allow,deny') {
 834                 $allowDeny_forbidden     = true;
 835                 if (PMA_allowDeny('allow')) {
 836                     $allowDeny_forbidden = false;
 837                 }
 838                 if (PMA_allowDeny('deny')) {
 839                     $allowDeny_forbidden = true;
 840                 }
 841             } elseif ($cfg['Server']['AllowDeny']['order'] == 'deny,allow') {
 842                 if (PMA_allowDeny('deny')) {
 843                     $allowDeny_forbidden = true;
 844                 }
 845                 if (PMA_allowDeny('allow')) {
 846                     $allowDeny_forbidden = false;
 847                 }
 848             } elseif ($cfg['Server']['AllowDeny']['order'] == 'explicit') {
 849                 if (PMA_allowDeny('allow')
 850                   && !PMA_allowDeny('deny')) {
 851                     $allowDeny_forbidden = false;
 852                 } else {
 853                     $allowDeny_forbidden = true;
 854                 }
 855             } // end if ... elseif ... elseif
 856
 857             // Ejects the user if banished
 858             if ($allowDeny_forbidden) {
 859                 PMA_log_user($cfg['Server']['user'], 'allow-denied');
 860                 PMA_auth_fails();
 861             }
 862             unset($allowDeny_forbidden); //Clean up after you!
 863         } // end if
 864
 865         // is root allowed?
 866         if (!$cfg['Server']['AllowRoot'] && $cfg['Server']['user'] == 'root') {
 867             $allowDeny_forbidden = true;
 868             PMA_log_user($cfg['Server']['user'], 'root-denied');
 869             PMA_auth_fails();
 870             unset($allowDeny_forbidden); //Clean up after you!
 871         }
 872
 873         // is a login without password allowed?
 874         if (!$cfg['Server']['AllowNoPassword'] && $cfg['Server']['password'] == '') {
 875             $login_without_password_is_forbidden = true;
 876             PMA_log_user($cfg['Server']['user'], 'empty-denied');
 877             PMA_auth_fails();
 878             unset($login_without_password_is_forbidden); //Clean up after you!
 879         }
 880
 881         // Try to connect MySQL with the control user profile (will be used to
 882         // get the privileges list for the current user but the true user link
 883         // must be open after this one so it would be default one for all the
 884         // scripts)
 885         $controllink = false;
 886         if ($cfg['Server']['controluser'] != '') {
 887             $controllink = PMA_DBI_connect($cfg['Server']['controluser'],
 888                 $cfg['Server']['controlpass'], true);
 889         }
 890
 891         // Connects to the server (validates user's login)
 892         $userlink = PMA_DBI_connect($cfg['Server']['user'],
 893             $cfg['Server']['password'], false);
 894
 895         if (! $controllink) {
 896             $controllink = $userlink;
 897         }
 898
 899         /* Log success */
 900         PMA_log_user($cfg['Server']['user']);
 901
 902         /**
 903          * with phpMyAdmin 3 we support MySQL >=5
 904          * but only production releases:
 905          *  - > 5.0.15
 906          */
 907         if (PMA_MYSQL_INT_VERSION < 50015) {
 908             PMA_fatalError(__('You should upgrade to %s %s or later.'), array('MySQL', '5.0.15'));
 909         }
 910
 911         /**
 912          * SQL Parser code
 913          */
 914         require_once './libraries/sqlparser.lib.php';
 915
 916         /**
 917          * SQL Validator interface code
 918          */
 919         require_once './libraries/sqlvalidator.lib.php';
 920
 921         /**
 922          * the PMA_List_Database class
 923          */
 924         require_once './libraries/PMA.php';
 925         $pma = new PMA;
 926         $pma->userlink = $userlink;
 927         $pma->controllink = $controllink;
 928
 929         /**
 930          * some resetting has to be done when switching servers
 931          */
 932         if (isset($_SESSION['tmp_user_values']['previous_server']) && $_SESSION['tmp_user_values']['previous_server'] != $GLOBALS['server']) {
 933             unset($_SESSION['tmp_user_values']['navi_limit_offset']);
 934         }
 935         $_SESSION['tmp_user_values']['previous_server'] = $GLOBALS['server'];
 936
 937     } // end server connecting
 938
 939     /**
 940      * check if profiling was requested and remember it
 941      * (note: when $cfg['ServerDefault'] = 0, constant is not defined)
 942      */
 943     if (isset($_REQUEST['profiling']) && PMA_profilingSupported()) {
 944         $_SESSION['profiling'] = true;
 945     } elseif (isset($_REQUEST['profiling_form'])) {
 946         // the checkbox was unchecked
 947         unset($_SESSION['profiling']);
 948     }
 949
 950     // library file for blobstreaming
 951     require_once './libraries/blobstreaming.lib.php';
 952
 953     // checks for blobstreaming plugins and databases that support
 954     // blobstreaming (by having the necessary tables for blobstreaming)
 955     checkBLOBStreamingPlugins();
 956
 957 } // end if !defined('PMA_MINIMUM_COMMON')
 958
 959 // load user preferences
 960 $GLOBALS['PMA_Config']->loadUserPreferences();
 961
 962 // remove sensitive values from session
 963 $GLOBALS['PMA_Config']->set('blowfish_secret', '');
 964 $GLOBALS['PMA_Config']->set('Servers', '');
 965 $GLOBALS['PMA_Config']->set('default_server', '');
 966
 967 /* Tell tracker that it can actually work */
 968 PMA_Tracker::enable();
 969
 970 if (!empty($__redirect) && in_array($__redirect, $goto_whitelist)) {
 971     /**
 972      * include subform target page
 973      */
 974     require $__redirect;
 975     exit();
 976 }
 977 ?>