libraries/common.inc.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * Misc stuff and REQUIRED by ALL the scripts.
   5  * MUST be included by every script
   6  *
   7  * Among other things, it contains the advanced authentication work.
   8  *
   9  * Order of sections for common.inc.php:
  10  *
  11  * LABEL_variables_init
  12  *  - initialize some variables always needed
  13  * LABEL_parsing_config_file
  14  *  - parsing of the configuration file
  15  * LABEL_loading_language_file
  16  *  - loading language file
  17  * LABEL_theme_setup
  18  *  - setting up themes
  19  *
  20  * - load of MySQL extension (if necessary)
  21  * - loading of an authentication library
  22  * - db connection
  23  * - authentication work
  24  *
  25  * @version $Id$
  26  */
  27
  28 /**
  29  * For now, avoid warnings of E_STRICT mode
  30  * (this must be done before function definitions)
  31  */
  32 if (defined('E_STRICT')) {
  33     $old_error_reporting = error_reporting(0);
  34     if ($old_error_reporting & E_STRICT) {
  35         error_reporting($old_error_reporting ^ E_STRICT);
  36     } else {
  37         error_reporting($old_error_reporting);
  38     }
  39     unset($old_error_reporting);
  40 }
  41
  42 // at this point PMA_PHP_INT_VERSION is not yet defined
  43 if (version_compare(phpversion(), '6', 'lt')) {
  44     /**
  45      * Avoid object cloning errors
  46      */
  47     @ini_set('zend.ze1_compatibility_mode', false);
  48
  49     /**
  50      * Avoid problems with magic_quotes_runtime
  51      */
  52     @ini_set('magic_quotes_runtime', false);
  53 }
  54
  55 /**
  56  * core functions
  57  */
  58 require_once './libraries/core.lib.php';
  59
  60 /**
  61  * Input sanitizing
  62  */
  63 require_once './libraries/sanitizing.lib.php';
  64
  65 /**
  66  * the PMA_Theme class
  67  */
  68 require_once './libraries/Theme.class.php';
  69
  70 /**
  71  * the PMA_Theme_Manager class
  72  */
  73 require_once './libraries/Theme_Manager.class.php';
  74
  75 /**
  76  * the PMA_Config class
  77  */
  78 require_once './libraries/Config.class.php';
  79
  80 /**
  81  * the PMA_Table class
  82  */
  83 require_once './libraries/Table.class.php';
  84
  85 if (!defined('PMA_MINIMUM_COMMON')) {
  86     /**
  87      * common functions
  88      */
  89     require_once './libraries/common.lib.php';
  90
  91     /**
  92      * Java script escaping.
  93      */
  94     require_once './libraries/js_escape.lib.php';
  95
  96     /**
  97      * Include URL/hidden inputs generating.
  98      */
  99     require_once './libraries/url_generating.lib.php';
 100 }
 101
 102 /******************************************************************************/
 103 /* start procedural code                       label_start_procedural         */
 104
 105 /**
 106  * protect against older PHP versions' bug about GLOBALS overwrite
 107  * (no need to localize this message :))
 108  * but what if script.php?GLOBALS[admin]=1&GLOBALS[_REQUEST]=1 ???
 109  */
 110 if (isset($_REQUEST['GLOBALS']) || isset($_FILES['GLOBALS'])
 111   || isset($_SERVER['GLOBALS']) || isset($_COOKIE['GLOBALS'])
 112   || isset($_ENV['GLOBALS'])) {
 113     die('GLOBALS overwrite attempt');
 114 }
 115
 116 /**
 117  * protect against possible exploits - there is no need to have so much variables
 118  */
 119 if (count($_REQUEST) > 1000) {
 120     die('possible exploit');
 121 }
 122
 123 /**
 124  * Check for numeric keys
 125  * (if register_globals is on, numeric key can be found in $GLOBALS)
 126  */
 127 foreach ($GLOBALS as $key => $dummy) {
 128     if (is_numeric($key)) {
 129         die('numeric key detected');
 130     }
 131 }
 132 unset($dummy);
 133
 134 /**
 135  * PATH_INFO could be compromised if set, so remove it from PHP_SELF
 136  * and provide a clean PHP_SELF here
 137  */
 138 $PMA_PHP_SELF = PMA_getenv('PHP_SELF');
 139 $_PATH_INFO = PMA_getenv('PATH_INFO');
 140 if (! empty($_PATH_INFO) && ! empty($PMA_PHP_SELF)) {
 141     $path_info_pos = strrpos($PMA_PHP_SELF, $_PATH_INFO);
 142     if ($path_info_pos + strlen($_PATH_INFO) === strlen($PMA_PHP_SELF)) {
 143         $PMA_PHP_SELF = substr($PMA_PHP_SELF, 0, $path_info_pos);
 144     }
 145 }
 146 $PMA_PHP_SELF = htmlspecialchars($PMA_PHP_SELF);
 147
 148
 149 /**
 150  * just to be sure there was no import (registering) before here
 151  * we empty the global space (but avoid unsetting $variables_list
 152  * and $key in the foreach(), we still need them!)
 153  */
 154 $variables_whitelist = array (
 155     'GLOBALS',
 156     '_SERVER',
 157     '_GET',
 158     '_POST',
 159     '_REQUEST',
 160     '_FILES',
 161     '_ENV',
 162     '_COOKIE',
 163     '_SESSION',
 164     'PMA_PHP_SELF',
 165     'variables_whitelist',
 166     'key'
 167 );
 168
 169 foreach (get_defined_vars() as $key => $value) {
 170     if (! in_array($key, $variables_whitelist)) {
 171         unset($$key);
 172     }
 173 }
 174 unset($key, $value, $variables_whitelist);
 175
 176
 177 /**
 178  * Subforms - some functions need to be called by form, cause of the limited URL
 179  * length, but if this functions inside another form you cannot just open a new
 180  * form - so phpMyAdmin uses 'arrays' inside this form
 181  *
 182  * <code>
 183  * <form ...>
 184  * ... main form elments ...
 185  * <input type="hidden" name="subform[action1][id]" value="1" />
 186  * ... other subform data ...
 187  * <input type="submit" name="usesubform[action1]" value="do action1" />
 188  * ... other subforms ...
 189  * <input type="hidden" name="subform[actionX][id]" value="X" />
 190  * ... other subform data ...
 191  * <input type="submit" name="usesubform[actionX]" value="do actionX" />
 192  * ... main form elments ...
 193  * <input type="submit" name="main_action" value="submit form" />
 194  * </form>
 195  * </code
 196  *
 197  * so we now check if a subform is submitted
 198  */
 199 $__redirect = null;
 200 if (isset($_POST['usesubform'])) {
 201     // if a subform is present and should be used
 202     // the rest of the form is deprecated
 203     $subform_id = key($_POST['usesubform']);
 204     $subform    = $_POST['subform'][$subform_id];
 205     $_POST      = $subform;
 206     $_REQUEST   = $subform;
 207     /**
 208      * some subforms need another page than the main form, so we will just
 209      * include this page at the end of this script - we use $__redirect to
 210      * track this
 211      */
 212     if (isset($_POST['redirect'])
 213       && $_POST['redirect'] != basename($PMA_PHP_SELF)) {
 214         $__redirect = $_POST['redirect'];
 215         unset($_POST['redirect']);
 216     }
 217     unset($subform_id, $subform);
 218 } else {
 219     // Note: here we overwrite $_REQUEST so that it does not contain cookies,
 220     // because another application for the same domain could have set
 221     // a cookie (with a compatible path) that overrides a variable
 222     // we expect from GET or POST.
 223     // We'll refer to cookies explicitly with the $_COOKIE syntax.
 224     $_REQUEST = array_merge($_GET, $_POST);
 225 }
 226 // end check if a subform is submitted
 227
 228 // remove quotes added by php
 229 // (get_magic_quotes_gpc() is deprecated in PHP 5.3, but compare with 5.2.99
 230 // to be able to test with 5.3.0-dev)
 231 if (function_exists('get_magic_quotes_gpc') && -1 == version_compare(PHP_VERSION, '5.2.99') && get_magic_quotes_gpc()) {
 232     PMA_arrayWalkRecursive($_GET, 'stripslashes', true);
 233     PMA_arrayWalkRecursive($_POST, 'stripslashes', true);
 234     PMA_arrayWalkRecursive($_COOKIE, 'stripslashes', true);
 235     PMA_arrayWalkRecursive($_REQUEST, 'stripslashes', true);
 236 }
 237
 238 /**
 239  * clean cookies on new install or upgrade
 240  * when changing something with increment the cookie version
 241  */
 242 $pma_cookie_version = 4;
 243 if (isset($_COOKIE)
 244  && (! isset($_COOKIE['pmaCookieVer'])
 245   || $_COOKIE['pmaCookieVer'] < $pma_cookie_version)) {
 246     // delete all cookies
 247     foreach($_COOKIE as $cookie_name => $tmp) {
 248         PMA_removeCookie($cookie_name);
 249     }
 250     $_COOKIE = array();
 251     PMA_setCookie('pmaCookieVer', $pma_cookie_version);
 252 }
 253
 254 /**
 255  * include deprecated grab_globals only if required
 256  */
 257 if (empty($__redirect) && !defined('PMA_NO_VARIABLES_IMPORT')) {
 258     require './libraries/grab_globals.lib.php';
 259 }
 260
 261 /**
 262  * include session handling after the globals, to prevent overwriting
 263  */
 264 require_once './libraries/session.inc.php';
 265
 266 /**
 267  * init some variables LABEL_variables_init
 268  */
 269
 270 /**
 271  * holds errors
 272  * @global array $GLOBALS['PMA_errors']
 273  */
 274 $GLOBALS['PMA_errors'] = array();
 275
 276 /**
 277  * holds parameters to be passed to next page
 278  * @global array $GLOBALS['url_params']
 279  */
 280 $GLOBALS['url_params'] = array();
 281
 282 /**
 283  * the whitelist for $GLOBALS['goto']
 284  * @global array $goto_whitelist
 285  */
 286 $goto_whitelist = array(
 287     //'browse_foreigners.php',
 288     //'calendar.php',
 289     //'changelog.php',
 290     //'chk_rel.php',
 291     'db_create.php',
 292     'db_datadict.php',
 293     'db_sql.php',
 294     'db_export.php',
 295     'db_importdocsql.php',
 296     'db_qbe.php',
 297     'db_structure.php',
 298     'db_import.php',
 299     'db_operations.php',
 300     'db_printview.php',
 301     'db_search.php',
 302     //'Documentation.html',
 303     //'error.php',
 304     'export.php',
 305     'import.php',
 306     //'index.php',
 307     //'navigation.php',
 308     //'license.php',
 309     'main.php',
 310     'pdf_pages.php',
 311     'pdf_schema.php',
 312     //'phpinfo.php',
 313     'querywindow.php',
 314     //'readme.php',
 315     'server_binlog.php',
 316     'server_collations.php',
 317     'server_databases.php',
 318     'server_engines.php',
 319     'server_export.php',
 320     'server_import.php',
 321     'server_privileges.php',
 322     'server_processlist.php',
 323     'server_sql.php',
 324     'server_status.php',
 325     'server_variables.php',
 326     'sql.php',
 327     'tbl_addfield.php',
 328     'tbl_alter.php',
 329     'tbl_change.php',
 330     'tbl_create.php',
 331     'tbl_import.php',
 332     'tbl_indexes.php',
 333     'tbl_move_copy.php',
 334     'tbl_printview.php',
 335     'tbl_sql.php',
 336     'tbl_export.php',
 337     'tbl_operations.php',
 338     'tbl_structure.php',
 339     'tbl_relation.php',
 340     'tbl_replace.php',
 341     'tbl_row_action.php',
 342     'tbl_select.php',
 343     //'themes.php',
 344     'transformation_overview.php',
 345     'transformation_wrapper.php',
 346     'translators.html',
 347     'user_password.php',
 348 );
 349
 350 /**
 351  * check $__redirect against whitelist
 352  */
 353 if (! PMA_checkPageValidity($__redirect, $goto_whitelist)) {
 354     $__redirect = null;
 355 }
 356
 357 /**
 358  * holds page that should be displayed
 359  * @global string $GLOBALS['goto']
 360  */
 361 $GLOBALS['goto'] = '';
 362 // Security fix: disallow accessing serious server files via "?goto="
 363 if (PMA_checkPageValidity($_REQUEST['goto'], $goto_whitelist)) {
 364     $GLOBALS['goto'] = $_REQUEST['goto'];
 365     $GLOBALS['url_params']['goto'] = $_REQUEST['goto'];
 366 } else {
 367     unset($_REQUEST['goto'], $_GET['goto'], $_POST['goto'], $_COOKIE['goto']);
 368 }
 369
 370 /**
 371  * returning page
 372  * @global string $GLOBALS['back']
 373  */
 374 if (PMA_checkPageValidity($_REQUEST['back'], $goto_whitelist)) {
 375     $GLOBALS['back'] = $_REQUEST['back'];
 376 } else {
 377     unset($_REQUEST['back'], $_GET['back'], $_POST['back'], $_COOKIE['back']);
 378 }
 379
 380 /**
 381  * Check whether user supplied token is valid, if not remove any possibly
 382  * dangerous stuff from request.
 383  *
 384  * remember that some objects in the session with session_start and __wakeup()
 385  * could access this variables before we reach this point
 386  * f.e. PMA_Config: fontsize
 387  *
 388  * @todo variables should be handled by their respective owners (objects)
 389  * f.e. lang, server, convcharset, collation_connection in PMA_Config
 390  */
 391 if (! PMA_isValid($_REQUEST['token']) || $_SESSION[' PMA_token '] != $_REQUEST['token']) {
 392     /**
 393      *  List of parameters which are allowed from unsafe source
 394      */
 395     $allow_list = array(
 396         'db', 'table', 'lang', 'server', 'convcharset', 'collation_connection', 'target',
 397         /* Session ID */
 398         'phpMyAdmin',
 399         /* Cookie preferences */
 400         'pma_lang', 'pma_charset', 'pma_collation_connection',
 401         /* Possible login form */
 402         'pma_servername', 'pma_username', 'pma_password',
 403     );
 404     /**
 405      * Require cleanup functions
 406      */
 407     require_once './libraries/cleanup.lib.php';
 408     /**
 409      * Do actual cleanup
 410      */
 411     PMA_remove_request_vars($allow_list);
 412
 413 }
 414
 415
 416 /**
 417  * @global string $convcharset
 418  * @see select_lang.lib.php
 419  */
 420 if (isset($_REQUEST['convcharset'])) {
 421     $convcharset = strip_tags($_REQUEST['convcharset']);
 422 }
 423
 424 /**
 425  * current selected database
 426  * @global string $GLOBALS['db']
 427  */
 428 $GLOBALS['db'] = '';
 429 if (PMA_isValid($_REQUEST['db'])) {
 430     // can we strip tags from this?
 431     // only \ and / is not allowed in db names for MySQL
 432     $GLOBALS['db'] = $_REQUEST['db'];
 433     $GLOBALS['url_params']['db'] = $GLOBALS['db'];
 434 }
 435
 436 /**
 437  * current selected table
 438  * @global string $GLOBALS['table']
 439  */
 440 $GLOBALS['table'] = '';
 441 if (PMA_isValid($_REQUEST['table'])) {
 442     // can we strip tags from this?
 443     // only \ and / is not allowed in table names for MySQL
 444     $GLOBALS['table'] = $_REQUEST['table'];
 445     $GLOBALS['url_params']['table'] = $GLOBALS['table'];
 446 }
 447
 448 /**
 449  * SQL query to be executed
 450  * @global string $GLOBALS['sql_query']
 451  */
 452 $GLOBALS['sql_query'] = '';
 453 if (PMA_isValid($_REQUEST['sql_query'])) {
 454     $GLOBALS['sql_query'] = $_REQUEST['sql_query'];
 455 }
 456
 457 /**
 458  * avoid problems in phpmyadmin.css.php in some cases
 459  * @global string $js_frame
 460  */
 461 $_REQUEST['js_frame'] = PMA_ifSetOr($_REQUEST['js_frame'], '');
 462
 463 //$_REQUEST['set_theme'] // checked later in this file LABEL_theme_setup
 464 //$_REQUEST['server']; // checked later in this file
 465 //$_REQUEST['lang'];   // checked by LABEL_loading_language_file
 466
 467
 468
 469 /******************************************************************************/
 470 /* parsing configuration file                         LABEL_parsing_config_file      */
 471
 472 /**
 473  * We really need this one!
 474  */
 475 if (! function_exists('preg_replace')) {
 476     PMA_fatalError('strCantLoad', 'pcre');
 477 }
 478
 479 /**
 480  * @global PMA_Config $_SESSION['PMA_Config']
 481  * force reading of config file, because we removed sensitive values
 482  * in the previous iteration
 483  */
 484 $_SESSION['PMA_Config'] = new PMA_Config('./config.inc.php');
 485
 486 if (!defined('PMA_MINIMUM_COMMON')) {
 487     $_SESSION['PMA_Config']->checkPmaAbsoluteUri();
 488 }
 489
 490 /**
 491  * BC - enable backward compatibility
 492  * exports all configuration settings into $GLOBALS ($GLOBALS['cfg'])
 493  */
 494 $_SESSION['PMA_Config']->enableBc();
 495
 496
 497 /**
 498  * check HTTPS connection
 499  */
 500 if ($_SESSION['PMA_Config']->get('ForceSSL')
 501   && !$_SESSION['PMA_Config']->get('is_https')) {
 502     PMA_sendHeaderLocation(
 503         preg_replace('/^http/', 'https',
 504             $_SESSION['PMA_Config']->get('PmaAbsoluteUri'))
 505         . PMA_generate_common_url($_GET));
 506     exit;
 507 }
 508
 509
 510 /******************************************************************************/
 511 /* loading language file                       LABEL_loading_language_file    */
 512
 513 /**
 514  * Added messages while developing:
 515  */
 516 if (file_exists('./lang/added_messages.php')) {
 517     include './lang/added_messages.php';
 518 }
 519
 520 /**
 521  * Includes the language file if it hasn't been included yet
 522  */
 523 require './libraries/language.lib.php';
 524
 525
 526 /**
 527  * check for errors occurred while loading configuration
 528  * this check is done here after loading language files to present errors in locale
 529  */
 530 if ($_SESSION['PMA_Config']->error_config_file) {
 531     $GLOBALS['PMA_errors'][] = $strConfigFileError
 532         . '<br /><br />'
 533         . ($_SESSION['PMA_Config']->getSource() == './config.inc.php' ?
 534         '<a href="show_config_errors.php"'
 535         .' target="_blank">' . $_SESSION['PMA_Config']->getSource() . '</a>'
 536         :
 537         '<a href="' . $_SESSION['PMA_Config']->getSource() . '"'
 538         .' target="_blank">' . $_SESSION['PMA_Config']->getSource() . '</a>');
 539 }
 540 if ($_SESSION['PMA_Config']->error_config_default_file) {
 541     $GLOBALS['PMA_errors'][] = sprintf($strConfigDefaultFileError,
 542         $_SESSION['PMA_Config']->default_source);
 543 }
 544 if ($_SESSION['PMA_Config']->error_pma_uri) {
 545     $GLOBALS['PMA_errors'][] = sprintf($strPmaUriError);
 546 }
 547
 548 /**
 549  * current server
 550  * @global integer $GLOBALS['server']
 551  */
 552 $GLOBALS['server'] = 0;
 553
 554 /**
 555  * Servers array fixups.
 556  * $default_server comes from PMA_Config::enableBc()
 557  * @todo merge into PMA_Config
 558  */
 559 // Do we have some server?
 560 if (!isset($cfg['Servers']) || count($cfg['Servers']) == 0) {
 561     // No server => create one with defaults
 562     $cfg['Servers'] = array(1 => $default_server);
 563 } else {
 564     // We have server(s) => apply default configuration
 565     $new_servers = array();
 566
 567     foreach ($cfg['Servers'] as $server_index => $each_server) {
 568
 569         // Detect wrong configuration
 570         if (!is_int($server_index) || $server_index < 1) {
 571             $GLOBALS['PMA_errors'][] = sprintf($strInvalidServerIndex, $server_index);
 572         }
 573
 574         $each_server = array_merge($default_server, $each_server);
 575
 576         // Don't use servers with no hostname
 577         if ($each_server['connect_type'] == 'tcp' && empty($each_server['host'])) {
 578             $GLOBALS['PMA_errors'][] = sprintf($strInvalidServerHostname, $server_index);
 579         }
 580
 581         // Final solution to bug #582890
 582         // If we are using a socket connection
 583         // and there is nothing in the verbose server name
 584         // or the host field, then generate a name for the server
 585         // in the form of "Server 2", localized of course!
 586         if ($each_server['connect_type'] == 'socket' && empty($each_server['host']) && empty($each_server['verbose'])) {
 587             $each_server['verbose'] = $GLOBALS['strServer'] . $server_index;
 588         }
 589
 590         $new_servers[$server_index] = $each_server;
 591     }
 592     $cfg['Servers'] = $new_servers;
 593     unset($new_servers, $server_index, $each_server);
 594 }
 595
 596 // Cleanup
 597 unset($default_server);
 598
 599
 600 /******************************************************************************/
 601 /* setup themes                                          LABEL_theme_setup    */
 602
 603 /**
 604  * @global PMA_Theme_Manager $_SESSION['PMA_Theme_Manager']
 605  */
 606 if (! isset($_SESSION['PMA_Theme_Manager'])) {
 607     $_SESSION['PMA_Theme_Manager'] = new PMA_Theme_Manager;
 608 } else {
 609     /**
 610      * @todo move all __wakeup() functionality into session.inc.php
 611      */
 612     $_SESSION['PMA_Theme_Manager']->checkConfig();
 613 }
 614
 615 // for the theme per server feature
 616 if (isset($_REQUEST['server']) && !isset($_REQUEST['set_theme'])) {
 617     $GLOBALS['server'] = $_REQUEST['server'];
 618     $tmp = $_SESSION['PMA_Theme_Manager']->getThemeCookie();
 619     if (empty($tmp)) {
 620         $tmp = $_SESSION['PMA_Theme_Manager']->theme_default;
 621     }
 622     $_SESSION['PMA_Theme_Manager']->setActiveTheme($tmp);
 623     unset($tmp);
 624 }
 625 /**
 626  * @todo move into PMA_Theme_Manager::__wakeup()
 627  */
 628 if (isset($_REQUEST['set_theme'])) {
 629     // if user selected a theme
 630     $_SESSION['PMA_Theme_Manager']->setActiveTheme($_REQUEST['set_theme']);
 631 }
 632
 633 /**
 634  * the theme object
 635  * @global PMA_Theme $_SESSION['PMA_Theme']
 636  */
 637 $_SESSION['PMA_Theme'] = $_SESSION['PMA_Theme_Manager']->theme;
 638
 639 // BC
 640 /**
 641  * the active theme
 642  * @global string $GLOBALS['theme']
 643  */
 644 $GLOBALS['theme']           = $_SESSION['PMA_Theme']->getName();
 645 /**
 646  * the theme path
 647  * @global string $GLOBALS['pmaThemePath']
 648  */
 649 $GLOBALS['pmaThemePath']    = $_SESSION['PMA_Theme']->getPath();
 650 /**
 651  * the theme image path
 652  * @global string $GLOBALS['pmaThemeImage']
 653  */
 654 $GLOBALS['pmaThemeImage']   = $_SESSION['PMA_Theme']->getImgPath();
 655
 656 /**
 657  * load layout file if exists
 658  */
 659 if (@file_exists($_SESSION['PMA_Theme']->getLayoutFile())) {
 660     include $_SESSION['PMA_Theme']->getLayoutFile();
 661     /**
 662      * @todo remove if all themes are update use Navi instead of Left as frame name
 663      */
 664     if (! isset($GLOBALS['cfg']['NaviWidth'])
 665      && isset($GLOBALS['cfg']['LeftWidth'])) {
 666         $GLOBALS['cfg']['NaviWidth'] = $GLOBALS['cfg']['LeftWidth'];
 667     }
 668 }
 669
 670 if (! defined('PMA_MINIMUM_COMMON')) {
 671     /**
 672      * Character set conversion.
 673      */
 674     require_once './libraries/charset_conversion.lib.php';
 675
 676     /**
 677      * String handling
 678      */
 679     require_once './libraries/string.lib.php';
 680
 681     /**
 682      * Lookup server by name
 683      * by Arnold - Helder Hosting
 684      * (see FAQ 4.8)
 685      */
 686     if (! empty($_REQUEST['server']) && is_string($_REQUEST['server'])
 687      && ! is_numeric($_REQUEST['server'])) {
 688         foreach ($cfg['Servers'] as $i => $server) {
 689             if ($server['host'] == $_REQUEST['server']) {
 690                 $_REQUEST['server'] = $i;
 691                 break;
 692             }
 693         }
 694         if (is_string($_REQUEST['server'])) {
 695             unset($_REQUEST['server']);
 696         }
 697         unset($i);
 698     }
 699
 700     /**
 701      * If no server is selected, make sure that $cfg['Server'] is empty (so
 702      * that nothing will work), and skip server authentication.
 703      * We do NOT exit here, but continue on without logging into any server.
 704      * This way, the welcome page will still come up (with no server info) and
 705      * present a choice of servers in the case that there are multiple servers
 706      * and '$cfg['ServerDefault'] = 0' is set.
 707      */
 708
 709     if (isset($_REQUEST['server']) && (is_string($_REQUEST['server']) || is_numeric($_REQUEST['server'])) && ! empty($_REQUEST['server']) && ! empty($cfg['Servers'][$_REQUEST['server']])) {
 710         $GLOBALS['server'] = $_REQUEST['server'];
 711         $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
 712     } else {
 713         if (!empty($cfg['Servers'][$cfg['ServerDefault']])) {
 714             $GLOBALS['server'] = $cfg['ServerDefault'];
 715             $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
 716         } else {
 717             $GLOBALS['server'] = 0;
 718             $cfg['Server'] = array();
 719         }
 720     }
 721     $GLOBALS['url_params']['server'] = $GLOBALS['server'];
 722
 723     if (! empty($cfg['Server'])) {
 724
 725         /**
 726          * Loads the proper database interface for this server
 727          */
 728         require_once './libraries/database_interface.lib.php';
 729
 730         // Gets the authentication library that fits the $cfg['Server'] settings
 731         // and run authentication
 732
 733         // (for a quick check of path disclosure in auth/cookies:)
 734         $coming_from_common = true;
 735
 736         // to allow HTTP or http
 737         $cfg['Server']['auth_type'] = strtolower($cfg['Server']['auth_type']);
 738         if (! file_exists('./libraries/auth/' . $cfg['Server']['auth_type'] . '.auth.lib.php')) {
 739             PMA_fatalError($strInvalidAuthMethod . ' ' . $cfg['Server']['auth_type']);
 740         }
 741         /**
 742          * the required auth type plugin
 743          */
 744         require_once './libraries/auth/' . $cfg['Server']['auth_type'] . '.auth.lib.php';
 745
 746         if (!PMA_auth_check()) {
 747             PMA_auth();
 748         } else {
 749             PMA_auth_set_user();
 750         }
 751
 752         // Check IP-based Allow/Deny rules as soon as possible to reject the
 753         // user
 754         // Based on mod_access in Apache:
 755         // http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/aaa/mod_access.c?rev=1.37&content-type=text/vnd.viewcvs-markup
 756         // Look at: "static int check_dir_access(request_rec *r)"
 757         // Robbat2 - May 10, 2002
 758         if (isset($cfg['Server']['AllowDeny'])
 759           && isset($cfg['Server']['AllowDeny']['order'])) {
 760
 761             /**
 762              * ip based access library
 763              */
 764             require_once './libraries/ip_allow_deny.lib.php';
 765
 766             $allowDeny_forbidden         = false; // default
 767             if ($cfg['Server']['AllowDeny']['order'] == 'allow,deny') {
 768                 $allowDeny_forbidden     = true;
 769                 if (PMA_allowDeny('allow')) {
 770                     $allowDeny_forbidden = false;
 771                 }
 772                 if (PMA_allowDeny('deny')) {
 773                     $allowDeny_forbidden = true;
 774                 }
 775             } elseif ($cfg['Server']['AllowDeny']['order'] == 'deny,allow') {
 776                 if (PMA_allowDeny('deny')) {
 777                     $allowDeny_forbidden = true;
 778                 }
 779                 if (PMA_allowDeny('allow')) {
 780                     $allowDeny_forbidden = false;
 781                 }
 782             } elseif ($cfg['Server']['AllowDeny']['order'] == 'explicit') {
 783                 if (PMA_allowDeny('allow')
 784                   && !PMA_allowDeny('deny')) {
 785                     $allowDeny_forbidden = false;
 786                 } else {
 787                     $allowDeny_forbidden = true;
 788                 }
 789             } // end if ... elseif ... elseif
 790
 791             // Ejects the user if banished
 792             if ($allowDeny_forbidden) {
 793                PMA_auth_fails();
 794             }
 795             unset($allowDeny_forbidden); //Clean up after you!
 796         } // end if
 797
 798         // is root allowed?
 799         if (!$cfg['Server']['AllowRoot'] && $cfg['Server']['user'] == 'root') {
 800             $allowDeny_forbidden = true;
 801             PMA_auth_fails();
 802             unset($allowDeny_forbidden); //Clean up after you!
 803         }
 804
 805         $bkp_track_err = @ini_set('track_errors', 1);
 806
 807         // Try to connect MySQL with the control user profile (will be used to
 808         // get the privileges list for the current user but the true user link
 809         // must be open after this one so it would be default one for all the
 810         // scripts)
 811         $controllink = false;
 812         if ($cfg['Server']['controluser'] != '') {
 813             $controllink = PMA_DBI_connect($cfg['Server']['controluser'],
 814                 $cfg['Server']['controlpass'], true);
 815         }
 816         if (! $controllink) {
 817             $controllink = PMA_DBI_connect($cfg['Server']['user'],
 818                 $cfg['Server']['password'], true);
 819         } // end if ... else
 820
 821         // Pass #1 of DB-Config to read in master level DB-Config will go here
 822         // Robbat2 - May 11, 2002
 823
 824         // Connects to the server (validates user's login)
 825         $userlink = PMA_DBI_connect($cfg['Server']['user'],
 826             $cfg['Server']['password'], false);
 827
 828         // Pass #2 of DB-Config to read in user level DB-Config will go here
 829         // Robbat2 - May 11, 2002
 830
 831         @ini_set('track_errors', $bkp_track_err);
 832         unset($bkp_track_err);
 833
 834         /**
 835          * If we auto switched to utf-8 we need to reread messages here
 836          */
 837         if (defined('PMA_LANG_RELOAD')) {
 838             require './libraries/language.lib.php';
 839         }
 840
 841         /**
 842          * SQL Parser code
 843          */
 844         require_once './libraries/sqlparser.lib.php';
 845
 846         /**
 847          * SQL Validator interface code
 848          */
 849         require_once './libraries/sqlvalidator.lib.php';
 850
 851         /**
 852          * the PMA_List_Database class
 853          */
 854         require_once './libraries/List_Database.class.php';
 855         $PMA_List_Database = new PMA_List_Database($userlink, $controllink);
 856
 857         /**
 858          * some resetting has to be done when switching servers
 859          */
 860         if (isset($_SESSION['userconf']['previous_server']) && $_SESSION['userconf']['previous_server'] != $GLOBALS['server']) {
 861             unset($_SESSION['userconf']['navi_limit_offset']);
 862         }
 863         $_SESSION['userconf']['previous_server'] = $GLOBALS['server'];
 864
 865     } // end server connecting
 866
 867     /**
 868      * Kanji encoding convert feature appended by Y.Kawada (2002/2/20)
 869      */
 870     if (@function_exists('mb_convert_encoding')
 871         && strpos(' ' . $lang, 'ja-')
 872         && file_exists('./libraries/kanji-encoding.lib.php')) {
 873         require_once './libraries/kanji-encoding.lib.php';
 874         /**
 875          * enable multibyte string support
 876          */
 877         define('PMA_MULTIBYTE_ENCODING', 1);
 878     } // end if
 879
 880     /**
 881      * save some settings in cookies
 882      * @todo should be done in PMA_Config
 883      */
 884     PMA_setCookie('pma_lang', $GLOBALS['lang']);
 885     PMA_setCookie('pma_charset', $GLOBALS['convcharset']);
 886     PMA_setCookie('pma_collation_connection', $GLOBALS['collation_connection']);
 887
 888     $_SESSION['PMA_Theme_Manager']->setThemeCookie();
 889
 890     /**
 891      * check if profiling was requested and remember it
 892      * (note: when $cfg['ServerDefault'] = 0, constant is not defined)
 893      */
 894
 895     if (PMA_profilingSupported() && isset($_REQUEST['profiling'])) {
 896         $_SESSION['profiling'] = true;
 897     } elseif (isset($_REQUEST['profiling_form'])) {
 898         // the checkbox was unchecked
 899         unset($_SESSION['profiling']);
 900     }
 901
 902 } // end if !defined('PMA_MINIMUM_COMMON')
 903
 904 // remove sensitive values from session
 905 $_SESSION['PMA_Config']->set('blowfish_secret', '');
 906 $_SESSION['PMA_Config']->set('Servers', '');
 907 $_SESSION['PMA_Config']->set('default_server', '');
 908
 909 if (!empty($__redirect) && in_array($__redirect, $goto_whitelist)) {
 910     /**
 911      * include subform target page
 912      */
 913     require $__redirect;
 914     exit();
 915 }
 916 ?>