libraries/common.inc.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * Misc stuff and REQUIRED by ALL the scripts.
   5  * MUST be included by every script
   6  *
   7  * Among other things, it contains the advanced authentication work.
   8  *
   9  * Order of sections for common.inc.php:
  10  *
  11  * the authentication libraries must be before the connection to db
  12  *
  13  * ... so the required order is:
  14  *
  15  * LABEL_variables_init
  16  *  - initialize some variables always needed
  17  * LABEL_parsing_config_file
  18  *  - parsing of the configuration file
  19  * LABEL_loading_language_file
  20  *  - loading language file
  21  * LABEL_setup_servers
  22  *  - check and setup configured servers
  23  * LABEL_theme_setup
  24  *  - setting up themes
  25  *
  26  * - load of MySQL extension (if necessary)
  27  * - loading of an authentication library
  28  * - db connection
  29  * - authentication work
  30  *
  31  * @package phpMyAdmin
  32  */
  33
  34 /**
  35  * Minimum PHP version; can't call PMA_fatalError() which uses a
  36  * PHP 5 function, so cannot easily localize this message.
  37  */
  38 if (version_compare(PHP_VERSION, '5.2.0', 'lt')) {
  39     die('PHP 5.2+ is required');
  40 }
  41
  42 /**
  43   * Backward compatibility for PHP 5.2
  44   */
  45 if (!defined('E_DEPRECATED')) {
  46     define('E_DEPRECATED', 8192);
  47 }
  48
  49 /**
  50  * the error handler
  51  */
  52 require './libraries/Error_Handler.class.php';
  53
  54 /**
  55  * initialize the error handler
  56  */
  57 $GLOBALS['error_handler'] = new PMA_Error_Handler();
  58 $cfg['Error_Handler']['display'] = true;
  59
  60 /*
  61  * This setting was removed in PHP 5.3. But at this point PMA_PHP_INT_VERSION
  62  * is not yet defined so we use another way to find out the PHP version.
  63  */
  64 if (version_compare(phpversion(), '5.3', 'lt')) {
  65     /**
  66      * Avoid object cloning errors
  67      */
  68     @ini_set('zend.ze1_compatibility_mode', false);
  69 }
  70
  71 /**
  72  * Avoid problems with magic_quotes_runtime
  73  * (in the future, this setting will be removed but it's not yet
  74  * known in which PHP version)
  75  */
  76 @ini_set('magic_quotes_runtime', false);
  77
  78 /**
  79  * for verification in all procedural scripts under libraries
  80  */
  81 define('PHPMYADMIN', true);
  82
  83 /**
  84  * core functions
  85  */
  86 require './libraries/core.lib.php';
  87
  88 /**
  89  * Input sanitizing
  90  */
  91 require './libraries/sanitizing.lib.php';
  92
  93 /**
  94  * the PMA_Theme class
  95  */
  96 require './libraries/Theme.class.php';
  97
  98 /**
  99  * the PMA_Theme_Manager class
 100  */
 101 require './libraries/Theme_Manager.class.php';
 102
 103 /**
 104  * the PMA_Config class
 105  */
 106 require './libraries/Config.class.php';
 107
 108 /**
 109  * the relation lib, tracker needs it
 110  */
 111 require './libraries/relation.lib.php';
 112
 113 /**
 114  * the PMA_Tracker class
 115  */
 116 require './libraries/Tracker.class.php';
 117
 118 /**
 119  * the PMA_Table class
 120  */
 121 require './libraries/Table.class.php';
 122
 123 if (!defined('PMA_MINIMUM_COMMON')) {
 124     /**
 125      * common functions
 126      */
 127     require_once './libraries/common.lib.php';
 128
 129     /**
 130      * Java script escaping.
 131      */
 132     require_once './libraries/js_escape.lib.php';
 133
 134     /**
 135      * Include URL/hidden inputs generating.
 136      */
 137     require_once './libraries/url_generating.lib.php';
 138 }
 139
 140 /******************************************************************************/
 141 /* start procedural code                       label_start_procedural         */
 142
 143 /**
 144  * protect against possible exploits - there is no need to have so much variables
 145  */
 146 if (count($_REQUEST) > 1000) {
 147     die('possible exploit');
 148 }
 149
 150 /**
 151  * Check for numeric keys
 152  * (if register_globals is on, numeric key can be found in $GLOBALS)
 153  */
 154 foreach ($GLOBALS as $key => $dummy) {
 155     if (is_numeric($key)) {
 156         die('numeric key detected');
 157     }
 158 }
 159 unset($dummy);
 160
 161 /**
 162  * PATH_INFO could be compromised if set, so remove it from PHP_SELF
 163  * and provide a clean PHP_SELF here
 164  */
 165 $PMA_PHP_SELF = PMA_getenv('PHP_SELF');
 166 $_PATH_INFO = PMA_getenv('PATH_INFO');
 167 if (! empty($_PATH_INFO) && ! empty($PMA_PHP_SELF)) {
 168     $path_info_pos = strrpos($PMA_PHP_SELF, $_PATH_INFO);
 169     if ($path_info_pos + strlen($_PATH_INFO) === strlen($PMA_PHP_SELF)) {
 170         $PMA_PHP_SELF = substr($PMA_PHP_SELF, 0, $path_info_pos);
 171     }
 172 }
 173 $PMA_PHP_SELF = htmlspecialchars($PMA_PHP_SELF);
 174
 175
 176 /**
 177  * just to be sure there was no import (registering) before here
 178  * we empty the global space (but avoid unsetting $variables_list
 179  * and $key in the foreach (), we still need them!)
 180  */
 181 $variables_whitelist = array (
 182     'GLOBALS',
 183     '_SERVER',
 184     '_GET',
 185     '_POST',
 186     '_REQUEST',
 187     '_FILES',
 188     '_ENV',
 189     '_COOKIE',
 190     '_SESSION',
 191     'error_handler',
 192     'PMA_PHP_SELF',
 193     'variables_whitelist',
 194     'key'
 195 );
 196
 197 foreach (get_defined_vars() as $key => $value) {
 198     if (! in_array($key, $variables_whitelist)) {
 199         unset($$key);
 200     }
 201 }
 202 unset($key, $value, $variables_whitelist);
 203
 204
 205 /**
 206  * Subforms - some functions need to be called by form, cause of the limited URL
 207  * length, but if this functions inside another form you cannot just open a new
 208  * form - so phpMyAdmin uses 'arrays' inside this form
 209  *
 210  * <code>
 211  * <form ...>
 212  * ... main form elments ...
 213  * <input type="hidden" name="subform[action1][id]" value="1" />
 214  * ... other subform data ...
 215  * <input type="submit" name="usesubform[action1]" value="do action1" />
 216  * ... other subforms ...
 217  * <input type="hidden" name="subform[actionX][id]" value="X" />
 218  * ... other subform data ...
 219  * <input type="submit" name="usesubform[actionX]" value="do actionX" />
 220  * ... main form elments ...
 221  * <input type="submit" name="main_action" value="submit form" />
 222  * </form>
 223  * </code>
 224  *
 225  * so we now check if a subform is submitted
 226  */
 227 $__redirect = null;
 228 if (isset($_POST['usesubform'])) {
 229     // if a subform is present and should be used
 230     // the rest of the form is deprecated
 231     $subform_id = key($_POST['usesubform']);
 232     $subform    = $_POST['subform'][$subform_id];
 233     $_POST      = $subform;
 234     $_REQUEST   = $subform;
 235     /**
 236      * some subforms need another page than the main form, so we will just
 237      * include this page at the end of this script - we use $__redirect to
 238      * track this
 239      */
 240     if (isset($_POST['redirect'])
 241       && $_POST['redirect'] != basename($PMA_PHP_SELF)) {
 242         $__redirect = $_POST['redirect'];
 243         unset($_POST['redirect']);
 244     }
 245     unset($subform_id, $subform);
 246 } else {
 247     // Note: here we overwrite $_REQUEST so that it does not contain cookies,
 248     // because another application for the same domain could have set
 249     // a cookie (with a compatible path) that overrides a variable
 250     // we expect from GET or POST.
 251     // We'll refer to cookies explicitly with the $_COOKIE syntax.
 252     $_REQUEST = array_merge($_GET, $_POST);
 253 }
 254 // end check if a subform is submitted
 255
 256 // remove quotes added by php
 257 if (function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc()) {
 258     PMA_arrayWalkRecursive($_GET, 'stripslashes', true);
 259     PMA_arrayWalkRecursive($_POST, 'stripslashes', true);
 260     PMA_arrayWalkRecursive($_COOKIE, 'stripslashes', true);
 261     PMA_arrayWalkRecursive($_REQUEST, 'stripslashes', true);
 262 }
 263
 264 /**
 265  * include deprecated grab_globals only if required
 266  */
 267 if (empty($__redirect) && !defined('PMA_NO_VARIABLES_IMPORT')) {
 268     require './libraries/grab_globals.lib.php';
 269 }
 270
 271 /**
 272  * check timezone setting
 273  * this could produce an E_STRICT - but only once,
 274  * if not done here it will produce E_STRICT on every date/time function
 275  *
 276  * @todo need to decide how we should handle this (without @)
 277  */
 278 date_default_timezone_set(@date_default_timezone_get());
 279
 280 /******************************************************************************/
 281 /* parsing configuration file                         LABEL_parsing_config_file      */
 282
 283 /**
 284  * We really need this one!
 285  */
 286 if (! function_exists('preg_replace')) {
 287     PMA_warnMissingExtension('pcre', true);
 288 }
 289
 290 /**
 291  * @global PMA_Config $GLOBALS['PMA_Config']
 292  * force reading of config file, because we removed sensitive values
 293  * in the previous iteration
 294  */
 295 $GLOBALS['PMA_Config'] = new PMA_Config(CONFIG_FILE);
 296
 297 if (!defined('PMA_MINIMUM_COMMON')) {
 298     $GLOBALS['PMA_Config']->checkPmaAbsoluteUri();
 299 }
 300
 301 /**
 302  * BC - enable backward compatibility
 303  * exports all configuration settings into $GLOBALS ($GLOBALS['cfg'])
 304  */
 305 $GLOBALS['PMA_Config']->enableBc();
 306
 307 /**
 308  * clean cookies on upgrade
 309  * when changing something related to PMA cookies, increment the cookie version
 310  */
 311 $pma_cookie_version = 4;
 312 if (isset($_COOKIE)
 313  && (isset($_COOKIE['pmaCookieVer'])
 314   && $_COOKIE['pmaCookieVer'] < $pma_cookie_version)) {
 315     // delete all cookies
 316     foreach ($_COOKIE as $cookie_name => $tmp) {
 317         $GLOBALS['PMA_Config']->removeCookie($cookie_name);
 318     }
 319     $_COOKIE = array();
 320     $GLOBALS['PMA_Config']->setCookie('pmaCookieVer', $pma_cookie_version);
 321 }
 322
 323
 324 /**
 325  * check HTTPS connection
 326  */
 327 if ($GLOBALS['PMA_Config']->get('ForceSSL')
 328   && !$GLOBALS['PMA_Config']->get('is_https')) {
 329     PMA_sendHeaderLocation(
 330         preg_replace('/^http/', 'https',
 331             $GLOBALS['PMA_Config']->get('PmaAbsoluteUri'))
 332         . PMA_generate_common_url($_GET, 'text'));
 333     // delete the current session, otherwise we get problems (see bug #2397877)
 334     $GLOBALS['PMA_Config']->removeCookie($GLOBALS['session_name']);
 335     exit;
 336 }
 337
 338
 339 /**
 340  * include session handling after the globals, to prevent overwriting
 341  */
 342 require './libraries/session.inc.php';
 343
 344 /**
 345  * init some variables LABEL_variables_init
 346  */
 347
 348 /**
 349  * holds parameters to be passed to next page
 350  * @global array $GLOBALS['url_params']
 351  */
 352 $GLOBALS['url_params'] = array();
 353
 354 /**
 355  * the whitelist for $GLOBALS['goto']
 356  * @global array $goto_whitelist
 357  */
 358 $goto_whitelist = array(
 359     //'browse_foreigners.php',
 360     //'calendar.php',
 361     //'changelog.php',
 362     //'chk_rel.php',
 363     'db_create.php',
 364     'db_datadict.php',
 365     'db_sql.php',
 366     'db_events.php',
 367     'db_export.php',
 368     'db_importdocsql.php',
 369     'db_qbe.php',
 370     'db_structure.php',
 371     'db_import.php',
 372     'db_operations.php',
 373     'db_printview.php',
 374     'db_search.php',
 375     'db_routines.php',
 376     //'Documentation.html',
 377     'export.php',
 378     'import.php',
 379     //'index.php',
 380     //'navigation.php',
 381     //'license.php',
 382     'main.php',
 383     'pdf_pages.php',
 384     'pdf_schema.php',
 385     //'phpinfo.php',
 386     'querywindow.php',
 387     //'readme.php',
 388     'server_binlog.php',
 389     'server_collations.php',
 390     'server_databases.php',
 391     'server_engines.php',
 392     'server_export.php',
 393     'server_import.php',
 394     'server_privileges.php',
 395     'server_processlist.php',
 396     'server_sql.php',
 397     'server_status.php',
 398     'server_variables.php',
 399     'sql.php',
 400     'tbl_addfield.php',
 401     'tbl_alter.php',
 402     'tbl_change.php',
 403     'tbl_create.php',
 404     'tbl_import.php',
 405     'tbl_indexes.php',
 406     'tbl_move_copy.php',
 407     'tbl_printview.php',
 408     'tbl_sql.php',
 409     'tbl_export.php',
 410     'tbl_operations.php',
 411     'tbl_structure.php',
 412     'tbl_relation.php',
 413     'tbl_replace.php',
 414     'tbl_row_action.php',
 415     'tbl_select.php',
 416     'tbl_zoom_select.php',
 417     //'themes.php',
 418     'transformation_overview.php',
 419     'transformation_wrapper.php',
 420     'user_password.php',
 421 );
 422
 423 /**
 424  * check $__redirect against whitelist
 425  */
 426 if (! PMA_checkPageValidity($__redirect, $goto_whitelist)) {
 427     $__redirect = null;
 428 }
 429
 430 /**
 431  * holds page that should be displayed
 432  * @global string $GLOBALS['goto']
 433  */
 434 $GLOBALS['goto'] = '';
 435 // Security fix: disallow accessing serious server files via "?goto="
 436 if (PMA_checkPageValidity($_REQUEST['goto'], $goto_whitelist)) {
 437     $GLOBALS['goto'] = $_REQUEST['goto'];
 438     $GLOBALS['url_params']['goto'] = $_REQUEST['goto'];
 439 } else {
 440     unset($_REQUEST['goto'], $_GET['goto'], $_POST['goto'], $_COOKIE['goto']);
 441 }
 442
 443 /**
 444  * returning page
 445  * @global string $GLOBALS['back']
 446  */
 447 if (PMA_checkPageValidity($_REQUEST['back'], $goto_whitelist)) {
 448     $GLOBALS['back'] = $_REQUEST['back'];
 449 } else {
 450     unset($_REQUEST['back'], $_GET['back'], $_POST['back'], $_COOKIE['back']);
 451 }
 452
 453 /**
 454  * Check whether user supplied token is valid, if not remove any possibly
 455  * dangerous stuff from request.
 456  *
 457  * remember that some objects in the session with session_start and __wakeup()
 458  * could access this variables before we reach this point
 459  * f.e. PMA_Config: fontsize
 460  *
 461  * @todo variables should be handled by their respective owners (objects)
 462  * f.e. lang, server, collation_connection in PMA_Config
 463  */
 464 if (! PMA_isValid($_REQUEST['token']) || $_SESSION[' PMA_token '] != $_REQUEST['token']) {
 465     /**
 466      *  List of parameters which are allowed from unsafe source
 467      */
 468     $allow_list = array(
 469         /* needed for direct access, see FAQ 1.34
 470          * also, server needed for cookie login screen (multi-server)
 471          */
 472         'server', 'db', 'table', 'target',
 473         /* Session ID */
 474         'phpMyAdmin',
 475         /* Cookie preferences */
 476         'pma_lang', 'pma_collation_connection',
 477         /* Possible login form */
 478         'pma_servername', 'pma_username', 'pma_password',
 479         /* for playing blobstreamable media */
 480         'media_type', 'custom_type', 'bs_reference',
 481         /* for changing BLOB repository file MIME type */
 482         'bs_db', 'bs_table', 'bs_ref', 'bs_new_mime_type',
 483     );
 484     /**
 485      * Require cleanup functions
 486      */
 487     require './libraries/cleanup.lib.php';
 488     /**
 489      * Do actual cleanup
 490      */
 491     PMA_remove_request_vars($allow_list);
 492
 493 }
 494
 495
 496 /**
 497  * current selected database
 498  * @global string $GLOBALS['db']
 499  */
 500 $GLOBALS['db'] = '';
 501 if (PMA_isValid($_REQUEST['db'])) {
 502     // can we strip tags from this?
 503     // only \ and / is not allowed in db names for MySQL
 504     $GLOBALS['db'] = $_REQUEST['db'];
 505     $GLOBALS['url_params']['db'] = $GLOBALS['db'];
 506 }
 507
 508 /**
 509  * current selected table
 510  * @global string $GLOBALS['table']
 511  */
 512 $GLOBALS['table'] = '';
 513 if (PMA_isValid($_REQUEST['table'])) {
 514     // can we strip tags from this?
 515     // only \ and / is not allowed in table names for MySQL
 516     $GLOBALS['table'] = $_REQUEST['table'];
 517     $GLOBALS['url_params']['table'] = $GLOBALS['table'];
 518 }
 519
 520 /**
 521  * Store currently selected recent table.
 522  * Affect $GLOBALS['db'] and $GLOBALS['table']
 523  */
 524 if (PMA_isValid($_REQUEST['selected_recent_table'])) {
 525     $recent_table = json_decode($_REQUEST['selected_recent_table'], true);
 526     $GLOBALS['db'] = $recent_table['db'];
 527     $GLOBALS['url_params']['db'] = $GLOBALS['db'];
 528     $GLOBALS['table'] = $recent_table['table'];
 529     $GLOBALS['url_params']['table'] = $GLOBALS['table'];
 530 }
 531
 532 /**
 533  * SQL query to be executed
 534  * @global string $GLOBALS['sql_query']
 535  */
 536 $GLOBALS['sql_query'] = '';
 537 if (PMA_isValid($_REQUEST['sql_query'])) {
 538     $GLOBALS['sql_query'] = $_REQUEST['sql_query'];
 539 }
 540
 541 /**
 542  * avoid problems in phpmyadmin.css.php in some cases
 543  * @global string $js_frame
 544  */
 545 $_REQUEST['js_frame'] = PMA_ifSetOr($_REQUEST['js_frame'], '');
 546
 547 //$_REQUEST['set_theme'] // checked later in this file LABEL_theme_setup
 548 //$_REQUEST['server']; // checked later in this file
 549 //$_REQUEST['lang'];   // checked by LABEL_loading_language_file
 550
 551
 552 /**
 553  * holds name of JavaScript files to be included in HTML header
 554  * @global array $js_include
 555  */
 556 $GLOBALS['js_include'] = array();
 557 $GLOBALS['js_include'][] = 'jquery/jquery-1.6.2.js';
 558 $GLOBALS['js_include'][] = 'jquery/jquery-ui-1.8.custom.js';
 559 $GLOBALS['js_include'][] = 'update-location.js';
 560
 561 /**
 562  * holds an array of javascript code snippets to be included in the HTML header
 563  * Can be used with PMA_AddJSCode() to pass on js variables to the browser.
 564  * @global array $js_script
 565  */
 566 $GLOBALS['js_script'] = array();
 567
 568 /**
 569  * Add common jQuery functions script here if necessary.
 570  */
 571
 572 /**
 573  * JavaScript events that will be registered
 574  * @global array $js_events
 575  */
 576 $GLOBALS['js_events'] = array();
 577
 578 /**
 579  * footnotes to be displayed ot the page bottom
 580  * @global array $footnotes
 581  */
 582 $GLOBALS['footnotes'] = array();
 583
 584 /******************************************************************************/
 585 /* loading language file                       LABEL_loading_language_file    */
 586
 587 /**
 588  * lang detection is done here
 589  */
 590 require './libraries/select_lang.lib.php';
 591
 592 /**
 593  * check for errors occurred while loading configuration
 594  * this check is done here after loading language files to present errors in locale
 595  */
 596 if ($GLOBALS['PMA_Config']->error_config_file) {
 597     $error = '<h1>' . __('Failed to read configuration file') . '</h1>'
 598         . _('This usually means there is a syntax error in it, please check any errors shown below.')
 599         . '<br />'
 600         . '<br />'
 601         . '<iframe src="show_config_errors.php" />';
 602     trigger_error($error, E_USER_ERROR);
 603 }
 604 if ($GLOBALS['PMA_Config']->error_config_default_file) {
 605     $error = sprintf(__('Could not load default configuration from: %1$s'),
 606         $GLOBALS['PMA_Config']->default_source);
 607     trigger_error($error, E_USER_ERROR);
 608 }
 609 if ($GLOBALS['PMA_Config']->error_pma_uri) {
 610     trigger_error(__('The <tt>$cfg[\'PmaAbsoluteUri\']</tt> directive MUST be set in your configuration file!'), E_USER_ERROR);
 611 }
 612
 613
 614 /******************************************************************************/
 615 /* setup servers                                       LABEL_setup_servers    */
 616
 617 /**
 618  * current server
 619  * @global integer $GLOBALS['server']
 620  */
 621 $GLOBALS['server'] = 0;
 622
 623 /**
 624  * Servers array fixups.
 625  * $default_server comes from PMA_Config::enableBc()
 626  * @todo merge into PMA_Config
 627  */
 628 // Do we have some server?
 629 if (! isset($cfg['Servers']) || count($cfg['Servers']) == 0) {
 630     // No server => create one with defaults
 631     $cfg['Servers'] = array(1 => $default_server);
 632 } else {
 633     // We have server(s) => apply default configuration
 634     $new_servers = array();
 635
 636     foreach ($cfg['Servers'] as $server_index => $each_server) {
 637
 638         // Detect wrong configuration
 639         if (!is_int($server_index) || $server_index < 1) {
 640             trigger_error(sprintf(__('Invalid server index: %s'), $server_index), E_USER_ERROR);
 641         }
 642
 643         $each_server = array_merge($default_server, $each_server);
 644
 645         // Don't use servers with no hostname
 646         if ($each_server['connect_type'] == 'tcp' && empty($each_server['host'])) {
 647             trigger_error(sprintf(__('Invalid hostname for server %1$s. Please review your configuration.'), $server_index), E_USER_ERROR);
 648         }
 649
 650         // Final solution to bug #582890
 651         // If we are using a socket connection
 652         // and there is nothing in the verbose server name
 653         // or the host field, then generate a name for the server
 654         // in the form of "Server 2", localized of course!
 655         if ($each_server['connect_type'] == 'socket' && empty($each_server['host']) && empty($each_server['verbose'])) {
 656             $each_server['verbose'] = __('Server') . $server_index;
 657         }
 658
 659         $new_servers[$server_index] = $each_server;
 660     }
 661     $cfg['Servers'] = $new_servers;
 662     unset($new_servers, $server_index, $each_server);
 663 }
 664
 665 // Cleanup
 666 unset($default_server);
 667
 668
 669 /******************************************************************************/
 670 /* setup themes                                          LABEL_theme_setup    */
 671
 672 /**
 673  * @global PMA_Theme_Manager $_SESSION['PMA_Theme_Manager']
 674  */
 675 if (! isset($_SESSION['PMA_Theme_Manager'])) {
 676     $_SESSION['PMA_Theme_Manager'] = new PMA_Theme_Manager;
 677 } else {
 678     /**
 679      * @todo move all __wakeup() functionality into session.inc.php
 680      */
 681     $_SESSION['PMA_Theme_Manager']->checkConfig();
 682 }
 683
 684 // for the theme per server feature
 685 if (isset($_REQUEST['server']) && ! isset($_REQUEST['set_theme'])) {
 686     $GLOBALS['server'] = $_REQUEST['server'];
 687     $tmp = $_SESSION['PMA_Theme_Manager']->getThemeCookie();
 688     if (empty($tmp)) {
 689         $tmp = $_SESSION['PMA_Theme_Manager']->theme_default;
 690     }
 691     $_SESSION['PMA_Theme_Manager']->setActiveTheme($tmp);
 692     unset($tmp);
 693 }
 694 /**
 695  * @todo move into PMA_Theme_Manager::__wakeup()
 696  */
 697 if (isset($_REQUEST['set_theme'])) {
 698     // if user selected a theme
 699     $_SESSION['PMA_Theme_Manager']->setActiveTheme($_REQUEST['set_theme']);
 700 }
 701
 702 /**
 703  * the theme object
 704  * @global PMA_Theme $_SESSION['PMA_Theme']
 705  */
 706 $_SESSION['PMA_Theme'] = $_SESSION['PMA_Theme_Manager']->theme;
 707
 708 // BC
 709 /**
 710  * the active theme
 711  * @global string $GLOBALS['theme']
 712  */
 713 $GLOBALS['theme']           = $_SESSION['PMA_Theme']->getName();
 714 /**
 715  * the theme path
 716  * @global string $GLOBALS['pmaThemePath']
 717  */
 718 $GLOBALS['pmaThemePath']    = $_SESSION['PMA_Theme']->getPath();
 719 /**
 720  * the theme image path
 721  * @global string $GLOBALS['pmaThemeImage']
 722  */
 723 $GLOBALS['pmaThemeImage']   = $_SESSION['PMA_Theme']->getImgPath();
 724
 725 /**
 726  * load layout file if exists
 727  */
 728 if (@file_exists($_SESSION['PMA_Theme']->getLayoutFile())) {
 729     include $_SESSION['PMA_Theme']->getLayoutFile();
 730     /**
 731      * @todo remove if all themes are update use Navi instead of Left as frame name
 732      */
 733     if (! isset($GLOBALS['cfg']['NaviWidth'])
 734      && isset($GLOBALS['cfg']['LeftWidth'])) {
 735         $GLOBALS['cfg']['NaviWidth'] = $GLOBALS['cfg']['LeftWidth'];
 736     }
 737 }
 738
 739 if (! defined('PMA_MINIMUM_COMMON')) {
 740     /**
 741      * Character set conversion.
 742      */
 743     require_once './libraries/charset_conversion.lib.php';
 744
 745     /**
 746      * String handling
 747      */
 748     require_once './libraries/string.lib.php';
 749
 750     /**
 751      * Lookup server by name
 752      * (see FAQ 4.8)
 753      */
 754     if (! empty($_REQUEST['server']) && is_string($_REQUEST['server'])
 755      && ! is_numeric($_REQUEST['server'])) {
 756         foreach ($cfg['Servers'] as $i => $server) {
 757             if ($server['host'] == $_REQUEST['server']) {
 758                 $_REQUEST['server'] = $i;
 759                 break;
 760             }
 761         }
 762         if (is_string($_REQUEST['server'])) {
 763             unset($_REQUEST['server']);
 764         }
 765         unset($i);
 766     }
 767
 768     /**
 769      * If no server is selected, make sure that $cfg['Server'] is empty (so
 770      * that nothing will work), and skip server authentication.
 771      * We do NOT exit here, but continue on without logging into any server.
 772      * This way, the welcome page will still come up (with no server info) and
 773      * present a choice of servers in the case that there are multiple servers
 774      * and '$cfg['ServerDefault'] = 0' is set.
 775      */
 776
 777     if (isset($_REQUEST['server']) && (is_string($_REQUEST['server']) || is_numeric($_REQUEST['server'])) && ! empty($_REQUEST['server']) && ! empty($cfg['Servers'][$_REQUEST['server']])) {
 778         $GLOBALS['server'] = $_REQUEST['server'];
 779         $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
 780     } else {
 781         if (!empty($cfg['Servers'][$cfg['ServerDefault']])) {
 782             $GLOBALS['server'] = $cfg['ServerDefault'];
 783             $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
 784         } else {
 785             $GLOBALS['server'] = 0;
 786             $cfg['Server'] = array();
 787         }
 788     }
 789     $GLOBALS['url_params']['server'] = $GLOBALS['server'];
 790
 791     /**
 792      * Kanji encoding convert feature appended by Y.Kawada (2002/2/20)
 793      */
 794     if (function_exists('mb_convert_encoding')
 795      && $lang == 'ja') {
 796         require_once './libraries/kanji-encoding.lib.php';
 797     } // end if
 798
 799     /**
 800      * save some settings in cookies
 801      * @todo should be done in PMA_Config
 802      */
 803     $GLOBALS['PMA_Config']->setCookie('pma_lang', $GLOBALS['lang']);
 804     $GLOBALS['PMA_Config']->setCookie('pma_collation_connection', $GLOBALS['collation_connection']);
 805
 806     $_SESSION['PMA_Theme_Manager']->setThemeCookie();
 807
 808     if (! empty($cfg['Server'])) {
 809
 810         /**
 811          * Loads the proper database interface for this server
 812          */
 813         require_once './libraries/database_interface.lib.php';
 814
 815         require_once './libraries/logging.lib.php';
 816
 817         // get LoginCookieValidity from preferences cache
 818         // no generic solution for loading preferences from cache as some settings need to be kept
 819         // for processing in PMA_Config::loadUserPreferences()
 820         $cache_key = 'server_' . $GLOBALS['server'];
 821         if (isset($_SESSION['cache'][$cache_key]['userprefs']['LoginCookieValidity'])) {
 822             $value = $_SESSION['cache'][$cache_key]['userprefs']['LoginCookieValidity'];
 823             $GLOBALS['PMA_Config']->set('LoginCookieValidity', $value);
 824             $GLOBALS['cfg']['LoginCookieValidity'] = $value;
 825             unset($value);
 826         }
 827         unset($cache_key);
 828
 829         // Gets the authentication library that fits the $cfg['Server'] settings
 830         // and run authentication
 831
 832         // to allow HTTP or http
 833         $cfg['Server']['auth_type'] = strtolower($cfg['Server']['auth_type']);
 834         if (! file_exists('./libraries/auth/' . $cfg['Server']['auth_type'] . '.auth.lib.php')) {
 835             PMA_fatalError(__('Invalid authentication method set in configuration:') . ' ' . $cfg['Server']['auth_type']);
 836         }
 837         /**
 838          * the required auth type plugin
 839          */
 840         require_once './libraries/auth/' . $cfg['Server']['auth_type'] . '.auth.lib.php';
 841         if (!PMA_auth_check()) {
 842             /* Force generating of new session on login */
 843             PMA_secureSession();
 844             PMA_auth();
 845         } else {
 846             PMA_auth_set_user();
 847         }
 848
 849          // Check IP-based Allow/Deny rules as soon as possible to reject the
 850         // user
 851         // Based on mod_access in Apache:
 852         // http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/aaa/mod_access.c?rev=1.37&content-type=text/vnd.viewcvs-markup
 853         // Look at: "static int check_dir_access(request_rec *r)"
 854         if (isset($cfg['Server']['AllowDeny'])
 855                 && isset($cfg['Server']['AllowDeny']['order'])) {
 856
 857             /**
 858              * ip based access library
 859              */
 860             require_once './libraries/ip_allow_deny.lib.php';
 861
 862             $allowDeny_forbidden         = false; // default
 863             if ($cfg['Server']['AllowDeny']['order'] == 'allow,deny') {
 864                 $allowDeny_forbidden     = true;
 865                 if (PMA_allowDeny('allow')) {
 866                     $allowDeny_forbidden = false;
 867                 }
 868                 if (PMA_allowDeny('deny')) {
 869                     $allowDeny_forbidden = true;
 870                 }
 871             } elseif ($cfg['Server']['AllowDeny']['order'] == 'deny,allow') {
 872                 if (PMA_allowDeny('deny')) {
 873                     $allowDeny_forbidden = true;
 874                 }
 875                 if (PMA_allowDeny('allow')) {
 876                     $allowDeny_forbidden = false;
 877                 }
 878             } elseif ($cfg['Server']['AllowDeny']['order'] == 'explicit') {
 879                 if (PMA_allowDeny('allow')
 880                   && !PMA_allowDeny('deny')) {
 881                     $allowDeny_forbidden = false;
 882                 } else {
 883                     $allowDeny_forbidden = true;
 884                 }
 885             } // end if ... elseif ... elseif
 886
 887             // Ejects the user if banished
 888             if ($allowDeny_forbidden) {
 889                 PMA_log_user($cfg['Server']['user'], 'allow-denied');
 890                 PMA_auth_fails();
 891             }
 892             unset($allowDeny_forbidden); //Clean up after you!
 893         } // end if
 894
 895         // is root allowed?
 896         if (!$cfg['Server']['AllowRoot'] && $cfg['Server']['user'] == 'root') {
 897             $allowDeny_forbidden = true;
 898             PMA_log_user($cfg['Server']['user'], 'root-denied');
 899             PMA_auth_fails();
 900             unset($allowDeny_forbidden); //Clean up after you!
 901         }
 902
 903         // is a login without password allowed?
 904         if (!$cfg['Server']['AllowNoPassword'] && $cfg['Server']['password'] == '') {
 905             $login_without_password_is_forbidden = true;
 906             PMA_log_user($cfg['Server']['user'], 'empty-denied');
 907             PMA_auth_fails();
 908             unset($login_without_password_is_forbidden); //Clean up after you!
 909         }
 910
 911         // if using TCP socket is not needed
 912         if (strtolower($cfg['Server']['connect_type']) == 'tcp') {
 913             $cfg['Server']['socket'] = '';
 914         }
 915
 916         // Try to connect MySQL with the control user profile (will be used to
 917         // get the privileges list for the current user but the true user link
 918         // must be open after this one so it would be default one for all the
 919         // scripts)
 920         $controllink = false;
 921         if ($cfg['Server']['controluser'] != '') {
 922             $controllink = PMA_DBI_connect($cfg['Server']['controluser'],
 923                 $cfg['Server']['controlpass'], true);
 924         }
 925
 926         // Connects to the server (validates user's login)
 927         $userlink = PMA_DBI_connect($cfg['Server']['user'],
 928             $cfg['Server']['password'], false);
 929
 930         if (! $controllink) {
 931             $controllink = $userlink;
 932         }
 933
 934         /* Log success */
 935         PMA_log_user($cfg['Server']['user']);
 936
 937         /**
 938          * with phpMyAdmin 3 we support MySQL >=5
 939          * but only production releases:
 940          *  - > 5.0.15
 941          */
 942         if (PMA_MYSQL_INT_VERSION < 50015) {
 943             PMA_fatalError(__('You should upgrade to %s %s or later.'), array('MySQL', '5.0.15'));
 944         }
 945
 946         /**
 947          * SQL Parser code
 948          */
 949         require_once './libraries/sqlparser.lib.php';
 950
 951         /**
 952          * SQL Validator interface code
 953          */
 954         require_once './libraries/sqlvalidator.lib.php';
 955
 956         /**
 957          * the PMA_List_Database class
 958          */
 959         require_once './libraries/PMA.php';
 960         $pma = new PMA;
 961         $pma->userlink = $userlink;
 962         $pma->controllink = $controllink;
 963
 964         /**
 965          * some resetting has to be done when switching servers
 966          */
 967         if (isset($_SESSION['tmp_user_values']['previous_server']) && $_SESSION['tmp_user_values']['previous_server'] != $GLOBALS['server']) {
 968             unset($_SESSION['tmp_user_values']['navi_limit_offset']);
 969         }
 970         $_SESSION['tmp_user_values']['previous_server'] = $GLOBALS['server'];
 971
 972     } // end server connecting
 973
 974     /**
 975      * check if profiling was requested and remember it
 976      * (note: when $cfg['ServerDefault'] = 0, constant is not defined)
 977      */
 978     if (isset($_REQUEST['profiling']) && PMA_profilingSupported()) {
 979         $_SESSION['profiling'] = true;
 980     } elseif (isset($_REQUEST['profiling_form'])) {
 981         // the checkbox was unchecked
 982         unset($_SESSION['profiling']);
 983     }
 984
 985     // library file for blobstreaming
 986     require_once './libraries/blobstreaming.lib.php';
 987
 988     // checks for blobstreaming plugins and databases that support
 989     // blobstreaming (by having the necessary tables for blobstreaming)
 990     checkBLOBStreamingPlugins();
 991
 992 } // end if !defined('PMA_MINIMUM_COMMON')
 993
 994 // load user preferences
 995 $GLOBALS['PMA_Config']->loadUserPreferences();
 996
 997 // remove sensitive values from session
 998 $GLOBALS['PMA_Config']->set('blowfish_secret', '');
 999 $GLOBALS['PMA_Config']->set('Servers', '');
1000 $GLOBALS['PMA_Config']->set('default_server', '');
1001
1002 /* Tell tracker that it can actually work */
1003 PMA_Tracker::enable();
1004
1005 /**
1006  * @global boolean $GLOBALS['is_ajax_request']
1007  * @todo should this be moved to the variables init section above?
1008  *
1009  * Check if the current request is an AJAX request, and set is_ajax_request
1010  * accordingly.  Suppress headers, footers and unnecessary output if set to
1011  * true
1012  */
1013 if (isset($_REQUEST['ajax_request']) && $_REQUEST['ajax_request'] == true) {
1014     $GLOBALS['is_ajax_request'] = true;
1015 } else {
1016     $GLOBALS['is_ajax_request'] = false;
1017 }
1018
1019 /**
1020  * @global  boolean $GLOBALS['grid_edit']
1021  *
1022  * Set to true if this is a request made during an grid edit process.  This
1023  * request is made to retrieve the non-truncated/transformed values.
1024  */
1025 if (isset($_REQUEST['grid_edit']) && $_REQUEST['grid_edit'] == true) {
1026     $GLOBALS['grid_edit'] = true;
1027 }
1028 else {
1029     $GLOBALS['grid_edit'] = false;
1030 }
1031
1032 if (!empty($__redirect) && in_array($__redirect, $goto_whitelist)) {
1033     /**
1034      * include subform target page
1035      */
1036     require $__redirect;
1037     exit();
1038 }
1039 ?>