phpmyadmin/libraries/common.inc.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * Misc stuff and REQUIRED by ALL the scripts.
   5  * MUST be included by every script
   6  *
   7  * Among other things, it contains the advanced authentication work.
   8  *
   9  * Order of sections for common.inc.php:
  10  *
  11  * LABEL_variables_init
  12  *  - initialize some variables always needed
  13  * LABEL_parsing_config_file
  14  *  - parsing of the configuration file
  15  * LABEL_loading_language_file
  16  *  - loading language file
  17  * LABEL_theme_setup
  18  *  - setting up themes
  19  *
  20  * - load of MySQL extension (if necessary)
  21  * - loading of an authentication library
  22  * - db connection
  23  * - authentication work
  24  *
  25  * @version $Id$
  26  */
  27
  28 /**
  29  * For now, avoid warnings of E_STRICT mode
  30  * (this must be done before function definitions)
  31  */
  32 if (defined('E_STRICT')) {
  33     $old_error_reporting = error_reporting(0);
  34     if ($old_error_reporting & E_STRICT) {
  35         error_reporting($old_error_reporting ^ E_STRICT);
  36     } else {
  37         error_reporting($old_error_reporting);
  38     }
  39     unset($old_error_reporting);
  40 }
  41
  42 // at this point PMA_PHP_INT_VERSION is not yet defined
  43 if (version_compare(phpversion(), '6', 'lt')) {
  44     /**
  45      * Avoid object cloning errors
  46      */
  47     @ini_set('zend.ze1_compatibility_mode', false);
  48
  49     /**
  50      * Avoid problems with magic_quotes_runtime
  51      */
  52     @ini_set('magic_quotes_runtime', false);
  53 }
  54
  55 /**
  56  * for verification in all procedural scripts under libraries
  57  */
  58 define('PHPMYADMIN', true);
  59
  60 /**
  61  * core functions
  62  */
  63 require_once './libraries/core.lib.php';
  64
  65 /**
  66  * Input sanitizing
  67  */
  68 require_once './libraries/sanitizing.lib.php';
  69
  70 /**
  71  * the PMA_Theme class
  72  */
  73 require_once './libraries/Theme.class.php';
  74
  75 /**
  76  * the PMA_Theme_Manager class
  77  */
  78 require_once './libraries/Theme_Manager.class.php';
  79
  80 /**
  81  * the PMA_Config class
  82  */
  83 require_once './libraries/Config.class.php';
  84
  85 /**
  86  * the PMA_Table class
  87  */
  88 require_once './libraries/Table.class.php';
  89
  90 if (!defined('PMA_MINIMUM_COMMON')) {
  91     /**
  92      * common functions
  93      */
  94     require_once './libraries/common.lib.php';
  95
  96     /**
  97      * Java script escaping.
  98      */
  99     require_once './libraries/js_escape.lib.php';
 100
 101     /**
 102      * Include URL/hidden inputs generating.
 103      */
 104     require_once './libraries/url_generating.lib.php';
 105 }
 106
 107 /******************************************************************************/
 108 /* start procedural code                       label_start_procedural         */
 109
 110 /**
 111  * protect against older PHP versions' bug about GLOBALS overwrite
 112  * (no need to localize this message :))
 113  * but what if script.php?GLOBALS[admin]=1&GLOBALS[_REQUEST]=1 ???
 114  */
 115 if (isset($_REQUEST['GLOBALS']) || isset($_FILES['GLOBALS'])
 116   || isset($_SERVER['GLOBALS']) || isset($_COOKIE['GLOBALS'])
 117   || isset($_ENV['GLOBALS'])) {
 118     die('GLOBALS overwrite attempt');
 119 }
 120
 121 /**
 122  * protect against possible exploits - there is no need to have so much variables
 123  */
 124 if (count($_REQUEST) > 1000) {
 125     die('possible exploit');
 126 }
 127
 128 /**
 129  * Check for numeric keys
 130  * (if register_globals is on, numeric key can be found in $GLOBALS)
 131  */
 132 foreach ($GLOBALS as $key => $dummy) {
 133     if (is_numeric($key)) {
 134         die('numeric key detected');
 135     }
 136 }
 137 unset($dummy);
 138
 139 /**
 140  * PATH_INFO could be compromised if set, so remove it from PHP_SELF
 141  * and provide a clean PHP_SELF here
 142  */
 143 $PMA_PHP_SELF = PMA_getenv('PHP_SELF');
 144 $_PATH_INFO = PMA_getenv('PATH_INFO');
 145 if (! empty($_PATH_INFO) && ! empty($PMA_PHP_SELF)) {
 146     $path_info_pos = strrpos($PMA_PHP_SELF, $_PATH_INFO);
 147     if ($path_info_pos + strlen($_PATH_INFO) === strlen($PMA_PHP_SELF)) {
 148         $PMA_PHP_SELF = substr($PMA_PHP_SELF, 0, $path_info_pos);
 149     }
 150 }
 151 $PMA_PHP_SELF = htmlspecialchars($PMA_PHP_SELF);
 152
 153
 154 /**
 155  * just to be sure there was no import (registering) before here
 156  * we empty the global space (but avoid unsetting $variables_list
 157  * and $key in the foreach(), we still need them!)
 158  */
 159 $variables_whitelist = array (
 160     'GLOBALS',
 161     '_SERVER',
 162     '_GET',
 163     '_POST',
 164     '_REQUEST',
 165     '_FILES',
 166     '_ENV',
 167     '_COOKIE',
 168     '_SESSION',
 169     'PMA_PHP_SELF',
 170     'variables_whitelist',
 171     'key'
 172 );
 173
 174 foreach (get_defined_vars() as $key => $value) {
 175     if (! in_array($key, $variables_whitelist)) {
 176         unset($$key);
 177     }
 178 }
 179 unset($key, $value, $variables_whitelist);
 180
 181
 182 /**
 183  * Subforms - some functions need to be called by form, cause of the limited URL
 184  * length, but if this functions inside another form you cannot just open a new
 185  * form - so phpMyAdmin uses 'arrays' inside this form
 186  *
 187  * <code>
 188  * <form ...>
 189  * ... main form elments ...
 190  * <input type="hidden" name="subform[action1][id]" value="1" />
 191  * ... other subform data ...
 192  * <input type="submit" name="usesubform[action1]" value="do action1" />
 193  * ... other subforms ...
 194  * <input type="hidden" name="subform[actionX][id]" value="X" />
 195  * ... other subform data ...
 196  * <input type="submit" name="usesubform[actionX]" value="do actionX" />
 197  * ... main form elments ...
 198  * <input type="submit" name="main_action" value="submit form" />
 199  * </form>
 200  * </code
 201  *
 202  * so we now check if a subform is submitted
 203  */
 204 $__redirect = null;
 205 if (isset($_POST['usesubform'])) {
 206     // if a subform is present and should be used
 207     // the rest of the form is deprecated
 208     $subform_id = key($_POST['usesubform']);
 209     $subform    = $_POST['subform'][$subform_id];
 210     $_POST      = $subform;
 211     $_REQUEST   = $subform;
 212     /**
 213      * some subforms need another page than the main form, so we will just
 214      * include this page at the end of this script - we use $__redirect to
 215      * track this
 216      */
 217     if (isset($_POST['redirect'])
 218       && $_POST['redirect'] != basename($PMA_PHP_SELF)) {
 219         $__redirect = $_POST['redirect'];
 220         unset($_POST['redirect']);
 221     }
 222     unset($subform_id, $subform);
 223 } else {
 224     // Note: here we overwrite $_REQUEST so that it does not contain cookies,
 225     // because another application for the same domain could have set
 226     // a cookie (with a compatible path) that overrides a variable
 227     // we expect from GET or POST.
 228     // We'll refer to cookies explicitly with the $_COOKIE syntax.
 229     $_REQUEST = array_merge($_GET, $_POST);
 230 }
 231 // end check if a subform is submitted
 232
 233 // remove quotes added by php
 234 // (get_magic_quotes_gpc() is deprecated in PHP 5.3, but compare with 5.2.99
 235 // to be able to test with 5.3.0-dev)
 236 if (function_exists('get_magic_quotes_gpc') && -1 == version_compare(PHP_VERSION, '5.2.99') && get_magic_quotes_gpc()) {
 237     PMA_arrayWalkRecursive($_GET, 'stripslashes', true);
 238     PMA_arrayWalkRecursive($_POST, 'stripslashes', true);
 239     PMA_arrayWalkRecursive($_COOKIE, 'stripslashes', true);
 240     PMA_arrayWalkRecursive($_REQUEST, 'stripslashes', true);
 241 }
 242
 243 /**
 244  * clean cookies on new install or upgrade
 245  * when changing something with increment the cookie version
 246  */
 247 /*
 248 $pma_cookie_version = 4;
 249 if (isset($_COOKIE)
 250  && (! isset($_COOKIE['pmaCookieVer'])
 251   || $_COOKIE['pmaCookieVer'] < $pma_cookie_version)) {
 252     // delete all cookies
 253     foreach($_COOKIE as $cookie_name => $tmp) {
 254         PMA_removeCookie($cookie_name);
 255     }
 256     $_COOKIE = array();
 257     PMA_setCookie('pmaCookieVer', $pma_cookie_version);
 258 }
 259 */
 260 /**
 261  * include deprecated grab_globals only if required
 262  */
 263 if (empty($__redirect) && !defined('PMA_NO_VARIABLES_IMPORT')) {
 264     require './libraries/grab_globals.lib.php';
 265 }
 266
 267 /**
 268  * include session handling after the globals, to prevent overwriting
 269  */
 270 require_once './libraries/session.inc.php';
 271
 272 /**
 273  * init some variables LABEL_variables_init
 274  */
 275
 276 /**
 277  * holds errors
 278  * @global array $GLOBALS['PMA_errors']
 279  */
 280 $GLOBALS['PMA_errors'] = array();
 281
 282 /**
 283  * holds parameters to be passed to next page
 284  * @global array $GLOBALS['url_params']
 285  */
 286 $GLOBALS['url_params'] = array();
 287
 288 /**
 289  * the whitelist for $GLOBALS['goto']
 290  * @global array $goto_whitelist
 291  */
 292 $goto_whitelist = array(
 293     //'browse_foreigners.php',
 294     //'calendar.php',
 295     //'changelog.php',
 296     //'chk_rel.php',
 297     'db_create.php',
 298     'db_datadict.php',
 299     'db_sql.php',
 300     'db_export.php',
 301     'db_importdocsql.php',
 302     'db_qbe.php',
 303     'db_structure.php',
 304     'db_import.php',
 305     'db_operations.php',
 306     'db_printview.php',
 307     'db_search.php',
 308     //'Documentation.html',
 309     //'error.php',
 310     'export.php',
 311     'import.php',
 312     //'index.php',
 313     //'navigation.php',
 314     //'license.php',
 315     'main.php',
 316     'pdf_pages.php',
 317     'pdf_schema.php',
 318     //'phpinfo.php',
 319     'querywindow.php',
 320     //'readme.php',
 321     'server_binlog.php',
 322     'server_collations.php',
 323     'server_databases.php',
 324     'server_engines.php',
 325     'server_export.php',
 326     'server_import.php',
 327     'server_privileges.php',
 328     'server_processlist.php',
 329     'server_sql.php',
 330     'server_status.php',
 331     'server_variables.php',
 332     'sql.php',
 333     'tbl_addfield.php',
 334     'tbl_alter.php',
 335     'tbl_change.php',
 336     'tbl_create.php',
 337     'tbl_import.php',
 338     'tbl_indexes.php',
 339     'tbl_move_copy.php',
 340     'tbl_printview.php',
 341     'tbl_sql.php',
 342     'tbl_export.php',
 343     'tbl_operations.php',
 344     'tbl_structure.php',
 345     'tbl_relation.php',
 346     'tbl_replace.php',
 347     'tbl_row_action.php',
 348     'tbl_select.php',
 349     //'themes.php',
 350     'transformation_overview.php',
 351     'transformation_wrapper.php',
 352     'translators.html',
 353     'user_password.php',
 354 );
 355
 356 /**
 357  * check $__redirect against whitelist
 358  */
 359 if (! PMA_checkPageValidity($__redirect, $goto_whitelist)) {
 360     $__redirect = null;
 361 }
 362
 363 /**
 364  * holds page that should be displayed
 365  * @global string $GLOBALS['goto']
 366  */
 367 $GLOBALS['goto'] = '';
 368 // Security fix: disallow accessing serious server files via "?goto="
 369 if (PMA_checkPageValidity($_REQUEST['goto'], $goto_whitelist)) {
 370     $GLOBALS['goto'] = $_REQUEST['goto'];
 371     $GLOBALS['url_params']['goto'] = $_REQUEST['goto'];
 372 } else {
 373     unset($_REQUEST['goto'], $_GET['goto'], $_POST['goto'], $_COOKIE['goto']);
 374 }
 375
 376 /**
 377  * returning page
 378  * @global string $GLOBALS['back']
 379  */
 380 if (PMA_checkPageValidity($_REQUEST['back'], $goto_whitelist)) {
 381     $GLOBALS['back'] = $_REQUEST['back'];
 382 } else {
 383     unset($_REQUEST['back'], $_GET['back'], $_POST['back'], $_COOKIE['back']);
 384 }
 385
 386 /**
 387  * Check whether user supplied token is valid, if not remove any possibly
 388  * dangerous stuff from request.
 389  *
 390  * remember that some objects in the session with session_start and __wakeup()
 391  * could access this variables before we reach this point
 392  * f.e. PMA_Config: fontsize
 393  *
 394  * @todo variables should be handled by their respective owners (objects)
 395  * f.e. lang, server, convcharset, collation_connection in PMA_Config
 396  */
 397 if (! PMA_isValid($_REQUEST['token']) || $_SESSION[' PMA_token '] != $_REQUEST['token']) {
 398     /**
 399      *  List of parameters which are allowed from unsafe source
 400      */
 401     $allow_list = array(
 402         /* needed for direct access, see FAQ 1.34
 403          * also, server needed for cookie login screen (multi-server)
 404          */
 405         'server', 'db', 'table', 'target',
 406         /* to change the language on login screen or main page */
 407         'lang',
 408         /* Session ID */
 409         'phpMyAdmin',
 410         /* Cookie preferences */
 411         'pma_lang', 'pma_charset', 'pma_collation_connection',
 412         /* Possible login form */
 413         'pma_servername', 'pma_username', 'pma_password',
 414     );
 415     /**
 416      * Require cleanup functions
 417      */
 418     require_once './libraries/cleanup.lib.php';
 419     /**
 420      * Do actual cleanup
 421      */
 422     PMA_remove_request_vars($allow_list);
 423
 424 }
 425
 426
 427 /**
 428  * @global string $convcharset
 429  * @see select_lang.lib.php
 430  */
 431 if (isset($_REQUEST['convcharset'])) {
 432     $convcharset = strip_tags($_REQUEST['convcharset']);
 433 }
 434
 435 /**
 436  * current selected database
 437  * @global string $GLOBALS['db']
 438  */
 439 $GLOBALS['db'] = '';
 440 if (PMA_isValid($_REQUEST['db'])) {
 441     // can we strip tags from this?
 442     // only \ and / is not allowed in db names for MySQL
 443     $GLOBALS['db'] = $_REQUEST['db'];
 444     $GLOBALS['url_params']['db'] = $GLOBALS['db'];
 445 }
 446
 447 /**
 448  * current selected table
 449  * @global string $GLOBALS['table']
 450  */
 451 $GLOBALS['table'] = '';
 452 if (PMA_isValid($_REQUEST['table'])) {
 453     // can we strip tags from this?
 454     // only \ and / is not allowed in table names for MySQL
 455     $GLOBALS['table'] = $_REQUEST['table'];
 456     $GLOBALS['url_params']['table'] = $GLOBALS['table'];
 457 }
 458
 459 /**
 460  * SQL query to be executed
 461  * @global string $GLOBALS['sql_query']
 462  */
 463 $GLOBALS['sql_query'] = '';
 464 if (PMA_isValid($_REQUEST['sql_query'])) {
 465     $GLOBALS['sql_query'] = $_REQUEST['sql_query'];
 466 }
 467
 468 /**
 469  * avoid problems in phpmyadmin.css.php in some cases
 470  * @global string $js_frame
 471  */
 472 $_REQUEST['js_frame'] = PMA_ifSetOr($_REQUEST['js_frame'], '');
 473
 474 //$_REQUEST['set_theme'] // checked later in this file LABEL_theme_setup
 475 //$_REQUEST['server']; // checked later in this file
 476 //$_REQUEST['lang'];   // checked by LABEL_loading_language_file
 477
 478
 479
 480 /******************************************************************************/
 481 /* parsing configuration file                         LABEL_parsing_config_file      */
 482
 483 /**
 484  * We really need this one!
 485  */
 486 if (! function_exists('preg_replace')) {
 487     PMA_fatalError('strCantLoad', 'pcre');
 488 }
 489
 490 /**
 491  * @global PMA_Config $_SESSION['PMA_Config']
 492  * force reading of config file, because we removed sensitive values
 493  * in the previous iteration
 494  */
 495 $_SESSION['PMA_Config'] = new PMA_Config('./config.inc.php');
 496
 497 if (!defined('PMA_MINIMUM_COMMON')) {
 498     $_SESSION['PMA_Config']->checkPmaAbsoluteUri();
 499 }
 500
 501 /**
 502  * BC - enable backward compatibility
 503  * exports all configuration settings into $GLOBALS ($GLOBALS['cfg'])
 504  */
 505 $_SESSION['PMA_Config']->enableBc();
 506
 507
 508 /**
 509  * check HTTPS connection
 510  */
 511 if ($_SESSION['PMA_Config']->get('ForceSSL')
 512   && !$_SESSION['PMA_Config']->get('is_https')) {
 513     PMA_sendHeaderLocation(
 514         preg_replace('/^http/', 'https',
 515             $_SESSION['PMA_Config']->get('PmaAbsoluteUri'))
 516         . PMA_generate_common_url($_GET));
 517     exit;
 518 }
 519
 520
 521 /******************************************************************************/
 522 /* loading language file                       LABEL_loading_language_file    */
 523
 524 /**
 525  * Added messages while developing:
 526  */
 527 if (file_exists('./lang/added_messages.php')) {
 528     include './lang/added_messages.php';
 529 }
 530
 531 /**
 532  * Includes the language file if it hasn't been included yet
 533  */
 534 require './libraries/language.lib.php';
 535
 536
 537 /**
 538  * check for errors occurred while loading configuration
 539  * this check is done here after loading language files to present errors in locale
 540  */
 541 if ($_SESSION['PMA_Config']->error_config_file) {
 542     $GLOBALS['PMA_errors'][] = $strConfigFileError
 543         . '<br /><br />'
 544         . ($_SESSION['PMA_Config']->getSource() == './config.inc.php' ?
 545         '<a href="show_config_errors.php"'
 546         .' target="_blank">' . $_SESSION['PMA_Config']->getSource() . '</a>'
 547         :
 548         '<a href="' . $_SESSION['PMA_Config']->getSource() . '"'
 549         .' target="_blank">' . $_SESSION['PMA_Config']->getSource() . '</a>');
 550 }
 551 if ($_SESSION['PMA_Config']->error_config_default_file) {
 552     $GLOBALS['PMA_errors'][] = sprintf($strConfigDefaultFileError,
 553         $_SESSION['PMA_Config']->default_source);
 554 }
 555 if ($_SESSION['PMA_Config']->error_pma_uri) {
 556     $GLOBALS['PMA_errors'][] = sprintf($strPmaUriError);
 557 }
 558
 559 /**
 560  * current server
 561  * @global integer $GLOBALS['server']
 562  */
 563 $GLOBALS['server'] = 0;
 564
 565 /**
 566  * Servers array fixups.
 567  * $default_server comes from PMA_Config::enableBc()
 568  * @todo merge into PMA_Config
 569  */
 570 // Do we have some server?
 571 if (!isset($cfg['Servers']) || count($cfg['Servers']) == 0) {
 572     // No server => create one with defaults
 573     $cfg['Servers'] = array(1 => $default_server);
 574 } else {
 575     // We have server(s) => apply default configuration
 576     $new_servers = array();
 577
 578     foreach ($cfg['Servers'] as $server_index => $each_server) {
 579
 580         // Detect wrong configuration
 581         if (!is_int($server_index) || $server_index < 1) {
 582             $GLOBALS['PMA_errors'][] = sprintf($strInvalidServerIndex, $server_index);
 583         }
 584
 585         $each_server = array_merge($default_server, $each_server);
 586
 587         // Don't use servers with no hostname
 588         if ($each_server['connect_type'] == 'tcp' && empty($each_server['host'])) {
 589             $GLOBALS['PMA_errors'][] = sprintf($strInvalidServerHostname, $server_index);
 590         }
 591
 592         // Final solution to bug #582890
 593         // If we are using a socket connection
 594         // and there is nothing in the verbose server name
 595         // or the host field, then generate a name for the server
 596         // in the form of "Server 2", localized of course!
 597         if ($each_server['connect_type'] == 'socket' && empty($each_server['host']) && empty($each_server['verbose'])) {
 598             $each_server['verbose'] = $GLOBALS['strServer'] . $server_index;
 599         }
 600
 601         $new_servers[$server_index] = $each_server;
 602     }
 603     $cfg['Servers'] = $new_servers;
 604     unset($new_servers, $server_index, $each_server);
 605 }
 606
 607 // Cleanup
 608 unset($default_server);
 609
 610
 611 /******************************************************************************/
 612 /* setup themes                                          LABEL_theme_setup    */
 613
 614 /**
 615  * @global PMA_Theme_Manager $_SESSION['PMA_Theme_Manager']
 616  */
 617 if (! isset($_SESSION['PMA_Theme_Manager'])) {
 618     $_SESSION['PMA_Theme_Manager'] = new PMA_Theme_Manager;
 619 } else {
 620     /**
 621      * @todo move all __wakeup() functionality into session.inc.php
 622      */
 623     $_SESSION['PMA_Theme_Manager']->checkConfig();
 624 }
 625
 626 // for the theme per server feature
 627 if (isset($_REQUEST['server']) && !isset($_REQUEST['set_theme'])) {
 628     $GLOBALS['server'] = $_REQUEST['server'];
 629     $tmp = $_SESSION['PMA_Theme_Manager']->getThemeCookie();
 630     if (empty($tmp)) {
 631         $tmp = $_SESSION['PMA_Theme_Manager']->theme_default;
 632     }
 633     $_SESSION['PMA_Theme_Manager']->setActiveTheme($tmp);
 634     unset($tmp);
 635 }
 636 /**
 637  * @todo move into PMA_Theme_Manager::__wakeup()
 638  */
 639 if (isset($_REQUEST['set_theme'])) {
 640     // if user selected a theme
 641     $_SESSION['PMA_Theme_Manager']->setActiveTheme($_REQUEST['set_theme']);
 642 }
 643
 644 /**
 645  * the theme object
 646  * @global PMA_Theme $_SESSION['PMA_Theme']
 647  */
 648 $_SESSION['PMA_Theme'] = $_SESSION['PMA_Theme_Manager']->theme;
 649
 650 // BC
 651 /**
 652  * the active theme
 653  * @global string $GLOBALS['theme']
 654  */
 655 $GLOBALS['theme']           = $_SESSION['PMA_Theme']->getName();
 656 /**
 657  * the theme path
 658  * @global string $GLOBALS['pmaThemePath']
 659  */
 660 $GLOBALS['pmaThemePath']    = $_SESSION['PMA_Theme']->getPath();
 661 /**
 662  * the theme image path
 663  * @global string $GLOBALS['pmaThemeImage']
 664  */
 665 $GLOBALS['pmaThemeImage']   = $_SESSION['PMA_Theme']->getImgPath();
 666
 667 /**
 668  * load layout file if exists
 669  */
 670 if (@file_exists($_SESSION['PMA_Theme']->getLayoutFile())) {
 671     include $_SESSION['PMA_Theme']->getLayoutFile();
 672     /**
 673      * @todo remove if all themes are update use Navi instead of Left as frame name
 674      */
 675     if (! isset($GLOBALS['cfg']['NaviWidth'])
 676      && isset($GLOBALS['cfg']['LeftWidth'])) {
 677         $GLOBALS['cfg']['NaviWidth'] = $GLOBALS['cfg']['LeftWidth'];
 678     }
 679 }
 680
 681 if (! defined('PMA_MINIMUM_COMMON')) {
 682     /**
 683      * Character set conversion.
 684      */
 685     require_once './libraries/charset_conversion.lib.php';
 686
 687     /**
 688      * String handling
 689      */
 690     require_once './libraries/string.lib.php';
 691
 692     /**
 693      * Lookup server by name
 694      * by Arnold - Helder Hosting
 695      * (see FAQ 4.8)
 696      */
 697     if (! empty($_REQUEST['server']) && is_string($_REQUEST['server'])
 698      && ! is_numeric($_REQUEST['server'])) {
 699         foreach ($cfg['Servers'] as $i => $server) {
 700             if ($server['host'] == $_REQUEST['server']) {
 701                 $_REQUEST['server'] = $i;
 702                 break;
 703             }
 704         }
 705         if (is_string($_REQUEST['server'])) {
 706             unset($_REQUEST['server']);
 707         }
 708         unset($i);
 709     }
 710
 711     /**
 712      * If no server is selected, make sure that $cfg['Server'] is empty (so
 713      * that nothing will work), and skip server authentication.
 714      * We do NOT exit here, but continue on without logging into any server.
 715      * This way, the welcome page will still come up (with no server info) and
 716      * present a choice of servers in the case that there are multiple servers
 717      * and '$cfg['ServerDefault'] = 0' is set.
 718      */
 719
 720     if (isset($_REQUEST['server']) && (is_string($_REQUEST['server']) || is_numeric($_REQUEST['server'])) && ! empty($_REQUEST['server']) && ! empty($cfg['Servers'][$_REQUEST['server']])) {
 721         $GLOBALS['server'] = $_REQUEST['server'];
 722         $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
 723     } else {
 724         if (!empty($cfg['Servers'][$cfg['ServerDefault']])) {
 725             $GLOBALS['server'] = $cfg['ServerDefault'];
 726             $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
 727         } else {
 728             $GLOBALS['server'] = 0;
 729             $cfg['Server'] = array();
 730         }
 731     }
 732     $GLOBALS['url_params']['server'] = $GLOBALS['server'];
 733
 734     if (! empty($cfg['Server'])) {
 735
 736         /**
 737          * Loads the proper database interface for this server
 738          */
 739         require_once './libraries/database_interface.lib.php';
 740
 741         // Gets the authentication library that fits the $cfg['Server'] settings
 742         // and run authentication
 743
 744         // to allow HTTP or http
 745         $cfg['Server']['auth_type'] = strtolower($cfg['Server']['auth_type']);
 746         if (! file_exists('./libraries/auth/' . $cfg['Server']['auth_type'] . '.auth.lib.php')) {
 747             PMA_fatalError($strInvalidAuthMethod . ' ' . $cfg['Server']['auth_type']);
 748         }
 749         /**
 750          * the required auth type plugin
 751          */
 752         require_once './libraries/auth/' . $cfg['Server']['auth_type'] . '.auth.lib.php';
 753
 754         if (!PMA_auth_check()) {
 755             PMA_auth();
 756         } else {
 757             PMA_auth_set_user();
 758         }
 759
 760         // Check IP-based Allow/Deny rules as soon as possible to reject the
 761         // user
 762         // Based on mod_access in Apache:
 763         // http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/aaa/mod_access.c?rev=1.37&content-type=text/vnd.viewcvs-markup
 764         // Look at: "static int check_dir_access(request_rec *r)"
 765         // Robbat2 - May 10, 2002
 766         if (isset($cfg['Server']['AllowDeny'])
 767           && isset($cfg['Server']['AllowDeny']['order'])) {
 768
 769             /**
 770              * ip based access library
 771              */
 772             require_once './libraries/ip_allow_deny.lib.php';
 773
 774             $allowDeny_forbidden         = false; // default
 775             if ($cfg['Server']['AllowDeny']['order'] == 'allow,deny') {
 776                 $allowDeny_forbidden     = true;
 777                 if (PMA_allowDeny('allow')) {
 778                     $allowDeny_forbidden = false;
 779                 }
 780                 if (PMA_allowDeny('deny')) {
 781                     $allowDeny_forbidden = true;
 782                 }
 783             } elseif ($cfg['Server']['AllowDeny']['order'] == 'deny,allow') {
 784                 if (PMA_allowDeny('deny')) {
 785                     $allowDeny_forbidden = true;
 786                 }
 787                 if (PMA_allowDeny('allow')) {
 788                     $allowDeny_forbidden = false;
 789                 }
 790             } elseif ($cfg['Server']['AllowDeny']['order'] == 'explicit') {
 791                 if (PMA_allowDeny('allow')
 792                   && !PMA_allowDeny('deny')) {
 793                     $allowDeny_forbidden = false;
 794                 } else {
 795                     $allowDeny_forbidden = true;
 796                 }
 797             } // end if ... elseif ... elseif
 798
 799             // Ejects the user if banished
 800             if ($allowDeny_forbidden) {
 801                PMA_auth_fails();
 802             }
 803             unset($allowDeny_forbidden); //Clean up after you!
 804         } // end if
 805
 806         // is root allowed?
 807         if (!$cfg['Server']['AllowRoot'] && $cfg['Server']['user'] == 'root') {
 808             $allowDeny_forbidden = true;
 809             PMA_auth_fails();
 810             unset($allowDeny_forbidden); //Clean up after you!
 811         }
 812
 813         $bkp_track_err = @ini_set('track_errors', 1);
 814
 815         // Try to connect MySQL with the control user profile (will be used to
 816         // get the privileges list for the current user but the true user link
 817         // must be open after this one so it would be default one for all the
 818         // scripts)
 819         $controllink = false;
 820         if ($cfg['Server']['controluser'] != '') {
 821             $controllink = PMA_DBI_connect($cfg['Server']['controluser'],
 822                 $cfg['Server']['controlpass'], true);
 823         }
 824         if (! $controllink) {
 825             $controllink = PMA_DBI_connect($cfg['Server']['user'],
 826                 $cfg['Server']['password'], true);
 827         } // end if ... else
 828
 829         // Pass #1 of DB-Config to read in master level DB-Config will go here
 830         // Robbat2 - May 11, 2002
 831
 832         // Connects to the server (validates user's login)
 833         $userlink = PMA_DBI_connect($cfg['Server']['user'],
 834             $cfg['Server']['password'], false);
 835
 836         // Pass #2 of DB-Config to read in user level DB-Config will go here
 837         // Robbat2 - May 11, 2002
 838
 839         @ini_set('track_errors', $bkp_track_err);
 840         unset($bkp_track_err);
 841
 842         /**
 843          * If we auto switched to utf-8 we need to reread messages here
 844          */
 845         if (defined('PMA_LANG_RELOAD')) {
 846             require './libraries/language.lib.php';
 847         }
 848
 849         /**
 850          * SQL Parser code
 851          */
 852         require_once './libraries/sqlparser.lib.php';
 853
 854         /**
 855          * SQL Validator interface code
 856          */
 857         require_once './libraries/sqlvalidator.lib.php';
 858
 859         /**
 860          * the PMA_List_Database class
 861          */
 862         require_once './libraries/List_Database.class.php';
 863         $PMA_List_Database = new PMA_List_Database($userlink, $controllink);
 864
 865         /**
 866          * some resetting has to be done when switching servers
 867          */
 868         if (isset($_SESSION['userconf']['previous_server']) && $_SESSION['userconf']['previous_server'] != $GLOBALS['server']) {
 869             unset($_SESSION['userconf']['navi_limit_offset']);
 870         }
 871         $_SESSION['userconf']['previous_server'] = $GLOBALS['server'];
 872
 873     } // end server connecting
 874
 875     /**
 876      * Kanji encoding convert feature appended by Y.Kawada (2002/2/20)
 877      */
 878     if (@function_exists('mb_convert_encoding')
 879         && strpos(' ' . $lang, 'ja-')
 880         && file_exists('./libraries/kanji-encoding.lib.php')) {
 881         require_once './libraries/kanji-encoding.lib.php';
 882         /**
 883          * enable multibyte string support
 884          */
 885         define('PMA_MULTIBYTE_ENCODING', 1);
 886     } // end if
 887
 888     /**
 889      * save some settings in cookies
 890      * @todo should be done in PMA_Config
 891      */
 892     PMA_setCookie('pma_lang', $GLOBALS['lang']);
 893     PMA_setCookie('pma_charset', $GLOBALS['convcharset']);
 894     PMA_setCookie('pma_collation_connection', $GLOBALS['collation_connection']);
 895
 896     $_SESSION['PMA_Theme_Manager']->setThemeCookie();
 897
 898     /**
 899      * check if profiling was requested and remember it
 900      * (note: when $cfg['ServerDefault'] = 0, constant is not defined)
 901      */
 902
 903     if (PMA_profilingSupported() && isset($_REQUEST['profiling'])) {
 904         $_SESSION['profiling'] = true;
 905     } elseif (isset($_REQUEST['profiling_form'])) {
 906         // the checkbox was unchecked
 907         unset($_SESSION['profiling']);
 908     }
 909
 910 } // end if !defined('PMA_MINIMUM_COMMON')
 911
 912 // remove sensitive values from session
 913 $_SESSION['PMA_Config']->set('blowfish_secret', '');
 914 $_SESSION['PMA_Config']->set('Servers', '');
 915 $_SESSION['PMA_Config']->set('default_server', '');
 916
 917 if (!empty($__redirect) && in_array($__redirect, $goto_whitelist)) {
 918     /**
 919      * include subform target page
 920      */
 921     require $__redirect;
 922     exit();
 923 }
 924 ?>