libraries/common.inc.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * Misc stuff and REQUIRED by ALL the scripts.
   5  * MUST be included by every script
   6  *
   7  * Among other things, it contains the advanced authentication work.
   8  *
   9  * Order of sections for common.inc.php:
  10  *
  11  * the authentication libraries must be before the connection to db
  12  *
  13  * ... so the required order is:
  14  *
  15  * LABEL_variables_init
  16  *  - initialize some variables always needed
  17  * LABEL_parsing_config_file
  18  *  - parsing of the configuration file
  19  * LABEL_loading_language_file
  20  *  - loading language file
  21  * LABEL_setup_servers
  22  *  - check and setup configured servers
  23  * LABEL_theme_setup
  24  *  - setting up themes
  25  *
  26  * - load of MySQL extension (if necessary)
  27  * - loading of an authentication library
  28  * - db connection
  29  * - authentication work
  30  *
  31  * @version $Id$
  32  * @package phpMyAdmin
  33  */
  34
  35 /**
  36  * Minimum PHP version; can't call PMA_fatalError() which uses a
  37  * PHP 5 function, so cannot easily localize this message.
  38  */
  39 if (version_compare(PHP_VERSION, '5.2.0', 'lt')) {
  40     die('PHP 5.2+ is required');
  41 }
  42
  43 /**
  44   * Backward compatibility for PHP 5.2
  45   */
  46 if (!defined('E_DEPRECATED')) {
  47     define('E_DEPRECATED', 8192);
  48 }
  49
  50 /**
  51  * the error handler
  52  */
  53 require_once './libraries/Error_Handler.class.php';
  54
  55 /**
  56  * initialize the error handler
  57  */
  58 $GLOBALS['error_handler'] = new PMA_Error_Handler();
  59 $cfg['Error_Handler']['display'] = TRUE;
  60
  61 // at this point PMA_PHP_INT_VERSION is not yet defined
  62 if (version_compare(phpversion(), '6', 'lt')) {
  63     /**
  64      * Avoid object cloning errors
  65      */
  66     @ini_set('zend.ze1_compatibility_mode', false);
  67
  68     /**
  69      * Avoid problems with magic_quotes_runtime
  70      */
  71     @ini_set('magic_quotes_runtime', false);
  72 }
  73
  74 /**
  75  * for verification in all procedural scripts under libraries
  76  */
  77 define('PHPMYADMIN', true);
  78
  79 /**
  80  * core functions
  81  */
  82 require_once './libraries/core.lib.php';
  83
  84 /**
  85  * Input sanitizing
  86  */
  87 require_once './libraries/sanitizing.lib.php';
  88
  89 /**
  90  * the PMA_Theme class
  91  */
  92 require_once './libraries/Theme.class.php';
  93
  94 /**
  95  * the PMA_Theme_Manager class
  96  */
  97 require_once './libraries/Theme_Manager.class.php';
  98
  99 /**
 100  * the PMA_Config class
 101  */
 102 require_once './libraries/Config.class.php';
 103
 104 /**
 105  * the relation lib, tracker needs it
 106  */
 107 require_once './libraries/relation.lib.php';
 108
 109 /**
 110  * the PMA_Tracker class
 111  */
 112 require_once './libraries/Tracker.class.php';
 113
 114 /**
 115  * the PMA_Table class
 116  */
 117 require_once './libraries/Table.class.php';
 118
 119 if (!defined('PMA_MINIMUM_COMMON')) {
 120     /**
 121      * common functions
 122      */
 123     require_once './libraries/common.lib.php';
 124
 125     /**
 126      * Java script escaping.
 127      */
 128     require_once './libraries/js_escape.lib.php';
 129
 130     /**
 131      * Include URL/hidden inputs generating.
 132      */
 133     require_once './libraries/url_generating.lib.php';
 134 }
 135
 136 /******************************************************************************/
 137 /* start procedural code                       label_start_procedural         */
 138
 139 /**
 140  * protect against possible exploits - there is no need to have so much variables
 141  */
 142 if (count($_REQUEST) > 1000) {
 143     die('possible exploit');
 144 }
 145
 146 /**
 147  * Check for numeric keys
 148  * (if register_globals is on, numeric key can be found in $GLOBALS)
 149  */
 150 foreach ($GLOBALS as $key => $dummy) {
 151     if (is_numeric($key)) {
 152         die('numeric key detected');
 153     }
 154 }
 155 unset($dummy);
 156
 157 /**
 158  * PATH_INFO could be compromised if set, so remove it from PHP_SELF
 159  * and provide a clean PHP_SELF here
 160  */
 161 $PMA_PHP_SELF = PMA_getenv('PHP_SELF');
 162 $_PATH_INFO = PMA_getenv('PATH_INFO');
 163 if (! empty($_PATH_INFO) && ! empty($PMA_PHP_SELF)) {
 164     $path_info_pos = strrpos($PMA_PHP_SELF, $_PATH_INFO);
 165     if ($path_info_pos + strlen($_PATH_INFO) === strlen($PMA_PHP_SELF)) {
 166         $PMA_PHP_SELF = substr($PMA_PHP_SELF, 0, $path_info_pos);
 167     }
 168 }
 169 $PMA_PHP_SELF = htmlspecialchars($PMA_PHP_SELF);
 170
 171
 172 /**
 173  * just to be sure there was no import (registering) before here
 174  * we empty the global space (but avoid unsetting $variables_list
 175  * and $key in the foreach(), we still need them!)
 176  */
 177 $variables_whitelist = array (
 178     'GLOBALS',
 179     '_SERVER',
 180     '_GET',
 181     '_POST',
 182     '_REQUEST',
 183     '_FILES',
 184     '_ENV',
 185     '_COOKIE',
 186     '_SESSION',
 187     'error_handler',
 188     'PMA_PHP_SELF',
 189     'variables_whitelist',
 190     'key'
 191 );
 192
 193 foreach (get_defined_vars() as $key => $value) {
 194     if (! in_array($key, $variables_whitelist)) {
 195         unset($$key);
 196     }
 197 }
 198 unset($key, $value, $variables_whitelist);
 199
 200
 201 /**
 202  * Subforms - some functions need to be called by form, cause of the limited URL
 203  * length, but if this functions inside another form you cannot just open a new
 204  * form - so phpMyAdmin uses 'arrays' inside this form
 205  *
 206  * <code>
 207  * <form ...>
 208  * ... main form elments ...
 209  * <input type="hidden" name="subform[action1][id]" value="1" />
 210  * ... other subform data ...
 211  * <input type="submit" name="usesubform[action1]" value="do action1" />
 212  * ... other subforms ...
 213  * <input type="hidden" name="subform[actionX][id]" value="X" />
 214  * ... other subform data ...
 215  * <input type="submit" name="usesubform[actionX]" value="do actionX" />
 216  * ... main form elments ...
 217  * <input type="submit" name="main_action" value="submit form" />
 218  * </form>
 219  * </code>
 220  *
 221  * so we now check if a subform is submitted
 222  */
 223 $__redirect = null;
 224 if (isset($_POST['usesubform'])) {
 225     // if a subform is present and should be used
 226     // the rest of the form is deprecated
 227     $subform_id = key($_POST['usesubform']);
 228     $subform    = $_POST['subform'][$subform_id];
 229     $_POST      = $subform;
 230     $_REQUEST   = $subform;
 231     /**
 232      * some subforms need another page than the main form, so we will just
 233      * include this page at the end of this script - we use $__redirect to
 234      * track this
 235      */
 236     if (isset($_POST['redirect'])
 237       && $_POST['redirect'] != basename($PMA_PHP_SELF)) {
 238         $__redirect = $_POST['redirect'];
 239         unset($_POST['redirect']);
 240     }
 241     unset($subform_id, $subform);
 242 } else {
 243     // Note: here we overwrite $_REQUEST so that it does not contain cookies,
 244     // because another application for the same domain could have set
 245     // a cookie (with a compatible path) that overrides a variable
 246     // we expect from GET or POST.
 247     // We'll refer to cookies explicitly with the $_COOKIE syntax.
 248     $_REQUEST = array_merge($_GET, $_POST);
 249 }
 250 // end check if a subform is submitted
 251
 252 // remove quotes added by php
 253 if (function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc()) {
 254     PMA_arrayWalkRecursive($_GET, 'stripslashes', true);
 255     PMA_arrayWalkRecursive($_POST, 'stripslashes', true);
 256     PMA_arrayWalkRecursive($_COOKIE, 'stripslashes', true);
 257     PMA_arrayWalkRecursive($_REQUEST, 'stripslashes', true);
 258 }
 259
 260 /**
 261  * include deprecated grab_globals only if required
 262  */
 263 if (empty($__redirect) && !defined('PMA_NO_VARIABLES_IMPORT')) {
 264     require './libraries/grab_globals.lib.php';
 265 }
 266
 267 /**
 268  * check timezone setting
 269  * this could produce an E_STRICT - but only once,
 270  * if not done here it will produce E_STRICT on every date/time function
 271  *
 272  * @todo need to decide how we should handle this (without @)
 273  */
 274 date_default_timezone_set(@date_default_timezone_get());
 275
 276 /******************************************************************************/
 277 /* parsing configuration file                         LABEL_parsing_config_file      */
 278
 279 /**
 280  * We really need this one!
 281  */
 282 if (! function_exists('preg_replace')) {
 283     PMA_fatalError('strCantLoad', 'pcre');
 284 }
 285
 286 /**
 287  * @global PMA_Config $GLOBALS['PMA_Config']
 288  * force reading of config file, because we removed sensitive values
 289  * in the previous iteration
 290  */
 291 $GLOBALS['PMA_Config'] = new PMA_Config(CONFIG_FILE);
 292
 293 if (!defined('PMA_MINIMUM_COMMON')) {
 294     $GLOBALS['PMA_Config']->checkPmaAbsoluteUri();
 295 }
 296
 297 /**
 298  * BC - enable backward compatibility
 299  * exports all configuration settings into $GLOBALS ($GLOBALS['cfg'])
 300  */
 301 $GLOBALS['PMA_Config']->enableBc();
 302
 303 /**
 304  * clean cookies on upgrade
 305  * when changing something related to PMA cookies, increment the cookie version
 306  */
 307 $pma_cookie_version = 4;
 308 if (isset($_COOKIE)
 309  && (isset($_COOKIE['pmaCookieVer'])
 310   && $_COOKIE['pmaCookieVer'] < $pma_cookie_version)) {
 311     // delete all cookies
 312     foreach($_COOKIE as $cookie_name => $tmp) {
 313         $GLOBALS['PMA_Config']->removeCookie($cookie_name);
 314     }
 315     $_COOKIE = array();
 316     $GLOBALS['PMA_Config']->setCookie('pmaCookieVer', $pma_cookie_version);
 317 }
 318
 319
 320 /**
 321  * check HTTPS connection
 322  */
 323 if ($GLOBALS['PMA_Config']->get('ForceSSL')
 324   && !$GLOBALS['PMA_Config']->get('is_https')) {
 325     PMA_sendHeaderLocation(
 326         preg_replace('/^http/', 'https',
 327             $GLOBALS['PMA_Config']->get('PmaAbsoluteUri'))
 328         . PMA_generate_common_url($_GET, 'text'));
 329     // delete the current session, otherwise we get problems (see bug #2397877)
 330     $GLOBALS['PMA_Config']->removeCookie($GLOBALS['session_name']);
 331     exit;
 332 }
 333
 334
 335 /**
 336  * include session handling after the globals, to prevent overwriting
 337  */
 338 require_once './libraries/session.inc.php';
 339
 340 /**
 341  * init some variables LABEL_variables_init
 342  */
 343
 344 /**
 345  * holds parameters to be passed to next page
 346  * @global array $GLOBALS['url_params']
 347  */
 348 $GLOBALS['url_params'] = array();
 349
 350 /**
 351  * the whitelist for $GLOBALS['goto']
 352  * @global array $goto_whitelist
 353  */
 354 $goto_whitelist = array(
 355     //'browse_foreigners.php',
 356     //'calendar.php',
 357     //'changelog.php',
 358     //'chk_rel.php',
 359     'db_create.php',
 360     'db_datadict.php',
 361     'db_sql.php',
 362     'db_export.php',
 363     'db_importdocsql.php',
 364     'db_qbe.php',
 365     'db_structure.php',
 366     'db_import.php',
 367     'db_operations.php',
 368     'db_printview.php',
 369     'db_search.php',
 370     //'Documentation.html',
 371     //'error.php',
 372     'export.php',
 373     'import.php',
 374     //'index.php',
 375     //'navigation.php',
 376     //'license.php',
 377     'main.php',
 378     'pdf_pages.php',
 379     'pdf_schema.php',
 380     //'phpinfo.php',
 381     'querywindow.php',
 382     //'readme.php',
 383     'server_binlog.php',
 384     'server_collations.php',
 385     'server_databases.php',
 386     'server_engines.php',
 387     'server_export.php',
 388     'server_import.php',
 389     'server_privileges.php',
 390     'server_processlist.php',
 391     'server_sql.php',
 392     'server_status.php',
 393     'server_variables.php',
 394     'sql.php',
 395     'tbl_addfield.php',
 396     'tbl_alter.php',
 397     'tbl_change.php',
 398     'tbl_create.php',
 399     'tbl_import.php',
 400     'tbl_indexes.php',
 401     'tbl_move_copy.php',
 402     'tbl_printview.php',
 403     'tbl_sql.php',
 404     'tbl_export.php',
 405     'tbl_operations.php',
 406     'tbl_structure.php',
 407     'tbl_relation.php',
 408     'tbl_replace.php',
 409     'tbl_row_action.php',
 410     'tbl_select.php',
 411     //'themes.php',
 412     'transformation_overview.php',
 413     'transformation_wrapper.php',
 414     'translators.html',
 415     'user_password.php',
 416 );
 417
 418 /**
 419  * check $__redirect against whitelist
 420  */
 421 if (! PMA_checkPageValidity($__redirect, $goto_whitelist)) {
 422     $__redirect = null;
 423 }
 424
 425 /**
 426  * holds page that should be displayed
 427  * @global string $GLOBALS['goto']
 428  */
 429 $GLOBALS['goto'] = '';
 430 // Security fix: disallow accessing serious server files via "?goto="
 431 if (PMA_checkPageValidity($_REQUEST['goto'], $goto_whitelist)) {
 432     $GLOBALS['goto'] = $_REQUEST['goto'];
 433     $GLOBALS['url_params']['goto'] = $_REQUEST['goto'];
 434 } else {
 435     unset($_REQUEST['goto'], $_GET['goto'], $_POST['goto'], $_COOKIE['goto']);
 436 }
 437
 438 /**
 439  * returning page
 440  * @global string $GLOBALS['back']
 441  */
 442 if (PMA_checkPageValidity($_REQUEST['back'], $goto_whitelist)) {
 443     $GLOBALS['back'] = $_REQUEST['back'];
 444 } else {
 445     unset($_REQUEST['back'], $_GET['back'], $_POST['back'], $_COOKIE['back']);
 446 }
 447
 448 /**
 449  * Check whether user supplied token is valid, if not remove any possibly
 450  * dangerous stuff from request.
 451  *
 452  * remember that some objects in the session with session_start and __wakeup()
 453  * could access this variables before we reach this point
 454  * f.e. PMA_Config: fontsize
 455  *
 456  * @todo variables should be handled by their respective owners (objects)
 457  * f.e. lang, server, convcharset, collation_connection in PMA_Config
 458  */
 459 if (! PMA_isValid($_REQUEST['token']) || $_SESSION[' PMA_token '] != $_REQUEST['token']) {
 460     /**
 461      *  List of parameters which are allowed from unsafe source
 462      */
 463     $allow_list = array(
 464         /* needed for direct access, see FAQ 1.34
 465          * also, server needed for cookie login screen (multi-server)
 466          */
 467         'server', 'db', 'table', 'target',
 468         /* Session ID */
 469         'phpMyAdmin',
 470         /* Cookie preferences */
 471         'pma_lang', 'pma_charset', 'pma_collation_connection',
 472         /* Possible login form */
 473         'pma_servername', 'pma_username', 'pma_password',
 474         /* for playing blobstreamable media */
 475         'media_type', 'custom_type', 'bs_reference',
 476         /* for changing BLOB repository file MIME type */
 477         'bs_db', 'bs_table', 'bs_ref', 'bs_new_mime_type'
 478     );
 479     /**
 480      * Require cleanup functions
 481      */
 482     require_once './libraries/cleanup.lib.php';
 483     /**
 484      * Do actual cleanup
 485      */
 486     PMA_remove_request_vars($allow_list);
 487
 488 }
 489
 490
 491 /**
 492  * @global string $GLOBALS['convcharset']
 493  * @see select_lang.lib.php
 494  */
 495 if (isset($_REQUEST['convcharset'])) {
 496     $GLOBALS['convcharset'] = strip_tags($_REQUEST['convcharset']);
 497 }
 498
 499 /**
 500  * current selected database
 501  * @global string $GLOBALS['db']
 502  */
 503 $GLOBALS['db'] = '';
 504 if (PMA_isValid($_REQUEST['db'])) {
 505     // can we strip tags from this?
 506     // only \ and / is not allowed in db names for MySQL
 507     $GLOBALS['db'] = $_REQUEST['db'];
 508     $GLOBALS['url_params']['db'] = $GLOBALS['db'];
 509 }
 510
 511 /**
 512  * current selected table
 513  * @global string $GLOBALS['table']
 514  */
 515 $GLOBALS['table'] = '';
 516 if (PMA_isValid($_REQUEST['table'])) {
 517     // can we strip tags from this?
 518     // only \ and / is not allowed in table names for MySQL
 519     $GLOBALS['table'] = $_REQUEST['table'];
 520     $GLOBALS['url_params']['table'] = $GLOBALS['table'];
 521 }
 522
 523 /**
 524  * SQL query to be executed
 525  * @global string $GLOBALS['sql_query']
 526  */
 527 $GLOBALS['sql_query'] = '';
 528 if (PMA_isValid($_REQUEST['sql_query'])) {
 529     $GLOBALS['sql_query'] = $_REQUEST['sql_query'];
 530 }
 531
 532 /**
 533  * avoid problems in phpmyadmin.css.php in some cases
 534  * @global string $js_frame
 535  */
 536 $_REQUEST['js_frame'] = PMA_ifSetOr($_REQUEST['js_frame'], '');
 537
 538 //$_REQUEST['set_theme'] // checked later in this file LABEL_theme_setup
 539 //$_REQUEST['server']; // checked later in this file
 540 //$_REQUEST['lang'];   // checked by LABEL_loading_language_file
 541
 542
 543 /**
 544  * holds name of JavaScript files to be included in HTML header
 545  * @global array $js_include
 546  */
 547 $GLOBALS['js_include'] = array();
 548 $GLOBALS['js_include'][] = 'mootools.js';
 549 $GLOBALS['js_include'][] = 'jquery/jquery-1.4.2.js';
 550 $GLOBALS['js_include'][] = 'update-location.js';
 551
 552 /**
 553  * JavaScript events that will be registered
 554  * @global array $js_events
 555  */
 556 $GLOBALS['js_events'] = array();
 557
 558 /**
 559  * footnotes to be displayed ot the page bottom
 560  * @global array $footnotes
 561  */
 562 $GLOBALS['footnotes'] = array();
 563
 564 /******************************************************************************/
 565 /* loading language file                       LABEL_loading_language_file    */
 566
 567 /**
 568  * Added messages while developing:
 569  */
 570 if (file_exists('./lang/added_messages.php')) {
 571     include './lang/added_messages.php';
 572 }
 573
 574 /**
 575  * lang detection is done here
 576  */
 577 require_once './libraries/select_lang.lib.php';
 578
 579 /**
 580  * check for errors occurred while loading configuration
 581  * this check is done here after loading language files to present errors in locale
 582  */
 583 if ($GLOBALS['PMA_Config']->error_config_file) {
 584     $error = $strConfigFileError
 585         . '<br /><br />'
 586         . ($GLOBALS['PMA_Config']->getSource() == CONFIG_FILE ?
 587         '<a href="show_config_errors.php"'
 588         .' target="_blank">' . $GLOBALS['PMA_Config']->getSource() . '</a>'
 589         :
 590         '<a href="' . $GLOBALS['PMA_Config']->getSource() . '"'
 591         .' target="_blank">' . $GLOBALS['PMA_Config']->getSource() . '</a>');
 592     trigger_error($error, E_USER_ERROR);
 593 }
 594 if ($GLOBALS['PMA_Config']->error_config_default_file) {
 595     $error = sprintf($strConfigDefaultFileError,
 596         $GLOBALS['PMA_Config']->default_source);
 597     trigger_error($error, E_USER_ERROR);
 598 }
 599 if ($GLOBALS['PMA_Config']->error_pma_uri) {
 600     trigger_error($strPmaUriError, E_USER_ERROR);
 601 }
 602
 603
 604 /******************************************************************************/
 605 /* setup servers                                       LABEL_setup_servers    */
 606
 607 /**
 608  * current server
 609  * @global integer $GLOBALS['server']
 610  */
 611 $GLOBALS['server'] = 0;
 612
 613 /**
 614  * Servers array fixups.
 615  * $default_server comes from PMA_Config::enableBc()
 616  * @todo merge into PMA_Config
 617  */
 618 // Do we have some server?
 619 if (!isset($cfg['Servers']) || count($cfg['Servers']) == 0) {
 620     // No server => create one with defaults
 621     $cfg['Servers'] = array(1 => $default_server);
 622 } else {
 623     // We have server(s) => apply default configuration
 624     $new_servers = array();
 625
 626     foreach ($cfg['Servers'] as $server_index => $each_server) {
 627
 628         // Detect wrong configuration
 629         if (!is_int($server_index) || $server_index < 1) {
 630             trigger_error(sprintf($strInvalidServerIndex, $server_index), E_USER_ERROR);
 631         }
 632
 633         $each_server = array_merge($default_server, $each_server);
 634
 635         // Don't use servers with no hostname
 636         if ($each_server['connect_type'] == 'tcp' && empty($each_server['host'])) {
 637             trigger_error(sprintf($strInvalidServerHostname, $server_index), E_USER_ERROR);
 638         }
 639
 640         // Final solution to bug #582890
 641         // If we are using a socket connection
 642         // and there is nothing in the verbose server name
 643         // or the host field, then generate a name for the server
 644         // in the form of "Server 2", localized of course!
 645         if ($each_server['connect_type'] == 'socket' && empty($each_server['host']) && empty($each_server['verbose'])) {
 646             $each_server['verbose'] = $GLOBALS['strServer'] . $server_index;
 647         }
 648
 649         $new_servers[$server_index] = $each_server;
 650     }
 651     $cfg['Servers'] = $new_servers;
 652     unset($new_servers, $server_index, $each_server);
 653 }
 654
 655 // Cleanup
 656 unset($default_server);
 657
 658
 659 /******************************************************************************/
 660 /* setup themes                                          LABEL_theme_setup    */
 661
 662 if (isset($_REQUEST['custom_color_reset'])) {
 663     unset($_SESSION['tmp_user_values']['custom_color']);
 664 } elseif (isset($_REQUEST['custom_color'])) {
 665     $_SESSION['tmp_user_values']['custom_color'] = $_REQUEST['custom_color'];
 666 }
 667 /**
 668  * @global PMA_Theme_Manager $_SESSION['PMA_Theme_Manager']
 669  */
 670 if (! isset($_SESSION['PMA_Theme_Manager'])) {
 671     $_SESSION['PMA_Theme_Manager'] = new PMA_Theme_Manager;
 672 } else {
 673     /**
 674      * @todo move all __wakeup() functionality into session.inc.php
 675      */
 676     $_SESSION['PMA_Theme_Manager']->checkConfig();
 677 }
 678
 679 // for the theme per server feature
 680 if (isset($_REQUEST['server']) && !isset($_REQUEST['set_theme'])) {
 681     $GLOBALS['server'] = $_REQUEST['server'];
 682     $tmp = $_SESSION['PMA_Theme_Manager']->getThemeCookie();
 683     if (empty($tmp)) {
 684         $tmp = $_SESSION['PMA_Theme_Manager']->theme_default;
 685     }
 686     $_SESSION['PMA_Theme_Manager']->setActiveTheme($tmp);
 687     unset($tmp);
 688 }
 689 /**
 690  * @todo move into PMA_Theme_Manager::__wakeup()
 691  */
 692 if (isset($_REQUEST['set_theme'])) {
 693     // if user selected a theme
 694     $_SESSION['PMA_Theme_Manager']->setActiveTheme($_REQUEST['set_theme']);
 695 }
 696
 697 /**
 698  * the theme object
 699  * @global PMA_Theme $_SESSION['PMA_Theme']
 700  */
 701 $_SESSION['PMA_Theme'] = $_SESSION['PMA_Theme_Manager']->theme;
 702
 703 // BC
 704 /**
 705  * the active theme
 706  * @global string $GLOBALS['theme']
 707  */
 708 $GLOBALS['theme']           = $_SESSION['PMA_Theme']->getName();
 709 /**
 710  * the theme path
 711  * @global string $GLOBALS['pmaThemePath']
 712  */
 713 $GLOBALS['pmaThemePath']    = $_SESSION['PMA_Theme']->getPath();
 714 /**
 715  * the theme image path
 716  * @global string $GLOBALS['pmaThemeImage']
 717  */
 718 $GLOBALS['pmaThemeImage']   = $_SESSION['PMA_Theme']->getImgPath();
 719
 720 /**
 721  * load layout file if exists
 722  */
 723 if (@file_exists($_SESSION['PMA_Theme']->getLayoutFile())) {
 724     include $_SESSION['PMA_Theme']->getLayoutFile();
 725     /**
 726      * @todo remove if all themes are update use Navi instead of Left as frame name
 727      */
 728     if (! isset($GLOBALS['cfg']['NaviWidth'])
 729      && isset($GLOBALS['cfg']['LeftWidth'])) {
 730         $GLOBALS['cfg']['NaviWidth'] = $GLOBALS['cfg']['LeftWidth'];
 731     }
 732 }
 733
 734 if (! defined('PMA_MINIMUM_COMMON')) {
 735     /**
 736      * Character set conversion.
 737      */
 738     require_once './libraries/charset_conversion.lib.php';
 739
 740     /**
 741      * String handling
 742      */
 743     require_once './libraries/string.lib.php';
 744
 745     /**
 746      * Lookup server by name
 747      * by Arnold - Helder Hosting
 748      * (see FAQ 4.8)
 749      */
 750     if (! empty($_REQUEST['server']) && is_string($_REQUEST['server'])
 751      && ! is_numeric($_REQUEST['server'])) {
 752         foreach ($cfg['Servers'] as $i => $server) {
 753             if ($server['host'] == $_REQUEST['server']) {
 754                 $_REQUEST['server'] = $i;
 755                 break;
 756             }
 757         }
 758         if (is_string($_REQUEST['server'])) {
 759             unset($_REQUEST['server']);
 760         }
 761         unset($i);
 762     }
 763
 764     /**
 765      * If no server is selected, make sure that $cfg['Server'] is empty (so
 766      * that nothing will work), and skip server authentication.
 767      * We do NOT exit here, but continue on without logging into any server.
 768      * This way, the welcome page will still come up (with no server info) and
 769      * present a choice of servers in the case that there are multiple servers
 770      * and '$cfg['ServerDefault'] = 0' is set.
 771      */
 772
 773     if (isset($_REQUEST['server']) && (is_string($_REQUEST['server']) || is_numeric($_REQUEST['server'])) && ! empty($_REQUEST['server']) && ! empty($cfg['Servers'][$_REQUEST['server']])) {
 774         $GLOBALS['server'] = $_REQUEST['server'];
 775         $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
 776     } else {
 777         if (!empty($cfg['Servers'][$cfg['ServerDefault']])) {
 778             $GLOBALS['server'] = $cfg['ServerDefault'];
 779             $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
 780         } else {
 781             $GLOBALS['server'] = 0;
 782             $cfg['Server'] = array();
 783         }
 784     }
 785     $GLOBALS['url_params']['server'] = $GLOBALS['server'];
 786
 787     /**
 788      * Kanji encoding convert feature appended by Y.Kawada (2002/2/20)
 789      */
 790     if (function_exists('mb_convert_encoding')
 791      && strpos($lang, 'ja-') !== false) {
 792         require_once './libraries/kanji-encoding.lib.php';
 793         /**
 794          * enable multibyte string support
 795          */
 796         define('PMA_MULTIBYTE_ENCODING', 1);
 797     } // end if
 798
 799     /**
 800      * save some settings in cookies
 801      * @todo should be done in PMA_Config
 802      */
 803     $GLOBALS['PMA_Config']->setCookie('pma_lang', $GLOBALS['lang']);
 804     $GLOBALS['PMA_Config']->setCookie('pma_charset', $GLOBALS['convcharset']);
 805     $GLOBALS['PMA_Config']->setCookie('pma_collation_connection', $GLOBALS['collation_connection']);
 806
 807     $_SESSION['PMA_Theme_Manager']->setThemeCookie();
 808
 809     if (! empty($cfg['Server'])) {
 810
 811         /**
 812          * Loads the proper database interface for this server
 813          */
 814         require_once './libraries/database_interface.lib.php';
 815
 816         require_once './libraries/logging.lib.php';
 817
 818         // Gets the authentication library that fits the $cfg['Server'] settings
 819         // and run authentication
 820
 821         // to allow HTTP or http
 822         $cfg['Server']['auth_type'] = strtolower($cfg['Server']['auth_type']);
 823         if (! file_exists('./libraries/auth/' . $cfg['Server']['auth_type'] . '.auth.lib.php')) {
 824             PMA_fatalError($strInvalidAuthMethod . ' ' . $cfg['Server']['auth_type']);
 825         }
 826         /**
 827          * the required auth type plugin
 828          */
 829         require_once './libraries/auth/' . $cfg['Server']['auth_type'] . '.auth.lib.php';
 830
 831         if (!PMA_auth_check()) {
 832             PMA_auth();
 833         } else {
 834             PMA_auth_set_user();
 835         }
 836
 837         // Check IP-based Allow/Deny rules as soon as possible to reject the
 838         // user
 839         // Based on mod_access in Apache:
 840         // http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/aaa/mod_access.c?rev=1.37&content-type=text/vnd.viewcvs-markup
 841         // Look at: "static int check_dir_access(request_rec *r)"
 842         // Robbat2 - May 10, 2002
 843         if (isset($cfg['Server']['AllowDeny'])
 844           && isset($cfg['Server']['AllowDeny']['order'])) {
 845
 846             /**
 847              * ip based access library
 848              */
 849             require_once './libraries/ip_allow_deny.lib.php';
 850
 851             $allowDeny_forbidden         = false; // default
 852             if ($cfg['Server']['AllowDeny']['order'] == 'allow,deny') {
 853                 $allowDeny_forbidden     = true;
 854                 if (PMA_allowDeny('allow')) {
 855                     $allowDeny_forbidden = false;
 856                 }
 857                 if (PMA_allowDeny('deny')) {
 858                     $allowDeny_forbidden = true;
 859                 }
 860             } elseif ($cfg['Server']['AllowDeny']['order'] == 'deny,allow') {
 861                 if (PMA_allowDeny('deny')) {
 862                     $allowDeny_forbidden = true;
 863                 }
 864                 if (PMA_allowDeny('allow')) {
 865                     $allowDeny_forbidden = false;
 866                 }
 867             } elseif ($cfg['Server']['AllowDeny']['order'] == 'explicit') {
 868                 if (PMA_allowDeny('allow')
 869                   && !PMA_allowDeny('deny')) {
 870                     $allowDeny_forbidden = false;
 871                 } else {
 872                     $allowDeny_forbidden = true;
 873                 }
 874             } // end if ... elseif ... elseif
 875
 876             // Ejects the user if banished
 877             if ($allowDeny_forbidden) {
 878                 PMA_log_user($cfg['Server']['user'], 'allow-denied');
 879                 PMA_auth_fails();
 880             }
 881             unset($allowDeny_forbidden); //Clean up after you!
 882         } // end if
 883
 884         // is root allowed?
 885         if (!$cfg['Server']['AllowRoot'] && $cfg['Server']['user'] == 'root') {
 886             $allowDeny_forbidden = true;
 887             PMA_log_user($cfg['Server']['user'], 'root-denied');
 888             PMA_auth_fails();
 889             unset($allowDeny_forbidden); //Clean up after you!
 890         }
 891
 892         // is a login without password allowed?
 893         if (!$cfg['Server']['AllowNoPassword'] && $cfg['Server']['password'] == '') {
 894             $login_without_password_is_forbidden = true;
 895             PMA_log_user($cfg['Server']['user'], 'empty-denied');
 896             PMA_auth_fails();
 897             unset($login_without_password_is_forbidden); //Clean up after you!
 898         }
 899
 900         // Try to connect MySQL with the control user profile (will be used to
 901         // get the privileges list for the current user but the true user link
 902         // must be open after this one so it would be default one for all the
 903         // scripts)
 904         $controllink = false;
 905         if ($cfg['Server']['controluser'] != '') {
 906             $controllink = PMA_DBI_connect($cfg['Server']['controluser'],
 907                 $cfg['Server']['controlpass'], true);
 908         }
 909
 910         // Connects to the server (validates user's login)
 911         $userlink = PMA_DBI_connect($cfg['Server']['user'],
 912             $cfg['Server']['password'], false);
 913
 914         if (! $controllink) {
 915             $controllink = $userlink;
 916         }
 917
 918         /* Log success */
 919         PMA_log_user($cfg['Server']['user']);
 920
 921         /**
 922          * with phpMyAdmin 3 we support MySQL >=5
 923          * but only production releases:
 924          *  - > 5.0.15
 925          */
 926         if (PMA_MYSQL_INT_VERSION < 50015) {
 927             PMA_fatalError('strUpgrade', array('MySQL', '5.0.15'));
 928         }
 929
 930         /**
 931          * SQL Parser code
 932          */
 933         require_once './libraries/sqlparser.lib.php';
 934
 935         /**
 936          * SQL Validator interface code
 937          */
 938         require_once './libraries/sqlvalidator.lib.php';
 939
 940         /**
 941          * the PMA_List_Database class
 942          */
 943         require_once './libraries/PMA.php';
 944         $pma = new PMA;
 945         $pma->userlink = $userlink;
 946         $pma->controllink = $controllink;
 947
 948         /**
 949          * some resetting has to be done when switching servers
 950          */
 951         if (isset($_SESSION['tmp_user_values']['previous_server']) && $_SESSION['tmp_user_values']['previous_server'] != $GLOBALS['server']) {
 952             unset($_SESSION['tmp_user_values']['navi_limit_offset']);
 953         }
 954         $_SESSION['tmp_user_values']['previous_server'] = $GLOBALS['server'];
 955
 956     } // end server connecting
 957
 958     /**
 959      * check if profiling was requested and remember it
 960      * (note: when $cfg['ServerDefault'] = 0, constant is not defined)
 961      */
 962     if (isset($_REQUEST['profiling']) && PMA_profilingSupported()) {
 963         $_SESSION['profiling'] = true;
 964     } elseif (isset($_REQUEST['profiling_form'])) {
 965         // the checkbox was unchecked
 966         unset($_SESSION['profiling']);
 967     }
 968
 969     // library file for blobstreaming
 970     require_once './libraries/blobstreaming.lib.php';
 971
 972     // checks for blobstreaming plugins and databases that support
 973     // blobstreaming (by having the necessary tables for blobstreaming)
 974     if (checkBLOBStreamingPlugins()) {
 975         checkBLOBStreamableDatabases();
 976     }
 977 } // end if !defined('PMA_MINIMUM_COMMON')
 978
 979 // remove sensitive values from session
 980 $GLOBALS['PMA_Config']->set('blowfish_secret', '');
 981 $GLOBALS['PMA_Config']->set('Servers', '');
 982 $GLOBALS['PMA_Config']->set('default_server', '');
 983
 984 /* Tell tracker that it can actually work */
 985 PMA_Tracker::enable();
 986
 987 if (!empty($__redirect) && in_array($__redirect, $goto_whitelist)) {
 988     /**
 989      * include subform target page
 990      */
 991     require $__redirect;
 992     exit();
 993 }
 994 ?>