sql.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * SQL executor
   5  *
   6  * @todo    we must handle the case if sql.php is called directly with a query
   7  *          that returns 0 rows - to prevent cyclic redirects or includes
   8  * @package PhpMyAdmin
   9  */
  10 use PhpMyAdmin\Config\PageSettings;
  11 use PhpMyAdmin\ParseAnalyze;
  12 use PhpMyAdmin\Response;
  13 use PhpMyAdmin\Sql;
  14 use PhpMyAdmin\Url;
  15 use PhpMyAdmin\Util;
  16
  17 /**
  18  * Gets some core libraries
  19  */
  20 require_once 'libraries/common.inc.php';
  21 require_once 'libraries/check_user_privileges.inc.php';
  22
  23 PageSettings::showGroup('Browse');
  24
  25 $response = Response::getInstance();
  26 $header   = $response->getHeader();
  27 $scripts  = $header->getScripts();
  28 $scripts->addFile('vendor/jquery/jquery-ui-timepicker-addon.js');
  29 $scripts->addFile('vendor/jquery/jquery.uitablefilter.js');
  30 $scripts->addFile('tbl_change.js');
  31 $scripts->addFile('indexes.js');
  32 $scripts->addFile('gis_data_editor.js');
  33 $scripts->addFile('multi_column_sort.js');
  34
  35 /**
  36  * Set ajax_reload in the response if it was already set
  37  */
  38 if (isset($ajax_reload) && $ajax_reload['reload'] === true) {
  39     $response->addJSON('ajax_reload', $ajax_reload);
  40 }
  41
  42 /**
  43  * Defines the url to return to in case of error in a sql statement
  44  */
  45 $is_gotofile  = true;
  46 if (empty($goto)) {
  47     if (empty($table)) {
  48         $goto = Util::getScriptNameForOption(
  49             $GLOBALS['cfg']['DefaultTabDatabase'], 'database'
  50         );
  51     } else {
  52         $goto = Util::getScriptNameForOption(
  53             $GLOBALS['cfg']['DefaultTabTable'], 'table'
  54         );
  55     }
  56 } // end if
  57
  58 if (! isset($err_url)) {
  59     $err_url = (! empty($back) ? $back : $goto)
  60         . '?' . Url::getCommon(array('db' => $GLOBALS['db']))
  61         . ((mb_strpos(' ' . $goto, 'db_') != 1
  62             && strlen($table) > 0)
  63             ? '&amp;table=' . urlencode($table)
  64             : ''
  65         );
  66 } // end if
  67
  68 // Coming from a bookmark dialog
  69 if (isset($_POST['bkm_fields']['bkm_sql_query'])) {
  70     $sql_query = $_POST['bkm_fields']['bkm_sql_query'];
  71 } elseif (isset($_GET['sql_query'])) {
  72     $sql_query = $_GET['sql_query'];
  73 }
  74
  75 // This one is just to fill $db
  76 if (isset($_POST['bkm_fields']['bkm_database'])) {
  77     $db = $_POST['bkm_fields']['bkm_database'];
  78 }
  79
  80 // During grid edit, if we have a relational field, show the dropdown for it.
  81 if (isset($_REQUEST['get_relational_values'])
  82     && $_REQUEST['get_relational_values'] == true
  83 ) {
  84     Sql::getRelationalValues($db, $table);
  85     // script has exited at this point
  86 }
  87
  88 // Just like above, find possible values for enum fields during grid edit.
  89 if (isset($_REQUEST['get_enum_values']) && $_REQUEST['get_enum_values'] == true) {
  90     Sql::getEnumOrSetValues($db, $table, "enum");
  91     // script has exited at this point
  92 }
  93
  94
  95 // Find possible values for set fields during grid edit.
  96 if (isset($_REQUEST['get_set_values']) && $_REQUEST['get_set_values'] == true) {
  97     Sql::getEnumOrSetValues($db, $table, "set");
  98     // script has exited at this point
  99 }
 100
 101 if (isset($_REQUEST['get_default_fk_check_value'])
 102     && $_REQUEST['get_default_fk_check_value'] == true
 103 ) {
 104     $response = Response::getInstance();
 105     $response->addJSON(
 106         'default_fk_check_value', Util::isForeignKeyCheck()
 107     );
 108     exit;
 109 }
 110
 111 /**
 112  * Check ajax request to set the column order and visibility
 113  */
 114 if (isset($_REQUEST['set_col_prefs']) && $_REQUEST['set_col_prefs'] == true) {
 115     Sql::setColumnOrderOrVisibility($table, $db);
 116     // script has exited at this point
 117 }
 118
 119 // Default to browse if no query set and we have table
 120 // (needed for browsing from DefaultTabTable)
 121 if (empty($sql_query) && strlen($table) > 0 && strlen($db) > 0) {
 122     $sql_query = Sql::getDefaultSqlQueryForBrowse($db, $table);
 123
 124     // set $goto to what will be displayed if query returns 0 rows
 125     $goto = '';
 126 } else {
 127     // Now we can check the parameters
 128     Util::checkParameters(array('sql_query'));
 129 }
 130
 131 /**
 132  * Parse and analyze the query
 133  */
 134 list(
 135     $analyzed_sql_results,
 136     $db,
 137     $table_from_sql
 138 ) = ParseAnalyze::sqlQuery($sql_query, $db);
 139 // @todo: possibly refactor
 140 extract($analyzed_sql_results);
 141
 142 if ($table != $table_from_sql && !empty($table_from_sql)) {
 143     $table = $table_from_sql;
 144 }
 145
 146
 147 /**
 148  * Check rights in case of DROP DATABASE
 149  *
 150  * This test may be bypassed if $is_js_confirmed = 1 (already checked with js)
 151  * but since a malicious user may pass this variable by url/form, we don't take
 152  * into account this case.
 153  */
 154 if (Sql::hasNoRightsToDropDatabase(
 155     $analyzed_sql_results, $cfg['AllowUserDropDatabase'], $GLOBALS['dbi']->isSuperuser()
 156 )) {
 157     Util::mysqlDie(
 158         __('"DROP DATABASE" statements are disabled.'),
 159         '',
 160         false,
 161         $err_url
 162     );
 163 } // end if
 164
 165 /**
 166  * Need to find the real end of rows?
 167  */
 168 if (isset($find_real_end) && $find_real_end) {
 169     $unlim_num_rows = Sql::findRealEndOfRows($db, $table);
 170 }
 171
 172
 173 /**
 174  * Bookmark add
 175  */
 176 if (isset($_POST['store_bkm'])) {
 177     Sql::addBookmark($goto);
 178     // script has exited at this point
 179 } // end if
 180
 181
 182 /**
 183  * Sets or modifies the $goto variable if required
 184  */
 185 if ($goto == 'sql.php') {
 186     $is_gotofile = false;
 187     $goto = 'sql.php' . Url::getCommon(
 188         array(
 189             'db' => $db,
 190             'table' => $table,
 191             'sql_query' => $sql_query
 192         )
 193     );
 194 } // end if
 195
 196 Sql::executeQueryAndSendQueryResponse(
 197     $analyzed_sql_results, // analyzed_sql_results
 198     $is_gotofile, // is_gotofile
 199     $db, // db
 200     $table, // table
 201     isset($find_real_end) ? $find_real_end : null, // find_real_end
 202     isset($import_text) ? $import_text : null, // sql_query_for_bookmark
 203     isset($extra_data) ? $extra_data : null, // extra_data
 204     isset($message_to_show) ? $message_to_show : null, // message_to_show
 205     isset($message) ? $message : null, // message
 206     isset($sql_data) ? $sql_data : null, // sql_data
 207     $goto, // goto
 208     $pmaThemeImage, // pmaThemeImage
 209     isset($disp_query) ? $display_query : null, // disp_query
 210     isset($disp_message) ? $disp_message : null, // disp_message
 211     isset($query_type) ? $query_type : null, // query_type
 212     $sql_query, // sql_query
 213     isset($selected) ? $selected : null, // selectedTables
 214     isset($complete_query) ? $complete_query : null // complete_query
 215 );