sql.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * SQL executor
   5  *
   6  * @todo    we must handle the case if sql.php is called directly with a query
   7  *          that returns 0 rows - to prevent cyclic redirects or includes
   8  * @package PhpMyAdmin
   9  */
  10 declare(strict_types=1);
  11
  12 use PhpMyAdmin\Config\PageSettings;
  13 use PhpMyAdmin\ParseAnalyze;
  14 use PhpMyAdmin\Response;
  15 use PhpMyAdmin\Sql;
  16 use PhpMyAdmin\Url;
  17 use PhpMyAdmin\Util;
  18
  19 if (! defined('ROOT_PATH')) {
  20     define('ROOT_PATH', __DIR__ . DIRECTORY_SEPARATOR);
  21 }
  22
  23 /**
  24  * Gets some core libraries
  25  */
  26 require_once ROOT_PATH . 'libraries/common.inc.php';
  27 require_once ROOT_PATH . 'libraries/check_user_privileges.inc.php';
  28
  29 PageSettings::showGroup('Browse');
  30
  31 $response = Response::getInstance();
  32 $header   = $response->getHeader();
  33 $scripts  = $header->getScripts();
  34 $scripts->addFile('vendor/jquery/jquery.uitablefilter.js');
  35 $scripts->addFile('tbl_change.js');
  36 $scripts->addFile('indexes.js');
  37 $scripts->addFile('gis_data_editor.js');
  38 $scripts->addFile('multi_column_sort.js');
  39
  40 $sql = new Sql();
  41
  42 /**
  43  * Set ajax_reload in the response if it was already set
  44  */
  45 if (isset($ajax_reload) && $ajax_reload['reload'] === true) {
  46     $response->addJSON('ajax_reload', $ajax_reload);
  47 }
  48
  49 /**
  50  * Defines the url to return to in case of error in a sql statement
  51  */
  52 $is_gotofile  = true;
  53 if (empty($goto)) {
  54     if (empty($table)) {
  55         $goto = Util::getScriptNameForOption(
  56             $GLOBALS['cfg']['DefaultTabDatabase'],
  57             'database'
  58         );
  59     } else {
  60         $goto = Util::getScriptNameForOption(
  61             $GLOBALS['cfg']['DefaultTabTable'],
  62             'table'
  63         );
  64     }
  65 } // end if
  66
  67 if (! isset($err_url)) {
  68     $err_url = (! empty($back) ? $back : $goto)
  69         . '?' . Url::getCommon(['db' => $GLOBALS['db']])
  70         . ((mb_strpos(' ' . $goto, 'db_') != 1
  71             && strlen($table) > 0)
  72             ? '&amp;table=' . urlencode($table)
  73             : ''
  74         );
  75 } // end if
  76
  77 // Coming from a bookmark dialog
  78 if (isset($_POST['bkm_fields']['bkm_sql_query'])) {
  79     $sql_query = $_POST['bkm_fields']['bkm_sql_query'];
  80 } elseif (isset($_POST['sql_query'])) {
  81     $sql_query = $_POST['sql_query'];
  82 }
  83
  84 // This one is just to fill $db
  85 if (isset($_POST['bkm_fields']['bkm_database'])) {
  86     $db = $_POST['bkm_fields']['bkm_database'];
  87 }
  88
  89 // During grid edit, if we have a relational field, show the dropdown for it.
  90 if (isset($_POST['get_relational_values'])
  91     && $_POST['get_relational_values'] == true
  92 ) {
  93     $sql->getRelationalValues($db, $table);
  94     // script has exited at this point
  95 }
  96
  97 // Just like above, find possible values for enum fields during grid edit.
  98 if (isset($_POST['get_enum_values']) && $_POST['get_enum_values'] == true) {
  99     $sql->getEnumOrSetValues($db, $table, "enum");
 100     // script has exited at this point
 101 }
 102
 103
 104 // Find possible values for set fields during grid edit.
 105 if (isset($_POST['get_set_values']) && $_POST['get_set_values'] == true) {
 106     $sql->getEnumOrSetValues($db, $table, "set");
 107     // script has exited at this point
 108 }
 109
 110 if (isset($_GET['get_default_fk_check_value'])
 111     && $_GET['get_default_fk_check_value'] == true
 112 ) {
 113     $response = Response::getInstance();
 114     $response->addJSON(
 115         'default_fk_check_value',
 116         Util::isForeignKeyCheck()
 117     );
 118     exit;
 119 }
 120
 121 /**
 122  * Check ajax request to set the column order and visibility
 123  */
 124 if (isset($_POST['set_col_prefs']) && $_POST['set_col_prefs'] == true) {
 125     $sql->setColumnOrderOrVisibility($table, $db);
 126     // script has exited at this point
 127 }
 128
 129 // Default to browse if no query set and we have table
 130 // (needed for browsing from DefaultTabTable)
 131 if (empty($sql_query) && strlen($table) > 0 && strlen($db) > 0) {
 132     $sql_query = $sql->getDefaultSqlQueryForBrowse($db, $table);
 133
 134     // set $goto to what will be displayed if query returns 0 rows
 135     $goto = '';
 136 } else {
 137     // Now we can check the parameters
 138     Util::checkParameters(['sql_query']);
 139 }
 140
 141 /**
 142  * Parse and analyze the query
 143  */
 144 list(
 145     $analyzed_sql_results,
 146     $db,
 147     $table_from_sql
 148 ) = ParseAnalyze::sqlQuery($sql_query, $db);
 149 // @todo: possibly refactor
 150 extract($analyzed_sql_results);
 151
 152 if ($table != $table_from_sql && ! empty($table_from_sql)) {
 153     $table = $table_from_sql;
 154 }
 155
 156
 157 /**
 158  * Check rights in case of DROP DATABASE
 159  *
 160  * This test may be bypassed if $is_js_confirmed = 1 (already checked with js)
 161  * but since a malicious user may pass this variable by url/form, we don't take
 162  * into account this case.
 163  */
 164 if ($sql->hasNoRightsToDropDatabase(
 165     $analyzed_sql_results,
 166     $cfg['AllowUserDropDatabase'],
 167     $GLOBALS['dbi']->isSuperuser()
 168 )) {
 169     Util::mysqlDie(
 170         __('"DROP DATABASE" statements are disabled.'),
 171         '',
 172         false,
 173         $err_url
 174     );
 175 } // end if
 176
 177 /**
 178  * Need to find the real end of rows?
 179  */
 180 if (isset($find_real_end) && $find_real_end) {
 181     $unlim_num_rows = $sql->findRealEndOfRows($db, $table);
 182 }
 183
 184
 185 /**
 186  * Bookmark add
 187  */
 188 if (isset($_POST['store_bkm'])) {
 189     $sql->addBookmark($goto);
 190     // script has exited at this point
 191 } // end if
 192
 193
 194 /**
 195  * Sets or modifies the $goto variable if required
 196  */
 197 if ($goto == 'sql.php') {
 198     $is_gotofile = false;
 199     $goto = 'sql.php' . Url::getCommon(
 200         [
 201             'db' => $db,
 202             'table' => $table,
 203             'sql_query' => $sql_query,
 204         ]
 205     );
 206 } // end if
 207
 208 $sql->executeQueryAndSendQueryResponse(
 209     $analyzed_sql_results, // analyzed_sql_results
 210     $is_gotofile, // is_gotofile
 211     $db, // db
 212     $table, // table
 213     isset($find_real_end) ? $find_real_end : null, // find_real_end
 214     isset($import_text) ? $import_text : null, // sql_query_for_bookmark
 215     isset($extra_data) ? $extra_data : null, // extra_data
 216     isset($message_to_show) ? $message_to_show : null, // message_to_show
 217     isset($message) ? $message : null, // message
 218     isset($sql_data) ? $sql_data : null, // sql_data
 219     $goto, // goto
 220     $pmaThemeImage, // pmaThemeImage
 221     isset($disp_query) ? $display_query : null, // disp_query
 222     isset($disp_message) ? $disp_message : null, // disp_message
 223     isset($query_type) ? $query_type : null, // query_type
 224     $sql_query, // sql_query
 225     isset($selected) ? $selected : null, // selectedTables
 226     isset($complete_query) ? $complete_query : null // complete_query
 227 );