libraries/Header.class.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * Used to render the header of PMA's pages
   5  *
   6  * @package PhpMyAdmin
   7  */
   8 if (! defined('PHPMYADMIN')) {
   9     exit;
  10 }
  11
  12 require_once 'libraries/Scripts.class.php';
  13 require_once 'libraries/RecentTable.class.php';
  14 require_once 'libraries/Menu.class.php';
  15 require_once 'libraries/navigation/Navigation.class.php';
  16 require_once 'libraries/url_generating.lib.php';
  17
  18
  19 /**
  20  * Class used to output the HTTP and HTML headers
  21  *
  22  * @package PhpMyAdmin
  23  */
  24 class PMA_Header
  25 {
  26     /**
  27      * PMA_Scripts instance
  28      *
  29      * @access private
  30      * @var object
  31      */
  32     private $_scripts;
  33     /**
  34      * PMA_Menu instance
  35      *
  36      * @access private
  37      * @var object
  38      */
  39     private $_menu;
  40     /**
  41      * Whether to offer the option of importing user settings
  42      *
  43      * @access private
  44      * @var bool
  45      */
  46     private $_userprefsOfferImport;
  47     /**
  48      * The page title
  49      *
  50      * @access private
  51      * @var string
  52      */
  53     private $_title;
  54     /**
  55      * The value for the id attribute for the body tag
  56      *
  57      * @access private
  58      * @var string
  59      */
  60     private $_bodyId;
  61     /**
  62      * Whether to show the top menu
  63      *
  64      * @access private
  65      * @var bool
  66      */
  67     private $_menuEnabled;
  68     /**
  69      * Whether to show the warnings
  70      *
  71      * @access private
  72      * @var bool
  73      */
  74     private $_warningsEnabled;
  75     /**
  76      * Whether the page is in 'print view' mode
  77      *
  78      * @access private
  79      * @var bool
  80      */
  81     private $_isPrintView;
  82     /**
  83      * Whether we are servicing an ajax request.
  84      * We can't simply use $GLOBALS['is_ajax_request']
  85      * here since it may have not been initialised yet.
  86      *
  87      * @access private
  88      * @var bool
  89      */
  90     private $_isAjax;
  91     /**
  92      * Whether to display anything
  93      *
  94      * @access private
  95      * @var bool
  96      */
  97     private $_isEnabled;
  98     /**
  99      * Whether the HTTP headers (and possibly some HTML)
 100      * have already been sent to the browser
 101      *
 102      * @access private
 103      * @var bool
 104      */
 105     private $_headerIsSent;
 106
 107     /**
 108      * Creates a new class instance
 109      *
 110      * @return new PMA_Header object
 111      */
 112     public function __construct()
 113     {
 114         $this->_isEnabled = true;
 115         $this->_isAjax = false;
 116         $this->_bodyId = '';
 117         $this->_title  = '';
 118         $db = ! empty($GLOBALS['db']) ? $GLOBALS['db'] : '';
 119         $table = ! empty($GLOBALS['table']) ? $GLOBALS['table'] : '';
 120         $this->_menu   = new PMA_Menu(
 121             $GLOBALS['server'],
 122             $db,
 123             $table
 124         );
 125         $this->_menuEnabled = true;
 126         $this->_warningsEnabled = true;
 127         $this->_isPrintView = false;
 128         $this->_scripts     = new PMA_Scripts();
 129         $this->_addDefaultScripts();
 130         $this->_headerIsSent = false;
 131         // if database storage for user preferences is transient,
 132         // offer to load exported settings from localStorage
 133         // (detection will be done in JavaScript)
 134         $this->_userprefsOfferImport = false;
 135         if ($GLOBALS['PMA_Config']->get('user_preferences') == 'session'
 136             && ! isset($_SESSION['userprefs_autoload'])
 137         ) {
 138             $this->_userprefsOfferImport = true;
 139         }
 140     }
 141
 142     /**
 143      * Loads common scripts
 144      *
 145      * @return void
 146      */
 147     private function _addDefaultScripts()
 148     {
 149         $this->_scripts->addFile('jquery/jquery-1.8.3.min.js');
 150         $this->_scripts->addFile('ajax.js');
 151         $this->_scripts->addFile('keyhandler.js');
 152         $this->_scripts->addFile('jquery/jquery-ui-1.9.2.custom.min.js');
 153         $this->_scripts->addFile('jquery/jquery.sprintf.js');
 154         $this->_scripts->addFile('jquery/jquery.cookie.js');
 155         $this->_scripts->addFile('jquery/jquery.mousewheel.js');
 156         $this->_scripts->addFile('jquery/jquery.event.drag-2.2.js');
 157         $this->_scripts->addFile('jquery/jquery-ui-timepicker-addon.js');
 158         $this->_scripts->addFile('jquery/jquery.ba-hashchange-1.3.js');
 159         $this->_scripts->addFile('jquery/jquery.debounce-1.0.5.js');
 160         $this->_scripts->addFile('jquery/jquery.menuResizer-1.0.js');
 161
 162         // Cross-framing protection
 163         if ($GLOBALS['cfg']['AllowThirdPartyFraming'] === false) {
 164             $this->_scripts->addFile('cross_framing_protection.js');
 165         }
 166
 167         $this->_scripts->addFile('rte.js');
 168         if ($GLOBALS['cfg']['ErrorReporting'] == true) {
 169             $this->_scripts->addFile('tracekit/tracekit.js');
 170             $this->_scripts->addFile('error_report.js');
 171         }
 172
 173         // Here would not be a good place to add CodeMirror because
 174         // the user preferences have not been merged at this point
 175
 176         // Localised strings
 177         $params = array('lang' => $GLOBALS['lang']);
 178         if (isset($GLOBALS['db'])) {
 179             $params['db'] = $GLOBALS['db'];
 180         }
 181         $this->_scripts->addFile('messages.php' . PMA_URL_getCommon($params));
 182         // Append the theme id to this url to invalidate
 183         // the cache on a theme change. Though this might be
 184         // unavailable for fatal errors.
 185         if (isset($_SESSION['PMA_Theme'])) {
 186             $theme_id = urlencode($_SESSION['PMA_Theme']->getId());
 187         } else {
 188             $theme_id = 'default';
 189         }
 190         $this->_scripts->addFile(
 191             'get_image.js.php?theme=' . $theme_id
 192         );
 193         $this->_scripts->addFile('doclinks.js');
 194         $this->_scripts->addFile('functions.js');
 195         $this->_scripts->addFile('navigation.js');
 196         $this->_scripts->addFile('indexes.js');
 197         $this->_scripts->addFile('common.js');
 198         $this->_scripts->addCode($this->getJsParamsCode());
 199     }
 200
 201     /**
 202      * Returns, as an array, a list of parameters
 203      * used on the client side
 204      *
 205      * @return array
 206      */
 207     public function getJsParams()
 208     {
 209         $db = ! empty($GLOBALS['db']) ? $GLOBALS['db'] : '';
 210         $table = ! empty($GLOBALS['table']) ? $GLOBALS['table'] : '';
 211         return array(
 212             'common_query' => PMA_URL_getCommon('', '', '&'),
 213             'opendb_url' => $GLOBALS['cfg']['DefaultTabDatabase'],
 214             'safari_browser' => PMA_USR_BROWSER_AGENT == 'SAFARI' ? 1 : 0,
 215             'querywindow_height' => $GLOBALS['cfg']['QueryWindowHeight'],
 216             'querywindow_width' => $GLOBALS['cfg']['QueryWindowWidth'],
 217             'collation_connection' => $GLOBALS['collation_connection'],
 218             'lang' => $GLOBALS['lang'],
 219             'server' => $GLOBALS['server'],
 220             'table' => $table,
 221             'db'    => $db,
 222             'token' => $_SESSION[' PMA_token '],
 223             'text_dir' => $GLOBALS['text_dir'],
 224             'pma_absolute_uri' => $GLOBALS['cfg']['PmaAbsoluteUri'],
 225             'pma_text_default_tab' => PMA_Util::getTitleForTarget(
 226                 $GLOBALS['cfg']['DefaultTabTable']
 227             ),
 228             'pma_text_left_default_tab' => PMA_Util::getTitleForTarget(
 229                 $GLOBALS['cfg']['NavigationTreeDefaultTabTable']
 230             ),
 231             'confirm' => $GLOBALS['cfg']['Confirm']
 232         );
 233     }
 234
 235     /**
 236      * Returns, as a string, a list of parameters
 237      * used on the client side
 238      *
 239      * @return string
 240      */
 241     public function getJsParamsCode()
 242     {
 243         $params = $this->getJsParams();
 244         foreach ($params as $key => $value) {
 245             $params[$key] = $key . ':"' . PMA_escapeJsString($value) . '"';
 246         }
 247         return 'PMA_commonParams.setAll({' . implode(',', $params) . '});';
 248     }
 249
 250     /**
 251      * Disables the rendering of the header
 252      *
 253      * @return void
 254      */
 255     public function disable()
 256     {
 257         $this->_isEnabled = false;
 258     }
 259
 260     /**
 261      * Set the ajax flag to indicate whether
 262      * we are sevicing an ajax request
 263      *
 264      * @param bool $isAjax Whether we are sevicing an ajax request
 265      *
 266      * @return void
 267      */
 268     public function setAjax($isAjax)
 269     {
 270         $this->_isAjax = ($isAjax == true);
 271     }
 272
 273     /**
 274      * Returns the PMA_Scripts object
 275      *
 276      * @return PMA_Scripts object
 277      */
 278     public function getScripts()
 279     {
 280         return $this->_scripts;
 281     }
 282
 283     /**
 284      * Returns the PMA_Menu object
 285      *
 286      * @return PMA_Menu object
 287      */
 288     public function getMenu()
 289     {
 290         return $this->_menu;
 291     }
 292
 293     /**
 294      * Setter for the ID attribute in the BODY tag
 295      *
 296      * @param string $id Value for the ID attribute
 297      *
 298      * @return void
 299      */
 300     public function setBodyId($id)
 301     {
 302         $this->_bodyId = htmlspecialchars($id);
 303     }
 304
 305     /**
 306      * Setter for the title of the page
 307      *
 308      * @param string $title New title
 309      *
 310      * @return void
 311      */
 312     public function setTitle($title)
 313     {
 314         $this->_title = htmlspecialchars($title);
 315     }
 316
 317     /**
 318      * Disables the display of the top menu
 319      *
 320      * @return void
 321      */
 322     public function disableMenu()
 323     {
 324         $this->_menuEnabled = false;
 325     }
 326
 327     /**
 328      * Disables the display of the top menu
 329      *
 330      * @return void
 331      */
 332     public function disableWarnings()
 333     {
 334         $this->_warningsEnabled = false;
 335     }
 336
 337     /**
 338      * Turns on 'print view' mode
 339      *
 340      * @return void
 341      */
 342     public function enablePrintView()
 343     {
 344         $this->disableMenu();
 345         $this->setTitle(__('Print view') . ' - phpMyAdmin ' . PMA_VERSION);
 346         $this->_isPrintView = true;
 347     }
 348
 349     /**
 350      * Generates the header
 351      *
 352      * @return string The header
 353      */
 354     public function getDisplay()
 355     {
 356         $retval = '';
 357         if (! $this->_headerIsSent) {
 358             if (! $this->_isAjax && $this->_isEnabled) {
 359                 $this->sendHttpHeaders();
 360                 $retval .= $this->_getHtmlStart();
 361                 $retval .= $this->_getMetaTags();
 362                 $retval .= $this->_getLinkTags();
 363                 $retval .= $this->getTitleTag();
 364
 365                 // The user preferences have been merged at this point
 366                 // so we can conditionally add CodeMirror
 367                 if ($GLOBALS['cfg']['CodemirrorEnable']) {
 368                     $this->_scripts->addFile('codemirror/lib/codemirror.js');
 369                     $this->_scripts->addFile('codemirror/mode/sql/sql.js');
 370                     $this->_scripts->addFile('codemirror/addon/runmode/runmode.js');
 371                 }
 372                 if ($this->_userprefsOfferImport) {
 373                     $this->_scripts->addFile('config.js');
 374                 }
 375                 $retval .= $this->_scripts->getDisplay();
 376                 $retval .= $this->_getBodyStart();
 377                 if ($this->_menuEnabled && $GLOBALS['server'] > 0) {
 378                     $nav = new PMA_Navigation();
 379                     $retval .= $nav->getDisplay();
 380                 }
 381                 // Include possible custom headers
 382                 if (file_exists(CUSTOM_HEADER_FILE)) {
 383                     ob_start();
 384                     include CUSTOM_HEADER_FILE;
 385                     $retval .= ob_get_contents();
 386                     ob_end_clean();
 387                 }
 388                 // offer to load user preferences from localStorage
 389                 if ($this->_userprefsOfferImport) {
 390                     include_once './libraries/user_preferences.lib.php';
 391                     $retval .= PMA_userprefsAutoloadGetHeader();
 392                 }
 393                 // pass configuration for hint tooltip display
 394                 // (to be used by PMA_tooltip() in js/functions.js)
 395                 if (! $GLOBALS['cfg']['ShowHint']) {
 396                     $retval .= '<span id="no_hint" class="hide"></span>';
 397                 }
 398                 $retval .= $this->_getWarnings();
 399                 if ($this->_menuEnabled && $GLOBALS['server'] > 0) {
 400                     $retval .= $this->_menu->getDisplay();
 401                     $retval .= sprintf(
 402                         '<a id="goto_pagetop" href="#" title="%s">%s</a>',
 403                         __('Click on the bar to scroll to top of page'),
 404                         PMA_Util::getImage('s_top.png')
 405                     );
 406                 }
 407                 $retval .= '<div id="page_content">';
 408                 $retval .= $this->getMessage();
 409             }
 410             if ($this->_isEnabled && empty($_REQUEST['recent_table'])) {
 411                 $retval .= $this->_addRecentTable(
 412                     $GLOBALS['db'],
 413                     $GLOBALS['table']
 414                 );
 415             }
 416         }
 417         return $retval;
 418     }
 419
 420     /**
 421      * Returns the message to be displayed at the top of
 422      * the page, including the executed SQL query, if any.
 423      *
 424      * @return string
 425      */
 426     public function getMessage()
 427     {
 428         $retval = '';
 429         $message = '';
 430         if (! empty($GLOBALS['message'])) {
 431             $message = $GLOBALS['message'];
 432             unset($GLOBALS['message']);
 433         } else if (! empty($_REQUEST['message'])) {
 434             $message = $_REQUEST['message'];
 435         }
 436         if (! empty($message)) {
 437             if (isset($GLOBALS['buffer_message'])) {
 438                 $buffer_message = $GLOBALS['buffer_message'];
 439             }
 440             $retval .= PMA_Util::getMessage($message);
 441             if (isset($buffer_message)) {
 442                 $GLOBALS['buffer_message'] = $buffer_message;
 443             }
 444         }
 445         return $retval;
 446     }
 447
 448     /**
 449      * Sends out the HTTP headers
 450      *
 451      * @return void
 452      */
 453     public function sendHttpHeaders()
 454     {
 455         $https = $GLOBALS['PMA_Config']->isHttps();
 456         $mapTilesUrls = ' *.tile.openstreetmap.org *.tile.opencyclemap.org';
 457
 458         /**
 459          * Sends http headers
 460          */
 461         $GLOBALS['now'] = gmdate('D, d M Y H:i:s') . ' GMT';
 462         if (! defined('TESTSUITE')) {
 463             /* Prevent against ClickJacking by disabling framing */
 464             if (! $GLOBALS['cfg']['AllowThirdPartyFraming']) {
 465                 header(
 466                     'X-Frame-Options: DENY'
 467                 );
 468             }
 469             header(
 470                 "X-Content-Security-Policy: default-src 'self' "
 471                 . 'https://www.google.com '
 472                 . $GLOBALS['cfg']['CSPAllow'] . ';'
 473                 . "options inline-script eval-script;"
 474                 . "img-src 'self' data: "
 475                 . $GLOBALS['cfg']['CSPAllow']
 476                 . ($https ? "" : $mapTilesUrls)
 477                 . ";"
 478             );
 479             if (PMA_USR_BROWSER_AGENT == 'SAFARI'
 480                 && PMA_USR_BROWSER_VER < '6.0.0'
 481             ) {
 482                 header(
 483                     "X-WebKit-CSP: allow 'self' "
 484                     . 'https://www.google.com '
 485                     . $GLOBALS['cfg']['CSPAllow'] . ';'
 486                     . "options inline-script eval-script;"
 487                     . "img-src 'self' data: "
 488                     . $GLOBALS['cfg']['CSPAllow']
 489                     . ($https ? "" : $mapTilesUrls)
 490                     . ";"
 491                 );
 492             } else {
 493                 header(
 494                     "X-WebKit-CSP: default-src 'self' "
 495                     . 'https://www.google.com '
 496                     . $GLOBALS['cfg']['CSPAllow'] . ';'
 497                     . "script-src 'self' "
 498                     . 'https://www.google.com '
 499                     . $GLOBALS['cfg']['CSPAllow']
 500                     . " 'unsafe-inline' 'unsafe-eval';"
 501                     . "style-src 'self' 'unsafe-inline' "
 502                     . 'https://www.google.com '
 503                     . ';'
 504                     . "img-src 'self' data: "
 505                     . $GLOBALS['cfg']['CSPAllow']
 506                     . ($https ? "" : $mapTilesUrls)
 507                     . ";"
 508                 );
 509             }
 510         }
 511         PMA_noCacheHeader();
 512         if (! defined('IS_TRANSFORMATION_WRAPPER') && ! defined('TESTSUITE')) {
 513             // Define the charset to be used
 514             header('Content-Type: text/html; charset=utf-8');
 515         }
 516         $this->_headerIsSent = true;
 517     }
 518
 519     /**
 520      * Returns the DOCTYPE and the start HTML tag
 521      *
 522      * @return string DOCTYPE and HTML tags
 523      */
 524     private function _getHtmlStart()
 525     {
 526         $lang = $GLOBALS['available_languages'][$GLOBALS['lang']][1];
 527         $dir  = $GLOBALS['text_dir'];
 528
 529         $retval  = "<!DOCTYPE HTML>";
 530         $retval .= "<html lang='$lang' dir='$dir' class='";
 531         $retval .= strtolower(PMA_USR_BROWSER_AGENT) . " ";
 532         $retval .= strtolower(PMA_USR_BROWSER_AGENT)
 533             . intval(PMA_USR_BROWSER_VER) . "'>";
 534
 535         return $retval;
 536     }
 537
 538     /**
 539      * Returns the META tags
 540      *
 541      * @return string the META tags
 542      */
 543     private function _getMetaTags()
 544     {
 545         $retval  = '<meta charset="utf-8" />';
 546         $retval .= '<meta name="robots" content="noindex,nofollow" />';
 547         $retval .= '<meta http-equiv="X-UA-Compatible" content="IE=Edge">';
 548         if (! $GLOBALS['cfg']['AllowThirdPartyFraming']) {
 549             $retval .= '<style>html{display: none;}</style>';
 550         }
 551         return $retval;
 552     }
 553
 554     /**
 555      * Returns the LINK tags for the favicon and the stylesheets
 556      *
 557      * @return string the LINK tags
 558      */
 559     private function _getLinkTags()
 560     {
 561         $retval = '<link rel="icon" href="favicon.ico" '
 562             . 'type="image/x-icon" />'
 563             . '<link rel="shortcut icon" href="favicon.ico" '
 564             . 'type="image/x-icon" />';
 565         // stylesheets
 566         $basedir    = defined('PMA_PATH_TO_BASEDIR') ? PMA_PATH_TO_BASEDIR : '';
 567         $common_url = PMA_URL_getCommon(array('server' => $GLOBALS['server']));
 568         $theme_id   = $GLOBALS['PMA_Config']->getThemeUniqueValue();
 569         $theme_path = $GLOBALS['pmaThemePath'];
 570
 571         if ($this->_isPrintView) {
 572             $retval .= '<link rel="stylesheet" type="text/css" href="'
 573                 . $basedir . 'print.css" />';
 574         } else {
 575             $retval .= '<link rel="stylesheet" type="text/css" href="'
 576                 . $basedir . 'phpmyadmin.css.php'
 577                 . $common_url . '&amp;nocache='
 578                 . $theme_id . $GLOBALS['text_dir'] . '" />';
 579             $retval .= '<link rel="stylesheet" type="text/css" href="'
 580                 . $theme_path . '/jquery/jquery-ui-1.9.2.custom.css" />';
 581         }
 582
 583         return $retval;
 584     }
 585
 586     /**
 587      * Returns the TITLE tag
 588      *
 589      * @return string the TITLE tag
 590      */
 591     public function getTitleTag()
 592     {
 593         $retval  = "<title>";
 594         $retval .= $this->_getPageTitle();
 595         $retval .= "</title>";
 596         return $retval;
 597     }
 598
 599     /**
 600      * If the page is missing the title, this function
 601      * will set it to something reasonable
 602      *
 603      * @return string
 604      */
 605     private function _getPageTitle()
 606     {
 607         if (empty($this->_title)) {
 608             if ($GLOBALS['server'] > 0) {
 609                 if (! empty($GLOBALS['table'])) {
 610                     $temp_title = $GLOBALS['cfg']['TitleTable'];
 611                 } else if (! empty($GLOBALS['db'])) {
 612                     $temp_title = $GLOBALS['cfg']['TitleDatabase'];
 613                 } elseif (! empty($GLOBALS['cfg']['Server']['host'])) {
 614                     $temp_title = $GLOBALS['cfg']['TitleServer'];
 615                 } else {
 616                     $temp_title = $GLOBALS['cfg']['TitleDefault'];
 617                 }
 618                 $this->_title = htmlspecialchars(
 619                     PMA_Util::expandUserString($temp_title)
 620                 );
 621             } else {
 622                 $this->_title = 'phpMyAdmin';
 623             }
 624         }
 625         return $this->_title;
 626     }
 627
 628     /**
 629      * Returns the close tag to the HEAD
 630      * and the start tag for the BODY
 631      *
 632      * @return string HEAD and BODY tags
 633      */
 634     private function _getBodyStart()
 635     {
 636         $retval = "</head><body";
 637         if (! empty($this->_bodyId)) {
 638             $retval .= " id='" . $this->_bodyId . "'";
 639         }
 640         $retval .= ">";
 641         return $retval;
 642     }
 643
 644     /**
 645      * Returns some warnings to be displayed at the top of the page
 646      *
 647      * @return string The warnings
 648      */
 649     private function _getWarnings()
 650     {
 651         $retval = '';
 652         if ($this->_warningsEnabled) {
 653             $retval .= "<noscript>";
 654             $retval .= PMA_message::error(
 655                 __("Javascript must be enabled past this point")
 656             )->getDisplay();
 657             $retval .= "</noscript>";
 658         }
 659         return $retval;
 660     }
 661
 662     /**
 663      * Add recently used table and reload the navigation.
 664      *
 665      * @param string $db    Database name where the table is located.
 666      * @param string $table The table name
 667      *
 668      * @return string
 669      */
 670     private function _addRecentTable($db, $table)
 671     {
 672         $retval = '';
 673         if ($this->_menuEnabled
 674             && strlen($table)
 675             && $GLOBALS['cfg']['NumRecentTables'] > 0
 676         ) {
 677             $tmp_result = PMA_RecentTable::getInstance()->add($db, $table);
 678             if ($tmp_result === true) {
 679                 $params  = array('ajax_request' => true, 'recent_table' => true);
 680                 $url     = 'index.php' . PMA_URL_getCommon($params);
 681                 $retval  = '<a class="hide" id="update_recent_tables"';
 682                 $retval .= ' href="' . $url . '"></a>';
 683             } else {
 684                 $error  = $tmp_result;
 685                 $retval = $error->getDisplay();
 686             }
 687         }
 688         return $retval;
 689     }
 690 }
 691
 692 ?>