2 /* vim: set expandtab sw=4 ts=4 sts=4: */
4 * Misc stuff and REQUIRED by ALL the scripts.
5 * MUST be included by every script
7 * Among other things, it contains the advanced authentication work.
9 * Order of sections for common.inc.php:
11 * the authentication libraries must be before the connection to db
13 * ... so the required order is:
15 * LABEL_variables_init
16 * - initialize some variables always needed
17 * LABEL_parsing_config_file
18 * - parsing of the configuration file
19 * LABEL_loading_language_file
20 * - loading language file
22 * - check and setup configured servers
26 * - load of MySQL extension (if necessary)
27 * - loading of an authentication library
29 * - authentication work
35 * block attempts to directly run this script
37 if (getcwd() == dirname(__FILE__
)) {
38 die('Attack stopped');
42 * Minimum PHP version; can't call PMA_fatalError() which uses a
43 * PHP 5 function, so cannot easily localize this message.
45 if (version_compare(PHP_VERSION
, '5.3.0', 'lt')) {
46 die('PHP 5.3+ is required');
50 * for verification in all procedural scripts under libraries
52 define('PHPMYADMIN', true);
57 require './libraries/Error_Handler.class.php';
60 * initialize the error handler
62 $GLOBALS['error_handler'] = new PMA_Error_Handler();
63 $cfg['Error_Handler']['display'] = true;
66 * This setting was removed in PHP 5.4. But at this point PMA_PHP_INT_VERSION
67 * is not yet defined so we use another way to find out the PHP version.
69 if (version_compare(phpversion(), '5.4', 'lt')) {
71 * Avoid problems with magic_quotes_runtime
73 @ini_set
('magic_quotes_runtime', false);
79 require './libraries/core.lib.php';
84 require './libraries/sanitizing.lib.php';
87 * Warning about mbstring.
89 if (! function_exists('mb_detect_encoding')) {
90 PMA_warnMissingExtension('mbstring', $fatal = true);
96 require './libraries/Theme.class.php';
99 * the PMA_Theme_Manager class
101 require './libraries/Theme_Manager.class.php';
104 * the PMA_Config class
106 require './libraries/Config.class.php';
109 * the relation lib, tracker needs it
111 require './libraries/relation.lib.php';
114 * the PMA_Tracker class
116 require './libraries/Tracker.class.php';
119 * the PMA_Table class
121 require './libraries/Table.class.php';
124 * the PMA_Types class
126 require './libraries/Types.class.php';
128 if (! defined('PMA_MINIMUM_COMMON')) {
132 include_once './libraries/Util.class.php';
135 * JavaScript escaping.
137 include_once './libraries/js_escape.lib.php';
140 * Include URL/hidden inputs generating.
142 include_once './libraries/url_generating.lib.php';
145 * Used to generate the page
147 include_once 'libraries/Response.class.php';
150 /******************************************************************************/
151 /* start procedural code label_start_procedural */
154 * PATH_INFO could be compromised if set, so remove it from PHP_SELF
155 * and provide a clean PHP_SELF here
157 $PMA_PHP_SELF = PMA_getenv('PHP_SELF');
158 $_PATH_INFO = PMA_getenv('PATH_INFO');
159 if (! empty($_PATH_INFO) && ! empty($PMA_PHP_SELF)) {
160 $path_info_pos = strrpos($PMA_PHP_SELF, $_PATH_INFO);
161 if ($path_info_pos +
strlen($_PATH_INFO) === strlen($PMA_PHP_SELF)) {
162 $PMA_PHP_SELF = substr($PMA_PHP_SELF, 0, $path_info_pos);
165 $PMA_PHP_SELF = htmlspecialchars($PMA_PHP_SELF);
169 * just to be sure there was no import (registering) before here
170 * we empty the global space (but avoid unsetting $variables_list
171 * and $key in the foreach (), we still need them!)
173 $variables_whitelist = array (
185 'variables_whitelist',
189 foreach (get_defined_vars() as $key => $value) {
190 if (! in_array($key, $variables_whitelist)) {
194 unset($key, $value, $variables_whitelist);
198 * Subforms - some functions need to be called by form, cause of the limited URL
199 * length, but if this functions inside another form you cannot just open a new
200 * form - so phpMyAdmin uses 'arrays' inside this form
204 * ... main form elments ...
205 * <input type="hidden" name="subform[action1][id]" value="1" />
206 * ... other subform data ...
207 * <input type="submit" name="usesubform[action1]" value="do action1" />
208 * ... other subforms ...
209 * <input type="hidden" name="subform[actionX][id]" value="X" />
210 * ... other subform data ...
211 * <input type="submit" name="usesubform[actionX]" value="do actionX" />
212 * ... main form elments ...
213 * <input type="submit" name="main_action" value="submit form" />
217 * so we now check if a subform is submitted
220 if (isset($_POST['usesubform'])) {
221 // if a subform is present and should be used
222 // the rest of the form is deprecated
223 $subform_id = key($_POST['usesubform']);
224 $subform = $_POST['subform'][$subform_id];
226 $_REQUEST = $subform;
228 * some subforms need another page than the main form, so we will just
229 * include this page at the end of this script - we use $__redirect to
232 if (isset($_POST['redirect'])
233 && $_POST['redirect'] != basename($PMA_PHP_SELF)
235 $__redirect = $_POST['redirect'];
236 unset($_POST['redirect']);
238 unset($subform_id, $subform);
240 // Note: here we overwrite $_REQUEST so that it does not contain cookies,
241 // because another application for the same domain could have set
242 // a cookie (with a compatible path) that overrides a variable
243 // we expect from GET or POST.
244 // We'll refer to cookies explicitly with the $_COOKIE syntax.
245 $_REQUEST = array_merge($_GET, $_POST);
247 // end check if a subform is submitted
250 * This setting was removed in PHP 5.4. But at this point PMA_PHP_INT_VERSION
251 * is not yet defined so we use another way to find out the PHP version.
253 if (version_compare(phpversion(), '5.4', 'lt')) {
254 // remove quotes added by PHP
255 if (function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc()) {
256 PMA_arrayWalkRecursive($_GET, 'stripslashes', true);
257 PMA_arrayWalkRecursive($_POST, 'stripslashes', true);
258 PMA_arrayWalkRecursive($_COOKIE, 'stripslashes', true);
259 PMA_arrayWalkRecursive($_REQUEST, 'stripslashes', true);
264 * check timezone setting
265 * this could produce an E_STRICT - but only once,
266 * if not done here it will produce E_STRICT on every date/time function
267 * (starting with PHP 5.3, this code can produce E_WARNING rather than
271 date_default_timezone_set(@date_default_timezone_get
());
273 /******************************************************************************/
274 /* parsing configuration file LABEL_parsing_config_file */
277 * We really need this one!
279 if (! function_exists('preg_replace')) {
280 PMA_warnMissingExtension('pcre', true);
284 * JSON is required in several places.
286 if (! function_exists('json_encode')) {
287 PMA_warnMissingExtension('json', true);
291 * @global PMA_Config $GLOBALS['PMA_Config']
292 * force reading of config file, because we removed sensitive values
293 * in the previous iteration
295 $GLOBALS['PMA_Config'] = new PMA_Config(CONFIG_FILE
);
297 if (!defined('PMA_MINIMUM_COMMON')) {
298 $GLOBALS['PMA_Config']->checkPmaAbsoluteUri();
302 * BC - enable backward compatibility
303 * exports all configuration settings into $GLOBALS ($GLOBALS['cfg'])
305 $GLOBALS['PMA_Config']->enableBc();
308 * clean cookies on upgrade
309 * when changing something related to PMA cookies, increment the cookie version
311 $pma_cookie_version = 4;
313 && (isset($_COOKIE['pmaCookieVer'])
314 && $_COOKIE['pmaCookieVer'] < $pma_cookie_version)
316 // delete all cookies
317 foreach ($_COOKIE as $cookie_name => $tmp) {
318 $GLOBALS['PMA_Config']->removeCookie($cookie_name);
321 $GLOBALS['PMA_Config']->setCookie('pmaCookieVer', $pma_cookie_version);
326 * check HTTPS connection
328 if ($GLOBALS['PMA_Config']->get('ForceSSL')
329 && ! $GLOBALS['PMA_Config']->get('is_https')
332 $url = $GLOBALS['PMA_Config']->getSSLUri();
334 PMA_sendHeaderLocation($url . PMA_URL_getCommon($_GET, 'text'));
335 // delete the current session, otherwise we get problems (see bug #2397877)
336 $GLOBALS['PMA_Config']->removeCookie($GLOBALS['session_name']);
342 * include session handling after the globals, to prevent overwriting
344 require './libraries/session.inc.php';
347 * init some variables LABEL_variables_init
351 * holds parameters to be passed to next page
352 * @global array $GLOBALS['url_params']
354 $GLOBALS['url_params'] = array();
357 * the whitelist for $GLOBALS['goto']
358 * @global array $goto_whitelist
360 $goto_whitelist = array(
361 //'browse_foreigners.php',
369 'db_importdocsql.php',
388 'server_collations.php',
389 'server_databases.php',
390 'server_engines.php',
393 'server_privileges.php',
396 'server_status_advisor.php',
397 'server_status_monitor.php',
398 'server_status_queries.php',
399 'server_status_variables.php',
400 'server_variables.php',
411 'tbl_operations.php',
415 'tbl_row_action.php',
417 'tbl_zoom_select.php',
419 'transformation_overview.php',
420 'transformation_wrapper.php',
425 * check $__redirect against whitelist
427 if (! PMA_checkPageValidity($__redirect, $goto_whitelist)) {
432 * holds page that should be displayed
433 * @global string $GLOBALS['goto']
435 $GLOBALS['goto'] = '';
436 // Security fix: disallow accessing serious server files via "?goto="
437 if (PMA_checkPageValidity($_REQUEST['goto'], $goto_whitelist)) {
438 $GLOBALS['goto'] = $_REQUEST['goto'];
439 $GLOBALS['url_params']['goto'] = $_REQUEST['goto'];
441 unset($_REQUEST['goto'], $_GET['goto'], $_POST['goto'], $_COOKIE['goto']);
446 * @global string $GLOBALS['back']
448 if (PMA_checkPageValidity($_REQUEST['back'], $goto_whitelist)) {
449 $GLOBALS['back'] = $_REQUEST['back'];
451 unset($_REQUEST['back'], $_GET['back'], $_POST['back'], $_COOKIE['back']);
455 * Check whether user supplied token is valid, if not remove any possibly
456 * dangerous stuff from request.
458 * remember that some objects in the session with session_start and __wakeup()
459 * could access this variables before we reach this point
460 * f.e. PMA_Config: fontsize
462 * @todo variables should be handled by their respective owners (objects)
463 * f.e. lang, server, collation_connection in PMA_Config
465 $token_mismatch = true;
466 if (PMA_isValid($_REQUEST['token'])) {
467 $token_mismatch = ($_SESSION[' PMA_token '] != $_REQUEST['token']);
470 if ($token_mismatch) {
472 * List of parameters which are allowed from unsafe source
475 /* needed for direct access, see FAQ 1.34
476 * also, server needed for cookie login screen (multi-server)
478 'server', 'db', 'table', 'target', 'lang',
481 /* Cookie preferences */
482 'pma_lang', 'pma_collation_connection',
483 /* Possible login form */
484 'pma_servername', 'pma_username', 'pma_password',
485 /* Needed to send the correct reply */
487 /* Permit to log out even if there is a token mismatch */
491 * Allow changing themes in test/theme.php
493 if (defined('PMA_TEST_THEME')) {
494 $allow_list[] = 'set_theme';
497 * Require cleanup functions
499 include './libraries/cleanup.lib.php';
503 PMA_removeRequestVars($allow_list);
509 * current selected database
510 * @global string $GLOBALS['db']
513 if (PMA_isValid($_REQUEST['db'])) {
514 // can we strip tags from this?
515 // only \ and / is not allowed in db names for MySQL
516 $GLOBALS['db'] = $_REQUEST['db'];
517 $GLOBALS['url_params']['db'] = $GLOBALS['db'];
521 * current selected table
522 * @global string $GLOBALS['table']
524 $GLOBALS['table'] = '';
525 if (PMA_isValid($_REQUEST['table'])) {
526 // can we strip tags from this?
527 // only \ and / is not allowed in table names for MySQL
528 $GLOBALS['table'] = $_REQUEST['table'];
529 $GLOBALS['url_params']['table'] = $GLOBALS['table'];
533 * Store currently selected recent table.
534 * Affect $GLOBALS['db'] and $GLOBALS['table']
536 if (PMA_isValid($_REQUEST['selected_recent_table'])) {
537 $recent_table = json_decode($_REQUEST['selected_recent_table'], true);
538 $GLOBALS['db'] = $recent_table['db'];
539 $GLOBALS['url_params']['db'] = $GLOBALS['db'];
540 $GLOBALS['table'] = $recent_table['table'];
541 $GLOBALS['url_params']['table'] = $GLOBALS['table'];
545 * SQL query to be executed
546 * @global string $GLOBALS['sql_query']
548 $GLOBALS['sql_query'] = '';
549 if (PMA_isValid($_REQUEST['sql_query'])) {
550 $GLOBALS['sql_query'] = $_REQUEST['sql_query'];
553 //$_REQUEST['set_theme'] // checked later in this file LABEL_theme_setup
554 //$_REQUEST['server']; // checked later in this file
555 //$_REQUEST['lang']; // checked by LABEL_loading_language_file
557 /******************************************************************************/
558 /* loading language file LABEL_loading_language_file */
561 * lang detection is done here
563 require './libraries/select_lang.lib.php';
565 // Defines the cell alignment values depending on text direction
566 if ($GLOBALS['text_dir'] == 'ltr') {
567 $GLOBALS['cell_align_left'] = 'left';
568 $GLOBALS['cell_align_right'] = 'right';
570 $GLOBALS['cell_align_left'] = 'right';
571 $GLOBALS['cell_align_right'] = 'left';
575 * check for errors occurred while loading configuration
576 * this check is done here after loading language files to present errors in locale
578 $GLOBALS['PMA_Config']->checkPermissions();
580 if ($GLOBALS['PMA_Config']->error_config_file
) {
581 $error = '[strong]' . __('Failed to read configuration file') . '[/strong]'
583 . __('This usually means there is a syntax error in it, please check any errors shown below.')
586 trigger_error($error, E_USER_ERROR
);
588 if ($GLOBALS['PMA_Config']->error_config_default_file
) {
590 __('Could not load default configuration from: %1$s'),
591 $GLOBALS['PMA_Config']->default_source
593 trigger_error($error, E_USER_ERROR
);
595 if ($GLOBALS['PMA_Config']->error_pma_uri
) {
597 __('The [code]$cfg[\'PmaAbsoluteUri\'][/code] directive MUST be set in your configuration file!'),
603 /******************************************************************************/
604 /* setup servers LABEL_setup_servers */
608 * @global integer $GLOBALS['server']
610 $GLOBALS['server'] = 0;
613 * Servers array fixups.
614 * $default_server comes from PMA_Config::enableBc()
615 * @todo merge into PMA_Config
617 // Do we have some server?
618 if (! isset($cfg['Servers']) ||
count($cfg['Servers']) == 0) {
619 // No server => create one with defaults
620 $cfg['Servers'] = array(1 => $default_server);
622 // We have server(s) => apply default configuration
623 $new_servers = array();
625 foreach ($cfg['Servers'] as $server_index => $each_server) {
627 // Detect wrong configuration
628 if (!is_int($server_index) ||
$server_index < 1) {
630 sprintf(__('Invalid server index: %s'), $server_index),
635 $each_server = array_merge($default_server, $each_server);
637 // Don't use servers with no hostname
638 if ($each_server['connect_type'] == 'tcp' && empty($each_server['host'])) {
641 __('Invalid hostname for server %1$s. Please review your configuration.'),
648 // Final solution to bug #582890
649 // If we are using a socket connection
650 // and there is nothing in the verbose server name
651 // or the host field, then generate a name for the server
652 // in the form of "Server 2", localized of course!
653 if ($each_server['connect_type'] == 'socket'
654 && empty($each_server['host'])
655 && empty($each_server['verbose'])
657 $each_server['verbose'] = sprintf(__('Server %d'), $server_index);
660 $new_servers[$server_index] = $each_server;
662 $cfg['Servers'] = $new_servers;
663 unset($new_servers, $server_index, $each_server);
667 unset($default_server);
670 /******************************************************************************/
671 /* setup themes LABEL_theme_setup */
674 * @global PMA_Theme_Manager $_SESSION['PMA_Theme_Manager']
676 if (! isset($_SESSION['PMA_Theme_Manager'])) {
677 $_SESSION['PMA_Theme_Manager'] = new PMA_Theme_Manager
;
680 * @todo move all __wakeup() functionality into session.inc.php
682 $_SESSION['PMA_Theme_Manager']->checkConfig();
685 // for the theme per server feature
686 if (isset($_REQUEST['server']) && ! isset($_REQUEST['set_theme'])) {
687 $GLOBALS['server'] = $_REQUEST['server'];
688 $tmp = $_SESSION['PMA_Theme_Manager']->getThemeCookie();
690 $tmp = $_SESSION['PMA_Theme_Manager']->theme_default
;
692 $_SESSION['PMA_Theme_Manager']->setActiveTheme($tmp);
696 * @todo move into PMA_Theme_Manager::__wakeup()
698 if (isset($_REQUEST['set_theme'])) {
699 // if user selected a theme
700 $_SESSION['PMA_Theme_Manager']->setActiveTheme($_REQUEST['set_theme']);
705 * @global PMA_Theme $_SESSION['PMA_Theme']
707 $_SESSION['PMA_Theme'] = $_SESSION['PMA_Theme_Manager']->theme
;
712 * @global string $GLOBALS['theme']
714 $GLOBALS['theme'] = $_SESSION['PMA_Theme']->getName();
717 * @global string $GLOBALS['pmaThemePath']
719 $GLOBALS['pmaThemePath'] = $_SESSION['PMA_Theme']->getPath();
721 * the theme image path
722 * @global string $GLOBALS['pmaThemeImage']
724 $GLOBALS['pmaThemeImage'] = $_SESSION['PMA_Theme']->getImgPath();
727 * load layout file if exists
729 if (@file_exists
($_SESSION['PMA_Theme']->getLayoutFile())) {
730 include $_SESSION['PMA_Theme']->getLayoutFile();
733 if (! defined('PMA_MINIMUM_COMMON')) {
735 * Character set conversion.
737 include_once './libraries/charset_conversion.lib.php';
742 include_once './libraries/string.inc.php';
745 * Lookup server by name
748 if (! empty($_REQUEST['server'])
749 && is_string($_REQUEST['server'])
750 && ! is_numeric($_REQUEST['server'])
752 foreach ($cfg['Servers'] as $i => $server) {
753 if ($server['host'] == $_REQUEST['server']
754 ||
$server['verbose'] == $_REQUEST['server']
755 ||
$PMA_String->strtolower($server['verbose']) == $PMA_String->strtolower($_REQUEST['server'])
756 ||
md5($PMA_String->strtolower($server['verbose'])) == $PMA_String->strtolower($_REQUEST['server'])
758 $_REQUEST['server'] = $i;
762 if (is_string($_REQUEST['server'])) {
763 unset($_REQUEST['server']);
769 * If no server is selected, make sure that $cfg['Server'] is empty (so
770 * that nothing will work), and skip server authentication.
771 * We do NOT exit here, but continue on without logging into any server.
772 * This way, the welcome page will still come up (with no server info) and
773 * present a choice of servers in the case that there are multiple servers
774 * and '$cfg['ServerDefault'] = 0' is set.
777 if (isset($_REQUEST['server'])
778 && (is_string($_REQUEST['server']) ||
is_numeric($_REQUEST['server']))
779 && ! empty($_REQUEST['server'])
780 && ! empty($cfg['Servers'][$_REQUEST['server']])
782 $GLOBALS['server'] = $_REQUEST['server'];
783 $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
785 if (!empty($cfg['Servers'][$cfg['ServerDefault']])) {
786 $GLOBALS['server'] = $cfg['ServerDefault'];
787 $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
789 $GLOBALS['server'] = 0;
790 $cfg['Server'] = array();
793 $GLOBALS['url_params']['server'] = $GLOBALS['server'];
796 * Kanji encoding convert feature appended by Y.Kawada (2002/2/20)
798 if (function_exists('mb_convert_encoding')
801 include_once './libraries/kanji-encoding.lib.php';
805 * save some settings in cookies
806 * @todo should be done in PMA_Config
808 $GLOBALS['PMA_Config']->setCookie('pma_lang', $GLOBALS['lang']);
809 if (isset($GLOBALS['collation_connection'])) {
810 $GLOBALS['PMA_Config']->setCookie(
811 'pma_collation_connection',
812 $GLOBALS['collation_connection']
816 $_SESSION['PMA_Theme_Manager']->setThemeCookie();
818 if (! empty($cfg['Server'])) {
821 * Loads the proper database interface for this server
823 include_once './libraries/database_interface.inc.php';
825 include_once './libraries/logging.lib.php';
827 // get LoginCookieValidity from preferences cache
828 // no generic solution for loading preferences from cache as some settings
829 // need to be kept for processing in PMA_Config::loadUserPreferences()
830 $cache_key = 'server_' . $GLOBALS['server'];
831 if (isset($_SESSION['cache'][$cache_key]['userprefs']['LoginCookieValidity'])) {
832 $value = $_SESSION['cache'][$cache_key]['userprefs']['LoginCookieValidity'];
833 $GLOBALS['PMA_Config']->set('LoginCookieValidity', $value);
834 $GLOBALS['cfg']['LoginCookieValidity'] = $value;
839 // Gets the authentication library that fits the $cfg['Server'] settings
840 // and run authentication
842 // to allow HTTP or http
843 $cfg['Server']['auth_type'] = strtolower($cfg['Server']['auth_type']);
846 * the required auth type plugin
848 $auth_class = "Authentication" . ucfirst($cfg['Server']['auth_type']);
849 if (! file_exists('./libraries/plugins/auth/' . $auth_class . '.class.php')) {
851 __('Invalid authentication method set in configuration:')
852 . ' ' . $cfg['Server']['auth_type']
855 include_once './libraries/plugins/auth/' . $auth_class . '.class.php';
856 // todo: add plugin manager
857 $plugin_manager = null;
858 $auth_plugin = new $auth_class($plugin_manager);
860 if (! $auth_plugin->authCheck()) {
861 /* Force generating of new session on login */
863 $auth_plugin->auth();
865 $auth_plugin->authSetUser();
868 // Check IP-based Allow/Deny rules as soon as possible to reject the
870 // Based on mod_access in Apache:
871 // http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/aaa/mod_access.c?rev=1.37&content-type=text/vnd.viewcvs-markup
872 // Look at: "static int check_dir_access(request_rec *r)"
873 if (isset($cfg['Server']['AllowDeny'])
874 && isset($cfg['Server']['AllowDeny']['order'])
878 * ip based access library
880 include_once './libraries/ip_allow_deny.lib.php';
882 $allowDeny_forbidden = false; // default
883 if ($cfg['Server']['AllowDeny']['order'] == 'allow,deny') {
884 $allowDeny_forbidden = true;
885 if (PMA_allowDeny('allow')) {
886 $allowDeny_forbidden = false;
888 if (PMA_allowDeny('deny')) {
889 $allowDeny_forbidden = true;
891 } elseif ($cfg['Server']['AllowDeny']['order'] == 'deny,allow') {
892 if (PMA_allowDeny('deny')) {
893 $allowDeny_forbidden = true;
895 if (PMA_allowDeny('allow')) {
896 $allowDeny_forbidden = false;
898 } elseif ($cfg['Server']['AllowDeny']['order'] == 'explicit') {
899 if (PMA_allowDeny('allow') && ! PMA_allowDeny('deny')) {
900 $allowDeny_forbidden = false;
902 $allowDeny_forbidden = true;
904 } // end if ... elseif ... elseif
906 // Ejects the user if banished
907 if ($allowDeny_forbidden) {
908 PMA_logUser($cfg['Server']['user'], 'allow-denied');
909 $auth_plugin->authFails();
914 if (! $cfg['Server']['AllowRoot'] && $cfg['Server']['user'] == 'root') {
915 $allowDeny_forbidden = true;
916 PMA_logUser($cfg['Server']['user'], 'root-denied');
917 $auth_plugin->authFails();
920 // is a login without password allowed?
921 if (! $cfg['Server']['AllowNoPassword'] && $cfg['Server']['password'] == '') {
922 $login_without_password_is_forbidden = true;
923 PMA_logUser($cfg['Server']['user'], 'empty-denied');
924 $auth_plugin->authFails();
927 // if using TCP socket is not needed
928 if (strtolower($cfg['Server']['connect_type']) == 'tcp') {
929 $cfg['Server']['socket'] = '';
932 // Try to connect MySQL with the control user profile (will be used to
933 // get the privileges list for the current user but the true user link
934 // must be open after this one so it would be default one for all the
936 $controllink = false;
937 if ($cfg['Server']['controluser'] != '') {
938 if (! empty($cfg['Server']['controlhost'])
939 ||
! empty($cfg['Server']['controlport'])
941 $server_details = array();
942 if (! empty($cfg['Server']['controlhost'])) {
943 $server_details['host'] = $cfg['Server']['controlhost'];
945 $server_details['host'] = $cfg['Server']['host'];
947 if (! empty($cfg['Server']['controlport'])) {
948 $server_details['port'] = $cfg['Server']['controlport'];
949 } elseif ($server_details['host'] == $cfg['Server']['host']) {
950 // Evaluates to true when controlhost == host
951 // or controlhost is not defined (hence it defaults to host)
952 // In such case we can use the value of port.
953 $server_details['port'] = $cfg['Server']['port'];
955 // otherwise we leave the $server_details['port'] unset,
956 // allowing it to take default mysql port
958 $controllink = $GLOBALS['dbi']->connect(
959 $cfg['Server']['controluser'],
960 $cfg['Server']['controlpass'],
965 $controllink = $GLOBALS['dbi']->connect(
966 $cfg['Server']['controluser'],
967 $cfg['Server']['controlpass'],
973 // Connects to the server (validates user's login)
974 $userlink = $GLOBALS['dbi']->connect(
975 $cfg['Server']['user'], $cfg['Server']['password'], false
978 if (! $controllink) {
979 $controllink = $userlink;
983 PMA_logUser($cfg['Server']['user']);
986 * with phpMyAdmin 3 we support MySQL >=5
987 * but only production releases:
990 if (PMA_MYSQL_INT_VERSION
< 50015) {
992 __('You should upgrade to %s %s or later.'),
993 array('MySQL', '5.0.15')
998 * Type handling object.
1001 $GLOBALS['PMA_Types'] = new PMA_Types_Drizzle();
1003 $GLOBALS['PMA_Types'] = new PMA_Types_MySQL();
1007 // DisableIS must be set to false for Drizzle, it maps SHOW commands
1008 // to INFORMATION_SCHEMA queries anyway so it's fast on large servers
1009 $cfg['Server']['DisableIS'] = false;
1010 // SHOW OPEN TABLES is not supported by Drizzle
1011 $cfg['SkipLockedTables'] = false;
1017 include_once './libraries/sqlparser.lib.php';
1020 * SQL Validator interface code
1022 include_once './libraries/sqlvalidator.lib.php';
1025 * the PMA_List_Database class
1027 include_once './libraries/PMA.php';
1029 $pma->userlink
= $userlink;
1030 $pma->controllink
= $controllink;
1033 * some resetting has to be done when switching servers
1035 if (isset($_SESSION['tmp_user_values']['previous_server'])
1036 && $_SESSION['tmp_user_values']['previous_server'] != $GLOBALS['server']
1038 unset($_SESSION['tmp_user_values']['navi_limit_offset']);
1040 $_SESSION['tmp_user_values']['previous_server'] = $GLOBALS['server'];
1042 } // end server connecting
1045 * check if profiling was requested and remember it
1046 * (note: when $cfg['ServerDefault'] = 0, constant is not defined)
1048 if (isset($_REQUEST['profiling'])
1049 && PMA_Util
::profilingSupported()
1051 $_SESSION['profiling'] = true;
1052 } elseif (isset($_REQUEST['profiling_form'])) {
1053 // the checkbox was unchecked
1054 unset($_SESSION['profiling']);
1057 * Inclusion of profiling scripts is needed on various
1058 * pages like sql, tbl_sql, db_sql, tbl_select
1060 if (! defined('PMA_BYPASS_GET_INSTANCE')) {
1061 $response = PMA_Response
::getInstance();
1063 if (isset($_SESSION['profiling'])) {
1064 $header = $response->getHeader();
1065 $scripts = $header->getScripts();
1066 /* < IE 9 doesn't support canvas natively */
1067 if (PMA_USR_BROWSER_AGENT
== 'IE' && PMA_USR_BROWSER_VER
< 9) {
1068 $scripts->addFile('canvg/flashcanvas.js');
1070 $scripts->addFile('jqplot/jquery.jqplot.js');
1071 $scripts->addFile('jqplot/plugins/jqplot.pieRenderer.js');
1072 $scripts->addFile('jqplot/plugins/jqplot.highlighter.js');
1073 $scripts->addFile('canvg/canvg.js');
1074 $scripts->addFile('jquery/jquery.tablesorter.js');
1078 * There is no point in even attempting to process
1079 * an ajax request if there is a token mismatch
1081 if (isset($response) && $response->isAjax() && $token_mismatch) {
1082 $response->isSuccess(false);
1085 PMA_Message
::error(__('Error: Token mismatch'))
1089 } // end if !defined('PMA_MINIMUM_COMMON')
1091 // load user preferences
1092 $GLOBALS['PMA_Config']->loadUserPreferences();
1094 // remove sensitive values from session
1095 $GLOBALS['PMA_Config']->set('blowfish_secret', '');
1096 $GLOBALS['PMA_Config']->set('Servers', '');
1097 $GLOBALS['PMA_Config']->set('default_server', '');
1099 /* Tell tracker that it can actually work */
1100 PMA_Tracker
::enable();
1103 * @global boolean $GLOBALS['is_ajax_request']
1104 * @todo should this be moved to the variables init section above?
1106 * Check if the current request is an AJAX request, and set is_ajax_request
1107 * accordingly. Suppress headers, footers and unnecessary output if set to
1110 if (isset($_REQUEST['ajax_request']) && $_REQUEST['ajax_request'] == true) {
1111 $GLOBALS['is_ajax_request'] = true;
1113 $GLOBALS['is_ajax_request'] = false;
1116 if (isset($_REQUEST['GLOBALS']) ||
isset($_FILES['GLOBALS'])) {
1117 PMA_fatalError(__("GLOBALS overwrite attempt"));
1121 * protect against possible exploits - there is no need to have so much variables
1123 if (count($_REQUEST) > 1000) {
1124 PMA_fatalError(__('possible exploit'));
1128 * Check for numeric keys
1129 * (if register_globals is on, numeric key can be found in $GLOBALS)
1131 foreach ($GLOBALS as $key => $dummy) {
1132 if (is_numeric($key)) {
1133 PMA_fatalError(__('numeric key detected'));
1138 // here, the function does not exist with this configuration:
1139 // $cfg['ServerDefault'] = 0;
1140 $GLOBALS['is_superuser']
1141 = isset($GLOBALS['dbi']) && $GLOBALS['dbi']->isSuperuser();
1143 if (!empty($__redirect) && in_array($__redirect, $goto_whitelist)) {
1145 * include subform target page
1147 include $__redirect;