sql.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * SQL executor
   5  *
   6  * @todo    we must handle the case if sql.php is called directly with a query
   7  *          that returns 0 rows - to prevent cyclic redirects or includes
   8  * @package PhpMyAdmin
   9  */
  10
  11 /**
  12  * Gets some core libraries
  13  */
  14 require_once 'libraries/common.inc.php';
  15 require_once 'libraries/Table.class.php';
  16 require_once 'libraries/Header.class.php';
  17 require_once 'libraries/check_user_privileges.lib.php';
  18 require_once 'libraries/bookmark.lib.php';
  19 require_once 'libraries/sql.lib.php';
  20 require_once 'libraries/sqlparser.lib.php';
  21
  22 $response = PMA_Response::getInstance();
  23 $header   = $response->getHeader();
  24 $scripts  = $header->getScripts();
  25 $scripts->addFile('jquery/jquery-ui-timepicker-addon.js');
  26 $scripts->addFile('jquery/jquery.uitablefilter.js');
  27 $scripts->addFile('tbl_change.js');
  28 $scripts->addFile('indexes.js');
  29 $scripts->addFile('gis_data_editor.js');
  30 $scripts->addFile('multi_column_sort.js');
  31
  32 /**
  33  * Set ajax_reload in the response if it was already set
  34  */
  35 if (isset($ajax_reload) && $ajax_reload['reload'] === true) {
  36     $response->addJSON('ajax_reload', $ajax_reload);
  37 }
  38
  39
  40 /**
  41  * Defines the url to return to in case of error in a sql statement
  42  */
  43 // Security checks
  44 if (! empty($goto)) {
  45     $is_gotofile     = preg_replace('@^([^?]+).*$@s', '\\1', $goto);
  46     if (! @file_exists('' . $is_gotofile)) {
  47         unset($goto);
  48     } else {
  49         $is_gotofile = ($is_gotofile == $goto);
  50     }
  51 } else {
  52     if (empty($table)) {
  53         $goto = $cfg['DefaultTabDatabase'];
  54     } else {
  55         $goto = $cfg['DefaultTabTable'];
  56     }
  57     $is_gotofile  = true;
  58 } // end if
  59
  60 /** @var PMA_String $pmaString */
  61 $pmaString = $GLOBALS['PMA_String'];
  62 if (! isset($err_url)) {
  63     $err_url = (! empty($back) ? $back : $goto)
  64         . '?' . PMA_URL_getCommon(array('db' => $GLOBALS['db']))
  65         . ((/*overload*/mb_strpos(' ' . $goto, 'db_') != 1
  66             && /*overload*/mb_strlen($table))
  67             ? '&amp;table=' . urlencode($table)
  68             : ''
  69         );
  70 } // end if
  71
  72 // Coming from a bookmark dialog
  73 if (isset($_POST['bkm_fields']['bkm_sql_query'])) {
  74     $sql_query = $_POST['bkm_fields']['bkm_sql_query'];
  75 } elseif (isset($_GET['sql_query'])) {
  76     $sql_query = $_GET['sql_query'];
  77 }
  78
  79 // This one is just to fill $db
  80 if (isset($_POST['bkm_fields']['bkm_database'])) {
  81     $db = $_POST['bkm_fields']['bkm_database'];
  82 }
  83
  84
  85 // During grid edit, if we have a relational field, show the dropdown for it.
  86 if (isset($_REQUEST['get_relational_values'])
  87     && $_REQUEST['get_relational_values'] == true
  88 ) {
  89     PMA_getRelationalValues($db, $table);
  90     // script has exited at this point
  91 }
  92
  93 // Just like above, find possible values for enum fields during grid edit.
  94 if (isset($_REQUEST['get_enum_values']) && $_REQUEST['get_enum_values'] == true) {
  95     PMA_getEnumOrSetValues($db, $table, "enum");
  96     // script has exited at this point
  97 }
  98
  99
 100 // Find possible values for set fields during grid edit.
 101 if (isset($_REQUEST['get_set_values']) && $_REQUEST['get_set_values'] == true) {
 102     PMA_getEnumOrSetValues($db, $table, "set");
 103     // script has exited at this point
 104 }
 105
 106 /**
 107  * Check ajax request to set the column order and visibility
 108  */
 109 if (isset($_REQUEST['set_col_prefs']) && $_REQUEST['set_col_prefs'] == true) {
 110     PMA_setColumnOrderOrVisibility($table, $db);
 111     // script has exited at this point
 112 }
 113
 114 // Default to browse if no query set and we have table
 115 // (needed for browsing from DefaultTabTable)
 116 $tableLength = /*overload*/mb_strlen($table);
 117 $dbLength = /*overload*/mb_strlen($db);
 118 if (empty($sql_query) && $tableLength && $dbLength) {
 119     $sql_query = PMA_getDefaultSqlQueryForBrowse($db, $table);
 120
 121     // set $goto to what will be displayed if query returns 0 rows
 122     $goto = '';
 123 } else {
 124     // Now we can check the parameters
 125     PMA_Util::checkParameters(array('sql_query'));
 126 }
 127
 128 /**
 129  * Parse and analyze the query
 130  */
 131 require_once 'libraries/parse_analyze.inc.php';
 132
 133
 134 /**
 135  * Check rights in case of DROP DATABASE
 136  *
 137  * This test may be bypassed if $is_js_confirmed = 1 (already checked with js)
 138  * but since a malicious user may pass this variable by url/form, we don't take
 139  * into account this case.
 140  */
 141 if (PMA_hasNoRightsToDropDatabase(
 142     $analyzed_sql_results, $cfg['AllowUserDropDatabase'], $is_superuser
 143 )) {
 144     PMA_Util::mysqlDie(
 145         __('"DROP DATABASE" statements are disabled.'),
 146         '',
 147         false,
 148         $err_url
 149     );
 150 } // end if
 151
 152 /**
 153  * Need to find the real end of rows?
 154  */
 155 if (isset($find_real_end) && $find_real_end) {
 156     $unlim_num_rows = PMA_findRealEndOfRows($db, $table);
 157 }
 158
 159
 160 /**
 161  * Bookmark add
 162  */
 163 if (isset($_POST['store_bkm'])) {
 164     PMA_addBookmark($cfg['PmaAbsoluteUri'], $goto);
 165     // script has exited at this point
 166 } // end if
 167
 168
 169 /**
 170  * Sets or modifies the $goto variable if required
 171  */
 172 if ($goto == 'sql.php') {
 173     $is_gotofile = false;
 174     $goto = 'sql.php' . PMA_URL_getCommon(
 175         array(
 176             'db' => $db,
 177             'table' => $table,
 178             'sql_query' => $sql_query
 179         )
 180     );
 181 } // end if
 182
 183 PMA_executeQueryAndSendQueryResponse(
 184     $analyzed_sql_results,
 185     $is_gotofile,
 186     $db,
 187     $table,
 188     isset($find_real_end) ? $find_real_end : null,
 189     isset($import_text) ? $import_text : null,
 190     isset($extra_data) ? $extra_data : null,
 191     $is_affected,
 192     isset($message_to_show) ? $message_to_show : null,
 193     isset($disp_mode) ? $disp_mode : null,
 194     isset($message) ? $message : null,
 195     isset($sql_data) ? $sql_data : null,
 196     $goto,
 197     $pmaThemeImage,
 198     isset($disp_query) ? $display_query : null,
 199     isset($disp_message) ? $disp_message : null,
 200     isset($query_type) ? $query_type : null,
 201     $sql_query,
 202     isset($selected) ? $selected : null,
 203     isset($complete_query) ? $complete_query : null
 204 );
 205
 206 ?>