sql.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * SQL executor
   5  *
   6  * @todo    we must handle the case if sql.php is called directly with a query
   7  *          that returns 0 rows - to prevent cyclic redirects or includes
   8  * @package PhpMyAdmin
   9  */
  10
  11 /**
  12  * Gets some core libraries
  13  */
  14 require_once 'libraries/common.inc.php';
  15 require_once 'libraries/Table.class.php';
  16 require_once 'libraries/Header.class.php';
  17 require_once 'libraries/check_user_privileges.lib.php';
  18 require_once 'libraries/bookmark.lib.php';
  19 require_once 'libraries/sql.lib.php';
  20 require_once 'libraries/config/page_settings.class.php';
  21
  22 PMA_PageSettings::showGroup('Browse');
  23
  24
  25 $response = PMA_Response::getInstance();
  26 $header   = $response->getHeader();
  27 $scripts  = $header->getScripts();
  28 $scripts->addFile('jquery/jquery-ui-timepicker-addon.js');
  29 $scripts->addFile('jquery/jquery.uitablefilter.js');
  30 $scripts->addFile('tbl_change.js');
  31 $scripts->addFile('indexes.js');
  32 $scripts->addFile('gis_data_editor.js');
  33 $scripts->addFile('multi_column_sort.js');
  34
  35 /**
  36  * Set ajax_reload in the response if it was already set
  37  */
  38 if (isset($ajax_reload) && $ajax_reload['reload'] === true) {
  39     $response->addJSON('ajax_reload', $ajax_reload);
  40 }
  41
  42
  43 /**
  44  * Defines the url to return to in case of error in a sql statement
  45  */
  46 // Security checks
  47 if (! empty($goto)) {
  48     $is_gotofile     = preg_replace('@^([^?]+).*$@s', '\\1', $goto);
  49     if (! @file_exists('' . $is_gotofile)) {
  50         unset($goto);
  51     } else {
  52         $is_gotofile = ($is_gotofile == $goto);
  53     }
  54 } else {
  55     if (empty($table)) {
  56         $goto = PMA_Util::getScriptNameForOption(
  57             $GLOBALS['cfg']['DefaultTabDatabase'], 'database'
  58         );
  59     } else {
  60         $goto = PMA_Util::getScriptNameForOption(
  61             $GLOBALS['cfg']['DefaultTabTable'], 'table'
  62         );
  63     }
  64     $is_gotofile  = true;
  65 } // end if
  66
  67 if (! isset($err_url)) {
  68     $err_url = (! empty($back) ? $back : $goto)
  69         . '?' . PMA_URL_getCommon(array('db' => $GLOBALS['db']))
  70         . ((/*overload*/mb_strpos(' ' . $goto, 'db_') != 1
  71             && /*overload*/mb_strlen($table))
  72             ? '&amp;table=' . urlencode($table)
  73             : ''
  74         );
  75 } // end if
  76
  77 // Coming from a bookmark dialog
  78 if (isset($_POST['bkm_fields']['bkm_sql_query'])) {
  79     $sql_query = $_POST['bkm_fields']['bkm_sql_query'];
  80 } elseif (isset($_GET['sql_query'])) {
  81     $sql_query = $_GET['sql_query'];
  82 }
  83
  84 // This one is just to fill $db
  85 if (isset($_POST['bkm_fields']['bkm_database'])) {
  86     $db = $_POST['bkm_fields']['bkm_database'];
  87 }
  88
  89
  90 // During grid edit, if we have a relational field, show the dropdown for it.
  91 if (isset($_REQUEST['get_relational_values'])
  92     && $_REQUEST['get_relational_values'] == true
  93 ) {
  94     PMA_getRelationalValues($db, $table);
  95     // script has exited at this point
  96 }
  97
  98 // Just like above, find possible values for enum fields during grid edit.
  99 if (isset($_REQUEST['get_enum_values']) && $_REQUEST['get_enum_values'] == true) {
 100     PMA_getEnumOrSetValues($db, $table, "enum");
 101     // script has exited at this point
 102 }
 103
 104
 105 // Find possible values for set fields during grid edit.
 106 if (isset($_REQUEST['get_set_values']) && $_REQUEST['get_set_values'] == true) {
 107     PMA_getEnumOrSetValues($db, $table, "set");
 108     // script has exited at this point
 109 }
 110
 111 if (isset($_REQUEST['get_default_fk_check_value'])
 112     && $_REQUEST['get_default_fk_check_value'] == true
 113 ) {
 114     $response = PMA_Response::getInstance();
 115     $response->addJSON(
 116         'default_fk_check_value', PMA_Util::isForeignKeyCheck()
 117     );
 118     exit;
 119 }
 120
 121 /**
 122  * Check ajax request to set the column order and visibility
 123  */
 124 if (isset($_REQUEST['set_col_prefs']) && $_REQUEST['set_col_prefs'] == true) {
 125     PMA_setColumnOrderOrVisibility($table, $db);
 126     // script has exited at this point
 127 }
 128
 129 // Default to browse if no query set and we have table
 130 // (needed for browsing from DefaultTabTable)
 131 $tableLength = /*overload*/mb_strlen($table);
 132 $dbLength = /*overload*/mb_strlen($db);
 133 if (empty($sql_query) && $tableLength && $dbLength) {
 134     $sql_query = PMA_getDefaultSqlQueryForBrowse($db, $table);
 135
 136     // set $goto to what will be displayed if query returns 0 rows
 137     $goto = '';
 138 } else {
 139     // Now we can check the parameters
 140     PMA_Util::checkParameters(array('sql_query'));
 141 }
 142
 143 /**
 144  * Parse and analyze the query
 145  */
 146 require_once 'libraries/parse_analyze.inc.php';
 147
 148
 149 /**
 150  * Check rights in case of DROP DATABASE
 151  *
 152  * This test may be bypassed if $is_js_confirmed = 1 (already checked with js)
 153  * but since a malicious user may pass this variable by url/form, we don't take
 154  * into account this case.
 155  */
 156 if (PMA_hasNoRightsToDropDatabase(
 157     $analyzed_sql_results, $cfg['AllowUserDropDatabase'], $is_superuser
 158 )) {
 159     PMA_Util::mysqlDie(
 160         __('"DROP DATABASE" statements are disabled.'),
 161         '',
 162         false,
 163         $err_url
 164     );
 165 } // end if
 166
 167 /**
 168  * Need to find the real end of rows?
 169  */
 170 if (isset($find_real_end) && $find_real_end) {
 171     $unlim_num_rows = PMA_findRealEndOfRows($db, $table);
 172 }
 173
 174
 175 /**
 176  * Bookmark add
 177  */
 178 if (isset($_POST['store_bkm'])) {
 179     PMA_addBookmark($cfg['PmaAbsoluteUri'], $goto);
 180     // script has exited at this point
 181 } // end if
 182
 183
 184 /**
 185  * Sets or modifies the $goto variable if required
 186  */
 187 if ($goto == 'sql.php') {
 188     $is_gotofile = false;
 189     $goto = 'sql.php' . PMA_URL_getCommon(
 190         array(
 191             'db' => $db,
 192             'table' => $table,
 193             'sql_query' => $sql_query
 194         )
 195     );
 196 } // end if
 197
 198 PMA_executeQueryAndSendQueryResponse(
 199     $analyzed_sql_results, // analyzed_sql_results
 200     $is_gotofile, // is_gotofile
 201     $db, // db
 202     $table, // table
 203     isset($find_real_end) ? $find_real_end : null, // find_real_end
 204     isset($import_text) ? $import_text : null, // sql_query_for_bookmark
 205     isset($extra_data) ? $extra_data : null, // extra_data
 206     isset($message_to_show) ? $message_to_show : null, // message_to_show
 207     isset($message) ? $message : null, // message
 208     isset($sql_data) ? $sql_data : null, // sql_data
 209     $goto, // goto
 210     $pmaThemeImage, // pmaThemeImage
 211     isset($disp_query) ? $display_query : null, // disp_query
 212     isset($disp_message) ? $disp_message : null, // disp_message
 213     isset($query_type) ? $query_type : null, // query_type
 214     $sql_query, // sql_query
 215     isset($selected) ? $selected : null, // selectedTables
 216     isset($complete_query) ? $complete_query : null // complete_query
 217 );