libraries/Header.class.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * Used to render the header of PMA's pages
   5  *
   6  * @package PhpMyAdmin
   7  */
   8 if (! defined('PHPMYADMIN')) {
   9     exit;
  10 }
  11
  12 require_once 'libraries/Scripts.class.php';
  13 require_once 'libraries/RecentTable.class.php';
  14 require_once 'libraries/Menu.class.php';
  15 require_once 'libraries/navigation/Navigation.class.php';
  16 require_once 'libraries/url_generating.lib.php';
  17
  18
  19 /**
  20  * Class used to output the HTTP and HTML headers
  21  *
  22  * @package PhpMyAdmin
  23  */
  24 class PMA_Header
  25 {
  26     /**
  27      * PMA_Scripts instance
  28      *
  29      * @access private
  30      * @var object
  31      */
  32     private $_scripts;
  33     /**
  34      * PMA_Menu instance
  35      *
  36      * @access private
  37      * @var object
  38      */
  39     private $_menu;
  40     /**
  41      * Whether to offer the option of importing user settings
  42      *
  43      * @access private
  44      * @var bool
  45      */
  46     private $_userprefsOfferImport;
  47     /**
  48      * The page title
  49      *
  50      * @access private
  51      * @var string
  52      */
  53     private $_title;
  54     /**
  55      * The value for the id attribute for the body tag
  56      *
  57      * @access private
  58      * @var string
  59      */
  60     private $_bodyId;
  61     /**
  62      * Whether to show the top menu
  63      *
  64      * @access private
  65      * @var bool
  66      */
  67     private $_menuEnabled;
  68     /**
  69      * Whether to show the warnings
  70      *
  71      * @access private
  72      * @var bool
  73      */
  74     private $_warningsEnabled;
  75     /**
  76      * Whether the page is in 'print view' mode
  77      *
  78      * @access private
  79      * @var bool
  80      */
  81     private $_isPrintView;
  82     /**
  83      * Whether we are servicing an ajax request.
  84      * We can't simply use $GLOBALS['is_ajax_request']
  85      * here since it may have not been initialised yet.
  86      *
  87      * @access private
  88      * @var bool
  89      */
  90     private $_isAjax;
  91     /**
  92      * Whether to display anything
  93      *
  94      * @access private
  95      * @var bool
  96      */
  97     private $_isEnabled;
  98     /**
  99      * Whether the HTTP headers (and possibly some HTML)
 100      * have already been sent to the browser
 101      *
 102      * @access private
 103      * @var bool
 104      */
 105     private $_headerIsSent;
 106
 107     /**
 108      * Creates a new class instance
 109      *
 110      * @return new PMA_Header object
 111      */
 112     public function __construct()
 113     {
 114         $this->_isEnabled = true;
 115         $this->_isAjax = false;
 116         $this->_bodyId = '';
 117         $this->_title  = '';
 118         $db = ! empty($GLOBALS['db']) ? $GLOBALS['db'] : '';
 119         $table = ! empty($GLOBALS['table']) ? $GLOBALS['table'] : '';
 120         $this->_menu   = new PMA_Menu(
 121             $GLOBALS['server'],
 122             $db,
 123             $table
 124         );
 125         $this->_menuEnabled = true;
 126         $this->_warningsEnabled = true;
 127         $this->_isPrintView = false;
 128         $this->_scripts     = new PMA_Scripts();
 129         $this->_addDefaultScripts();
 130         $this->_headerIsSent = false;
 131         // if database storage for user preferences is transient,
 132         // offer to load exported settings from localStorage
 133         // (detection will be done in JavaScript)
 134         $this->_userprefsOfferImport = false;
 135         if ($GLOBALS['PMA_Config']->get('user_preferences') == 'session'
 136             && ! isset($_SESSION['userprefs_autoload'])
 137         ) {
 138             $this->_userprefsOfferImport = true;
 139         }
 140     }
 141
 142     /**
 143      * Loads common scripts
 144      *
 145      * @return void
 146      */
 147     private function _addDefaultScripts()
 148     {
 149         $this->_scripts->addFile('jquery/jquery-1.8.3.min.js');
 150         $this->_scripts->addFile('ajax.js');
 151         $this->_scripts->addFile('keyhandler.js');
 152         $this->_scripts->addFile('jquery/jquery-ui-1.9.2.custom.min.js');
 153         $this->_scripts->addFile('jquery/jquery.sprintf.js');
 154         $this->_scripts->addFile('jquery/jquery.cookie.js');
 155         $this->_scripts->addFile('jquery/jquery.mousewheel.js');
 156         $this->_scripts->addFile('jquery/jquery.event.drag-2.2.js');
 157         $this->_scripts->addFile('jquery/jquery-ui-timepicker-addon.js');
 158         $this->_scripts->addFile('jquery/jquery.ba-hashchange-1.3.js');
 159         $this->_scripts->addFile('jquery/jquery.debounce-1.0.5.js');
 160         $this->_scripts->addFile('jquery/jquery.menuResizer-1.0.js');
 161
 162         // Cross-framing protection
 163         if ($GLOBALS['cfg']['AllowThirdPartyFraming'] === false) {
 164             $this->_scripts->addFile('cross_framing_protection.js');
 165         }
 166
 167         $this->_scripts->addFile('rte.js');
 168         if ($GLOBALS['cfg']['ErrorReporting'] == true) {
 169             $this->_scripts->addFile('tracekit/tracekit.js');
 170             $this->_scripts->addFile('error_report.js');
 171         }
 172
 173         // Here would not be a good place to add CodeMirror because
 174         // the user preferences have not been merged at this point
 175
 176         // Localised strings
 177         $params = array('lang' => $GLOBALS['lang']);
 178         if (isset($GLOBALS['db'])) {
 179             $params['db'] = $GLOBALS['db'];
 180         }
 181         $this->_scripts->addFile('messages.php' . PMA_URL_getCommon($params));
 182         // Append the theme id to this url to invalidate
 183         // the cache on a theme change. Though this might be
 184         // unavailable for fatal errors.
 185         if (isset($_SESSION['PMA_Theme'])) {
 186             $theme_id = urlencode($_SESSION['PMA_Theme']->getId());
 187         } else {
 188             $theme_id = 'default';
 189         }
 190         $this->_scripts->addFile(
 191             'get_image.js.php?theme=' . $theme_id
 192         );
 193         $this->_scripts->addFile('doclinks.js');
 194         $this->_scripts->addFile('functions.js');
 195         $this->_scripts->addFile('navigation.js');
 196         $this->_scripts->addFile('indexes.js');
 197         $this->_scripts->addFile('common.js');
 198         $this->_scripts->addCode($this->getJsParamsCode());
 199     }
 200
 201     /**
 202      * Returns, as an array, a list of parameters
 203      * used on the client side
 204      *
 205      * @return array
 206      */
 207     public function getJsParams()
 208     {
 209         $db = ! empty($GLOBALS['db']) ? $GLOBALS['db'] : '';
 210         $table = ! empty($GLOBALS['table']) ? $GLOBALS['table'] : '';
 211         return array(
 212             'common_query' => PMA_URL_getCommon('', '', '&'),
 213             'opendb_url' => $GLOBALS['cfg']['DefaultTabDatabase'],
 214             'safari_browser' => PMA_USR_BROWSER_AGENT == 'SAFARI' ? 1 : 0,
 215             'querywindow_height' => $GLOBALS['cfg']['QueryWindowHeight'],
 216             'querywindow_width' => $GLOBALS['cfg']['QueryWindowWidth'],
 217             'collation_connection' => $GLOBALS['collation_connection'],
 218             'lang' => $GLOBALS['lang'],
 219             'server' => $GLOBALS['server'],
 220             'table' => $table,
 221             'db'    => $db,
 222             'token' => $_SESSION[' PMA_token '],
 223             'text_dir' => $GLOBALS['text_dir'],
 224             'pma_absolute_uri' => $GLOBALS['cfg']['PmaAbsoluteUri'],
 225             'pma_text_default_tab' => PMA_Util::getTitleForTarget(
 226                 $GLOBALS['cfg']['DefaultTabTable']
 227             ),
 228             'pma_text_left_default_tab' => PMA_Util::getTitleForTarget(
 229                 $GLOBALS['cfg']['NavigationTreeDefaultTabTable']
 230             ),
 231             'confirm' => $GLOBALS['cfg']['Confirm']
 232         );
 233     }
 234
 235     /**
 236      * Returns, as a string, a list of parameters
 237      * used on the client side
 238      *
 239      * @return string
 240      */
 241     public function getJsParamsCode()
 242     {
 243         $params = $this->getJsParams();
 244         foreach ($params as $key => $value) {
 245             $params[$key] = $key . ':"' . PMA_escapeJsString($value) . '"';
 246         }
 247         return 'PMA_commonParams.setAll({' . implode(',', $params) . '});';
 248     }
 249
 250     /**
 251      * Disables the rendering of the header
 252      *
 253      * @return void
 254      */
 255     public function disable()
 256     {
 257         $this->_isEnabled = false;
 258     }
 259
 260     /**
 261      * Set the ajax flag to indicate whether
 262      * we are sevicing an ajax request
 263      *
 264      * @param bool $isAjax Whether we are sevicing an ajax request
 265      *
 266      * @return void
 267      */
 268     public function setAjax($isAjax)
 269     {
 270         $this->_isAjax = ($isAjax == true);
 271     }
 272
 273     /**
 274      * Returns the PMA_Scripts object
 275      *
 276      * @return PMA_Scripts object
 277      */
 278     public function getScripts()
 279     {
 280         return $this->_scripts;
 281     }
 282
 283     /**
 284      * Returns the PMA_Menu object
 285      *
 286      * @return PMA_Menu object
 287      */
 288     public function getMenu()
 289     {
 290         return $this->_menu;
 291     }
 292
 293     /**
 294      * Setter for the ID attribute in the BODY tag
 295      *
 296      * @param string $id Value for the ID attribute
 297      *
 298      * @return void
 299      */
 300     public function setBodyId($id)
 301     {
 302         $this->_bodyId = htmlspecialchars($id);
 303     }
 304
 305     /**
 306      * Setter for the title of the page
 307      *
 308      * @param string $title New title
 309      *
 310      * @return void
 311      */
 312     public function setTitle($title)
 313     {
 314         $this->_title = htmlspecialchars($title);
 315     }
 316
 317     /**
 318      * Disables the display of the top menu
 319      *
 320      * @return void
 321      */
 322     public function disableMenu()
 323     {
 324         $this->_menuEnabled = false;
 325     }
 326
 327     /**
 328      * Disables the display of the top menu
 329      *
 330      * @return void
 331      */
 332     public function disableWarnings()
 333     {
 334         $this->_warningsEnabled = false;
 335     }
 336
 337     /**
 338      * Turns on 'print view' mode
 339      *
 340      * @return void
 341      */
 342     public function enablePrintView()
 343     {
 344         $this->disableMenu();
 345         $this->setTitle(__('Print view') . ' - phpMyAdmin ' . PMA_VERSION);
 346         $this->_isPrintView = true;
 347     }
 348
 349     /**
 350      * Generates the header
 351      *
 352      * @return string The header
 353      */
 354     public function getDisplay()
 355     {
 356         $retval = '';
 357         if (! $this->_headerIsSent) {
 358             if (! $this->_isAjax && $this->_isEnabled) {
 359                 $this->sendHttpHeaders();
 360                 $retval .= $this->_getHtmlStart();
 361                 $retval .= $this->_getMetaTags();
 362                 $retval .= $this->_getLinkTags();
 363                 $retval .= $this->getTitleTag();
 364
 365                 // The user preferences have been merged at this point
 366                 // so we can conditionally add CodeMirror
 367                 if ($GLOBALS['cfg']['CodemirrorEnable']) {
 368                     $this->_scripts->addFile('codemirror/lib/codemirror.js');
 369                     $this->_scripts->addFile('codemirror/mode/sql/sql.js');
 370                     $this->_scripts->addFile('codemirror/addon/runmode/runmode.js');
 371                 }
 372                 if ($this->_userprefsOfferImport) {
 373                     $this->_scripts->addFile('config.js');
 374                 }
 375                 $retval .= $this->_scripts->getDisplay();
 376                 $retval .= $this->_getBodyStart();
 377                 if ($this->_menuEnabled && $GLOBALS['server'] > 0) {
 378                     $nav = new PMA_Navigation();
 379                     $retval .= $nav->getDisplay();
 380                 }
 381                 // Include possible custom headers
 382                 if (file_exists(CUSTOM_HEADER_FILE)) {
 383                     ob_start();
 384                     include CUSTOM_HEADER_FILE;
 385                     $retval .= ob_get_contents();
 386                     ob_end_clean();
 387                 }
 388                 // offer to load user preferences from localStorage
 389                 if ($this->_userprefsOfferImport) {
 390                     include_once './libraries/user_preferences.lib.php';
 391                     $retval .= PMA_userprefsAutoloadGetHeader();
 392                 }
 393                 // pass configuration for hint tooltip display
 394                 // (to be used by PMA_tooltip() in js/functions.js)
 395                 if (! $GLOBALS['cfg']['ShowHint']) {
 396                     $retval .= '<span id="no_hint" class="hide"></span>';
 397                 }
 398                 $retval .= $this->_getWarnings();
 399                 if ($this->_menuEnabled && $GLOBALS['server'] > 0) {
 400                     $retval .= $this->_menu->getDisplay();
 401                     $retval .= sprintf(
 402                         '<a id="goto_pagetop" href="#" title="%s">%s</a>',
 403                         __('Click on the bar to scroll to top of page'),
 404                         PMA_Util::getImage('s_top.png')
 405                     );
 406                 }
 407                 $retval .= '<div id="page_content">';
 408                 $retval .= $this->getMessage();
 409             }
 410             if ($this->_isEnabled && empty($_REQUEST['recent_table'])) {
 411                 $retval .= $this->_addRecentTable(
 412                     $GLOBALS['db'],
 413                     $GLOBALS['table']
 414                 );
 415             }
 416         }
 417         return $retval;
 418     }
 419
 420     /**
 421      * Returns the message to be displayed at the top of
 422      * the page, including the executed SQL query, if any.
 423      *
 424      * @return string
 425      */
 426     public function getMessage()
 427     {
 428         $retval = '';
 429         $message = '';
 430         if (! empty($GLOBALS['message'])) {
 431             $message = $GLOBALS['message'];
 432             unset($GLOBALS['message']);
 433         } else if (! empty($_REQUEST['message'])) {
 434             $message = $_REQUEST['message'];
 435         }
 436         if (! empty($message)) {
 437             if (isset($GLOBALS['buffer_message'])) {
 438                 $buffer_message = $GLOBALS['buffer_message'];
 439             }
 440             $retval .= PMA_Util::getMessage($message);
 441             if (isset($buffer_message)) {
 442                 $GLOBALS['buffer_message'] = $buffer_message;
 443             }
 444         }
 445         return $retval;
 446     }
 447
 448     /**
 449      * Sends out the HTTP headers
 450      *
 451      * @return void
 452      */
 453     public function sendHttpHeaders()
 454     {
 455         $https = $GLOBALS['PMA_Config']->isHttps();
 456         $mapTilesUrls = ' *.tile.openstreetmap.org *.tile.opencyclemap.org';
 457
 458         /**
 459          * Sends http headers
 460          */
 461         $GLOBALS['now'] = gmdate('D, d M Y H:i:s') . ' GMT';
 462         if (! defined('TESTSUITE')) {
 463             /* Prevent against ClickJacking by disabling framing */
 464             if (! $GLOBALS['cfg']['AllowThirdPartyFraming']) {
 465                 header(
 466                     'X-Frame-Options: DENY'
 467                 );
 468             }
 469             header(
 470                 "X-Content-Security-Policy: default-src 'self' "
 471                 . 'https://www.google.com '
 472                 . $GLOBALS['cfg']['CSPAllow'] . ';'
 473                 . "options inline-script eval-script;"
 474                 . "img-src 'self' data: "
 475                 . $GLOBALS['cfg']['CSPAllow']
 476                 . ($https ? "" : $mapTilesUrls)
 477                 // for reCAPTCHA
 478                 . " https://www.google.com"
 479                 . ";"
 480             );
 481             if (PMA_USR_BROWSER_AGENT == 'SAFARI'
 482                 && PMA_USR_BROWSER_VER < '6.0.0'
 483             ) {
 484                 header(
 485                     "X-WebKit-CSP: allow 'self' "
 486                     . 'https://www.google.com '
 487                     . $GLOBALS['cfg']['CSPAllow'] . ';'
 488                     . "options inline-script eval-script;"
 489                     . "img-src 'self' data: "
 490                     . $GLOBALS['cfg']['CSPAllow']
 491                     . ($https ? "" : $mapTilesUrls)
 492                     // for reCAPTCHA
 493                     . " https://www.google.com"
 494                     . ";"
 495                 );
 496             } else {
 497                 header(
 498                     "X-WebKit-CSP: default-src 'self' "
 499                     . 'https://www.google.com '
 500                     . $GLOBALS['cfg']['CSPAllow'] . ';'
 501                     . "script-src 'self' "
 502                     . 'https://www.google.com '
 503                     . $GLOBALS['cfg']['CSPAllow']
 504                     . " 'unsafe-inline' 'unsafe-eval';"
 505                     . "style-src 'self' 'unsafe-inline' "
 506                     . 'https://www.google.com '
 507                     . ';'
 508                     . "img-src 'self' data: "
 509                     . $GLOBALS['cfg']['CSPAllow']
 510                     . ($https ? "" : $mapTilesUrls)
 511                     // for reCAPTCHA
 512                     . " https://www.google.com"
 513                     . ";"
 514                 );
 515             }
 516         }
 517         PMA_noCacheHeader();
 518         if (! defined('IS_TRANSFORMATION_WRAPPER') && ! defined('TESTSUITE')) {
 519             // Define the charset to be used
 520             header('Content-Type: text/html; charset=utf-8');
 521         }
 522         $this->_headerIsSent = true;
 523     }
 524
 525     /**
 526      * Returns the DOCTYPE and the start HTML tag
 527      *
 528      * @return string DOCTYPE and HTML tags
 529      */
 530     private function _getHtmlStart()
 531     {
 532         $lang = $GLOBALS['available_languages'][$GLOBALS['lang']][1];
 533         $dir  = $GLOBALS['text_dir'];
 534
 535         $retval  = "<!DOCTYPE HTML>";
 536         $retval .= "<html lang='$lang' dir='$dir' class='";
 537         $retval .= strtolower(PMA_USR_BROWSER_AGENT) . " ";
 538         $retval .= strtolower(PMA_USR_BROWSER_AGENT)
 539             . intval(PMA_USR_BROWSER_VER) . "'>";
 540
 541         return $retval;
 542     }
 543
 544     /**
 545      * Returns the META tags
 546      *
 547      * @return string the META tags
 548      */
 549     private function _getMetaTags()
 550     {
 551         $retval  = '<meta charset="utf-8" />';
 552         $retval .= '<meta name="robots" content="noindex,nofollow" />';
 553         $retval .= '<meta http-equiv="X-UA-Compatible" content="IE=Edge">';
 554         if (! $GLOBALS['cfg']['AllowThirdPartyFraming']) {
 555             $retval .= '<style>html{display: none;}</style>';
 556         }
 557         return $retval;
 558     }
 559
 560     /**
 561      * Returns the LINK tags for the favicon and the stylesheets
 562      *
 563      * @return string the LINK tags
 564      */
 565     private function _getLinkTags()
 566     {
 567         $retval = '<link rel="icon" href="favicon.ico" '
 568             . 'type="image/x-icon" />'
 569             . '<link rel="shortcut icon" href="favicon.ico" '
 570             . 'type="image/x-icon" />';
 571         // stylesheets
 572         $basedir    = defined('PMA_PATH_TO_BASEDIR') ? PMA_PATH_TO_BASEDIR : '';
 573         $common_url = PMA_URL_getCommon(array('server' => $GLOBALS['server']));
 574         $theme_id   = $GLOBALS['PMA_Config']->getThemeUniqueValue();
 575         $theme_path = $GLOBALS['pmaThemePath'];
 576
 577         if ($this->_isPrintView) {
 578             $retval .= '<link rel="stylesheet" type="text/css" href="'
 579                 . $basedir . 'print.css" />';
 580         } else {
 581             $retval .= '<link rel="stylesheet" type="text/css" href="'
 582                 . $basedir . 'phpmyadmin.css.php'
 583                 . $common_url . '&amp;nocache='
 584                 . $theme_id . $GLOBALS['text_dir'] . '" />';
 585             $retval .= '<link rel="stylesheet" type="text/css" href="'
 586                 . $theme_path . '/jquery/jquery-ui-1.9.2.custom.css" />';
 587         }
 588
 589         return $retval;
 590     }
 591
 592     /**
 593      * Returns the TITLE tag
 594      *
 595      * @return string the TITLE tag
 596      */
 597     public function getTitleTag()
 598     {
 599         $retval  = "<title>";
 600         $retval .= $this->_getPageTitle();
 601         $retval .= "</title>";
 602         return $retval;
 603     }
 604
 605     /**
 606      * If the page is missing the title, this function
 607      * will set it to something reasonable
 608      *
 609      * @return string
 610      */
 611     private function _getPageTitle()
 612     {
 613         if (empty($this->_title)) {
 614             if ($GLOBALS['server'] > 0) {
 615                 if (! empty($GLOBALS['table'])) {
 616                     $temp_title = $GLOBALS['cfg']['TitleTable'];
 617                 } else if (! empty($GLOBALS['db'])) {
 618                     $temp_title = $GLOBALS['cfg']['TitleDatabase'];
 619                 } elseif (! empty($GLOBALS['cfg']['Server']['host'])) {
 620                     $temp_title = $GLOBALS['cfg']['TitleServer'];
 621                 } else {
 622                     $temp_title = $GLOBALS['cfg']['TitleDefault'];
 623                 }
 624                 $this->_title = htmlspecialchars(
 625                     PMA_Util::expandUserString($temp_title)
 626                 );
 627             } else {
 628                 $this->_title = 'phpMyAdmin';
 629             }
 630         }
 631         return $this->_title;
 632     }
 633
 634     /**
 635      * Returns the close tag to the HEAD
 636      * and the start tag for the BODY
 637      *
 638      * @return string HEAD and BODY tags
 639      */
 640     private function _getBodyStart()
 641     {
 642         $retval = "</head><body";
 643         if (! empty($this->_bodyId)) {
 644             $retval .= " id='" . $this->_bodyId . "'";
 645         }
 646         $retval .= ">";
 647         return $retval;
 648     }
 649
 650     /**
 651      * Returns some warnings to be displayed at the top of the page
 652      *
 653      * @return string The warnings
 654      */
 655     private function _getWarnings()
 656     {
 657         $retval = '';
 658         if ($this->_warningsEnabled) {
 659             $retval .= "<noscript>";
 660             $retval .= PMA_message::error(
 661                 __("Javascript must be enabled past this point")
 662             )->getDisplay();
 663             $retval .= "</noscript>";
 664         }
 665         return $retval;
 666     }
 667
 668     /**
 669      * Add recently used table and reload the navigation.
 670      *
 671      * @param string $db    Database name where the table is located.
 672      * @param string $table The table name
 673      *
 674      * @return string
 675      */
 676     private function _addRecentTable($db, $table)
 677     {
 678         $retval = '';
 679         if ($this->_menuEnabled
 680             && strlen($table)
 681             && $GLOBALS['cfg']['NumRecentTables'] > 0
 682         ) {
 683             $tmp_result = PMA_RecentTable::getInstance()->add($db, $table);
 684             if ($tmp_result === true) {
 685                 $params  = array('ajax_request' => true, 'recent_table' => true);
 686                 $url     = 'index.php' . PMA_URL_getCommon($params);
 687                 $retval  = '<a class="hide" id="update_recent_tables"';
 688                 $retval .= ' href="' . $url . '"></a>';
 689             } else {
 690                 $error  = $tmp_result;
 691                 $retval = $error->getDisplay();
 692             }
 693         }
 694         return $retval;
 695     }
 696 }
 697
 698 ?>