libraries/common.inc.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * Misc stuff and REQUIRED by ALL the scripts.
   5  * MUST be included by every script
   6  *
   7  * Among other things, it contains the advanced authentication work.
   8  *
   9  * Order of sections for common.inc.php:
  10  *
  11  * the authentication libraries must be before the connection to db
  12  *
  13  * ... so the required order is:
  14  *
  15  * LABEL_variables_init
  16  *  - initialize some variables always needed
  17  * LABEL_parsing_config_file
  18  *  - parsing of the configuration file
  19  * LABEL_loading_language_file
  20  *  - loading language file
  21  * LABEL_setup_servers
  22  *  - check and setup configured servers
  23  * LABEL_theme_setup
  24  *  - setting up themes
  25  *
  26  * - load of MySQL extension (if necessary)
  27  * - loading of an authentication library
  28  * - db connection
  29  * - authentication work
  30  *
  31  * @version $Id$
  32  * @package phpMyAdmin
  33  */
  34
  35 /**
  36  * Minimum PHP version; can't call PMA_fatalError() which uses a
  37  * PHP 5 function, so cannot easily localize this message.
  38  */
  39 if (version_compare(PHP_VERSION, '5.2.0', 'lt')) {
  40     die('PHP 5.2+ is required');
  41 }
  42
  43 /**
  44   * Backward compatibility for PHP 5.2
  45   */
  46 if (!defined('E_DEPRECATED')) {
  47     define('E_DEPRECATED', 8192);
  48 }
  49
  50 /**
  51  * the error handler
  52  */
  53 require_once './libraries/Error_Handler.class.php';
  54
  55 /**
  56  * initialize the error handler
  57  */
  58 $GLOBALS['error_handler'] = new PMA_Error_Handler();
  59 $cfg['Error_Handler']['display'] = TRUE;
  60
  61 // at this point PMA_PHP_INT_VERSION is not yet defined
  62 if (version_compare(phpversion(), '6', 'lt')) {
  63     /**
  64      * Avoid object cloning errors
  65      */
  66     @ini_set('zend.ze1_compatibility_mode', false);
  67
  68     /**
  69      * Avoid problems with magic_quotes_runtime
  70      */
  71     @ini_set('magic_quotes_runtime', false);
  72 }
  73
  74 /**
  75  * for verification in all procedural scripts under libraries
  76  */
  77 define('PHPMYADMIN', true);
  78
  79 /**
  80  * core functions
  81  */
  82 require_once './libraries/core.lib.php';
  83
  84 /**
  85  * Input sanitizing
  86  */
  87 require_once './libraries/sanitizing.lib.php';
  88
  89 /**
  90  * the PMA_Theme class
  91  */
  92 require_once './libraries/Theme.class.php';
  93
  94 /**
  95  * the PMA_Theme_Manager class
  96  */
  97 require_once './libraries/Theme_Manager.class.php';
  98
  99 /**
 100  * the PMA_Config class
 101  */
 102 require_once './libraries/Config.class.php';
 103
 104 /**
 105  * the relation lib, tracker needs it
 106  */
 107 require_once './libraries/relation.lib.php';
 108
 109 /**
 110  * the PMA_Tracker class
 111  */
 112 require_once './libraries/Tracker.class.php';
 113
 114 /**
 115  * the PMA_Table class
 116  */
 117 require_once './libraries/Table.class.php';
 118
 119 if (!defined('PMA_MINIMUM_COMMON')) {
 120     /**
 121      * common functions
 122      */
 123     require_once './libraries/common.lib.php';
 124
 125     /**
 126      * Java script escaping.
 127      */
 128     require_once './libraries/js_escape.lib.php';
 129
 130     /**
 131      * Include URL/hidden inputs generating.
 132      */
 133     require_once './libraries/url_generating.lib.php';
 134 }
 135
 136 /******************************************************************************/
 137 /* start procedural code                       label_start_procedural         */
 138
 139 /**
 140  * protect against possible exploits - there is no need to have so much variables
 141  */
 142 if (count($_REQUEST) > 1000) {
 143     die('possible exploit');
 144 }
 145
 146 /**
 147  * Check for numeric keys
 148  * (if register_globals is on, numeric key can be found in $GLOBALS)
 149  */
 150 foreach ($GLOBALS as $key => $dummy) {
 151     if (is_numeric($key)) {
 152         die('numeric key detected');
 153     }
 154 }
 155 unset($dummy);
 156
 157 /**
 158  * PATH_INFO could be compromised if set, so remove it from PHP_SELF
 159  * and provide a clean PHP_SELF here
 160  */
 161 $PMA_PHP_SELF = PMA_getenv('PHP_SELF');
 162 $_PATH_INFO = PMA_getenv('PATH_INFO');
 163 if (! empty($_PATH_INFO) && ! empty($PMA_PHP_SELF)) {
 164     $path_info_pos = strrpos($PMA_PHP_SELF, $_PATH_INFO);
 165     if ($path_info_pos + strlen($_PATH_INFO) === strlen($PMA_PHP_SELF)) {
 166         $PMA_PHP_SELF = substr($PMA_PHP_SELF, 0, $path_info_pos);
 167     }
 168 }
 169 $PMA_PHP_SELF = htmlspecialchars($PMA_PHP_SELF);
 170
 171
 172 /**
 173  * just to be sure there was no import (registering) before here
 174  * we empty the global space (but avoid unsetting $variables_list
 175  * and $key in the foreach(), we still need them!)
 176  */
 177 $variables_whitelist = array (
 178     'GLOBALS',
 179     '_SERVER',
 180     '_GET',
 181     '_POST',
 182     '_REQUEST',
 183     '_FILES',
 184     '_ENV',
 185     '_COOKIE',
 186     '_SESSION',
 187     'error_handler',
 188     'PMA_PHP_SELF',
 189     'variables_whitelist',
 190     'key'
 191 );
 192
 193 foreach (get_defined_vars() as $key => $value) {
 194     if (! in_array($key, $variables_whitelist)) {
 195         unset($$key);
 196     }
 197 }
 198 unset($key, $value, $variables_whitelist);
 199
 200
 201 /**
 202  * Subforms - some functions need to be called by form, cause of the limited URL
 203  * length, but if this functions inside another form you cannot just open a new
 204  * form - so phpMyAdmin uses 'arrays' inside this form
 205  *
 206  * <code>
 207  * <form ...>
 208  * ... main form elments ...
 209  * <input type="hidden" name="subform[action1][id]" value="1" />
 210  * ... other subform data ...
 211  * <input type="submit" name="usesubform[action1]" value="do action1" />
 212  * ... other subforms ...
 213  * <input type="hidden" name="subform[actionX][id]" value="X" />
 214  * ... other subform data ...
 215  * <input type="submit" name="usesubform[actionX]" value="do actionX" />
 216  * ... main form elments ...
 217  * <input type="submit" name="main_action" value="submit form" />
 218  * </form>
 219  * </code>
 220  *
 221  * so we now check if a subform is submitted
 222  */
 223 $__redirect = null;
 224 if (isset($_POST['usesubform'])) {
 225     // if a subform is present and should be used
 226     // the rest of the form is deprecated
 227     $subform_id = key($_POST['usesubform']);
 228     $subform    = $_POST['subform'][$subform_id];
 229     $_POST      = $subform;
 230     $_REQUEST   = $subform;
 231     /**
 232      * some subforms need another page than the main form, so we will just
 233      * include this page at the end of this script - we use $__redirect to
 234      * track this
 235      */
 236     if (isset($_POST['redirect'])
 237       && $_POST['redirect'] != basename($PMA_PHP_SELF)) {
 238         $__redirect = $_POST['redirect'];
 239         unset($_POST['redirect']);
 240     }
 241     unset($subform_id, $subform);
 242 } else {
 243     // Note: here we overwrite $_REQUEST so that it does not contain cookies,
 244     // because another application for the same domain could have set
 245     // a cookie (with a compatible path) that overrides a variable
 246     // we expect from GET or POST.
 247     // We'll refer to cookies explicitly with the $_COOKIE syntax.
 248     $_REQUEST = array_merge($_GET, $_POST);
 249 }
 250 // end check if a subform is submitted
 251
 252 // remove quotes added by php
 253 if (function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc()) {
 254     PMA_arrayWalkRecursive($_GET, 'stripslashes', true);
 255     PMA_arrayWalkRecursive($_POST, 'stripslashes', true);
 256     PMA_arrayWalkRecursive($_COOKIE, 'stripslashes', true);
 257     PMA_arrayWalkRecursive($_REQUEST, 'stripslashes', true);
 258 }
 259
 260 /**
 261  * include deprecated grab_globals only if required
 262  */
 263 if (empty($__redirect) && !defined('PMA_NO_VARIABLES_IMPORT')) {
 264     require './libraries/grab_globals.lib.php';
 265 }
 266
 267 /**
 268  * check timezone setting
 269  * this could produce an E_STRICT - but only once,
 270  * if not done here it will produce E_STRICT on every date/time function
 271  *
 272  * @todo need to decide how we should handle this (without @)
 273  */
 274 date_default_timezone_set(@date_default_timezone_get());
 275
 276 /******************************************************************************/
 277 /* parsing configuration file                         LABEL_parsing_config_file      */
 278
 279 /**
 280  * We really need this one!
 281  */
 282 if (! function_exists('preg_replace')) {
 283     PMA_warnMissingExtension('pcre', true);
 284 }
 285
 286 /**
 287  * @global PMA_Config $GLOBALS['PMA_Config']
 288  * force reading of config file, because we removed sensitive values
 289  * in the previous iteration
 290  */
 291 $GLOBALS['PMA_Config'] = new PMA_Config(CONFIG_FILE);
 292
 293 if (!defined('PMA_MINIMUM_COMMON')) {
 294     $GLOBALS['PMA_Config']->checkPmaAbsoluteUri();
 295 }
 296
 297 /**
 298  * BC - enable backward compatibility
 299  * exports all configuration settings into $GLOBALS ($GLOBALS['cfg'])
 300  */
 301 $GLOBALS['PMA_Config']->enableBc();
 302
 303 /**
 304  * clean cookies on upgrade
 305  * when changing something related to PMA cookies, increment the cookie version
 306  */
 307 $pma_cookie_version = 4;
 308 if (isset($_COOKIE)
 309  && (isset($_COOKIE['pmaCookieVer'])
 310   && $_COOKIE['pmaCookieVer'] < $pma_cookie_version)) {
 311     // delete all cookies
 312     foreach($_COOKIE as $cookie_name => $tmp) {
 313         $GLOBALS['PMA_Config']->removeCookie($cookie_name);
 314     }
 315     $_COOKIE = array();
 316     $GLOBALS['PMA_Config']->setCookie('pmaCookieVer', $pma_cookie_version);
 317 }
 318
 319
 320 /**
 321  * check HTTPS connection
 322  */
 323 if ($GLOBALS['PMA_Config']->get('ForceSSL')
 324   && !$GLOBALS['PMA_Config']->get('is_https')) {
 325     PMA_sendHeaderLocation(
 326         preg_replace('/^http/', 'https',
 327             $GLOBALS['PMA_Config']->get('PmaAbsoluteUri'))
 328         . PMA_generate_common_url($_GET, 'text'));
 329     // delete the current session, otherwise we get problems (see bug #2397877)
 330     $GLOBALS['PMA_Config']->removeCookie($GLOBALS['session_name']);
 331     exit;
 332 }
 333
 334
 335 /**
 336  * include session handling after the globals, to prevent overwriting
 337  */
 338 require_once './libraries/session.inc.php';
 339
 340 /**
 341  * init some variables LABEL_variables_init
 342  */
 343
 344 /**
 345  * holds parameters to be passed to next page
 346  * @global array $GLOBALS['url_params']
 347  */
 348 $GLOBALS['url_params'] = array();
 349
 350 /**
 351  * the whitelist for $GLOBALS['goto']
 352  * @global array $goto_whitelist
 353  */
 354 $goto_whitelist = array(
 355     //'browse_foreigners.php',
 356     //'calendar.php',
 357     //'changelog.php',
 358     //'chk_rel.php',
 359     'db_create.php',
 360     'db_datadict.php',
 361     'db_sql.php',
 362     'db_export.php',
 363     'db_importdocsql.php',
 364     'db_qbe.php',
 365     'db_structure.php',
 366     'db_import.php',
 367     'db_operations.php',
 368     'db_printview.php',
 369     'db_search.php',
 370     //'Documentation.html',
 371     //'error.php',
 372     'export.php',
 373     'import.php',
 374     //'index.php',
 375     //'navigation.php',
 376     //'license.php',
 377     'main.php',
 378     'pdf_pages.php',
 379     'pdf_schema.php',
 380     //'phpinfo.php',
 381     'querywindow.php',
 382     //'readme.php',
 383     'server_binlog.php',
 384     'server_collations.php',
 385     'server_databases.php',
 386     'server_engines.php',
 387     'server_export.php',
 388     'server_import.php',
 389     'server_privileges.php',
 390     'server_processlist.php',
 391     'server_sql.php',
 392     'server_status.php',
 393     'server_variables.php',
 394     'sql.php',
 395     'tbl_addfield.php',
 396     'tbl_alter.php',
 397     'tbl_change.php',
 398     'tbl_create.php',
 399     'tbl_import.php',
 400     'tbl_indexes.php',
 401     'tbl_move_copy.php',
 402     'tbl_printview.php',
 403     'tbl_sql.php',
 404     'tbl_export.php',
 405     'tbl_operations.php',
 406     'tbl_structure.php',
 407     'tbl_relation.php',
 408     'tbl_replace.php',
 409     'tbl_row_action.php',
 410     'tbl_select.php',
 411     //'themes.php',
 412     'transformation_overview.php',
 413     'transformation_wrapper.php',
 414     'translators.html',
 415     'user_password.php',
 416 );
 417
 418 /**
 419  * check $__redirect against whitelist
 420  */
 421 if (! PMA_checkPageValidity($__redirect, $goto_whitelist)) {
 422     $__redirect = null;
 423 }
 424
 425 /**
 426  * holds page that should be displayed
 427  * @global string $GLOBALS['goto']
 428  */
 429 $GLOBALS['goto'] = '';
 430 // Security fix: disallow accessing serious server files via "?goto="
 431 if (PMA_checkPageValidity($_REQUEST['goto'], $goto_whitelist)) {
 432     $GLOBALS['goto'] = $_REQUEST['goto'];
 433     $GLOBALS['url_params']['goto'] = $_REQUEST['goto'];
 434 } else {
 435     unset($_REQUEST['goto'], $_GET['goto'], $_POST['goto'], $_COOKIE['goto']);
 436 }
 437
 438 /**
 439  * returning page
 440  * @global string $GLOBALS['back']
 441  */
 442 if (PMA_checkPageValidity($_REQUEST['back'], $goto_whitelist)) {
 443     $GLOBALS['back'] = $_REQUEST['back'];
 444 } else {
 445     unset($_REQUEST['back'], $_GET['back'], $_POST['back'], $_COOKIE['back']);
 446 }
 447
 448 /**
 449  * Check whether user supplied token is valid, if not remove any possibly
 450  * dangerous stuff from request.
 451  *
 452  * remember that some objects in the session with session_start and __wakeup()
 453  * could access this variables before we reach this point
 454  * f.e. PMA_Config: fontsize
 455  *
 456  * @todo variables should be handled by their respective owners (objects)
 457  * f.e. lang, server, convcharset, collation_connection in PMA_Config
 458  */
 459 if (! PMA_isValid($_REQUEST['token']) || $_SESSION[' PMA_token '] != $_REQUEST['token']) {
 460     /**
 461      *  List of parameters which are allowed from unsafe source
 462      */
 463     $allow_list = array(
 464         /* needed for direct access, see FAQ 1.34
 465          * also, server needed for cookie login screen (multi-server)
 466          */
 467         'server', 'db', 'table', 'target',
 468         /* Session ID */
 469         'phpMyAdmin',
 470         /* Cookie preferences */
 471         'pma_lang', 'pma_charset', 'pma_collation_connection',
 472         /* Possible login form */
 473         'pma_servername', 'pma_username', 'pma_password',
 474         /* for playing blobstreamable media */
 475         'media_type', 'custom_type', 'bs_reference',
 476         /* for changing BLOB repository file MIME type */
 477         'bs_db', 'bs_table', 'bs_ref', 'bs_new_mime_type'
 478     );
 479     /**
 480      * Require cleanup functions
 481      */
 482     require_once './libraries/cleanup.lib.php';
 483     /**
 484      * Do actual cleanup
 485      */
 486     PMA_remove_request_vars($allow_list);
 487
 488 }
 489
 490
 491 /**
 492  * @global string $GLOBALS['convcharset']
 493  * @see select_lang.lib.php
 494  */
 495 if (isset($_REQUEST['convcharset'])) {
 496     $GLOBALS['convcharset'] = strip_tags($_REQUEST['convcharset']);
 497 }
 498
 499 /**
 500  * current selected database
 501  * @global string $GLOBALS['db']
 502  */
 503 $GLOBALS['db'] = '';
 504 if (PMA_isValid($_REQUEST['db'])) {
 505     // can we strip tags from this?
 506     // only \ and / is not allowed in db names for MySQL
 507     $GLOBALS['db'] = $_REQUEST['db'];
 508     $GLOBALS['url_params']['db'] = $GLOBALS['db'];
 509 }
 510
 511 /**
 512  * current selected table
 513  * @global string $GLOBALS['table']
 514  */
 515 $GLOBALS['table'] = '';
 516 if (PMA_isValid($_REQUEST['table'])) {
 517     // can we strip tags from this?
 518     // only \ and / is not allowed in table names for MySQL
 519     $GLOBALS['table'] = $_REQUEST['table'];
 520     $GLOBALS['url_params']['table'] = $GLOBALS['table'];
 521 }
 522
 523 /**
 524  * SQL query to be executed
 525  * @global string $GLOBALS['sql_query']
 526  */
 527 $GLOBALS['sql_query'] = '';
 528 if (PMA_isValid($_REQUEST['sql_query'])) {
 529     $GLOBALS['sql_query'] = $_REQUEST['sql_query'];
 530 }
 531
 532 /**
 533  * avoid problems in phpmyadmin.css.php in some cases
 534  * @global string $js_frame
 535  */
 536 $_REQUEST['js_frame'] = PMA_ifSetOr($_REQUEST['js_frame'], '');
 537
 538 //$_REQUEST['set_theme'] // checked later in this file LABEL_theme_setup
 539 //$_REQUEST['server']; // checked later in this file
 540 //$_REQUEST['lang'];   // checked by LABEL_loading_language_file
 541
 542
 543 /**
 544  * holds name of JavaScript files to be included in HTML header
 545  * @global array $js_include
 546  */
 547 $GLOBALS['js_include'] = array();
 548 $GLOBALS['js_include'][] = 'jquery/jquery-1.4.2.js';
 549 $GLOBALS['js_include'][] = 'update-location.js';
 550
 551 /**
 552  * JavaScript events that will be registered
 553  * @global array $js_events
 554  */
 555 $GLOBALS['js_events'] = array();
 556
 557 /**
 558  * footnotes to be displayed ot the page bottom
 559  * @global array $footnotes
 560  */
 561 $GLOBALS['footnotes'] = array();
 562
 563 /******************************************************************************/
 564 /* loading language file                       LABEL_loading_language_file    */
 565
 566 /**
 567  * Added messages while developing:
 568  */
 569 if (file_exists('./lang/added_messages.php')) {
 570     include './lang/added_messages.php';
 571 }
 572
 573 /**
 574  * lang detection is done here
 575  */
 576 require_once './libraries/select_lang.lib.php';
 577
 578 /**
 579  * check for errors occurred while loading configuration
 580  * this check is done here after loading language files to present errors in locale
 581  */
 582 if ($GLOBALS['PMA_Config']->error_config_file) {
 583     $error = __('phpMyAdmin was unable to read your configuration file!<br />This might happen if PHP finds a parse error in it or PHP cannot find the file.<br />Please call the configuration file directly using the link below and read the PHP error message(s) that you receive. In most cases a quote or a semicolon is missing somewhere.<br />If you receive a blank page, everything is fine.')
 584         . '<br /><br />'
 585         . ($GLOBALS['PMA_Config']->getSource() == CONFIG_FILE ?
 586         '<a href="show_config_errors.php"'
 587         .' target="_blank">' . $GLOBALS['PMA_Config']->getSource() . '</a>'
 588         :
 589         '<a href="' . $GLOBALS['PMA_Config']->getSource() . '"'
 590         .' target="_blank">' . $GLOBALS['PMA_Config']->getSource() . '</a>');
 591     trigger_error($error, E_USER_ERROR);
 592 }
 593 if ($GLOBALS['PMA_Config']->error_config_default_file) {
 594     $error = sprintf(__('Could not load default configuration from: %1$s'),
 595         $GLOBALS['PMA_Config']->default_source);
 596     trigger_error($error, E_USER_ERROR);
 597 }
 598 if ($GLOBALS['PMA_Config']->error_pma_uri) {
 599     trigger_error(__('The <tt>$cfg[\'PmaAbsoluteUri\']</tt> directive MUST be set in your configuration file!'), E_USER_ERROR);
 600 }
 601
 602
 603 /******************************************************************************/
 604 /* setup servers                                       LABEL_setup_servers    */
 605
 606 /**
 607  * current server
 608  * @global integer $GLOBALS['server']
 609  */
 610 $GLOBALS['server'] = 0;
 611
 612 /**
 613  * Servers array fixups.
 614  * $default_server comes from PMA_Config::enableBc()
 615  * @todo merge into PMA_Config
 616  */
 617 // Do we have some server?
 618 if (!isset($cfg['Servers']) || count($cfg['Servers']) == 0) {
 619     // No server => create one with defaults
 620     $cfg['Servers'] = array(1 => $default_server);
 621 } else {
 622     // We have server(s) => apply default configuration
 623     $new_servers = array();
 624
 625     foreach ($cfg['Servers'] as $server_index => $each_server) {
 626
 627         // Detect wrong configuration
 628         if (!is_int($server_index) || $server_index < 1) {
 629             trigger_error(sprintf(__('Invalid server index: %s'), $server_index), E_USER_ERROR);
 630         }
 631
 632         $each_server = array_merge($default_server, $each_server);
 633
 634         // Don't use servers with no hostname
 635         if ($each_server['connect_type'] == 'tcp' && empty($each_server['host'])) {
 636             trigger_error(sprintf(__('Invalid hostname for server %1$s. Please review your configuration.'), $server_index), E_USER_ERROR);
 637         }
 638
 639         // Final solution to bug #582890
 640         // If we are using a socket connection
 641         // and there is nothing in the verbose server name
 642         // or the host field, then generate a name for the server
 643         // in the form of "Server 2", localized of course!
 644         if ($each_server['connect_type'] == 'socket' && empty($each_server['host']) && empty($each_server['verbose'])) {
 645             $each_server['verbose'] = __('Server') . $server_index;
 646         }
 647
 648         $new_servers[$server_index] = $each_server;
 649     }
 650     $cfg['Servers'] = $new_servers;
 651     unset($new_servers, $server_index, $each_server);
 652 }
 653
 654 // Cleanup
 655 unset($default_server);
 656
 657
 658 /******************************************************************************/
 659 /* setup themes                                          LABEL_theme_setup    */
 660
 661 if (isset($_REQUEST['custom_color_reset'])) {
 662     unset($_SESSION['tmp_user_values']['custom_color']);
 663 } elseif (isset($_REQUEST['custom_color'])) {
 664     $_SESSION['tmp_user_values']['custom_color'] = $_REQUEST['custom_color'];
 665 }
 666 /**
 667  * @global PMA_Theme_Manager $_SESSION['PMA_Theme_Manager']
 668  */
 669 if (! isset($_SESSION['PMA_Theme_Manager'])) {
 670     $_SESSION['PMA_Theme_Manager'] = new PMA_Theme_Manager;
 671 } else {
 672     /**
 673      * @todo move all __wakeup() functionality into session.inc.php
 674      */
 675     $_SESSION['PMA_Theme_Manager']->checkConfig();
 676 }
 677
 678 // for the theme per server feature
 679 if (isset($_REQUEST['server']) && !isset($_REQUEST['set_theme'])) {
 680     $GLOBALS['server'] = $_REQUEST['server'];
 681     $tmp = $_SESSION['PMA_Theme_Manager']->getThemeCookie();
 682     if (empty($tmp)) {
 683         $tmp = $_SESSION['PMA_Theme_Manager']->theme_default;
 684     }
 685     $_SESSION['PMA_Theme_Manager']->setActiveTheme($tmp);
 686     unset($tmp);
 687 }
 688 /**
 689  * @todo move into PMA_Theme_Manager::__wakeup()
 690  */
 691 if (isset($_REQUEST['set_theme'])) {
 692     // if user selected a theme
 693     $_SESSION['PMA_Theme_Manager']->setActiveTheme($_REQUEST['set_theme']);
 694 }
 695
 696 /**
 697  * the theme object
 698  * @global PMA_Theme $_SESSION['PMA_Theme']
 699  */
 700 $_SESSION['PMA_Theme'] = $_SESSION['PMA_Theme_Manager']->theme;
 701
 702 // BC
 703 /**
 704  * the active theme
 705  * @global string $GLOBALS['theme']
 706  */
 707 $GLOBALS['theme']           = $_SESSION['PMA_Theme']->getName();
 708 /**
 709  * the theme path
 710  * @global string $GLOBALS['pmaThemePath']
 711  */
 712 $GLOBALS['pmaThemePath']    = $_SESSION['PMA_Theme']->getPath();
 713 /**
 714  * the theme image path
 715  * @global string $GLOBALS['pmaThemeImage']
 716  */
 717 $GLOBALS['pmaThemeImage']   = $_SESSION['PMA_Theme']->getImgPath();
 718
 719 /**
 720  * load layout file if exists
 721  */
 722 if (@file_exists($_SESSION['PMA_Theme']->getLayoutFile())) {
 723     include $_SESSION['PMA_Theme']->getLayoutFile();
 724     /**
 725      * @todo remove if all themes are update use Navi instead of Left as frame name
 726      */
 727     if (! isset($GLOBALS['cfg']['NaviWidth'])
 728      && isset($GLOBALS['cfg']['LeftWidth'])) {
 729         $GLOBALS['cfg']['NaviWidth'] = $GLOBALS['cfg']['LeftWidth'];
 730     }
 731 }
 732
 733 if (! defined('PMA_MINIMUM_COMMON')) {
 734     /**
 735      * Character set conversion.
 736      */
 737     require_once './libraries/charset_conversion.lib.php';
 738
 739     /**
 740      * String handling
 741      */
 742     require_once './libraries/string.lib.php';
 743
 744     /**
 745      * Lookup server by name
 746      * by Arnold - Helder Hosting
 747      * (see FAQ 4.8)
 748      */
 749     if (! empty($_REQUEST['server']) && is_string($_REQUEST['server'])
 750      && ! is_numeric($_REQUEST['server'])) {
 751         foreach ($cfg['Servers'] as $i => $server) {
 752             if ($server['host'] == $_REQUEST['server']) {
 753                 $_REQUEST['server'] = $i;
 754                 break;
 755             }
 756         }
 757         if (is_string($_REQUEST['server'])) {
 758             unset($_REQUEST['server']);
 759         }
 760         unset($i);
 761     }
 762
 763     /**
 764      * If no server is selected, make sure that $cfg['Server'] is empty (so
 765      * that nothing will work), and skip server authentication.
 766      * We do NOT exit here, but continue on without logging into any server.
 767      * This way, the welcome page will still come up (with no server info) and
 768      * present a choice of servers in the case that there are multiple servers
 769      * and '$cfg['ServerDefault'] = 0' is set.
 770      */
 771
 772     if (isset($_REQUEST['server']) && (is_string($_REQUEST['server']) || is_numeric($_REQUEST['server'])) && ! empty($_REQUEST['server']) && ! empty($cfg['Servers'][$_REQUEST['server']])) {
 773         $GLOBALS['server'] = $_REQUEST['server'];
 774         $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
 775     } else {
 776         if (!empty($cfg['Servers'][$cfg['ServerDefault']])) {
 777             $GLOBALS['server'] = $cfg['ServerDefault'];
 778             $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
 779         } else {
 780             $GLOBALS['server'] = 0;
 781             $cfg['Server'] = array();
 782         }
 783     }
 784     $GLOBALS['url_params']['server'] = $GLOBALS['server'];
 785
 786     /**
 787      * Kanji encoding convert feature appended by Y.Kawada (2002/2/20)
 788      */
 789     if (function_exists('mb_convert_encoding')
 790      && $lang == 'ja') {
 791         require_once './libraries/kanji-encoding.lib.php';
 792         /**
 793          * enable multibyte string support
 794          */
 795         define('PMA_MULTIBYTE_ENCODING', 1);
 796     } // end if
 797
 798     /**
 799      * save some settings in cookies
 800      * @todo should be done in PMA_Config
 801      */
 802     $GLOBALS['PMA_Config']->setCookie('pma_lang', $GLOBALS['lang']);
 803     $GLOBALS['PMA_Config']->setCookie('pma_charset', $GLOBALS['convcharset']);
 804     $GLOBALS['PMA_Config']->setCookie('pma_collation_connection', $GLOBALS['collation_connection']);
 805
 806     $_SESSION['PMA_Theme_Manager']->setThemeCookie();
 807
 808     if (! empty($cfg['Server'])) {
 809
 810         /**
 811          * Loads the proper database interface for this server
 812          */
 813         require_once './libraries/database_interface.lib.php';
 814
 815         require_once './libraries/logging.lib.php';
 816
 817         // Gets the authentication library that fits the $cfg['Server'] settings
 818         // and run authentication
 819
 820         // to allow HTTP or http
 821         $cfg['Server']['auth_type'] = strtolower($cfg['Server']['auth_type']);
 822         if (! file_exists('./libraries/auth/' . $cfg['Server']['auth_type'] . '.auth.lib.php')) {
 823             PMA_fatalError(__('Invalid authentication method set in configuration:') . ' ' . $cfg['Server']['auth_type']);
 824         }
 825         /**
 826          * the required auth type plugin
 827          */
 828         require_once './libraries/auth/' . $cfg['Server']['auth_type'] . '.auth.lib.php';
 829
 830         if (!PMA_auth_check()) {
 831             PMA_auth();
 832         } else {
 833             PMA_auth_set_user();
 834         }
 835
 836         // Check IP-based Allow/Deny rules as soon as possible to reject the
 837         // user
 838         // Based on mod_access in Apache:
 839         // http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/aaa/mod_access.c?rev=1.37&content-type=text/vnd.viewcvs-markup
 840         // Look at: "static int check_dir_access(request_rec *r)"
 841         // Robbat2 - May 10, 2002
 842         if (isset($cfg['Server']['AllowDeny'])
 843           && isset($cfg['Server']['AllowDeny']['order'])) {
 844
 845             /**
 846              * ip based access library
 847              */
 848             require_once './libraries/ip_allow_deny.lib.php';
 849
 850             $allowDeny_forbidden         = false; // default
 851             if ($cfg['Server']['AllowDeny']['order'] == 'allow,deny') {
 852                 $allowDeny_forbidden     = true;
 853                 if (PMA_allowDeny('allow')) {
 854                     $allowDeny_forbidden = false;
 855                 }
 856                 if (PMA_allowDeny('deny')) {
 857                     $allowDeny_forbidden = true;
 858                 }
 859             } elseif ($cfg['Server']['AllowDeny']['order'] == 'deny,allow') {
 860                 if (PMA_allowDeny('deny')) {
 861                     $allowDeny_forbidden = true;
 862                 }
 863                 if (PMA_allowDeny('allow')) {
 864                     $allowDeny_forbidden = false;
 865                 }
 866             } elseif ($cfg['Server']['AllowDeny']['order'] == 'explicit') {
 867                 if (PMA_allowDeny('allow')
 868                   && !PMA_allowDeny('deny')) {
 869                     $allowDeny_forbidden = false;
 870                 } else {
 871                     $allowDeny_forbidden = true;
 872                 }
 873             } // end if ... elseif ... elseif
 874
 875             // Ejects the user if banished
 876             if ($allowDeny_forbidden) {
 877                 PMA_log_user($cfg['Server']['user'], 'allow-denied');
 878                 PMA_auth_fails();
 879             }
 880             unset($allowDeny_forbidden); //Clean up after you!
 881         } // end if
 882
 883         // is root allowed?
 884         if (!$cfg['Server']['AllowRoot'] && $cfg['Server']['user'] == 'root') {
 885             $allowDeny_forbidden = true;
 886             PMA_log_user($cfg['Server']['user'], 'root-denied');
 887             PMA_auth_fails();
 888             unset($allowDeny_forbidden); //Clean up after you!
 889         }
 890
 891         // is a login without password allowed?
 892         if (!$cfg['Server']['AllowNoPassword'] && $cfg['Server']['password'] == '') {
 893             $login_without_password_is_forbidden = true;
 894             PMA_log_user($cfg['Server']['user'], 'empty-denied');
 895             PMA_auth_fails();
 896             unset($login_without_password_is_forbidden); //Clean up after you!
 897         }
 898
 899         // Try to connect MySQL with the control user profile (will be used to
 900         // get the privileges list for the current user but the true user link
 901         // must be open after this one so it would be default one for all the
 902         // scripts)
 903         $controllink = false;
 904         if ($cfg['Server']['controluser'] != '') {
 905             $controllink = PMA_DBI_connect($cfg['Server']['controluser'],
 906                 $cfg['Server']['controlpass'], true);
 907         }
 908
 909         // Connects to the server (validates user's login)
 910         $userlink = PMA_DBI_connect($cfg['Server']['user'],
 911             $cfg['Server']['password'], false);
 912
 913         if (! $controllink) {
 914             $controllink = $userlink;
 915         }
 916
 917         /* Log success */
 918         PMA_log_user($cfg['Server']['user']);
 919
 920         /**
 921          * with phpMyAdmin 3 we support MySQL >=5
 922          * but only production releases:
 923          *  - > 5.0.15
 924          */
 925         if (PMA_MYSQL_INT_VERSION < 50015) {
 926             PMA_fatalError(__('You should upgrade to %s %s or later.'), array('MySQL', '5.0.15'));
 927         }
 928
 929         /**
 930          * SQL Parser code
 931          */
 932         require_once './libraries/sqlparser.lib.php';
 933
 934         /**
 935          * SQL Validator interface code
 936          */
 937         require_once './libraries/sqlvalidator.lib.php';
 938
 939         /**
 940          * the PMA_List_Database class
 941          */
 942         require_once './libraries/PMA.php';
 943         $pma = new PMA;
 944         $pma->userlink = $userlink;
 945         $pma->controllink = $controllink;
 946
 947         /**
 948          * some resetting has to be done when switching servers
 949          */
 950         if (isset($_SESSION['tmp_user_values']['previous_server']) && $_SESSION['tmp_user_values']['previous_server'] != $GLOBALS['server']) {
 951             unset($_SESSION['tmp_user_values']['navi_limit_offset']);
 952         }
 953         $_SESSION['tmp_user_values']['previous_server'] = $GLOBALS['server'];
 954
 955     } // end server connecting
 956
 957     /**
 958      * check if profiling was requested and remember it
 959      * (note: when $cfg['ServerDefault'] = 0, constant is not defined)
 960      */
 961     if (isset($_REQUEST['profiling']) && PMA_profilingSupported()) {
 962         $_SESSION['profiling'] = true;
 963     } elseif (isset($_REQUEST['profiling_form'])) {
 964         // the checkbox was unchecked
 965         unset($_SESSION['profiling']);
 966     }
 967
 968     // library file for blobstreaming
 969     require_once './libraries/blobstreaming.lib.php';
 970
 971     // checks for blobstreaming plugins and databases that support
 972     // blobstreaming (by having the necessary tables for blobstreaming)
 973     if (checkBLOBStreamingPlugins()) {
 974         checkBLOBStreamableDatabases();
 975     }
 976 } // end if !defined('PMA_MINIMUM_COMMON')
 977
 978 // remove sensitive values from session
 979 $GLOBALS['PMA_Config']->set('blowfish_secret', '');
 980 $GLOBALS['PMA_Config']->set('Servers', '');
 981 $GLOBALS['PMA_Config']->set('default_server', '');
 982
 983 /* Tell tracker that it can actually work */
 984 PMA_Tracker::enable();
 985
 986 if (!empty($__redirect) && in_array($__redirect, $goto_whitelist)) {
 987     /**
 988      * include subform target page
 989      */
 990     require $__redirect;
 991     exit();
 992 }
 993 ?>