libraries/common.inc.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * Misc stuff and REQUIRED by ALL the scripts.
   5  * MUST be included by every script
   6  *
   7  * Among other things, it contains the advanced authentication work.
   8  *
   9  * Order of sections for common.inc.php:
  10  *
  11  * the authentication libraries must be before the connection to db
  12  *
  13  * ... so the required order is:
  14  *
  15  * LABEL_variables_init
  16  *  - initialize some variables always needed
  17  * LABEL_parsing_config_file
  18  *  - parsing of the configuration file
  19  * LABEL_loading_language_file
  20  *  - loading language file
  21  * LABEL_setup_servers
  22  *  - check and setup configured servers
  23  * LABEL_theme_setup
  24  *  - setting up themes
  25  *
  26  * - load of MySQL extension (if necessary)
  27  * - loading of an authentication library
  28  * - db connection
  29  * - authentication work
  30  *
  31  * @version $Id$
  32  */
  33
  34 /**
  35  * the error handler
  36  */
  37 require_once './libraries/Error_Handler.class.php';
  38
  39 /**
  40  * initialize the error handler
  41  */
  42 $GLOBALS['error_handler'] = new PMA_Error_Handler();
  43 $cfg['Error_Handler']['display'] = TRUE;
  44
  45 // at this point PMA_PHP_INT_VERSION is not yet defined
  46 if (version_compare(phpversion(), '6', 'lt')) {
  47     /**
  48      * Avoid object cloning errors
  49      */
  50     @ini_set('zend.ze1_compatibility_mode', false);
  51
  52     /**
  53      * Avoid problems with magic_quotes_runtime
  54      */
  55     @ini_set('magic_quotes_runtime', false);
  56 }
  57
  58 /**
  59  * for verification in all procedural scripts under libraries
  60  */
  61 define('PHPMYADMIN', true);
  62
  63 /**
  64  * core functions
  65  */
  66 require_once './libraries/core.lib.php';
  67
  68 /**
  69  * Input sanitizing
  70  */
  71 require_once './libraries/sanitizing.lib.php';
  72
  73 /**
  74  * the PMA_Theme class
  75  * (this one is the first to produce a fatal error under PHP < 5)
  76  * and let's put here the same minimum requirement as in our doc.
  77  */
  78 if (version_compare(PHP_VERSION, '5.2.0') < 0 ) {
  79     PMA_fatalError('strUpgrade', array('PHP', '5.2'));
  80 }
  81
  82 require_once './libraries/Theme.class.php';
  83
  84 /**
  85  * the PMA_Theme_Manager class
  86  */
  87 require_once './libraries/Theme_Manager.class.php';
  88
  89 /**
  90  * the PMA_Config class
  91  */
  92 require_once './libraries/Config.class.php';
  93
  94 /**
  95  * the PMA_Table class
  96  */
  97 require_once './libraries/Table.class.php';
  98
  99 if (!defined('PMA_MINIMUM_COMMON')) {
 100     /**
 101      * common functions
 102      */
 103     require_once './libraries/common.lib.php';
 104
 105     /**
 106      * Java script escaping.
 107      */
 108     require_once './libraries/js_escape.lib.php';
 109
 110     /**
 111      * Include URL/hidden inputs generating.
 112      */
 113     require_once './libraries/url_generating.lib.php';
 114 }
 115
 116 /******************************************************************************/
 117 /* start procedural code                       label_start_procedural         */
 118
 119 /**
 120  * protect against possible exploits - there is no need to have so much variables
 121  */
 122 if (count($_REQUEST) > 1000) {
 123     die('possible exploit');
 124 }
 125
 126 /**
 127  * Check for numeric keys
 128  * (if register_globals is on, numeric key can be found in $GLOBALS)
 129  */
 130 foreach ($GLOBALS as $key => $dummy) {
 131     if (is_numeric($key)) {
 132         die('numeric key detected');
 133     }
 134 }
 135 unset($dummy);
 136
 137 /**
 138  * PATH_INFO could be compromised if set, so remove it from PHP_SELF
 139  * and provide a clean PHP_SELF here
 140  */
 141 $PMA_PHP_SELF = PMA_getenv('PHP_SELF');
 142 $_PATH_INFO = PMA_getenv('PATH_INFO');
 143 if (! empty($_PATH_INFO) && ! empty($PMA_PHP_SELF)) {
 144     $path_info_pos = strrpos($PMA_PHP_SELF, $_PATH_INFO);
 145     if ($path_info_pos + strlen($_PATH_INFO) === strlen($PMA_PHP_SELF)) {
 146         $PMA_PHP_SELF = substr($PMA_PHP_SELF, 0, $path_info_pos);
 147     }
 148 }
 149 $PMA_PHP_SELF = htmlspecialchars($PMA_PHP_SELF);
 150
 151
 152 /**
 153  * just to be sure there was no import (registering) before here
 154  * we empty the global space (but avoid unsetting $variables_list
 155  * and $key in the foreach(), we still need them!)
 156  */
 157 $variables_whitelist = array (
 158     'GLOBALS',
 159     '_SERVER',
 160     '_GET',
 161     '_POST',
 162     '_REQUEST',
 163     '_FILES',
 164     '_ENV',
 165     '_COOKIE',
 166     '_SESSION',
 167     'error_handler',
 168     'PMA_PHP_SELF',
 169     'variables_whitelist',
 170     'key'
 171 );
 172
 173 foreach (get_defined_vars() as $key => $value) {
 174     if (! in_array($key, $variables_whitelist)) {
 175         unset($$key);
 176     }
 177 }
 178 unset($key, $value, $variables_whitelist);
 179
 180
 181 /**
 182  * Subforms - some functions need to be called by form, cause of the limited URL
 183  * length, but if this functions inside another form you cannot just open a new
 184  * form - so phpMyAdmin uses 'arrays' inside this form
 185  *
 186  * <code>
 187  * <form ...>
 188  * ... main form elments ...
 189  * <input type="hidden" name="subform[action1][id]" value="1" />
 190  * ... other subform data ...
 191  * <input type="submit" name="usesubform[action1]" value="do action1" />
 192  * ... other subforms ...
 193  * <input type="hidden" name="subform[actionX][id]" value="X" />
 194  * ... other subform data ...
 195  * <input type="submit" name="usesubform[actionX]" value="do actionX" />
 196  * ... main form elments ...
 197  * <input type="submit" name="main_action" value="submit form" />
 198  * </form>
 199  * </code
 200  *
 201  * so we now check if a subform is submitted
 202  */
 203 $__redirect = null;
 204 if (isset($_POST['usesubform'])) {
 205     // if a subform is present and should be used
 206     // the rest of the form is deprecated
 207     $subform_id = key($_POST['usesubform']);
 208     $subform    = $_POST['subform'][$subform_id];
 209     $_POST      = $subform;
 210     $_REQUEST   = $subform;
 211     /**
 212      * some subforms need another page than the main form, so we will just
 213      * include this page at the end of this script - we use $__redirect to
 214      * track this
 215      */
 216     if (isset($_POST['redirect'])
 217       && $_POST['redirect'] != basename($PMA_PHP_SELF)) {
 218         $__redirect = $_POST['redirect'];
 219         unset($_POST['redirect']);
 220     }
 221     unset($subform_id, $subform);
 222 } else {
 223     // Note: here we overwrite $_REQUEST so that it does not contain cookies,
 224     // because another application for the same domain could have set
 225     // a cookie (with a compatible path) that overrides a variable
 226     // we expect from GET or POST.
 227     // We'll refer to cookies explicitly with the $_COOKIE syntax.
 228     $_REQUEST = array_merge($_GET, $_POST);
 229 }
 230 // end check if a subform is submitted
 231
 232 // remove quotes added by php
 233 // (get_magic_quotes_gpc() is deprecated in PHP 5.3, but compare with 5.2.99
 234 // to be able to test with 5.3.0-dev)
 235 if (function_exists('get_magic_quotes_gpc') && -1 == version_compare(PHP_VERSION, '5.2.99') && get_magic_quotes_gpc()) {
 236     PMA_arrayWalkRecursive($_GET, 'stripslashes', true);
 237     PMA_arrayWalkRecursive($_POST, 'stripslashes', true);
 238     PMA_arrayWalkRecursive($_COOKIE, 'stripslashes', true);
 239     PMA_arrayWalkRecursive($_REQUEST, 'stripslashes', true);
 240 }
 241
 242 /**
 243  * clean cookies on upgrade
 244  * when changing something related to PMA cookies, increment the cookie version
 245  */
 246 $pma_cookie_version = 4;
 247 if (isset($_COOKIE)
 248  && (isset($_COOKIE['pmaCookieVer'])
 249   && $_COOKIE['pmaCookieVer'] < $pma_cookie_version)) {
 250     // delete all cookies
 251     foreach($_COOKIE as $cookie_name => $tmp) {
 252         PMA_removeCookie($cookie_name);
 253     }
 254     $_COOKIE = array();
 255     PMA_setCookie('pmaCookieVer', $pma_cookie_version);
 256 }
 257
 258 /**
 259  * include deprecated grab_globals only if required
 260  */
 261 if (empty($__redirect) && !defined('PMA_NO_VARIABLES_IMPORT')) {
 262     require './libraries/grab_globals.lib.php';
 263 }
 264
 265 /**
 266  * check timezone setting
 267  * this could produce an E_STRICT - but only once,
 268  * if not done here it will produce E_STRICT on every date/time function
 269  *
 270  * @todo need to decide how we should handle this (without @)
 271  */
 272 date_default_timezone_set(@date_default_timezone_get());
 273
 274 /**
 275  * include session handling after the globals, to prevent overwriting
 276  */
 277 require_once './libraries/session.inc.php';
 278
 279 /**
 280  * init some variables LABEL_variables_init
 281  */
 282
 283 /**
 284  * holds parameters to be passed to next page
 285  * @global array $GLOBALS['url_params']
 286  */
 287 $GLOBALS['url_params'] = array();
 288
 289 /**
 290  * the whitelist for $GLOBALS['goto']
 291  * @global array $goto_whitelist
 292  */
 293 $goto_whitelist = array(
 294     //'browse_foreigners.php',
 295     //'calendar.php',
 296     //'changelog.php',
 297     //'chk_rel.php',
 298     'db_create.php',
 299     'db_datadict.php',
 300     'db_sql.php',
 301     'db_export.php',
 302     'db_importdocsql.php',
 303     'db_qbe.php',
 304     'db_structure.php',
 305     'db_import.php',
 306     'db_operations.php',
 307     'db_printview.php',
 308     'db_search.php',
 309     //'Documentation.html',
 310     //'error.php',
 311     'export.php',
 312     'import.php',
 313     //'index.php',
 314     //'navigation.php',
 315     //'license.php',
 316     'main.php',
 317     'pdf_pages.php',
 318     'pdf_schema.php',
 319     //'phpinfo.php',
 320     'querywindow.php',
 321     //'readme.php',
 322     'server_binlog.php',
 323     'server_collations.php',
 324     'server_databases.php',
 325     'server_engines.php',
 326     'server_export.php',
 327     'server_import.php',
 328     'server_privileges.php',
 329     'server_processlist.php',
 330     'server_sql.php',
 331     'server_status.php',
 332     'server_variables.php',
 333     'sql.php',
 334     'tbl_addfield.php',
 335     'tbl_alter.php',
 336     'tbl_change.php',
 337     'tbl_create.php',
 338     'tbl_import.php',
 339     'tbl_indexes.php',
 340     'tbl_move_copy.php',
 341     'tbl_printview.php',
 342     'tbl_sql.php',
 343     'tbl_export.php',
 344     'tbl_operations.php',
 345     'tbl_structure.php',
 346     'tbl_relation.php',
 347     'tbl_replace.php',
 348     'tbl_row_action.php',
 349     'tbl_select.php',
 350     //'themes.php',
 351     'transformation_overview.php',
 352     'transformation_wrapper.php',
 353     'translators.html',
 354     'user_password.php',
 355 );
 356
 357 /**
 358  * check $__redirect against whitelist
 359  */
 360 if (! PMA_checkPageValidity($__redirect, $goto_whitelist)) {
 361     $__redirect = null;
 362 }
 363
 364 /**
 365  * holds page that should be displayed
 366  * @global string $GLOBALS['goto']
 367  */
 368 $GLOBALS['goto'] = '';
 369 // Security fix: disallow accessing serious server files via "?goto="
 370 if (PMA_checkPageValidity($_REQUEST['goto'], $goto_whitelist)) {
 371     $GLOBALS['goto'] = $_REQUEST['goto'];
 372     $GLOBALS['url_params']['goto'] = $_REQUEST['goto'];
 373 } else {
 374     unset($_REQUEST['goto'], $_GET['goto'], $_POST['goto'], $_COOKIE['goto']);
 375 }
 376
 377 /**
 378  * returning page
 379  * @global string $GLOBALS['back']
 380  */
 381 if (PMA_checkPageValidity($_REQUEST['back'], $goto_whitelist)) {
 382     $GLOBALS['back'] = $_REQUEST['back'];
 383 } else {
 384     unset($_REQUEST['back'], $_GET['back'], $_POST['back'], $_COOKIE['back']);
 385 }
 386
 387 /**
 388  * Check whether user supplied token is valid, if not remove any possibly
 389  * dangerous stuff from request.
 390  *
 391  * remember that some objects in the session with session_start and __wakeup()
 392  * could access this variables before we reach this point
 393  * f.e. PMA_Config: fontsize
 394  *
 395  * @todo variables should be handled by their respective owners (objects)
 396  * f.e. lang, server, convcharset, collation_connection in PMA_Config
 397  */
 398 if (! PMA_isValid($_REQUEST['token']) || $_SESSION[' PMA_token '] != $_REQUEST['token']) {
 399     /**
 400      *  List of parameters which are allowed from unsafe source
 401      */
 402     $allow_list = array(
 403         /* needed for direct access, see FAQ 1.34
 404          * also, server needed for cookie login screen (multi-server)
 405          */
 406         'server', 'db', 'table', 'target',
 407         /* Session ID */
 408         'phpMyAdmin',
 409         /* Cookie preferences */
 410         'pma_lang', 'pma_charset', 'pma_collation_connection',
 411         /* Possible login form */
 412         'pma_servername', 'pma_username', 'pma_password',
 413         /* rajk - for playing blobstreamable media */
 414         'media_type', 'custom_type', 'bs_reference',
 415         /* rajk - for changing BLOB repository file MIME type */
 416         'bs_db', 'bs_table', 'bs_ref', 'bs_new_mime_type'
 417     );
 418     /**
 419      * Require cleanup functions
 420      */
 421     require_once './libraries/cleanup.lib.php';
 422     /**
 423      * Do actual cleanup
 424      */
 425     PMA_remove_request_vars($allow_list);
 426
 427 }
 428
 429
 430 /**
 431  * @global string $GLOBALS['convcharset']
 432  * @see select_lang.lib.php
 433  */
 434 if (isset($_REQUEST['convcharset'])) {
 435     $GLOBALS['convcharset'] = strip_tags($_REQUEST['convcharset']);
 436 }
 437
 438 /**
 439  * current selected database
 440  * @global string $GLOBALS['db']
 441  */
 442 $GLOBALS['db'] = '';
 443 if (PMA_isValid($_REQUEST['db'])) {
 444     // can we strip tags from this?
 445     // only \ and / is not allowed in db names for MySQL
 446     $GLOBALS['db'] = $_REQUEST['db'];
 447     $GLOBALS['url_params']['db'] = $GLOBALS['db'];
 448 }
 449
 450 /**
 451  * current selected table
 452  * @global string $GLOBALS['table']
 453  */
 454 $GLOBALS['table'] = '';
 455 if (PMA_isValid($_REQUEST['table'])) {
 456     // can we strip tags from this?
 457     // only \ and / is not allowed in table names for MySQL
 458     $GLOBALS['table'] = $_REQUEST['table'];
 459     $GLOBALS['url_params']['table'] = $GLOBALS['table'];
 460 }
 461
 462 /**
 463  * SQL query to be executed
 464  * @global string $GLOBALS['sql_query']
 465  */
 466 $GLOBALS['sql_query'] = '';
 467 if (PMA_isValid($_REQUEST['sql_query'])) {
 468     $GLOBALS['sql_query'] = $_REQUEST['sql_query'];
 469 }
 470
 471 /**
 472  * avoid problems in phpmyadmin.css.php in some cases
 473  * @global string $js_frame
 474  */
 475 $_REQUEST['js_frame'] = PMA_ifSetOr($_REQUEST['js_frame'], '');
 476
 477 //$_REQUEST['set_theme'] // checked later in this file LABEL_theme_setup
 478 //$_REQUEST['server']; // checked later in this file
 479 //$_REQUEST['lang'];   // checked by LABEL_loading_language_file
 480
 481
 482 /**
 483  * holds name of JavaScript files to be included in HTML header
 484  * @global array $js_include
 485  */
 486 $GLOBALS['js_include'] = array();
 487
 488 /**
 489  * holds locale messages required by JavaScript function
 490  * @global array $js_messages
 491  */
 492 $GLOBALS['js_messages'] = array();
 493
 494 /**
 495  * JavaScript events that will be registered
 496  * @global array $js_events
 497  */
 498 $GLOBALS['js_events'] = array();
 499
 500 /**
 501  * footnotes to be displayed ot the page bottom
 502  * @global array $footnotes
 503  */
 504 $GLOBALS['footnotes'] = array();
 505
 506 /******************************************************************************/
 507 /* parsing configuration file                         LABEL_parsing_config_file      */
 508
 509 /**
 510  * We really need this one!
 511  */
 512 if (! function_exists('preg_replace')) {
 513     PMA_fatalError('strCantLoad', 'pcre');
 514 }
 515
 516 /**
 517  * @global PMA_Config $_SESSION['PMA_Config']
 518  * force reading of config file, because we removed sensitive values
 519  * in the previous iteration
 520  */
 521 $_SESSION['PMA_Config'] = new PMA_Config('./config.inc.php');
 522
 523 if (!defined('PMA_MINIMUM_COMMON')) {
 524     $_SESSION['PMA_Config']->checkPmaAbsoluteUri();
 525 }
 526
 527 /**
 528  * BC - enable backward compatibility
 529  * exports all configuration settings into $GLOBALS ($GLOBALS['cfg'])
 530  */
 531 $_SESSION['PMA_Config']->enableBc();
 532
 533
 534 /**
 535  * check HTTPS connection
 536  */
 537 if ($_SESSION['PMA_Config']->get('ForceSSL')
 538   && !$_SESSION['PMA_Config']->get('is_https')) {
 539     PMA_sendHeaderLocation(
 540         preg_replace('/^http/', 'https',
 541             $_SESSION['PMA_Config']->get('PmaAbsoluteUri'))
 542         . PMA_generate_common_url($_GET, 'text'));
 543     // delete the current session, otherwise we get problems (see bug #2397877)
 544     PMA_removeCookie($GLOBALS['session_name']);
 545     exit;
 546 }
 547
 548
 549 /******************************************************************************/
 550 /* loading language file                       LABEL_loading_language_file    */
 551
 552 /**
 553  * Added messages while developing:
 554  */
 555 if (file_exists('./lang/added_messages.php')) {
 556     include './lang/added_messages.php';
 557 }
 558
 559 /**
 560  * lang detection is done here
 561  */
 562 require_once './libraries/select_lang.lib.php';
 563
 564 /**
 565  * check for errors occurred while loading configuration
 566  * this check is done here after loading language files to present errors in locale
 567  */
 568 if ($_SESSION['PMA_Config']->error_config_file) {
 569     $error = $strConfigFileError
 570         . '<br /><br />'
 571         . ($_SESSION['PMA_Config']->getSource() == './config.inc.php' ?
 572         '<a href="show_config_errors.php"'
 573         .' target="_blank">' . $_SESSION['PMA_Config']->getSource() . '</a>'
 574         :
 575         '<a href="' . $_SESSION['PMA_Config']->getSource() . '"'
 576         .' target="_blank">' . $_SESSION['PMA_Config']->getSource() . '</a>');
 577     trigger_error($error, E_USER_ERROR);
 578 }
 579 if ($_SESSION['PMA_Config']->error_config_default_file) {
 580     $error = sprintf($strConfigDefaultFileError,
 581         $_SESSION['PMA_Config']->default_source);
 582     trigger_error($error, E_USER_ERROR);
 583 }
 584 if ($_SESSION['PMA_Config']->error_pma_uri) {
 585     trigger_error($strPmaUriError, E_USER_ERROR);
 586 }
 587
 588
 589 /******************************************************************************/
 590 /* setup servers                                       LABEL_setup_servers    */
 591
 592 /**
 593  * current server
 594  * @global integer $GLOBALS['server']
 595  */
 596 $GLOBALS['server'] = 0;
 597
 598 /**
 599  * Servers array fixups.
 600  * $default_server comes from PMA_Config::enableBc()
 601  * @todo merge into PMA_Config
 602  */
 603 // Do we have some server?
 604 if (!isset($cfg['Servers']) || count($cfg['Servers']) == 0) {
 605     // No server => create one with defaults
 606     $cfg['Servers'] = array(1 => $default_server);
 607 } else {
 608     // We have server(s) => apply default configuration
 609     $new_servers = array();
 610
 611     foreach ($cfg['Servers'] as $server_index => $each_server) {
 612
 613         // Detect wrong configuration
 614         if (!is_int($server_index) || $server_index < 1) {
 615             trigger_error(sprintf($strInvalidServerIndex, $server_index), E_USER_ERROR);
 616         }
 617
 618         $each_server = array_merge($default_server, $each_server);
 619
 620         // Don't use servers with no hostname
 621         if ($each_server['connect_type'] == 'tcp' && empty($each_server['host'])) {
 622             trigger_error(sprintf($strInvalidServerHostname, $server_index), E_USER_ERROR);
 623         }
 624
 625         // Final solution to bug #582890
 626         // If we are using a socket connection
 627         // and there is nothing in the verbose server name
 628         // or the host field, then generate a name for the server
 629         // in the form of "Server 2", localized of course!
 630         if ($each_server['connect_type'] == 'socket' && empty($each_server['host']) && empty($each_server['verbose'])) {
 631             $each_server['verbose'] = $GLOBALS['strServer'] . $server_index;
 632         }
 633
 634         $new_servers[$server_index] = $each_server;
 635     }
 636     $cfg['Servers'] = $new_servers;
 637     unset($new_servers, $server_index, $each_server);
 638 }
 639
 640 // Cleanup
 641 unset($default_server);
 642
 643
 644 /******************************************************************************/
 645 /* setup themes                                          LABEL_theme_setup    */
 646
 647 if (isset($_REQUEST['custom_color_reset'])) {
 648     unset($_SESSION['userconf']['custom_color']);
 649     unset($_SESSION['userconf']['custom_color_rgb']);
 650 } elseif (isset($_REQUEST['custom_color'])) {
 651     $_SESSION['userconf']['custom_color'] = $_REQUEST['custom_color'];
 652     $_SESSION['userconf']['custom_color_rgb'] = $_REQUEST['custom_color_rgb'];
 653 }
 654 /**
 655  * @global PMA_Theme_Manager $_SESSION['PMA_Theme_Manager']
 656  */
 657 if (! isset($_SESSION['PMA_Theme_Manager'])) {
 658     $_SESSION['PMA_Theme_Manager'] = new PMA_Theme_Manager;
 659 } else {
 660     /**
 661      * @todo move all __wakeup() functionality into session.inc.php
 662      */
 663     $_SESSION['PMA_Theme_Manager']->checkConfig();
 664 }
 665
 666 // for the theme per server feature
 667 if (isset($_REQUEST['server']) && !isset($_REQUEST['set_theme'])) {
 668     $GLOBALS['server'] = $_REQUEST['server'];
 669     $tmp = $_SESSION['PMA_Theme_Manager']->getThemeCookie();
 670     if (empty($tmp)) {
 671         $tmp = $_SESSION['PMA_Theme_Manager']->theme_default;
 672     }
 673     $_SESSION['PMA_Theme_Manager']->setActiveTheme($tmp);
 674     unset($tmp);
 675 }
 676 /**
 677  * @todo move into PMA_Theme_Manager::__wakeup()
 678  */
 679 if (isset($_REQUEST['set_theme'])) {
 680     // if user selected a theme
 681     $_SESSION['PMA_Theme_Manager']->setActiveTheme($_REQUEST['set_theme']);
 682 }
 683
 684 /**
 685  * the theme object
 686  * @global PMA_Theme $_SESSION['PMA_Theme']
 687  */
 688 $_SESSION['PMA_Theme'] = $_SESSION['PMA_Theme_Manager']->theme;
 689
 690 // BC
 691 /**
 692  * the active theme
 693  * @global string $GLOBALS['theme']
 694  */
 695 $GLOBALS['theme']           = $_SESSION['PMA_Theme']->getName();
 696 /**
 697  * the theme path
 698  * @global string $GLOBALS['pmaThemePath']
 699  */
 700 $GLOBALS['pmaThemePath']    = $_SESSION['PMA_Theme']->getPath();
 701 /**
 702  * the theme image path
 703  * @global string $GLOBALS['pmaThemeImage']
 704  */
 705 $GLOBALS['pmaThemeImage']   = $_SESSION['PMA_Theme']->getImgPath();
 706
 707 /**
 708  * load layout file if exists
 709  */
 710 if (@file_exists($_SESSION['PMA_Theme']->getLayoutFile())) {
 711     include $_SESSION['PMA_Theme']->getLayoutFile();
 712     /**
 713      * @todo remove if all themes are update use Navi instead of Left as frame name
 714      */
 715     if (! isset($GLOBALS['cfg']['NaviWidth'])
 716      && isset($GLOBALS['cfg']['LeftWidth'])) {
 717         $GLOBALS['cfg']['NaviWidth'] = $GLOBALS['cfg']['LeftWidth'];
 718     }
 719 }
 720
 721 if (! defined('PMA_MINIMUM_COMMON')) {
 722     /**
 723      * Character set conversion.
 724      */
 725     require_once './libraries/charset_conversion.lib.php';
 726
 727     /**
 728      * String handling
 729      */
 730     require_once './libraries/string.lib.php';
 731
 732     /**
 733      * Lookup server by name
 734      * by Arnold - Helder Hosting
 735      * (see FAQ 4.8)
 736      */
 737     if (! empty($_REQUEST['server']) && is_string($_REQUEST['server'])
 738      && ! is_numeric($_REQUEST['server'])) {
 739         foreach ($cfg['Servers'] as $i => $server) {
 740             if ($server['host'] == $_REQUEST['server']) {
 741                 $_REQUEST['server'] = $i;
 742                 break;
 743             }
 744         }
 745         if (is_string($_REQUEST['server'])) {
 746             unset($_REQUEST['server']);
 747         }
 748         unset($i);
 749     }
 750
 751     /**
 752      * If no server is selected, make sure that $cfg['Server'] is empty (so
 753      * that nothing will work), and skip server authentication.
 754      * We do NOT exit here, but continue on without logging into any server.
 755      * This way, the welcome page will still come up (with no server info) and
 756      * present a choice of servers in the case that there are multiple servers
 757      * and '$cfg['ServerDefault'] = 0' is set.
 758      */
 759
 760     if (isset($_REQUEST['server']) && (is_string($_REQUEST['server']) || is_numeric($_REQUEST['server'])) && ! empty($_REQUEST['server']) && ! empty($cfg['Servers'][$_REQUEST['server']])) {
 761         $GLOBALS['server'] = $_REQUEST['server'];
 762         $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
 763     } else {
 764         if (!empty($cfg['Servers'][$cfg['ServerDefault']])) {
 765             $GLOBALS['server'] = $cfg['ServerDefault'];
 766             $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
 767         } else {
 768             $GLOBALS['server'] = 0;
 769             $cfg['Server'] = array();
 770         }
 771     }
 772     $GLOBALS['url_params']['server'] = $GLOBALS['server'];
 773
 774     /**
 775      * Kanji encoding convert feature appended by Y.Kawada (2002/2/20)
 776      */
 777     if (function_exists('mb_convert_encoding')
 778      && strpos($lang, 'ja-') !== false) {
 779         require_once './libraries/kanji-encoding.lib.php';
 780         /**
 781          * enable multibyte string support
 782          */
 783         define('PMA_MULTIBYTE_ENCODING', 1);
 784     } // end if
 785
 786     /**
 787      * save some settings in cookies
 788      * @todo should be done in PMA_Config
 789      */
 790     PMA_setCookie('pma_lang', $GLOBALS['lang']);
 791     PMA_setCookie('pma_charset', $GLOBALS['convcharset']);
 792     PMA_setCookie('pma_collation_connection', $GLOBALS['collation_connection']);
 793
 794     $_SESSION['PMA_Theme_Manager']->setThemeCookie();
 795
 796     if (! empty($cfg['Server'])) {
 797
 798         /**
 799          * Loads the proper database interface for this server
 800          */
 801         require_once './libraries/database_interface.lib.php';
 802
 803         // Gets the authentication library that fits the $cfg['Server'] settings
 804         // and run authentication
 805
 806         // to allow HTTP or http
 807         $cfg['Server']['auth_type'] = strtolower($cfg['Server']['auth_type']);
 808         if (! file_exists('./libraries/auth/' . $cfg['Server']['auth_type'] . '.auth.lib.php')) {
 809             PMA_fatalError($strInvalidAuthMethod . ' ' . $cfg['Server']['auth_type']);
 810         }
 811         /**
 812          * the required auth type plugin
 813          */
 814         require_once './libraries/auth/' . $cfg['Server']['auth_type'] . '.auth.lib.php';
 815
 816         if (!PMA_auth_check()) {
 817             PMA_auth();
 818         } else {
 819             PMA_auth_set_user();
 820         }
 821
 822         // Check IP-based Allow/Deny rules as soon as possible to reject the
 823         // user
 824         // Based on mod_access in Apache:
 825         // http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/aaa/mod_access.c?rev=1.37&content-type=text/vnd.viewcvs-markup
 826         // Look at: "static int check_dir_access(request_rec *r)"
 827         // Robbat2 - May 10, 2002
 828         if (isset($cfg['Server']['AllowDeny'])
 829           && isset($cfg['Server']['AllowDeny']['order'])) {
 830
 831             /**
 832              * ip based access library
 833              */
 834             require_once './libraries/ip_allow_deny.lib.php';
 835
 836             $allowDeny_forbidden         = false; // default
 837             if ($cfg['Server']['AllowDeny']['order'] == 'allow,deny') {
 838                 $allowDeny_forbidden     = true;
 839                 if (PMA_allowDeny('allow')) {
 840                     $allowDeny_forbidden = false;
 841                 }
 842                 if (PMA_allowDeny('deny')) {
 843                     $allowDeny_forbidden = true;
 844                 }
 845             } elseif ($cfg['Server']['AllowDeny']['order'] == 'deny,allow') {
 846                 if (PMA_allowDeny('deny')) {
 847                     $allowDeny_forbidden = true;
 848                 }
 849                 if (PMA_allowDeny('allow')) {
 850                     $allowDeny_forbidden = false;
 851                 }
 852             } elseif ($cfg['Server']['AllowDeny']['order'] == 'explicit') {
 853                 if (PMA_allowDeny('allow')
 854                   && !PMA_allowDeny('deny')) {
 855                     $allowDeny_forbidden = false;
 856                 } else {
 857                     $allowDeny_forbidden = true;
 858                 }
 859             } // end if ... elseif ... elseif
 860
 861             // Ejects the user if banished
 862             if ($allowDeny_forbidden) {
 863                PMA_auth_fails();
 864             }
 865             unset($allowDeny_forbidden); //Clean up after you!
 866         } // end if
 867
 868         // is root allowed?
 869         if (!$cfg['Server']['AllowRoot'] && $cfg['Server']['user'] == 'root') {
 870             $allowDeny_forbidden = true;
 871             PMA_auth_fails();
 872             unset($allowDeny_forbidden); //Clean up after you!
 873         }
 874
 875         // is root without password allowed?
 876         if (!$cfg['Server']['AllowNoPasswordRoot'] && $cfg['Server']['user'] == 'root' && $cfg['Server']['password'] == '') {
 877             $allowDeny_forbidden = true;
 878             PMA_auth_fails();
 879             unset($allowDeny_forbidden); //Clean up after you!
 880         }
 881
 882         // Try to connect MySQL with the control user profile (will be used to
 883         // get the privileges list for the current user but the true user link
 884         // must be open after this one so it would be default one for all the
 885         // scripts)
 886         $controllink = false;
 887         if ($cfg['Server']['controluser'] != '') {
 888             $controllink = PMA_DBI_connect($cfg['Server']['controluser'],
 889                 $cfg['Server']['controlpass'], true);
 890         }
 891
 892         // Connects to the server (validates user's login)
 893         $userlink = PMA_DBI_connect($cfg['Server']['user'],
 894             $cfg['Server']['password'], false);
 895
 896         if (! $controllink) {
 897             $controllink = $userlink;
 898         }
 899
 900         /**
 901          * with phpMyAdmin 3 we support MySQL >=5
 902          * but only production releases:
 903          *  - > 5.0.15
 904          */
 905         if (PMA_MYSQL_INT_VERSION < 50015) {
 906             PMA_fatalError('strUpgrade', array('MySQL', '5.0.15'));
 907         }
 908
 909         /**
 910          * SQL Parser code
 911          */
 912         require_once './libraries/sqlparser.lib.php';
 913
 914         /**
 915          * SQL Validator interface code
 916          */
 917         require_once './libraries/sqlvalidator.lib.php';
 918
 919         /**
 920          * the PMA_List_Database class
 921          */
 922         require_once './libraries/PMA.php';
 923         $pma = new PMA;
 924         $pma->userlink = $userlink;
 925         $pma->controllink = $controllink;
 926
 927         /**
 928          * some resetting has to be done when switching servers
 929          */
 930         if (isset($_SESSION['userconf']['previous_server']) && $_SESSION['userconf']['previous_server'] != $GLOBALS['server']) {
 931             unset($_SESSION['userconf']['navi_limit_offset']);
 932         }
 933         $_SESSION['userconf']['previous_server'] = $GLOBALS['server'];
 934
 935     } // end server connecting
 936
 937     /**
 938      * check if profiling was requested and remember it
 939      * (note: when $cfg['ServerDefault'] = 0, constant is not defined)
 940      */
 941     if (isset($_REQUEST['profiling']) && PMA_profilingSupported()) {
 942         $_SESSION['profiling'] = true;
 943     } elseif (isset($_REQUEST['profiling_form'])) {
 944         // the checkbox was unchecked
 945         unset($_SESSION['profiling']);
 946     }
 947
 948     // rajk - library file for blobstreaming
 949     require_once './libraries/blobstreaming.lib.php';
 950
 951     // rajk - checks for blobstreaming plugins and databases that support
 952     // blobstreaming (by having the necessary tables for blobstreaming)
 953     if (checkBLOBStreamingPlugins())
 954         checkBLOBStreamableDatabases();
 955 } // end if !defined('PMA_MINIMUM_COMMON')
 956
 957 // remove sensitive values from session
 958 $_SESSION['PMA_Config']->set('blowfish_secret', '');
 959 $_SESSION['PMA_Config']->set('Servers', '');
 960 $_SESSION['PMA_Config']->set('default_server', '');
 961
 962 if (!empty($__redirect) && in_array($__redirect, $goto_whitelist)) {
 963     /**
 964      * include subform target page
 965      */
 966     require $__redirect;
 967     exit();
 968 }
 969 ?>