updates
[phpmyadmin/crack.git] / main.php3
blob0049c9b5ded86df8ee7970bcbc992f8cd76b0e96
1 <?php
2 /* $Id$ */
5 /**
6 * Gets some core libraries and displays a top message if required
7 */
8 if (!defined('PMA_GRAB_GLOBALS_INCLUDED')) {
9 include('./libraries/grab_globals.lib.php3');
11 if (!defined('PMA_COMMON_LIB_INCLUDED')) {
12 include('./libraries/common.lib.php3');
14 // Puts the language to use in a cookie that will expire in 30 days
15 if (!isset($pma_uri_parts)) {
16 $pma_uri_parts = parse_url($cfg['PmaAbsoluteUri']);
17 $cookie_path = substr($pma_uri_parts['path'], 0, strrpos($pma_uri_parts['path'], '/'));
18 $is_https = ($pma_uri_parts['scheme'] == 'https') ? 1 : 0;
20 setcookie('lang', $lang, time() + 60*60*24*30, $cookie_path, '', $is_https);
21 // Defines the "item" image depending on text direction
22 $item_img = 'images/item_' . $text_dir . '.gif';
23 // Handles some variables that may have been sent by the calling script
24 if (isset($db)) {
25 unset($db);
27 if (isset($table)) {
28 unset($table);
30 $show_query = '1';
31 require('./header.inc.php3');
32 if (isset($message)) {
33 PMA_showMessage($message);
35 else if (isset($reload) && $reload) {
36 // Reloads the navigation frame via JavaScript if required
37 echo "\n";
39 <script type="text/javascript" language="javascript1.2">
40 <!--
41 window.parent.frames['nav'].location.replace('./left.php3?lang=<?php echo $lang; ?>&convcharset=<?php echo $convcharset; ?>&server=<?php echo $server; ?>');
42 //-->
43 </script>
44 <?php
46 echo "\n";
49 /**
50 * Displays the welcome message and the server informations
53 <h1><?php echo sprintf($strWelcome, ' phpMyAdmin ' . PMA_VERSION); ?></h1>
55 <?php
56 // Don't display server info if $server == 0 (no server selected)
57 // loic1: modified in order to have a valid words order whatever is the
58 // language used
59 if ($server > 0) {
60 // robbat2: Use the verbose name of the server instead of the hostname
61 // if a value is set
62 if(!empty($cfg['Server']['verbose'])) {
63 $server_info = $cfg['Server']['verbose'];
64 } else {
65 $server_info = $cfg['Server']['host'];
67 $server_info .= (empty($cfg['Server']['port']) ? '' : ':' . $cfg['Server']['port']);
68 // loic1: skip this because it's not a so good idea to display sockets
69 // used to everybody
70 // if (!empty($cfg['Server']['socket']) && PMA_PHP_INT_VERSION >= 30010) {
71 // $server_info .= ':' . $cfg['Server']['socket'];
72 // }
73 $local_query = 'SELECT VERSION() as version, USER() as user';
74 $res = PMA_mysql_query($local_query) or PMA_mysqlDie('', $local_query, FALSE, '');
75 $mysql_cur_user_and_host = PMA_mysql_result($res, 0, 'user');
76 $mysql_cur_user = substr($mysql_cur_user_and_host, 0, strpos($mysql_cur_user_and_host, '@'));
78 $full_string = str_replace('%pma_s1%', PMA_mysql_result($res, 0, 'version'), $strMySQLServerProcess);
79 $full_string = str_replace('%pma_s2%', $server_info, $full_string);
80 $full_string = str_replace('%pma_s3%', $mysql_cur_user_and_host, $full_string);
82 echo '<p><b>' . $full_string . '</b></p><br />' . "\n";
83 } // end if
86 /**
87 * Reload mysql (flush privileges)
89 if (($server > 0) && isset($mode) && ($mode == 'reload')) {
90 $result = PMA_mysql_query('FLUSH PRIVILEGES'); // Debug: or PMA_mysqlDie('', 'FLUSH PRIVILEGES', FALSE, 'main.php3?lang=' . $lang . '&amp;server=' . $server);
91 echo '<p><b>';
92 if ($result != 0) {
93 echo $strMySQLReloaded;
94 } else {
95 echo $strReloadFailed;
97 echo '</b></p>' . "\n\n";
102 * Displays the MySQL servers choice form
104 if ($server == 0 || count($cfg['Servers']) > 1) {
106 <!-- MySQL servers choice form -->
107 <table>
108 <tr>
109 <th><?php echo $strServerChoice; ?></th>
110 </tr>
111 <tr>
112 <td>
113 <form method="post" action="index.php3" target="_parent">
114 <select name="server">
115 <?php
116 echo "\n";
117 reset($cfg['Servers']);
118 while (list($key, $val) = each($cfg['Servers'])) {
119 if (!empty($val['host'])) {
120 echo ' <option value="' . $key . '"';
121 if (!empty($server) && ($server == $key)) {
122 echo ' selected="selected"';
124 echo '>';
125 if (!empty($val['verbose'])) {
126 echo $val['verbose'];
127 } else {
128 echo $val['host'];
129 if (!empty($val['port'])) {
130 echo ':' . $val['port'];
132 // loic1: skip this because it's not a so good idea to display
133 // sockets used to everybody
134 // if (!empty($val['socket']) && PMA_PHP_INT_VERSION >= 30010) {
135 // echo ':' . $val['socket'];
136 // }
138 // loic1: if 'only_db' is an array and there is more than one
139 // value, displaying such informations may not be a so good
140 // idea
141 if (!empty($val['only_db'])) {
142 echo ' - ' . (is_array($val['only_db']) ? implode(', ', $val['only_db']) : $val['only_db']);
144 if (!empty($val['user']) && ($val['auth_type'] == 'config')) {
145 echo ' (' . $val['user'] . ')';
147 echo '&nbsp;</option>' . "\n";
148 } // end if (!empty($val['host']))
149 } // end while
151 </select>
152 <input type="hidden" name="lang" value="<?php echo $lang; ?>" />
153 <input type="hidden" name="convcharset" value="<?php echo $convcharset; ?>" />
154 <input type="submit" value="<?php echo $strGo; ?>" />
155 </form>
156 </td>
157 </tr>
158 </table>
159 <br />
160 <?php
161 } // end of the servers choice form
164 <!-- MySQL and phpMyAdmin related links -->
165 <table>
166 <tr>
168 <?php
170 * Displays the mysql server related links
172 $is_superuser = FALSE;
173 if ($server > 0) {
174 // Get user's global privileges ($dbh and $userlink are links to MySQL
175 // defined in the "common.lib.php3" library)
176 $is_create_priv = FALSE;
177 $is_process_priv = FALSE;
178 $is_reload_priv = FALSE;
179 $is_superuser = @PMA_mysql_query('USE mysql', $userlink);
180 if ($dbh) {
181 $local_query = 'SELECT Create_priv, Process_priv, Reload_priv FROM mysql.user WHERE User = \'' . PMA_sqlAddslashes($mysql_cur_user) . '\'';
182 $rs_usr = PMA_mysql_query($local_query, $dbh); // Debug: or PMA_mysqlDie('', $local_query, FALSE);
183 if ($rs_usr) {
184 while ($result_usr = PMA_mysql_fetch_array($rs_usr)) {
185 if (!$is_create_priv) {
186 $is_create_priv = ($result_usr['Create_priv'] == 'Y');
188 if (!$is_process_priv) {
189 $is_process_priv = ($result_usr['Process_priv'] == 'Y');
191 if (!$is_reload_priv) {
192 $is_reload_priv = ($result_usr['Reload_priv'] == 'Y');
194 } // end while
195 mysql_free_result($rs_usr);
196 } // end if
197 } // end if
199 // If the user has Create priv on a inexistant db, show him in the dialog
200 // the first inexistant db name that we find, in most cases it's probably
201 // the one he just dropped :)
202 if (!$is_create_priv) {
203 $local_query = 'SELECT DISTINCT Db FROM mysql.db WHERE Create_priv = \'Y\' AND User = \'' . PMA_sqlAddslashes($mysql_cur_user) . '\'';
204 $rs_usr = PMA_mysql_query($local_query, $dbh); // Debug: or PMA_mysqlDie('', $local_query, FALSE);
205 if ($rs_usr) {
206 $re0 = '(^|(\\\\\\\\)+|[^\])'; // non-escaped wildcards
207 $re1 = '(^|[^\])(\\\)+'; // escaped wildcards
208 while ($row = PMA_mysql_fetch_array($rs_usr)) {
209 if (ereg($re0 . '(%|_)', $row['Db'])
210 || (!PMA_mysql_select_db(ereg_replace($re1 . '(%|_)', '\\1\\3', $row['Db']), $userlink) && @mysql_errno() != 1044)) {
211 $db_to_create = ereg_replace($re0 . '%', '\\1...', ereg_replace($re0 . '_', '\\1?', $row['Db']));
212 $db_to_create = ereg_replace($re1 . '(%|_)', '\\1\\3', $db_to_create);
213 $is_create_priv = TRUE;
214 break;
215 } // end if
216 } // end while
217 mysql_free_result($rs_usr);
218 } // end if
219 else if (PMA_MYSQL_INT_VERSION >= 32304) {
220 // Finally, let's try to get the user's privileges by using SHOW
221 // GRANTS...
222 // Maybe we'll find a little CREATE priv there :)
223 $local_query = 'SHOW GRANTS FOR ' . $mysql_cur_user_and_host;
224 $rs_usr = PMA_mysql_query($local_query, $dbh);
225 if (!$rs_usr) {
226 // OK, now we'd have to guess the user's hostname, but we
227 // only try out the 'username'@'%' case.
228 $local_query = 'SHOW GRANTS FOR ' . $mysql_cur_user;
229 $rs_usr = PMA_mysql_query($local_query, $dbh);
231 if ($rs_usr) {
232 $re0 = '(^|(\\\\\\\\)+|[^\])'; // non-escaped wildcards
233 $re1 = '(^|[^\])(\\\)+'; // escaped wildcards
234 while ($row = PMA_mysql_fetch_row($rs_usr)) {
235 $show_grants_dbname = substr($row[0], strpos($row[0], ' ON ') + 4,(strpos($row[0], '.', strpos($row[0], ' ON ')) - strpos($row[0], ' ON ') - 4));
236 $show_grants_str = substr($row[0],6,(strpos($row[0],' ON ')-6));
237 if (($show_grants_str == 'ALL') || ($show_grants_str == 'ALL PRIVILEGES') || ($show_grants_str == 'CREATE') || strpos($show_grants_str, 'CREATE')) {
238 if ($show_grants_dbname == '*') {
239 $is_create_priv = TRUE;
240 $db_to_create = '';
241 break;
242 } // end if
243 else if (ereg($re0 . '%|_', $show_grants_dbname) || !PMA_mysql_select_db($show_grants_dbname, $userlink) && @mysql_errno() != 1044) {
244 $db_to_create = ereg_replace($re0 . '%', '\\1...', ereg_replace($re0 . '_', '\\1?', $show_grants_dbname));
245 $db_to_create = ereg_replace($re1 . '(%|_)', '\\1\\3', $db_to_create);
246 $is_create_priv = TRUE;
247 break;
248 } // end elseif
249 } // end if
250 } // end while
251 unset($show_grants_dbname);
252 unset($show_grants_str);
253 mysql_free_result($rs_usr);
254 } // end if
255 } // end elseif
256 } // end if
257 else {
258 $db_to_create = '';
259 } // end else
261 if (!$cfg['SuggestDBName']) {
262 $db_to_create = '';
265 $common_url_query = 'lang=' . $lang . '&amp;convcharset=' . $convcharset . '&amp;server=' . $server;
267 if ($is_superuser) {
268 $cfg['ShowMysqlInfo'] = TRUE;
269 $cfg['ShowMysqlVars'] = TRUE;
270 $cfg['ShowChgPassword'] = TRUE;
272 if ($cfg['Server']['auth_type'] == 'config') {
273 $cfg['ShowChgPassword'] = FALSE;
276 // loic1: Displays the MySQL column only if at least one feature has to be
277 // displayed
278 if ($is_superuser || $is_create_priv || $is_process_priv || $is_reload_priv
279 || $cfg['ShowMysqlInfo'] || $cfg['ShowMysqlVars'] || $cfg['ShowChgPassword']
280 || $cfg['Server']['auth_type'] != 'config') {
282 <!-- MySQL server related links -->
283 <td valign="top" align="<?php echo $cell_align_left; ?>">
284 <table>
285 <tr>
286 <th colspan="2">&nbsp;&nbsp;MySQL</th>
287 </tr>
288 <?php
289 // The user is allowed to create a db
290 if ($is_create_priv) {
291 echo "\n";
293 <!-- db creation form -->
294 <tr>
295 <td valign="baseline"><img src="<?php echo $item_img; ?>" width="7" height="7" alt="item" /></td>
296 <td>
297 <form method="post" action="db_create.php3">
298 <?php echo $strCreateNewDatabase . '&nbsp;' . PMA_showMySQLDocu('Reference', 'CREATE_DATABASE'); ?><br />
299 <input type="hidden" name="server" value="<?php echo $server; ?>" />
300 <input type="hidden" name="lang" value="<?php echo $lang; ?>" />
301 <input type="hidden" name="convcharset" value="<?php echo $convcharset; ?>" />
302 <input type="hidden" name="reload" value="1" />
303 <input type="text" name="db" value="<?php echo $db_to_create; ?>" maxlength="64" class="textfield" />
304 <input type="submit" value="<?php echo $strCreate; ?>" />
305 </form>
306 </td>
307 </tr>
308 <?php
309 } // end create db form
310 echo "\n";
312 // Server related links
314 <!-- server-related links -->
315 <?php
316 if ($cfg['ShowMysqlInfo']) {
317 echo "\n";
319 <tr>
320 <td valign="baseline"><img src="<?php echo $item_img; ?>" width="7" height="7" alt="item" /></td>
321 <td>
322 <a href="sql.php3?<?php echo $common_url_query; ?>&amp;db=mysql&amp;sql_query=<?php echo urlencode('SHOW STATUS'); ?>&amp;goto=main.php3">
323 <?php echo $strMySQLShowStatus; ?></a>&nbsp;
324 <?php echo PMA_showMySQLDocu('MySQL_Database_Administration', 'SHOW_STATUS') . "\n"; ?>
325 </td>
326 </tr>
327 <?php
328 } // end if
329 if ($cfg['ShowMysqlVars']) {
330 echo "\n";
332 <tr>
333 <td valign="baseline"><img src="<?php echo $item_img; ?>" width="7" height="7" alt="item" /></td>
334 <td>
335 <a href="sql.php3?<?php echo $common_url_query; ?>&amp;db=mysql&amp;sql_query=<?php echo urlencode('SHOW VARIABLES'); ?>&amp;goto=main.php3">
336 <?php echo $strMySQLShowVars;?></a>&nbsp;
337 <?php echo PMA_showMySQLDocu('MySQL_Database_Administration', 'SHOW_VARIABLES') . "\n"; ?>
338 </td>
339 </tr>
340 <?php
343 if ($is_process_priv) {
344 echo "\n";
346 <tr>
347 <td valign="baseline"><img src="<?php echo $item_img; ?>" width="7" height="7" alt="item" /></td>
348 <td>
349 <a href="sql.php3?<?php echo $common_url_query; ?>&amp;db=mysql&amp;sql_query=<?php echo urlencode('SHOW PROCESSLIST'); ?>&amp;goto=main.php3">
350 <?php echo $strMySQLShowProcess; ?></a>&nbsp;
351 <?php echo PMA_showMySQLDocu('MySQL_Database_Administration', 'SHOW_PROCESSLIST') . "\n"; ?>
352 </td>
353 </tr>
354 <?php
355 } // end if
357 if ($is_reload_priv) {
358 echo "\n";
360 <tr>
361 <td valign="baseline"><img src="<?php echo $item_img; ?>" width="7" height="7" alt="item" /></td>
362 <td>
363 <a href="main.php3?<?php echo $common_url_query; ?>&amp;mode=reload">
364 <?php echo $strReloadMySQL; ?></a>&nbsp;
365 <?php echo PMA_showMySQLDocu('MySQL_Database_Administration', 'FLUSH') . "\n"; ?>
366 </td>
367 </tr>
368 <?php
371 if ($is_superuser) {
372 echo "\n";
374 <tr>
375 <td valign="baseline"><img src="<?php echo $item_img; ?>" width="7" height="7" alt="item" /></td>
376 <td>
377 <a href="user_details.php3?<?php echo $common_url_query; ?>&amp;db=mysql&amp;table=user">
378 <?php echo $strUsers; ?></a>&nbsp;
379 <?php echo PMA_showMySQLDocu('MySQL_Database_Administration', 'Privilege_system') . "\n"; ?>
380 </td>
381 </tr>
382 <?php
383 if (PMA_MYSQL_INT_VERSION >= 32303) {
384 echo "\n";
386 <tr>
387 <td valign="baseline"><img src="<?php echo $item_img; ?>" width="7" height="7" alt="item" /></td>
388 <td>
389 <a href="db_stats.php3?<?php echo $common_url_query; ?>">
390 <?php echo $strDatabasesStats; ?></a>
391 </td>
392 </tr>
393 <?php
397 // Change password (needs another message)
398 if ($cfg['ShowChgPassword']) {
399 echo "\n";
401 <tr>
402 <td valign="baseline"><img src="<?php echo $item_img; ?>" width="7" height="7" alt="item" /></td>
403 <td>
404 <a href="user_password.php3?<?php echo $common_url_query; ?>">
405 <?php echo ($strChangePassword); ?></a>
406 </td>
407 </tr>
408 <?php
409 } // end if
411 // Logout for advanced authentication
412 if ($cfg['Server']['auth_type'] != 'config') {
413 $http_logout = ($cfg['Server']['auth_type'] == 'http')
414 ? "\n" . ' <a href="./Documentation.html#login_bug" target="documentation">(*)</a>'
415 : '';
416 echo "\n";
418 <tr>
419 <td valign="baseline"><img src="<?php echo $item_img; ?>" width="7" height="7" alt="item" /></td>
420 <td>
421 <a href="index.php3?<?php echo $common_url_query; ?>&amp;old_usr=<?php echo urlencode($PHP_AUTH_USER); ?>" target="_parent">
422 <b><?php echo $strLogout; ?></b></a>&nbsp;<?php echo $http_logout . "\n"; ?>
423 </td>
424 </tr>
425 <?php
426 } // end if
427 echo "\n";
429 </table>
430 </td>
432 <td>&nbsp;&nbsp;&nbsp;&nbsp;</td>
433 <?php
434 } // end if
435 } // end of if ($server > 0)
436 echo "\n";
440 * Displays the phpMyAdmin related links
444 <!-- phpMyAdmin related links -->
445 <td valign="top" align="<?php echo $cell_align_left; ?>">
446 <table>
447 <tr>
448 <th colspan="2">&nbsp;&nbsp;phpMyAdmin</th>
449 </tr>
451 <?php
452 // Displays language selection combo
453 if (empty($cfg['Lang'])) {
455 <!-- Language Selection -->
456 <tr>
457 <td valign="baseline"><img src="<?php echo $item_img; ?>" width="7" height="7" alt="item" /></td>
458 <td nowrap="nowrap">
459 <form method="post" action="index.php3" target="_parent">
460 <input type="hidden" name="convcharset" value="<?php echo $convcharset; ?>" />
461 <input type="hidden" name="server" value="<?php echo $server; ?>" />
462 Language <a href="./translators.html" target="documentation">(*)</a>:
463 <select name="lang" dir="ltr" onchange="this.form.submit();">
464 <?php
465 echo "\n";
468 * Sorts available languages by their true names
470 * @param array the array to be sorted
471 * @param mixed a required parameter
473 * @return the sorted array
475 * @access private
477 function PMA_cmp(&$a, $b)
479 return (strcmp($a[1], $b[1]));
480 } // end of the 'PMA_cmp()' function
482 uasort($available_languages, 'PMA_cmp');
483 reset($available_languages);
484 while (list($id, $tmplang) = each($available_languages)) {
485 $lang_name = ucfirst(substr(strstr($tmplang[0], '|'), 1));
486 if ($lang == $id) {
487 $selected = ' selected="selected"';
488 } else {
489 $selected = '';
491 echo ' ';
492 echo '<option value="' . $id . '"' . $selected . '>' . $lang_name . ' (' . $id . ')</option>' . "\n";
495 </select>
496 <noscript><input type="submit" value="Go" /></noscript>
497 </form>
498 </td>
499 </tr>
500 <?php
503 if (isset($cfg['AllowAnywhereRecoding']) && $cfg['AllowAnywhereRecoding']
504 && $allow_recoding) {
505 echo "\n";
507 <!-- Charset Selection -->
508 <tr>
509 <td valign="baseline"><img src="<?php echo $item_img; ?>" width="7" height="7" alt="item" /></td>
510 <td nowrap="nowrap">
511 <form method="post" action="index.php3" target="_parent">
512 <input type="hidden" name="server" value="<?php echo $server; ?>" />
513 <input type="hidden" name="lang" value="<?php echo $lang; ?>" />
514 <?php echo $strMySQLCharset;?>:
515 <select name="convcharset" dir="ltr" onchange="this.form.submit();">
516 <?php
517 echo "\n";
518 reset($cfg['AvailableCharsets']);
519 while (list($id, $tmpcharset) = each($cfg['AvailableCharsets'])) {
520 if ($convcharset == $tmpcharset) {
521 $selected = ' selected="selected"';
522 } else {
523 $selected = '';
525 echo ' ';
526 echo '<option value="' . $tmpcharset . '"' . $selected . '>' . $tmpcharset . '</option>' . "\n";
529 </select>
530 <noscript><input type="submit" value="Go" /></noscript>
531 </form>
532 </td>
533 </tr>
534 <?php
536 echo "\n";
539 <!-- Documentation -->
540 <tr>
541 <td valign="baseline"><img src="<?php echo $item_img; ?>" width="7" height="7" alt="item" /></td>
542 <td>
543 <a href="Documentation.html" target="documentation"><b><?php echo $strPmaDocumentation; ?></b></a>
544 </td>
545 </tr>
547 <?php
548 if ($is_superuser || $cfg['ShowPhpInfo']) {
550 <!-- PHP Information -->
551 <tr>
552 <td valign="baseline"><img src="<?php echo $item_img; ?>" width="7" height="7" alt="item" /></td>
553 <td>
554 <a href="phpinfo.php3" target="_new"><?php echo $strShowPHPInfo; ?></a>
555 </td>
556 </tr>
557 <?php
559 echo "\n";
562 <!-- phpMyAdmin related urls -->
563 <tr>
564 <td valign="baseline"><img src="<?php echo $item_img; ?>" width="7" height="7" alt="item" /></td>
565 <td>
566 <a href="http://www.phpMyAdmin.net/" target="_new"><?php echo $strHomepageOfficial; ?></a><br />
567 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[<a href="ChangeLog" target="_new">ChangeLog</a>]
568 &nbsp;&nbsp;&nbsp;[<a href="http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/phpmyadmin/phpMyAdmin/" target="_new">CVS</a>]
569 &nbsp;&nbsp;&nbsp;[<a href="http://sourceforge.net/mail/?group_id=23067" target="_new">Lists</a>]
570 </td>
571 </tr>
572 </table>
573 </td>
575 </tr>
576 </table>
579 <?php
581 * Displays the "empty $cfg['PmaAbsoluteUri'] warning"
583 if ($display_pmaAbsoluteUri_warning) {
584 echo '<p class="warning">' . $strPmaUriError . '</p>' . "\n";
588 * Warning if using the default MySQL privileged account
590 if ($server != 0
591 && $cfg['Server']['auth_type'] == 'config'
592 && $cfg['Server']['user'] == 'root'
593 && $cfg['Server']['password'] == '') {
594 echo '<p class="warning">' . $strInsecureMySQL . '</p>' . "\n";
598 * Displays the footer
600 echo "\n";
601 require('./footer.inc.php3');