Protect against php code input from user (bug #1530370).
[phpmyadmin/crack.git] / server_databases.php
blob6a6e69b0c99d215bccef2a0e1f6302a63dcb2c6e
1 <?php
2 /* $Id$ */
3 // vim: expandtab sw=4 ts=4 sts=4:
5 /**
6 * Does the common work
7 */
8 require_once './libraries/common.lib.php';
11 $js_to_run = 'functions.js';
12 require './libraries/server_common.inc.php';
14 /**
15 * avoids 'undefined index' errors
17 if (empty($_REQUEST['sort_by'])) {
18 $sort_by = 'SCHEMA_NAME';
19 } else {
20 $sort_by = PMA_sanitize($_REQUEST['sort_by']);
23 if (isset($_REQUEST['sort_order'])
24 && strtolower($_REQUEST['sort_order']) == 'desc') {
25 $sort_order = 'desc';
26 } else {
27 $sort_order = 'asc';
30 $dbstats = empty($_REQUEST['dbstats']) ? 0 : 1;
31 $pos = empty($_REQUEST['pos']) ? 0 : (int) $_REQUEST['pos'];
34 /**
35 * Drops multiple databases
38 // workaround for IE behavior (it returns some coordinates based on where
39 // the mouse was on the Drop image):
40 if (isset($_REQUEST['drop_selected_dbs_x'])) {
41 $_REQUEST['drop_selected_dbs'] = true;
44 if ((isset($_REQUEST['drop_selected_dbs']) || isset($_REQUEST['query_type']))
45 && ($is_superuser || $cfg['AllowUserDropDatabase'])) {
46 if (! isset($_REQUEST['selected_dbs']) && ! isset($_REQUEST['query_type'])) {
47 $message = $strNoDatabasesSelected;
48 } else {
49 $action = 'server_databases.php';
50 $submit_mult = 'drop_db' ;
51 $err_url = 'server_databases.php?' . PMA_generate_common_url();
52 if (isset($_REQUEST['selected_dbs'])) {
53 $selected_db = $_REQUEST['selected_dbs'];
55 require './libraries/mult_submits.inc.php';
56 unset($action, $submit_mult, $err_url, $selected_db);
57 if ($mult_btn == $strYes) {
58 $message = sprintf($strDatabasesDropped, count($selected));
59 } else {
60 $message = sprintf($strDatabasesDropped, 0);
65 /**
66 * Displays the links
68 require './libraries/server_links.inc.php';
71 /**
72 * Displays the sub-page heading
74 echo '<h2>' . "\n"
75 . ( $GLOBALS['cfg']['MainPageIconic']
76 ? '<img class="icon" src="' . $pmaThemeImage . 's_db.png" width="16"'
77 .' height="16" alt="" />'
78 : '' )
79 . ( $dbstats ? $strDatabasesStats : $strDatabases ) . "\n"
80 .'</h2>' . "\n";
82 /**
83 * Gets the databases list
85 if ($server > 0) {
86 $databases = PMA_DBI_get_databases_full(null, $dbstats, null, $sort_by,
87 $sort_order, $pos, true);
88 $databases_count = PMA_DBI_get_databases_count();
89 } else {
90 $databases_count = 0;
94 /**
95 * Displays the page
97 if ($databases_count > 0) {
98 reset($databases);
99 $first_database = current($databases);
101 // table col order
102 // there is no db specific collation or charset prior 4.1.0
103 if (PMA_MYSQL_INT_VERSION >= 40100) {
104 $column_order['DEFAULT_COLLATION_NAME'] = array(
105 'disp_name' => $strCollation,
106 'description_function' => 'PMA_getCollationDescr',
107 'format' => 'string',
108 'footer' => PMA_getServerCollation(),
111 $column_order['SCHEMA_TABLES'] = array(
112 'disp_name' => $strNumTables,
113 'format' => 'number',
114 'footer' => 0,
116 $column_order['SCHEMA_TABLE_ROWS'] = array(
117 'disp_name' => $strRows,
118 'format' => 'number',
119 'footer' => 0,
121 $column_order['SCHEMA_DATA_LENGTH'] = array(
122 'disp_name' => $strData,
123 'format' => 'byte',
124 'footer' => 0,
126 $column_order['SCHEMA_INDEX_LENGTH'] = array(
127 'disp_name' => $strIndexes,
128 'format' => 'byte',
129 'footer' => 0,
131 $column_order['SCHEMA_LENGTH'] = array(
132 'disp_name' => $strTotalUC,
133 'format' => 'byte',
134 'footer' => 0,
136 $column_order['SCHEMA_DATA_FREE'] = array(
137 'disp_name' => $strOverhead,
138 'format' => 'byte',
139 'footer' => 0,
142 $_url_params = array(
143 'pos' => $pos,
144 'dbstats' => $dbstats,
145 'sort_by' => $sort_by,
146 'sort_order' => $sort_order,
149 if ($GLOBALS['cfg']['MaxDbList']
150 && $GLOBALS['cfg']['MaxDbList'] < $databases_count) {
151 // Move to the beginning or to the previous page
152 if ($pos > 0) {
153 // loic1: patch #474210 from Gosha Sakovich - part 1
154 if ($GLOBALS['cfg']['NavigationBarIconic']) {
155 $caption1 = '&lt;&lt;';
156 $caption2 = ' &lt; ';
157 $title1 = ' title="' . $GLOBALS['strPos1'] . '"';
158 $title2 = ' title="' . $GLOBALS['strPrevious'] . '"';
159 } else {
160 $caption1 = $GLOBALS['strPos1'] . ' &lt;&lt;';
161 $caption2 = $GLOBALS['strPrevious'] . ' &lt;';
162 $title1 = '';
163 $title2 = '';
164 } // end if... else...
165 $_url_params['pos'] = 0;
166 echo '<a' . $title1 . 'href="server_databases.php'
167 . PMA_generate_common_url($_url_params) . '">'
168 . $caption1 . '</a>';
169 $_url_params['pos'] = $pos - $GLOBALS['cfg']['MaxDbList'];
170 echo '<a' . $title2 . 'href="server_databases.php'
171 . PMA_generate_common_url($_url_params) . '">'
172 . $caption2 . '</a>';
175 echo '<form action="./server_databases.php" method="post">' . "\n";
176 echo PMA_generate_common_hidden_inputs($_url_params);
177 echo PMA_pageselector(
178 'server_databases.php' . PMA_generate_common_url($_url_params) . '&',
179 $GLOBALS['cfg']['MaxDbList'],
180 floor(($pos + 1) / $GLOBALS['cfg']['MaxDbList']) + 1,
181 ceil($databases_count / $GLOBALS['cfg']['MaxDbList']));
182 echo '</form>';
184 if ($pos + $GLOBALS['cfg']['MaxDbList'] < $databases_count) {
185 if ($GLOBALS['cfg']['NavigationBarIconic']) {
186 $caption3 = ' &gt; ';
187 $caption4 = '&gt;&gt;';
188 $title3 = ' title="' . $GLOBALS['strNext'] . '"';
189 $title4 = ' title="' . $GLOBALS['strEnd'] . '"';
190 } else {
191 $caption3 = '&gt; ' . $GLOBALS['strNext'];
192 $caption4 = '&gt;&gt; ' . $GLOBALS['strEnd'];
193 $title3 = '';
194 $title4 = '';
195 } // end if... else...
196 $_url_params['pos'] = $pos + $GLOBALS['cfg']['MaxDbList'];
197 echo '<a' . $title3 . 'href="server_databases.php'
198 . PMA_generate_common_url($_url_params) . '">'
199 . $caption3 . '</a>';
200 $_url_params['pos'] = floor($databases_count / $GLOBALS['cfg']['MaxDbList']) * $GLOBALS['cfg']['MaxDbList'];
201 echo '<a' . $title4 . 'href="server_databases.php'
202 . PMA_generate_common_url($_url_params) . '">'
203 . $caption4 . '</a>';
207 $_url_params['pos'] = $pos;
209 echo '<form action="./server_databases.php" method="post" name="dbStatsForm" id="dbStatsForm">' . "\n"
210 . PMA_generate_common_hidden_inputs($_url_params);
212 $_url_params['sort_by'] = 'SCHEMA_NAME';
213 $_url_params['sort_order'] = ($sort_by == 'SCHEMA_NAME' && $sort_order == 'asc') ? 'desc' : 'asc';
215 echo '<table id="tabledatabases" class="data">' . "\n"
216 . '<thead>' . "\n"
217 . '<tr>' . "\n"
218 . ($is_superuser || $cfg['AllowUserDropDatabase'] ? ' <th>&nbsp;</th>' . "\n" : '')
219 . ' <th><a href="./server_databases.php' . PMA_generate_common_url($_url_params) . '">' . "\n"
220 . ' ' . $strDatabase . "\n"
221 . ($sort_by == 'SCHEMA_NAME' ? ' <img class="icon" src="' . $pmaThemeImage . 's_' . $sort_order . '.png" width="11" height="9" alt="' . ($sort_order == 'asc' ? $strAscending : $strDescending) . '" />' . "\n" : '')
222 . ' </a></th>' . "\n";
223 $table_columns = 3;
224 foreach ( $column_order as $stat_name => $stat ) {
225 if ( array_key_exists( $stat_name, $first_database ) ) {
226 if ( $stat['format'] === 'byte' ) {
227 $table_columns += 2;
228 $colspan = ' colspan="2"';
229 } else {
230 $table_columns++;
231 $colspan = '';
233 $_url_params['sort_by'] = $stat_name;
234 $_url_params['sort_order'] = ($sort_by == $stat_name && $sort_order == 'desc') ? 'asc' : 'desc';
235 echo ' <th' . $colspan . '>'
236 .'<a href="./server_databases.php' . PMA_generate_common_url($_url_params) . '">' . "\n"
237 .' ' . $stat['disp_name'] . "\n"
238 .($sort_by == $stat_name ? ' <img class="icon" src="' . $pmaThemeImage . 's_' . $sort_order . '.png" width="11" height="9" alt="' . ($sort_order == 'asc' ? $strAscending : $strDescending) . '" />' . "\n" : '')
239 .' </a></th>' . "\n";
242 if ($is_superuser) {
243 echo ' <th>' . ($cfg['PropertiesIconic'] ? '&nbsp;' : $strAction ) . "\n"
244 . ' </th>' . "\n";
246 echo '</tr>' . "\n"
247 . '</thead>' . "\n"
248 . '<tbody>' . "\n";
250 $odd_row = true;
251 foreach ($databases as $current) {
252 echo '<tr class="' . ( $odd_row ? 'odd' : 'even' ) . '">' . "\n";
253 $odd_row = ! $odd_row;
255 if ( $is_superuser || $cfg['AllowUserDropDatabase'] ) {
256 echo ' <td class="tool">' . "\n";
257 if ($current['SCHEMA_NAME'] != 'mysql' && (PMA_MYSQL_INT_VERSION < 50002 || $current['SCHEMA_NAME'] != 'information_schema')) {
258 echo ' <input type="checkbox" name="selected_dbs[]" title="' . htmlspecialchars($current['SCHEMA_NAME']) . '" value="' . htmlspecialchars($current['SCHEMA_NAME']) . '" ' . (empty($checkall) ? '' : 'checked="checked" ') . '/>' . "\n";
259 } else {
260 echo ' <input type="checkbox" name="selected_dbs[]" title="' . htmlspecialchars($current['SCHEMA_NAME']) . '" value="' . htmlspecialchars($current['SCHEMA_NAME']) . '" disabled="disabled"/>' . "\n";
262 echo ' </td>' . "\n";
264 echo ' <td class="name">' . "\n"
265 . ' <a onclick="if ( window.parent.openDb(\'' . urlencode($current['SCHEMA_NAME']) . '\') ) return false;" href="index.php?' . $url_query . '&amp;db=' . urlencode($current['SCHEMA_NAME']) . '" title="' . sprintf($strJumpToDB, htmlspecialchars($current['SCHEMA_NAME'])) . '" target="_parent">' . "\n"
266 . ' ' . htmlspecialchars($current['SCHEMA_NAME']) . "\n"
267 . ' </a>' . "\n"
268 . ' </td>' . "\n";
270 foreach ( $column_order as $stat_name => $stat ) {
271 if ( array_key_exists( $stat_name, $current ) ) {
272 if ( is_numeric( $stat['footer'] ) ) {
273 $column_order[$stat_name]['footer'] += $current[$stat_name];
275 if ( $stat['format'] === 'byte' ) {
276 list( $value, $unit ) = PMA_formatByteDown( $current[$stat_name], 3, 1 );
277 } elseif ( $stat['format'] === 'number' ) {
278 $value = PMA_formatNumber( $current[$stat_name], 0 );
279 } else {
280 $value = htmlentities( $current[$stat_name], 0 );
282 echo ' <td class="value">';
283 if ( isset( $stat['description_function'] ) ) {
284 echo '<dfn title="' . $stat['description_function']( $current[$stat_name] ) . '">';
286 echo $value;
287 if ( isset( $stat['description_function'] ) ) {
288 echo '</dfn>';
290 echo '</td>' . "\n";
291 if ( $stat['format'] === 'byte' ) {
292 echo ' <td class="unit">' . $unit . '</td>' . "\n";
297 if ($is_superuser) {
298 echo ' <td class="tool">' . "\n"
299 . ' <a onclick="window.parent.setDb(\'' . urlencode($current['SCHEMA_NAME']) . '\');" href="./server_privileges.php?' . $url_query . '&amp;checkprivs=' . urlencode($current['SCHEMA_NAME']) . '" title="' . sprintf($strCheckPrivsLong, htmlspecialchars($current['SCHEMA_NAME'])) . '">'. "\n"
300 . ' ' .($cfg['PropertiesIconic'] ? '<img class="icon" src="' . $pmaThemeImage . 's_rights.png" width="16" height="16" alt=" ' .$strCheckPrivs . '" /> ' : $strCheckPrivs ). "\n"
301 . ' </a></td>' . "\n";
303 echo '</tr>' . "\n";
304 } // end foreach ( $databases as $key => $current )
305 unset($current, $odd_row);
307 echo '<tr>' . "\n";
308 if ( $is_superuser || $cfg['AllowUserDropDatabase'] ) {
309 echo ' <th>&nbsp;</th>' . "\n";
311 echo ' <th>' . $strTotalUC . ': ' . $databases_count . '</th>' . "\n";
312 foreach ( $column_order as $stat_name => $stat ) {
313 if ( array_key_exists( $stat_name, $first_database ) ) {
314 if ( $stat['format'] === 'byte' ) {
315 list( $value, $unit ) = PMA_formatByteDown( $stat['footer'], 3, 1 );
316 } elseif ( $stat['format'] === 'number' ) {
317 $value = PMA_formatNumber( $stat['footer'], 0 );
318 } else {
319 $value = htmlentities( $stat['footer'], 0 );
321 echo ' <th class="value">';
322 if ( isset( $stat['description_function'] ) ) {
323 echo '<dfn title="' . $stat['description_function']( $stat['footer'] ) . '">';
325 echo $value;
326 if ( isset( $stat['description_function'] ) ) {
327 echo '</dfn>';
329 echo '</th>' . "\n";
330 if ( $stat['format'] === 'byte' ) {
331 echo ' <th class="unit">' . $unit . '</th>' . "\n";
335 if ( $is_superuser ) {
336 echo ' <th>&nbsp;</th>' . "\n";
338 echo '</tr>' . "\n";
339 echo '</tbody>' . "\n"
340 .'</table>' . "\n";
341 unset($column_order, $stat_name, $stat, $databases, $table_columns);
343 if ($is_superuser || $cfg['AllowUserDropDatabase']) {
344 $common_url_query = PMA_generate_common_url() . '&amp;sort_by=' . $sort_by . '&amp;sort_order=' . $sort_order . '&amp;dbstats=' . $dbstats;
345 echo '<img class="selectallarrow" src="' . $pmaThemeImage . 'arrow_' . $text_dir . '.png" width="38" height="22" alt="' . $strWithChecked . '" />' . "\n"
346 . '<a href="./server_databases.php?' . $common_url_query . '&amp;checkall=1" onclick="if ( markAllRows(\'tabledatabases\') ) return false;">' . "\n"
347 . ' ' . $strCheckAll . '</a> / ' . "\n"
348 . '<a href="./server_databases.php?' . $common_url_query . '" onclick="if ( unMarkAllRows(\'tabledatabases\') ) return false;">' . "\n"
349 . ' ' . $strUncheckAll . '</a>' . "\n"
350 . '<i>' . $strWithChecked . '</i>' . "\n";
351 PMA_buttonOrImage( 'drop_selected_dbs', 'mult_submit', 'drop_selected_dbs', $strDrop, 'b_deltbl.png' );
354 echo '<ul><li id="li_switch_dbstats"><strong>' . "\n";
355 if ( empty( $dbstats ) ) {
356 echo ' <a href="./server_databases.php?' . $url_query . '&amp;dbstats=1"'
357 .' title="' . $strDatabasesStatsEnable . '">' . "\n"
358 .' ' . $strDatabasesStatsEnable;
359 } else {
360 echo ' <a href="./server_databases.php?' . $url_query . '"'
361 .' title="' . $strDatabasesStatsDisable . '">' . "\n"
362 .' ' . $strDatabasesStatsDisable;
364 echo '</a></strong><br />' . "\n"
365 .' <div class="warning">'
366 . $strDatabasesStatsHeavyTraffic . '</div></li>' . "\n"
367 .'</ul>' . "\n";
368 echo '</form>';
369 } else {
370 echo $strNoDatabases;
372 unset($databases_count);
375 * Create new database.
377 echo '<ul><li id="li_create_database">' . "\n";
378 require './libraries/display_create_database.lib.php';
379 echo ' </li>' . "\n";
380 echo '</ul>' . "\n";
383 * Sends the footer
385 require_once './libraries/footer.inc.php';