libraries/common.inc.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * Misc stuff and REQUIRED by ALL the scripts.
   5  * MUST be included by every script
   6  *
   7  * Among other things, it contains the advanced authentication work.
   8  *
   9  * Order of sections for common.inc.php:
  10  *
  11  * the authentication libraries must be before the connection to db
  12  *
  13  * ... so the required order is:
  14  *
  15  * LABEL_variables_init
  16  *  - initialize some variables always needed
  17  * LABEL_parsing_config_file
  18  *  - parsing of the configuration file
  19  * LABEL_loading_language_file
  20  *  - loading language file
  21  * LABEL_setup_servers
  22  *  - check and setup configured servers
  23  * LABEL_theme_setup
  24  *  - setting up themes
  25  *
  26  * - load of MySQL extension (if necessary)
  27  * - loading of an authentication library
  28  * - db connection
  29  * - authentication work
  30  *
  31  * @package PhpMyAdmin
  32  */
  33
  34 /**
  35  * Minimum PHP version; can't call PMA_fatalError() which uses a
  36  * PHP 5 function, so cannot easily localize this message.
  37  */
  38 if (version_compare(PHP_VERSION, '5.2.0', 'lt')) {
  39     die('PHP 5.2+ is required');
  40 }
  41
  42 /**
  43   * Backward compatibility for PHP 5.2
  44   */
  45 if (!defined('E_DEPRECATED')) {
  46     define('E_DEPRECATED', 8192);
  47 }
  48
  49 /**
  50  * the error handler
  51  */
  52 require './libraries/Error_Handler.class.php';
  53
  54 /**
  55  * initialize the error handler
  56  */
  57 $GLOBALS['error_handler'] = new PMA_Error_Handler();
  58 $cfg['Error_Handler']['display'] = true;
  59
  60 /*
  61  * This setting was removed in PHP 5.3. But at this point PMA_PHP_INT_VERSION
  62  * is not yet defined so we use another way to find out the PHP version.
  63  */
  64 if (version_compare(phpversion(), '5.3', 'lt')) {
  65     /**
  66      * Avoid object cloning errors
  67      */
  68     @ini_set('zend.ze1_compatibility_mode', false);
  69 }
  70
  71 /**
  72  * This setting was removed in PHP 5.4. But at this point PMA_PHP_INT_VERSION
  73  * is not yet defined so we use another way to find out the PHP version.
  74  */
  75 if (version_compare(phpversion(), '5.4', 'lt')) {
  76     /**
  77      * Avoid problems with magic_quotes_runtime
  78      */
  79     @ini_set('magic_quotes_runtime', false);
  80 }
  81
  82 /**
  83  * for verification in all procedural scripts under libraries
  84  */
  85 define('PHPMYADMIN', true);
  86
  87 /**
  88  * core functions
  89  */
  90 require './libraries/core.lib.php';
  91
  92 /**
  93  * Input sanitizing
  94  */
  95 require './libraries/sanitizing.lib.php';
  96
  97 /**
  98  * the PMA_Theme class
  99  */
 100 require './libraries/Theme.class.php';
 101
 102 /**
 103  * the PMA_Theme_Manager class
 104  */
 105 require './libraries/Theme_Manager.class.php';
 106
 107 /**
 108  * the PMA_Config class
 109  */
 110 require './libraries/Config.class.php';
 111
 112 /**
 113  * the relation lib, tracker needs it
 114  */
 115 require './libraries/relation.lib.php';
 116
 117 /**
 118  * the PMA_Tracker class
 119  */
 120 require './libraries/Tracker.class.php';
 121
 122 /**
 123  * the PMA_Table class
 124  */
 125 require './libraries/Table.class.php';
 126
 127 if (!defined('PMA_MINIMUM_COMMON')) {
 128     /**
 129      * common functions
 130      */
 131     include_once './libraries/common.lib.php';
 132
 133     /**
 134      * Java script escaping.
 135      */
 136     include_once './libraries/js_escape.lib.php';
 137
 138     /**
 139      * Include URL/hidden inputs generating.
 140      */
 141     include_once './libraries/url_generating.lib.php';
 142 }
 143
 144 /******************************************************************************/
 145 /* start procedural code                       label_start_procedural         */
 146
 147 /**
 148  * protect against possible exploits - there is no need to have so much variables
 149  */
 150 if (count($_REQUEST) > 1000) {
 151     die(__('possible exploit'));
 152 }
 153
 154 /**
 155  * Check for numeric keys
 156  * (if register_globals is on, numeric key can be found in $GLOBALS)
 157  */
 158 foreach ($GLOBALS as $key => $dummy) {
 159     if (is_numeric($key)) {
 160         die(__('numeric key detected'));
 161     }
 162 }
 163 unset($dummy);
 164
 165 /**
 166  * PATH_INFO could be compromised if set, so remove it from PHP_SELF
 167  * and provide a clean PHP_SELF here
 168  */
 169 $PMA_PHP_SELF = PMA_getenv('PHP_SELF');
 170 $_PATH_INFO = PMA_getenv('PATH_INFO');
 171 if (! empty($_PATH_INFO) && ! empty($PMA_PHP_SELF)) {
 172     $path_info_pos = strrpos($PMA_PHP_SELF, $_PATH_INFO);
 173     if ($path_info_pos + strlen($_PATH_INFO) === strlen($PMA_PHP_SELF)) {
 174         $PMA_PHP_SELF = substr($PMA_PHP_SELF, 0, $path_info_pos);
 175     }
 176 }
 177 $PMA_PHP_SELF = htmlspecialchars($PMA_PHP_SELF);
 178
 179
 180 /**
 181  * just to be sure there was no import (registering) before here
 182  * we empty the global space (but avoid unsetting $variables_list
 183  * and $key in the foreach (), we still need them!)
 184  */
 185 $variables_whitelist = array (
 186     'GLOBALS',
 187     '_SERVER',
 188     '_GET',
 189     '_POST',
 190     '_REQUEST',
 191     '_FILES',
 192     '_ENV',
 193     '_COOKIE',
 194     '_SESSION',
 195     'error_handler',
 196     'PMA_PHP_SELF',
 197     'variables_whitelist',
 198     'key'
 199 );
 200
 201 foreach (get_defined_vars() as $key => $value) {
 202     if (! in_array($key, $variables_whitelist)) {
 203         unset($$key);
 204     }
 205 }
 206 unset($key, $value, $variables_whitelist);
 207
 208
 209 /**
 210  * Subforms - some functions need to be called by form, cause of the limited URL
 211  * length, but if this functions inside another form you cannot just open a new
 212  * form - so phpMyAdmin uses 'arrays' inside this form
 213  *
 214  * <code>
 215  * <form ...>
 216  * ... main form elments ...
 217  * <input type="hidden" name="subform[action1][id]" value="1" />
 218  * ... other subform data ...
 219  * <input type="submit" name="usesubform[action1]" value="do action1" />
 220  * ... other subforms ...
 221  * <input type="hidden" name="subform[actionX][id]" value="X" />
 222  * ... other subform data ...
 223  * <input type="submit" name="usesubform[actionX]" value="do actionX" />
 224  * ... main form elments ...
 225  * <input type="submit" name="main_action" value="submit form" />
 226  * </form>
 227  * </code>
 228  *
 229  * so we now check if a subform is submitted
 230  */
 231 $__redirect = null;
 232 if (isset($_POST['usesubform'])) {
 233     // if a subform is present and should be used
 234     // the rest of the form is deprecated
 235     $subform_id = key($_POST['usesubform']);
 236     $subform    = $_POST['subform'][$subform_id];
 237     $_POST      = $subform;
 238     $_REQUEST   = $subform;
 239     /**
 240      * some subforms need another page than the main form, so we will just
 241      * include this page at the end of this script - we use $__redirect to
 242      * track this
 243      */
 244     if (isset($_POST['redirect'])
 245       && $_POST['redirect'] != basename($PMA_PHP_SELF)) {
 246         $__redirect = $_POST['redirect'];
 247         unset($_POST['redirect']);
 248     }
 249     unset($subform_id, $subform);
 250 } else {
 251     // Note: here we overwrite $_REQUEST so that it does not contain cookies,
 252     // because another application for the same domain could have set
 253     // a cookie (with a compatible path) that overrides a variable
 254     // we expect from GET or POST.
 255     // We'll refer to cookies explicitly with the $_COOKIE syntax.
 256     $_REQUEST = array_merge($_GET, $_POST);
 257 }
 258 // end check if a subform is submitted
 259
 260 /**
 261  * This setting was removed in PHP 5.4. But at this point PMA_PHP_INT_VERSION
 262  * is not yet defined so we use another way to find out the PHP version.
 263  */
 264 if (version_compare(phpversion(), '5.4', 'lt')) {
 265     // remove quotes added by PHP
 266     if (function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc()) {
 267         PMA_arrayWalkRecursive($_GET, 'stripslashes', true);
 268         PMA_arrayWalkRecursive($_POST, 'stripslashes', true);
 269         PMA_arrayWalkRecursive($_COOKIE, 'stripslashes', true);
 270         PMA_arrayWalkRecursive($_REQUEST, 'stripslashes', true);
 271     }
 272 }
 273
 274 /**
 275  * include deprecated grab_globals only if required
 276  */
 277 if (empty($__redirect) && !defined('PMA_NO_VARIABLES_IMPORT')) {
 278     include './libraries/grab_globals.lib.php';
 279 }
 280
 281 /**
 282  * check timezone setting
 283  * this could produce an E_STRICT - but only once,
 284  * if not done here it will produce E_STRICT on every date/time function
 285  *
 286  * @todo need to decide how we should handle this (without @)
 287  */
 288 date_default_timezone_set(@date_default_timezone_get());
 289
 290 /******************************************************************************/
 291 /* parsing configuration file                         LABEL_parsing_config_file      */
 292
 293 /**
 294  * We really need this one!
 295  */
 296 if (! function_exists('preg_replace')) {
 297     PMA_warnMissingExtension('pcre', true);
 298 }
 299
 300 /**
 301  * @global PMA_Config $GLOBALS['PMA_Config']
 302  * force reading of config file, because we removed sensitive values
 303  * in the previous iteration
 304  */
 305 $GLOBALS['PMA_Config'] = new PMA_Config(CONFIG_FILE);
 306
 307 if (!defined('PMA_MINIMUM_COMMON')) {
 308     $GLOBALS['PMA_Config']->checkPmaAbsoluteUri();
 309 }
 310
 311 /**
 312  * BC - enable backward compatibility
 313  * exports all configuration settings into $GLOBALS ($GLOBALS['cfg'])
 314  */
 315 $GLOBALS['PMA_Config']->enableBc();
 316
 317 /**
 318  * clean cookies on upgrade
 319  * when changing something related to PMA cookies, increment the cookie version
 320  */
 321 $pma_cookie_version = 4;
 322 if (isset($_COOKIE)
 323  && (isset($_COOKIE['pmaCookieVer'])
 324   && $_COOKIE['pmaCookieVer'] < $pma_cookie_version)) {
 325     // delete all cookies
 326     foreach ($_COOKIE as $cookie_name => $tmp) {
 327         $GLOBALS['PMA_Config']->removeCookie($cookie_name);
 328     }
 329     $_COOKIE = array();
 330     $GLOBALS['PMA_Config']->setCookie('pmaCookieVer', $pma_cookie_version);
 331 }
 332
 333
 334 /**
 335  * check HTTPS connection
 336  */
 337 if ($GLOBALS['PMA_Config']->get('ForceSSL')
 338   && !$GLOBALS['PMA_Config']->get('is_https')) {
 339     PMA_sendHeaderLocation(
 340         preg_replace('/^http/', 'https',
 341             $GLOBALS['PMA_Config']->get('PmaAbsoluteUri'))
 342         . PMA_generate_common_url($_GET, 'text'));
 343     // delete the current session, otherwise we get problems (see bug #2397877)
 344     $GLOBALS['PMA_Config']->removeCookie($GLOBALS['session_name']);
 345     exit;
 346 }
 347
 348
 349 /**
 350  * include session handling after the globals, to prevent overwriting
 351  */
 352 require './libraries/session.inc.php';
 353
 354 /**
 355  * init some variables LABEL_variables_init
 356  */
 357
 358 /**
 359  * holds parameters to be passed to next page
 360  * @global array $GLOBALS['url_params']
 361  */
 362 $GLOBALS['url_params'] = array();
 363
 364 /**
 365  * the whitelist for $GLOBALS['goto']
 366  * @global array $goto_whitelist
 367  */
 368 $goto_whitelist = array(
 369     //'browse_foreigners.php',
 370     //'calendar.php',
 371     //'changelog.php',
 372     //'chk_rel.php',
 373     'db_create.php',
 374     'db_datadict.php',
 375     'db_sql.php',
 376     'db_events.php',
 377     'db_export.php',
 378     'db_importdocsql.php',
 379     'db_qbe.php',
 380     'db_structure.php',
 381     'db_import.php',
 382     'db_operations.php',
 383     'db_printview.php',
 384     'db_search.php',
 385     'db_routines.php',
 386     //'Documentation.html',
 387     'export.php',
 388     'import.php',
 389     //'index.php',
 390     //'navigation.php',
 391     //'license.php',
 392     'main.php',
 393     'pdf_pages.php',
 394     'pdf_schema.php',
 395     //'phpinfo.php',
 396     'querywindow.php',
 397     //'readme.php',
 398     'server_binlog.php',
 399     'server_collations.php',
 400     'server_databases.php',
 401     'server_engines.php',
 402     'server_export.php',
 403     'server_import.php',
 404     'server_privileges.php',
 405     'server_processlist.php',
 406     'server_sql.php',
 407     'server_status.php',
 408     'server_variables.php',
 409     'sql.php',
 410     'tbl_addfield.php',
 411     'tbl_alter.php',
 412     'tbl_change.php',
 413     'tbl_create.php',
 414     'tbl_import.php',
 415     'tbl_indexes.php',
 416     'tbl_move_copy.php',
 417     'tbl_printview.php',
 418     'tbl_sql.php',
 419     'tbl_export.php',
 420     'tbl_operations.php',
 421     'tbl_structure.php',
 422     'tbl_relation.php',
 423     'tbl_replace.php',
 424     'tbl_row_action.php',
 425     'tbl_select.php',
 426     'tbl_zoom_select.php',
 427     //'themes.php',
 428     'transformation_overview.php',
 429     'transformation_wrapper.php',
 430     'user_password.php',
 431 );
 432
 433 /**
 434  * check $__redirect against whitelist
 435  */
 436 if (! PMA_checkPageValidity($__redirect, $goto_whitelist)) {
 437     $__redirect = null;
 438 }
 439
 440 /**
 441  * holds page that should be displayed
 442  * @global string $GLOBALS['goto']
 443  */
 444 $GLOBALS['goto'] = '';
 445 // Security fix: disallow accessing serious server files via "?goto="
 446 if (PMA_checkPageValidity($_REQUEST['goto'], $goto_whitelist)) {
 447     $GLOBALS['goto'] = $_REQUEST['goto'];
 448     $GLOBALS['url_params']['goto'] = $_REQUEST['goto'];
 449 } else {
 450     unset($_REQUEST['goto'], $_GET['goto'], $_POST['goto'], $_COOKIE['goto']);
 451 }
 452
 453 /**
 454  * returning page
 455  * @global string $GLOBALS['back']
 456  */
 457 if (PMA_checkPageValidity($_REQUEST['back'], $goto_whitelist)) {
 458     $GLOBALS['back'] = $_REQUEST['back'];
 459 } else {
 460     unset($_REQUEST['back'], $_GET['back'], $_POST['back'], $_COOKIE['back']);
 461 }
 462
 463 /**
 464  * Check whether user supplied token is valid, if not remove any possibly
 465  * dangerous stuff from request.
 466  *
 467  * remember that some objects in the session with session_start and __wakeup()
 468  * could access this variables before we reach this point
 469  * f.e. PMA_Config: fontsize
 470  *
 471  * @todo variables should be handled by their respective owners (objects)
 472  * f.e. lang, server, collation_connection in PMA_Config
 473  */
 474 if (! PMA_isValid($_REQUEST['token']) || $_SESSION[' PMA_token '] != $_REQUEST['token']) {
 475     /**
 476      *  List of parameters which are allowed from unsafe source
 477      */
 478     $allow_list = array(
 479         /* needed for direct access, see FAQ 1.34
 480          * also, server needed for cookie login screen (multi-server)
 481          */
 482         'server', 'db', 'table', 'target', 'lang',
 483         /* Session ID */
 484         'phpMyAdmin',
 485         /* Cookie preferences */
 486         'pma_lang', 'pma_collation_connection',
 487         /* Possible login form */
 488         'pma_servername', 'pma_username', 'pma_password',
 489         /* for playing blobstreamable media */
 490         'media_type', 'custom_type', 'bs_reference',
 491         /* for changing BLOB repository file MIME type */
 492         'bs_db', 'bs_table', 'bs_ref', 'bs_new_mime_type',
 493     );
 494     /**
 495      * Require cleanup functions
 496      */
 497     include './libraries/cleanup.lib.php';
 498     /**
 499      * Do actual cleanup
 500      */
 501     PMA_remove_request_vars($allow_list);
 502
 503 }
 504
 505
 506 /**
 507  * current selected database
 508  * @global string $GLOBALS['db']
 509  */
 510 $GLOBALS['db'] = '';
 511 if (PMA_isValid($_REQUEST['db'])) {
 512     // can we strip tags from this?
 513     // only \ and / is not allowed in db names for MySQL
 514     $GLOBALS['db'] = $_REQUEST['db'];
 515     $GLOBALS['url_params']['db'] = $GLOBALS['db'];
 516 }
 517
 518 /**
 519  * current selected table
 520  * @global string $GLOBALS['table']
 521  */
 522 $GLOBALS['table'] = '';
 523 if (PMA_isValid($_REQUEST['table'])) {
 524     // can we strip tags from this?
 525     // only \ and / is not allowed in table names for MySQL
 526     $GLOBALS['table'] = $_REQUEST['table'];
 527     $GLOBALS['url_params']['table'] = $GLOBALS['table'];
 528 }
 529
 530 /**
 531  * Store currently selected recent table.
 532  * Affect $GLOBALS['db'] and $GLOBALS['table']
 533  */
 534 if (PMA_isValid($_REQUEST['selected_recent_table'])) {
 535     $recent_table = json_decode($_REQUEST['selected_recent_table'], true);
 536     $GLOBALS['db'] = $recent_table['db'];
 537     $GLOBALS['url_params']['db'] = $GLOBALS['db'];
 538     $GLOBALS['table'] = $recent_table['table'];
 539     $GLOBALS['url_params']['table'] = $GLOBALS['table'];
 540 }
 541
 542 /**
 543  * SQL query to be executed
 544  * @global string $GLOBALS['sql_query']
 545  */
 546 $GLOBALS['sql_query'] = '';
 547 if (PMA_isValid($_REQUEST['sql_query'])) {
 548     $GLOBALS['sql_query'] = $_REQUEST['sql_query'];
 549 }
 550
 551 /**
 552  * avoid problems in phpmyadmin.css.php in some cases
 553  * @global string $js_frame
 554  */
 555 $_REQUEST['js_frame'] = PMA_ifSetOr($_REQUEST['js_frame'], '');
 556
 557 //$_REQUEST['set_theme'] // checked later in this file LABEL_theme_setup
 558 //$_REQUEST['server']; // checked later in this file
 559 //$_REQUEST['lang'];   // checked by LABEL_loading_language_file
 560
 561
 562 /**
 563  * holds name of JavaScript files to be included in HTML header
 564  * @global array $js_include
 565  */
 566 $GLOBALS['js_include'] = array();
 567 $GLOBALS['js_include'][] = 'jquery/jquery-1.6.2.js';
 568 $GLOBALS['js_include'][] = 'jquery/jquery-ui-1.8.16.custom.js';
 569 $GLOBALS['js_include'][] = 'update-location.js';
 570
 571 /**
 572  * holds an array of javascript code snippets to be included in the HTML header
 573  * Can be used with PMA_AddJSCode() to pass on js variables to the browser.
 574  * @global array $js_script
 575  */
 576 $GLOBALS['js_script'] = array();
 577
 578 /**
 579  * Add common jQuery functions script here if necessary.
 580  */
 581
 582 /**
 583  * JavaScript events that will be registered
 584  * @global array $js_events
 585  */
 586 $GLOBALS['js_events'] = array();
 587
 588 /**
 589  * footnotes to be displayed ot the page bottom
 590  * @global array $footnotes
 591  */
 592 $GLOBALS['footnotes'] = array();
 593
 594 /******************************************************************************/
 595 /* loading language file                       LABEL_loading_language_file    */
 596
 597 /**
 598  * lang detection is done here
 599  */
 600 require './libraries/select_lang.lib.php';
 601
 602 /**
 603  * check for errors occurred while loading configuration
 604  * this check is done here after loading language files to present errors in locale
 605  */
 606 if ($GLOBALS['PMA_Config']->error_config_file) {
 607     $error = '<h1>' . __('Failed to read configuration file') . '</h1>'
 608         . _('This usually means there is a syntax error in it, please check any errors shown below.')
 609         . '<br />'
 610         . '<br />'
 611         . '<iframe src="show_config_errors.php" />';
 612     trigger_error($error, E_USER_ERROR);
 613 }
 614 if ($GLOBALS['PMA_Config']->error_config_default_file) {
 615     $error = sprintf(__('Could not load default configuration from: %1$s'),
 616         $GLOBALS['PMA_Config']->default_source);
 617     trigger_error($error, E_USER_ERROR);
 618 }
 619 if ($GLOBALS['PMA_Config']->error_pma_uri) {
 620     trigger_error(__('The <tt>$cfg[\'PmaAbsoluteUri\']</tt> directive MUST be set in your configuration file!'), E_USER_ERROR);
 621 }
 622
 623
 624 /******************************************************************************/
 625 /* setup servers                                       LABEL_setup_servers    */
 626
 627 /**
 628  * current server
 629  * @global integer $GLOBALS['server']
 630  */
 631 $GLOBALS['server'] = 0;
 632
 633 /**
 634  * Servers array fixups.
 635  * $default_server comes from PMA_Config::enableBc()
 636  * @todo merge into PMA_Config
 637  */
 638 // Do we have some server?
 639 if (! isset($cfg['Servers']) || count($cfg['Servers']) == 0) {
 640     // No server => create one with defaults
 641     $cfg['Servers'] = array(1 => $default_server);
 642 } else {
 643     // We have server(s) => apply default configuration
 644     $new_servers = array();
 645
 646     foreach ($cfg['Servers'] as $server_index => $each_server) {
 647
 648         // Detect wrong configuration
 649         if (!is_int($server_index) || $server_index < 1) {
 650             trigger_error(sprintf(__('Invalid server index: %s'), $server_index), E_USER_ERROR);
 651         }
 652
 653         $each_server = array_merge($default_server, $each_server);
 654
 655         // Don't use servers with no hostname
 656         if ($each_server['connect_type'] == 'tcp' && empty($each_server['host'])) {
 657             trigger_error(sprintf(__('Invalid hostname for server %1$s. Please review your configuration.'), $server_index), E_USER_ERROR);
 658         }
 659
 660         // Final solution to bug #582890
 661         // If we are using a socket connection
 662         // and there is nothing in the verbose server name
 663         // or the host field, then generate a name for the server
 664         // in the form of "Server 2", localized of course!
 665         if ($each_server['connect_type'] == 'socket' && empty($each_server['host']) && empty($each_server['verbose'])) {
 666             $each_server['verbose'] = __('Server') . $server_index;
 667         }
 668
 669         $new_servers[$server_index] = $each_server;
 670     }
 671     $cfg['Servers'] = $new_servers;
 672     unset($new_servers, $server_index, $each_server);
 673 }
 674
 675 // Cleanup
 676 unset($default_server);
 677
 678
 679 /******************************************************************************/
 680 /* setup themes                                          LABEL_theme_setup    */
 681
 682 /**
 683  * @global PMA_Theme_Manager $_SESSION['PMA_Theme_Manager']
 684  */
 685 if (! isset($_SESSION['PMA_Theme_Manager'])) {
 686     $_SESSION['PMA_Theme_Manager'] = new PMA_Theme_Manager;
 687 } else {
 688     /**
 689      * @todo move all __wakeup() functionality into session.inc.php
 690      */
 691     $_SESSION['PMA_Theme_Manager']->checkConfig();
 692 }
 693
 694 // for the theme per server feature
 695 if (isset($_REQUEST['server']) && ! isset($_REQUEST['set_theme'])) {
 696     $GLOBALS['server'] = $_REQUEST['server'];
 697     $tmp = $_SESSION['PMA_Theme_Manager']->getThemeCookie();
 698     if (empty($tmp)) {
 699         $tmp = $_SESSION['PMA_Theme_Manager']->theme_default;
 700     }
 701     $_SESSION['PMA_Theme_Manager']->setActiveTheme($tmp);
 702     unset($tmp);
 703 }
 704 /**
 705  * @todo move into PMA_Theme_Manager::__wakeup()
 706  */
 707 if (isset($_REQUEST['set_theme'])) {
 708     // if user selected a theme
 709     $_SESSION['PMA_Theme_Manager']->setActiveTheme($_REQUEST['set_theme']);
 710 }
 711
 712 /**
 713  * the theme object
 714  * @global PMA_Theme $_SESSION['PMA_Theme']
 715  */
 716 $_SESSION['PMA_Theme'] = $_SESSION['PMA_Theme_Manager']->theme;
 717
 718 // BC
 719 /**
 720  * the active theme
 721  * @global string $GLOBALS['theme']
 722  */
 723 $GLOBALS['theme']           = $_SESSION['PMA_Theme']->getName();
 724 /**
 725  * the theme path
 726  * @global string $GLOBALS['pmaThemePath']
 727  */
 728 $GLOBALS['pmaThemePath']    = $_SESSION['PMA_Theme']->getPath();
 729 /**
 730  * the theme image path
 731  * @global string $GLOBALS['pmaThemeImage']
 732  */
 733 $GLOBALS['pmaThemeImage']   = $_SESSION['PMA_Theme']->getImgPath();
 734
 735 /**
 736  * load layout file if exists
 737  */
 738 if (@file_exists($_SESSION['PMA_Theme']->getLayoutFile())) {
 739     include $_SESSION['PMA_Theme']->getLayoutFile();
 740     /**
 741      * @todo remove if all themes are update use Navi instead of Left as frame name
 742      */
 743     if (! isset($GLOBALS['cfg']['NaviWidth'])
 744      && isset($GLOBALS['cfg']['LeftWidth'])) {
 745         $GLOBALS['cfg']['NaviWidth'] = $GLOBALS['cfg']['LeftWidth'];
 746     }
 747 }
 748
 749 if (! defined('PMA_MINIMUM_COMMON')) {
 750     /**
 751      * Character set conversion.
 752      */
 753     include_once './libraries/charset_conversion.lib.php';
 754
 755     /**
 756      * String handling
 757      */
 758     include_once './libraries/string.lib.php';
 759
 760     /**
 761      * Lookup server by name
 762      * (see FAQ 4.8)
 763      */
 764     if (! empty($_REQUEST['server']) && is_string($_REQUEST['server'])
 765      && ! is_numeric($_REQUEST['server'])) {
 766         foreach ($cfg['Servers'] as $i => $server) {
 767             if ($server['host'] == $_REQUEST['server']) {
 768                 $_REQUEST['server'] = $i;
 769                 break;
 770             }
 771         }
 772         if (is_string($_REQUEST['server'])) {
 773             unset($_REQUEST['server']);
 774         }
 775         unset($i);
 776     }
 777
 778     /**
 779      * If no server is selected, make sure that $cfg['Server'] is empty (so
 780      * that nothing will work), and skip server authentication.
 781      * We do NOT exit here, but continue on without logging into any server.
 782      * This way, the welcome page will still come up (with no server info) and
 783      * present a choice of servers in the case that there are multiple servers
 784      * and '$cfg['ServerDefault'] = 0' is set.
 785      */
 786
 787     if (isset($_REQUEST['server']) && (is_string($_REQUEST['server']) || is_numeric($_REQUEST['server'])) && ! empty($_REQUEST['server']) && ! empty($cfg['Servers'][$_REQUEST['server']])) {
 788         $GLOBALS['server'] = $_REQUEST['server'];
 789         $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
 790     } else {
 791         if (!empty($cfg['Servers'][$cfg['ServerDefault']])) {
 792             $GLOBALS['server'] = $cfg['ServerDefault'];
 793             $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
 794         } else {
 795             $GLOBALS['server'] = 0;
 796             $cfg['Server'] = array();
 797         }
 798     }
 799     $GLOBALS['url_params']['server'] = $GLOBALS['server'];
 800
 801     /**
 802      * Kanji encoding convert feature appended by Y.Kawada (2002/2/20)
 803      */
 804     if (function_exists('mb_convert_encoding')
 805      && $lang == 'ja') {
 806         include_once './libraries/kanji-encoding.lib.php';
 807     } // end if
 808
 809     /**
 810      * save some settings in cookies
 811      * @todo should be done in PMA_Config
 812      */
 813     $GLOBALS['PMA_Config']->setCookie('pma_lang', $GLOBALS['lang']);
 814     $GLOBALS['PMA_Config']->setCookie('pma_collation_connection', $GLOBALS['collation_connection']);
 815
 816     $_SESSION['PMA_Theme_Manager']->setThemeCookie();
 817
 818     if (! empty($cfg['Server'])) {
 819
 820         /**
 821          * Loads the proper database interface for this server
 822          */
 823         include_once './libraries/database_interface.lib.php';
 824
 825         include_once './libraries/logging.lib.php';
 826
 827         // get LoginCookieValidity from preferences cache
 828         // no generic solution for loading preferences from cache as some settings need to be kept
 829         // for processing in PMA_Config::loadUserPreferences()
 830         $cache_key = 'server_' . $GLOBALS['server'];
 831         if (isset($_SESSION['cache'][$cache_key]['userprefs']['LoginCookieValidity'])) {
 832             $value = $_SESSION['cache'][$cache_key]['userprefs']['LoginCookieValidity'];
 833             $GLOBALS['PMA_Config']->set('LoginCookieValidity', $value);
 834             $GLOBALS['cfg']['LoginCookieValidity'] = $value;
 835             unset($value);
 836         }
 837         unset($cache_key);
 838
 839         // Gets the authentication library that fits the $cfg['Server'] settings
 840         // and run authentication
 841
 842         // to allow HTTP or http
 843         $cfg['Server']['auth_type'] = strtolower($cfg['Server']['auth_type']);
 844         if (! file_exists('./libraries/auth/' . $cfg['Server']['auth_type'] . '.auth.lib.php')) {
 845             PMA_fatalError(__('Invalid authentication method set in configuration:') . ' ' . $cfg['Server']['auth_type']);
 846         }
 847         /**
 848          * the required auth type plugin
 849          */
 850         include_once './libraries/auth/' . $cfg['Server']['auth_type'] . '.auth.lib.php';
 851         if (!PMA_auth_check()) {
 852             /* Force generating of new session on login */
 853             PMA_secureSession();
 854             PMA_auth();
 855         } else {
 856             PMA_auth_set_user();
 857         }
 858
 859          // Check IP-based Allow/Deny rules as soon as possible to reject the
 860         // user
 861         // Based on mod_access in Apache:
 862         // http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/aaa/mod_access.c?rev=1.37&content-type=text/vnd.viewcvs-markup
 863         // Look at: "static int check_dir_access(request_rec *r)"
 864         if (isset($cfg['Server']['AllowDeny'])
 865                 && isset($cfg['Server']['AllowDeny']['order'])) {
 866
 867             /**
 868              * ip based access library
 869              */
 870             include_once './libraries/ip_allow_deny.lib.php';
 871
 872             $allowDeny_forbidden         = false; // default
 873             if ($cfg['Server']['AllowDeny']['order'] == 'allow,deny') {
 874                 $allowDeny_forbidden     = true;
 875                 if (PMA_allowDeny('allow')) {
 876                     $allowDeny_forbidden = false;
 877                 }
 878                 if (PMA_allowDeny('deny')) {
 879                     $allowDeny_forbidden = true;
 880                 }
 881             } elseif ($cfg['Server']['AllowDeny']['order'] == 'deny,allow') {
 882                 if (PMA_allowDeny('deny')) {
 883                     $allowDeny_forbidden = true;
 884                 }
 885                 if (PMA_allowDeny('allow')) {
 886                     $allowDeny_forbidden = false;
 887                 }
 888             } elseif ($cfg['Server']['AllowDeny']['order'] == 'explicit') {
 889                 if (PMA_allowDeny('allow')
 890                   && !PMA_allowDeny('deny')) {
 891                     $allowDeny_forbidden = false;
 892                 } else {
 893                     $allowDeny_forbidden = true;
 894                 }
 895             } // end if ... elseif ... elseif
 896
 897             // Ejects the user if banished
 898             if ($allowDeny_forbidden) {
 899                 PMA_log_user($cfg['Server']['user'], 'allow-denied');
 900                 PMA_auth_fails();
 901             }
 902             unset($allowDeny_forbidden); //Clean up after you!
 903         } // end if
 904
 905         // is root allowed?
 906         if (!$cfg['Server']['AllowRoot'] && $cfg['Server']['user'] == 'root') {
 907             $allowDeny_forbidden = true;
 908             PMA_log_user($cfg['Server']['user'], 'root-denied');
 909             PMA_auth_fails();
 910             unset($allowDeny_forbidden); //Clean up after you!
 911         }
 912
 913         // is a login without password allowed?
 914         if (!$cfg['Server']['AllowNoPassword'] && $cfg['Server']['password'] == '') {
 915             $login_without_password_is_forbidden = true;
 916             PMA_log_user($cfg['Server']['user'], 'empty-denied');
 917             PMA_auth_fails();
 918             unset($login_without_password_is_forbidden); //Clean up after you!
 919         }
 920
 921         // if using TCP socket is not needed
 922         if (strtolower($cfg['Server']['connect_type']) == 'tcp') {
 923             $cfg['Server']['socket'] = '';
 924         }
 925
 926         // Try to connect MySQL with the control user profile (will be used to
 927         // get the privileges list for the current user but the true user link
 928         // must be open after this one so it would be default one for all the
 929         // scripts)
 930         $controllink = false;
 931         if ($cfg['Server']['controluser'] != '') {
 932             if (! empty($cfg['Server']['controlhost'])) {
 933                 $controllink = PMA_DBI_connect($cfg['Server']['controluser'],
 934                     $cfg['Server']['controlpass'], true,
 935                     array('host' => $cfg['Server']['controlhost'])
 936                 );
 937             } else {
 938                 $controllink = PMA_DBI_connect($cfg['Server']['controluser'],
 939                     $cfg['Server']['controlpass'], true);
 940             }
 941         }
 942
 943         // Connects to the server (validates user's login)
 944         $userlink = PMA_DBI_connect($cfg['Server']['user'],
 945             $cfg['Server']['password'], false);
 946
 947         if (! $controllink) {
 948             $controllink = $userlink;
 949         }
 950
 951         /* Log success */
 952         PMA_log_user($cfg['Server']['user']);
 953
 954         /**
 955          * with phpMyAdmin 3 we support MySQL >=5
 956          * but only production releases:
 957          *  - > 5.0.15
 958          */
 959         if (PMA_MYSQL_INT_VERSION < 50015) {
 960             PMA_fatalError(__('You should upgrade to %s %s or later.'), array('MySQL', '5.0.15'));
 961         }
 962
 963         if (PMA_DRIZZLE) {
 964             // DisableIS must be set to false for Drizzle, it maps SHOW commands
 965             // to INFORMATION_SCHEMA queries anyway so it's fast on large servers
 966             $cfg['Server']['DisableIS'] = false;
 967             // SHOW OPEN TABLES is not supported by Drizzle
 968             $cfg['SkipLockedTables'] = false;
 969         }
 970
 971         /**
 972          * SQL Parser code
 973          */
 974         include_once './libraries/sqlparser.lib.php';
 975
 976         /**
 977          * SQL Validator interface code
 978          */
 979         include_once './libraries/sqlvalidator.lib.php';
 980
 981         /**
 982          * the PMA_List_Database class
 983          */
 984         include_once './libraries/PMA.php';
 985         $pma = new PMA;
 986         $pma->userlink = $userlink;
 987         $pma->controllink = $controllink;
 988
 989         /**
 990          * some resetting has to be done when switching servers
 991          */
 992         if (isset($_SESSION['tmp_user_values']['previous_server']) && $_SESSION['tmp_user_values']['previous_server'] != $GLOBALS['server']) {
 993             unset($_SESSION['tmp_user_values']['navi_limit_offset']);
 994         }
 995         $_SESSION['tmp_user_values']['previous_server'] = $GLOBALS['server'];
 996
 997     } // end server connecting
 998
 999     /**
1000      * check if profiling was requested and remember it
1001      * (note: when $cfg['ServerDefault'] = 0, constant is not defined)
1002      */
1003     if (isset($_REQUEST['profiling']) && PMA_profilingSupported()) {
1004         $_SESSION['profiling'] = true;
1005     } elseif (isset($_REQUEST['profiling_form'])) {
1006         // the checkbox was unchecked
1007         unset($_SESSION['profiling']);
1008     }
1009
1010     // library file for blobstreaming
1011     include_once './libraries/blobstreaming.lib.php';
1012
1013     // checks for blobstreaming plugins and databases that support
1014     // blobstreaming (by having the necessary tables for blobstreaming)
1015     checkBLOBStreamingPlugins();
1016
1017 } // end if !defined('PMA_MINIMUM_COMMON')
1018
1019 // load user preferences
1020 $GLOBALS['PMA_Config']->loadUserPreferences();
1021
1022 // remove sensitive values from session
1023 $GLOBALS['PMA_Config']->set('blowfish_secret', '');
1024 $GLOBALS['PMA_Config']->set('Servers', '');
1025 $GLOBALS['PMA_Config']->set('default_server', '');
1026
1027 /* Tell tracker that it can actually work */
1028 PMA_Tracker::enable();
1029
1030 /**
1031  * @global boolean $GLOBALS['is_ajax_request']
1032  * @todo should this be moved to the variables init section above?
1033  *
1034  * Check if the current request is an AJAX request, and set is_ajax_request
1035  * accordingly.  Suppress headers, footers and unnecessary output if set to
1036  * true
1037  */
1038 if (isset($_REQUEST['ajax_request']) && $_REQUEST['ajax_request'] == true) {
1039     $GLOBALS['is_ajax_request'] = true;
1040 } else {
1041     $GLOBALS['is_ajax_request'] = false;
1042 }
1043
1044 /**
1045  * @global  boolean $GLOBALS['grid_edit']
1046  *
1047  * Set to true if this is a request made during an grid edit process.  This
1048  * request is made to retrieve the non-truncated/transformed values.
1049  */
1050 if (isset($_REQUEST['grid_edit']) && $_REQUEST['grid_edit'] == true) {
1051     $GLOBALS['grid_edit'] = true;
1052 } else {
1053     $GLOBALS['grid_edit'] = false;
1054 }
1055
1056 if (!empty($__redirect) && in_array($__redirect, $goto_whitelist)) {
1057     /**
1058      * include subform target page
1059      */
1060     include $__redirect;
1061     exit();
1062 }
1063 ?>