PageRenderTime 46ms CodeModel.GetById 17ms app.highlight 19ms RepoModel.GetById 1ms app.codeStats 0ms

/phpmyadmin/libraries/common.inc.php

https://bitbucket.org/adarshj/convenient_website
PHP | 1082 lines | 485 code | 124 blank | 473 comment | 137 complexity | 1eded26e256a5f9e6de6b2d176f982c0 MD5 | raw file
   1<?php
   2/* vim: set expandtab sw=4 ts=4 sts=4: */
   3/**
   4 * Misc stuff and REQUIRED by ALL the scripts.
   5 * MUST be included by every script
   6 *
   7 * Among other things, it contains the advanced authentication work.
   8 *
   9 * Order of sections for common.inc.php:
  10 *
  11 * the authentication libraries must be before the connection to db
  12 *
  13 * ... so the required order is:
  14 *
  15 * LABEL_variables_init
  16 *  - initialize some variables always needed
  17 * LABEL_parsing_config_file
  18 *  - parsing of the configuration file
  19 * LABEL_loading_language_file
  20 *  - loading language file
  21 * LABEL_setup_servers
  22 *  - check and setup configured servers
  23 * LABEL_theme_setup
  24 *  - setting up themes
  25 *
  26 * - load of MySQL extension (if necessary)
  27 * - loading of an authentication library
  28 * - db connection
  29 * - authentication work
  30 *
  31 * @package PhpMyAdmin
  32 */
  33
  34/**
  35 * Minimum PHP version; can't call PMA_fatalError() which uses a
  36 * PHP 5 function, so cannot easily localize this message.
  37 */
  38if (version_compare(PHP_VERSION, '5.2.0', 'lt')) {
  39    die('PHP 5.2+ is required');
  40}
  41
  42/**
  43  * Backward compatibility for PHP 5.2
  44  */
  45if (!defined('E_DEPRECATED')) {
  46    define('E_DEPRECATED', 8192);
  47}
  48
  49/**
  50 * the error handler
  51 */
  52require './libraries/Error_Handler.class.php';
  53
  54/**
  55 * initialize the error handler
  56 */
  57$GLOBALS['error_handler'] = new PMA_Error_Handler();
  58$cfg['Error_Handler']['display'] = true;
  59
  60/*
  61 * This setting was removed in PHP 5.3. But at this point PMA_PHP_INT_VERSION
  62 * is not yet defined so we use another way to find out the PHP version.
  63 */
  64if (version_compare(phpversion(), '5.3', 'lt')) {
  65    /**
  66     * Avoid object cloning errors
  67     */
  68    @ini_set('zend.ze1_compatibility_mode', false);
  69}
  70
  71/**
  72 * This setting was removed in PHP 5.4. But at this point PMA_PHP_INT_VERSION
  73 * is not yet defined so we use another way to find out the PHP version.
  74 */
  75if (version_compare(phpversion(), '5.4', 'lt')) {
  76    /**
  77     * Avoid problems with magic_quotes_runtime
  78     */
  79    @ini_set('magic_quotes_runtime', false);
  80}
  81
  82/**
  83 * for verification in all procedural scripts under libraries
  84 */
  85define('PHPMYADMIN', true);
  86
  87/**
  88 * core functions
  89 */
  90require './libraries/core.lib.php';
  91
  92/**
  93 * Input sanitizing
  94 */
  95require './libraries/sanitizing.lib.php';
  96
  97/**
  98 * the PMA_Theme class
  99 */
 100require './libraries/Theme.class.php';
 101
 102/**
 103 * the PMA_Theme_Manager class
 104 */
 105require './libraries/Theme_Manager.class.php';
 106
 107/**
 108 * the PMA_Config class
 109 */
 110require './libraries/Config.class.php';
 111
 112/**
 113 * the relation lib, tracker needs it
 114 */
 115require './libraries/relation.lib.php';
 116
 117/**
 118 * the PMA_Tracker class
 119 */
 120require './libraries/Tracker.class.php';
 121
 122/**
 123 * the PMA_Table class
 124 */
 125require './libraries/Table.class.php';
 126
 127if (!defined('PMA_MINIMUM_COMMON')) {
 128    /**
 129     * common functions
 130     */
 131    include_once './libraries/common.lib.php';
 132
 133    /**
 134     * Java script escaping.
 135     */
 136    include_once './libraries/js_escape.lib.php';
 137
 138    /**
 139     * Include URL/hidden inputs generating.
 140     */
 141    include_once './libraries/url_generating.lib.php';
 142}
 143
 144/******************************************************************************/
 145/* start procedural code                       label_start_procedural         */
 146
 147/**
 148 * protect against possible exploits - there is no need to have so much variables
 149 */
 150if (count($_REQUEST) > 1000) {
 151    die(__('possible exploit'));
 152}
 153
 154/**
 155 * Check for numeric keys
 156 * (if register_globals is on, numeric key can be found in $GLOBALS)
 157 */
 158foreach ($GLOBALS as $key => $dummy) {
 159    if (is_numeric($key)) {
 160        die(__('numeric key detected'));
 161    }
 162}
 163unset($dummy);
 164
 165/**
 166 * PATH_INFO could be compromised if set, so remove it from PHP_SELF
 167 * and provide a clean PHP_SELF here
 168 */
 169$PMA_PHP_SELF = PMA_getenv('PHP_SELF');
 170$_PATH_INFO = PMA_getenv('PATH_INFO');
 171if (! empty($_PATH_INFO) && ! empty($PMA_PHP_SELF)) {
 172    $path_info_pos = strrpos($PMA_PHP_SELF, $_PATH_INFO);
 173    if ($path_info_pos + strlen($_PATH_INFO) === strlen($PMA_PHP_SELF)) {
 174        $PMA_PHP_SELF = substr($PMA_PHP_SELF, 0, $path_info_pos);
 175    }
 176}
 177$PMA_PHP_SELF = htmlspecialchars($PMA_PHP_SELF);
 178
 179
 180/**
 181 * just to be sure there was no import (registering) before here
 182 * we empty the global space (but avoid unsetting $variables_list
 183 * and $key in the foreach (), we still need them!)
 184 */
 185$variables_whitelist = array (
 186    'GLOBALS',
 187    '_SERVER',
 188    '_GET',
 189    '_POST',
 190    '_REQUEST',
 191    '_FILES',
 192    '_ENV',
 193    '_COOKIE',
 194    '_SESSION',
 195    'error_handler',
 196    'PMA_PHP_SELF',
 197    'variables_whitelist',
 198    'key'
 199);
 200
 201foreach (get_defined_vars() as $key => $value) {
 202    if (! in_array($key, $variables_whitelist)) {
 203        unset($$key);
 204    }
 205}
 206unset($key, $value, $variables_whitelist);
 207
 208
 209/**
 210 * Subforms - some functions need to be called by form, cause of the limited URL
 211 * length, but if this functions inside another form you cannot just open a new
 212 * form - so phpMyAdmin uses 'arrays' inside this form
 213 *
 214 * <code>
 215 * <form ...>
 216 * ... main form elments ...
 217 * <input type="hidden" name="subform[action1][id]" value="1" />
 218 * ... other subform data ...
 219 * <input type="submit" name="usesubform[action1]" value="do action1" />
 220 * ... other subforms ...
 221 * <input type="hidden" name="subform[actionX][id]" value="X" />
 222 * ... other subform data ...
 223 * <input type="submit" name="usesubform[actionX]" value="do actionX" />
 224 * ... main form elments ...
 225 * <input type="submit" name="main_action" value="submit form" />
 226 * </form>
 227 * </code>
 228 *
 229 * so we now check if a subform is submitted
 230 */
 231$__redirect = null;
 232if (isset($_POST['usesubform'])) {
 233    // if a subform is present and should be used
 234    // the rest of the form is deprecated
 235    $subform_id = key($_POST['usesubform']);
 236    $subform    = $_POST['subform'][$subform_id];
 237    $_POST      = $subform;
 238    $_REQUEST   = $subform;
 239    /**
 240     * some subforms need another page than the main form, so we will just
 241     * include this page at the end of this script - we use $__redirect to
 242     * track this
 243     */
 244    if (isset($_POST['redirect'])
 245      && $_POST['redirect'] != basename($PMA_PHP_SELF)) {
 246        $__redirect = $_POST['redirect'];
 247        unset($_POST['redirect']);
 248    }
 249    unset($subform_id, $subform);
 250} else {
 251    // Note: here we overwrite $_REQUEST so that it does not contain cookies,
 252    // because another application for the same domain could have set
 253    // a cookie (with a compatible path) that overrides a variable
 254    // we expect from GET or POST.
 255    // We'll refer to cookies explicitly with the $_COOKIE syntax.
 256    $_REQUEST = array_merge($_GET, $_POST);
 257}
 258// end check if a subform is submitted
 259
 260/**
 261 * This setting was removed in PHP 5.4. But at this point PMA_PHP_INT_VERSION
 262 * is not yet defined so we use another way to find out the PHP version.
 263 */
 264if (version_compare(phpversion(), '5.4', 'lt')) {
 265    // remove quotes added by PHP
 266    if (function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc()) {
 267        PMA_arrayWalkRecursive($_GET, 'stripslashes', true);
 268        PMA_arrayWalkRecursive($_POST, 'stripslashes', true);
 269        PMA_arrayWalkRecursive($_COOKIE, 'stripslashes', true);
 270        PMA_arrayWalkRecursive($_REQUEST, 'stripslashes', true);
 271    }
 272}
 273
 274/**
 275 * include deprecated grab_globals only if required
 276 */
 277if (empty($__redirect) && !defined('PMA_NO_VARIABLES_IMPORT')) {
 278    include './libraries/grab_globals.lib.php';
 279}
 280
 281/**
 282 * check timezone setting
 283 * this could produce an E_STRICT - but only once,
 284 * if not done here it will produce E_STRICT on every date/time function
 285 *
 286 * @todo need to decide how we should handle this (without @)
 287 */
 288date_default_timezone_set(@date_default_timezone_get());
 289
 290/******************************************************************************/
 291/* parsing configuration file                         LABEL_parsing_config_file      */
 292
 293/**
 294 * We really need this one!
 295 */
 296if (! function_exists('preg_replace')) {
 297    PMA_warnMissingExtension('pcre', true);
 298}
 299
 300/**
 301 * @global PMA_Config $GLOBALS['PMA_Config']
 302 * force reading of config file, because we removed sensitive values
 303 * in the previous iteration
 304 */
 305$GLOBALS['PMA_Config'] = new PMA_Config(CONFIG_FILE);
 306
 307if (!defined('PMA_MINIMUM_COMMON')) {
 308    $GLOBALS['PMA_Config']->checkPmaAbsoluteUri();
 309}
 310
 311/**
 312 * BC - enable backward compatibility
 313 * exports all configuration settings into $GLOBALS ($GLOBALS['cfg'])
 314 */
 315$GLOBALS['PMA_Config']->enableBc();
 316
 317/**
 318 * clean cookies on upgrade
 319 * when changing something related to PMA cookies, increment the cookie version
 320 */
 321$pma_cookie_version = 4;
 322if (isset($_COOKIE)
 323 && (isset($_COOKIE['pmaCookieVer'])
 324  && $_COOKIE['pmaCookieVer'] < $pma_cookie_version)) {
 325    // delete all cookies
 326    foreach ($_COOKIE as $cookie_name => $tmp) {
 327        $GLOBALS['PMA_Config']->removeCookie($cookie_name);
 328    }
 329    $_COOKIE = array();
 330    $GLOBALS['PMA_Config']->setCookie('pmaCookieVer', $pma_cookie_version);
 331}
 332
 333
 334/**
 335 * check HTTPS connection
 336 */
 337if ($GLOBALS['PMA_Config']->get('ForceSSL')
 338    && ! $GLOBALS['PMA_Config']->get('is_https')
 339) {
 340    // grab current URL
 341    $url = $GLOBALS['PMA_Config']->get('PmaAbsoluteUri');
 342    // Parse current URL
 343    $parsed = parse_url($url);
 344    // In case parsing has failed do stupid string replacement
 345    if ($parsed === false) {
 346        // Replace http protocol
 347        $url = preg_replace('@^http:@', 'https:', $url);
 348    } else {
 349        if($GLOBALS['PMA_Config']->get('SSLPort')) {
 350            $port_number = $GLOBALS['PMA_Config']->get('SSLPort');
 351        } else {
 352            $port_number = 443;
 353        }
 354        $url = 'https://' . $parsed['host'] . ':' . $port_number . '/' . $parsed['path'];
 355    }
 356    // Actually redirect
 357    PMA_sendHeaderLocation($url . PMA_generate_common_url($_GET, 'text'));
 358    // delete the current session, otherwise we get problems (see bug #2397877)
 359    $GLOBALS['PMA_Config']->removeCookie($GLOBALS['session_name']);
 360    exit;
 361}
 362
 363
 364/**
 365 * include session handling after the globals, to prevent overwriting
 366 */
 367require './libraries/session.inc.php';
 368
 369/**
 370 * init some variables LABEL_variables_init
 371 */
 372
 373/**
 374 * holds parameters to be passed to next page
 375 * @global array $GLOBALS['url_params']
 376 */
 377$GLOBALS['url_params'] = array();
 378
 379/**
 380 * the whitelist for $GLOBALS['goto']
 381 * @global array $goto_whitelist
 382 */
 383$goto_whitelist = array(
 384    //'browse_foreigners.php',
 385    //'calendar.php',
 386    //'changelog.php',
 387    //'chk_rel.php',
 388    'db_create.php',
 389    'db_datadict.php',
 390    'db_sql.php',
 391    'db_events.php',
 392    'db_export.php',
 393    'db_importdocsql.php',
 394    'db_qbe.php',
 395    'db_structure.php',
 396    'db_import.php',
 397    'db_operations.php',
 398    'db_printview.php',
 399    'db_search.php',
 400    'db_routines.php',
 401    //'Documentation.html',
 402    'export.php',
 403    'import.php',
 404    //'index.php',
 405    //'navigation.php',
 406    //'license.php',
 407    'main.php',
 408    'pdf_pages.php',
 409    'pdf_schema.php',
 410    //'phpinfo.php',
 411    'querywindow.php',
 412    //'readme.php',
 413    'server_binlog.php',
 414    'server_collations.php',
 415    'server_databases.php',
 416    'server_engines.php',
 417    'server_export.php',
 418    'server_import.php',
 419    'server_privileges.php',
 420    'server_processlist.php',
 421    'server_sql.php',
 422    'server_status.php',
 423    'server_variables.php',
 424    'sql.php',
 425    'tbl_addfield.php',
 426    'tbl_alter.php',
 427    'tbl_change.php',
 428    'tbl_create.php',
 429    'tbl_import.php',
 430    'tbl_indexes.php',
 431    'tbl_move_copy.php',
 432    'tbl_printview.php',
 433    'tbl_sql.php',
 434    'tbl_export.php',
 435    'tbl_operations.php',
 436    'tbl_structure.php',
 437    'tbl_relation.php',
 438    'tbl_replace.php',
 439    'tbl_row_action.php',
 440    'tbl_select.php',
 441    'tbl_zoom_select.php',
 442    //'themes.php',
 443    'transformation_overview.php',
 444    'transformation_wrapper.php',
 445    'user_password.php',
 446);
 447
 448/**
 449 * check $__redirect against whitelist
 450 */
 451if (! PMA_checkPageValidity($__redirect, $goto_whitelist)) {
 452    $__redirect = null;
 453}
 454
 455/**
 456 * holds page that should be displayed
 457 * @global string $GLOBALS['goto']
 458 */
 459$GLOBALS['goto'] = '';
 460// Security fix: disallow accessing serious server files via "?goto="
 461if (PMA_checkPageValidity($_REQUEST['goto'], $goto_whitelist)) {
 462    $GLOBALS['goto'] = $_REQUEST['goto'];
 463    $GLOBALS['url_params']['goto'] = $_REQUEST['goto'];
 464} else {
 465    unset($_REQUEST['goto'], $_GET['goto'], $_POST['goto'], $_COOKIE['goto']);
 466}
 467
 468/**
 469 * returning page
 470 * @global string $GLOBALS['back']
 471 */
 472if (PMA_checkPageValidity($_REQUEST['back'], $goto_whitelist)) {
 473    $GLOBALS['back'] = $_REQUEST['back'];
 474} else {
 475    unset($_REQUEST['back'], $_GET['back'], $_POST['back'], $_COOKIE['back']);
 476}
 477
 478/**
 479 * Check whether user supplied token is valid, if not remove any possibly
 480 * dangerous stuff from request.
 481 *
 482 * remember that some objects in the session with session_start and __wakeup()
 483 * could access this variables before we reach this point
 484 * f.e. PMA_Config: fontsize
 485 *
 486 * @todo variables should be handled by their respective owners (objects)
 487 * f.e. lang, server, collation_connection in PMA_Config
 488 */
 489if (! PMA_isValid($_REQUEST['token']) || $_SESSION[' PMA_token '] != $_REQUEST['token']) {
 490    /**
 491     *  List of parameters which are allowed from unsafe source
 492     */
 493    $allow_list = array(
 494        /* needed for direct access, see FAQ 1.34
 495         * also, server needed for cookie login screen (multi-server)
 496         */
 497        'server', 'db', 'table', 'target', 'lang',
 498        /* Session ID */
 499        'phpMyAdmin',
 500        /* Cookie preferences */
 501        'pma_lang', 'pma_collation_connection',
 502        /* Possible login form */
 503        'pma_servername', 'pma_username', 'pma_password',
 504        /* for playing blobstreamable media */
 505        'media_type', 'custom_type', 'bs_reference',
 506        /* for changing BLOB repository file MIME type */
 507        'bs_db', 'bs_table', 'bs_ref', 'bs_new_mime_type',
 508    );
 509    /**
 510     * Require cleanup functions
 511     */
 512    include './libraries/cleanup.lib.php';
 513    /**
 514     * Do actual cleanup
 515     */
 516    PMA_remove_request_vars($allow_list);
 517
 518}
 519
 520
 521/**
 522 * current selected database
 523 * @global string $GLOBALS['db']
 524 */
 525$GLOBALS['db'] = '';
 526if (PMA_isValid($_REQUEST['db'])) {
 527    // can we strip tags from this?
 528    // only \ and / is not allowed in db names for MySQL
 529    $GLOBALS['db'] = $_REQUEST['db'];
 530    $GLOBALS['url_params']['db'] = $GLOBALS['db'];
 531}
 532
 533/**
 534 * current selected table
 535 * @global string $GLOBALS['table']
 536 */
 537$GLOBALS['table'] = '';
 538if (PMA_isValid($_REQUEST['table'])) {
 539    // can we strip tags from this?
 540    // only \ and / is not allowed in table names for MySQL
 541    $GLOBALS['table'] = $_REQUEST['table'];
 542    $GLOBALS['url_params']['table'] = $GLOBALS['table'];
 543}
 544
 545/**
 546 * Store currently selected recent table.
 547 * Affect $GLOBALS['db'] and $GLOBALS['table']
 548 */
 549if (PMA_isValid($_REQUEST['selected_recent_table'])) {
 550    $recent_table = json_decode($_REQUEST['selected_recent_table'], true);
 551    $GLOBALS['db'] = $recent_table['db'];
 552    $GLOBALS['url_params']['db'] = $GLOBALS['db'];
 553    $GLOBALS['table'] = $recent_table['table'];
 554    $GLOBALS['url_params']['table'] = $GLOBALS['table'];
 555}
 556
 557/**
 558 * SQL query to be executed
 559 * @global string $GLOBALS['sql_query']
 560 */
 561$GLOBALS['sql_query'] = '';
 562if (PMA_isValid($_REQUEST['sql_query'])) {
 563    $GLOBALS['sql_query'] = $_REQUEST['sql_query'];
 564}
 565
 566/**
 567 * avoid problems in phpmyadmin.css.php in some cases
 568 * @global string $js_frame
 569 */
 570$_REQUEST['js_frame'] = PMA_ifSetOr($_REQUEST['js_frame'], '');
 571
 572//$_REQUEST['set_theme'] // checked later in this file LABEL_theme_setup
 573//$_REQUEST['server']; // checked later in this file
 574//$_REQUEST['lang'];   // checked by LABEL_loading_language_file
 575
 576
 577/**
 578 * holds name of JavaScript files to be included in HTML header
 579 * @global array $js_include
 580 */
 581$GLOBALS['js_include'] = array();
 582$GLOBALS['js_include'][] = 'jquery/jquery-1.6.2.js';
 583$GLOBALS['js_include'][] = 'jquery/jquery-ui-1.8.16.custom.js';
 584$GLOBALS['js_include'][] = 'update-location.js';
 585
 586/**
 587 * holds an array of javascript code snippets to be included in the HTML header
 588 * Can be used with PMA_AddJSCode() to pass on js variables to the browser.
 589 * @global array $js_script
 590 */
 591$GLOBALS['js_script'] = array();
 592
 593/**
 594 * Add common jQuery functions script here if necessary.
 595 */
 596
 597/**
 598 * JavaScript events that will be registered
 599 * @global array $js_events
 600 */
 601$GLOBALS['js_events'] = array();
 602
 603/**
 604 * footnotes to be displayed ot the page bottom
 605 * @global array $footnotes
 606 */
 607$GLOBALS['footnotes'] = array();
 608
 609/******************************************************************************/
 610/* loading language file                       LABEL_loading_language_file    */
 611
 612/**
 613 * lang detection is done here
 614 */
 615require './libraries/select_lang.lib.php';
 616
 617/**
 618 * check for errors occurred while loading configuration
 619 * this check is done here after loading language files to present errors in locale
 620 */
 621if ($GLOBALS['PMA_Config']->error_config_file) {
 622    $error = '<h1>' . __('Failed to read configuration file') . '</h1>'
 623        . _('This usually means there is a syntax error in it, please check any errors shown below.')
 624        . '<br />'
 625        . '<br />'
 626        . '<iframe src="show_config_errors.php" />';
 627    trigger_error($error, E_USER_ERROR);
 628}
 629if ($GLOBALS['PMA_Config']->error_config_default_file) {
 630    $error = sprintf(__('Could not load default configuration from: %1$s'),
 631        $GLOBALS['PMA_Config']->default_source);
 632    trigger_error($error, E_USER_ERROR);
 633}
 634if ($GLOBALS['PMA_Config']->error_pma_uri) {
 635    trigger_error(__('The <tt>$cfg[\'PmaAbsoluteUri\']</tt> directive MUST be set in your configuration file!'), E_USER_ERROR);
 636}
 637
 638
 639/******************************************************************************/
 640/* setup servers                                       LABEL_setup_servers    */
 641
 642/**
 643 * current server
 644 * @global integer $GLOBALS['server']
 645 */
 646$GLOBALS['server'] = 0;
 647
 648/**
 649 * Servers array fixups.
 650 * $default_server comes from PMA_Config::enableBc()
 651 * @todo merge into PMA_Config
 652 */
 653// Do we have some server?
 654if (! isset($cfg['Servers']) || count($cfg['Servers']) == 0) {
 655    // No server => create one with defaults
 656    $cfg['Servers'] = array(1 => $default_server);
 657} else {
 658    // We have server(s) => apply default configuration
 659    $new_servers = array();
 660
 661    foreach ($cfg['Servers'] as $server_index => $each_server) {
 662
 663        // Detect wrong configuration
 664        if (!is_int($server_index) || $server_index < 1) {
 665            trigger_error(sprintf(__('Invalid server index: %s'), $server_index), E_USER_ERROR);
 666        }
 667
 668        $each_server = array_merge($default_server, $each_server);
 669
 670        // Don't use servers with no hostname
 671        if ($each_server['connect_type'] == 'tcp' && empty($each_server['host'])) {
 672            trigger_error(sprintf(__('Invalid hostname for server %1$s. Please review your configuration.'), $server_index), E_USER_ERROR);
 673        }
 674
 675        // Final solution to bug #582890
 676        // If we are using a socket connection
 677        // and there is nothing in the verbose server name
 678        // or the host field, then generate a name for the server
 679        // in the form of "Server 2", localized of course!
 680        if ($each_server['connect_type'] == 'socket' && empty($each_server['host']) && empty($each_server['verbose'])) {
 681            $each_server['verbose'] = __('Server') . $server_index;
 682        }
 683
 684        $new_servers[$server_index] = $each_server;
 685    }
 686    $cfg['Servers'] = $new_servers;
 687    unset($new_servers, $server_index, $each_server);
 688}
 689
 690// Cleanup
 691unset($default_server);
 692
 693
 694/******************************************************************************/
 695/* setup themes                                          LABEL_theme_setup    */
 696
 697/**
 698 * @global PMA_Theme_Manager $_SESSION['PMA_Theme_Manager']
 699 */
 700if (! isset($_SESSION['PMA_Theme_Manager'])) {
 701    $_SESSION['PMA_Theme_Manager'] = new PMA_Theme_Manager;
 702} else {
 703    /**
 704     * @todo move all __wakeup() functionality into session.inc.php
 705     */
 706    $_SESSION['PMA_Theme_Manager']->checkConfig();
 707}
 708
 709// for the theme per server feature
 710if (isset($_REQUEST['server']) && ! isset($_REQUEST['set_theme'])) {
 711    $GLOBALS['server'] = $_REQUEST['server'];
 712    $tmp = $_SESSION['PMA_Theme_Manager']->getThemeCookie();
 713    if (empty($tmp)) {
 714        $tmp = $_SESSION['PMA_Theme_Manager']->theme_default;
 715    }
 716    $_SESSION['PMA_Theme_Manager']->setActiveTheme($tmp);
 717    unset($tmp);
 718}
 719/**
 720 * @todo move into PMA_Theme_Manager::__wakeup()
 721 */
 722if (isset($_REQUEST['set_theme'])) {
 723    // if user selected a theme
 724    $_SESSION['PMA_Theme_Manager']->setActiveTheme($_REQUEST['set_theme']);
 725}
 726
 727/**
 728 * the theme object
 729 * @global PMA_Theme $_SESSION['PMA_Theme']
 730 */
 731$_SESSION['PMA_Theme'] = $_SESSION['PMA_Theme_Manager']->theme;
 732
 733// BC
 734/**
 735 * the active theme
 736 * @global string $GLOBALS['theme']
 737 */
 738$GLOBALS['theme']           = $_SESSION['PMA_Theme']->getName();
 739/**
 740 * the theme path
 741 * @global string $GLOBALS['pmaThemePath']
 742 */
 743$GLOBALS['pmaThemePath']    = $_SESSION['PMA_Theme']->getPath();
 744/**
 745 * the theme image path
 746 * @global string $GLOBALS['pmaThemeImage']
 747 */
 748$GLOBALS['pmaThemeImage']   = $_SESSION['PMA_Theme']->getImgPath();
 749
 750/**
 751 * load layout file if exists
 752 */
 753if (@file_exists($_SESSION['PMA_Theme']->getLayoutFile())) {
 754    include $_SESSION['PMA_Theme']->getLayoutFile();
 755    /**
 756     * @todo remove if all themes are update use Navi instead of Left as frame name
 757     */
 758    if (! isset($GLOBALS['cfg']['NaviWidth'])
 759     && isset($GLOBALS['cfg']['LeftWidth'])) {
 760        $GLOBALS['cfg']['NaviWidth'] = $GLOBALS['cfg']['LeftWidth'];
 761    }
 762}
 763
 764if (! defined('PMA_MINIMUM_COMMON')) {
 765    /**
 766     * Character set conversion.
 767     */
 768    include_once './libraries/charset_conversion.lib.php';
 769
 770    /**
 771     * String handling
 772     */
 773    include_once './libraries/string.lib.php';
 774
 775    /**
 776     * Lookup server by name
 777     * (see FAQ 4.8)
 778     */
 779    if (! empty($_REQUEST['server']) && is_string($_REQUEST['server'])
 780     && ! is_numeric($_REQUEST['server'])) {
 781        foreach ($cfg['Servers'] as $i => $server) {
 782            if ($server['host'] == $_REQUEST['server']) {
 783                $_REQUEST['server'] = $i;
 784                break;
 785            }
 786        }
 787        if (is_string($_REQUEST['server'])) {
 788            unset($_REQUEST['server']);
 789        }
 790        unset($i);
 791    }
 792
 793    /**
 794     * If no server is selected, make sure that $cfg['Server'] is empty (so
 795     * that nothing will work), and skip server authentication.
 796     * We do NOT exit here, but continue on without logging into any server.
 797     * This way, the welcome page will still come up (with no server info) and
 798     * present a choice of servers in the case that there are multiple servers
 799     * and '$cfg['ServerDefault'] = 0' is set.
 800     */
 801
 802    if (isset($_REQUEST['server']) && (is_string($_REQUEST['server']) || is_numeric($_REQUEST['server'])) && ! empty($_REQUEST['server']) && ! empty($cfg['Servers'][$_REQUEST['server']])) {
 803        $GLOBALS['server'] = $_REQUEST['server'];
 804        $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
 805    } else {
 806        if (!empty($cfg['Servers'][$cfg['ServerDefault']])) {
 807            $GLOBALS['server'] = $cfg['ServerDefault'];
 808            $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
 809        } else {
 810            $GLOBALS['server'] = 0;
 811            $cfg['Server'] = array();
 812        }
 813    }
 814    $GLOBALS['url_params']['server'] = $GLOBALS['server'];
 815
 816    /**
 817     * Kanji encoding convert feature appended by Y.Kawada (2002/2/20)
 818     */
 819    if (function_exists('mb_convert_encoding')
 820     && $lang == 'ja') {
 821        include_once './libraries/kanji-encoding.lib.php';
 822    } // end if
 823
 824    /**
 825     * save some settings in cookies
 826     * @todo should be done in PMA_Config
 827     */
 828    $GLOBALS['PMA_Config']->setCookie('pma_lang', $GLOBALS['lang']);
 829    if (isset($GLOBALS['collation_connection'])) {
 830        $GLOBALS['PMA_Config']->setCookie(
 831            'pma_collation_connection',
 832            $GLOBALS['collation_connection']);
 833    }
 834
 835    $_SESSION['PMA_Theme_Manager']->setThemeCookie();
 836
 837    if (! empty($cfg['Server'])) {
 838
 839        /**
 840         * Loads the proper database interface for this server
 841         */
 842        include_once './libraries/database_interface.lib.php';
 843
 844        include_once './libraries/logging.lib.php';
 845
 846        // get LoginCookieValidity from preferences cache
 847        // no generic solution for loading preferences from cache as some settings need to be kept
 848        // for processing in PMA_Config::loadUserPreferences()
 849        $cache_key = 'server_' . $GLOBALS['server'];
 850        if (isset($_SESSION['cache'][$cache_key]['userprefs']['LoginCookieValidity'])) {
 851            $value = $_SESSION['cache'][$cache_key]['userprefs']['LoginCookieValidity'];
 852            $GLOBALS['PMA_Config']->set('LoginCookieValidity', $value);
 853            $GLOBALS['cfg']['LoginCookieValidity'] = $value;
 854            unset($value);
 855        }
 856        unset($cache_key);
 857
 858        // Gets the authentication library that fits the $cfg['Server'] settings
 859        // and run authentication
 860
 861        // to allow HTTP or http
 862        $cfg['Server']['auth_type'] = strtolower($cfg['Server']['auth_type']);
 863        if (! file_exists('./libraries/auth/' . $cfg['Server']['auth_type'] . '.auth.lib.php')) {
 864            PMA_fatalError(__('Invalid authentication method set in configuration:') . ' ' . $cfg['Server']['auth_type']);
 865        }
 866        /**
 867         * the required auth type plugin
 868         */
 869        include_once './libraries/auth/' . $cfg['Server']['auth_type'] . '.auth.lib.php';
 870        if (!PMA_auth_check()) {
 871            /* Force generating of new session on login */
 872            PMA_secureSession();
 873            PMA_auth();
 874        } else {
 875            PMA_auth_set_user();
 876        }
 877
 878         // Check IP-based Allow/Deny rules as soon as possible to reject the
 879        // user
 880        // Based on mod_access in Apache:
 881        // http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/aaa/mod_access.c?rev=1.37&content-type=text/vnd.viewcvs-markup
 882        // Look at: "static int check_dir_access(request_rec *r)"
 883        if (isset($cfg['Server']['AllowDeny'])
 884                && isset($cfg['Server']['AllowDeny']['order'])) {
 885
 886            /**
 887             * ip based access library
 888             */
 889            include_once './libraries/ip_allow_deny.lib.php';
 890
 891            $allowDeny_forbidden         = false; // default
 892            if ($cfg['Server']['AllowDeny']['order'] == 'allow,deny') {
 893                $allowDeny_forbidden     = true;
 894                if (PMA_allowDeny('allow')) {
 895                    $allowDeny_forbidden = false;
 896                }
 897                if (PMA_allowDeny('deny')) {
 898                    $allowDeny_forbidden = true;
 899                }
 900            } elseif ($cfg['Server']['AllowDeny']['order'] == 'deny,allow') {
 901                if (PMA_allowDeny('deny')) {
 902                    $allowDeny_forbidden = true;
 903                }
 904                if (PMA_allowDeny('allow')) {
 905                    $allowDeny_forbidden = false;
 906                }
 907            } elseif ($cfg['Server']['AllowDeny']['order'] == 'explicit') {
 908                if (PMA_allowDeny('allow')
 909                  && !PMA_allowDeny('deny')) {
 910                    $allowDeny_forbidden = false;
 911                } else {
 912                    $allowDeny_forbidden = true;
 913                }
 914            } // end if ... elseif ... elseif
 915
 916            // Ejects the user if banished
 917            if ($allowDeny_forbidden) {
 918                PMA_log_user($cfg['Server']['user'], 'allow-denied');
 919                PMA_auth_fails();
 920            }
 921            unset($allowDeny_forbidden); //Clean up after you!
 922        } // end if
 923
 924        // is root allowed?
 925        if (!$cfg['Server']['AllowRoot'] && $cfg['Server']['user'] == 'root') {
 926            $allowDeny_forbidden = true;
 927            PMA_log_user($cfg['Server']['user'], 'root-denied');
 928            PMA_auth_fails();
 929            unset($allowDeny_forbidden); //Clean up after you!
 930        }
 931
 932        // is a login without password allowed?
 933        if (!$cfg['Server']['AllowNoPassword'] && $cfg['Server']['password'] == '') {
 934            $login_without_password_is_forbidden = true;
 935            PMA_log_user($cfg['Server']['user'], 'empty-denied');
 936            PMA_auth_fails();
 937            unset($login_without_password_is_forbidden); //Clean up after you!
 938        }
 939
 940        // if using TCP socket is not needed
 941        if (strtolower($cfg['Server']['connect_type']) == 'tcp') {
 942            $cfg['Server']['socket'] = '';
 943        }
 944
 945        // Try to connect MySQL with the control user profile (will be used to
 946        // get the privileges list for the current user but the true user link
 947        // must be open after this one so it would be default one for all the
 948        // scripts)
 949        $controllink = false;
 950        if ($cfg['Server']['controluser'] != '') {
 951            if (! empty($cfg['Server']['controlhost'])) {
 952                $controllink = PMA_DBI_connect($cfg['Server']['controluser'],
 953                    $cfg['Server']['controlpass'], true,
 954                    array('host' => $cfg['Server']['controlhost'])
 955                );
 956            } else {
 957                $controllink = PMA_DBI_connect($cfg['Server']['controluser'],
 958                    $cfg['Server']['controlpass'], true);
 959            }
 960        }
 961
 962        // Connects to the server (validates user's login)
 963        $userlink = PMA_DBI_connect($cfg['Server']['user'],
 964            $cfg['Server']['password'], false);
 965
 966        if (! $controllink) {
 967            $controllink = $userlink;
 968        }
 969
 970        /* Log success */
 971        PMA_log_user($cfg['Server']['user']);
 972
 973        /**
 974         * with phpMyAdmin 3 we support MySQL >=5
 975         * but only production releases:
 976         *  - > 5.0.15
 977         */
 978        if (PMA_MYSQL_INT_VERSION < 50015) {
 979            PMA_fatalError(__('You should upgrade to %s %s or later.'), array('MySQL', '5.0.15'));
 980        }
 981
 982        if (PMA_DRIZZLE) {
 983            // DisableIS must be set to false for Drizzle, it maps SHOW commands
 984            // to INFORMATION_SCHEMA queries anyway so it's fast on large servers
 985            $cfg['Server']['DisableIS'] = false;
 986            // SHOW OPEN TABLES is not supported by Drizzle
 987            $cfg['SkipLockedTables'] = false;
 988        }
 989
 990        /**
 991         * SQL Parser code
 992         */
 993        include_once './libraries/sqlparser.lib.php';
 994
 995        /**
 996         * SQL Validator interface code
 997         */
 998        include_once './libraries/sqlvalidator.lib.php';
 999
1000        /**
1001         * the PMA_List_Database class
1002         */
1003        include_once './libraries/PMA.php';
1004        $pma = new PMA;
1005        $pma->userlink = $userlink;
1006        $pma->controllink = $controllink;
1007
1008        /**
1009         * some resetting has to be done when switching servers
1010         */
1011        if (isset($_SESSION['tmp_user_values']['previous_server']) && $_SESSION['tmp_user_values']['previous_server'] != $GLOBALS['server']) {
1012            unset($_SESSION['tmp_user_values']['navi_limit_offset']);
1013        }
1014        $_SESSION['tmp_user_values']['previous_server'] = $GLOBALS['server'];
1015
1016    } // end server connecting
1017
1018    /**
1019     * check if profiling was requested and remember it
1020     * (note: when $cfg['ServerDefault'] = 0, constant is not defined)
1021     */
1022    if (isset($_REQUEST['profiling']) && PMA_profilingSupported()) {
1023        $_SESSION['profiling'] = true;
1024    } elseif (isset($_REQUEST['profiling_form'])) {
1025        // the checkbox was unchecked
1026        unset($_SESSION['profiling']);
1027    }
1028
1029    // library file for blobstreaming
1030    include_once './libraries/blobstreaming.lib.php';
1031
1032    // checks for blobstreaming plugins and databases that support
1033    // blobstreaming (by having the necessary tables for blobstreaming)
1034    checkBLOBStreamingPlugins();
1035
1036} // end if !defined('PMA_MINIMUM_COMMON')
1037
1038// load user preferences
1039$GLOBALS['PMA_Config']->loadUserPreferences();
1040
1041// remove sensitive values from session
1042$GLOBALS['PMA_Config']->set('blowfish_secret', '');
1043$GLOBALS['PMA_Config']->set('Servers', '');
1044$GLOBALS['PMA_Config']->set('default_server', '');
1045
1046/* Tell tracker that it can actually work */
1047PMA_Tracker::enable();
1048
1049/**
1050 * @global boolean $GLOBALS['is_ajax_request']
1051 * @todo should this be moved to the variables init section above?
1052 *
1053 * Check if the current request is an AJAX request, and set is_ajax_request
1054 * accordingly.  Suppress headers, footers and unnecessary output if set to
1055 * true
1056 */
1057if (isset($_REQUEST['ajax_request']) && $_REQUEST['ajax_request'] == true) {
1058    $GLOBALS['is_ajax_request'] = true;
1059} else {
1060    $GLOBALS['is_ajax_request'] = false;
1061}
1062
1063/**
1064 * @global  boolean $GLOBALS['grid_edit']
1065 *
1066 * Set to true if this is a request made during an grid edit process.  This
1067 * request is made to retrieve the non-truncated/transformed values.
1068 */
1069if (isset($_REQUEST['grid_edit']) && $_REQUEST['grid_edit'] == true) {
1070    $GLOBALS['grid_edit'] = true;
1071} else {
1072    $GLOBALS['grid_edit'] = false;
1073}
1074
1075if (!empty($__redirect) && in_array($__redirect, $goto_whitelist)) {
1076    /**
1077     * include subform target page
1078     */
1079    include $__redirect;
1080    exit();
1081}
1082?>