· 8 years ago · Jan 20, 2018, 09:46 AM
1<?php
2/* vim: set expandtab sw=4 ts=4 sts=4: */
3/**
4 * Misc stuff and REQUIRED by ALL the scripts.
5 * MUST be included by every script
6 *
7 * Among other things, it contains the advanced authentication work.
8 *
9 * Order of sections for common.inc.php:
10 *
11 * the authentication libraries must be before the connection to db
12 *
13 * ... so the required order is:
14 *
15 * LABEL_variables_init
16 * - initialize some variables always needed
17 * LABEL_parsing_config_file
18 * - parsing of the configuration file
19 * LABEL_loading_language_file
20 * - loading language file
21 * LABEL_setup_servers
22 * - check and setup configured servers
23 * LABEL_theme_setup
24 * - setting up themes
25 *
26 * - load of MySQL extension (if necessary)
27 * - loading of an authentication library
28 * - db connection
29 * - authentication work
30 *
31 * @package PhpMyAdmin
32 */
33
34/**
35 * block attempts to directly run this script
36 */
37if (getcwd() == dirname(__FILE__)) {
38 die('Attack stopped');
39}
40
41/**
42 * Minimum PHP version; can't call PMA_fatalError() which uses a
43 * PHP 5 function, so cannot easily localize this message.
44 */
45if (version_compare(PHP_VERSION, '5.3.0', 'lt')) {
46 die('PHP 5.3+ is required');
47}
48
49/**
50 * for verification in all procedural scripts under libraries
51 */
52define('PHPMYADMIN', true);
53
54/**
55 * the error handler
56 */
57require './libraries/Error_Handler.class.php';
58
59/**
60 * initialize the error handler
61 */
62$GLOBALS['error_handler'] = new PMA_Error_Handler();
63$cfg['Error_Handler']['display'] = true;
64
65/**
66 * This setting was removed in PHP 5.4. But at this point PMA_PHP_INT_VERSION
67 * is not yet defined so we use another way to find out the PHP version.
68 */
69if (version_compare(phpversion(), '5.4', 'lt')) {
70 /**
71 * Avoid problems with magic_quotes_runtime
72 */
73 @ini_set('magic_quotes_runtime', false);
74}
75
76/**
77 * core functions
78 */
79require './libraries/core.lib.php';
80
81/**
82 * Input sanitizing
83 */
84require './libraries/sanitizing.lib.php';
85
86/**
87 * Warning about mbstring.
88 */
89if (! function_exists('mb_detect_encoding')) {
90 PMA_warnMissingExtension('mbstring', $fatal = true);
91}
92
93/**
94 * the PMA_Theme class
95 */
96require './libraries/Theme.class.php';
97
98/**
99 * the PMA_Theme_Manager class
100 */
101require './libraries/Theme_Manager.class.php';
102
103/**
104 * the PMA_Config class
105 */
106require './libraries/Config.class.php';
107
108/**
109 * the relation lib, tracker needs it
110 */
111require './libraries/relation.lib.php';
112
113/**
114 * the PMA_Tracker class
115 */
116require './libraries/Tracker.class.php';
117
118/**
119 * the PMA_Table class
120 */
121require './libraries/Table.class.php';
122
123/**
124 * the PMA_Types class
125 */
126require './libraries/Types.class.php';
127
128if (! defined('PMA_MINIMUM_COMMON')) {
129 /**
130 * common functions
131 */
132 include_once './libraries/Util.class.php';
133
134 /**
135 * JavaScript escaping.
136 */
137 include_once './libraries/js_escape.lib.php';
138
139 /**
140 * Include URL/hidden inputs generating.
141 */
142 include_once './libraries/url_generating.lib.php';
143
144 /**
145 * Used to generate the page
146 */
147 include_once 'libraries/Response.class.php';
148}
149
150/******************************************************************************/
151/* start procedural code label_start_procedural */
152
153/**
154 * PATH_INFO could be compromised if set, so remove it from PHP_SELF
155 * and provide a clean PHP_SELF here
156 */
157$PMA_PHP_SELF = PMA_getenv('PHP_SELF');
158$_PATH_INFO = PMA_getenv('PATH_INFO');
159if (! empty($_PATH_INFO) && ! empty($PMA_PHP_SELF)) {
160 $path_info_pos = strrpos($PMA_PHP_SELF, $_PATH_INFO);
161 if ($path_info_pos + strlen($_PATH_INFO) === strlen($PMA_PHP_SELF)) {
162 $PMA_PHP_SELF = substr($PMA_PHP_SELF, 0, $path_info_pos);
163 }
164}
165$PMA_PHP_SELF = htmlspecialchars($PMA_PHP_SELF);
166
167
168/**
169 * just to be sure there was no import (registering) before here
170 * we empty the global space (but avoid unsetting $variables_list
171 * and $key in the foreach (), we still need them!)
172 */
173$variables_whitelist = array (
174 'GLOBALS',
175 '_SERVER',
176 '_GET',
177 '_POST',
178 '_REQUEST',
179 '_FILES',
180 '_ENV',
181 '_COOKIE',
182 '_SESSION',
183 'error_handler',
184 'PMA_PHP_SELF',
185 'variables_whitelist',
186 'key'
187);
188
189foreach (get_defined_vars() as $key => $value) {
190 if (! in_array($key, $variables_whitelist)) {
191 unset($$key);
192 }
193}
194unset($key, $value, $variables_whitelist);
195
196
197/**
198 * Subforms - some functions need to be called by form, cause of the limited URL
199 * length, but if this functions inside another form you cannot just open a new
200 * form - so phpMyAdmin uses 'arrays' inside this form
201 *
202 * <code>
203 * <form ...>
204 * ... main form elments ...
205 * <input type="hidden" name="subform[action1][id]" value="1" />
206 * ... other subform data ...
207 * <input type="submit" name="usesubform[action1]" value="do action1" />
208 * ... other subforms ...
209 * <input type="hidden" name="subform[actionX][id]" value="X" />
210 * ... other subform data ...
211 * <input type="submit" name="usesubform[actionX]" value="do actionX" />
212 * ... main form elments ...
213 * <input type="submit" name="main_action" value="submit form" />
214 * </form>
215 * </code>
216 *
217 * so we now check if a subform is submitted
218 */
219$__redirect = null;
220if (isset($_POST['usesubform'])) {
221 // if a subform is present and should be used
222 // the rest of the form is deprecated
223 $subform_id = key($_POST['usesubform']);
224 $subform = $_POST['subform'][$subform_id];
225 $_POST = $subform;
226 $_REQUEST = $subform;
227 /**
228 * some subforms need another page than the main form, so we will just
229 * include this page at the end of this script - we use $__redirect to
230 * track this
231 */
232 if (isset($_POST['redirect'])
233 && $_POST['redirect'] != basename($PMA_PHP_SELF)
234 ) {
235 $__redirect = $_POST['redirect'];
236 unset($_POST['redirect']);
237 }
238 unset($subform_id, $subform);
239} else {
240 // Note: here we overwrite $_REQUEST so that it does not contain cookies,
241 // because another application for the same domain could have set
242 // a cookie (with a compatible path) that overrides a variable
243 // we expect from GET or POST.
244 // We'll refer to cookies explicitly with the $_COOKIE syntax.
245 $_REQUEST = array_merge($_GET, $_POST);
246}
247// end check if a subform is submitted
248
249/**
250 * This setting was removed in PHP 5.4. But at this point PMA_PHP_INT_VERSION
251 * is not yet defined so we use another way to find out the PHP version.
252 */
253if (version_compare(phpversion(), '5.4', 'lt')) {
254 // remove quotes added by PHP
255 if (function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc()) {
256 PMA_arrayWalkRecursive($_GET, 'stripslashes', true);
257 PMA_arrayWalkRecursive($_POST, 'stripslashes', true);
258 PMA_arrayWalkRecursive($_COOKIE, 'stripslashes', true);
259 PMA_arrayWalkRecursive($_REQUEST, 'stripslashes', true);
260 }
261}
262
263/**
264 * check timezone setting
265 * this could produce an E_STRICT - but only once,
266 * if not done here it will produce E_STRICT on every date/time function
267 * (starting with PHP 5.3, this code can produce E_WARNING rather than
268 * E_STRICT)
269 *
270 */
271date_default_timezone_set(@date_default_timezone_get());
272
273/******************************************************************************/
274/* parsing configuration file LABEL_parsing_config_file */
275
276/**
277 * We really need this one!
278 */
279if (! function_exists('preg_replace')) {
280 PMA_warnMissingExtension('pcre', true);
281}
282
283/**
284 * JSON is required in several places.
285 */
286if (! function_exists('json_encode')) {
287 PMA_warnMissingExtension('json', true);
288}
289
290/**
291 * @global PMA_Config $GLOBALS['PMA_Config']
292 * force reading of config file, because we removed sensitive values
293 * in the previous iteration
294 */
295$GLOBALS['PMA_Config'] = new PMA_Config(CONFIG_FILE);
296
297if (!defined('PMA_MINIMUM_COMMON')) {
298 $GLOBALS['PMA_Config']->checkPmaAbsoluteUri();
299}
300
301/**
302 * BC - enable backward compatibility
303 * exports all configuration settings into $GLOBALS ($GLOBALS['cfg'])
304 */
305$GLOBALS['PMA_Config']->enableBc();
306
307/**
308 * clean cookies on upgrade
309 * when changing something related to PMA cookies, increment the cookie version
310 */
311$pma_cookie_version = 4;
312if (isset($_COOKIE)
313 && (isset($_COOKIE['pmaCookieVer'])
314 && $_COOKIE['pmaCookieVer'] < $pma_cookie_version)
315) {
316 // delete all cookies
317 foreach ($_COOKIE as $cookie_name => $tmp) {
318 $GLOBALS['PMA_Config']->removeCookie($cookie_name);
319 }
320 $_COOKIE = array();
321 $GLOBALS['PMA_Config']->setCookie('pmaCookieVer', $pma_cookie_version);
322}
323
324
325/**
326 * check HTTPS connection
327 */
328if ($GLOBALS['PMA_Config']->get('ForceSSL')
329 && ! $GLOBALS['PMA_Config']->get('is_https')
330) {
331 // grab SSL URL
332 $url = $GLOBALS['PMA_Config']->getSSLUri();
333 // Actually redirect
334 PMA_sendHeaderLocation($url . PMA_URL_getCommon($_GET, 'text'));
335 // delete the current session, otherwise we get problems (see bug #2397877)
336 $GLOBALS['PMA_Config']->removeCookie($GLOBALS['session_name']);
337 exit;
338}
339
340
341/**
342 * include session handling after the globals, to prevent overwriting
343 */
344require './libraries/session.inc.php';
345
346/**
347 * init some variables LABEL_variables_init
348 */
349
350/**
351 * holds parameters to be passed to next page
352 * @global array $GLOBALS['url_params']
353 */
354$GLOBALS['url_params'] = array();
355
356/**
357 * the whitelist for $GLOBALS['goto']
358 * @global array $goto_whitelist
359 */
360$goto_whitelist = array(
361 //'browse_foreigners.php',
362 //'changelog.php',
363 //'chk_rel.php',
364 'db_create.php',
365 'db_datadict.php',
366 'db_sql.php',
367 'db_events.php',
368 'db_export.php',
369 'db_importdocsql.php',
370 'db_qbe.php',
371 'db_structure.php',
372 'db_import.php',
373 'db_operations.php',
374 'db_printview.php',
375 'db_search.php',
376 'db_routines.php',
377 'export.php',
378 'import.php',
379 //'index.php',
380 //'navigation.php',
381 //'license.php',
382 'index.php',
383 'pdf_pages.php',
384 'pdf_schema.php',
385 //'phpinfo.php',
386 'querywindow.php',
387 'server_binlog.php',
388 'server_collations.php',
389 'server_databases.php',
390 'server_engines.php',
391 'server_export.php',
392 'server_import.php',
393 'server_privileges.php',
394 'server_sql.php',
395 'server_status.php',
396 'server_status_advisor.php',
397 'server_status_monitor.php',
398 'server_status_queries.php',
399 'server_status_variables.php',
400 'server_variables.php',
401 'sql.php',
402 'tbl_addfield.php',
403 'tbl_change.php',
404 'tbl_create.php',
405 'tbl_import.php',
406 'tbl_indexes.php',
407 'tbl_move_copy.php',
408 'tbl_printview.php',
409 'tbl_sql.php',
410 'tbl_export.php',
411 'tbl_operations.php',
412 'tbl_structure.php',
413 'tbl_relation.php',
414 'tbl_replace.php',
415 'tbl_row_action.php',
416 'tbl_select.php',
417 'tbl_zoom_select.php',
418 //'themes.php',
419 'transformation_overview.php',
420 'transformation_wrapper.php',
421 'user_password.php',
422);
423
424/**
425 * check $__redirect against whitelist
426 */
427if (! PMA_checkPageValidity($__redirect, $goto_whitelist)) {
428 $__redirect = null;
429}
430
431/**
432 * holds page that should be displayed
433 * @global string $GLOBALS['goto']
434 */
435$GLOBALS['goto'] = '';
436// Security fix: disallow accessing serious server files via "?goto="
437if (PMA_checkPageValidity($_REQUEST['goto'], $goto_whitelist)) {
438 $GLOBALS['goto'] = $_REQUEST['goto'];
439 $GLOBALS['url_params']['goto'] = $_REQUEST['goto'];
440} else {
441 unset($_REQUEST['goto'], $_GET['goto'], $_POST['goto'], $_COOKIE['goto']);
442}
443
444/**
445 * returning page
446 * @global string $GLOBALS['back']
447 */
448if (PMA_checkPageValidity($_REQUEST['back'], $goto_whitelist)) {
449 $GLOBALS['back'] = $_REQUEST['back'];
450} else {
451 unset($_REQUEST['back'], $_GET['back'], $_POST['back'], $_COOKIE['back']);
452}
453
454/**
455 * Check whether user supplied token is valid, if not remove any possibly
456 * dangerous stuff from request.
457 *
458 * remember that some objects in the session with session_start and __wakeup()
459 * could access this variables before we reach this point
460 * f.e. PMA_Config: fontsize
461 *
462 * @todo variables should be handled by their respective owners (objects)
463 * f.e. lang, server, collation_connection in PMA_Config
464 */
465$token_mismatch = true;
466if (PMA_isValid($_REQUEST['token'])) {
467 $token_mismatch = ($_SESSION[' PMA_token '] != $_REQUEST['token']);
468}
469
470if ($token_mismatch) {
471 /**
472 * List of parameters which are allowed from unsafe source
473 */
474 $allow_list = array(
475 /* needed for direct access, see FAQ 1.34
476 * also, server needed for cookie login screen (multi-server)
477 */
478 'server', 'db', 'table', 'target', 'lang',
479 /* Session ID */
480 'phpMyAdmin',
481 /* Cookie preferences */
482 'pma_lang', 'pma_collation_connection',
483 /* Possible login form */
484 'pma_servername', 'pma_username', 'pma_password',
485 'recaptcha_challenge_field', 'recaptcha_response_field',
486 /* Needed to send the correct reply */
487 'ajax_request',
488 /* Permit to log out even if there is a token mismatch */
489 'old_usr'
490 );
491 /**
492 * Allow changing themes in test/theme.php
493 */
494 if (defined('PMA_TEST_THEME')) {
495 $allow_list[] = 'set_theme';
496 }
497 /**
498 * Require cleanup functions
499 */
500 include './libraries/cleanup.lib.php';
501 /**
502 * Do actual cleanup
503 */
504 PMA_removeRequestVars($allow_list);
505
506}
507
508
509/**
510 * current selected database
511 * @global string $GLOBALS['db']
512 */
513$GLOBALS['db'] = '';
514if (PMA_isValid($_REQUEST['db'])) {
515 // can we strip tags from this?
516 // only \ and / is not allowed in db names for MySQL
517 $GLOBALS['db'] = $_REQUEST['db'];
518 $GLOBALS['url_params']['db'] = $GLOBALS['db'];
519}
520
521/**
522 * current selected table
523 * @global string $GLOBALS['table']
524 */
525$GLOBALS['table'] = '';
526if (PMA_isValid($_REQUEST['table'])) {
527 // can we strip tags from this?
528 // only \ and / is not allowed in table names for MySQL
529 $GLOBALS['table'] = $_REQUEST['table'];
530 $GLOBALS['url_params']['table'] = $GLOBALS['table'];
531}
532
533/**
534 * Store currently selected recent table.
535 * Affect $GLOBALS['db'] and $GLOBALS['table']
536 */
537if (PMA_isValid($_REQUEST['selected_recent_table'])) {
538 $recent_table = json_decode($_REQUEST['selected_recent_table'], true);
539 $GLOBALS['db'] = $recent_table['db'];
540 $GLOBALS['url_params']['db'] = $GLOBALS['db'];
541 $GLOBALS['table'] = $recent_table['table'];
542 $GLOBALS['url_params']['table'] = $GLOBALS['table'];
543}
544
545/**
546 * SQL query to be executed
547 * @global string $GLOBALS['sql_query']
548 */
549$GLOBALS['sql_query'] = '';
550if (PMA_isValid($_REQUEST['sql_query'])) {
551 $GLOBALS['sql_query'] = $_REQUEST['sql_query'];
552}
553
554//$_REQUEST['set_theme'] // checked later in this file LABEL_theme_setup
555//$_REQUEST['server']; // checked later in this file
556//$_REQUEST['lang']; // checked by LABEL_loading_language_file
557
558/******************************************************************************/
559/* loading language file LABEL_loading_language_file */
560
561/**
562 * lang detection is done here
563 */
564require './libraries/select_lang.lib.php';
565
566// Defines the cell alignment values depending on text direction
567if ($GLOBALS['text_dir'] == 'ltr') {
568 $GLOBALS['cell_align_left'] = 'left';
569 $GLOBALS['cell_align_right'] = 'right';
570} else {
571 $GLOBALS['cell_align_left'] = 'right';
572 $GLOBALS['cell_align_right'] = 'left';
573}
574
575/**
576 * check for errors occurred while loading configuration
577 * this check is done here after loading language files to present errors in locale
578 */
579$GLOBALS['PMA_Config']->checkPermissions();
580
581if ($GLOBALS['PMA_Config']->error_config_file) {
582 $error = '[strong]' . __('Failed to read configuration file') . '[/strong]'
583 . '[br][br]'
584 . __('This usually means there is a syntax error in it, please check any errors shown below.')
585 . '[br][br]'
586 . '[conferr]';
587 trigger_error($error, E_USER_ERROR);
588}
589if ($GLOBALS['PMA_Config']->error_config_default_file) {
590 $error = sprintf(
591 __('Could not load default configuration from: %1$s'),
592 $GLOBALS['PMA_Config']->default_source
593 );
594 trigger_error($error, E_USER_ERROR);
595}
596if ($GLOBALS['PMA_Config']->error_pma_uri) {
597 trigger_error(
598 __('The [code]$cfg[\'PmaAbsoluteUri\'][/code] directive MUST be set in your configuration file!'),
599 E_USER_ERROR
600 );
601}
602
603
604/******************************************************************************/
605/* setup servers LABEL_setup_servers */
606
607/**
608 * current server
609 * @global integer $GLOBALS['server']
610 */
611$GLOBALS['server'] = 0;
612
613/**
614 * Servers array fixups.
615 * $default_server comes from PMA_Config::enableBc()
616 * @todo merge into PMA_Config
617 */
618// Do we have some server?
619if (! isset($cfg['Servers']) || count($cfg['Servers']) == 0) {
620 // No server => create one with defaults
621 $cfg['Servers'] = array(1 => $default_server);
622} else {
623 // We have server(s) => apply default configuration
624 $new_servers = array();
625
626 foreach ($cfg['Servers'] as $server_index => $each_server) {
627
628 // Detect wrong configuration
629 if (!is_int($server_index) || $server_index < 1) {
630 trigger_error(
631 sprintf(__('Invalid server index: %s'), $server_index),
632 E_USER_ERROR
633 );
634 }
635
636 $each_server = array_merge($default_server, $each_server);
637
638 // Don't use servers with no hostname
639 if ($each_server['connect_type'] == 'tcp' && empty($each_server['host'])) {
640 trigger_error(
641 sprintf(
642 __('Invalid hostname for server %1$s. Please review your configuration.'),
643 $server_index
644 ),
645 E_USER_ERROR
646 );
647 }
648
649 // Final solution to bug #582890
650 // If we are using a socket connection
651 // and there is nothing in the verbose server name
652 // or the host field, then generate a name for the server
653 // in the form of "Server 2", localized of course!
654 if ($each_server['connect_type'] == 'socket'
655 && empty($each_server['host'])
656 && empty($each_server['verbose'])
657 ) {
658 $each_server['verbose'] = sprintf(__('Server %d'), $server_index);
659 }
660
661 $new_servers[$server_index] = $each_server;
662 }
663 $cfg['Servers'] = $new_servers;
664 unset($new_servers, $server_index, $each_server);
665}
666
667// Cleanup
668unset($default_server);
669
670
671/******************************************************************************/
672/* setup themes LABEL_theme_setup */
673
674/**
675 * @global PMA_Theme_Manager $_SESSION['PMA_Theme_Manager']
676 */
677if (! isset($_SESSION['PMA_Theme_Manager'])) {
678 $_SESSION['PMA_Theme_Manager'] = new PMA_Theme_Manager;
679} else {
680 /**
681 * @todo move all __wakeup() functionality into session.inc.php
682 */
683 $_SESSION['PMA_Theme_Manager']->checkConfig();
684}
685
686// for the theme per server feature
687if (isset($_REQUEST['server']) && ! isset($_REQUEST['set_theme'])) {
688 $GLOBALS['server'] = $_REQUEST['server'];
689 $tmp = $_SESSION['PMA_Theme_Manager']->getThemeCookie();
690 if (empty($tmp)) {
691 $tmp = $_SESSION['PMA_Theme_Manager']->theme_default;
692 }
693 $_SESSION['PMA_Theme_Manager']->setActiveTheme($tmp);
694 unset($tmp);
695}
696/**
697 * @todo move into PMA_Theme_Manager::__wakeup()
698 */
699if (isset($_REQUEST['set_theme'])) {
700 // if user selected a theme
701 $_SESSION['PMA_Theme_Manager']->setActiveTheme($_REQUEST['set_theme']);
702}
703
704/**
705 * the theme object
706 * @global PMA_Theme $_SESSION['PMA_Theme']
707 */
708$_SESSION['PMA_Theme'] = $_SESSION['PMA_Theme_Manager']->theme;
709
710// BC
711/**
712 * the active theme
713 * @global string $GLOBALS['theme']
714 */
715$GLOBALS['theme'] = $_SESSION['PMA_Theme']->getName();
716/**
717 * the theme path
718 * @global string $GLOBALS['pmaThemePath']
719 */
720$GLOBALS['pmaThemePath'] = $_SESSION['PMA_Theme']->getPath();
721/**
722 * the theme image path
723 * @global string $GLOBALS['pmaThemeImage']
724 */
725$GLOBALS['pmaThemeImage'] = $_SESSION['PMA_Theme']->getImgPath();
726
727/**
728 * load layout file if exists
729 */
730if (@file_exists($_SESSION['PMA_Theme']->getLayoutFile())) {
731 include $_SESSION['PMA_Theme']->getLayoutFile();
732}
733
734if (! defined('PMA_MINIMUM_COMMON')) {
735 /**
736 * Character set conversion.
737 */
738 include_once './libraries/charset_conversion.lib.php';
739
740 /**
741 * String handling
742 */
743 include_once './libraries/string.inc.php';
744
745 /**
746 * Lookup server by name
747 * (see FAQ 4.8)
748 */
749 if (! empty($_REQUEST['server'])
750 && is_string($_REQUEST['server'])
751 && ! is_numeric($_REQUEST['server'])
752 ) {
753 foreach ($cfg['Servers'] as $i => $server) {
754 if ($server['host'] == $_REQUEST['server']
755 || $server['verbose'] == $_REQUEST['server']
756 || $PMA_String->strtolower($server['verbose']) == $PMA_String->strtolower($_REQUEST['server'])
757 || md5($PMA_String->strtolower($server['verbose'])) == $PMA_String->strtolower($_REQUEST['server'])
758 ) {
759 $_REQUEST['server'] = $i;
760 break;
761 }
762 }
763 if (is_string($_REQUEST['server'])) {
764 unset($_REQUEST['server']);
765 }
766 unset($i);
767 }
768
769 /**
770 * If no server is selected, make sure that $cfg['Server'] is empty (so
771 * that nothing will work), and skip server authentication.
772 * We do NOT exit here, but continue on without logging into any server.
773 * This way, the welcome page will still come up (with no server info) and
774 * present a choice of servers in the case that there are multiple servers
775 * and '$cfg['ServerDefault'] = 0' is set.
776 */
777
778 if (isset($_REQUEST['server'])
779 && (is_string($_REQUEST['server']) || is_numeric($_REQUEST['server']))
780 && ! empty($_REQUEST['server'])
781 && ! empty($cfg['Servers'][$_REQUEST['server']])
782 ) {
783 $GLOBALS['server'] = $_REQUEST['server'];
784 $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
785 } else {
786 if (!empty($cfg['Servers'][$cfg['ServerDefault']])) {
787 $GLOBALS['server'] = $cfg['ServerDefault'];
788 $cfg['Server'] = $cfg['Servers'][$GLOBALS['server']];
789 } else {
790 $GLOBALS['server'] = 0;
791 $cfg['Server'] = array();
792 }
793 }
794 $GLOBALS['url_params']['server'] = $GLOBALS['server'];
795
796 /**
797 * Kanji encoding convert feature appended by Y.Kawada (2002/2/20)
798 */
799 if (function_exists('mb_convert_encoding')
800 && $lang == 'ja'
801 ) {
802 include_once './libraries/kanji-encoding.lib.php';
803 } // end if
804
805 /**
806 * save some settings in cookies
807 * @todo should be done in PMA_Config
808 */
809 $GLOBALS['PMA_Config']->setCookie('pma_lang', $GLOBALS['lang']);
810 if (isset($GLOBALS['collation_connection'])) {
811 $GLOBALS['PMA_Config']->setCookie(
812 'pma_collation_connection',
813 $GLOBALS['collation_connection']
814 );
815 }
816
817 $_SESSION['PMA_Theme_Manager']->setThemeCookie();
818
819 if (! empty($cfg['Server'])) {
820
821 /**
822 * Loads the proper database interface for this server
823 */
824 include_once './libraries/database_interface.inc.php';
825
826 include_once './libraries/logging.lib.php';
827
828 // get LoginCookieValidity from preferences cache
829 // no generic solution for loading preferences from cache as some settings
830 // need to be kept for processing in PMA_Config::loadUserPreferences()
831 $cache_key = 'server_' . $GLOBALS['server'];
832 if (isset($_SESSION['cache'][$cache_key]['userprefs']['LoginCookieValidity'])) {
833 $value = $_SESSION['cache'][$cache_key]['userprefs']['LoginCookieValidity'];
834 $GLOBALS['PMA_Config']->set('LoginCookieValidity', $value);
835 $GLOBALS['cfg']['LoginCookieValidity'] = $value;
836 unset($value);
837 }
838 unset($cache_key);
839
840 // Gets the authentication library that fits the $cfg['Server'] settings
841 // and run authentication
842
843 // to allow HTTP or http
844 $cfg['Server']['auth_type'] = strtolower($cfg['Server']['auth_type']);
845
846 /**
847 * the required auth type plugin
848 */
849 $auth_class = "Authentication" . ucfirst($cfg['Server']['auth_type']);
850 if (! file_exists(
851 './libraries/plugins/auth/'
852 . $auth_class . '.class.php'
853 )) {
854 PMA_fatalError(
855 __('Invalid authentication method set in configuration:')
856 . ' ' . $cfg['Server']['auth_type']
857 );
858 }
859 include_once './libraries/plugins/auth/' . $auth_class . '.class.php';
860 // todo: add plugin manager
861 $plugin_manager = null;
862 $auth_plugin = new $auth_class($plugin_manager);
863
864 if (! $auth_plugin->authCheck()) {
865 /* Force generating of new session on login */
866 PMA_secureSession();
867 $auth_plugin->auth();
868 } else {
869 $auth_plugin->authSetUser();
870 }
871
872 // Check IP-based Allow/Deny rules as soon as possible to reject the
873 // user
874 // Based on mod_access in Apache:
875 // http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/aaa/mod_access.c?rev=1.37&content-type=text/vnd.viewcvs-markup
876 // Look at: "static int check_dir_access(request_rec *r)"
877 if (isset($cfg['Server']['AllowDeny'])
878 && isset($cfg['Server']['AllowDeny']['order'])
879 ) {
880
881 /**
882 * ip based access library
883 */
884 include_once './libraries/ip_allow_deny.lib.php';
885
886 $allowDeny_forbidden = false; // default
887 if ($cfg['Server']['AllowDeny']['order'] == 'allow,deny') {
888 $allowDeny_forbidden = true;
889 if (PMA_allowDeny('allow')) {
890 $allowDeny_forbidden = false;
891 }
892 if (PMA_allowDeny('deny')) {
893 $allowDeny_forbidden = true;
894 }
895 } elseif ($cfg['Server']['AllowDeny']['order'] == 'deny,allow') {
896 if (PMA_allowDeny('deny')) {
897 $allowDeny_forbidden = true;
898 }
899 if (PMA_allowDeny('allow')) {
900 $allowDeny_forbidden = false;
901 }
902 } elseif ($cfg['Server']['AllowDeny']['order'] == 'explicit') {
903 if (PMA_allowDeny('allow') && ! PMA_allowDeny('deny')) {
904 $allowDeny_forbidden = false;
905 } else {
906 $allowDeny_forbidden = true;
907 }
908 } // end if ... elseif ... elseif
909
910 // Ejects the user if banished
911 if ($allowDeny_forbidden) {
912 PMA_logUser($cfg['Server']['user'], 'allow-denied');
913 $auth_plugin->authFails();
914 }
915 } // end if
916
917 // is root allowed?
918 if (! $cfg['Server']['AllowRoot'] && $cfg['Server']['user'] == 'root') {
919 $allowDeny_forbidden = true;
920 PMA_logUser($cfg['Server']['user'], 'root-denied');
921 $auth_plugin->authFails();
922 }
923
924 // is a login without password allowed?
925 if (! $cfg['Server']['AllowNoPassword']
926 && $cfg['Server']['password'] == ''
927 ) {
928 $login_without_password_is_forbidden = true;
929 PMA_logUser($cfg['Server']['user'], 'empty-denied');
930 $auth_plugin->authFails();
931 }
932
933 // if using TCP socket is not needed
934 if (strtolower($cfg['Server']['connect_type']) == 'tcp') {
935 $cfg['Server']['socket'] = '';
936 }
937
938 // Try to connect MySQL with the control user profile (will be used to
939 // get the privileges list for the current user but the true user link
940 // must be open after this one so it would be default one for all the
941 // scripts)
942 $controllink = false;
943 if ($cfg['Server']['controluser'] != '') {
944 if (! empty($cfg['Server']['controlhost'])
945 || ! empty($cfg['Server']['controlport'])
946 ) {
947 $server_details = array();
948 if (! empty($cfg['Server']['controlhost'])) {
949 $server_details['host'] = $cfg['Server']['controlhost'];
950 } else {
951 $server_details['host'] = $cfg['Server']['host'];
952 }
953 if (! empty($cfg['Server']['controlport'])) {
954 $server_details['port'] = $cfg['Server']['controlport'];
955 } elseif ($server_details['host'] == $cfg['Server']['host']) {
956 // Evaluates to true when controlhost == host
957 // or controlhost is not defined (hence it defaults to host)
958 // In such case we can use the value of port.
959 $server_details['port'] = $cfg['Server']['port'];
960 }
961 // otherwise we leave the $server_details['port'] unset,
962 // allowing it to take default mysql port
963
964 $controllink = $GLOBALS['dbi']->connect(
965 $cfg['Server']['controluser'],
966 $cfg['Server']['controlpass'],
967 true,
968 $server_details
969 );
970 } else {
971 $controllink = $GLOBALS['dbi']->connect(
972 $cfg['Server']['controluser'],
973 $cfg['Server']['controlpass'],
974 true
975 );
976 }
977 }
978
979 // Connects to the server (validates user's login)
980 $userlink = $GLOBALS['dbi']->connect(
981 $cfg['Server']['user'], $cfg['Server']['password'], false
982 );
983
984 if (! $controllink) {
985 $controllink = $userlink;
986 }
987
988 /* Log success */
989 PMA_logUser($cfg['Server']['user']);
990
991 /**
992 * with phpMyAdmin 3 we support MySQL >=5
993 * but only production releases:
994 * - > 5.0.15
995 */
996 if (PMA_MYSQL_INT_VERSION < 50015) {
997 PMA_fatalError(
998 __('You should upgrade to %s %s or later.'),
999 array('MySQL', '5.0.15')
1000 );
1001 }
1002
1003 /**
1004 * Type handling object.
1005 */
1006 if (PMA_DRIZZLE) {
1007 $GLOBALS['PMA_Types'] = new PMA_Types_Drizzle();
1008 } else {
1009 $GLOBALS['PMA_Types'] = new PMA_Types_MySQL();
1010 }
1011
1012 if (PMA_DRIZZLE) {
1013 // SHOW OPEN TABLES is not supported by Drizzle
1014 $cfg['SkipLockedTables'] = false;
1015 }
1016
1017 /**
1018 * SQL Parser code
1019 */
1020 include_once './libraries/sqlparser.lib.php';
1021
1022 /**
1023 * SQL Validator interface code
1024 */
1025 include_once './libraries/sqlvalidator.lib.php';
1026
1027 /**
1028 * the PMA_List_Database class
1029 */
1030 include_once './libraries/PMA.php';
1031 $pma = new PMA;
1032 $pma->userlink = $userlink;
1033 $pma->controllink = $controllink;
1034
1035 /**
1036 * some resetting has to be done when switching servers
1037 */
1038 if (isset($_SESSION['tmpval']['previous_server'])
1039 && $_SESSION['tmpval']['previous_server'] != $GLOBALS['server']
1040 ) {
1041 unset($_SESSION['tmpval']['navi_limit_offset']);
1042 }
1043 $_SESSION['tmpval']['previous_server'] = $GLOBALS['server'];
1044
1045 } // end server connecting
1046
1047 /**
1048 * check if profiling was requested and remember it
1049 * (note: when $cfg['ServerDefault'] = 0, constant is not defined)
1050 */
1051 if (isset($_REQUEST['profiling'])
1052 && PMA_Util::profilingSupported()
1053 ) {
1054 $_SESSION['profiling'] = true;
1055 } elseif (isset($_REQUEST['profiling_form'])) {
1056 // the checkbox was unchecked
1057 unset($_SESSION['profiling']);
1058 }
1059 /**
1060 * Inclusion of profiling scripts is needed on various
1061 * pages like sql, tbl_sql, db_sql, tbl_select
1062 */
1063 if (! defined('PMA_BYPASS_GET_INSTANCE')) {
1064 $response = PMA_Response::getInstance();
1065 }
1066 if (isset($_SESSION['profiling'])) {
1067 $header = $response->getHeader();
1068 $scripts = $header->getScripts();
1069 $scripts->addFile('jqplot/jquery.jqplot.js');
1070 $scripts->addFile('jqplot/plugins/jqplot.pieRenderer.js');
1071 $scripts->addFile('jqplot/plugins/jqplot.highlighter.js');
1072 $scripts->addFile('canvg/canvg.js');
1073 $scripts->addFile('jquery/jquery.tablesorter.js');
1074 }
1075
1076 /*
1077 * There is no point in even attempting to process
1078 * an ajax request if there is a token mismatch
1079 */
1080 if (isset($response) && $response->isAjax() && $token_mismatch) {
1081 $response->isSuccess(false);
1082 $response->addJSON(
1083 'message',
1084 PMA_Message::error(__('Error: Token mismatch'))
1085 );
1086 exit;
1087 }
1088} // end if !defined('PMA_MINIMUM_COMMON')
1089
1090// load user preferences
1091$GLOBALS['PMA_Config']->loadUserPreferences();
1092
1093// remove sensitive values from session
1094$GLOBALS['PMA_Config']->set('blowfish_secret', '');
1095$GLOBALS['PMA_Config']->set('Servers', '');
1096$GLOBALS['PMA_Config']->set('default_server', '');
1097
1098/* Tell tracker that it can actually work */
1099PMA_Tracker::enable();
1100
1101/**
1102 * @global boolean $GLOBALS['is_ajax_request']
1103 * @todo should this be moved to the variables init section above?
1104 *
1105 * Check if the current request is an AJAX request, and set is_ajax_request
1106 * accordingly. Suppress headers, footers and unnecessary output if set to
1107 * true
1108 */
1109if (isset($_REQUEST['ajax_request']) && $_REQUEST['ajax_request'] == true) {
1110 $GLOBALS['is_ajax_request'] = true;
1111} else {
1112 $GLOBALS['is_ajax_request'] = false;
1113}
1114
1115if (isset($_REQUEST['GLOBALS']) || isset($_FILES['GLOBALS'])) {
1116 PMA_fatalError(__("GLOBALS overwrite attempt"));
1117}
1118
1119/**
1120 * protect against possible exploits - there is no need to have so much variables
1121 */
1122if (count($_REQUEST) > 1000) {
1123 PMA_fatalError(__('possible exploit'));
1124}
1125
1126/**
1127 * Check for numeric keys
1128 * (if register_globals is on, numeric key can be found in $GLOBALS)
1129 */
1130foreach ($GLOBALS as $key => $dummy) {
1131 if (is_numeric($key)) {
1132 PMA_fatalError(__('numeric key detected'));
1133 }
1134}
1135unset($dummy);
1136
1137// here, the function does not exist with this configuration:
1138// $cfg['ServerDefault'] = 0;
1139$GLOBALS['is_superuser']
1140 = isset($GLOBALS['dbi']) && $GLOBALS['dbi']->isSuperuser();
1141
1142if (!empty($__redirect) && in_array($__redirect, $goto_whitelist)) {
1143 /**
1144 * include subform target page
1145 */
1146 include $__redirect;
1147 exit();
1148}
1149
1150?>