1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
|
<?php
/* vim: set expandtab sw=4 ts=4 sts=4: */
/**
* Core functions used all over the scripts.
* This script is distinct from libraries/common.inc.php because this
* script is called from /test.
*
* @version $Id$
*/
/**
* checks given $var and returns it if valid, or $default of not valid
* given $var is also checked for type being 'similar' as $default
* or against any other type if $type is provided
*
* <code>
* // $_REQUEST['db'] not set
* echo PMA_ifSetOr($_REQUEST['db'], ''); // ''
* // $_REQUEST['sql_query'] not set
* echo PMA_ifSetOr($_REQUEST['sql_query']); // null
* // $cfg['ForceSSL'] not set
* echo PMA_ifSetOr($cfg['ForceSSL'], false, 'boolean'); // false
* echo PMA_ifSetOr($cfg['ForceSSL']); // null
* // $cfg['ForceSSL'] set to 1
* echo PMA_ifSetOr($cfg['ForceSSL'], false, 'boolean'); // false
* echo PMA_ifSetOr($cfg['ForceSSL'], false, 'similar'); // 1
* echo PMA_ifSetOr($cfg['ForceSSL'], false); // 1
* // $cfg['ForceSSL'] set to true
* echo PMA_ifSetOr($cfg['ForceSSL'], false, 'boolean'); // true
* </code>
*
* @todo create some testsuites
* @uses PMA_isValid()
* @see PMA_isValid()
* @param mixed $var param to check
* @param mixed $default default value
* @param mixed $type var type or array of values to check against $var
* @return mixed $var or $default
*/
function PMA_ifSetOr(&$var, $default = null, $type = 'similar')
{
if (! PMA_isValid($var, $type, $default)) {
return $default;
}
return $var;
}
/**
* checks given $var against $type or $compare
*
* $type can be:
* - false : no type checking
* - 'scalar' : whether type of $var is integer, float, string or boolean
* - 'numeric' : whether type of $var is any number repesentation
* - 'length' : whether type of $var is scalar with a string length > 0
* - 'similar' : whether type of $var is similar to type of $compare
* - 'equal' : whether type of $var is identical to type of $compare
* - 'identical' : whether $var is identical to $compare, not only the type!
* - or any other valid PHP variable type
*
* <code>
* // $_REQUEST['doit'] = true;
* PMA_isValid($_REQUEST['doit'], 'identical', 'true'); // false
* // $_REQUEST['doit'] = 'true';
* PMA_isValid($_REQUEST['doit'], 'identical', 'true'); // true
* </code>
*
* NOTE: call-by-reference is used to not get NOTICE on undefined vars,
* but the var is not altered inside this function, also after checking a var
* this var exists nut is not set, example:
* <code>
* // $var is not set
* isset($var); // false
* functionCallByReference($var); // false
* isset($var); // true
* functionCallByReference($var); // true
* </code>
*
* to avoid this we set this var to null if not isset
*
* @todo create some testsuites
* @todo add some more var types like hex, bin, ...?
* @uses is_scalar()
* @uses is_numeric()
* @uses is_array()
* @uses in_array()
* @uses gettype()
* @uses strtolower()
* @see http://php.net/gettype
* @param mixed $var variable to check
* @param mixed $type var type or array of valid values to check against $var
* @param mixed $compare var to compare with $var
* @return boolean whether valid or not
*/
function PMA_isValid(&$var, $type = 'length', $compare = null)
{
if (! isset($var)) {
// var is not even set
return false;
}
if ($type === false) {
// no vartype requested
return true;
}
if (is_array($type)) {
return in_array($var, $type);
}
// allow some aliaes of var types
$type = strtolower($type);
switch ($type) {
case 'identic' :
$type = 'identical';
break;
case 'len' :
$type = 'length';
break;
case 'bool' :
$type = 'boolean';
break;
case 'float' :
$type = 'double';
break;
case 'int' :
$type = 'integer';
break;
case 'null' :
$type = 'NULL';
break;
}
if ($type === 'identical') {
return $var === $compare;
}
// whether we should check against given $compare
if ($type === 'similar') {
switch (gettype($compare)) {
case 'string':
case 'boolean':
$type = 'scalar';
break;
case 'integer':
case 'double':
$type = 'numeric';
break;
default:
$type = gettype($compare);
}
} elseif ($type === 'equal') {
$type = gettype($compare);
}
// do the check
if ($type === 'length' || $type === 'scalar') {
$is_scalar = is_scalar($var);
if ($is_scalar && $type === 'length') {
return (bool) strlen($var);
}
return $is_scalar;
}
if ($type === 'numeric') {
return is_numeric($var);
}
if (gettype($var) === $type) {
return true;
}
return false;
}
/**
* Removes insecure parts in a path; used before include() or
* require() when a part of the path comes from an insecure source
* like a cookie or form.
*
* @param string The path to check
*
* @return string The secured path
*
* @access public
* @author Marc Delisle (lem9@users.sourceforge.net)
*/
function PMA_securePath($path)
{
// change .. to .
$path = preg_replace('@\.\.*@', '.', $path);
return $path;
} // end function
/**
* displays the given error message on phpMyAdmin error page in foreign language,
* ends script execution and closes session
*
* loads language file if not loaded already
*
* @todo use detected argument separator (PMA_Config)
* @uses $GLOBALS['session_name']
* @uses $GLOBALS['text_dir']
* @uses $GLOBALS['strError']
* @uses $GLOBALS['available_languages']
* @uses $GLOBALS['lang']
* @uses PMA_removeCookie()
* @uses select_lang.lib.php
* @uses $_COOKIE
* @uses substr()
* @uses header()
* @uses http_build_query()
* @uses is_string()
* @uses sprintf()
* @uses vsprintf()
* @uses strtr()
* @uses defined()
* @param string $error_message the error message or named error message
* @param string|array $message_args arguments applied to $error_message
* @return exit
*/
function PMA_fatalError($error_message, $message_args = null)
{
// it could happen PMA_fatalError() is called before language file is loaded
if (! isset($GLOBALS['available_languages'])) {
$GLOBALS['cfg'] = array(
'DefaultLang' => 'en-utf-8',
'AllowAnywhereRecoding' => false);
// Loads the language file
require_once './libraries/select_lang.lib.php';
if (isset($strError)) {
$GLOBALS['strError'] = $strError;
} else {
$GLOBALS['strError'] = 'Error';
}
// $text_dir is set in lang/language-utf-8.inc.php
if (isset($text_dir)) {
$GLOBALS['text_dir'] = $text_dir;
}
}
// $error_message could be a language string identifier: strString
if (substr($error_message, 0, 3) === 'str') {
if (isset($$error_message)) {
$error_message = $$error_message;
} elseif (isset($GLOBALS[$error_message])) {
$error_message = $GLOBALS[$error_message];
}
}
if (is_string($message_args)) {
$error_message = sprintf($error_message, $message_args);
} elseif (is_array($message_args)) {
$error_message = vsprintf($error_message, $message_args);
}
$error_message = strtr($error_message, array('<br />' => '[br]'));
// Displays the error message
// (do not use & for parameters sent by header)
$query_params = array(
'lang' => $GLOBALS['available_languages'][$GLOBALS['lang']][2],
'dir' => $GLOBALS['text_dir'],
'type' => $GLOBALS['strError'],
'error' => $error_message,
);
header('Location: ' . (defined('PMA_SETUP') ? '../' : '') . 'error.php?'
. http_build_query($query_params, null, '&'));
// on fatal errors it cannot hurt to always delete the current session
if (isset($GLOBALS['session_name']) && isset($_COOKIE[$GLOBALS['session_name']])) {
PMA_removeCookie($GLOBALS['session_name']);
}
exit;
}
/**
* returns count of tables in given db
*
* @uses PMA_DBI_try_query()
* @uses PMA_backquote()
* @uses PMA_DBI_QUERY_STORE()
* @uses PMA_DBI_num_rows()
* @uses PMA_DBI_free_result()
* @param string $db database to count tables for
* @return integer count of tables in $db
*/
function PMA_getTableCount($db)
{
$tables = PMA_DBI_try_query(
'SHOW TABLES FROM ' . PMA_backquote($db) . ';',
null, PMA_DBI_QUERY_STORE);
if ($tables) {
$num_tables = PMA_DBI_num_rows($tables);
// for blobstreaming - get blobstreaming tables
// for use in determining if a table here is a blobstreaming table - rajk
// load PMA configuration
$PMA_Config = $_SESSION['PMA_Config'];
// if PMA configuration exists
if (!empty($PMA_Config))
{
// load BS tables
$session_bs_tables = $_SESSION['PMA_Config']->get('BLOBSTREAMING_TABLES');
// if BS tables exist
if (isset ($session_bs_tables))
while ($data = PMA_DBI_fetch_assoc($tables))
foreach ($session_bs_tables as $table_key=>$table_val)
// if the table is a blobstreaming table, reduce the table count
if ($data['Tables_in_' . $db] == $table_key)
{
if ($num_tables > 0)
$num_tables--;
break;
}
} // end if PMA configuration exists
PMA_DBI_free_result($tables);
} else {
$num_tables = 0;
}
return $num_tables;
}
/**
* Converts numbers like 10M into bytes
* Used with permission from Moodle (http://moodle.org) by Martin Dougiamas
* (renamed with PMA prefix to avoid double definition when embedded
* in Moodle)
*
* @uses each()
* @uses strlen()
* @uses substr()
* @param string $size
* @return integer $size
*/
function PMA_get_real_size($size = 0)
{
if (! $size) {
return 0;
}
$scan['gb'] = 1073741824; //1024 * 1024 * 1024;
$scan['g'] = 1073741824; //1024 * 1024 * 1024;
$scan['mb'] = 1048576;
$scan['m'] = 1048576;
$scan['kb'] = 1024;
$scan['k'] = 1024;
$scan['b'] = 1;
foreach ($scan as $unit => $factor) {
if (strlen($size) > strlen($unit)
&& strtolower(substr($size, strlen($size) - strlen($unit))) == $unit) {
return substr($size, 0, strlen($size) - strlen($unit)) * $factor;
}
}
return $size;
} // end function PMA_get_real_size()
/**
* merges array recursive like array_merge_recursive() but keyed-values are
* always overwritten.
*
* array PMA_array_merge_recursive(array $array1[, array $array2[, array ...]])
*
* @see http://php.net/array_merge
* @see http://php.net/array_merge_recursive
* @uses func_num_args()
* @uses func_get_arg()
* @uses is_array()
* @uses call_user_func_array()
* @param array array to merge
* @param array array to merge
* @param array ...
* @return array merged array
*/
function PMA_array_merge_recursive()
{
switch(func_num_args()) {
case 0 :
return false;
break;
case 1 :
// when does that happen?
return func_get_arg(0);
break;
case 2 :
$args = func_get_args();
if (!is_array($args[0]) || !is_array($args[1])) {
return $args[1];
}
foreach ($args[1] as $key2 => $value2) {
if (isset($args[0][$key2]) && !is_int($key2)) {
$args[0][$key2] = PMA_array_merge_recursive($args[0][$key2],
$value2);
} else {
// we erase the parent array, otherwise we cannot override a directive that
// contains array elements, like this:
// (in config.default.php) $cfg['ForeignKeyDropdownOrder'] = array('id-content','content-id');
// (in config.inc.php) $cfg['ForeignKeyDropdownOrder'] = array('content-id');
if (is_int($key2) && $key2 == 0) {
unset($args[0]);
}
$args[0][$key2] = $value2;
}
}
return $args[0];
break;
default :
$args = func_get_args();
$args[1] = PMA_array_merge_recursive($args[0], $args[1]);
array_shift($args);
return call_user_func_array('PMA_array_merge_recursive', $args);
break;
}
}
/**
* calls $function vor every element in $array recursively
*
* this function is protected against deep recursion attack CVE-2006-1549,
* 1000 seems to be more than enough
*
* @see http://www.php-security.org/MOPB/MOPB-02-2007.html
* @see http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1549
*
* @uses PMA_arrayWalkRecursive()
* @uses is_array()
* @uses is_string()
* @param array $array array to walk
* @param string $function function to call for every array element
*/
function PMA_arrayWalkRecursive(&$array, $function, $apply_to_keys_also = false)
{
static $recursive_counter = 0;
if (++$recursive_counter > 1000) {
die('possible deep recursion attack');
}
foreach ($array as $key => $value) {
if (is_array($value)) {
PMA_arrayWalkRecursive($array[$key], $function, $apply_to_keys_also);
} else {
$array[$key] = $function($value);
}
if ($apply_to_keys_also && is_string($key)) {
$new_key = $function($key);
if ($new_key != $key) {
$array[$new_key] = $array[$key];
unset($array[$key]);
}
}
}
$recursive_counter--;
}
/**
* boolean phpMyAdmin.PMA_checkPageValidity(string &$page, array $whitelist)
*
* checks given given $page against given $whitelist and returns true if valid
* it ignores optionaly query paramters in $page (script.php?ignored)
*
* @uses in_array()
* @uses urldecode()
* @uses substr()
* @uses strpos()
* @param string &$page page to check
* @param array $whitelist whitelist to check page against
* @return boolean whether $page is valid or not (in $whitelist or not)
*/
function PMA_checkPageValidity(&$page, $whitelist)
{
if (! isset($page) || !is_string($page)) {
return false;
}
if (in_array($page, $whitelist)) {
return true;
} elseif (in_array(substr($page, 0, strpos($page . '?', '?')), $whitelist)) {
return true;
} else {
$_page = urldecode($page);
if (in_array(substr($_page, 0, strpos($_page . '?', '?')), $whitelist)) {
return true;
}
}
return false;
}
/**
* trys to find the value for the given environment vriable name
*
* searchs in $_SERVER, $_ENV than trys getenv() and apache_getenv()
* in this order
*
* @uses $_SERVER
* @uses $_ENV
* @uses getenv()
* @uses function_exists()
* @uses apache_getenv()
* @param string $var_name variable name
* @return string value of $var or empty string
*/
function PMA_getenv($var_name) {
if (isset($_SERVER[$var_name])) {
return $_SERVER[$var_name];
} elseif (isset($_ENV[$var_name])) {
return $_ENV[$var_name];
} elseif (getenv($var_name)) {
return getenv($var_name);
} elseif (function_exists('apache_getenv')
&& apache_getenv($var_name, true)) {
return apache_getenv($var_name, true);
}
return '';
}
/**
* removes cookie
*
* @uses PMA_Config::isHttps()
* @uses PMA_Config::getCookiePath()
* @uses setcookie()
* @uses time()
* @param string $cookie name of cookie to remove
* @return boolean result of setcookie()
*/
function PMA_removeCookie($cookie)
{
return setcookie($cookie, '', time() - 3600,
PMA_Config::getCookiePath(), '', PMA_Config::isHttps());
}
/**
* sets cookie if value is different from current cokkie value,
* or removes if value is equal to default
*
* @uses PMA_Config::isHttps()
* @uses PMA_Config::getCookiePath()
* @uses $_COOKIE
* @uses PMA_removeCookie()
* @uses setcookie()
* @uses time()
* @param string $cookie name of cookie to remove
* @param mixed $value new cookie value
* @param string $default default value
* @param int $validity validity of cookie in seconds (default is one month)
* @param bool $httponlt whether cookie is only for HTTP (and not for scripts)
* @return boolean result of setcookie()
*/
function PMA_setCookie($cookie, $value, $default = null, $validity = null, $httponly = true)
{
if ($validity == null) {
$validity = 2592000;
}
if (strlen($value) && null !== $default && $value === $default
&& isset($_COOKIE[$cookie])) {
// remove cookie, default value is used
return PMA_removeCookie($cookie);
}
if (! strlen($value) && isset($_COOKIE[$cookie])) {
// remove cookie, value is empty
return PMA_removeCookie($cookie);
}
if (! isset($_COOKIE[$cookie]) || $_COOKIE[$cookie] !== $value) {
// set cookie with new value
/* Calculate cookie validity */
if ($validity == 0) {
$v = 0;
} else {
$v = time() + $validity;
}
return setcookie($cookie, $value, $v,
PMA_Config::getCookiePath(), '', PMA_Config::isHttps(), $httponly);
}
// cookie has already $value as value
return true;
}
?>
|