?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Merge branch 'QA_3_4'
[phpmyadmin/last10db.git] / server_privileges.php
blobdaf8a990ba0edb42964e9850b55061f3e48696fc
1 <?php
2 /* vim: set expandtab sw=4 ts=4 sts=4: */
3 /**
4 *
5 * @package phpMyAdmin
6 */
7
8 /**
9 *
10 */
11 require_once './libraries/common.inc.php';
12
13 /**
14 * Does the common work
15 */
16 $GLOBALS['js_include'][] = 'server_privileges.js';
17 $GLOBALS['js_include'][] = 'functions.js';
18 $GLOBALS['js_include'][] = 'jquery/jquery-ui-1.8.custom.js';
19
20 require './libraries/server_common.inc.php';
21
22 if ($GLOBALS['cfg']['AjaxEnable']) {
23 $conditional_class = 'ajax';
24 } else {
25 $conditional_class = '';
26 }
27
28 /**
29 * Messages are built using the message name
30 */
31 $strPrivDescAllPrivileges = __('Includes all privileges except GRANT.');
32 $strPrivDescAlter = __('Allows altering the structure of existing tables.');
33 $strPrivDescAlterRoutine = __('Allows altering and dropping stored routines.');
34 $strPrivDescCreateDb = __('Allows creating new databases and tables.');
35 $strPrivDescCreateRoutine = __('Allows creating stored routines.');
36 $strPrivDescCreateTbl = __('Allows creating new tables.');
37 $strPrivDescCreateTmpTable = __('Allows creating temporary tables.');
38 $strPrivDescCreateUser = __('Allows creating, dropping and renaming user accounts.');
39 $strPrivDescCreateView = __('Allows creating new views.');
40 $strPrivDescDelete = __('Allows deleting data.');
41 $strPrivDescDropDb = __('Allows dropping databases and tables.');
42 $strPrivDescDropTbl = __('Allows dropping tables.');
43 $strPrivDescEvent = __('Allows to set up events for the event scheduler');
44 $strPrivDescExecute = __('Allows executing stored routines.');
45 $strPrivDescFile = __('Allows importing data from and exporting data into files.');
46 $strPrivDescGrant = __('Allows adding users and privileges without reloading the privilege tables.');
47 $strPrivDescIndex = __('Allows creating and dropping indexes.');
48 $strPrivDescInsert = __('Allows inserting and replacing data.');
49 $strPrivDescLockTables = __('Allows locking tables for the current thread.');
50 $strPrivDescMaxConnections = __('Limits the number of new connections the user may open per hour.');
51 $strPrivDescMaxQuestions = __('Limits the number of queries the user may send to the server per hour.');
52 $strPrivDescMaxUpdates = __('Limits the number of commands that change any table or database the user may execute per hour.');
53 $strPrivDescMaxUserConnections = __('Limits the number of simultaneous connections the user may have.');
54 $strPrivDescProcess = __('Allows viewing processes of all users');
55 $strPrivDescReferences = __('Has no effect in this MySQL version.');
56 $strPrivDescReload = __('Allows reloading server settings and flushing the server\'s caches.');
57 $strPrivDescReplClient = __('Allows the user to ask where the slaves / masters are.');
58 $strPrivDescReplSlave = __('Needed for the replication slaves.');
59 $strPrivDescSelect = __('Allows reading data.');
60 $strPrivDescShowDb = __('Gives access to the complete list of databases.');
61 $strPrivDescShowView = __('Allows performing SHOW CREATE VIEW queries.');
62 $strPrivDescShutdown = __('Allows shutting down the server.');
63 $strPrivDescSuper = __('Allows connecting, even if maximum number of connections is reached; required for most administrative operations like setting global variables or killing threads of other users.');
64 $strPrivDescTrigger = __('Allows creating and dropping triggers');
65 $strPrivDescUpdate = __('Allows changing data.');
66 $strPrivDescUsage = __('No privileges.');
67
68 /**
69 * Checks if a dropdown box has been used for selecting a database / table
70 */
71 if (PMA_isValid($_REQUEST['pred_tablename'])) {
72 $tablename = $_REQUEST['pred_tablename'];
73 unset($pred_tablename);
74 } elseif (PMA_isValid($_REQUEST['tablename'])) {
75 $tablename = $_REQUEST['tablename'];
76 } else {
77 unset($tablename);
78 }
79
80 if (PMA_isValid($_REQUEST['pred_dbname'])) {
81 $dbname = $_REQUEST['pred_dbname'];
82 unset($pred_dbname);
83 } elseif (PMA_isValid($_REQUEST['dbname'])) {
84 $dbname = $_REQUEST['dbname'];
85 } else {
86 unset($dbname);
87 unset($tablename);
88 }
89
90 if (isset($dbname)) {
91 $db_and_table = PMA_backquote(PMA_unescape_mysql_wildcards($dbname)) . '.';
92 if (isset($tablename)) {
93 $db_and_table .= PMA_backquote($tablename);
94 } else {
95 $db_and_table .= '*';
96 }
97 } else {
98 $db_and_table = '*.*';
99 }
100
101 // check if given $dbname is a wildcard or not
102 if (isset($dbname)) {
103 //if (preg_match('/\\\\(?:_|%)/i', $dbname)) {
104 if (preg_match('/(?<!\\\\)(?:_|%)/i', $dbname)) {
105 $dbname_is_wildcard = true;
106 } else {
107 $dbname_is_wildcard = false;
108 }
109 }
110
111 /**
112 * Checks if the user is allowed to do what he tries to...
113 */
114 if (!$is_superuser) {
115 require './libraries/server_links.inc.php';
116 echo '<h2>' . "\n"
117 . PMA_getIcon('b_usrlist.png')
118 . __('Privileges') . "\n"
119 . '</h2>' . "\n";
120 PMA_Message::error(__('No Privileges'))->display();
121 require './libraries/footer.inc.php';
122 }
123
124 $random_n = mt_rand(0,1000000); // a random number that will be appended to the id of the user forms
125
126 /**
127 * Escapes wildcard in a database+table specification
128 * before using it in a GRANT statement.
129 *
130 * Escaping a wildcard character in a GRANT is only accepted at the global
131 * or database level, not at table level; this is why I remove
132 * the escaping character. Internally, in mysql.tables_priv.Db there are
133 * no escaping (for example test_db) but in mysql.db you'll see test\_db
134 * for a db-specific privilege.
135 *
136 * @param string $db_and_table
137 * @param string $dbname
138 * @param string $tablename
139 * @return string the escaped (if necessary) $db_and_table
140 */
141 function PMA_WildcardEscapeForGrant($db_and_table, $dbname, $tablename) {
142
143 if (! strlen($dbname)) {
144 $db_and_table = '*.*';
145 } else {
146 if (strlen($tablename)) {
147 $db_and_table = PMA_backquote(PMA_unescape_mysql_wildcards($dbname)) . '.';
148 $db_and_table .= PMA_backquote($tablename);
149 } else {
150 $db_and_table = PMA_backquote($dbname) . '.';
151 $db_and_table .= '*';
152 }
153 }
154 return $db_and_table;
155 }
156
157 /**
158 * Generates a condition on the user name
159 *
160 * @param string the user's initial
161 * @return string the generated condition
162 */
163 function PMA_RangeOfUsers($initial = '')
164 {
165 // strtolower() is used because the User field
166 // might be BINARY, so LIKE would be case sensitive
167 if (!empty($initial)) {
168 $ret = " WHERE `User` LIKE '" . PMA_sqlAddslashes($initial) . "%'"
169 . " OR `User` LIKE '" . PMA_sqlAddslashes(strtolower($initial)) . "%'";
170 } else {
171 $ret = '';
172 }
173 return $ret;
174 } // end function
175
176 /**
177 * Extracts the privilege information of a priv table row
178 *
179 * @param array $row the row
180 * @param boolean $enableHTML add <dfn> tag with tooltips
181 *
182 * @global resource $user_link the database connection
183 *
184 * @return array
185 */
186 function PMA_extractPrivInfo($row = '', $enableHTML = FALSE)
187 {
188 $grants = array(
189 array('Select_priv', 'SELECT', __('Allows reading data.')),
190 array('Insert_priv', 'INSERT', __('Allows inserting and replacing data.')),
191 array('Update_priv', 'UPDATE', __('Allows changing data.')),
192 array('Delete_priv', 'DELETE', __('Allows deleting data.')),
193 array('Create_priv', 'CREATE', __('Allows creating new databases and tables.')),
194 array('Drop_priv', 'DROP', __('Allows dropping databases and tables.')),
195 array('Reload_priv', 'RELOAD', __('Allows reloading server settings and flushing the server\'s caches.')),
196 array('Shutdown_priv', 'SHUTDOWN', __('Allows shutting down the server.')),
197 array('Process_priv', 'PROCESS', __('Allows viewing processes of all users')),
198 array('File_priv', 'FILE', __('Allows importing data from and exporting data into files.')),
199 array('References_priv', 'REFERENCES', __('Has no effect in this MySQL version.')),
200 array('Index_priv', 'INDEX', __('Allows creating and dropping indexes.')),
201 array('Alter_priv', 'ALTER', __('Allows altering the structure of existing tables.')),
202 array('Show_db_priv', 'SHOW DATABASES', __('Gives access to the complete list of databases.')),
203 array('Super_priv', 'SUPER', __('Allows connecting, even if maximum number of connections is reached; required for most administrative operations like setting global variables or killing threads of other users.')),
204 array('Create_tmp_table_priv', 'CREATE TEMPORARY TABLES', __('Allows creating temporary tables.')),
205 array('Lock_tables_priv', 'LOCK TABLES', __('Allows locking tables for the current thread.')),
206 array('Repl_slave_priv', 'REPLICATION SLAVE', __('Needed for the replication slaves.')),
207 array('Repl_client_priv', 'REPLICATION CLIENT', __('Allows the user to ask where the slaves / masters are.')),
208 array('Create_view_priv', 'CREATE VIEW', __('Allows creating new views.')),
209 array('Event_priv', 'EVENT', __('Allows to set up events for the event scheduler')),
210 array('Trigger_priv', 'TRIGGER', __('Allows creating and dropping triggers')),
211 // for table privs:
212 array('Create View_priv', 'CREATE VIEW', __('Allows creating new views.')),
213 array('Show_view_priv', 'SHOW VIEW', __('Allows performing SHOW CREATE VIEW queries.')),
214 // for table privs:
215 array('Show view_priv', 'SHOW VIEW', __('Allows performing SHOW CREATE VIEW queries.')),
216 array('Create_routine_priv', 'CREATE ROUTINE', __('Allows creating stored routines.')),
217 array('Alter_routine_priv', 'ALTER ROUTINE', __('Allows altering and dropping stored routines.')),
218 array('Create_user_priv', 'CREATE USER', __('Allows creating, dropping and renaming user accounts.')),
219 array('Execute_priv', 'EXECUTE', __('Allows executing stored routines.')),
220 );
221
222 if (!empty($row) && isset($row['Table_priv'])) {
223 $row1 = PMA_DBI_fetch_single_row(
224 'SHOW COLUMNS FROM `mysql`.`tables_priv` LIKE \'Table_priv\';',
225 'ASSOC', $GLOBALS['userlink']);
226 $av_grants = explode('\',\'', substr($row1['Type'], 5, strlen($row1['Type']) - 7));
227 unset($row1);
228 $users_grants = explode(',', $row['Table_priv']);
229 foreach ($av_grants as $current_grant) {
230 $row[$current_grant . '_priv'] = in_array($current_grant, $users_grants) ? 'Y' : 'N';
231 }
232 unset($current_grant);
233 unset($av_grants);
234 unset($users_grants);
235 }
236 $privs = array();
237 $allPrivileges = TRUE;
238 foreach ($grants as $current_grant) {
239 if ((!empty($row) && isset($row[$current_grant[0]]))
240 || (empty($row) && isset($GLOBALS[$current_grant[0]]))) {
241 if ((!empty($row) && $row[$current_grant[0]] == 'Y')
242 || (empty($row)
243 && ($GLOBALS[$current_grant[0]] == 'Y'
244 || (is_array($GLOBALS[$current_grant[0]])
245 && count($GLOBALS[$current_grant[0]]) == $GLOBALS['column_count']
246 && empty($GLOBALS[$current_grant[0] . '_none'])))))
247 {
248 if ($enableHTML) {
249 $privs[] = '<dfn title="' . $current_grant[2] . '">' . $current_grant[1] . '</dfn>';
250 } else {
251 $privs[] = $current_grant[1];
252 }
253 } elseif (!empty($GLOBALS[$current_grant[0]])
254 && is_array($GLOBALS[$current_grant[0]])
255 && empty($GLOBALS[$current_grant[0] . '_none'])) {
256 if ($enableHTML) {
257 $priv_string = '<dfn title="' . $current_grant[2] . '">' . $current_grant[1] . '</dfn>';
258 } else {
259 $priv_string = $current_grant[1];
260 }
261 $privs[] = $priv_string . ' (`' . join('`, `', $GLOBALS[$current_grant[0]]) . '`)';
262 } else {
263 $allPrivileges = FALSE;
264 }
265 }
266 }
267 if (empty($privs)) {
268 if ($enableHTML) {
269 $privs[] = '<dfn title="' . __('No privileges.') . '">USAGE</dfn>';
270 } else {
271 $privs[] = 'USAGE';
272 }
273 } elseif ($allPrivileges && (! isset($GLOBALS['grant_count']) || count($privs) == $GLOBALS['grant_count'])) {
274 if ($enableHTML) {
275 $privs = array('<dfn title="' . __('Includes all privileges except GRANT.') . '">ALL PRIVILEGES</dfn>');
276 } else {
277 $privs = array('ALL PRIVILEGES');
278 }
279 }
280 return $privs;
281 } // end of the 'PMA_extractPrivInfo()' function
282
283 /**
284 * Displays on which column(s) a table-specific privilege is granted
285 */
286 function PMA_display_column_privs($columns, $row, $name_for_select,
287 $priv_for_header, $name, $name_for_dfn, $name_for_current)
288 {
289 echo ' <div class="item" id="div_item_' . $name . '">' . "\n"
290 . ' <label for="select_' . $name . '_priv">' . "\n"
291 . ' <tt><dfn title="' . $name_for_dfn . '">'
292 . $priv_for_header . '</dfn></tt>' . "\n"
293 . ' </label><br />' . "\n"
294 . ' <select id="select_' . $name . '_priv" name="'
295 . $name_for_select . '[]" multiple="multiple" size="8">' . "\n";
296
297 foreach ($columns as $current_column => $current_column_privileges) {
298 echo ' <option value="' . htmlspecialchars($current_column) . '"';
299 if ($row[$name_for_select] == 'Y' || $current_column_privileges[$name_for_current]) {
300 echo ' selected="selected"';
301 }
302 echo '>' . htmlspecialchars($current_column) . '</option>' . "\n";
303 }
304
305 echo ' </select>' . "\n"
306 . ' <i>' . __('Or') . '</i>' . "\n"
307 . ' <label for="checkbox_' . $name_for_select
308 . '_none"><input type="checkbox"'
309 . (empty($GLOBALS['checkall']) ? '' : ' checked="checked"')
310 . ' name="' . $name_for_select . '_none" id="checkbox_'
311 . $name_for_select . '_none" title="' . _pgettext('None privileges', 'None') . '" />'
312 . _pgettext('None privileges', 'None') . '</label>' . "\n"
313 . ' </div>' . "\n";
314 } // end function
315
316
317 /**
318 * Displays the privileges form table
319 *
320 * @param string $db the database
321 * @param string $table the table
322 * @param boolean $submit wheather to display the submit button or not
323 * @global array $cfg the phpMyAdmin configuration
324 * @global ressource $user_link the database connection
325 *
326 * @return void
327 */
328 function PMA_displayPrivTable($db = '*', $table = '*', $submit = TRUE)
329 {
330 global $random_n;
331
332 if ($db == '*') {
333 $table = '*';
334 }
335
336 if (isset($GLOBALS['username'])) {
337 $username = $GLOBALS['username'];
338 $hostname = $GLOBALS['hostname'];
339 if ($db == '*') {
340 $sql_query =
341 "SELECT * FROM `mysql`.`user`"
342 ." WHERE `User` = '" . PMA_sqlAddslashes($username) . "'"
343 ." AND `Host` = '" . PMA_sqlAddslashes($hostname) . "';";
344 } elseif ($table == '*') {
345 $sql_query =
346 "SELECT * FROM `mysql`.`db`"
347 ." WHERE `User` = '" . PMA_sqlAddslashes($username) . "'"
348 ." AND `Host` = '" . PMA_sqlAddslashes($hostname) . "'"
349 ." AND '" . PMA_unescape_mysql_wildcards($db) . "'"
350 ." LIKE `Db`;";
351 } else {
352 $sql_query =
353 "SELECT `Table_priv`"
354 ." FROM `mysql`.`tables_priv`"
355 ." WHERE `User` = '" . PMA_sqlAddslashes($username) . "'"
356 ." AND `Host` = '" . PMA_sqlAddslashes($hostname) . "'"
357 ." AND `Db` = '" . PMA_unescape_mysql_wildcards($db) . "'"
358 ." AND `Table_name` = '" . PMA_sqlAddslashes($table) . "';";
359 }
360 $row = PMA_DBI_fetch_single_row($sql_query);
361 }
362 if (empty($row)) {
363 if ($table == '*') {
364 if ($db == '*') {
365 $sql_query = 'SHOW COLUMNS FROM `mysql`.`user`;';
366 } elseif ($table == '*') {
367 $sql_query = 'SHOW COLUMNS FROM `mysql`.`db`;';
368 }
369 $res = PMA_DBI_query($sql_query);
370 while ($row1 = PMA_DBI_fetch_row($res)) {
371 if (substr($row1[0], 0, 4) == 'max_') {
372 $row[$row1[0]] = 0;
373 } else {
374 $row[$row1[0]] = 'N';
375 }
376 }
377 PMA_DBI_free_result($res);
378 } else {
379 $row = array('Table_priv' => '');
380 }
381 }
382 if (isset($row['Table_priv'])) {
383 $row1 = PMA_DBI_fetch_single_row(
384 'SHOW COLUMNS FROM `mysql`.`tables_priv` LIKE \'Table_priv\';',
385 'ASSOC', $GLOBALS['userlink']);
386 // note: in MySQL 5.0.3 we get "Create View', 'Show view';
387 // the View for Create is spelled with uppercase V
388 // the view for Show is spelled with lowercase v
389 // and there is a space between the words
390
391 $av_grants = explode('\',\'', substr($row1['Type'], strpos($row1['Type'], '(') + 2, strpos($row1['Type'], ')') - strpos($row1['Type'], '(') - 3));
392 unset($row1);
393 $users_grants = explode(',', $row['Table_priv']);
394
395 foreach ($av_grants as $current_grant) {
396 $row[$current_grant . '_priv'] = in_array($current_grant, $users_grants) ? 'Y' : 'N';
397 }
398 unset($row['Table_priv'], $current_grant, $av_grants, $users_grants);
399
400 // get collumns
401 $res = PMA_DBI_try_query('SHOW COLUMNS FROM ' . PMA_backquote(PMA_unescape_mysql_wildcards($db)) . '.' . PMA_backquote($table) . ';');
402 $columns = array();
403 if ($res) {
404 while ($row1 = PMA_DBI_fetch_row($res)) {
405 $columns[$row1[0]] = array(
406 'Select' => FALSE,
407 'Insert' => FALSE,
408 'Update' => FALSE,
409 'References' => FALSE
410 );
411 }
412 PMA_DBI_free_result($res);
413 }
414 unset($res, $row1);
415 }
416 // t a b l e - s p e c i f i c p r i v i l e g e s
417 if (! empty($columns)) {
418 $res = PMA_DBI_query(
419 'SELECT `Column_name`, `Column_priv`'
420 .' FROM `mysql`.`columns_priv`'
421 .' WHERE `User`'
422 .' = \'' . PMA_sqlAddslashes($username) . "'"
423 .' AND `Host`'
424 .' = \'' . PMA_sqlAddslashes($hostname) . "'"
425 .' AND `Db`'
426 .' = \'' . PMA_sqlAddslashes(PMA_unescape_mysql_wildcards($db)) . "'"
427 .' AND `Table_name`'
428 .' = \'' . PMA_sqlAddslashes($table) . '\';');
429
430 while ($row1 = PMA_DBI_fetch_row($res)) {
431 $row1[1] = explode(',', $row1[1]);
432 foreach ($row1[1] as $current) {
433 $columns[$row1[0]][$current] = TRUE;
434 }
435 }
436 PMA_DBI_free_result($res);
437 unset($res, $row1, $current);
438
439 echo '<input type="hidden" name="grant_count" value="' . count($row) . '" />' . "\n"
440 . '<input type="hidden" name="column_count" value="' . count($columns) . '" />' . "\n"
441 . '<fieldset id="fieldset_user_priv">' . "\n"
442 . ' <legend>' . __('Table-specific privileges')
443 . PMA_showHint(__(' Note: MySQL privilege names are expressed in English '))
444 . '</legend>' . "\n";
445
446
447
448 // privs that are attached to a specific column
449 PMA_display_column_privs($columns, $row, 'Select_priv',
450 'SELECT', 'select', __('Allows reading data.'), 'Select');
451
452 PMA_display_column_privs($columns, $row, 'Insert_priv',
453 'INSERT', 'insert', __('Allows inserting and replacing data.'), 'Insert');
454
455 PMA_display_column_privs($columns, $row, 'Update_priv',
456 'UPDATE', 'update', __('Allows changing data.'), 'Update');
457
458 PMA_display_column_privs($columns, $row, 'References_priv',
459 'REFERENCES', 'references', __('Has no effect in this MySQL version.'), 'References');
460
461 // privs that are not attached to a specific column
462
463 echo ' <div class="item">' . "\n";
464 foreach ($row as $current_grant => $current_grant_value) {
465 if (in_array(substr($current_grant, 0, (strlen($current_grant) - 5)),
466 array('Select', 'Insert', 'Update', 'References'))) {
467 continue;
468 }
469 // make a substitution to match the messages variables;
470 // also we must substitute the grant we get, because we can't generate
471 // a form variable containing blanks (those would get changed to
472 // an underscore when receiving the POST)
473 if ($current_grant == 'Create View_priv') {
474 $tmp_current_grant = 'CreateView_priv';
475 $current_grant = 'Create_view_priv';
476 } elseif ($current_grant == 'Show view_priv') {
477 $tmp_current_grant = 'ShowView_priv';
478 $current_grant = 'Show_view_priv';
479 } else {
480 $tmp_current_grant = $current_grant;
481 }
482
483 echo ' <div class="item">' . "\n"
484 . ' <input type="checkbox"'
485 . (empty($GLOBALS['checkall']) ? '' : ' checked="checked"')
486 . ' name="' . $current_grant . '" id="checkbox_' . $current_grant
487 . '" value="Y" '
488 . ($current_grant_value == 'Y' ? 'checked="checked" ' : '')
489 . 'title="';
490
491 echo (isset($GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5))])
492 ? $GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5))]
493 : $GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5)) . 'Tbl']) . '"/>' . "\n";
494
495 echo ' <label for="checkbox_' . $current_grant
496 . '"><tt><dfn title="'
497 . (isset($GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5))])
498 ? $GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5))]
499 : $GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5)) . 'Tbl'])
500 . '">' . strtoupper(substr($current_grant, 0, strlen($current_grant) - 5)) . '</dfn></tt></label>' . "\n"
501 . ' </div>' . "\n";
502 } // end foreach ()
503
504 echo ' </div>' . "\n";
505 // for Safari 2.0.2
506 echo ' <div class="clearfloat"></div>' . "\n";
507
508 } else {
509
510 // g l o b a l o r d b - s p e c i f i c
511 //
512 // d a t a
513 $privTable[0] = array(
514 array('Select', 'SELECT', __('Allows reading data.')),
515 array('Insert', 'INSERT', __('Allows inserting and replacing data.')),
516 array('Update', 'UPDATE', __('Allows changing data.')),
517 array('Delete', 'DELETE', __('Allows deleting data.'))
518 );
519 if ($db == '*') {
520 $privTable[0][] = array('File', 'FILE', __('Allows importing data from and exporting data into files.'));
521 }
522
523 // s t r u c t u r e
524 $privTable[1] = array(
525 array('Create', 'CREATE', ($table == '*' ? __('Allows creating new databases and tables.') : __('Allows creating new tables.'))),
526 array('Alter', 'ALTER', __('Allows altering the structure of existing tables.')),
527 array('Index', 'INDEX', __('Allows creating and dropping indexes.')),
528 array('Drop', 'DROP', ($table == '*' ? __('Allows dropping databases and tables.') : __('Allows dropping tables.'))),
529 array('Create_tmp_table', 'CREATE TEMPORARY TABLES', __('Allows creating temporary tables.')),
530 array('Show_view', 'SHOW VIEW', __('Allows performing SHOW CREATE VIEW queries.')),
531 array('Create_routine', 'CREATE ROUTINE', __('Allows creating stored routines.')),
532 array('Alter_routine', 'ALTER ROUTINE', __('Allows altering and dropping stored routines.')),
533 array('Execute', 'EXECUTE', __('Allows executing stored routines.')),
534 );
535 // this one is for a db-specific priv: Create_view_priv
536 if (isset($row['Create_view_priv'])) {
537 $privTable[1][] = array('Create_view', 'CREATE VIEW', __('Allows creating new views.'));
538 }
539 // this one is for a table-specific priv: Create View_priv
540 if (isset($row['Create View_priv'])) {
541 $privTable[1][] = array('Create View', 'CREATE VIEW', __('Allows creating new views.'));
542 }
543 if (isset($row['Event_priv'])) {
544 // MySQL 5.1.6
545 $privTable[1][] = array('Event', 'EVENT', __('Allows to set up events for the event scheduler'));
546 $privTable[1][] = array('Trigger', 'TRIGGER', __('Allows creating and dropping triggers'));
547 }
548
549 // a d m i n i s t r a t i o n
550 $privTable[2] = array(
551 array('Grant', 'GRANT', __('Allows adding users and privileges without reloading the privilege tables.')),
552 );
553 if ($db == '*') {
554 $privTable[2][] = array('Super', 'SUPER', __('Allows connecting, even if maximum number of connections is reached; required for most administrative operations like setting global variables or killing threads of other users.'));
555 $privTable[2][] = array('Process', 'PROCESS', __('Allows viewing processes of all users'));
556 $privTable[2][] = array('Reload', 'RELOAD', __('Allows reloading server settings and flushing the server\'s caches.'));
557 $privTable[2][] = array('Shutdown', 'SHUTDOWN', __('Allows shutting down the server.'));
558 $privTable[2][] = array('Show_db', 'SHOW DATABASES', __('Gives access to the complete list of databases.'));
559 }
560 $privTable[2][] = array('Lock_tables', 'LOCK TABLES', __('Allows locking tables for the current thread.'));
561 $privTable[2][] = array('References', 'REFERENCES', __('Has no effect in this MySQL version.'));
562 if ($db == '*') {
563 $privTable[2][] = array('Repl_client', 'REPLICATION CLIENT', __('Allows the user to ask where the slaves / masters are.'));
564 $privTable[2][] = array('Repl_slave', 'REPLICATION SLAVE', __('Needed for the replication slaves.'));
565 $privTable[2][] = array('Create_user', 'CREATE USER', __('Allows creating, dropping and renaming user accounts.'));
566 }
567 echo '<input type="hidden" name="grant_count" value="'
568 . (count($privTable[0]) + count($privTable[1]) + count($privTable[2]) - (isset($row['Grant_priv']) ? 1 : 0))
569 . '" />' . "\n"
570 . '<fieldset id="fieldset_user_global_rights">' . "\n"
571 . ' <legend>' . "\n"
572 . ' '
573 . ($db == '*'
574 ? __('Global privileges')
575 : ($table == '*'
576 ? __('Database-specific privileges')
577 : __('Table-specific privileges'))) . "\n"
578 . ' (<a href="server_privileges.php?'
579 . $GLOBALS['url_query'] . '&amp;checkall=1" onclick="setCheckboxes(\'addUsersForm_' . $random_n . '\', true); return false;">'
580 . __('Check All') . '</a> /' . "\n"
581 . ' <a href="server_privileges.php?'
582 . $GLOBALS['url_query'] . '" onclick="setCheckboxes(\'addUsersForm_' . $random_n . '\', false); return false;">'
583 . __('Uncheck All') . '</a>)' . "\n"
584 . ' </legend>' . "\n"
585 . ' <p><small><i>' . __(' Note: MySQL privilege names are expressed in English ') . '</i></small></p>' . "\n"
586 . ' <fieldset>' . "\n"
587 . ' <legend>' . __('Data') . '</legend>' . "\n";
588 foreach ($privTable[0] as $priv)
589 {
590 echo ' <div class="item">' . "\n"
591 . ' <input type="checkbox"'
592 . (empty($GLOBALS['checkall']) ? '' : ' checked="checked"')
593 . ' name="' . $priv[0] . '_priv" id="checkbox_' . $priv[0]
594 . '_priv" value="Y" '
595 . ($row[$priv[0] . '_priv'] == 'Y' ? 'checked="checked" ' : '')
596 . 'title="' . $priv[2] . '"/>' . "\n"
597 . ' <label for="checkbox_' . $priv[0]
598 . '_priv"><tt><dfn title="' . $priv[2] . '">' . $priv[1]
599 . '</dfn></tt></label>' . "\n"
600 . ' </div>' . "\n";
601 }
602 echo ' </fieldset>' . "\n"
603 . ' <fieldset>' . "\n"
604 . ' <legend>' . __('Structure') . '</legend>' . "\n";
605 foreach ($privTable[1] as $priv)
606 {
607 echo ' <div class="item">' . "\n"
608 . ' <input type="checkbox"'
609 . (empty($GLOBALS['checkall']) ? '' : ' checked="checked"')
610 . ' name="' . $priv[0] . '_priv" id="checkbox_' . $priv[0]
611 . '_priv" value="Y" '
612 . ($row[$priv[0] . '_priv'] == 'Y' ? 'checked="checked" ' : '')
613 . 'title="' . $priv[2] . '"/>' . "\n"
614 . ' <label for="checkbox_' . $priv[0]
615 . '_priv"><tt><dfn title="' . $priv[2] . '">' . $priv[1]
616 . '</dfn></tt></label>' . "\n"
617 . ' </div>' . "\n";
618 }
619 echo ' </fieldset>' . "\n"
620 . ' <fieldset>' . "\n"
621 . ' <legend>' . __('Administration') . '</legend>' . "\n";
622 foreach ($privTable[2] as $priv)
623 {
624 echo ' <div class="item">' . "\n"
625 . ' <input type="checkbox"'
626 . (empty($GLOBALS['checkall']) ? '' : ' checked="checked"')
627 . ' name="' . $priv[0] . '_priv" id="checkbox_' . $priv[0]
628 . '_priv" value="Y" '
629 . ($row[$priv[0] . '_priv'] == 'Y' ? 'checked="checked" ' : '')
630 . 'title="' . $priv[2] . '"/>' . "\n"
631 . ' <label for="checkbox_' . $priv[0]
632 . '_priv"><tt><dfn title="' . $priv[2] . '">' . $priv[1]
633 . '</dfn></tt></label>' . "\n"
634 . ' </div>' . "\n";
635 }
636
637 echo ' </fieldset>' . "\n";
638 // The "Resource limits" box is not displayed for db-specific privs
639 if ($db == '*') {
640 echo ' <fieldset>' . "\n"
641 . ' <legend>' . __('Resource limits') . '</legend>' . "\n"
642 . ' <p><small><i>' . __('Note: Setting these options to 0 (zero) removes the limit.') . '</i></small></p>' . "\n"
643 . ' <div class="item">' . "\n"
644 . ' <label for="text_max_questions"><tt><dfn title="'
645 . __('Limits the number of queries the user may send to the server per hour.') . '">MAX QUERIES PER HOUR</dfn></tt></label>' . "\n"
646 . ' <input type="text" name="max_questions" id="text_max_questions" value="'
647 . $row['max_questions'] . '" size="11" maxlength="11" title="' . __('Limits the number of queries the user may send to the server per hour.') . '" />' . "\n"
648 . ' </div>' . "\n"
649 . ' <div class="item">' . "\n"
650 . ' <label for="text_max_updates"><tt><dfn title="'
651 . __('Limits the number of commands that change any table or database the user may execute per hour.') . '">MAX UPDATES PER HOUR</dfn></tt></label>' . "\n"
652 . ' <input type="text" name="max_updates" id="text_max_updates" value="'
653 . $row['max_updates'] . '" size="11" maxlength="11" title="' . __('Limits the number of commands that change any table or database the user may execute per hour.') . '" />' . "\n"
654 . ' </div>' . "\n"
655 . ' <div class="item">' . "\n"
656 . ' <label for="text_max_connections"><tt><dfn title="'
657 . __('Limits the number of new connections the user may open per hour.') . '">MAX CONNECTIONS PER HOUR</dfn></tt></label>' . "\n"
658 . ' <input type="text" name="max_connections" id="text_max_connections" value="'
659 . $row['max_connections'] . '" size="11" maxlength="11" title="' . __('Limits the number of new connections the user may open per hour.') . '" />' . "\n"
660 . ' </div>' . "\n"
661 . ' <div class="item">' . "\n"
662 . ' <label for="text_max_user_connections"><tt><dfn title="'
663 . __('Limits the number of simultaneous connections the user may have.') . '">MAX USER_CONNECTIONS</dfn></tt></label>' . "\n"
664 . ' <input type="text" name="max_user_connections" id="text_max_user_connections" value="'
665 . $row['max_user_connections'] . '" size="11" maxlength="11" title="' . __('Limits the number of simultaneous connections the user may have.') . '" />' . "\n"
666 . ' </div>' . "\n"
667 . ' </fieldset>' . "\n";
668 }
669 // for Safari 2.0.2
670 echo ' <div class="clearfloat"></div>' . "\n";
671 }
672 echo '</fieldset>' . "\n";
673 if ($submit) {
674 echo '<fieldset id="fieldset_user_privtable_footer" class="tblFooters">' . "\n"
675 . ' <input type="submit" name="update_privs" value="' . __('Go') . '" />' . "\n"
676 . '</fieldset>' . "\n";
677 }
678 } // end of the 'PMA_displayPrivTable()' function
679
680
681 /**
682 * Displays the fields used by the "new user" form as well as the
683 * "change login information / copy user" form.
684 *
685 * @param string $mode are we creating a new user or are we just
686 * changing one? (allowed values: 'new', 'change')
687 * @global array $cfg the phpMyAdmin configuration
688 * @global ressource $user_link the database connection
689 *
690 * @return void
691 */
692 function PMA_displayLoginInformationFields($mode = 'new')
693 {
694 // Get user/host name lengths
695 $fields_info = PMA_DBI_get_fields('mysql', 'user');
696 $username_length = 16;
697 $hostname_length = 41;
698 foreach ($fields_info as $key => $val) {
699 if ($val['Field'] == 'User') {
700 strtok($val['Type'], '()');
701 $v = strtok('()');
702 if (is_int($v)) {
703 $username_length = $v;
704 }
705 } elseif ($val['Field'] == 'Host') {
706 strtok($val['Type'], '()');
707 $v = strtok('()');
708 if (is_int($v)) {
709 $hostname_length = $v;
710 }
711 }
712 }
713 unset($fields_info);
714
715 if (isset($GLOBALS['username']) && strlen($GLOBALS['username']) === 0) {
716 $GLOBALS['pred_username'] = 'any';
717 }
718 echo '<fieldset id="fieldset_add_user_login">' . "\n"
719 . '<legend>' . __('Login Information') . '</legend>' . "\n"
720 . '<div class="item">' . "\n"
721 . '<label for="select_pred_username">' . "\n"
722 . ' ' . __('User name') . ':' . "\n"
723 . '</label>' . "\n"
724 . '<span class="options">' . "\n"
725 . ' <select name="pred_username" id="select_pred_username" title="' . __('User name') . '"' . "\n"
726 . ' onchange="if (this.value == \'any\') { username.value = \'\'; } else if (this.value == \'userdefined\') { username.focus(); username.select(); }">' . "\n"
727 . ' <option value="any"' . ((isset($GLOBALS['pred_username']) && $GLOBALS['pred_username'] == 'any') ? ' selected="selected"' : '') . '>' . __('Any user') . '</option>' . "\n"
728 . ' <option value="userdefined"' . ((! isset($GLOBALS['pred_username']) || $GLOBALS['pred_username'] == 'userdefined') ? ' selected="selected"' : '') . '>' . __('Use text field') . ':</option>' . "\n"
729 . ' </select>' . "\n"
730 . '</span>' . "\n"
731 . '<input type="text" name="username" maxlength="'
732 . $username_length . '" title="' . __('User name') . '"'
733 . (empty($GLOBALS['username'])
734 ? ''
735 : ' value="' . htmlspecialchars(isset($GLOBALS['new_username'])
736 ? $GLOBALS['new_username']
737 : $GLOBALS['username']) . '"')
738 . ' onchange="pred_username.value = \'userdefined\';" />' . "\n"
739 . '</div>' . "\n"
740 . '<div class="item">' . "\n"
741 . '<label for="select_pred_hostname">' . "\n"
742 . ' ' . __('Host') . ':' . "\n"
743 . '</label>' . "\n"
744 . '<span class="options">' . "\n"
745 . ' <select name="pred_hostname" id="select_pred_hostname" title="' . __('Host') . '"' . "\n";
746 $_current_user = PMA_DBI_fetch_value('SELECT USER();');
747 if (! empty($_current_user)) {
748 $thishost = str_replace("'", '', substr($_current_user, (strrpos($_current_user, '@') + 1)));
749 if ($thishost == 'localhost' || $thishost == '127.0.0.1') {
750 unset($thishost);
751 }
752 }
753 echo ' onchange="if (this.value == \'any\') { hostname.value = \'%\'; } else if (this.value == \'localhost\') { hostname.value = \'localhost\'; } '
754 . (empty($thishost) ? '' : 'else if (this.value == \'thishost\') { hostname.value = \'' . addslashes(htmlspecialchars($thishost)) . '\'; } ')
755 . 'else if (this.value == \'hosttable\') { hostname.value = \'\'; } else if (this.value == \'userdefined\') { hostname.focus(); hostname.select(); }">' . "\n";
756 unset($_current_user);
757
758 // when we start editing a user, $GLOBALS['pred_hostname'] is not defined
759 if (! isset($GLOBALS['pred_hostname']) && isset($GLOBALS['hostname'])) {
760 switch (strtolower($GLOBALS['hostname'])) {
761 case 'localhost':
762 case '127.0.0.1':
763 $GLOBALS['pred_hostname'] = 'localhost';
764 break;
765 case '%':
766 $GLOBALS['pred_hostname'] = 'any';
767 break;
768 default:
769 $GLOBALS['pred_hostname'] = 'userdefined';
770 break;
771 }
772 }
773 echo ' <option value="any"'
774 . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'any')
775 ? ' selected="selected"' : '') . '>' . __('Any host')
776 . '</option>' . "\n"
777 . ' <option value="localhost"'
778 . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'localhost')
779 ? ' selected="selected"' : '') . '>' . __('Local')
780 . '</option>' . "\n";
781 if (!empty($thishost)) {
782 echo ' <option value="thishost"'
783 . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'thishost')
784 ? ' selected="selected"' : '') . '>' . __('This Host')
785 . '</option>' . "\n";
786 }
787 unset($thishost);
788 echo ' <option value="hosttable"'
789 . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'hosttable')
790 ? ' selected="selected"' : '') . '>' . __('Use Host Table')
791 . '</option>' . "\n"
792 . ' <option value="userdefined"'
793 . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'userdefined')
794 ? ' selected="selected"' : '')
795 . '>' . __('Use text field') . ':</option>' . "\n"
796 . ' </select>' . "\n"
797 . '</span>' . "\n"
798 . '<input type="text" name="hostname" maxlength="'
799 . $hostname_length . '" value="'
800 . htmlspecialchars(isset($GLOBALS['hostname']) ? $GLOBALS['hostname'] : '')
801 . '" title="' . __('Host')
802 . '" onchange="pred_hostname.value = \'userdefined\';" />' . "\n"
803 . PMA_showHint(__('When Host table is used, this field is ignored and values stored in Host table are used instead.'))
804 . '</div>' . "\n"
805 . '<div class="item">' . "\n"
806 . '<label for="select_pred_password">' . "\n"
807 . ' ' . __('Password') . ':' . "\n"
808 . '</label>' . "\n"
809 . '<span class="options">' . "\n"
810 . ' <select name="pred_password" id="select_pred_password" title="'
811 . __('Password') . '"' . "\n"
812 . ' onchange="if (this.value == \'none\') { pma_pw.value = \'\'; pma_pw2.value = \'\'; } else if (this.value == \'userdefined\') { pma_pw.focus(); pma_pw.select(); }">' . "\n"
813 . ($mode == 'change' ? ' <option value="keep" selected="selected">' . __('Do not change the password') . '</option>' . "\n" : '')
814 . ' <option value="none"';
815 if (isset($GLOBALS['username']) && $mode != 'change') {
816 echo ' selected="selected"';
817 }
818 echo '>' . __('No Password') . '</option>' . "\n"
819 . ' <option value="userdefined"' . (isset($GLOBALS['username']) ? '' : ' selected="selected"') . '>' . __('Use text field') . ':</option>' . "\n"
820 . ' </select>' . "\n"
821 . '</span>' . "\n"
822 . '<input type="password" id="text_pma_pw" name="pma_pw" title="' . __('Password') . '" onchange="pred_password.value = \'userdefined\';" />' . "\n"
823 . '</div>' . "\n"
824 . '<div class="item" id="div_element_before_generate_password">' . "\n"
825 . '<label for="text_pma_pw2">' . "\n"
826 . ' ' . __('Re-type') . ':' . "\n"
827 . '</label>' . "\n"
828 . '<span class="options">&nbsp;</span>' . "\n"
829 . '<input type="password" name="pma_pw2" id="text_pma_pw2" title="' . __('Re-type') . '" onchange="pred_password.value = \'userdefined\';" />' . "\n"
830 . '</div>' . "\n"
831 // Generate password added here via jQuery
832 . '</fieldset>' . "\n";
833 } // end of the 'PMA_displayUserAndHostFields()' function
834
835 /**
836 * Changes / copies a user, part I
837 */
838 if (isset($_REQUEST['change_copy'])) {
839 $user_host_condition =
840 ' WHERE `User`'
841 .' = \'' . PMA_sqlAddslashes($old_username) . "'"
842 .' AND `Host`'
843 .' = \'' . PMA_sqlAddslashes($old_hostname) . '\';';
844 $row = PMA_DBI_fetch_single_row('SELECT * FROM `mysql`.`user` ' . $user_host_condition);
845 if (! $row) {
846 PMA_Message::notice(__('No user found.'))->display();
847 unset($_REQUEST['change_copy']);
848 } else {
849 extract($row, EXTR_OVERWRITE);
850 // Recent MySQL versions have the field "Password" in mysql.user,
851 // so the previous extract creates $Password but this script
852 // uses $password
853 if (! isset($password) && isset($Password)) {
854 $password = $Password;
855 }
856 $queries = array();
857 }
858 }
859
860
861 /**
862 * Adds a user
863 * (Changes / copies a user, part II)
864 */
865 if (isset($_REQUEST['adduser_submit']) || isset($_REQUEST['change_copy'])) {
866 $sql_query = '';
867 if ($pred_username == 'any') {
868 $username = '';
869 }
870 switch ($pred_hostname) {
871 case 'any':
872 $hostname = '%';
873 break;
874 case 'localhost':
875 $hostname = 'localhost';
876 break;
877 case 'hosttable':
878 $hostname = '';
879 break;
880 case 'thishost':
881 $_user_name = PMA_DBI_fetch_value('SELECT USER()');
882 $hostname = substr($_user_name, (strrpos($_user_name, '@') + 1));
883 unset($_user_name);
884 break;
885 }
886 $sql = "SELECT '1' FROM `mysql`.`user`"
887 . " WHERE `User` = '" . PMA_sqlAddslashes($username) . "'"
888 . " AND `Host` = '" . PMA_sqlAddslashes($hostname) . "';";
889 if (PMA_DBI_fetch_value($sql) == 1) {
890 $message = PMA_Message::error(__('The user %s already exists!'));
891 $message->addParam('[i]\'' . $username . '\'@\'' . $hostname . '\'[/i]');
892 $_REQUEST['adduser'] = true;
893 $_add_user_error = true;
894 } else {
895
896 $create_user_real = 'CREATE USER \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\'';
897
898 $real_sql_query =
899 'GRANT ' . join(', ', PMA_extractPrivInfo()) . ' ON *.* TO \''
900 . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\'';
901 if ($pred_password != 'none' && $pred_password != 'keep') {
902 $sql_query = $real_sql_query . ' IDENTIFIED BY \'***\'';
903 $real_sql_query .= ' IDENTIFIED BY \'' . PMA_sqlAddslashes($pma_pw) . '\'';
904 if (isset($create_user_real)) {
905 $create_user_show = $create_user_real . ' IDENTIFIED BY \'***\'';
906 $create_user_real .= ' IDENTIFIED BY \'' . PMA_sqlAddslashes($pma_pw) . '\'';
907 }
908 } else {
909 if ($pred_password == 'keep' && !empty($password)) {
910 $real_sql_query .= ' IDENTIFIED BY PASSWORD \'' . $password . '\'';
911 if (isset($create_user_real)) {
912 $create_user_real .= ' IDENTIFIED BY PASSWORD \'' . $password . '\'';
913 }
914 }
915 $sql_query = $real_sql_query;
916 if (isset($create_user_real)) {
917 $create_user_show = $create_user_real;
918 }
919 }
920 /**
921 * @todo similar code appears twice in this script
922 */
923 if ((isset($Grant_priv) && $Grant_priv == 'Y')
924 || (isset($max_questions) || isset($max_connections)
925 || isset($max_updates) || isset($max_user_connections))) {
926 $real_sql_query .= ' WITH';
927 $sql_query .= ' WITH';
928 if (isset($Grant_priv) && $Grant_priv == 'Y') {
929 $real_sql_query .= ' GRANT OPTION';
930 $sql_query .= ' GRANT OPTION';
931 }
932 if (isset($max_questions)) {
933 // avoid negative values
934 $max_questions = max(0, (int)$max_questions);
935 $real_sql_query .= ' MAX_QUERIES_PER_HOUR ' . $max_questions;
936 $sql_query .= ' MAX_QUERIES_PER_HOUR ' . $max_questions;
937 }
938 if (isset($max_connections)) {
939 $max_connections = max(0, (int)$max_connections);
940 $real_sql_query .= ' MAX_CONNECTIONS_PER_HOUR ' . $max_connections;
941 $sql_query .= ' MAX_CONNECTIONS_PER_HOUR ' . $max_connections;
942 }
943 if (isset($max_updates)) {
944 $max_updates = max(0, (int)$max_updates);
945 $real_sql_query .= ' MAX_UPDATES_PER_HOUR ' . $max_updates;
946 $sql_query .= ' MAX_UPDATES_PER_HOUR ' . $max_updates;
947 }
948 if (isset($max_user_connections)) {
949 $max_user_connections = max(0, (int)$max_user_connections);
950 $real_sql_query .= ' MAX_USER_CONNECTIONS ' . $max_user_connections;
951 $sql_query .= ' MAX_USER_CONNECTIONS ' . $max_user_connections;
952 }
953 }
954 if (isset($create_user_real)) {
955 $create_user_real .= ';';
956 $create_user_show .= ';';
957 }
958 $real_sql_query .= ';';
959 $sql_query .= ';';
960 if (empty($_REQUEST['change_copy'])) {
961 $_error = false;
962
963 if (isset($create_user_real)) {
964 if (! PMA_DBI_try_query($create_user_real)) {
965 $_error = true;
966 }
967 $sql_query = $create_user_show . $sql_query;
968 }
969
970 if ($_error || ! PMA_DBI_try_query($real_sql_query)) {
971 $_REQUEST['createdb'] = false;
972 $message = PMA_Message::rawError(PMA_DBI_getError());
973 } else {
974 $message = PMA_Message::success(__('You have added a new user.'));
975 }
976
977 switch (PMA_ifSetOr($_REQUEST['createdb'], '0')) {
978 case '1' :
979 // Create database with same name and grant all privileges
980 $q = 'CREATE DATABASE IF NOT EXISTS '
981 . PMA_backquote(PMA_sqlAddslashes($username)) . ';';
982 $sql_query .= $q;
983 if (! PMA_DBI_try_query($q)) {
984 $message = PMA_Message::rawError(PMA_DBI_getError());
985 break;
986 }
987
988
989 /**
990 * If we are not in an Ajax request, we can't reload navigation now
991 */
992 if($GLOBALS['is_ajax_request'] != true) {
993 // this is needed in case tracking is on:
994 $GLOBALS['db'] = $username;
995 $GLOBALS['reload'] = TRUE;
996 PMA_reloadNavigation();
997 }
998
999 $q = 'GRANT ALL PRIVILEGES ON '
1000 . PMA_backquote(PMA_sqlAddslashes($username)) . '.* TO \''
1001 . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
1002 $sql_query .= $q;
1003 if (! PMA_DBI_try_query($q)) {
1004 $message = PMA_Message::rawError(PMA_DBI_getError());
1005 }
1006 break;
1007 case '2' :
1008 // Grant all privileges on wildcard name (username\_%)
1009 $q = 'GRANT ALL PRIVILEGES ON '
1010 . PMA_backquote(PMA_sqlAddslashes($username) . '\_%') . '.* TO \''
1011 . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
1012 $sql_query .= $q;
1013 if (! PMA_DBI_try_query($q)) {
1014 $message = PMA_Message::rawError(PMA_DBI_getError());
1015 }
1016 break;
1017 case '3' :
1018 // Grant all privileges on the specified database to the new user
1019 $q = 'GRANT ALL PRIVILEGES ON '
1020 . PMA_backquote(PMA_sqlAddslashes($dbname)) . '.* TO \''
1021 . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
1022 $sql_query .= $q;
1023 if (! PMA_DBI_try_query($q)) {
1024 $message = PMA_Message::rawError(PMA_DBI_getError());
1025 }
1026 break;
1027 case '0' :
1028 default :
1029 break;
1030 }
1031 } else {
1032 if (isset($create_user_real)) {
1033 $queries[] = $create_user_real;
1034 }
1035 $queries[] = $real_sql_query;
1036 // we put the query containing the hidden password in
1037 // $queries_for_display, at the same position occupied
1038 // by the real query in $queries
1039 $tmp_count = count($queries);
1040 if (isset($create_user_real)) {
1041 $queries_for_display[$tmp_count - 2] = $create_user_show;
1042 }
1043 $queries_for_display[$tmp_count - 1] = $sql_query;
1044 }
1045 unset($res, $real_sql_query);
1046 }
1047 }
1048
1049
1050 /**
1051 * Changes / copies a user, part III
1052 */
1053 if (isset($_REQUEST['change_copy'])) {
1054 $user_host_condition =
1055 ' WHERE `User`'
1056 .' = \'' . PMA_sqlAddslashes($old_username) . "'"
1057 .' AND `Host`'
1058 .' = \'' . PMA_sqlAddslashes($old_hostname) . '\';';
1059 $res = PMA_DBI_query('SELECT * FROM `mysql`.`db`' . $user_host_condition);
1060 while ($row = PMA_DBI_fetch_assoc($res)) {
1061 $queries[] =
1062 'GRANT ' . join(', ', PMA_extractPrivInfo($row))
1063 .' ON ' . PMA_backquote($row['Db']) . '.*'
1064 .' TO \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\''
1065 . ($row['Grant_priv'] == 'Y' ? ' WITH GRANT OPTION;' : ';');
1066 }
1067 PMA_DBI_free_result($res);
1068 $res = PMA_DBI_query(
1069 'SELECT `Db`, `Table_name`, `Table_priv`'
1070 .' FROM `mysql`.`tables_priv`' . $user_host_condition,
1071 $GLOBALS['userlink'], PMA_DBI_QUERY_STORE);
1072 while ($row = PMA_DBI_fetch_assoc($res)) {
1073
1074 $res2 = PMA_DBI_QUERY(
1075 'SELECT `Column_name`, `Column_priv`'
1076 .' FROM `mysql`.`columns_priv`'
1077 .' WHERE `User`'
1078 .' = \'' . PMA_sqlAddslashes($old_username) . "'"
1079 .' AND `Host`'
1080 .' = \'' . PMA_sqlAddslashes($old_hostname) . '\''
1081 .' AND `Db`'
1082 .' = \'' . PMA_sqlAddslashes($row['Db']) . "'"
1083 .' AND `Table_name`'
1084 .' = \'' . PMA_sqlAddslashes($row['Table_name']) . "'"
1085 .';',
1086 null, PMA_DBI_QUERY_STORE);
1087
1088 $tmp_privs1 = PMA_extractPrivInfo($row);
1089 $tmp_privs2 = array(
1090 'Select' => array(),
1091 'Insert' => array(),
1092 'Update' => array(),
1093 'References' => array()
1094 );
1095
1096 while ($row2 = PMA_DBI_fetch_assoc($res2)) {
1097 $tmp_array = explode(',', $row2['Column_priv']);
1098 if (in_array('Select', $tmp_array)) {
1099 $tmp_privs2['Select'][] = $row2['Column_name'];
1100 }
1101 if (in_array('Insert', $tmp_array)) {
1102 $tmp_privs2['Insert'][] = $row2['Column_name'];
1103 }
1104 if (in_array('Update', $tmp_array)) {
1105 $tmp_privs2['Update'][] = $row2['Column_name'];
1106 }
1107 if (in_array('References', $tmp_array)) {
1108 $tmp_privs2['References'][] = $row2['Column_name'];
1109 }
1110 unset($tmp_array);
1111 }
1112 if (count($tmp_privs2['Select']) > 0 && !in_array('SELECT', $tmp_privs1)) {
1113 $tmp_privs1[] = 'SELECT (`' . join('`, `', $tmp_privs2['Select']) . '`)';
1114 }
1115 if (count($tmp_privs2['Insert']) > 0 && !in_array('INSERT', $tmp_privs1)) {
1116 $tmp_privs1[] = 'INSERT (`' . join('`, `', $tmp_privs2['Insert']) . '`)';
1117 }
1118 if (count($tmp_privs2['Update']) > 0 && !in_array('UPDATE', $tmp_privs1)) {
1119 $tmp_privs1[] = 'UPDATE (`' . join('`, `', $tmp_privs2['Update']) . '`)';
1120 }
1121 if (count($tmp_privs2['References']) > 0 && !in_array('REFERENCES', $tmp_privs1)) {
1122 $tmp_privs1[] = 'REFERENCES (`' . join('`, `', $tmp_privs2['References']) . '`)';
1123 }
1124 unset($tmp_privs2);
1125 $queries[] =
1126 'GRANT ' . join(', ', $tmp_privs1)
1127 . ' ON ' . PMA_backquote($row['Db']) . '.' . PMA_backquote($row['Table_name'])
1128 . ' TO \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\''
1129 . (in_array('Grant', explode(',', $row['Table_priv'])) ? ' WITH GRANT OPTION;' : ';');
1130 }
1131 }
1132
1133
1134 /**
1135 * Updates privileges
1136 */
1137 if (!empty($update_privs)) {
1138 $db_and_table = PMA_WildcardEscapeForGrant($db_and_table, $dbname, (isset($tablename) ? $tablename : ''));
1139
1140 $sql_query0 =
1141 'REVOKE ALL PRIVILEGES ON ' . $db_and_table
1142 . ' FROM \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
1143 if (! isset($Grant_priv) || $Grant_priv != 'Y') {
1144 $sql_query1 =
1145 'REVOKE GRANT OPTION ON ' . $db_and_table
1146 . ' FROM \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
1147 } else {
1148 $sql_query1 = '';
1149 }
1150
1151 // Should not do a GRANT USAGE for a table-specific privilege, it
1152 // causes problems later (cannot revoke it)
1153 if (! (isset($tablename) && 'USAGE' == implode('', PMA_extractPrivInfo()))) {
1154 $sql_query2 =
1155 'GRANT ' . join(', ', PMA_extractPrivInfo())
1156 . ' ON ' . $db_and_table
1157 . ' TO \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\'';
1158
1159 /**
1160 * @todo similar code appears twice in this script
1161 */
1162 if ((isset($Grant_priv) && $Grant_priv == 'Y')
1163 || (! isset($dbname)
1164 && (isset($max_questions) || isset($max_connections)
1165 || isset($max_updates) || isset($max_user_connections))))
1166 {
1167 $sql_query2 .= 'WITH';
1168 if (isset($Grant_priv) && $Grant_priv == 'Y') {
1169 $sql_query2 .= ' GRANT OPTION';
1170 }
1171 if (isset($max_questions)) {
1172 $max_questions = max(0, (int)$max_questions);
1173 $sql_query2 .= ' MAX_QUERIES_PER_HOUR ' . $max_questions;
1174 }
1175 if (isset($max_connections)) {
1176 $max_connections = max(0, (int)$max_connections);
1177 $sql_query2 .= ' MAX_CONNECTIONS_PER_HOUR ' . $max_connections;
1178 }
1179 if (isset($max_updates)) {
1180 $max_updates = max(0, (int)$max_updates);
1181 $sql_query2 .= ' MAX_UPDATES_PER_HOUR ' . $max_updates;
1182 }
1183 if (isset($max_user_connections)) {
1184 $max_user_connections = max(0, (int)$max_user_connections);
1185 $sql_query2 .= ' MAX_USER_CONNECTIONS ' . $max_user_connections;
1186 }
1187 }
1188 $sql_query2 .= ';';
1189 }
1190 if (! PMA_DBI_query($sql_query0)) {
1191 // This might fail when the executing user does not have ALL PRIVILEGES himself.
1192 // See https://sourceforge.net/tracker/index.php?func=detail&aid=3285929&group_id=23067&atid=377408
1193 $sql_query0 = '';
1194 }
1195 if (isset($sql_query1) && !PMA_DBI_try_query($sql_query1)) {
1196 // this one may fail, too...
1197 $sql_query1 = '';
1198 }
1199 if (isset($sql_query2)) {
1200 PMA_DBI_query($sql_query2);
1201 } else {
1202 $sql_query2 = '';
1203 }
1204 $sql_query = $sql_query0 . ' ' . $sql_query1 . ' ' . $sql_query2;
1205 $message = PMA_Message::success(__('You have updated the privileges for %s.'));
1206 $message->addParam('\'' . htmlspecialchars($username) . '\'@\'' . htmlspecialchars($hostname) . '\'');
1207 }
1208
1209
1210 /**
1211 * Revokes Privileges
1212 */
1213 if (isset($_REQUEST['revokeall'])) {
1214 $db_and_table = PMA_WildcardEscapeForGrant($db_and_table, $dbname, isset($tablename) ? $tablename : '');
1215
1216 $sql_query0 =
1217 'REVOKE ALL PRIVILEGES ON ' . $db_and_table
1218 . ' FROM \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
1219 $sql_query1 =
1220 'REVOKE GRANT OPTION ON ' . $db_and_table
1221 . ' FROM \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
1222
1223 PMA_DBI_query($sql_query0);
1224 if (! PMA_DBI_try_query($sql_query1)) {
1225 // this one may fail, too...
1226 $sql_query1 = '';
1227 }
1228 $sql_query = $sql_query0 . ' ' . $sql_query1;
1229 $message = PMA_Message::success(__('You have revoked the privileges for %s'));
1230 $message->addParam('\'' . htmlspecialchars($username) . '\'@\'' . htmlspecialchars($hostname) . '\'');
1231 if (! isset($tablename)) {
1232 unset($dbname);
1233 } else {
1234 unset($tablename);
1235 }
1236 }
1237
1238
1239 /**
1240 * Updates the password
1241 */
1242 if (isset($_REQUEST['change_pw'])) {
1243 // similar logic in user_password.php
1244 $message = '';
1245
1246 if ($nopass == 0 && isset($pma_pw) && isset($pma_pw2)) {
1247 if ($pma_pw != $pma_pw2) {
1248 $message = PMA_Message::error(__('The passwords aren\'t the same!'));
1249 } elseif (empty($pma_pw) || empty($pma_pw2)) {
1250 $message = PMA_Message::error(__('The password is empty!'));
1251 }
1252 } // end if
1253
1254 // here $nopass could be == 1
1255 if (empty($message)) {
1256
1257 $hashing_function = (!empty($pw_hash) && $pw_hash == 'old' ? 'OLD_' : '')
1258 . 'PASSWORD';
1259
1260 // in $sql_query which will be displayed, hide the password
1261 $sql_query = 'SET PASSWORD FOR \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\' = ' . (($pma_pw == '') ? '\'\'' : $hashing_function . '(\'' . preg_replace('@.@s', '*', $pma_pw) . '\')');
1262 $local_query = 'SET PASSWORD FOR \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\' = ' . (($pma_pw == '') ? '\'\'' : $hashing_function . '(\'' . PMA_sqlAddslashes($pma_pw) . '\')');
1263 PMA_DBI_try_query($local_query)
1264 or PMA_mysqlDie(PMA_DBI_getError(), $sql_query, FALSE, $err_url);
1265 $message = PMA_Message::success(__('The password for %s was changed successfully.'));
1266 $message->addParam('\'' . htmlspecialchars($username) . '\'@\'' . htmlspecialchars($hostname) . '\'');
1267 }
1268 }
1269
1270
1271 /**
1272 * Deletes users
1273 * (Changes / copies a user, part IV)
1274 */
1275
1276 if (isset($_REQUEST['delete']) || (isset($_REQUEST['change_copy']) && $_REQUEST['mode'] < 4)) {
1277 if (isset($_REQUEST['change_copy'])) {
1278 $selected_usr = array($old_username . '&amp;#27;' . $old_hostname);
1279 } else {
1280 $selected_usr = $_REQUEST['selected_usr'];
1281 $queries = array();
1282 }
1283 foreach ($selected_usr as $each_user) {
1284 list($this_user, $this_host) = explode('&amp;#27;', $each_user);
1285 $queries[] = '# ' . sprintf(__('Deleting %s'), '\'' . $this_user . '\'@\'' . $this_host . '\'') . ' ...';
1286 $queries[] = 'DROP USER \'' . PMA_sqlAddslashes($this_user) . '\'@\'' . PMA_sqlAddslashes($this_host) . '\';';
1287
1288 if (isset($_REQUEST['drop_users_db'])) {
1289 $queries[] = 'DROP DATABASE IF EXISTS ' . PMA_backquote($this_user) . ';';
1290 $GLOBALS['reload'] = TRUE;
1291
1292 if($GLOBALS['is_ajax_request'] != true) {
1293 PMA_reloadNavigation();
1294 }
1295 }
1296 }
1297 if (empty($_REQUEST['change_copy'])) {
1298 if (empty($queries)) {
1299 $message = PMA_Message::error(__('No users selected for deleting!'));
1300 } else {
1301 if ($_REQUEST['mode'] == 3) {
1302 $queries[] = '# ' . __('Reloading the privileges') . ' ...';
1303 $queries[] = 'FLUSH PRIVILEGES;';
1304 }
1305 $drop_user_error = '';
1306 foreach ($queries as $sql_query) {
1307 if ($sql_query{0} != '#') {
1308 if (! PMA_DBI_try_query($sql_query, $GLOBALS['userlink'])) {
1309 $drop_user_error .= PMA_DBI_getError() . "\n";
1310 }
1311 }
1312 }
1313 // tracking sets this, causing the deleted db to be shown in navi
1314 unset($GLOBALS['db']);
1315
1316 $sql_query = join("\n", $queries);
1317 if (! empty($drop_user_error)) {
1318 $message = PMA_Message::rawError($drop_user_error);
1319 } else {
1320 $message = PMA_Message::success(__('The selected users have been deleted successfully.'));
1321 }
1322 }
1323 unset($queries);
1324 }
1325 }
1326
1327
1328 /**
1329 * Changes / copies a user, part V
1330 */
1331 if (isset($_REQUEST['change_copy'])) {
1332 $tmp_count = 0;
1333 foreach ($queries as $sql_query) {
1334 if ($sql_query{0} != '#') {
1335 PMA_DBI_query($sql_query);
1336 }
1337 // when there is a query containing a hidden password, take it
1338 // instead of the real query sent
1339 if (isset($queries_for_display[$tmp_count])) {
1340 $queries[$tmp_count] = $queries_for_display[$tmp_count];
1341 }
1342 $tmp_count++;
1343 }
1344 $message = PMA_Message::success();
1345 $sql_query = join("\n", $queries);
1346 }
1347
1348
1349 /**
1350 * Reloads the privilege tables into memory
1351 */
1352 if (isset($_REQUEST['flush_privileges'])) {
1353 $sql_query = 'FLUSH PRIVILEGES;';
1354 PMA_DBI_query($sql_query);
1355 $message = PMA_Message::success(__('The privileges were reloaded successfully.'));
1356 }
1357
1358 /**
1359 * defines some standard links
1360 */
1361 $link_edit = '<a class="edit_user_anchor ' . $conditional_class . '" href="server_privileges.php?' . $GLOBALS['url_query']
1362 . '&amp;username=%s'
1363 . '&amp;hostname=%s'
1364 . '&amp;dbname=%s'
1365 . '&amp;tablename=%s">'
1366 . PMA_getIcon('b_usredit.png', __('Edit Privileges'))
1367 . '</a>';
1368
1369 $link_revoke = '<a href="server_privileges.php?' . $GLOBALS['url_query']
1370 . '&amp;username=%s'
1371 . '&amp;hostname=%s'
1372 . '&amp;dbname=%s'
1373 . '&amp;tablename=%s'
1374 . '&amp;revokeall=1">'
1375 . PMA_getIcon('b_usrdrop.png', __('Revoke'))
1376 . '</a>';
1377
1378 $link_export = '<a class="export_user_anchor ' . $conditional_class . '" href="server_privileges.php?' . $GLOBALS['url_query']
1379 . '&amp;username=%s'
1380 . '&amp;hostname=%s'
1381 . '&amp;initial=%s'
1382 . '&amp;export=1">'
1383 . PMA_getIcon('b_tblexport.png', __('Export'))
1384 . '</a>';
1385
1386 /**
1387 * If we are in an Ajax request for Create User/Edit User/Revoke User/Flush Privileges,
1388 * show $message and exit.
1389 */
1390 if( $GLOBALS['is_ajax_request'] && ! isset($_REQUEST['export']) && (! isset($_REQUEST['adduser']) || $_add_user_error) && ! isset($_REQUEST['initial']) && ! isset($_REQUEST['showall']) && ! isset($_REQUEST['edit_user_dialog'])) {
1391
1392 if(isset($sql_query)) {
1393 $extra_data['sql_query'] = PMA_showMessage(NULL, $sql_query);
1394 }
1395
1396 if(isset($_REQUEST['adduser_submit']) || isset($_REQUEST['change_copy'])) {
1397 /**
1398 * generate html on the fly for the new user that was just created.
1399 */
1400 $new_user_string = '<tr>'."\n"
1401 .'<td> <input type="checkbox" name="selected_usr[]" id="checkbox_sel_users_" value="' . htmlspecialchars($username) . '&amp;#27;' . htmlspecialchars($hostname) . '" /> </td>'."\n"
1402 .'<td><label for="checkbox_sel_users_">' . (empty($username) ? '<span style="color: #FF0000">' . __('Any') . '</span>' : htmlspecialchars($username) ) . '</label></td>' . "\n"
1403 .'<td>' . htmlspecialchars($hostname) . '</td>' . "\n";
1404 $new_user_string .= '<td>';
1405
1406 if(!empty($password) || isset($pma_pw)) {
1407 $new_user_string .= __('Yes');
1408 }
1409 else {
1410 $new_user_string .= '<span style="color: #FF0000">' . __('No') . '</span>';
1411 };
1412
1413 $new_user_string .= '</td>'."\n";
1414 $new_user_string .= '<td><tt>' . join(', ', PMA_extractPrivInfo('', true)) . '</tt></td>'; //Fill in privileges here
1415 $new_user_string .= '<td>';
1416
1417 if((isset($Grant_priv) && $Grant_priv == 'Y')) {
1418 $new_user_string .= __('Yes');
1419 }
1420 else {
1421 $new_user_string .= __('No');
1422 }
1423
1424 $new_user_string .='</td>';
1425
1426 $new_user_string .= '<td>'.sprintf($link_edit, urlencode($username), urlencode($hostname), '', '' ).'</td>'."\n";
1427 $new_user_string .= '<td>'.sprintf($link_export, urlencode($username), urlencode($hostname), (isset($initial) ? $initial : '')).'</td>'."\n";
1428
1429 $new_user_string .= '</tr>';
1430
1431 $extra_data['new_user_string'] = $new_user_string;
1432
1433 /**
1434 * Generate the string for this alphabet's initial, to update the user
1435 * pagination
1436 */
1437 $new_user_initial = strtoupper(substr($username, 0, 1));
1438 $new_user_initial_string = '<a href="server_privileges.php?' . $GLOBALS['url_query'] . '&initial=' . $new_user_initial
1439 .'">' . $new_user_initial . '</a>';
1440 $extra_data['new_user_initial'] = $new_user_initial;
1441 $extra_data['new_user_initial_string'] = $new_user_initial_string;
1442 }
1443
1444 if(isset($update_privs)) {
1445 $extra_data['db_specific_privs'] = false;
1446 if (isset($dbname_is_wildcard)) {
1447 $extra_data['db_specific_privs'] = !$dbname_is_wildcard;
1448 }
1449 $new_privileges = join(', ', PMA_extractPrivInfo('', true));
1450
1451 $extra_data['new_privileges'] = $new_privileges;
1452 }
1453
1454 if ($message instanceof PMA_Message) {
1455 PMA_ajaxResponse($message, $message->isSuccess(), $extra_data);
1456 }
1457 }
1458
1459 /**
1460 * Displays the links
1461 */
1462 if (isset($viewing_mode) && $viewing_mode == 'db') {
1463 $db = $checkprivs;
1464 $url_query .= '&amp;goto=db_operations.php';
1465
1466 // Gets the database structure
1467 $sub_part = '_structure';
1468 require './libraries/db_info.inc.php';
1469 echo "\n";
1470 } else {
1471 require './libraries/server_links.inc.php';
1472 }
1473
1474
1475 /**
1476 * Displays the page
1477 */
1478
1479 // export user definition
1480 if (isset($_REQUEST['export'])) {
1481 echo '<h2>' . __('User') . ' \'' . htmlspecialchars($username) . '\'@\'' . htmlspecialchars($hostname) . '\'</h2>';
1482 echo '<textarea cols="' . $GLOBALS['cfg']['TextareaCols'] . '" rows="' . $GLOBALS['cfg']['TextareaRows'] . '">';
1483 $grants = PMA_DBI_fetch_result("SHOW GRANTS FOR '" . PMA_sqlAddslashes($username) . "'@'" . PMA_sqlAddslashes($hostname) . "'");
1484 foreach($grants as $one_grant) {
1485 echo $one_grant . ";\n\n";
1486 }
1487 echo '</textarea>';
1488 unset($username, $hostname, $grants, $one_grant);
1489 if( $GLOBALS['is_ajax_request']) {
1490 exit;
1491 }
1492 }
1493
1494 if (empty($_REQUEST['adduser']) && (! isset($checkprivs) || ! strlen($checkprivs))) {
1495 if (! isset($username)) {
1496 // No username is given --> display the overview
1497 echo '<h2>' . "\n"
1498 . PMA_getIcon('b_usrlist.png')
1499 . __('User overview') . "\n"
1500 . '</h2>' . "\n";
1501
1502 $sql_query =
1503 'SELECT *,' .
1504 " IF(`Password` = _latin1 '', 'N', 'Y') AS 'Password'" .
1505 ' FROM `mysql`.`user`';
1506
1507 $sql_query .= (isset($initial) ? PMA_RangeOfUsers($initial) : '');
1508
1509 $sql_query .= ' ORDER BY `User` ASC, `Host` ASC;';
1510 $res = PMA_DBI_try_query($sql_query, null, PMA_DBI_QUERY_STORE);
1511
1512 if (! $res) {
1513 // the query failed! This may have two reasons:
1514 // - the user does not have enough privileges
1515 // - the privilege tables use a structure of an earlier version.
1516 // so let's try a more simple query
1517
1518 $sql_query = 'SELECT * FROM `mysql`.`user`';
1519 $res = PMA_DBI_try_query($sql_query, null, PMA_DBI_QUERY_STORE);
1520
1521 if (!$res) {
1522 PMA_Message::error(__('No Privileges'))->display();
1523 PMA_DBI_free_result($res);
1524 unset($res);
1525 } else {
1526 // This message is hardcoded because I will replace it by
1527 // a automatic repair feature soon.
1528 $raw = 'Your privilege table structure seems to be older than'
1529 . ' this MySQL version!<br />'
1530 . 'Please run the <tt>mysql_upgrade</tt> command'
1531 . '(<tt>mysql_fix_privilege_tables</tt> on older systems)'
1532 . ' that should be included in your MySQL server distribution'
1533 . ' to solve this problem!';
1534 PMA_Message::rawError($raw)->display();
1535 }
1536 } else {
1537
1538 // we also want users not in table `user` but in other table
1539 $tables = PMA_DBI_fetch_result('SHOW TABLES FROM `mysql`;');
1540
1541 $tables_to_search_for_users = array(
1542 'user', 'db', 'tables_priv', 'columns_priv', 'procs_priv',
1543 );
1544
1545 $db_rights_sqls = array();
1546 foreach ($tables_to_search_for_users as $table_search_in) {
1547 if (in_array($table_search_in, $tables)) {
1548 $db_rights_sqls[] = 'SELECT DISTINCT `User`, `Host` FROM `mysql`.`' . $table_search_in . '` ' . (isset($initial) ? PMA_RangeOfUsers($initial) : '');
1549 }
1550 }
1551
1552 $user_defaults = array(
1553 'User' => '',
1554 'Host' => '%',
1555 'Password' => '?',
1556 'Grant_priv' => 'N',
1557 'privs' => array('USAGE'),
1558 );
1559
1560 // for all initials, even non A-Z
1561 $array_initials = array();
1562 // for the rights
1563 $db_rights = array();
1564
1565 $db_rights_sql = '(' . implode(') UNION (', $db_rights_sqls) . ')'
1566 .' ORDER BY `User` ASC, `Host` ASC';
1567
1568 $db_rights_result = PMA_DBI_query($db_rights_sql);
1569
1570 while ($db_rights_row = PMA_DBI_fetch_assoc($db_rights_result)) {
1571 $db_rights_row = array_merge($user_defaults, $db_rights_row);
1572 $db_rights[$db_rights_row['User']][$db_rights_row['Host']] =
1573 $db_rights_row;
1574 }
1575 PMA_DBI_free_result($db_rights_result);
1576 unset($db_rights_sql, $db_rights_sqls, $db_rights_result, $db_rights_row);
1577 ksort($db_rights);
1578
1579 /**
1580 * Displays the initials
1581 * In an Ajax request, we don't need to show this
1582 */
1583
1584 if( $GLOBALS['is_ajax_request'] != true ) {
1585
1586 // initialize to FALSE the letters A-Z
1587 for ($letter_counter = 1; $letter_counter < 27; $letter_counter++) {
1588 if (! isset($array_initials[chr($letter_counter + 64)])) {
1589 $array_initials[chr($letter_counter + 64)] = FALSE;
1590 }
1591 }
1592
1593 $initials = PMA_DBI_try_query('SELECT DISTINCT UPPER(LEFT(`User`,1)) FROM `user` ORDER BY `User` ASC', null, PMA_DBI_QUERY_STORE);
1594 while (list($tmp_initial) = PMA_DBI_fetch_row($initials)) {
1595 $array_initials[$tmp_initial] = TRUE;
1596 }
1597
1598 // Display the initials, which can be any characters, not
1599 // just letters. For letters A-Z, we add the non-used letters
1600 // as greyed out.
1601
1602 uksort($array_initials, "strnatcasecmp");
1603
1604 echo '<table id="initials_table" class="' . $conditional_class . '" <cellspacing="5"><tr>';
1605 foreach ($array_initials as $tmp_initial => $initial_was_found) {
1606 if ($initial_was_found) {
1607 echo '<td><a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;initial=' . urlencode($tmp_initial) . '">' . $tmp_initial . '</a></td>' . "\n";
1608 } else {
1609 echo '<td>' . $tmp_initial . '</td>';
1610 }
1611 }
1612 echo '<td><a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;showall=1">[' . __('Show all') . ']</a></td>' . "\n";
1613 echo '</tr></table>';
1614 }
1615
1616 /**
1617 * Display the user overview
1618 * (if less than 50 users, display them immediately)
1619 */
1620
1621 if (isset($initial) || isset($showall) || PMA_DBI_num_rows($res) < 50) {
1622
1623 while ($row = PMA_DBI_fetch_assoc($res)) {
1624 $row['privs'] = PMA_extractPrivInfo($row, true);
1625 $db_rights[$row['User']][$row['Host']] = $row;
1626 }
1627 @PMA_DBI_free_result($res);
1628 unset($res);
1629
1630 echo '<form name="usersForm" id="usersForm" action="server_privileges.php" method="post">' . "\n"
1631 . PMA_generate_common_hidden_inputs('', '')
1632 . ' <table id="tableuserrights" class="data">' . "\n"
1633 . ' <thead>' . "\n"
1634 . ' <tr><th></th>' . "\n"
1635 . ' <th>' . __('User') . '</th>' . "\n"
1636 . ' <th>' . __('Host') . '</th>' . "\n"
1637 . ' <th>' . __('Password') . '</th>' . "\n"
1638 . ' <th>' . __('Global privileges') . ' '
1639 . PMA_showHint(__(' Note: MySQL privilege names are expressed in English ')) . '</th>' . "\n"
1640 . ' <th>' . __('Grant') . '</th>' . "\n"
1641 . ' <th colspan="2">' . __('Action') . '</th>' . "\n";
1642 echo ' </tr>' . "\n";
1643 echo ' </thead>' . "\n";
1644 echo ' <tbody>' . "\n";
1645 $odd_row = true;
1646 $index_checkbox = -1;
1647 foreach ($db_rights as $user) {
1648 $index_checkbox++;
1649 ksort($user);
1650 foreach ($user as $host) {
1651 $index_checkbox++;
1652 echo ' <tr class="' . ($odd_row ? 'odd' : 'even') . '">' . "\n"
1653 . ' <td><input type="checkbox" name="selected_usr[]" id="checkbox_sel_users_'
1654 . $index_checkbox . '" value="'
1655 . htmlspecialchars($host['User'] . '&amp;#27;' . $host['Host'])
1656 . '"'
1657 . (empty($GLOBALS['checkall']) ? '' : ' checked="checked"')
1658 . ' /></td>' . "\n"
1659 . ' <td><label for="checkbox_sel_users_' . $index_checkbox . '">' . (empty($host['User']) ? '<span style="color: #FF0000">' . __('Any') . '</span>' : htmlspecialchars($host['User'])) . '</label></td>' . "\n"
1660 . ' <td>' . htmlspecialchars($host['Host']) . '</td>' . "\n";
1661 echo ' <td>';
1662 switch ($host['Password']) {
1663 case 'Y':
1664 echo __('Yes');
1665 break;
1666 case 'N':
1667 echo '<span style="color: #FF0000">' . __('No') . '</span>';
1668 break;
1669 // this happens if this is a definition not coming from mysql.user
1670 default:
1671 echo '--'; // in future version, replace by "not present"
1672 break;
1673 } // end switch
1674 echo '</td>' . "\n"
1675 . ' <td><tt>' . "\n"
1676 . ' ' . implode(',' . "\n" . ' ', $host['privs']) . "\n"
1677 . ' </tt></td>' . "\n"
1678 . ' <td>' . ($host['Grant_priv'] == 'Y' ? __('Yes') : __('No')) . '</td>' . "\n"
1679 . ' <td align="center">';
1680 printf($link_edit, urlencode($host['User']), urlencode($host['Host']), '', '');
1681 echo '</td>';
1682 echo '<td align="center">';
1683 printf($link_export, urlencode($host['User']), urlencode($host['Host']), (isset($initial) ? $initial : ''));
1684 echo '</td>';
1685 echo '</tr>';
1686 $odd_row = ! $odd_row;
1687 }
1688 }
1689
1690 unset($user, $host, $odd_row);
1691 echo ' </tbody></table>' . "\n"
1692 .'<img class="selectallarrow"'
1693 .' src="' . $pmaThemeImage . 'arrow_' . $text_dir . '.png"'
1694 .' width="38" height="22"'
1695 .' alt="' . __('With selected:') . '" />' . "\n"
1696 .'<a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;checkall=1"'
1697 .' onclick="if (markAllRows(\'usersForm\')) return false;">'
1698 . __('Check All') . '</a>' . "\n"
1699 .'/' . "\n"
1700 .'<a href="server_privileges.php?' . $GLOBALS['url_query'] . '"'
1701 .' onclick="if (unMarkAllRows(\'usersForm\')) return false;">'
1702 . __('Uncheck All') . '</a>' . "\n";
1703
1704 // add/delete user fieldset
1705 echo ' <fieldset id="fieldset_add_user">' . "\n"
1706 . ' <a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;adduser=1" class="' . $conditional_class . '">' . "\n"
1707 . PMA_getIcon('b_usradd.png')
1708 . ' ' . __('Add a new User') . '</a>' . "\n"
1709 . ' </fieldset>' . "\n"
1710 . ' <fieldset id="fieldset_delete_user">'
1711 . ' <legend>' . "\n"
1712 . PMA_getIcon('b_usrdrop.png')
1713 . ' ' . __('Remove selected users') . '' . "\n"
1714 . ' </legend>' . "\n"
1715 . ' <input type="hidden" name="mode" value="2" />' . "\n"
1716 . '(' . __('Revoke all active privileges from the users and delete them afterwards.') . ')<br />' . "\n"
1717 . ' <input type="checkbox" title="' . __('Drop the databases that have the same names as the users.') . '" name="drop_users_db" id="checkbox_drop_users_db" />' . "\n"
1718 . ' <label for="checkbox_drop_users_db" title="' . __('Drop the databases that have the same names as the users.') . '">' . "\n"
1719 . ' ' . __('Drop the databases that have the same names as the users.') . "\n"
1720 . ' </label>' . "\n"
1721 . ' </fieldset>' . "\n"
1722 . ' <fieldset id="fieldset_delete_user_footer" class="tblFooters">' . "\n"
1723 . ' <input type="submit" name="delete" value="' . __('Go') . '" id="buttonGo" class="' . $conditional_class . '"/>' . "\n"
1724 . ' </fieldset>' . "\n"
1725 . '</form>' . "\n";
1726 } else {
1727
1728 unset ($row);
1729 echo ' <fieldset id="fieldset_add_user">' . "\n"
1730 . ' <a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;adduser=1">' . "\n"
1731 . PMA_getIcon('b_usradd.png')
1732 . ' ' . __('Add a new User') . '</a>' . "\n"
1733 . ' </fieldset>' . "\n";
1734 } // end if (display overview)
1735
1736 if( $GLOBALS['is_ajax_request'] ) {
1737 exit;
1738 }
1739
1740 $flushnote = new PMA_Message(__('Note: phpMyAdmin gets the users\' privileges directly from MySQL\'s privilege tables. The content of these tables may differ from the privileges the server uses, if they have been changed manually. In this case, you should %sreload the privileges%s before you continue.'), PMA_Message::NOTICE);
1741 $flushnote->addParam('<a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;flush_privileges=1" id="reload_privileges_anchor" class="' . $conditional_class . '">', false);
1742 $flushnote->addParam('</a>', false);
1743 $flushnote->display();
1744 }
1745
1746
1747 } else {
1748
1749 // A user was selected -> display the user's properties
1750
1751 // In an Ajax request, prevent cached values from showing
1752 if($GLOBALS['is_ajax_request'] == true) {
1753 header('Cache-Control: no-cache');
1754 }
1755
1756 echo '<h2>' . "\n"
1757 . PMA_getIcon('b_usredit.png')
1758 . __('Edit Privileges') . ': '
1759 . __('User') ;
1760
1761 if (isset($dbname)) {
1762 echo ' <i><a href="server_privileges.php?'
1763 . $GLOBALS['url_query'] . '&amp;username=' . htmlspecialchars(urlencode($username))
1764 . '&amp;hostname=' . htmlspecialchars(urlencode($hostname)) . '&amp;dbname=&amp;tablename=">\''
1765 . htmlspecialchars($username) . '\'@\'' . htmlspecialchars($hostname)
1766 . '\'</a></i>' . "\n";
1767 $url_dbname = urlencode(str_replace(array('\_', '\%'), array('_', '%'), $dbname));
1768
1769 echo ' - ' . ($dbname_is_wildcard ? __('Databases') : __('Database') );
1770 if (isset($tablename)) {
1771 echo ' <i><a href="server_privileges.php?' . $GLOBALS['url_query']
1772 . '&amp;username=' . htmlspecialchars(urlencode($username)) . '&amp;hostname=' . htmlspecialchars(urlencode($hostname))
1773 . '&amp;dbname=' . htmlspecialchars($url_dbname) . '&amp;tablename=">' . htmlspecialchars($dbname) . '</a></i>';
1774 echo ' - ' . __('Table') . ' <i>' . htmlspecialchars($tablename) . '</i>';
1775 } else {
1776 echo ' <i>' . htmlspecialchars($dbname) . '</i>';
1777 }
1778
1779 } else {
1780 echo ' <i>\'' . htmlspecialchars($username) . '\'@\'' . htmlspecialchars($hostname)
1781 . '\'</i>' . "\n";
1782
1783 }
1784 echo '</h2>' . "\n";
1785
1786
1787 $sql = "SELECT '1' FROM `mysql`.`user`"
1788 . " WHERE `User` = '" . PMA_sqlAddslashes($username) . "'"
1789 . " AND `Host` = '" . PMA_sqlAddslashes($hostname) . "';";
1790 $user_does_not_exists = (bool) ! PMA_DBI_fetch_value($sql);
1791 unset($sql);
1792 if ($user_does_not_exists) {
1793 PMA_Message::error(__('The selected user was not found in the privilege table.'))->display();
1794 PMA_displayLoginInformationFields();
1795 //require './libraries/footer.inc.php';
1796 }
1797
1798 echo '<form name="usersForm" id="addUsersForm_' . $random_n . '" action="server_privileges.php" method="post">' . "\n";
1799 $_params = array(
1800 'username' => $username,
1801 'hostname' => $hostname,
1802 );
1803 if (isset($dbname)) {
1804 $_params['dbname'] = $dbname;
1805 if (isset($tablename)) {
1806 $_params['tablename'] = $tablename;
1807 }
1808 }
1809 echo PMA_generate_common_hidden_inputs($_params);
1810
1811 PMA_displayPrivTable(PMA_ifSetOr($dbname, '*', 'length'),
1812 PMA_ifSetOr($tablename, '*', 'length'));
1813
1814 echo '</form>' . "\n";
1815
1816 if (! isset($tablename) && empty($dbname_is_wildcard)) {
1817
1818 // no table name was given, display all table specific rights
1819 // but only if $dbname contains no wildcards
1820
1821 // table header
1822 echo '<form action="server_privileges.php" method="post">' . "\n"
1823 . PMA_generate_common_hidden_inputs('', '')
1824 . '<input type="hidden" name="username" value="' . htmlspecialchars($username) . '" />' . "\n"
1825 . '<input type="hidden" name="hostname" value="' . htmlspecialchars($hostname) . '" />' . "\n"
1826 . '<fieldset>' . "\n"
1827 . '<legend>' . (! isset($dbname) ? __('Database-specific privileges') : __('Table-specific privileges')) . '</legend>' . "\n"
1828 . '<table class="data">' . "\n"
1829 . '<thead>' . "\n"
1830 . '<tr><th>' . (! isset($dbname) ? __('Database') : __('Table')) . '</th>' . "\n"
1831 . ' <th>' . __('Privileges') . '</th>' . "\n"
1832 . ' <th>' . __('Grant') . '</th>' . "\n"
1833 . ' <th>' . (! isset($dbname) ? __('Table-specific privileges') : __('Column-specific privileges')) . '</th>' . "\n"
1834 . ' <th colspan="2">' . __('Action') . '</th>' . "\n"
1835 . '</tr>' . "\n"
1836 . '</thead>' . "\n"
1837 . '<tbody>' . "\n";
1838
1839 $user_host_condition =
1840 ' WHERE `User`'
1841 . ' = \'' . PMA_sqlAddslashes($username) . "'"
1842 . ' AND `Host`'
1843 . ' = \'' . PMA_sqlAddslashes($hostname) . "'";
1844
1845 // table body
1846 // get data
1847
1848 // we also want privielgs for this user not in table `db` but in other table
1849 $tables = PMA_DBI_fetch_result('SHOW TABLES FROM `mysql`;');
1850 if (! isset($dbname)) {
1851
1852 // no db name given, so we want all privs for the given user
1853
1854 $tables_to_search_for_users = array(
1855 'tables_priv', 'columns_priv',
1856 );
1857
1858 $db_rights_sqls = array();
1859 foreach ($tables_to_search_for_users as $table_search_in) {
1860 if (in_array($table_search_in, $tables)) {
1861 $db_rights_sqls[] = '
1862 SELECT DISTINCT `Db`
1863 FROM `mysql`.' . PMA_backquote($table_search_in)
1864 . $user_host_condition;
1865 }
1866 }
1867
1868 $user_defaults = array(
1869 'Db' => '',
1870 'Grant_priv' => 'N',
1871 'privs' => array('USAGE'),
1872 'Table_privs' => true,
1873 );
1874
1875 // for the rights
1876 $db_rights = array();
1877
1878 $db_rights_sql = '(' . implode(') UNION (', $db_rights_sqls) . ')'
1879 .' ORDER BY `Db` ASC';
1880
1881 $db_rights_result = PMA_DBI_query($db_rights_sql);
1882
1883 while ($db_rights_row = PMA_DBI_fetch_assoc($db_rights_result)) {
1884 $db_rights_row = array_merge($user_defaults, $db_rights_row);
1885 // only Db names in the table `mysql`.`db` uses wildcards
1886 // as we are in the db specific rights display we want
1887 // all db names escaped, also from other sources
1888 $db_rights_row['Db'] = PMA_escape_mysql_wildcards(
1889 $db_rights_row['Db']);
1890 $db_rights[$db_rights_row['Db']] = $db_rights_row;
1891 }
1892
1893 PMA_DBI_free_result($db_rights_result);
1894 unset($db_rights_sql, $db_rights_sqls, $db_rights_result, $db_rights_row);
1895
1896 $sql_query = 'SELECT * FROM `mysql`.`db`' . $user_host_condition . ' ORDER BY `Db` ASC';
1897 $res = PMA_DBI_query($sql_query);
1898 $sql_query = '';
1899
1900 while ($row = PMA_DBI_fetch_assoc($res)) {
1901 if (isset($db_rights[$row['Db']])) {
1902 $db_rights[$row['Db']] = array_merge($db_rights[$row['Db']], $row);
1903 } else {
1904 $db_rights[$row['Db']] = $row;
1905 }
1906 // there are db specific rights for this user
1907 // so we can drop this db rights
1908 $db_rights[$row['Db']]['can_delete'] = true;
1909 }
1910 PMA_DBI_free_result($res);
1911 unset($row, $res);
1912
1913 } else {
1914
1915 // db name was given,
1916 // so we want all user specific rights for this db
1917
1918 $user_host_condition .=
1919 ' AND `Db`'
1920 .' LIKE \'' . PMA_sqlAddslashes($dbname) . "'";
1921
1922 $tables_to_search_for_users = array(
1923 'columns_priv',
1924 );
1925
1926 $db_rights_sqls = array();
1927 foreach ($tables_to_search_for_users as $table_search_in) {
1928 if (in_array($table_search_in, $tables)) {
1929 $db_rights_sqls[] = '
1930 SELECT DISTINCT `Table_name`
1931 FROM `mysql`.' . PMA_backquote($table_search_in)
1932 . $user_host_condition;
1933 }
1934 }
1935
1936 $user_defaults = array(
1937 'Table_name' => '',
1938 'Grant_priv' => 'N',
1939 'privs' => array('USAGE'),
1940 'Column_priv' => true,
1941 );
1942
1943 // for the rights
1944 $db_rights = array();
1945
1946 $db_rights_sql = '(' . implode(') UNION (', $db_rights_sqls) . ')'
1947 .' ORDER BY `Table_name` ASC';
1948
1949 $db_rights_result = PMA_DBI_query($db_rights_sql);
1950
1951 while ($db_rights_row = PMA_DBI_fetch_assoc($db_rights_result)) {
1952 $db_rights_row = array_merge($user_defaults, $db_rights_row);
1953 $db_rights[$db_rights_row['Table_name']] = $db_rights_row;
1954 }
1955 PMA_DBI_free_result($db_rights_result);
1956 unset($db_rights_sql, $db_rights_sqls, $db_rights_result, $db_rights_row);
1957
1958 $sql_query =
1959 'SELECT `Table_name`,'
1960 .' `Table_priv`,'
1961 .' IF(`Column_priv` = _latin1 \'\', 0, 1)'
1962 .' AS \'Column_priv\''
1963 .' FROM `mysql`.`tables_priv`'
1964 . $user_host_condition
1965 .' ORDER BY `Table_name` ASC;';
1966 $res = PMA_DBI_query($sql_query);
1967 $sql_query = '';
1968
1969 while ($row = PMA_DBI_fetch_assoc($res)) {
1970 if (isset($db_rights[$row['Table_name']])) {
1971 $db_rights[$row['Table_name']] = array_merge($db_rights[$row['Table_name']], $row);
1972 } else {
1973 $db_rights[$row['Table_name']] = $row;
1974 }
1975 }
1976 PMA_DBI_free_result($res);
1977 unset($row, $res);
1978 }
1979 ksort($db_rights);
1980
1981 // display rows
1982 if (count($db_rights) < 1) {
1983 echo '<tr class="odd">' . "\n"
1984 . ' <td colspan="6"><center><i>' . __('None') . '</i></center></td>' . "\n"
1985 . '</tr>' . "\n";
1986 } else {
1987 $odd_row = true;
1988 $found_rows = array();
1989 //while ($row = PMA_DBI_fetch_assoc($res)) {
1990 foreach ($db_rights as $row) {
1991 $found_rows[] = (! isset($dbname)) ? $row['Db'] : $row['Table_name'];
1992
1993 echo '<tr class="' . ($odd_row ? 'odd' : 'even') . '">' . "\n"
1994 . ' <td>' . htmlspecialchars((! isset($dbname)) ? $row['Db'] : $row['Table_name']) . '</td>' . "\n"
1995 . ' <td><tt>' . "\n"
1996 . ' ' . join(',' . "\n" . ' ', PMA_extractPrivInfo($row, TRUE)) . "\n"
1997 . ' </tt></td>' . "\n"
1998 . ' <td>' . ((((! isset($dbname)) && $row['Grant_priv'] == 'Y') || (isset($dbname) && in_array('Grant', explode(',', $row['Table_priv'])))) ? __('Yes') : __('No')) . '</td>' . "\n"
1999 . ' <td>';
2000 if (! empty($row['Table_privs']) || ! empty ($row['Column_priv'])) {
2001 echo __('Yes');
2002 } else {
2003 echo __('No');
2004 }
2005 echo '</td>' . "\n"
2006 . ' <td>';
2007 printf($link_edit, htmlspecialchars(urlencode($username)),
2008 urlencode(htmlspecialchars($hostname)),
2009 urlencode((! isset($dbname)) ? $row['Db'] : htmlspecialchars($dbname)),
2010 urlencode((! isset($dbname)) ? '' : $row['Table_name']));
2011 echo '</td>' . "\n"
2012 . ' <td>';
2013 if (! empty($row['can_delete']) || isset($row['Table_name']) && strlen($row['Table_name'])) {
2014 printf($link_revoke, htmlspecialchars(urlencode($username)),
2015 urlencode(htmlspecialchars($hostname)),
2016 urlencode((! isset($dbname)) ? $row['Db'] : htmlspecialchars($dbname)),
2017 urlencode((! isset($dbname)) ? '' : $row['Table_name']));
2018 }
2019 echo '</td>' . "\n"
2020 . '</tr>' . "\n";
2021 $odd_row = ! $odd_row;
2022 } // end while
2023 }
2024 unset($row);
2025 echo '</tbody>' . "\n"
2026 . '</table>' . "\n";
2027
2028 if (! isset($dbname)) {
2029
2030 // no database name was given, display select db
2031
2032 $pred_db_array =PMA_DBI_fetch_result('SHOW DATABASES;');
2033
2034 echo ' <label for="text_dbname">' . __('Add privileges on the following database') . ':</label>' . "\n";
2035 if (!empty($pred_db_array)) {
2036 echo ' <select name="pred_dbname" onchange="this.form.submit();">' . "\n"
2037 . ' <option value="" selected="selected">' . __('Use text field') . ':</option>' . "\n";
2038 foreach ($pred_db_array as $current_db) {
2039 $current_db = PMA_escape_mysql_wildcards($current_db);
2040 // cannot use array_diff() once, outside of the loop,
2041 // because the list of databases has special characters
2042 // already escaped in $found_rows,
2043 // contrary to the output of SHOW DATABASES
2044 if (empty($found_rows) || ! in_array($current_db, $found_rows)) {
2045 echo ' <option value="' . htmlspecialchars($current_db) . '">'
2046 . htmlspecialchars($current_db) . '</option>' . "\n";
2047 }
2048 }
2049 echo ' </select>' . "\n";
2050 }
2051 echo ' <input type="text" id="text_dbname" name="dbname" />' . "\n"
2052 . PMA_showHint(__('Wildcards % and _ should be escaped with a \ to use them literally'));
2053 } else {
2054 echo ' <input type="hidden" name="dbname" value="' . htmlspecialchars($dbname) . '"/>' . "\n"
2055 . ' <label for="text_tablename">' . __('Add privileges on the following table') . ':</label>' . "\n";
2056 if ($res = @PMA_DBI_try_query('SHOW TABLES FROM ' . PMA_backquote(PMA_unescape_mysql_wildcards($dbname)) . ';', null, PMA_DBI_QUERY_STORE)) {
2057 $pred_tbl_array = array();
2058 while ($row = PMA_DBI_fetch_row($res)) {
2059 if (! isset($found_rows) || !in_array($row[0], $found_rows)) {
2060 $pred_tbl_array[] = $row[0];
2061 }
2062 }
2063 PMA_DBI_free_result($res);
2064 unset($res, $row);
2065 if (!empty($pred_tbl_array)) {
2066 echo ' <select name="pred_tablename" onchange="this.form.submit();">' . "\n"
2067 . ' <option value="" selected="selected">' . __('Use text field') . ':</option>' . "\n";
2068 foreach ($pred_tbl_array as $current_table) {
2069 echo ' <option value="' . htmlspecialchars($current_table) . '">' . htmlspecialchars($current_table) . '</option>' . "\n";
2070 }
2071 echo ' </select>' . "\n";
2072 }
2073 } else {
2074 unset($res);
2075 }
2076 echo ' <input type="text" id="text_tablename" name="tablename" />' . "\n";
2077 }
2078 echo '</fieldset>' . "\n";
2079 echo '<fieldset class="tblFooters">' . "\n"
2080 . ' <input type="submit" value="' . __('Go') . '" />'
2081 . '</fieldset>' . "\n"
2082 . '</form>' . "\n";
2083
2084 }
2085
2086 // Provide a line with links to the relevant database and table
2087 if (isset($dbname) && empty($dbname_is_wildcard)) {
2088 echo '[ ' . __('Database')
2089 . ' <a href="' . $GLOBALS['cfg']['DefaultTabDatabase'] . '?'
2090 . $GLOBALS['url_query'] . '&amp;db=' . $url_dbname . '&amp;reload=1">'
2091 . htmlspecialchars($dbname) . ': ' . PMA_getTitleForTarget($GLOBALS['cfg']['DefaultTabDatabase']) . "</a> ]\n";
2092
2093 if (isset($tablename)) {
2094 echo ' [ ' . __('Table') . ' <a href="'
2095 . $GLOBALS['cfg']['DefaultTabTable'] . '?' . $GLOBALS['url_query']
2096 . '&amp;db=' . $url_dbname . '&amp;table=' . htmlspecialchars(urlencode($tablename))
2097 . '&amp;reload=1">' . htmlspecialchars($tablename) . ': '
2098 . PMA_getTitleForTarget($GLOBALS['cfg']['DefaultTabTable'])
2099 . "</a> ]\n";
2100 }
2101 unset($url_dbname);
2102 }
2103
2104 if (! isset($dbname) && ! $user_does_not_exists) {
2105 require_once './libraries/display_change_password.lib.php';
2106
2107 echo '<form action="server_privileges.php" method="post" onsubmit="return checkPassword(this);">' . "\n"
2108 . PMA_generate_common_hidden_inputs('', '')
2109 . '<input type="hidden" name="old_username" value="' . htmlspecialchars($username) . '" />' . "\n"
2110 . '<input type="hidden" name="old_hostname" value="' . htmlspecialchars($hostname) . '" />' . "\n"
2111 . '<fieldset id="fieldset_change_copy_user">' . "\n"
2112 . ' <legend>' . __('Change Login Information / Copy User') . '</legend>' . "\n";
2113 PMA_displayLoginInformationFields('change');
2114 echo ' <fieldset>' . "\n"
2115 . ' <legend>' . __('Create a new user with the same privileges and ...') . '</legend>' . "\n";
2116 $choices = array(
2117 '4' => __('... keep the old one.'),
2118 '1' => __(' ... delete the old one from the user tables.'),
2119 '2' => __(' ... revoke all active privileges from the old one and delete it afterwards.'),
2120 '3' => __(' ... delete the old one from the user tables and reload the privileges afterwards.'));
2121 PMA_display_html_radio('mode', $choices, '4', true);
2122 unset($choices);
2123
2124 echo ' </fieldset>' . "\n"
2125 . '</fieldset>' . "\n"
2126 . '<fieldset id="fieldset_change_copy_user_footer" class="tblFooters">' . "\n"
2127 . ' <input type="submit" name="change_copy" value="' . __('Go') . '" />' . "\n"
2128 . '</fieldset>' . "\n"
2129 . '</form>' . "\n";
2130 }
2131 }
2132 } elseif (isset($_REQUEST['adduser'])) {
2133
2134 // Add a new user
2135 $GLOBALS['url_query'] .= '&amp;adduser=1';
2136 echo '<h2>' . "\n"
2137 . PMA_getIcon('b_usradd.png') . __('Add a new User') . "\n"
2138 . '</h2>' . "\n"
2139 . '<form name="usersForm" id="addUsersForm_' . $random_n . '" action="server_privileges.php" method="post">' . "\n"
2140 . PMA_generate_common_hidden_inputs('', '');
2141 PMA_displayLoginInformationFields('new');
2142 echo '<fieldset id="fieldset_add_user_database">' . "\n"
2143 . '<legend>' . __('Database for user') . '</legend>' . "\n";
2144
2145 $default_choice = 0;
2146 $choices = array(
2147 '0' => _pgettext('Create none database for user', 'None'),
2148 '1' => __('Create database with same name and grant all privileges'),
2149 '2' => __('Grant all privileges on wildcard name (username\\_%)'));
2150
2151 if ( !empty($dbname) ) {
2152 $choices['3'] = sprintf( __('Grant all privileges on database &quot;%s&quot;'), htmlspecialchars($dbname));
2153 $default_choice = 3;
2154 echo '<input type="hidden" name="dbname" value="' . htmlspecialchars($dbname) . '" />' . "\n";
2155 }
2156
2157 // 4th parameter set to true to add line breaks
2158 // 5th parameter set to false to avoid htmlspecialchars() escaping in the label
2159 // since we have some HTML in some labels
2160 PMA_display_html_radio('createdb', $choices, $default_choice, true, false);
2161 unset($choices);
2162 unset($default_choice);
2163
2164 echo '</fieldset>' . "\n";
2165 PMA_displayPrivTable('*', '*', FALSE);
2166 echo ' <fieldset id="fieldset_add_user_footer" class="tblFooters">' . "\n"
2167 . ' <input type="submit" name="adduser_submit" value="' . __('Go') . '" />' . "\n"
2168 . ' </fieldset>' . "\n"
2169 . '</form>' . "\n";
2170 } else {
2171 // check the privileges for a particular database.
2172 echo '<form id="usersForm"><table id="dbspecificuserrights" class="data">' . "\n"
2173 . '<caption class="tblHeaders">' . "\n"
2174 . PMA_getIcon('b_usrcheck.png')
2175 . ' ' . sprintf(__('Users having access to &quot;%s&quot;'), '<a href="' . $GLOBALS['cfg']['DefaultTabDatabase'] . '?' . PMA_generate_common_url($checkprivs) . '">' . htmlspecialchars($checkprivs) . '</a>') . "\n"
2176 . '</caption>' . "\n"
2177 . '<thead>' . "\n"
2178 . ' <tr><th>' . __('User') . '</th>' . "\n"
2179 . ' <th>' . __('Host') . '</th>' . "\n"
2180 . ' <th>' . __('Type') . '</th>' . "\n"
2181 . ' <th>' . __('Privileges') . '</th>' . "\n"
2182 . ' <th>' . __('Grant') . '</th>' . "\n"
2183 . ' <th>' . __('Action') . '</th>' . "\n"
2184 . ' </tr>' . "\n"
2185 . '</thead>' . "\n"
2186 . '<tbody>' . "\n";
2187 $odd_row = TRUE;
2188 unset($row, $row1, $row2);
2189
2190 // now, we build the table...
2191 $list_of_privileges =
2192 '`User`, '
2193 . '`Host`, '
2194 . '`Select_priv`, '
2195 . '`Insert_priv`, '
2196 . '`Update_priv`, '
2197 . '`Delete_priv`, '
2198 . '`Create_priv`, '
2199 . '`Drop_priv`, '
2200 . '`Grant_priv`, '
2201 . '`Index_priv`, '
2202 . '`Alter_priv`, '
2203 . '`References_priv`, '
2204 . '`Create_tmp_table_priv`, '
2205 . '`Lock_tables_priv`, '
2206 . '`Create_view_priv`, '
2207 . '`Show_view_priv`, '
2208 . '`Create_routine_priv`, '
2209 . '`Alter_routine_priv`, '
2210 . '`Execute_priv`';
2211
2212 $list_of_compared_privileges =
2213 '`Select_priv` = \'N\''
2214 . ' AND `Insert_priv` = \'N\''
2215 . ' AND `Update_priv` = \'N\''
2216 . ' AND `Delete_priv` = \'N\''
2217 . ' AND `Create_priv` = \'N\''
2218 . ' AND `Drop_priv` = \'N\''
2219 . ' AND `Grant_priv` = \'N\''
2220 . ' AND `References_priv` = \'N\''
2221 . ' AND `Create_tmp_table_priv` = \'N\''
2222 . ' AND `Lock_tables_priv` = \'N\''
2223 . ' AND `Create_view_priv` = \'N\''
2224 . ' AND `Show_view_priv` = \'N\''
2225 . ' AND `Create_routine_priv` = \'N\''
2226 . ' AND `Alter_routine_priv` = \'N\''
2227 . ' AND `Execute_priv` = \'N\'';
2228
2229 if (PMA_MYSQL_INT_VERSION >= 50106) {
2230 $list_of_privileges .=
2231 ', `Event_priv`, '
2232 . '`Trigger_priv`';
2233 $list_of_compared_privileges .=
2234 ' AND `Event_priv` = \'N\''
2235 . ' AND `Trigger_priv` = \'N\'';
2236 }
2237
2238 $sql_query =
2239 '(SELECT ' . $list_of_privileges . ', `Db`'
2240 .' FROM `mysql`.`db`'
2241 .' WHERE \'' . PMA_sqlAddslashes($checkprivs) . "'"
2242 .' LIKE `Db`'
2243 .' AND NOT (' . $list_of_compared_privileges. ')) '
2244 .'UNION '
2245 .'(SELECT ' . $list_of_privileges . ', \'*\' AS `Db`'
2246 .' FROM `mysql`.`user` '
2247 .' WHERE NOT (' . $list_of_compared_privileges . ')) '
2248 .' ORDER BY `User` ASC,'
2249 .' `Host` ASC,'
2250 .' `Db` ASC;';
2251 $res = PMA_DBI_query($sql_query);
2252 $row = PMA_DBI_fetch_assoc($res);
2253 if ($row) {
2254 $found = TRUE;
2255 }
2256
2257 if ($found) {
2258 while (TRUE) {
2259 // prepare the current user
2260 $current_privileges = array();
2261 $current_user = $row['User'];
2262 $current_host = $row['Host'];
2263 while ($row && $current_user == $row['User'] && $current_host == $row['Host']) {
2264 $current_privileges[] = $row;
2265 $row = PMA_DBI_fetch_assoc($res);
2266 }
2267 echo ' <tr class="noclick ' . ($odd_row ? 'odd' : 'even') . '">' . "\n"
2268 . ' <td';
2269 if (count($current_privileges) > 1) {
2270 echo ' rowspan="' . count($current_privileges) . '"';
2271 }
2272 echo '>' . (empty($current_user) ? '<span style="color: #FF0000">' . __('Any') . '</span>' : htmlspecialchars($current_user)) . "\n"
2273 . ' </td>' . "\n"
2274 . ' <td';
2275 if (count($current_privileges) > 1) {
2276 echo ' rowspan="' . count($current_privileges) . '"';
2277 }
2278 echo '>' . htmlspecialchars($current_host) . '</td>' . "\n";
2279 foreach ($current_privileges as $current) {
2280 echo ' <td>' . "\n"
2281 . ' ';
2282 if (! isset($current['Db']) || $current['Db'] == '*') {
2283 echo __('global');
2284 } elseif ($current['Db'] == PMA_escape_mysql_wildcards($checkprivs)) {
2285 echo __('database-specific');
2286 } else {
2287 echo __('wildcard'), ': <tt>' . htmlspecialchars($current['Db']) . '</tt>';
2288 }
2289 echo "\n"
2290 . ' </td>' . "\n"
2291 . ' <td>' . "\n"
2292 . ' <tt>' . "\n"
2293 . ' ' . join(',' . "\n" . ' ', PMA_extractPrivInfo($current, TRUE)) . "\n"
2294 . ' </tt>' . "\n"
2295 . ' </td>' . "\n"
2296 . ' <td>' . "\n"
2297 . ' ' . ($current['Grant_priv'] == 'Y' ? __('Yes') : __('No')) . "\n"
2298 . ' </td>' . "\n"
2299 . ' <td>' . "\n";
2300 printf($link_edit, urlencode($current_user),
2301 urlencode($current_host),
2302 urlencode(! isset($current['Db']) || $current['Db'] == '*' ? '' : $current['Db']),
2303 '');
2304 echo '</td>' . "\n"
2305 . ' </tr>' . "\n";
2306 }
2307 if (empty($row) && empty($row1) && empty($row2)) {
2308 break;
2309 }
2310 $odd_row = ! $odd_row;
2311 }
2312 } else {
2313 echo ' <tr class="odd">' . "\n"
2314 . ' <td colspan="6">' . "\n"
2315 . ' ' . __('No user found.') . "\n"
2316 . ' </td>' . "\n"
2317 . ' </tr>' . "\n";
2318 }
2319 echo '</tbody>' . "\n"
2320 . '</table></form>' . "\n";
2321
2322 // Offer to create a new user for the current database
2323 echo '<fieldset id="fieldset_add_user">' . "\n"
2324 . ' <a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;adduser=1&amp;dbname=' . htmlspecialchars($checkprivs) .'">' . "\n"
2325 . PMA_getIcon('b_usradd.png')
2326 . ' ' . __('Add a new User') . '</a>' . "\n"
2327 . '</fieldset>' . "\n";
2328
2329 } // end if (empty($_REQUEST['adduser']) && empty($checkprivs)) ... elseif ... else ...
2330
2331
2332 /**
2333 * Displays the footer
2334 */
2335 echo "\n\n";
2336 require './libraries/footer.inc.php';
2337
2338 ?>
Proposed solution for https://sourceforge.net/tracker/?func=detail&aid=3141575&group_id=23067&atid=377411