phpmyadmin/libraries/server_user_groups.lib.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * set of functions for user group handling
   5  *
   6  * @package PhpMyAdmin
   7  */
   8
   9 if (! defined('PHPMYADMIN')) {
  10     exit;
  11 }
  12
  13 /**
  14  * Return HTML to list the users belonging to a given user group
  15  *
  16  * @param string $userGroup user group name
  17  *
  18  * @return string HTML to list the users belonging to a given user group
  19  */
  20 function PMA_getHtmlForListingUsersofAGroup($userGroup)
  21 {
  22     $html_output  = '<h2>'
  23         . sprintf(__('Users of \'%s\' user group'), htmlspecialchars($userGroup))
  24         . '</h2>';
  25
  26     $cfgRelation = PMA_getRelationsParam();
  27     $usersTable = PMA_Util::backquote($cfgRelation['db'])
  28         . "." . PMA_Util::backquote($cfgRelation['users']);
  29     $sql_query = "SELECT `username` FROM " . $usersTable
  30         . " WHERE `usergroup`='" . PMA_Util::sqlAddSlashes($userGroup) . "'";
  31     $result = PMA_queryAsControlUser($sql_query, false);
  32     if ($result) {
  33         if ($GLOBALS['dbi']->numRows($result) == 0) {
  34             $html_output .= '<p>'
  35                 . __('No users were found belonging to this user group.')
  36                 . '</p>';
  37         } else {
  38             $html_output .= '<table>'
  39                 . '<thead><tr><th>#</th><th>' . __('User') . '</th></tr></thead>'
  40                 . '<tbody>';
  41             $i = 0;
  42             while ($row = $GLOBALS['dbi']->fetchRow($result)) {
  43                 $i++;
  44                 $html_output .= '<tr>'
  45                     . '<td>' . $i . ' </td>'
  46                     . '<td>' . htmlspecialchars($row[0]) . '</td>'
  47                     . '</tr>';
  48             }
  49             $html_output .= '</tbody>'
  50                 . '</table>';
  51         }
  52     }
  53     $GLOBALS['dbi']->freeResult($result);
  54     return $html_output;
  55 }
  56
  57 /**
  58  * Returns HTML for the 'user groups' table
  59  *
  60  * @return string HTML for the 'user groups' table
  61  */
  62 function PMA_getHtmlForUserGroupsTable()
  63 {
  64     $html_output  = '<h2>' . __('User groups') . '</h2>';
  65     $cfgRelation = PMA_getRelationsParam();
  66     $groupTable = PMA_Util::backquote($cfgRelation['db'])
  67         . "." . PMA_Util::backquote($cfgRelation['usergroups']);
  68     $sql_query = "SELECT * FROM " . $groupTable . " ORDER BY `usergroup` ASC";
  69     $result = PMA_queryAsControlUser($sql_query, false);
  70
  71     if ($result && $GLOBALS['dbi']->numRows($result)) {
  72         $html_output .= '<form name="userGroupsForm" id="userGroupsForm"'
  73             . ' action="server_privileges.php" method="post">';
  74         $html_output .= PMA_URL_getHiddenInputs();
  75         $html_output .= '<table id="userGroupsTable">';
  76         $html_output .= '<thead><tr>';
  77         $html_output .= '<th style="white-space: nowrap">'
  78             . __('User group') . '</th>';
  79         $html_output .= '<th>' . __('Server level tabs') . '</th>';
  80         $html_output .= '<th>' . __('Database level tabs') . '</th>';
  81         $html_output .= '<th>' . __('Table level tabs') . '</th>';
  82         $html_output .= '<th>' . __('Action') . '</th>';
  83         $html_output .= '</tr></thead>';
  84         $html_output .= '<tbody>';
  85
  86         $odd = true;
  87         $userGroups = array();
  88         while ($row = $GLOBALS['dbi']->fetchAssoc($result)) {
  89             $groupName = $row['usergroup'];
  90             if (! isset($userGroups[$groupName])) {
  91                 $userGroups[$groupName] = array();
  92             }
  93             $userGroups[$groupName][$row['tab']] = $row['allowed'];
  94         }
  95         foreach ($userGroups as $groupName => $tabs) {
  96             $html_output .= '<tr class="' . ($odd ? 'odd' : 'even') . '">';
  97             $html_output .= '<td>' . htmlspecialchars($groupName) . '</td>';
  98             $html_output .= '<td>' . _getAllowedTabNames($tabs, 'server') . '</td>';
  99             $html_output .= '<td>' . _getAllowedTabNames($tabs, 'db') . '</td>';
 100             $html_output .= '<td>' . _getAllowedTabNames($tabs, 'table') . '</td>';
 101
 102             $html_output .= '<td>';
 103             $html_output .= '<a class="" href="server_user_groups.php'
 104                 . PMA_URL_getCommon(
 105                     array(
 106                         'viewUsers' => 1, 'userGroup' => $groupName
 107                     )
 108                 )
 109                 . '">'
 110                 . PMA_Util::getIcon('b_usrlist.png', __('View users')) . '</a>';
 111             $html_output .= '&nbsp;&nbsp;';
 112             $html_output .= '<a class="" href="server_user_groups.php'
 113                 . PMA_URL_getCommon(
 114                     array(
 115                         'editUserGroup' => 1, 'userGroup' => $groupName
 116                     )
 117                 )
 118                 . '">'
 119                 . PMA_Util::getIcon('b_edit.png', __('Edit')) . '</a>';
 120             $html_output .= '&nbsp;&nbsp;';
 121             $html_output .= '<a class="deleteUserGroup ajax"'
 122                 . ' href="server_user_groups.php'
 123                 . PMA_URL_getCommon(
 124                     array(
 125                         'deleteUserGroup' => 1, 'userGroup' => $groupName
 126                     )
 127                 )
 128                 . '">'
 129                 . PMA_Util::getIcon('b_drop.png', __('Delete')) . '</a>';
 130             $html_output .= '</td>';
 131
 132             $html_output .= '</tr>';
 133
 134             $odd = ! $odd;
 135         }
 136
 137         $html_output .= '</tbody>';
 138         $html_output .= '</table>';
 139         $html_output .= '</form>';
 140     }
 141     $GLOBALS['dbi']->freeResult($result);
 142
 143     $html_output .= '<fieldset id="fieldset_add_user_group">';
 144     $html_output .= '<a href="server_user_groups.php'
 145         . PMA_URL_getCommon(array('addUserGroup' => 1)) . '">'
 146         . PMA_Util::getIcon('b_usradd.png')
 147         . __('Add user group') . '</a>';
 148     $html_output .= '</fieldset>';
 149
 150     return $html_output;
 151 }
 152
 153 /**
 154  * Returns the list of allowed menu tab names
 155  * based on a data row from usergroup table.
 156  *
 157  * @param array  $row   row of usergroup table
 158  * @param string $level 'server', 'db' or 'table'
 159  *
 160  * @return string comma separated list of allowed menu tab names
 161  */
 162 function _getAllowedTabNames($row, $level)
 163 {
 164     $tabNames = array();
 165     $tabs = PMA_Util::getMenuTabList($level);
 166     foreach ($tabs as $tab => $tabName) {
 167         if (! isset($row[$level . '_' . $tab])
 168             || $row[$level . '_' . $tab] == 'Y'
 169         ) {
 170             $tabNames[] = $tabName;
 171         }
 172     }
 173     return implode(', ', $tabNames);
 174 }
 175
 176 /**
 177  * Deletes a user group
 178  *
 179  * @param string $userGroup user group name
 180  *
 181  * @return void
 182  */
 183 function PMA_deleteUserGroup($userGroup)
 184 {
 185     $cfgRelation = PMA_getRelationsParam();
 186     $userTable = PMA_Util::backquote($cfgRelation['db'])
 187         . "." . PMA_Util::backquote($cfgRelation['users']);
 188     $groupTable = PMA_Util::backquote($cfgRelation['db'])
 189         . "." . PMA_Util::backquote($cfgRelation['usergroups']);
 190     $sql_query = "DELETE FROM " . $userTable
 191         . " WHERE `usergroup`='" . PMA_Util::sqlAddSlashes($userGroup) . "'";
 192     PMA_queryAsControlUser($sql_query, true);
 193     $sql_query = "DELETE FROM " . $groupTable
 194         . " WHERE `usergroup`='" . PMA_Util::sqlAddSlashes($userGroup) . "'";
 195     PMA_queryAsControlUser($sql_query, true);
 196 }
 197
 198 /**
 199  * Returns HTML for add/edit user group dialog
 200  *
 201  * @param string $userGroup name of the user group in case of editing
 202  *
 203  * @return string HTML for add/edit user group dialog
 204  */
 205 function PMA_getHtmlToEditUserGroup($userGroup = null)
 206 {
 207     $html_output = '';
 208     if ($userGroup == null) {
 209         $html_output .= '<h2>' . __('Add user group') . '</h2>';
 210     } else {
 211         $html_output .= '<h2>'
 212             . sprintf(__('Edit user group: \'%s\''), htmlspecialchars($userGroup))
 213             . '</h2>';
 214     }
 215
 216     $html_output .= '<form name="userGroupForm" id="userGroupForm"'
 217         . ' action="server_user_groups.php" method="post">';
 218     $urlParams = array();
 219     if ($userGroup != null) {
 220         $urlParams['userGroup'] = $userGroup;
 221         $urlParams['editUserGroupSubmit'] = '1';
 222     } else {
 223         $urlParams['addUserGroupSubmit'] = '1';
 224     }
 225     $html_output .= PMA_URL_getHiddenInputs($urlParams);
 226
 227     $html_output .= '<fieldset id="fieldset_user_group_rights">';
 228     $html_output .= '<legend>' . __('User group menu assignments')
 229         . '&nbsp;&nbsp;&nbsp;'
 230         . '<input type="checkbox" class="checkall_box" title="Check all">'
 231         . '<label for="addUsersForm_checkall">' . __('Check all') . '</label>'
 232         . '</legend>';
 233
 234     if ($userGroup == null) {
 235         $html_output .= '<label for="userGroup">' . __('Group name:') . '</label>';
 236         $html_output .= '<input type="text" name="userGroup" '
 237             . 'autocomplete="off" required="required" />';
 238         $html_output .= '<div class="clearfloat"></div>';
 239     }
 240
 241     $allowedTabs = array(
 242         'server' => array(),
 243         'db'     => array(),
 244         'table'  => array()
 245     );
 246     if ($userGroup != null) {
 247         $cfgRelation = PMA_getRelationsParam();
 248         $groupTable = PMA_Util::backquote($cfgRelation['db'])
 249             . "." . PMA_Util::backquote($cfgRelation['usergroups']);
 250         $sql_query = "SELECT * FROM " . $groupTable
 251             . " WHERE `usergroup`='" . PMA_Util::sqlAddSlashes($userGroup) . "'";
 252         $result = PMA_queryAsControlUser($sql_query, false);
 253         if ($result) {
 254             while ($row = $GLOBALS['dbi']->fetchAssoc($result)) {
 255                 $key = $row['tab'];
 256                 $value = $row['allowed'];
 257                 if (substr($key, 0, 7) == 'server_' && $value == 'Y') {
 258                     $allowedTabs['server'][] = /*overload*/mb_substr($key, 7);
 259                 } elseif (substr($key, 0, 3) == 'db_' && $value == 'Y') {
 260                     $allowedTabs['db'][] = /*overload*/mb_substr($key, 3);
 261                 } elseif (substr($key, 0, 6) == 'table_'
 262                     && $value == 'Y'
 263                 ) {
 264                     $allowedTabs['table'][] = /*overload*/mb_substr($key, 6);
 265                 }
 266             }
 267         }
 268         $GLOBALS['dbi']->freeResult($result);
 269     }
 270
 271     $html_output .= _getTabList(
 272         __('Server-level tabs'), 'server', $allowedTabs['server']
 273     );
 274     $html_output .= _getTabList(
 275         __('Database-level tabs'), 'db', $allowedTabs['db']
 276     );
 277     $html_output .= _getTabList(
 278         __('Table-level tabs'), 'table', $allowedTabs['table']
 279     );
 280
 281     $html_output .= '</fieldset>';
 282
 283     $html_output .= '<fieldset id="fieldset_user_group_rights_footer"'
 284         . ' class="tblFooters">';
 285     $html_output .= '<input type="submit" value="' . __('Go') . '">';
 286     $html_output .= '</fieldset>';
 287
 288     return $html_output;
 289 }
 290
 291 /**
 292  * Returns HTML for checkbox groups to choose
 293  * tabs of 'server', 'db' or 'table' levels.
 294  *
 295  * @param string $title    title of the checkbox group
 296  * @param string $level    'server', 'db' or 'table'
 297  * @param array  $selected array of selected allowed tabs
 298  *
 299  * @return string HTML for checkbox groups
 300  */
 301 function _getTabList($title, $level, $selected)
 302 {
 303     $tabs = PMA_Util::getMenuTabList($level);
 304     $html_output = '<fieldset>';
 305     $html_output .= '<legend>' . $title . '</legend>';
 306     foreach ($tabs as $tab => $tabName) {
 307         $html_output .= '<div class="item">';
 308         $html_output .= '<input type="checkbox" class="checkall"'
 309             . (in_array($tab, $selected) ? ' checked="checked"' : '')
 310             . ' name="' . $level . '_' . $tab .  '" value="Y" />';
 311         $html_output .= '<label for="' . $level . '_' . $tab .  '">'
 312             . '<code>' . $tabName . '</code>'
 313             . '</label>';
 314         $html_output .= '</div>';
 315     }
 316     $html_output .= '</fieldset>';
 317     return $html_output;
 318 }
 319
 320 /**
 321  * Add/update a user group with allowed menu tabs.
 322  *
 323  * @param string  $userGroup user group name
 324  * @param boolean $new       whether this is a new user group
 325  *
 326  * @return void
 327  */
 328 function PMA_editUserGroup($userGroup, $new = false)
 329 {
 330     $tabs = PMA_Util::getMenuTabList();
 331     $cfgRelation = PMA_getRelationsParam();
 332     $groupTable = PMA_Util::backquote($cfgRelation['db'])
 333         . "." . PMA_Util::backquote($cfgRelation['usergroups']);
 334
 335     if (! $new) {
 336         $sql_query = "DELETE FROM " . $groupTable
 337             . " WHERE `usergroup`='" . PMA_Util::sqlAddSlashes($userGroup) . "';";
 338         PMA_queryAsControlUser($sql_query, true);
 339     }
 340
 341     $sql_query = "INSERT INTO " . $groupTable
 342         . "(`usergroup`, `tab`, `allowed`)"
 343         . " VALUES ";
 344     $first = true;
 345     foreach ($tabs as $tabGroupName => $tabGroup) {
 346         foreach ($tabs[$tabGroupName] as $tab => $tabName) {
 347             if (! $first) {
 348                 $sql_query .= ", ";
 349             }
 350             $tabName = $tabGroupName . '_' . $tab;
 351             $allowed = isset($_REQUEST[$tabName]) && $_REQUEST[$tabName] == 'Y';
 352             $sql_query .= "('" . $userGroup . "', '" . $tabName . "', '"
 353                 . ($allowed ? "Y" : "N") . "')";
 354             $first = false;
 355         }
 356     }
 357     $sql_query .= ";";
 358     PMA_queryAsControlUser($sql_query, true);
 359 }