server_privileges.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * Server privileges and users manipulations
   5  *
   6  * @package PhpMyAdmin
   7  */
   8
   9 use PhpMyAdmin\Core;
  10 use PhpMyAdmin\Message;
  11 use PhpMyAdmin\Relation;
  12 use PhpMyAdmin\Response;
  13 use PhpMyAdmin\Server\Common;
  14 use PhpMyAdmin\Server\Privileges;
  15 use PhpMyAdmin\Server\Users;
  16
  17 /**
  18  * include common file
  19  */
  20 require_once 'libraries/common.inc.php';
  21
  22 /**
  23  * functions implementation for this script
  24  */
  25 require_once 'libraries/check_user_privileges.lib.php';
  26
  27 $cfgRelation = Relation::getRelationsParam();
  28
  29 /**
  30  * Does the common work
  31  */
  32 $response = Response::getInstance();
  33 $header   = $response->getHeader();
  34 $scripts  = $header->getScripts();
  35 $scripts->addFile('server_privileges.js');
  36 $scripts->addFile('vendor/zxcvbn.js');
  37
  38 if ((isset($_REQUEST['viewing_mode'])
  39     && $_REQUEST['viewing_mode'] == 'server')
  40     && $GLOBALS['cfgRelation']['menuswork']
  41 ) {
  42     $response->addHTML('<div>');
  43     $response->addHTML(Users::getHtmlForSubMenusOnUsersPage('server_privileges.php'));
  44 }
  45
  46 /**
  47  * Sets globals from $_POST patterns, for privileges and max_* vars
  48  */
  49
  50 $post_patterns = array(
  51     '/_priv$/i',
  52     '/^max_/i'
  53 );
  54
  55 Core::setPostAsGlobal($post_patterns);
  56
  57 require 'libraries/server_common.inc.php';
  58
  59 /**
  60  * Messages are built using the message name
  61  */
  62 $strPrivDescAllPrivileges = __('Includes all privileges except GRANT.');
  63 $strPrivDescAlter = __('Allows altering the structure of existing tables.');
  64 $strPrivDescAlterRoutine = __('Allows altering and dropping stored routines.');
  65 $strPrivDescCreateDb = __('Allows creating new databases and tables.');
  66 $strPrivDescCreateRoutine = __('Allows creating stored routines.');
  67 $strPrivDescCreateTbl = __('Allows creating new tables.');
  68 $strPrivDescCreateTmpTable = __('Allows creating temporary tables.');
  69 $strPrivDescCreateUser = __('Allows creating, dropping and renaming user accounts.');
  70 $strPrivDescCreateView = __('Allows creating new views.');
  71 $strPrivDescDelete = __('Allows deleting data.');
  72 $strPrivDescDropDb = __('Allows dropping databases and tables.');
  73 $strPrivDescDropTbl = __('Allows dropping tables.');
  74 $strPrivDescEvent = __('Allows to set up events for the event scheduler.');
  75 $strPrivDescExecute = __('Allows executing stored routines.');
  76 $strPrivDescFile = __('Allows importing data from and exporting data into files.');
  77 $strPrivDescGrantTbl = __(
  78     'Allows user to give to other users or remove from other users the privileges '
  79     . 'that user possess yourself.'
  80 );
  81 $strPrivDescIndex = __('Allows creating and dropping indexes.');
  82 $strPrivDescInsert = __('Allows inserting and replacing data.');
  83 $strPrivDescLockTables = __('Allows locking tables for the current thread.');
  84 $strPrivDescMaxConnections = __(
  85     'Limits the number of new connections the user may open per hour.'
  86 );
  87 $strPrivDescMaxQuestions = __(
  88     'Limits the number of queries the user may send to the server per hour.'
  89 );
  90 $strPrivDescMaxUpdates = __(
  91     'Limits the number of commands that change any table or database '
  92     . 'the user may execute per hour.'
  93 );
  94 $strPrivDescMaxUserConnections = __(
  95     'Limits the number of simultaneous connections the user may have.'
  96 );
  97 $strPrivDescProcess = __('Allows viewing processes of all users.');
  98 $strPrivDescReferences = __('Has no effect in this MySQL version.');
  99 $strPrivDescReload = __(
 100     'Allows reloading server settings and flushing the server\'s caches.'
 101 );
 102 $strPrivDescReplClient = __(
 103     'Allows the user to ask where the slaves / masters are.'
 104 );
 105 $strPrivDescReplSlave = __('Needed for the replication slaves.');
 106 $strPrivDescSelect = __('Allows reading data.');
 107 $strPrivDescShowDb = __('Gives access to the complete list of databases.');
 108 $strPrivDescShowView = __('Allows performing SHOW CREATE VIEW queries.');
 109 $strPrivDescShutdown = __('Allows shutting down the server.');
 110 $strPrivDescSuper = __(
 111     'Allows connecting, even if maximum number of connections is reached; '
 112     . 'required for most administrative operations like setting global variables '
 113     . 'or killing threads of other users.'
 114 );
 115 $strPrivDescTrigger = __('Allows creating and dropping triggers.');
 116 $strPrivDescUpdate = __('Allows changing data.');
 117 $strPrivDescUsage = __('No privileges.');
 118
 119 $_add_user_error = false;
 120 /**
 121  * Get DB information: username, hostname, dbname,
 122  * tablename, db_and_table, dbname_is_wildcard
 123  */
 124 list(
 125     $username, $hostname, $dbname, $tablename, $routinename,
 126     $db_and_table, $dbname_is_wildcard
 127 ) = Privileges::getDataForDBInfo();
 128
 129 /**
 130  * Checks if the user is allowed to do what he tries to...
 131  */
 132 if (!$GLOBALS['is_superuser'] && !$GLOBALS['is_grantuser']
 133     && !$GLOBALS['is_createuser']
 134 ) {
 135     $response->addHTML(Common::getHtmlForSubPageHeader('privileges', '', false));
 136     $response->addHTML(
 137         Message::error(__('No Privileges'))
 138             ->getDisplay()
 139     );
 140     exit;
 141 }
 142 if (! $GLOBALS['is_grantuser'] && !$GLOBALS['is_createuser']) {
 143     $response->addHTML(Message::notice(
 144         __('You do not have privileges to manipulate with the users!')
 145     )->getDisplay());
 146 }
 147
 148 /**
 149  * Checks if the user is using "Change Login Information / Copy User" dialog
 150  * only to update the password
 151  */
 152 if (isset($_REQUEST['change_copy']) && $username == $_REQUEST['old_username']
 153     && $hostname == $_REQUEST['old_hostname']
 154 ) {
 155     $response->addHTML(
 156         Message::error(
 157             __(
 158                 "Username and hostname didn't change. "
 159                 . "If you only want to change the password, "
 160                 . "'Change password' tab should be used."
 161             )
 162         )->getDisplay()
 163     );
 164     $response->setRequestStatus(false);
 165     exit;
 166 }
 167
 168 /**
 169  * Changes / copies a user, part I
 170  */
 171 list($queries, $password) = Privileges::getDataForChangeOrCopyUser();
 172
 173 /**
 174  * Adds a user
 175  *   (Changes / copies a user, part II)
 176  */
 177 list($ret_message, $ret_queries, $queries_for_display, $sql_query, $_add_user_error)
 178     = Privileges::addUser(
 179         isset($dbname)? $dbname : null,
 180         isset($username)? $username : null,
 181         isset($hostname)? $hostname : null,
 182         isset($password)? $password : null,
 183         $cfgRelation['menuswork']
 184     );
 185 //update the old variables
 186 if (isset($ret_queries)) {
 187     $queries = $ret_queries;
 188     unset($ret_queries);
 189 }
 190 if (isset($ret_message)) {
 191     $message = $ret_message;
 192     unset($ret_message);
 193 }
 194
 195 /**
 196  * Changes / copies a user, part III
 197  */
 198 if (isset($_REQUEST['change_copy'])) {
 199     $queries = Privileges::getDbSpecificPrivsQueriesForChangeOrCopyUser(
 200         $queries, $username, $hostname
 201     );
 202 }
 203
 204 $itemType = '';
 205 if (! empty($routinename)) {
 206     $itemType = Privileges::getRoutineType($dbname, $routinename);
 207 }
 208
 209 /**
 210  * Updates privileges
 211  */
 212 if (! empty($_POST['update_privs'])) {
 213     if (is_array($dbname)) {
 214         foreach ($dbname as $key => $db_name) {
 215             list($sql_query[$key], $message) = Privileges::updatePrivileges(
 216                 (isset($username) ? $username : ''),
 217                 (isset($hostname) ? $hostname : ''),
 218                 (isset($tablename)
 219                     ? $tablename
 220                     : (isset($routinename) ? $routinename : '')),
 221                 (isset($db_name) ? $db_name : ''),
 222                 $itemType
 223             );
 224         }
 225
 226         $sql_query = implode("\n", $sql_query);
 227     } else {
 228         list($sql_query, $message) = Privileges::updatePrivileges(
 229             (isset($username) ? $username : ''),
 230             (isset($hostname) ? $hostname : ''),
 231             (isset($tablename)
 232                 ? $tablename
 233                 : (isset($routinename) ? $routinename : '')),
 234             (isset($dbname) ? $dbname : ''),
 235             $itemType
 236         );
 237     }
 238 }
 239
 240 /**
 241  * Assign users to user groups
 242  */
 243 if (! empty($_REQUEST['changeUserGroup']) && $cfgRelation['menuswork']
 244     && $GLOBALS['is_superuser'] && $GLOBALS['is_createuser']
 245 ) {
 246     Privileges::setUserGroup($username, $_REQUEST['userGroup']);
 247     $message = Message::success();
 248 }
 249
 250 /**
 251  * Revokes Privileges
 252  */
 253 if (isset($_REQUEST['revokeall'])) {
 254     list ($message, $sql_query) = Privileges::getMessageAndSqlQueryForPrivilegesRevoke(
 255         (isset($dbname) ? $dbname : ''),
 256         (isset($tablename)
 257             ? $tablename
 258             : (isset($routinename) ? $routinename : '')),
 259         $username,
 260         $hostname,
 261         $itemType
 262     );
 263 }
 264
 265 /**
 266  * Updates the password
 267  */
 268 if (isset($_REQUEST['change_pw'])) {
 269     $message = Privileges::updatePassword(
 270         $err_url, $username, $hostname
 271     );
 272 }
 273
 274 /**
 275  * Deletes users
 276  *   (Changes / copies a user, part IV)
 277  */
 278 if (isset($_REQUEST['delete'])
 279     || (isset($_REQUEST['change_copy']) && $_REQUEST['mode'] < 4)
 280 ) {
 281     include_once 'libraries/relation_cleanup.lib.php';
 282     $queries = Privileges::getDataForDeleteUsers($queries);
 283     if (empty($_REQUEST['change_copy'])) {
 284         list($sql_query, $message) = Privileges::deleteUser($queries);
 285     }
 286 }
 287
 288 /**
 289  * Changes / copies a user, part V
 290  */
 291 if (isset($_REQUEST['change_copy'])) {
 292     $queries = Privileges::getDataForQueries($queries, $queries_for_display);
 293     $message = Message::success();
 294     $sql_query = join("\n", $queries);
 295 }
 296
 297 /**
 298  * Reloads the privilege tables into memory
 299  */
 300 $message_ret = Privileges::updateMessageForReload();
 301 if (isset($message_ret)) {
 302     $message = $message_ret;
 303     unset($message_ret);
 304 }
 305
 306 /**
 307  * If we are in an Ajax request for Create User/Edit User/Revoke User/
 308  * Flush Privileges, show $message and exit.
 309  */
 310 if ($response->isAjax()
 311     && empty($_REQUEST['ajax_page_request'])
 312     && ! isset($_REQUEST['export'])
 313     && (! isset($_REQUEST['submit_mult']) || $_REQUEST['submit_mult'] != 'export')
 314     && ((! isset($_REQUEST['initial']) || $_REQUEST['initial'] === null
 315     || $_REQUEST['initial'] === '')
 316     || (isset($_REQUEST['delete']) && $_REQUEST['delete'] === __('Go')))
 317     && ! isset($_REQUEST['showall'])
 318     && ! isset($_REQUEST['edit_user_group_dialog'])
 319     && ! isset($_REQUEST['db_specific'])
 320 ) {
 321     $extra_data = Privileges::getExtraDataForAjaxBehavior(
 322         (isset($password) ? $password : ''),
 323         (isset($sql_query) ? $sql_query : ''),
 324         (isset($hostname) ? $hostname : ''),
 325         (isset($username) ? $username : '')
 326     );
 327
 328     if (! empty($message) && $message instanceof Message) {
 329         $response->setRequestStatus($message->isSuccess());
 330         $response->addJSON('message', $message);
 331         $response->addJSON($extra_data);
 332         exit;
 333     }
 334 }
 335
 336 /**
 337  * Displays the links
 338  */
 339 if (isset($_REQUEST['viewing_mode']) && $_REQUEST['viewing_mode'] == 'db') {
 340     $GLOBALS['db'] = $_REQUEST['db'] = $_REQUEST['checkprivsdb'];
 341
 342     $url_query .= '&amp;goto=db_operations.php';
 343
 344     // Gets the database structure
 345     $sub_part = '_structure';
 346     ob_start();
 347
 348     list(
 349         $tables,
 350         $num_tables,
 351         $total_num_tables,
 352         $sub_part,
 353         $is_show_stats,
 354         $db_is_system_schema,
 355         $tooltip_truename,
 356         $tooltip_aliasname,
 357         $pos
 358     ) = PhpMyAdmin\Util::getDbInfo($db, isset($sub_part) ? $sub_part : '');
 359
 360     $content = ob_get_contents();
 361     ob_end_clean();
 362     $response->addHTML($content . "\n");
 363 } else {
 364     if (! empty($GLOBALS['message'])) {
 365         $response->addHTML(PhpMyAdmin\Util::getMessage($GLOBALS['message']));
 366         unset($GLOBALS['message']);
 367     }
 368 }
 369
 370 /**
 371  * Displays the page
 372  */
 373 $response->addHTML(
 374     Privileges::getHtmlForUserGroupDialog(
 375         isset($username)? $username : null,
 376         $cfgRelation['menuswork']
 377     )
 378 );
 379
 380 // export user definition
 381 if (isset($_REQUEST['export'])
 382     || (isset($_REQUEST['submit_mult']) && $_REQUEST['submit_mult'] == 'export')
 383 ) {
 384     list($title, $export) = Privileges::getListForExportUserDefinition(
 385         isset($username) ? $username : null,
 386         isset($hostname) ? $hostname : null
 387     );
 388
 389     unset($username, $hostname, $grants, $one_grant);
 390
 391     if ($response->isAjax()) {
 392         $response->addJSON('message', $export);
 393         $response->addJSON('title', $title);
 394         exit;
 395     } else {
 396         $response->addHTML("<h2>$title</h2>$export");
 397     }
 398 }
 399
 400 if (isset($_REQUEST['adduser'])) {
 401     // Add user
 402     $response->addHTML(
 403         Privileges::getHtmlForAddUser((isset($dbname) ? $dbname : ''))
 404     );
 405 } elseif (isset($_REQUEST['checkprivsdb'])) {
 406     if (isset($_REQUEST['checkprivstable'])) {
 407         // check the privileges for a particular table.
 408         $response->addHTML(
 409             Privileges::getHtmlForSpecificTablePrivileges(
 410                 $_REQUEST['checkprivsdb'], $_REQUEST['checkprivstable']
 411             )
 412         );
 413     } else {
 414         // check the privileges for a particular database.
 415         $response->addHTML(
 416             Privileges::getHtmlForSpecificDbPrivileges($_REQUEST['checkprivsdb'])
 417         );
 418     }
 419 } else {
 420     if (isset($dbname) && ! is_array($dbname)) {
 421         $url_dbname = urlencode(
 422             str_replace(
 423                 array('\_', '\%'),
 424                 array('_', '%'),
 425                 $dbname
 426             )
 427         );
 428     }
 429
 430     if (! isset($username)) {
 431         // No username is given --> display the overview
 432         $response->addHTML(
 433             Privileges::getHtmlForUserOverview($pmaThemeImage, $text_dir)
 434         );
 435     } else if (!empty($routinename)) {
 436         $response->addHTML(
 437             Privileges::getHtmlForRoutineSpecificPrivileges(
 438                 $username, $hostname, $dbname, $routinename,
 439                 (isset($url_dbname) ? $url_dbname : '')
 440             )
 441         );
 442     } else {
 443         // A user was selected -> display the user's properties
 444         // In an Ajax request, prevent cached values from showing
 445         if ($response->isAjax()) {
 446             header('Cache-Control: no-cache');
 447         }
 448
 449         $response->addHTML(
 450             Privileges::getHtmlForUserProperties(
 451                 (isset($dbname_is_wildcard) ? $dbname_is_wildcard : ''),
 452                 (isset($url_dbname) ? $url_dbname : ''),
 453                 $username, $hostname,
 454                 (isset($dbname) ? $dbname : ''),
 455                 (isset($tablename) ? $tablename : '')
 456             )
 457         );
 458     }
 459 }
 460
 461 if ((isset($_REQUEST['viewing_mode']) && $_REQUEST['viewing_mode'] == 'server')
 462     && $GLOBALS['cfgRelation']['menuswork']
 463 ) {
 464     $response->addHTML('</div>');
 465 }