server_privileges.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * Server privileges and users manipulations
   5  *
   6  * @package PhpMyAdmin
   7  */
   8
   9 /**
  10  *
  11  */
  12 require_once 'libraries/common.inc.php';
  13
  14 /**
  15  * functions implementation for this script
  16  */
  17 require_once 'libraries/display_change_password.lib.php';
  18 require_once 'libraries/server_privileges.lib.php';
  19
  20 $cfgRelation = PMA_getRelationsParam();
  21
  22 /**
  23  * Does the common work
  24  */
  25 $response = PMA_Response::getInstance();
  26 $header   = $response->getHeader();
  27 $scripts  = $header->getScripts();
  28 $scripts->addFile('server_privileges.js');
  29
  30 if ($GLOBALS['cfgRelation']['menuswork']) {
  31     $response->addHTML('<div>');
  32     $response->addHTML(PMA_getHtmlForSubMenusOnUsersPage('server_privileges.php'));
  33 }
  34
  35 $_add_user_error = false;
  36
  37 if (isset ($_REQUEST['username'])) {
  38     $username = $_REQUEST['username'];
  39 }
  40 if (isset ($_REQUEST['hostname'])) {
  41     $hostname = $_REQUEST['hostname'];
  42 }
  43
  44 /**
  45  * Sets globals from $_POST patterns, for privileges and max_* vars
  46  */
  47
  48 $post_patterns = array(
  49     '/_priv$/i',
  50     '/^max_/i'
  51 );
  52 foreach (array_keys($_POST) as $post_key) {
  53     foreach ($post_patterns as $one_post_pattern) {
  54         if (preg_match($one_post_pattern, $post_key)) {
  55             $GLOBALS[$post_key] = $_POST[$post_key];
  56         }
  57     }
  58 }
  59
  60 require 'libraries/server_common.inc.php';
  61
  62 /**
  63  * Messages are built using the message name
  64  */
  65 $strPrivDescAllPrivileges = __('Includes all privileges except GRANT.');
  66 $strPrivDescAlter = __('Allows altering the structure of existing tables.');
  67 $strPrivDescAlterRoutine = __('Allows altering and dropping stored routines.');
  68 $strPrivDescCreateDb = __('Allows creating new databases and tables.');
  69 $strPrivDescCreateRoutine = __('Allows creating stored routines.');
  70 $strPrivDescCreateTbl = __('Allows creating new tables.');
  71 $strPrivDescCreateTmpTable = __('Allows creating temporary tables.');
  72 $strPrivDescCreateUser = __('Allows creating, dropping and renaming user accounts.');
  73 $strPrivDescCreateView = __('Allows creating new views.');
  74 $strPrivDescDelete = __('Allows deleting data.');
  75 $strPrivDescDropDb = __('Allows dropping databases and tables.');
  76 $strPrivDescDropTbl = __('Allows dropping tables.');
  77 $strPrivDescEvent = __('Allows to set up events for the event scheduler');
  78 $strPrivDescExecute = __('Allows executing stored routines.');
  79 $strPrivDescFile = __('Allows importing data from and exporting data into files.');
  80 $strPrivDescGrant = __(
  81     'Allows adding users and privileges without reloading the privilege tables.'
  82 );
  83 $strPrivDescIndex = __('Allows creating and dropping indexes.');
  84 $strPrivDescInsert = __('Allows inserting and replacing data.');
  85 $strPrivDescLockTables = __('Allows locking tables for the current thread.');
  86 $strPrivDescMaxConnections = __(
  87     'Limits the number of new connections the user may open per hour.'
  88 );
  89 $strPrivDescMaxQuestions = __(
  90     'Limits the number of queries the user may send to the server per hour.'
  91 );
  92 $strPrivDescMaxUpdates = __(
  93     'Limits the number of commands that change any table or database '
  94     . 'the user may execute per hour.'
  95 );
  96 $strPrivDescMaxUserConnections = __(
  97     'Limits the number of simultaneous connections the user may have.'
  98 );
  99 $strPrivDescProcess = __('Allows viewing processes of all users');
 100 $strPrivDescReferences = __('Has no effect in this MySQL version.');
 101 $strPrivDescReload = __(
 102     'Allows reloading server settings and flushing the server\'s caches.'
 103 );
 104 $strPrivDescReplClient = __(
 105     'Allows the user to ask where the slaves / masters are.'
 106 );
 107 $strPrivDescReplSlave = __('Needed for the replication slaves.');
 108 $strPrivDescSelect = __('Allows reading data.');
 109 $strPrivDescShowDb = __('Gives access to the complete list of databases.');
 110 $strPrivDescShowView = __('Allows performing SHOW CREATE VIEW queries.');
 111 $strPrivDescShutdown = __('Allows shutting down the server.');
 112 $strPrivDescSuper = __(
 113     'Allows connecting, even if maximum number of connections is reached; '
 114     . 'required for most administrative operations like setting global variables '
 115     . 'or killing threads of other users.'
 116 );
 117 $strPrivDescTrigger = __('Allows creating and dropping triggers');
 118 $strPrivDescUpdate = __('Allows changing data.');
 119 $strPrivDescUsage = __('No privileges.');
 120
 121
 122 /**
 123  * Get DB information: dbname, tablename, db_and_table, dbname_is_wildcard
 124  */
 125 list($dbname, $tablename, $db_and_table, $dbname_is_wildcard)
 126     = PMA_getDataForDBInfo();
 127
 128 /**
 129  * Checks if the user is allowed to do what he tries to...
 130  */
 131 if (! $is_superuser) {
 132     $response->addHTML(PMA_getHtmlForSubPageHeader('privileges', '', false));
 133     $response->addHTML(PMA_Message::error(__('No Privileges'))->getDisplay());
 134     exit;
 135 }
 136
 137 /**
 138  * Changes / copies a user, part I
 139  */
 140 list($queries, $password) = PMA_getDataForChangeOrCopyUser();
 141
 142 /**
 143  * Adds a user
 144  *   (Changes / copies a user, part II)
 145  */
 146 list($ret_message, $ret_queries, $queries_for_display, $sql_query, $_add_user_error)
 147     = PMA_addUser(
 148         isset($dbname)? $dbname : null,
 149         isset($username)? $username : null,
 150         isset($hostname)? $hostname : null,
 151         isset($password)? $password : null,
 152         $cfgRelation['menuswork']
 153     );
 154 //update the old variables
 155 if (isset($ret_queries)) {
 156     $queries = $ret_queries;
 157     unset($ret_queries);
 158 }
 159 if (isset($ret_message)) {
 160     $message = $ret_message;
 161     unset($ret_message);
 162 }
 163
 164 /**
 165  * Changes / copies a user, part III
 166  */
 167 if (isset($_REQUEST['change_copy'])) {
 168     $queries = PMA_getDbSpecificPrivsQueriesForChangeOrCopyUser(
 169         $queries, $username, $hostname
 170     );
 171 }
 172
 173 /**
 174  * Updates privileges
 175  */
 176 if (! empty($_POST['update_privs'])) {
 177     list($sql_query, $message) = PMA_updatePrivileges(
 178         (isset($username) ? $username : ''),
 179         (isset($hostname) ? $hostname : ''),
 180         (isset($tablename) ? $tablename : ''),
 181         (isset($dbname) ? $dbname : '')
 182     );
 183 }
 184
 185 /**
 186  * Assign users to user groups
 187  */
 188 if (! empty($_REQUEST['changeUserGroup']) && $cfgRelation['menuswork']) {
 189     PMA_setUserGroup($username, $_REQUEST['userGroup']);
 190     $message = PMA_Message::success();
 191 }
 192
 193 /**
 194  * Revokes Privileges
 195  */
 196 if (isset($_REQUEST['revokeall'])) {
 197     list ($message, $sql_query) = PMA_getMessageAndSqlQueryForPrivilegesRevoke(
 198         $db_and_table,
 199         (isset($dbname) ? $dbname : ''),
 200         (isset($tablename) ? $tablename : ''),
 201         $username, $hostname
 202     );
 203 }
 204
 205 /**
 206  * Updates the password
 207  */
 208 if (isset($_REQUEST['change_pw'])) {
 209     $message = PMA_updatePassword(
 210         $err_url, $username, $hostname
 211     );
 212 }
 213
 214 /**
 215  * Deletes users
 216  *   (Changes / copies a user, part IV)
 217  */
 218 if (isset($_REQUEST['delete'])
 219     || (isset($_REQUEST['change_copy']) && $_REQUEST['mode'] < 4)
 220 ) {
 221     $queries = PMA_getDataForDeleteUsers($queries);
 222     if (empty($_REQUEST['change_copy'])) {
 223         list($sql_query, $message) = PMA_deleteUser($queries);
 224     }
 225 }
 226
 227 /**
 228  * Changes / copies a user, part V
 229  */
 230 if (isset($_REQUEST['change_copy'])) {
 231     $queries = PMA_getDataForQueries($queries, $queries_for_display);
 232     $message = PMA_Message::success();
 233     $sql_query = join("\n", $queries);
 234 }
 235
 236 /**
 237  * Reloads the privilege tables into memory
 238  */
 239 $message_ret = PMA_updateMessageForReload();
 240 if (isset($message_ret)) {
 241     $message = $message_ret;
 242     unset($message_ret);
 243 }
 244
 245 /**
 246  * If we are in an Ajax request for Create User/Edit User/Revoke User/
 247  * Flush Privileges, show $message and exit.
 248  */
 249 if ($GLOBALS['is_ajax_request']
 250     && empty($_REQUEST['ajax_page_request'])
 251     && ! isset($_REQUEST['export'])
 252     && (! isset($_REQUEST['submit_mult']) || $_REQUEST['submit_mult'] != 'export')
 253     && (! isset($_REQUEST['adduser']) || $_add_user_error)
 254     && (! isset($_REQUEST['initial']) || empty($_REQUEST['initial']))
 255     && ! isset($_REQUEST['showall'])
 256     && ! isset($_REQUEST['edit_user_dialog'])
 257     && ! isset($_REQUEST['edit_user_group_dialog'])
 258     && ! isset($_REQUEST['db_specific'])
 259 ) {
 260     $extra_data = PMA_getExtraDataForAjaxBehavior(
 261         (isset($password) ? $password : ''),
 262         (isset($sql_query) ? $sql_query : ''),
 263         (isset($hostname) ? $hostname : ''),
 264         (isset($username) ? $username : '')
 265     );
 266
 267     if (! empty($message) && $message instanceof PMA_Message) {
 268         $response = PMA_Response::getInstance();
 269         $response->isSuccess($message->isSuccess());
 270         $response->addJSON('message', $message);
 271         $response->addJSON($extra_data);
 272         exit;
 273     }
 274 }
 275
 276 /**
 277  * Displays the links
 278  */
 279 if (isset($_REQUEST['viewing_mode']) && $_REQUEST['viewing_mode'] == 'db') {
 280     $_REQUEST['db'] = $_REQUEST['checkprivs'];
 281
 282     $url_query .= '&amp;goto=db_operations.php';
 283
 284     // Gets the database structure
 285     $sub_part = '_structure';
 286     ob_start();
 287     include 'libraries/db_info.inc.php';
 288     $content = ob_get_contents();
 289     ob_end_clean();
 290     $response->addHTML($content . "\n");
 291 } else {
 292     if (! empty($GLOBALS['message'])) {
 293         $response->addHTML(PMA_Util::getMessage($GLOBALS['message']));
 294         unset($GLOBALS['message']);
 295     }
 296 }
 297
 298 /**
 299  * Displays the page
 300  */
 301 $response->addHTML(
 302     PMA_getHtmlForUserGroupDialog(
 303         isset($username)? $username : null,
 304         $cfgRelation['menuswork']
 305     )
 306 );
 307
 308 // export user definition
 309 if (isset($_REQUEST['export'])
 310     || (isset($_REQUEST['submit_mult']) && $_REQUEST['submit_mult'] == 'export')
 311 ) {
 312     list($title, $export) = PMA_getListForExportUserDefinition(
 313         isset($username) ? $username : null,
 314         isset($hostname) ? $hostname : null
 315     );
 316
 317     unset($username, $hostname, $grants, $one_grant);
 318
 319     $response = PMA_Response::getInstance();
 320     if ($GLOBALS['is_ajax_request']) {
 321         $response->addJSON('message', $export);
 322         $response->addJSON('title', $title);
 323         exit;
 324     } else {
 325         $response->addHTML("<h2>$title</h2>$export");
 326     }
 327 }
 328
 329 if (empty($_REQUEST['adduser'])
 330     && (! isset($_REQUEST['checkprivs'])
 331     || ! strlen($_REQUEST['checkprivs']))
 332 ) {
 333     if (! isset($username)) {
 334         // No username is given --> display the overview
 335         $response->addHTML(
 336             PMA_getHtmlForDisplayUserOverviewPage($pmaThemeImage, $text_dir)
 337         );
 338     } else {
 339         // A user was selected -> display the user's properties
 340         // In an Ajax request, prevent cached values from showing
 341         if ($GLOBALS['is_ajax_request'] == true) {
 342             header('Cache-Control: no-cache');
 343         }
 344         $url_dbname = urlencode(
 345             str_replace(
 346                 array('\_', '\%'),
 347                 array('_', '%'), $_REQUEST['dbname']
 348             )
 349         );
 350         $response->addHTML(
 351             PMA_getHtmlForDisplayUserProperties(
 352                 ((isset ($dbname_is_wildcard)) ? $dbname_is_wildcard : ''),
 353                 $url_dbname, $username, $hostname,
 354                 (isset($dbname) ? $dbname : ''),
 355                 (isset($tablename) ? $tablename : '')
 356             )
 357         );
 358     }
 359 } elseif (isset($_REQUEST['adduser'])) {
 360     // Add user
 361     $response->addHTML(
 362         PMA_getHtmlForAddUser((isset($dbname) ? $dbname : ''))
 363     );
 364 } else {
 365     // check the privileges for a particular database.
 366     $response->addHTML(
 367         PMA_getHtmlForSpecificDbPrivileges()
 368     );
 369 } // end if (empty($_REQUEST['adduser']) && empty($checkprivs))... elseif... else...
 370
 371 if ($GLOBALS['cfgRelation']['menuswork']) {
 372     $response->addHTML('</div>');
 373 }
 374
 375 ?>