server_privileges.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * Server privileges and users manipulations
   5  *
   6  * @package PhpMyAdmin
   7  */
   8 declare(strict_types=1);
   9
  10 use PhpMyAdmin\Core;
  11 use PhpMyAdmin\Message;
  12 use PhpMyAdmin\Relation;
  13 use PhpMyAdmin\RelationCleanup;
  14 use PhpMyAdmin\Response;
  15 use PhpMyAdmin\Server\Privileges;
  16 use PhpMyAdmin\Server\Users;
  17 use PhpMyAdmin\Template;
  18
  19 if (! defined('ROOT_PATH')) {
  20     define('ROOT_PATH', __DIR__ . DIRECTORY_SEPARATOR);
  21 }
  22
  23 /**
  24  * include common file
  25  */
  26 require_once ROOT_PATH . 'libraries/common.inc.php';
  27
  28 /**
  29  * functions implementation for this script
  30  */
  31 require_once ROOT_PATH . 'libraries/check_user_privileges.inc.php';
  32
  33 $relation = new Relation($GLOBALS['dbi']);
  34 $cfgRelation = $relation->getRelationsParam();
  35
  36 /**
  37  * Does the common work
  38  */
  39 $response = Response::getInstance();
  40 $header   = $response->getHeader();
  41 $scripts  = $header->getScripts();
  42 $scripts->addFile('server_privileges.js');
  43 $scripts->addFile('vendor/zxcvbn.js');
  44
  45 $template = new Template();
  46 $relationCleanup = new RelationCleanup($GLOBALS['dbi'], $relation);
  47 $serverPrivileges = new Privileges($template, $GLOBALS['dbi'], $relation, $relationCleanup);
  48
  49 if ((isset($_GET['viewing_mode'])
  50     && $_GET['viewing_mode'] == 'server')
  51     && $GLOBALS['cfgRelation']['menuswork']
  52 ) {
  53     $response->addHTML('<div>');
  54     $response->addHTML(Users::getHtmlForSubMenusOnUsersPage('server_privileges.php'));
  55 }
  56
  57 /**
  58  * Sets globals from $_POST patterns, for privileges and max_* vars
  59  */
  60
  61 $post_patterns = [
  62     '/_priv$/i',
  63     '/^max_/i',
  64 ];
  65
  66 Core::setPostAsGlobal($post_patterns);
  67
  68 require ROOT_PATH . 'libraries/server_common.inc.php';
  69
  70 /**
  71  * Messages are built using the message name
  72  */
  73 $strPrivDescAllPrivileges = __('Includes all privileges except GRANT.');
  74 $strPrivDescAlter = __('Allows altering the structure of existing tables.');
  75 $strPrivDescAlterRoutine = __('Allows altering and dropping stored routines.');
  76 $strPrivDescCreateDb = __('Allows creating new databases and tables.');
  77 $strPrivDescCreateRoutine = __('Allows creating stored routines.');
  78 $strPrivDescCreateTbl = __('Allows creating new tables.');
  79 $strPrivDescCreateTmpTable = __('Allows creating temporary tables.');
  80 $strPrivDescCreateUser = __('Allows creating, dropping and renaming user accounts.');
  81 $strPrivDescCreateView = __('Allows creating new views.');
  82 $strPrivDescDelete = __('Allows deleting data.');
  83 $strPrivDescDropDb = __('Allows dropping databases and tables.');
  84 $strPrivDescDropTbl = __('Allows dropping tables.');
  85 $strPrivDescEvent = __('Allows to set up events for the event scheduler.');
  86 $strPrivDescExecute = __('Allows executing stored routines.');
  87 $strPrivDescFile = __('Allows importing data from and exporting data into files.');
  88 $strPrivDescGrantTbl = __(
  89     'Allows user to give to other users or remove from other users the privileges '
  90     . 'that user possess yourself.'
  91 );
  92 $strPrivDescIndex = __('Allows creating and dropping indexes.');
  93 $strPrivDescInsert = __('Allows inserting and replacing data.');
  94 $strPrivDescLockTables = __('Allows locking tables for the current thread.');
  95 $strPrivDescMaxConnections = __(
  96     'Limits the number of new connections the user may open per hour.'
  97 );
  98 $strPrivDescMaxQuestions = __(
  99     'Limits the number of queries the user may send to the server per hour.'
 100 );
 101 $strPrivDescMaxUpdates = __(
 102     'Limits the number of commands that change any table or database '
 103     . 'the user may execute per hour.'
 104 );
 105 $strPrivDescMaxUserConnections = __(
 106     'Limits the number of simultaneous connections the user may have.'
 107 );
 108 $strPrivDescProcess = __('Allows viewing processes of all users.');
 109 $strPrivDescReferences = __('Has no effect in this MySQL version.');
 110 $strPrivDescReload = __(
 111     'Allows reloading server settings and flushing the server\'s caches.'
 112 );
 113 $strPrivDescReplClient = __(
 114     'Allows the user to ask where the slaves / masters are.'
 115 );
 116 $strPrivDescReplSlave = __('Needed for the replication slaves.');
 117 $strPrivDescSelect = __('Allows reading data.');
 118 $strPrivDescShowDb = __('Gives access to the complete list of databases.');
 119 $strPrivDescShowView = __('Allows performing SHOW CREATE VIEW queries.');
 120 $strPrivDescShutdown = __('Allows shutting down the server.');
 121 $strPrivDescSuper = __(
 122     'Allows connecting, even if maximum number of connections is reached; '
 123     . 'required for most administrative operations like setting global variables '
 124     . 'or killing threads of other users.'
 125 );
 126 $strPrivDescTrigger = __('Allows creating and dropping triggers.');
 127 $strPrivDescUpdate = __('Allows changing data.');
 128 $strPrivDescUsage = __('No privileges.');
 129
 130 $_add_user_error = false;
 131 /**
 132  * Get DB information: username, hostname, dbname,
 133  * tablename, db_and_table, dbname_is_wildcard
 134  */
 135 list(
 136     $username, $hostname, $dbname, $tablename, $routinename,
 137     $db_and_table, $dbname_is_wildcard
 138 ) = $serverPrivileges->getDataForDBInfo();
 139
 140 /**
 141  * Checks if the user is allowed to do what he tries to...
 142  */
 143 if (! $GLOBALS['dbi']->isSuperuser() && ! $GLOBALS['is_grantuser']
 144     && ! $GLOBALS['is_createuser']
 145 ) {
 146     $response->addHTML(
 147         $template->render('server/sub_page_header', [
 148             'type' => 'privileges',
 149             'is_image' => false,
 150         ])
 151     );
 152     $response->addHTML(
 153         Message::error(__('No Privileges'))
 154             ->getDisplay()
 155     );
 156     exit;
 157 }
 158 if (! $GLOBALS['is_grantuser'] && ! $GLOBALS['is_createuser']) {
 159     $response->addHTML(Message::notice(
 160         __('You do not have the privileges to administrate the users!')
 161     )->getDisplay());
 162 }
 163
 164 /**
 165  * Checks if the user is using "Change Login Information / Copy User" dialog
 166  * only to update the password
 167  */
 168 if (isset($_POST['change_copy']) && $username == $_POST['old_username']
 169     && $hostname == $_POST['old_hostname']
 170 ) {
 171     $response->addHTML(
 172         Message::error(
 173             __(
 174                 "Username and hostname didn't change. "
 175                 . "If you only want to change the password, "
 176                 . "'Change password' tab should be used."
 177             )
 178         )->getDisplay()
 179     );
 180     $response->setRequestStatus(false);
 181     exit;
 182 }
 183
 184 /**
 185  * Changes / copies a user, part I
 186  */
 187 list($queries, $password) = $serverPrivileges->getDataForChangeOrCopyUser();
 188
 189 /**
 190  * Adds a user
 191  *   (Changes / copies a user, part II)
 192  */
 193 list($ret_message, $ret_queries, $queries_for_display, $sql_query, $_add_user_error)
 194     = $serverPrivileges->addUser(
 195         isset($dbname) ? $dbname : null,
 196         isset($username) ? $username : null,
 197         isset($hostname) ? $hostname : null,
 198         isset($password) ? $password : null,
 199         $cfgRelation['menuswork']
 200     );
 201 //update the old variables
 202 if (isset($ret_queries)) {
 203     $queries = $ret_queries;
 204     unset($ret_queries);
 205 }
 206 if (isset($ret_message)) {
 207     $message = $ret_message;
 208     unset($ret_message);
 209 }
 210
 211 /**
 212  * Changes / copies a user, part III
 213  */
 214 if (isset($_POST['change_copy'])) {
 215     $queries = $serverPrivileges->getDbSpecificPrivsQueriesForChangeOrCopyUser(
 216         $queries,
 217         $username,
 218         $hostname
 219     );
 220 }
 221
 222 $itemType = '';
 223 if (! empty($routinename)) {
 224     $itemType = $serverPrivileges->getRoutineType($dbname, $routinename);
 225 }
 226
 227 /**
 228  * Updates privileges
 229  */
 230 if (! empty($_POST['update_privs'])) {
 231     if (is_array($dbname)) {
 232         foreach ($dbname as $key => $db_name) {
 233             list($sql_query[$key], $message) = $serverPrivileges->updatePrivileges(
 234                 (isset($username) ? $username : ''),
 235                 (isset($hostname) ? $hostname : ''),
 236                 (isset($tablename)
 237                     ? $tablename
 238                     : (isset($routinename) ? $routinename : '')),
 239                 (isset($db_name) ? $db_name : ''),
 240                 $itemType
 241             );
 242         }
 243
 244         $sql_query = implode("\n", $sql_query);
 245     } else {
 246         list($sql_query, $message) = $serverPrivileges->updatePrivileges(
 247             (isset($username) ? $username : ''),
 248             (isset($hostname) ? $hostname : ''),
 249             (isset($tablename)
 250                 ? $tablename
 251                 : (isset($routinename) ? $routinename : '')),
 252             (isset($dbname) ? $dbname : ''),
 253             $itemType
 254         );
 255     }
 256 }
 257
 258 /**
 259  * Assign users to user groups
 260  */
 261 if (! empty($_POST['changeUserGroup']) && $cfgRelation['menuswork']
 262     && $GLOBALS['dbi']->isSuperuser() && $GLOBALS['is_createuser']
 263 ) {
 264     $serverPrivileges->setUserGroup($username, $_POST['userGroup']);
 265     $message = Message::success();
 266 }
 267
 268 /**
 269  * Revokes Privileges
 270  */
 271 if (isset($_POST['revokeall'])) {
 272     list ($message, $sql_query) = $serverPrivileges->getMessageAndSqlQueryForPrivilegesRevoke(
 273         (isset($dbname) ? $dbname : ''),
 274         (isset($tablename)
 275             ? $tablename
 276             : (isset($routinename) ? $routinename : '')),
 277         $username,
 278         $hostname,
 279         $itemType
 280     );
 281 }
 282
 283 /**
 284  * Updates the password
 285  */
 286 if (isset($_POST['change_pw'])) {
 287     $message = $serverPrivileges->updatePassword(
 288         $err_url,
 289         $username,
 290         $hostname
 291     );
 292 }
 293
 294 /**
 295  * Deletes users
 296  *   (Changes / copies a user, part IV)
 297  */
 298 if (isset($_POST['delete'])
 299     || (isset($_POST['change_copy']) && $_POST['mode'] < 4)
 300 ) {
 301     $queries = $serverPrivileges->getDataForDeleteUsers($queries);
 302     if (empty($_POST['change_copy'])) {
 303         list($sql_query, $message) = $serverPrivileges->deleteUser($queries);
 304     }
 305 }
 306
 307 /**
 308  * Changes / copies a user, part V
 309  */
 310 if (isset($_POST['change_copy'])) {
 311     $queries = $serverPrivileges->getDataForQueries($queries, $queries_for_display);
 312     $message = Message::success();
 313     $sql_query = join("\n", $queries);
 314 }
 315
 316 /**
 317  * Reloads the privilege tables into memory
 318  */
 319 $message_ret = $serverPrivileges->updateMessageForReload();
 320 if (! is_null($message_ret)) {
 321     $message = $message_ret;
 322     unset($message_ret);
 323 }
 324
 325 /**
 326  * If we are in an Ajax request for Create User/Edit User/Revoke User/
 327  * Flush Privileges, show $message and exit.
 328  */
 329 if ($response->isAjax()
 330     && empty($_REQUEST['ajax_page_request'])
 331     && ! isset($_GET['export'])
 332     && (! isset($_POST['submit_mult']) || $_POST['submit_mult'] != 'export')
 333     && ((! isset($_GET['initial']) || $_GET['initial'] === null
 334     || $_GET['initial'] === '')
 335     || (isset($_POST['delete']) && $_POST['delete'] === __('Go')))
 336     && ! isset($_GET['showall'])
 337     && ! isset($_GET['edit_user_group_dialog'])
 338 ) {
 339     $extra_data = $serverPrivileges->getExtraDataForAjaxBehavior(
 340         (isset($password) ? $password : ''),
 341         (isset($sql_query) ? $sql_query : ''),
 342         (isset($hostname) ? $hostname : ''),
 343         (isset($username) ? $username : '')
 344     );
 345
 346     if (! empty($message) && $message instanceof Message) {
 347         $response->setRequestStatus($message->isSuccess());
 348         $response->addJSON('message', $message);
 349         $response->addJSON($extra_data);
 350         exit;
 351     }
 352 }
 353
 354 /**
 355  * Displays the links
 356  */
 357 if (isset($_GET['viewing_mode']) && $_GET['viewing_mode'] == 'db') {
 358     $GLOBALS['db'] = $_REQUEST['db'] = $_GET['checkprivsdb'];
 359
 360     $url_query .= '&amp;goto=db_operations.php';
 361
 362     // Gets the database structure
 363     $sub_part = '_structure';
 364     ob_start();
 365
 366     list(
 367         $tables,
 368         $num_tables,
 369         $total_num_tables,
 370         $sub_part,
 371         $is_show_stats,
 372         $db_is_system_schema,
 373         $tooltip_truename,
 374         $tooltip_aliasname,
 375         $pos
 376     ) = PhpMyAdmin\Util::getDbInfo($db, is_null($sub_part) ? '' : $sub_part);
 377
 378     $content = ob_get_contents();
 379     ob_end_clean();
 380     $response->addHTML($content . "\n");
 381 } else {
 382     if (! empty($GLOBALS['message'])) {
 383         $response->addHTML(PhpMyAdmin\Util::getMessage($GLOBALS['message']));
 384         unset($GLOBALS['message']);
 385     }
 386 }
 387
 388 /**
 389  * Displays the page
 390  */
 391 $response->addHTML(
 392     $serverPrivileges->getHtmlForUserGroupDialog(
 393         isset($username) ? $username : null,
 394         $cfgRelation['menuswork']
 395     )
 396 );
 397
 398 // export user definition
 399 if (isset($_GET['export'])
 400     || (isset($_POST['submit_mult']) && $_POST['submit_mult'] == 'export')
 401 ) {
 402     list($title, $export) = $serverPrivileges->getListForExportUserDefinition(
 403         isset($username) ? $username : null,
 404         isset($hostname) ? $hostname : null
 405     );
 406
 407     unset($username, $hostname, $grants, $one_grant);
 408
 409     if ($response->isAjax()) {
 410         $response->addJSON('message', $export);
 411         $response->addJSON('title', $title);
 412         exit;
 413     } else {
 414         $response->addHTML("<h2>$title</h2>$export");
 415     }
 416 }
 417
 418 if (isset($_GET['adduser'])) {
 419     // Add user
 420     $response->addHTML(
 421         $serverPrivileges->getHtmlForAddUser((isset($dbname) ? $dbname : ''))
 422     );
 423 } elseif (isset($_GET['checkprivsdb'])) {
 424     if (isset($_GET['checkprivstable'])) {
 425         // check the privileges for a particular table.
 426         $response->addHTML(
 427             $serverPrivileges->getHtmlForSpecificTablePrivileges(
 428                 $_GET['checkprivsdb'],
 429                 $_GET['checkprivstable']
 430             )
 431         );
 432     } else {
 433         // check the privileges for a particular database.
 434         $response->addHTML(
 435             $serverPrivileges->getHtmlForSpecificDbPrivileges($_GET['checkprivsdb'])
 436         );
 437     }
 438 } else {
 439     if (isset($dbname) && ! is_array($dbname)) {
 440         $url_dbname = urlencode(
 441             str_replace(
 442                 [
 443                     '\_',
 444                     '\%',
 445                 ],
 446                 [
 447                     '_',
 448                     '%',
 449                 ],
 450                 $dbname
 451             )
 452         );
 453     }
 454
 455     if (! isset($username)) {
 456         // No username is given --> display the overview
 457         $response->addHTML(
 458             $serverPrivileges->getHtmlForUserOverview($pmaThemeImage, $text_dir)
 459         );
 460     } elseif (! empty($routinename)) {
 461         $response->addHTML(
 462             $serverPrivileges->getHtmlForRoutineSpecificPrivileges(
 463                 $username,
 464                 $hostname,
 465                 $dbname,
 466                 $routinename,
 467                 (isset($url_dbname) ? $url_dbname : '')
 468             )
 469         );
 470     } else {
 471         // A user was selected -> display the user's properties
 472         // In an Ajax request, prevent cached values from showing
 473         if ($response->isAjax()) {
 474             header('Cache-Control: no-cache');
 475         }
 476
 477         $response->addHTML(
 478             $serverPrivileges->getHtmlForUserProperties(
 479                 (isset($dbname_is_wildcard) ? $dbname_is_wildcard : ''),
 480                 (isset($url_dbname) ? $url_dbname : ''),
 481                 $username,
 482                 $hostname,
 483                 (isset($dbname) ? $dbname : ''),
 484                 (isset($tablename) ? $tablename : '')
 485             )
 486         );
 487     }
 488 }
 489
 490 if ((isset($_GET['viewing_mode']) && $_GET['viewing_mode'] == 'server')
 491     && $GLOBALS['cfgRelation']['menuswork']
 492 ) {
 493     $response->addHTML('</div>');
 494 }