server_privileges.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * Server privileges and users manipulations
   5  *
   6  * @package PhpMyAdmin
   7  */
   8
   9 /**
  10  * include common file
  11  */
  12 require_once 'libraries/common.inc.php';
  13
  14 /**
  15  * functions implementation for this script
  16  */
  17 require_once 'libraries/display_change_password.lib.php';
  18 require_once 'libraries/server_privileges.lib.php';
  19
  20 $cfgRelation = PMA_getRelationsParam();
  21
  22 /**
  23  * Does the common work
  24  */
  25 $response = PMA_Response::getInstance();
  26 $header   = $response->getHeader();
  27 $scripts  = $header->getScripts();
  28 $scripts->addFile('server_privileges.js');
  29
  30 if ((isset($_REQUEST['viewing_mode'])
  31     && $_REQUEST['viewing_mode'] == 'server')
  32     && isset($GLOBALS['cfgRelation']['menuswork'])
  33     && $GLOBALS['cfgRelation']['menuswork']
  34 ) {
  35     include_once 'libraries/server_users.lib.php';
  36     $response->addHTML('<div>');
  37     $response->addHTML(PMA_getHtmlForSubMenusOnUsersPage('server_privileges.php'));
  38 }
  39
  40 /**
  41  * Sets globals from $_POST patterns, for privileges and max_* vars
  42  */
  43
  44 $post_patterns = array(
  45     '/_priv$/i',
  46     '/^max_/i'
  47 );
  48
  49 PMA_setPostAsGlobal($post_patterns);
  50
  51 require 'libraries/server_common.inc.php';
  52
  53 /**
  54  * Messages are built using the message name
  55  */
  56 $strPrivDescAllPrivileges = __('Includes all privileges except GRANT.');
  57 $strPrivDescAlter = __('Allows altering the structure of existing tables.');
  58 $strPrivDescAlterRoutine = __('Allows altering and dropping stored routines.');
  59 $strPrivDescCreateDb = __('Allows creating new databases and tables.');
  60 $strPrivDescCreateRoutine = __('Allows creating stored routines.');
  61 $strPrivDescCreateTbl = __('Allows creating new tables.');
  62 $strPrivDescCreateTmpTable = __('Allows creating temporary tables.');
  63 $strPrivDescCreateUser = __('Allows creating, dropping and renaming user accounts.');
  64 $strPrivDescCreateView = __('Allows creating new views.');
  65 $strPrivDescDelete = __('Allows deleting data.');
  66 $strPrivDescDropDb = __('Allows dropping databases and tables.');
  67 $strPrivDescDropTbl = __('Allows dropping tables.');
  68 $strPrivDescEvent = __('Allows to set up events for the event scheduler.');
  69 $strPrivDescExecute = __('Allows executing stored routines.');
  70 $strPrivDescFile = __('Allows importing data from and exporting data into files.');
  71 $strPrivDescGrant = __(
  72     'Allows adding users and privileges without reloading the privilege tables.'
  73 );
  74 $strPrivDescIndex = __('Allows creating and dropping indexes.');
  75 $strPrivDescInsert = __('Allows inserting and replacing data.');
  76 $strPrivDescLockTables = __('Allows locking tables for the current thread.');
  77 $strPrivDescMaxConnections = __(
  78     'Limits the number of new connections the user may open per hour.'
  79 );
  80 $strPrivDescMaxQuestions = __(
  81     'Limits the number of queries the user may send to the server per hour.'
  82 );
  83 $strPrivDescMaxUpdates = __(
  84     'Limits the number of commands that change any table or database '
  85     . 'the user may execute per hour.'
  86 );
  87 $strPrivDescMaxUserConnections = __(
  88     'Limits the number of simultaneous connections the user may have.'
  89 );
  90 $strPrivDescProcess = __('Allows viewing processes of all users.');
  91 $strPrivDescReferences = __('Has no effect in this MySQL version.');
  92 $strPrivDescReload = __(
  93     'Allows reloading server settings and flushing the server\'s caches.'
  94 );
  95 $strPrivDescReplClient = __(
  96     'Allows the user to ask where the slaves / masters are.'
  97 );
  98 $strPrivDescReplSlave = __('Needed for the replication slaves.');
  99 $strPrivDescSelect = __('Allows reading data.');
 100 $strPrivDescShowDb = __('Gives access to the complete list of databases.');
 101 $strPrivDescShowView = __('Allows performing SHOW CREATE VIEW queries.');
 102 $strPrivDescShutdown = __('Allows shutting down the server.');
 103 $strPrivDescSuper = __(
 104     'Allows connecting, even if maximum number of connections is reached; '
 105     . 'required for most administrative operations like setting global variables '
 106     . 'or killing threads of other users.'
 107 );
 108 $strPrivDescTrigger = __('Allows creating and dropping triggers.');
 109 $strPrivDescUpdate = __('Allows changing data.');
 110 $strPrivDescUsage = __('No privileges.');
 111
 112 $_add_user_error = false;
 113 /**
 114  * Get DB information: username, hostname, dbname,
 115  * tablename, db_and_table, dbname_is_wildcard
 116  */
 117 list(
 118     $username, $hostname, $dbname, $tablename,
 119     $db_and_table, $dbname_is_wildcard
 120 ) = PMA_getDataForDBInfo();
 121
 122 /**
 123  * Checks if the user is allowed to do what he tries to...
 124  */
 125 if (!$GLOBALS['is_superuser'] && !$GLOBALS['is_grantuser']
 126     && !$GLOBALS['is_createuser']
 127 ) {
 128     $response->addHTML(PMA_getHtmlForSubPageHeader('privileges', '', false));
 129     $response->addHTML(PMA_Message::error(__('No Privileges'))->getDisplay());
 130     exit;
 131 }
 132
 133 /**
 134  * Checks if the user is using "Change Login Information / Copy User" dialog
 135  * only to update the password
 136  */
 137 if (isset($_REQUEST['change_copy']) && $username == $_REQUEST['old_username']
 138     && $hostname == $_REQUEST['old_hostname']
 139 ) {
 140     $response->addHTML(
 141         PMA_Message::error(__('Username and hostname didn\'t change.'))->getDisplay()
 142     );
 143     $response->isSuccess(false);
 144     exit;
 145 }
 146
 147 /**
 148  * Changes / copies a user, part I
 149  */
 150 list($queries, $password) = PMA_getDataForChangeOrCopyUser();
 151
 152 /**
 153  * Adds a user
 154  *   (Changes / copies a user, part II)
 155  */
 156 list($ret_message, $ret_queries, $queries_for_display, $sql_query, $_add_user_error)
 157     = PMA_addUser(
 158         isset($dbname)? $dbname : null,
 159         isset($username)? $username : null,
 160         isset($hostname)? $hostname : null,
 161         isset($password)? $password : null,
 162         $cfgRelation['menuswork']
 163     );
 164 //update the old variables
 165 if (isset($ret_queries)) {
 166     $queries = $ret_queries;
 167     unset($ret_queries);
 168 }
 169 if (isset($ret_message)) {
 170     $message = $ret_message;
 171     unset($ret_message);
 172 }
 173
 174 /**
 175  * Changes / copies a user, part III
 176  */
 177 if (isset($_REQUEST['change_copy'])) {
 178     $queries = PMA_getDbSpecificPrivsQueriesForChangeOrCopyUser(
 179         $queries, $username, $hostname
 180     );
 181 }
 182
 183 /**
 184  * Updates privileges
 185  */
 186 if (! empty($_POST['update_privs'])) {
 187     if (is_array($dbname)) {
 188         foreach ($dbname as $key => $db_name) {
 189             list($sql_query[$key], $message) = PMA_updatePrivileges(
 190                 (isset($username) ? $username : ''),
 191                 (isset($hostname) ? $hostname : ''),
 192                 (isset($tablename) ? $tablename : ''),
 193                 (isset($db_name) ? $db_name : '')
 194             );
 195         }
 196
 197         $sql_query = implode("\n", $sql_query);
 198     } else {
 199         list($sql_query, $message) = PMA_updatePrivileges(
 200             (isset($username) ? $username : ''),
 201             (isset($hostname) ? $hostname : ''),
 202             (isset($tablename) ? $tablename : ''),
 203             (isset($dbname) ? $dbname : '')
 204         );
 205     }
 206 }
 207
 208 /**
 209  * Assign users to user groups
 210  */
 211 if (! empty($_REQUEST['changeUserGroup']) && $cfgRelation['menuswork']
 212     && $GLOBALS['is_superuser'] && $GLOBALS['is_createuser']
 213 ) {
 214     PMA_setUserGroup($username, $_REQUEST['userGroup']);
 215     $message = PMA_Message::success();
 216 }
 217
 218 /**
 219  * Revokes Privileges
 220  */
 221 if (isset($_REQUEST['revokeall'])) {
 222     list ($message, $sql_query) = PMA_getMessageAndSqlQueryForPrivilegesRevoke(
 223         (isset($dbname) ? $dbname : ''),
 224         (isset($tablename) ? $tablename : ''),
 225         $username, $hostname
 226     );
 227 }
 228
 229 /**
 230  * Updates the password
 231  */
 232 if (isset($_REQUEST['change_pw'])) {
 233     $message = PMA_updatePassword(
 234         $err_url, $username, $hostname
 235     );
 236 }
 237
 238 /**
 239  * Deletes users
 240  *   (Changes / copies a user, part IV)
 241  */
 242 if (isset($_REQUEST['delete'])
 243     || (isset($_REQUEST['change_copy']) && $_REQUEST['mode'] < 4)
 244 ) {
 245     $queries = PMA_getDataForDeleteUsers($queries);
 246     if (empty($_REQUEST['change_copy'])) {
 247         list($sql_query, $message) = PMA_deleteUser($queries);
 248     }
 249 }
 250
 251 /**
 252  * Changes / copies a user, part V
 253  */
 254 if (isset($_REQUEST['change_copy'])) {
 255     $queries = PMA_getDataForQueries($queries, $queries_for_display);
 256     $message = PMA_Message::success();
 257     $sql_query = join("\n", $queries);
 258 }
 259
 260 /**
 261  * Reloads the privilege tables into memory
 262  */
 263 $message_ret = PMA_updateMessageForReload();
 264 if (isset($message_ret)) {
 265     $message = $message_ret;
 266     unset($message_ret);
 267 }
 268
 269 /**
 270  * If we are in an Ajax request for Create User/Edit User/Revoke User/
 271  * Flush Privileges, show $message and exit.
 272  */
 273 if ($GLOBALS['is_ajax_request']
 274     && empty($_REQUEST['ajax_page_request'])
 275     && ! isset($_REQUEST['export'])
 276     && (! isset($_REQUEST['submit_mult']) || $_REQUEST['submit_mult'] != 'export')
 277     && ((! isset($_REQUEST['initial']) || $_REQUEST['initial'] === null
 278     || $_REQUEST['initial'] === '')
 279     || (isset($_REQUEST['delete']) && $_REQUEST['delete'] === 'Go'))
 280     && ! isset($_REQUEST['showall'])
 281     && ! isset($_REQUEST['edit_user_group_dialog'])
 282     && ! isset($_REQUEST['db_specific'])
 283 ) {
 284     $extra_data = PMA_getExtraDataForAjaxBehavior(
 285         (isset($password) ? $password : ''),
 286         (isset($sql_query) ? $sql_query : ''),
 287         (isset($hostname) ? $hostname : ''),
 288         (isset($username) ? $username : '')
 289     );
 290
 291     if (! empty($message) && $message instanceof PMA_Message) {
 292         $response = PMA_Response::getInstance();
 293         $response->isSuccess($message->isSuccess());
 294         $response->addJSON('message', $message);
 295         $response->addJSON($extra_data);
 296         exit;
 297     }
 298 }
 299
 300 /**
 301  * Displays the links
 302  */
 303 if (isset($_REQUEST['viewing_mode']) && $_REQUEST['viewing_mode'] == 'db') {
 304     $GLOBALS['db'] = $_REQUEST['db'] = $_REQUEST['checkprivsdb'];
 305
 306     $url_query .= '&amp;goto=db_operations.php';
 307
 308     // Gets the database structure
 309     $sub_part = '_structure';
 310     ob_start();
 311     include 'libraries/db_info.inc.php';
 312     $content = ob_get_contents();
 313     ob_end_clean();
 314     $response->addHTML($content . "\n");
 315 } else {
 316     if (! empty($GLOBALS['message'])) {
 317         $response->addHTML(PMA_Util::getMessage($GLOBALS['message']));
 318         unset($GLOBALS['message']);
 319     }
 320 }
 321
 322 /**
 323  * Displays the page
 324  */
 325 $response->addHTML(
 326     PMA_getHtmlForUserGroupDialog(
 327         isset($username)? $username : null,
 328         $cfgRelation['menuswork']
 329     )
 330 );
 331
 332 // export user definition
 333 if (isset($_REQUEST['export'])
 334     || (isset($_REQUEST['submit_mult']) && $_REQUEST['submit_mult'] == 'export')
 335 ) {
 336     list($title, $export) = PMA_getListForExportUserDefinition(
 337         isset($username) ? $username : null,
 338         isset($hostname) ? $hostname : null
 339     );
 340
 341     unset($username, $hostname, $grants, $one_grant);
 342
 343     $response = PMA_Response::getInstance();
 344     if ($GLOBALS['is_ajax_request']) {
 345         $response->addJSON('message', $export);
 346         $response->addJSON('title', $title);
 347         exit;
 348     } else {
 349         $response->addHTML("<h2>$title</h2>$export");
 350     }
 351 }
 352
 353 if (isset($_REQUEST['adduser'])) {
 354     // Add user
 355     $response->addHTML(
 356         PMA_getHtmlForAddUser((isset($dbname) ? $dbname : ''))
 357     );
 358 } elseif (isset($_REQUEST['checkprivsdb'])) {
 359     if (isset($_REQUEST['checkprivstable'])) {
 360         // check the privileges for a particular table.
 361         $response->addHTML(
 362             PMA_getHtmlForSpecificTablePrivileges(
 363                 $_REQUEST['checkprivsdb'], $_REQUEST['checkprivstable']
 364             )
 365         );
 366     } else {
 367         // check the privileges for a particular database.
 368         $response->addHTML(
 369             PMA_getHtmlForSpecificDbPrivileges($_REQUEST['checkprivsdb'])
 370         );
 371     }
 372 } else {
 373     if (! isset($username)) {
 374         // No username is given --> display the overview
 375         $response->addHTML(
 376             PMA_getHtmlForUserOverview($pmaThemeImage, $text_dir)
 377         );
 378     } else {
 379         // A user was selected -> display the user's properties
 380         // In an Ajax request, prevent cached values from showing
 381         if ($GLOBALS['is_ajax_request'] == true) {
 382             header('Cache-Control: no-cache');
 383         }
 384         if (isset($dbname) && ! is_array($dbname)) {
 385             $url_dbname = urlencode(
 386                 str_replace(
 387                     array('\_', '\%'),
 388                     array('_', '%'), $_REQUEST['dbname']
 389                 )
 390             );
 391         }
 392         $response->addHTML(
 393             PMA_getHtmlForUserProperties(
 394                 (isset($dbname_is_wildcard) ? $dbname_is_wildcard : ''),
 395                 (isset($url_dbname) ? $url_dbname : ''),
 396                 $username, $hostname,
 397                 (isset($dbname) ? $dbname : ''),
 398                 (isset($tablename) ? $tablename : '')
 399             )
 400         );
 401     }
 402 }
 403
 404 if ((isset($_REQUEST['viewing_mode']) && $_REQUEST['viewing_mode'] == 'server')
 405     && $GLOBALS['cfgRelation']['menuswork']
 406 ) {
 407     $response->addHTML('</div>');
 408 }
 409
 410 ?>