server_privileges.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * Server privileges and users manipulations
   5  *
   6  * @package PhpMyAdmin
   7  */
   8
   9 use PhpMyAdmin\Core;
  10 use PhpMyAdmin\Message;
  11 use PhpMyAdmin\Relation;
  12 use PhpMyAdmin\Response;
  13 use PhpMyAdmin\Server\Common;
  14 use PhpMyAdmin\Server\Privileges;
  15 use PhpMyAdmin\Server\Users;
  16 use PhpMyAdmin\Template;
  17
  18 /**
  19  * include common file
  20  */
  21 require_once 'libraries/common.inc.php';
  22
  23 /**
  24  * functions implementation for this script
  25  */
  26 require_once 'libraries/check_user_privileges.inc.php';
  27
  28 $relation = new Relation();
  29 $cfgRelation = $relation->getRelationsParam();
  30
  31 /**
  32  * Does the common work
  33  */
  34 $response = Response::getInstance();
  35 $header   = $response->getHeader();
  36 $scripts  = $header->getScripts();
  37 $scripts->addFile('server_privileges.js');
  38 $scripts->addFile('vendor/zxcvbn.js');
  39
  40 if ((isset($_REQUEST['viewing_mode'])
  41     && $_REQUEST['viewing_mode'] == 'server')
  42     && $GLOBALS['cfgRelation']['menuswork']
  43 ) {
  44     $response->addHTML('<div>');
  45     $response->addHTML(Users::getHtmlForSubMenusOnUsersPage('server_privileges.php'));
  46 }
  47
  48 /**
  49  * Sets globals from $_POST patterns, for privileges and max_* vars
  50  */
  51
  52 $post_patterns = array(
  53     '/_priv$/i',
  54     '/^max_/i'
  55 );
  56
  57 Core::setPostAsGlobal($post_patterns);
  58
  59 require 'libraries/server_common.inc.php';
  60
  61 /**
  62  * Messages are built using the message name
  63  */
  64 $strPrivDescAllPrivileges = __('Includes all privileges except GRANT.');
  65 $strPrivDescAlter = __('Allows altering the structure of existing tables.');
  66 $strPrivDescAlterRoutine = __('Allows altering and dropping stored routines.');
  67 $strPrivDescCreateDb = __('Allows creating new databases and tables.');
  68 $strPrivDescCreateRoutine = __('Allows creating stored routines.');
  69 $strPrivDescCreateTbl = __('Allows creating new tables.');
  70 $strPrivDescCreateTmpTable = __('Allows creating temporary tables.');
  71 $strPrivDescCreateUser = __('Allows creating, dropping and renaming user accounts.');
  72 $strPrivDescCreateView = __('Allows creating new views.');
  73 $strPrivDescDelete = __('Allows deleting data.');
  74 $strPrivDescDropDb = __('Allows dropping databases and tables.');
  75 $strPrivDescDropTbl = __('Allows dropping tables.');
  76 $strPrivDescEvent = __('Allows to set up events for the event scheduler.');
  77 $strPrivDescExecute = __('Allows executing stored routines.');
  78 $strPrivDescFile = __('Allows importing data from and exporting data into files.');
  79 $strPrivDescGrantTbl = __(
  80     'Allows user to give to other users or remove from other users the privileges '
  81     . 'that user possess yourself.'
  82 );
  83 $strPrivDescIndex = __('Allows creating and dropping indexes.');
  84 $strPrivDescInsert = __('Allows inserting and replacing data.');
  85 $strPrivDescLockTables = __('Allows locking tables for the current thread.');
  86 $strPrivDescMaxConnections = __(
  87     'Limits the number of new connections the user may open per hour.'
  88 );
  89 $strPrivDescMaxQuestions = __(
  90     'Limits the number of queries the user may send to the server per hour.'
  91 );
  92 $strPrivDescMaxUpdates = __(
  93     'Limits the number of commands that change any table or database '
  94     . 'the user may execute per hour.'
  95 );
  96 $strPrivDescMaxUserConnections = __(
  97     'Limits the number of simultaneous connections the user may have.'
  98 );
  99 $strPrivDescProcess = __('Allows viewing processes of all users.');
 100 $strPrivDescReferences = __('Has no effect in this MySQL version.');
 101 $strPrivDescReload = __(
 102     'Allows reloading server settings and flushing the server\'s caches.'
 103 );
 104 $strPrivDescReplClient = __(
 105     'Allows the user to ask where the slaves / masters are.'
 106 );
 107 $strPrivDescReplSlave = __('Needed for the replication slaves.');
 108 $strPrivDescSelect = __('Allows reading data.');
 109 $strPrivDescShowDb = __('Gives access to the complete list of databases.');
 110 $strPrivDescShowView = __('Allows performing SHOW CREATE VIEW queries.');
 111 $strPrivDescShutdown = __('Allows shutting down the server.');
 112 $strPrivDescSuper = __(
 113     'Allows connecting, even if maximum number of connections is reached; '
 114     . 'required for most administrative operations like setting global variables '
 115     . 'or killing threads of other users.'
 116 );
 117 $strPrivDescTrigger = __('Allows creating and dropping triggers.');
 118 $strPrivDescUpdate = __('Allows changing data.');
 119 $strPrivDescUsage = __('No privileges.');
 120
 121 $_add_user_error = false;
 122 /**
 123  * Get DB information: username, hostname, dbname,
 124  * tablename, db_and_table, dbname_is_wildcard
 125  */
 126 list(
 127     $username, $hostname, $dbname, $tablename, $routinename,
 128     $db_and_table, $dbname_is_wildcard
 129 ) = Privileges::getDataForDBInfo();
 130
 131 /**
 132  * Checks if the user is allowed to do what he tries to...
 133  */
 134 if (!$GLOBALS['dbi']->isSuperuser() && !$GLOBALS['is_grantuser']
 135     && !$GLOBALS['is_createuser']
 136 ) {
 137     $response->addHTML(
 138         Template::get('server/sub_page_header')->render([
 139             'type' => 'privileges',
 140             'is_image' => false,
 141         ])
 142     );
 143     $response->addHTML(
 144         Message::error(__('No Privileges'))
 145             ->getDisplay()
 146     );
 147     exit;
 148 }
 149 if (! $GLOBALS['is_grantuser'] && !$GLOBALS['is_createuser']) {
 150     $response->addHTML(Message::notice(
 151         __('You do not have privileges to manipulate with the users!')
 152     )->getDisplay());
 153 }
 154
 155 /**
 156  * Checks if the user is using "Change Login Information / Copy User" dialog
 157  * only to update the password
 158  */
 159 if (isset($_REQUEST['change_copy']) && $username == $_REQUEST['old_username']
 160     && $hostname == $_REQUEST['old_hostname']
 161 ) {
 162     $response->addHTML(
 163         Message::error(
 164             __(
 165                 "Username and hostname didn't change. "
 166                 . "If you only want to change the password, "
 167                 . "'Change password' tab should be used."
 168             )
 169         )->getDisplay()
 170     );
 171     $response->setRequestStatus(false);
 172     exit;
 173 }
 174
 175 /**
 176  * Changes / copies a user, part I
 177  */
 178 list($queries, $password) = Privileges::getDataForChangeOrCopyUser();
 179
 180 /**
 181  * Adds a user
 182  *   (Changes / copies a user, part II)
 183  */
 184 list($ret_message, $ret_queries, $queries_for_display, $sql_query, $_add_user_error)
 185     = Privileges::addUser(
 186         isset($dbname)? $dbname : null,
 187         isset($username)? $username : null,
 188         isset($hostname)? $hostname : null,
 189         isset($password)? $password : null,
 190         $cfgRelation['menuswork']
 191     );
 192 //update the old variables
 193 if (isset($ret_queries)) {
 194     $queries = $ret_queries;
 195     unset($ret_queries);
 196 }
 197 if (isset($ret_message)) {
 198     $message = $ret_message;
 199     unset($ret_message);
 200 }
 201
 202 /**
 203  * Changes / copies a user, part III
 204  */
 205 if (isset($_REQUEST['change_copy'])) {
 206     $queries = Privileges::getDbSpecificPrivsQueriesForChangeOrCopyUser(
 207         $queries, $username, $hostname
 208     );
 209 }
 210
 211 $itemType = '';
 212 if (! empty($routinename)) {
 213     $itemType = Privileges::getRoutineType($dbname, $routinename);
 214 }
 215
 216 /**
 217  * Updates privileges
 218  */
 219 if (! empty($_POST['update_privs'])) {
 220     if (is_array($dbname)) {
 221         foreach ($dbname as $key => $db_name) {
 222             list($sql_query[$key], $message) = Privileges::updatePrivileges(
 223                 (isset($username) ? $username : ''),
 224                 (isset($hostname) ? $hostname : ''),
 225                 (isset($tablename)
 226                     ? $tablename
 227                     : (isset($routinename) ? $routinename : '')),
 228                 (isset($db_name) ? $db_name : ''),
 229                 $itemType
 230             );
 231         }
 232
 233         $sql_query = implode("\n", $sql_query);
 234     } else {
 235         list($sql_query, $message) = Privileges::updatePrivileges(
 236             (isset($username) ? $username : ''),
 237             (isset($hostname) ? $hostname : ''),
 238             (isset($tablename)
 239                 ? $tablename
 240                 : (isset($routinename) ? $routinename : '')),
 241             (isset($dbname) ? $dbname : ''),
 242             $itemType
 243         );
 244     }
 245 }
 246
 247 /**
 248  * Assign users to user groups
 249  */
 250 if (! empty($_REQUEST['changeUserGroup']) && $cfgRelation['menuswork']
 251     && $GLOBALS['dbi']->isSuperuser() && $GLOBALS['is_createuser']
 252 ) {
 253     Privileges::setUserGroup($username, $_REQUEST['userGroup']);
 254     $message = Message::success();
 255 }
 256
 257 /**
 258  * Revokes Privileges
 259  */
 260 if (isset($_REQUEST['revokeall'])) {
 261     list ($message, $sql_query) = Privileges::getMessageAndSqlQueryForPrivilegesRevoke(
 262         (isset($dbname) ? $dbname : ''),
 263         (isset($tablename)
 264             ? $tablename
 265             : (isset($routinename) ? $routinename : '')),
 266         $username,
 267         $hostname,
 268         $itemType
 269     );
 270 }
 271
 272 /**
 273  * Updates the password
 274  */
 275 if (isset($_REQUEST['change_pw'])) {
 276     $message = Privileges::updatePassword(
 277         $err_url, $username, $hostname
 278     );
 279 }
 280
 281 /**
 282  * Deletes users
 283  *   (Changes / copies a user, part IV)
 284  */
 285 if (isset($_REQUEST['delete'])
 286     || (isset($_REQUEST['change_copy']) && $_REQUEST['mode'] < 4)
 287 ) {
 288     $queries = Privileges::getDataForDeleteUsers($queries);
 289     if (empty($_REQUEST['change_copy'])) {
 290         list($sql_query, $message) = Privileges::deleteUser($queries);
 291     }
 292 }
 293
 294 /**
 295  * Changes / copies a user, part V
 296  */
 297 if (isset($_REQUEST['change_copy'])) {
 298     $queries = Privileges::getDataForQueries($queries, $queries_for_display);
 299     $message = Message::success();
 300     $sql_query = join("\n", $queries);
 301 }
 302
 303 /**
 304  * Reloads the privilege tables into memory
 305  */
 306 $message_ret = Privileges::updateMessageForReload();
 307 if (isset($message_ret)) {
 308     $message = $message_ret;
 309     unset($message_ret);
 310 }
 311
 312 /**
 313  * If we are in an Ajax request for Create User/Edit User/Revoke User/
 314  * Flush Privileges, show $message and exit.
 315  */
 316 if ($response->isAjax()
 317     && empty($_REQUEST['ajax_page_request'])
 318     && ! isset($_REQUEST['export'])
 319     && (! isset($_REQUEST['submit_mult']) || $_REQUEST['submit_mult'] != 'export')
 320     && ((! isset($_REQUEST['initial']) || $_REQUEST['initial'] === null
 321     || $_REQUEST['initial'] === '')
 322     || (isset($_REQUEST['delete']) && $_REQUEST['delete'] === __('Go')))
 323     && ! isset($_REQUEST['showall'])
 324     && ! isset($_REQUEST['edit_user_group_dialog'])
 325     && ! isset($_REQUEST['db_specific'])
 326 ) {
 327     $extra_data = Privileges::getExtraDataForAjaxBehavior(
 328         (isset($password) ? $password : ''),
 329         (isset($sql_query) ? $sql_query : ''),
 330         (isset($hostname) ? $hostname : ''),
 331         (isset($username) ? $username : '')
 332     );
 333
 334     if (! empty($message) && $message instanceof Message) {
 335         $response->setRequestStatus($message->isSuccess());
 336         $response->addJSON('message', $message);
 337         $response->addJSON($extra_data);
 338         exit;
 339     }
 340 }
 341
 342 /**
 343  * Displays the links
 344  */
 345 if (isset($_REQUEST['viewing_mode']) && $_REQUEST['viewing_mode'] == 'db') {
 346     $GLOBALS['db'] = $_REQUEST['db'] = $_REQUEST['checkprivsdb'];
 347
 348     $url_query .= '&amp;goto=db_operations.php';
 349
 350     // Gets the database structure
 351     $sub_part = '_structure';
 352     ob_start();
 353
 354     list(
 355         $tables,
 356         $num_tables,
 357         $total_num_tables,
 358         $sub_part,
 359         $is_show_stats,
 360         $db_is_system_schema,
 361         $tooltip_truename,
 362         $tooltip_aliasname,
 363         $pos
 364     ) = PhpMyAdmin\Util::getDbInfo($db, isset($sub_part) ? $sub_part : '');
 365
 366     $content = ob_get_contents();
 367     ob_end_clean();
 368     $response->addHTML($content . "\n");
 369 } else {
 370     if (! empty($GLOBALS['message'])) {
 371         $response->addHTML(PhpMyAdmin\Util::getMessage($GLOBALS['message']));
 372         unset($GLOBALS['message']);
 373     }
 374 }
 375
 376 /**
 377  * Displays the page
 378  */
 379 $response->addHTML(
 380     Privileges::getHtmlForUserGroupDialog(
 381         isset($username)? $username : null,
 382         $cfgRelation['menuswork']
 383     )
 384 );
 385
 386 // export user definition
 387 if (isset($_REQUEST['export'])
 388     || (isset($_REQUEST['submit_mult']) && $_REQUEST['submit_mult'] == 'export')
 389 ) {
 390     list($title, $export) = Privileges::getListForExportUserDefinition(
 391         isset($username) ? $username : null,
 392         isset($hostname) ? $hostname : null
 393     );
 394
 395     unset($username, $hostname, $grants, $one_grant);
 396
 397     if ($response->isAjax()) {
 398         $response->addJSON('message', $export);
 399         $response->addJSON('title', $title);
 400         exit;
 401     } else {
 402         $response->addHTML("<h2>$title</h2>$export");
 403     }
 404 }
 405
 406 if (isset($_REQUEST['adduser'])) {
 407     // Add user
 408     $response->addHTML(
 409         Privileges::getHtmlForAddUser((isset($dbname) ? $dbname : ''))
 410     );
 411 } elseif (isset($_REQUEST['checkprivsdb'])) {
 412     if (isset($_REQUEST['checkprivstable'])) {
 413         // check the privileges for a particular table.
 414         $response->addHTML(
 415             Privileges::getHtmlForSpecificTablePrivileges(
 416                 $_REQUEST['checkprivsdb'], $_REQUEST['checkprivstable']
 417             )
 418         );
 419     } else {
 420         // check the privileges for a particular database.
 421         $response->addHTML(
 422             Privileges::getHtmlForSpecificDbPrivileges($_REQUEST['checkprivsdb'])
 423         );
 424     }
 425 } else {
 426     if (isset($dbname) && ! is_array($dbname)) {
 427         $url_dbname = urlencode(
 428             str_replace(
 429                 array('\_', '\%'),
 430                 array('_', '%'),
 431                 $dbname
 432             )
 433         );
 434     }
 435
 436     if (! isset($username)) {
 437         // No username is given --> display the overview
 438         $response->addHTML(
 439             Privileges::getHtmlForUserOverview($pmaThemeImage, $text_dir)
 440         );
 441     } elseif (!empty($routinename)) {
 442         $response->addHTML(
 443             Privileges::getHtmlForRoutineSpecificPrivileges(
 444                 $username, $hostname, $dbname, $routinename,
 445                 (isset($url_dbname) ? $url_dbname : '')
 446             )
 447         );
 448     } else {
 449         // A user was selected -> display the user's properties
 450         // In an Ajax request, prevent cached values from showing
 451         if ($response->isAjax()) {
 452             header('Cache-Control: no-cache');
 453         }
 454
 455         $response->addHTML(
 456             Privileges::getHtmlForUserProperties(
 457                 (isset($dbname_is_wildcard) ? $dbname_is_wildcard : ''),
 458                 (isset($url_dbname) ? $url_dbname : ''),
 459                 $username, $hostname,
 460                 (isset($dbname) ? $dbname : ''),
 461                 (isset($tablename) ? $tablename : '')
 462             )
 463         );
 464     }
 465 }
 466
 467 if ((isset($_REQUEST['viewing_mode']) && $_REQUEST['viewing_mode'] == 'server')
 468     && $GLOBALS['cfgRelation']['menuswork']
 469 ) {
 470     $response->addHTML('</div>');
 471 }