?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Translation update done using Pootle.
[phpmyadmin/mlewandow.git] / server_privileges.php
blob1389cb9f35b841c8041e66dbb0d60276ea08d514
1 <?php
2 /* vim: set expandtab sw=4 ts=4 sts=4: */
3 /**
4 *
5 * @package phpMyAdmin
6 */
7
8 /**
9 *
10 */
11 require_once './libraries/common.inc.php';
12
13 /**
14 * Does the common work
15 */
16 $GLOBALS['js_include'][] = 'server_privileges.js';
17 $GLOBALS['js_include'][] = 'functions.js';
18 $GLOBALS['js_include'][] = 'jquery/jquery-ui-1.8.custom.js';
19
20 require './libraries/server_common.inc.php';
21
22 if ($GLOBALS['cfg']['AjaxEnable']) {
23 $conditional_class = 'ajax';
24 } else {
25 $conditional_class = '';
26 }
27
28 /**
29 * Messages are built using the message name
30 */
31 $strPrivDescAllPrivileges = __('Includes all privileges except GRANT.');
32 $strPrivDescAlter = __('Allows altering the structure of existing tables.');
33 $strPrivDescAlterRoutine = __('Allows altering and dropping stored routines.');
34 $strPrivDescCreateDb = __('Allows creating new databases and tables.');
35 $strPrivDescCreateRoutine = __('Allows creating stored routines.');
36 $strPrivDescCreateTbl = __('Allows creating new tables.');
37 $strPrivDescCreateTmpTable = __('Allows creating temporary tables.');
38 $strPrivDescCreateUser = __('Allows creating, dropping and renaming user accounts.');
39 $strPrivDescCreateView = __('Allows creating new views.');
40 $strPrivDescDelete = __('Allows deleting data.');
41 $strPrivDescDropDb = __('Allows dropping databases and tables.');
42 $strPrivDescDropTbl = __('Allows dropping tables.');
43 $strPrivDescEvent = __('Allows to set up events for the event scheduler');
44 $strPrivDescExecute = __('Allows executing stored routines.');
45 $strPrivDescFile = __('Allows importing data from and exporting data into files.');
46 $strPrivDescGrant = __('Allows adding users and privileges without reloading the privilege tables.');
47 $strPrivDescIndex = __('Allows creating and dropping indexes.');
48 $strPrivDescInsert = __('Allows inserting and replacing data.');
49 $strPrivDescLockTables = __('Allows locking tables for the current thread.');
50 $strPrivDescMaxConnections = __('Limits the number of new connections the user may open per hour.');
51 $strPrivDescMaxQuestions = __('Limits the number of queries the user may send to the server per hour.');
52 $strPrivDescMaxUpdates = __('Limits the number of commands that change any table or database the user may execute per hour.');
53 $strPrivDescMaxUserConnections = __('Limits the number of simultaneous connections the user may have.');
54 $strPrivDescProcess = __('Allows viewing processes of all users');
55 $strPrivDescReferences = __('Has no effect in this MySQL version.');
56 $strPrivDescReload = __('Allows reloading server settings and flushing the server\'s caches.');
57 $strPrivDescReplClient = __('Allows the user to ask where the slaves / masters are.');
58 $strPrivDescReplSlave = __('Needed for the replication slaves.');
59 $strPrivDescSelect = __('Allows reading data.');
60 $strPrivDescShowDb = __('Gives access to the complete list of databases.');
61 $strPrivDescShowView = __('Allows performing SHOW CREATE VIEW queries.');
62 $strPrivDescShutdown = __('Allows shutting down the server.');
63 $strPrivDescSuper = __('Allows connecting, even if maximum number of connections is reached; required for most administrative operations like setting global variables or killing threads of other users.');
64 $strPrivDescTrigger = __('Allows creating and dropping triggers');
65 $strPrivDescUpdate = __('Allows changing data.');
66 $strPrivDescUsage = __('No privileges.');
67
68 /**
69 * Checks if a dropdown box has been used for selecting a database / table
70 */
71 if (PMA_isValid($_REQUEST['pred_tablename'])) {
72 $tablename = $_REQUEST['pred_tablename'];
73 unset($pred_tablename);
74 } elseif (PMA_isValid($_REQUEST['tablename'])) {
75 $tablename = $_REQUEST['tablename'];
76 } else {
77 unset($tablename);
78 }
79
80 if (PMA_isValid($_REQUEST['pred_dbname'])) {
81 $dbname = $_REQUEST['pred_dbname'];
82 unset($pred_dbname);
83 } elseif (PMA_isValid($_REQUEST['dbname'])) {
84 $dbname = $_REQUEST['dbname'];
85 } else {
86 unset($dbname);
87 unset($tablename);
88 }
89
90 if (isset($dbname)) {
91 $db_and_table = PMA_backquote(PMA_unescape_mysql_wildcards($dbname)) . '.';
92 if (isset($tablename)) {
93 $db_and_table .= PMA_backquote($tablename);
94 } else {
95 $db_and_table .= '*';
96 }
97 } else {
98 $db_and_table = '*.*';
99 }
100
101 // check if given $dbname is a wildcard or not
102 if (isset($dbname)) {
103 //if (preg_match('/\\\\(?:_|%)/i', $dbname)) {
104 if (preg_match('/(?<!\\\\)(?:_|%)/i', $dbname)) {
105 $dbname_is_wildcard = true;
106 } else {
107 $dbname_is_wildcard = false;
108 }
109 }
110
111 /**
112 * Checks if the user is allowed to do what he tries to...
113 */
114 if (!$is_superuser) {
115 require './libraries/server_links.inc.php';
116 echo '<h2>' . "\n"
117 . PMA_getIcon('b_usrlist.png')
118 . __('Privileges') . "\n"
119 . '</h2>' . "\n";
120 PMA_Message::error(__('No Privileges'))->display();
121 require './libraries/footer.inc.php';
122 }
123
124 $random_n = mt_rand(0,1000000); // a random number that will be appended to the id of the user forms
125
126 /**
127 * Escapes wildcard in a database+table specification
128 * before using it in a GRANT statement.
129 *
130 * Escaping a wildcard character in a GRANT is only accepted at the global
131 * or database level, not at table level; this is why I remove
132 * the escaping character. Internally, in mysql.tables_priv.Db there are
133 * no escaping (for example test_db) but in mysql.db you'll see test\_db
134 * for a db-specific privilege.
135 *
136 * @param string $db_and_table
137 * @param string $dbname
138 * @param string $tablename
139 * @return string the escaped (if necessary) $db_and_table
140 */
141 function PMA_WildcardEscapeForGrant($db_and_table, $dbname, $tablename) {
142
143 if (! strlen($dbname)) {
144 $db_and_table = '*.*';
145 } else {
146 if (strlen($tablename)) {
147 $db_and_table = PMA_backquote(PMA_unescape_mysql_wildcards($dbname)) . '.';
148 $db_and_table .= PMA_backquote($tablename);
149 } else {
150 $db_and_table = PMA_backquote($dbname) . '.';
151 $db_and_table .= '*';
152 }
153 }
154 return $db_and_table;
155 }
156
157 /**
158 * Generates a condition on the user name
159 *
160 * @param string the user's initial
161 * @return string the generated condition
162 */
163 function PMA_RangeOfUsers($initial = '')
164 {
165 // strtolower() is used because the User field
166 // might be BINARY, so LIKE would be case sensitive
167 if (!empty($initial)) {
168 $ret = " WHERE `User` LIKE '" . $initial . "%'"
169 . " OR `User` LIKE '" . strtolower($initial) . "%'";
170 } else {
171 $ret = '';
172 }
173 return $ret;
174 } // end function
175
176 /**
177 * Extracts the privilege information of a priv table row
178 *
179 * @param array $row the row
180 * @param boolean $enableHTML add <dfn> tag with tooltips
181 *
182 * @global ressource $user_link the database connection
183 *
184 * @return array
185 */
186 function PMA_extractPrivInfo($row = '', $enableHTML = FALSE)
187 {
188 $grants = array(
189 array('Select_priv', 'SELECT', __('Allows reading data.')),
190 array('Insert_priv', 'INSERT', __('Allows inserting and replacing data.')),
191 array('Update_priv', 'UPDATE', __('Allows changing data.')),
192 array('Delete_priv', 'DELETE', __('Allows deleting data.')),
193 array('Create_priv', 'CREATE', __('Allows creating new databases and tables.')),
194 array('Drop_priv', 'DROP', __('Allows dropping databases and tables.')),
195 array('Reload_priv', 'RELOAD', __('Allows reloading server settings and flushing the server\'s caches.')),
196 array('Shutdown_priv', 'SHUTDOWN', __('Allows shutting down the server.')),
197 array('Process_priv', 'PROCESS', __('Allows viewing processes of all users')),
198 array('File_priv', 'FILE', __('Allows importing data from and exporting data into files.')),
199 array('References_priv', 'REFERENCES', __('Has no effect in this MySQL version.')),
200 array('Index_priv', 'INDEX', __('Allows creating and dropping indexes.')),
201 array('Alter_priv', 'ALTER', __('Allows altering the structure of existing tables.')),
202 array('Show_db_priv', 'SHOW DATABASES', __('Gives access to the complete list of databases.')),
203 array('Super_priv', 'SUPER', __('Allows connecting, even if maximum number of connections is reached; required for most administrative operations like setting global variables or killing threads of other users.')),
204 array('Create_tmp_table_priv', 'CREATE TEMPORARY TABLES', __('Allows creating temporary tables.')),
205 array('Lock_tables_priv', 'LOCK TABLES', __('Allows locking tables for the current thread.')),
206 array('Repl_slave_priv', 'REPLICATION SLAVE', __('Needed for the replication slaves.')),
207 array('Repl_client_priv', 'REPLICATION CLIENT', __('Allows the user to ask where the slaves / masters are.')),
208 array('Create_view_priv', 'CREATE VIEW', __('Allows creating new views.')),
209 array('Event_priv', 'EVENT', __('Allows to set up events for the event scheduler')),
210 array('Trigger_priv', 'TRIGGER', __('Allows creating and dropping triggers')),
211 // for table privs:
212 array('Create View_priv', 'CREATE VIEW', __('Allows creating new views.')),
213 array('Show_view_priv', 'SHOW VIEW', __('Allows performing SHOW CREATE VIEW queries.')),
214 // for table privs:
215 array('Show view_priv', 'SHOW VIEW', __('Allows performing SHOW CREATE VIEW queries.')),
216 array('Create_routine_priv', 'CREATE ROUTINE', __('Allows creating stored routines.')),
217 array('Alter_routine_priv', 'ALTER ROUTINE', __('Allows altering and dropping stored routines.')),
218 array('Create_user_priv', 'CREATE USER', __('Allows creating, dropping and renaming user accounts.')),
219 array('Execute_priv', 'EXECUTE', __('Allows executing stored routines.')),
220 );
221
222 if (!empty($row) && isset($row['Table_priv'])) {
223 $row1 = PMA_DBI_fetch_single_row(
224 'SHOW COLUMNS FROM `mysql`.`tables_priv` LIKE \'Table_priv\';',
225 'ASSOC', $GLOBALS['userlink']);
226 $av_grants = explode('\',\'', substr($row1['Type'], 5, strlen($row1['Type']) - 7));
227 unset($row1);
228 $users_grants = explode(',', $row['Table_priv']);
229 foreach ($av_grants as $current_grant) {
230 $row[$current_grant . '_priv'] = in_array($current_grant, $users_grants) ? 'Y' : 'N';
231 }
232 unset($current_grant);
233 unset($av_grants);
234 unset($users_grants);
235 }
236 $privs = array();
237 $allPrivileges = TRUE;
238 foreach ($grants as $current_grant) {
239 if ((!empty($row) && isset($row[$current_grant[0]]))
240 || (empty($row) && isset($GLOBALS[$current_grant[0]]))) {
241 if ((!empty($row) && $row[$current_grant[0]] == 'Y')
242 || (empty($row)
243 && ($GLOBALS[$current_grant[0]] == 'Y'
244 || (is_array($GLOBALS[$current_grant[0]])
245 && count($GLOBALS[$current_grant[0]]) == $GLOBALS['column_count']
246 && empty($GLOBALS[$current_grant[0] . '_none'])))))
247 {
248 if ($enableHTML) {
249 $privs[] = '<dfn title="' . $current_grant[2] . '">' . $current_grant[1] . '</dfn>';
250 } else {
251 $privs[] = $current_grant[1];
252 }
253 } elseif (!empty($GLOBALS[$current_grant[0]])
254 && is_array($GLOBALS[$current_grant[0]])
255 && empty($GLOBALS[$current_grant[0] . '_none'])) {
256 if ($enableHTML) {
257 $priv_string = '<dfn title="' . $current_grant[2] . '">' . $current_grant[1] . '</dfn>';
258 } else {
259 $priv_string = $current_grant[1];
260 }
261 $privs[] = $priv_string . ' (`' . join('`, `', $GLOBALS[$current_grant[0]]) . '`)';
262 } else {
263 $allPrivileges = FALSE;
264 }
265 }
266 }
267 if (empty($privs)) {
268 if ($enableHTML) {
269 $privs[] = '<dfn title="' . __('No privileges.') . '">USAGE</dfn>';
270 } else {
271 $privs[] = 'USAGE';
272 }
273 } elseif ($allPrivileges && (!isset($GLOBALS['grant_count']) || count($privs) == $GLOBALS['grant_count'])) {
274 if ($enableHTML) {
275 $privs = array('<dfn title="' . __('Includes all privileges except GRANT.') . '">ALL PRIVILEGES</dfn>');
276 } else {
277 $privs = array('ALL PRIVILEGES');
278 }
279 }
280 return $privs;
281 } // end of the 'PMA_extractPrivInfo()' function
282
283 /**
284 * Displays on which column(s) a table-specific privilege is granted
285 */
286 function PMA_display_column_privs($columns, $row, $name_for_select,
287 $priv_for_header, $name, $name_for_dfn, $name_for_current)
288 {
289 echo ' <div class="item" id="div_item_' . $name . '">' . "\n"
290 . ' <label for="select_' . $name . '_priv">' . "\n"
291 . ' <tt><dfn title="' . $name_for_dfn . '">'
292 . $priv_for_header . '</dfn></tt>' . "\n"
293 . ' </label><br />' . "\n"
294 . ' <select id="select_' . $name . '_priv" name="'
295 . $name_for_select . '[]" multiple="multiple" size="8">' . "\n";
296
297 foreach ($columns as $current_column => $current_column_privileges) {
298 echo ' <option value="' . htmlspecialchars($current_column) . '"';
299 if ($row[$name_for_select] == 'Y' || $current_column_privileges[$name_for_current]) {
300 echo ' selected="selected"';
301 }
302 echo '>' . htmlspecialchars($current_column) . '</option>' . "\n";
303 }
304
305 echo ' </select>' . "\n"
306 . ' <i>' . __('Or') . '</i>' . "\n"
307 . ' <label for="checkbox_' . $name_for_select
308 . '_none"><input type="checkbox"'
309 . (empty($GLOBALS['checkall']) ? '' : ' checked="checked"')
310 . ' name="' . $name_for_select . '_none" id="checkbox_'
311 . $name_for_select . '_none" title="' . _pgettext('None privileges', 'None') . '" />'
312 . _pgettext('None privileges', 'None') . '</label>' . "\n"
313 . ' </div>' . "\n";
314 } // end function
315
316
317 /**
318 * Displays the privileges form table
319 *
320 * @param string $db the database
321 * @param string $table the table
322 * @param boolean $submit wheather to display the submit button or not
323 * @global array $cfg the phpMyAdmin configuration
324 * @global ressource $user_link the database connection
325 *
326 * @return void
327 */
328 function PMA_displayPrivTable($db = '*', $table = '*', $submit = TRUE)
329 {
330 global $random_n;
331
332 if ($db == '*') {
333 $table = '*';
334 }
335
336 if (isset($GLOBALS['username'])) {
337 $username = $GLOBALS['username'];
338 $hostname = $GLOBALS['hostname'];
339 if ($db == '*') {
340 $sql_query =
341 "SELECT * FROM `mysql`.`user`"
342 ." WHERE `User` = '" . PMA_sqlAddslashes($username) . "'"
343 ." AND `Host` = '" . PMA_sqlAddslashes($hostname) . "';";
344 } elseif ($table == '*') {
345 $sql_query =
346 "SELECT * FROM `mysql`.`db`"
347 ." WHERE `User` = '" . PMA_sqlAddslashes($username) . "'"
348 ." AND `Host` = '" . PMA_sqlAddslashes($hostname) . "'"
349 ." AND '" . PMA_unescape_mysql_wildcards($db) . "'"
350 ." LIKE `Db`;";
351 } else {
352 $sql_query =
353 "SELECT `Table_priv`"
354 ." FROM `mysql`.`tables_priv`"
355 ." WHERE `User` = '" . PMA_sqlAddslashes($username) . "'"
356 ." AND `Host` = '" . PMA_sqlAddslashes($hostname) . "'"
357 ." AND `Db` = '" . PMA_unescape_mysql_wildcards($db) . "'"
358 ." AND `Table_name` = '" . PMA_sqlAddslashes($table) . "';";
359 }
360 $row = PMA_DBI_fetch_single_row($sql_query);
361 }
362 if (empty($row)) {
363 if ($table == '*') {
364 if ($db == '*') {
365 $sql_query = 'SHOW COLUMNS FROM `mysql`.`user`;';
366 } elseif ($table == '*') {
367 $sql_query = 'SHOW COLUMNS FROM `mysql`.`db`;';
368 }
369 $res = PMA_DBI_query($sql_query);
370 while ($row1 = PMA_DBI_fetch_row($res)) {
371 if (substr($row1[0], 0, 4) == 'max_') {
372 $row[$row1[0]] = 0;
373 } else {
374 $row[$row1[0]] = 'N';
375 }
376 }
377 PMA_DBI_free_result($res);
378 } else {
379 $row = array('Table_priv' => '');
380 }
381 }
382 if (isset($row['Table_priv'])) {
383 $row1 = PMA_DBI_fetch_single_row(
384 'SHOW COLUMNS FROM `mysql`.`tables_priv` LIKE \'Table_priv\';',
385 'ASSOC', $GLOBALS['userlink']);
386 // note: in MySQL 5.0.3 we get "Create View', 'Show view';
387 // the View for Create is spelled with uppercase V
388 // the view for Show is spelled with lowercase v
389 // and there is a space between the words
390
391 $av_grants = explode('\',\'', substr($row1['Type'], strpos($row1['Type'], '(') + 2, strpos($row1['Type'], ')') - strpos($row1['Type'], '(') - 3));
392 unset($row1);
393 $users_grants = explode(',', $row['Table_priv']);
394
395 foreach ($av_grants as $current_grant) {
396 $row[$current_grant . '_priv'] = in_array($current_grant, $users_grants) ? 'Y' : 'N';
397 }
398 unset($row['Table_priv'], $current_grant, $av_grants, $users_grants);
399
400 // get collumns
401 $res = PMA_DBI_try_query('SHOW COLUMNS FROM ' . PMA_backquote(PMA_unescape_mysql_wildcards($db)) . '.' . PMA_backquote($table) . ';');
402 $columns = array();
403 if ($res) {
404 while ($row1 = PMA_DBI_fetch_row($res)) {
405 $columns[$row1[0]] = array(
406 'Select' => FALSE,
407 'Insert' => FALSE,
408 'Update' => FALSE,
409 'References' => FALSE
410 );
411 }
412 PMA_DBI_free_result($res);
413 }
414 unset($res, $row1);
415 }
416 // t a b l e - s p e c i f i c p r i v i l e g e s
417 if (! empty($columns)) {
418 $res = PMA_DBI_query(
419 'SELECT `Column_name`, `Column_priv`'
420 .' FROM `mysql`.`columns_priv`'
421 .' WHERE `User`'
422 .' = \'' . PMA_sqlAddslashes($username) . "'"
423 .' AND `Host`'
424 .' = \'' . PMA_sqlAddslashes($hostname) . "'"
425 .' AND `Db`'
426 .' = \'' . PMA_sqlAddslashes(PMA_unescape_mysql_wildcards($db)) . "'"
427 .' AND `Table_name`'
428 .' = \'' . PMA_sqlAddslashes($table) . '\';');
429
430 while ($row1 = PMA_DBI_fetch_row($res)) {
431 $row1[1] = explode(',', $row1[1]);
432 foreach ($row1[1] as $current) {
433 $columns[$row1[0]][$current] = TRUE;
434 }
435 }
436 PMA_DBI_free_result($res);
437 unset($res, $row1, $current);
438
439 echo '<input type="hidden" name="grant_count" value="' . count($row) . '" />' . "\n"
440 . '<input type="hidden" name="column_count" value="' . count($columns) . '" />' . "\n"
441 . '<fieldset id="fieldset_user_priv">' . "\n"
442 . ' <legend>' . __('Table-specific privileges')
443 . PMA_showHint(__(' Note: MySQL privilege names are expressed in English '))
444 . '</legend>' . "\n";
445
446
447
448 // privs that are attached to a specific column
449 PMA_display_column_privs($columns, $row, 'Select_priv',
450 'SELECT', 'select', __('Allows reading data.'), 'Select');
451
452 PMA_display_column_privs($columns, $row, 'Insert_priv',
453 'INSERT', 'insert', __('Allows inserting and replacing data.'), 'Insert');
454
455 PMA_display_column_privs($columns, $row, 'Update_priv',
456 'UPDATE', 'update', __('Allows changing data.'), 'Update');
457
458 PMA_display_column_privs($columns, $row, 'References_priv',
459 'REFERENCES', 'references', __('Has no effect in this MySQL version.'), 'References');
460
461 // privs that are not attached to a specific column
462
463 echo ' <div class="item">' . "\n";
464 foreach ($row as $current_grant => $current_grant_value) {
465 if (in_array(substr($current_grant, 0, (strlen($current_grant) - 5)),
466 array('Select', 'Insert', 'Update', 'References'))) {
467 continue;
468 }
469 // make a substitution to match the messages variables;
470 // also we must substitute the grant we get, because we can't generate
471 // a form variable containing blanks (those would get changed to
472 // an underscore when receiving the POST)
473 if ($current_grant == 'Create View_priv') {
474 $tmp_current_grant = 'CreateView_priv';
475 $current_grant = 'Create_view_priv';
476 } elseif ($current_grant == 'Show view_priv') {
477 $tmp_current_grant = 'ShowView_priv';
478 $current_grant = 'Show_view_priv';
479 } else {
480 $tmp_current_grant = $current_grant;
481 }
482
483 echo ' <div class="item">' . "\n"
484 . ' <input type="checkbox"'
485 . (empty($GLOBALS['checkall']) ? '' : ' checked="checked"')
486 . ' name="' . $current_grant . '" id="checkbox_' . $current_grant
487 . '" value="Y" '
488 . ($current_grant_value == 'Y' ? 'checked="checked" ' : '')
489 . 'title="';
490
491 echo (isset($GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5))])
492 ? $GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5))]
493 : $GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5)) . 'Tbl']) . '"/>' . "\n";
494
495 echo ' <label for="checkbox_' . $current_grant
496 . '"><tt><dfn title="'
497 . (isset($GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5))])
498 ? $GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5))]
499 : $GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5)) . 'Tbl'])
500 . '">' . strtoupper(substr($current_grant, 0, strlen($current_grant) - 5)) . '</dfn></tt></label>' . "\n"
501 . ' </div>' . "\n";
502 } // end foreach ()
503
504 echo ' </div>' . "\n";
505 // for Safari 2.0.2
506 echo ' <div class="clearfloat"></div>' . "\n";
507
508 } else {
509
510 // g l o b a l o r d b - s p e c i f i c
511 //
512 // d a t a
513 $privTable[0] = array(
514 array('Select', 'SELECT', __('Allows reading data.')),
515 array('Insert', 'INSERT', __('Allows inserting and replacing data.')),
516 array('Update', 'UPDATE', __('Allows changing data.')),
517 array('Delete', 'DELETE', __('Allows deleting data.'))
518 );
519 if ($db == '*') {
520 $privTable[0][] = array('File', 'FILE', __('Allows importing data from and exporting data into files.'));
521 }
522
523 // s t r u c t u r e
524 $privTable[1] = array(
525 array('Create', 'CREATE', ($table == '*' ? __('Allows creating new databases and tables.') : __('Allows creating new tables.'))),
526 array('Alter', 'ALTER', __('Allows altering the structure of existing tables.')),
527 array('Index', 'INDEX', __('Allows creating and dropping indexes.')),
528 array('Drop', 'DROP', ($table == '*' ? __('Allows dropping databases and tables.') : __('Allows dropping tables.'))),
529 array('Create_tmp_table', 'CREATE TEMPORARY TABLES', __('Allows creating temporary tables.')),
530 array('Show_view', 'SHOW VIEW', __('Allows performing SHOW CREATE VIEW queries.')),
531 array('Create_routine', 'CREATE ROUTINE', __('Allows creating stored routines.')),
532 array('Alter_routine', 'ALTER ROUTINE', __('Allows altering and dropping stored routines.')),
533 array('Execute', 'EXECUTE', __('Allows executing stored routines.')),
534 );
535 // this one is for a db-specific priv: Create_view_priv
536 if (isset($row['Create_view_priv'])) {
537 $privTable[1][] = array('Create_view', 'CREATE VIEW', __('Allows creating new views.'));
538 }
539 // this one is for a table-specific priv: Create View_priv
540 if (isset($row['Create View_priv'])) {
541 $privTable[1][] = array('Create View', 'CREATE VIEW', __('Allows creating new views.'));
542 }
543 if (isset($row['Event_priv'])) {
544 // MySQL 5.1.6
545 $privTable[1][] = array('Event', 'EVENT', __('Allows to set up events for the event scheduler'));
546 $privTable[1][] = array('Trigger', 'TRIGGER', __('Allows creating and dropping triggers'));
547 }
548
549 // a d m i n i s t r a t i o n
550 $privTable[2] = array(
551 array('Grant', 'GRANT', __('Allows adding users and privileges without reloading the privilege tables.')),
552 );
553 if ($db == '*') {
554 $privTable[2][] = array('Super', 'SUPER', __('Allows connecting, even if maximum number of connections is reached; required for most administrative operations like setting global variables or killing threads of other users.'));
555 $privTable[2][] = array('Process', 'PROCESS', __('Allows viewing processes of all users'));
556 $privTable[2][] = array('Reload', 'RELOAD', __('Allows reloading server settings and flushing the server\'s caches.'));
557 $privTable[2][] = array('Shutdown', 'SHUTDOWN', __('Allows shutting down the server.'));
558 $privTable[2][] = array('Show_db', 'SHOW DATABASES', __('Gives access to the complete list of databases.'));
559 }
560 $privTable[2][] = array('Lock_tables', 'LOCK TABLES', __('Allows locking tables for the current thread.'));
561 $privTable[2][] = array('References', 'REFERENCES', __('Has no effect in this MySQL version.'));
562 if ($db == '*') {
563 $privTable[2][] = array('Repl_client', 'REPLICATION CLIENT', __('Allows the user to ask where the slaves / masters are.'));
564 $privTable[2][] = array('Repl_slave', 'REPLICATION SLAVE', __('Needed for the replication slaves.'));
565 $privTable[2][] = array('Create_user', 'CREATE USER', __('Allows creating, dropping and renaming user accounts.'));
566 }
567 echo '<input type="hidden" name="grant_count" value="'
568 . (count($privTable[0]) + count($privTable[1]) + count($privTable[2]) - (isset($row['Grant_priv']) ? 1 : 0))
569 . '" />' . "\n"
570 . '<fieldset id="fieldset_user_global_rights">' . "\n"
571 . ' <legend>' . "\n"
572 . ' '
573 . ($db == '*'
574 ? __('Global privileges')
575 : ($table == '*'
576 ? __('Database-specific privileges')
577 : __('Table-specific privileges'))) . "\n"
578 . ' (<a href="server_privileges.php?'
579 . $GLOBALS['url_query'] . '&amp;checkall=1" onclick="setCheckboxes(\'addUsersForm_' . $random_n . '\', true); return false;">'
580 . __('Check All') . '</a> /' . "\n"
581 . ' <a href="server_privileges.php?'
582 . $GLOBALS['url_query'] . '" onclick="setCheckboxes(\'addUsersForm_' . $random_n . '\', false); return false;">'
583 . __('Uncheck All') . '</a>)' . "\n"
584 . ' </legend>' . "\n"
585 . ' <p><small><i>' . __(' Note: MySQL privilege names are expressed in English ') . '</i></small></p>' . "\n"
586 . ' <fieldset>' . "\n"
587 . ' <legend>' . __('Data') . '</legend>' . "\n";
588 foreach ($privTable[0] as $priv)
589 {
590 echo ' <div class="item">' . "\n"
591 . ' <input type="checkbox"'
592 . (empty($GLOBALS['checkall']) ? '' : ' checked="checked"')
593 . ' name="' . $priv[0] . '_priv" id="checkbox_' . $priv[0]
594 . '_priv" value="Y" '
595 . ($row[$priv[0] . '_priv'] == 'Y' ? 'checked="checked" ' : '')
596 . 'title="' . $priv[2] . '"/>' . "\n"
597 . ' <label for="checkbox_' . $priv[0]
598 . '_priv"><tt><dfn title="' . $priv[2] . '">' . $priv[1]
599 . '</dfn></tt></label>' . "\n"
600 . ' </div>' . "\n";
601 }
602 echo ' </fieldset>' . "\n"
603 . ' <fieldset>' . "\n"
604 . ' <legend>' . __('Structure') . '</legend>' . "\n";
605 foreach ($privTable[1] as $priv)
606 {
607 echo ' <div class="item">' . "\n"
608 . ' <input type="checkbox"'
609 . (empty($GLOBALS['checkall']) ? '' : ' checked="checked"')
610 . ' name="' . $priv[0] . '_priv" id="checkbox_' . $priv[0]
611 . '_priv" value="Y" '
612 . ($row[$priv[0] . '_priv'] == 'Y' ? 'checked="checked" ' : '')
613 . 'title="' . $priv[2] . '"/>' . "\n"
614 . ' <label for="checkbox_' . $priv[0]
615 . '_priv"><tt><dfn title="' . $priv[2] . '">' . $priv[1]
616 . '</dfn></tt></label>' . "\n"
617 . ' </div>' . "\n";
618 }
619 echo ' </fieldset>' . "\n"
620 . ' <fieldset>' . "\n"
621 . ' <legend>' . __('Administration') . '</legend>' . "\n";
622 foreach ($privTable[2] as $priv)
623 {
624 echo ' <div class="item">' . "\n"
625 . ' <input type="checkbox"'
626 . (empty($GLOBALS['checkall']) ? '' : ' checked="checked"')
627 . ' name="' . $priv[0] . '_priv" id="checkbox_' . $priv[0]
628 . '_priv" value="Y" '
629 . ($row[$priv[0] . '_priv'] == 'Y' ? 'checked="checked" ' : '')
630 . 'title="' . $priv[2] . '"/>' . "\n"
631 . ' <label for="checkbox_' . $priv[0]
632 . '_priv"><tt><dfn title="' . $priv[2] . '">' . $priv[1]
633 . '</dfn></tt></label>' . "\n"
634 . ' </div>' . "\n";
635 }
636
637 echo ' </fieldset>' . "\n";
638 // The "Resource limits" box is not displayed for db-specific privs
639 if ($db == '*') {
640 echo ' <fieldset>' . "\n"
641 . ' <legend>' . __('Resource limits') . '</legend>' . "\n"
642 . ' <p><small><i>' . __('Note: Setting these options to 0 (zero) removes the limit.') . '</i></small></p>' . "\n"
643 . ' <div class="item">' . "\n"
644 . ' <label for="text_max_questions"><tt><dfn title="'
645 . __('Limits the number of queries the user may send to the server per hour.') . '">MAX QUERIES PER HOUR</dfn></tt></label>' . "\n"
646 . ' <input type="text" name="max_questions" id="text_max_questions" value="'
647 . $row['max_questions'] . '" size="11" maxlength="11" title="' . __('Limits the number of queries the user may send to the server per hour.') . '" />' . "\n"
648 . ' </div>' . "\n"
649 . ' <div class="item">' . "\n"
650 . ' <label for="text_max_updates"><tt><dfn title="'
651 . __('Limits the number of commands that change any table or database the user may execute per hour.') . '">MAX UPDATES PER HOUR</dfn></tt></label>' . "\n"
652 . ' <input type="text" name="max_updates" id="text_max_updates" value="'
653 . $row['max_updates'] . '" size="11" maxlength="11" title="' . __('Limits the number of commands that change any table or database the user may execute per hour.') . '" />' . "\n"
654 . ' </div>' . "\n"
655 . ' <div class="item">' . "\n"
656 . ' <label for="text_max_connections"><tt><dfn title="'
657 . __('Limits the number of new connections the user may open per hour.') . '">MAX CONNECTIONS PER HOUR</dfn></tt></label>' . "\n"
658 . ' <input type="text" name="max_connections" id="text_max_connections" value="'
659 . $row['max_connections'] . '" size="11" maxlength="11" title="' . __('Limits the number of new connections the user may open per hour.') . '" />' . "\n"
660 . ' </div>' . "\n"
661 . ' <div class="item">' . "\n"
662 . ' <label for="text_max_user_connections"><tt><dfn title="'
663 . __('Limits the number of simultaneous connections the user may have.') . '">MAX USER_CONNECTIONS</dfn></tt></label>' . "\n"
664 . ' <input type="text" name="max_user_connections" id="text_max_user_connections" value="'
665 . $row['max_user_connections'] . '" size="11" maxlength="11" title="' . __('Limits the number of simultaneous connections the user may have.') . '" />' . "\n"
666 . ' </div>' . "\n"
667 . ' </fieldset>' . "\n";
668 }
669 // for Safari 2.0.2
670 echo ' <div class="clearfloat"></div>' . "\n";
671 }
672 echo '</fieldset>' . "\n";
673 if ($submit) {
674 echo '<fieldset id="fieldset_user_privtable_footer" class="tblFooters">' . "\n"
675 . ' <input type="submit" name="update_privs" value="' . __('Go') . '" />' . "\n"
676 . '</fieldset>' . "\n";
677 }
678 } // end of the 'PMA_displayPrivTable()' function
679
680
681 /**
682 * Displays the fields used by the "new user" form as well as the
683 * "change login information / copy user" form.
684 *
685 * @param string $mode are we creating a new user or are we just
686 * changing one? (allowed values: 'new', 'change')
687 * @global array $cfg the phpMyAdmin configuration
688 * @global ressource $user_link the database connection
689 *
690 * @return void
691 */
692 function PMA_displayLoginInformationFields($mode = 'new')
693 {
694 // Get user/host name lengths
695 $fields_info = PMA_DBI_get_fields('mysql', 'user');
696 $username_length = 16;
697 $hostname_length = 41;
698 foreach ($fields_info as $key => $val) {
699 if ($val['Field'] == 'User') {
700 strtok($val['Type'], '()');
701 $v = strtok('()');
702 if (is_int($v)) {
703 $username_length = $v;
704 }
705 } elseif ($val['Field'] == 'Host') {
706 strtok($val['Type'], '()');
707 $v = strtok('()');
708 if (is_int($v)) {
709 $hostname_length = $v;
710 }
711 }
712 }
713 unset($fields_info);
714
715 if (isset($GLOBALS['username']) && strlen($GLOBALS['username']) === 0) {
716 $GLOBALS['pred_username'] = 'any';
717 }
718 echo '<fieldset id="fieldset_add_user_login">' . "\n"
719 . '<legend>' . __('Login Information') . '</legend>' . "\n"
720 . '<div class="item">' . "\n"
721 . '<label for="select_pred_username">' . "\n"
722 . ' ' . __('User name') . ':' . "\n"
723 . '</label>' . "\n"
724 . '<span class="options">' . "\n"
725 . ' <select name="pred_username" id="select_pred_username" title="' . __('User name') . '"' . "\n"
726 . ' onchange="if (this.value == \'any\') { username.value = \'\'; } else if (this.value == \'userdefined\') { username.focus(); username.select(); }">' . "\n"
727 . ' <option value="any"' . ((isset($GLOBALS['pred_username']) && $GLOBALS['pred_username'] == 'any') ? ' selected="selected"' : '') . '>' . __('Any user') . '</option>' . "\n"
728 . ' <option value="userdefined"' . ((!isset($GLOBALS['pred_username']) || $GLOBALS['pred_username'] == 'userdefined') ? ' selected="selected"' : '') . '>' . __('Use text field') . ':</option>' . "\n"
729 . ' </select>' . "\n"
730 . '</span>' . "\n"
731 . '<input type="text" name="username" maxlength="'
732 . $username_length . '" title="' . __('User name') . '"'
733 . (empty($GLOBALS['username'])
734 ? ''
735 : ' value="' . htmlspecialchars(isset($GLOBALS['new_username'])
736 ? $GLOBALS['new_username']
737 : $GLOBALS['username']) . '"')
738 . ' onchange="pred_username.value = \'userdefined\';" />' . "\n"
739 . '</div>' . "\n"
740 . '<div class="item">' . "\n"
741 . '<label for="select_pred_hostname">' . "\n"
742 . ' ' . __('Host') . ':' . "\n"
743 . '</label>' . "\n"
744 . '<span class="options">' . "\n"
745 . ' <select name="pred_hostname" id="select_pred_hostname" title="' . __('Host') . '"' . "\n";
746 $_current_user = PMA_DBI_fetch_value('SELECT USER();');
747 if (! empty($_current_user)) {
748 $thishost = str_replace("'", '', substr($_current_user, (strrpos($_current_user, '@') + 1)));
749 if ($thishost == 'localhost' || $thishost == '127.0.0.1') {
750 unset($thishost);
751 }
752 }
753 echo ' onchange="if (this.value == \'any\') { hostname.value = \'%\'; } else if (this.value == \'localhost\') { hostname.value = \'localhost\'; } '
754 . (empty($thishost) ? '' : 'else if (this.value == \'thishost\') { hostname.value = \'' . addslashes(htmlspecialchars($thishost)) . '\'; } ')
755 . 'else if (this.value == \'hosttable\') { hostname.value = \'\'; } else if (this.value == \'userdefined\') { hostname.focus(); hostname.select(); }">' . "\n";
756 unset($_current_user);
757
758 // when we start editing a user, $GLOBALS['pred_hostname'] is not defined
759 if (!isset($GLOBALS['pred_hostname']) && isset($GLOBALS['hostname'])) {
760 switch (strtolower($GLOBALS['hostname'])) {
761 case 'localhost':
762 case '127.0.0.1':
763 $GLOBALS['pred_hostname'] = 'localhost';
764 break;
765 case '%':
766 $GLOBALS['pred_hostname'] = 'any';
767 break;
768 default:
769 $GLOBALS['pred_hostname'] = 'userdefined';
770 break;
771 }
772 }
773 echo ' <option value="any"'
774 . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'any')
775 ? ' selected="selected"' : '') . '>' . __('Any host')
776 . '</option>' . "\n"
777 . ' <option value="localhost"'
778 . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'localhost')
779 ? ' selected="selected"' : '') . '>' . __('Local')
780 . '</option>' . "\n";
781 if (!empty($thishost)) {
782 echo ' <option value="thishost"'
783 . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'thishost')
784 ? ' selected="selected"' : '') . '>' . __('This Host')
785 . '</option>' . "\n";
786 }
787 unset($thishost);
788 echo ' <option value="hosttable"'
789 . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'hosttable')
790 ? ' selected="selected"' : '') . '>' . __('Use Host Table')
791 . '</option>' . "\n"
792 . ' <option value="userdefined"'
793 . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'userdefined')
794 ? ' selected="selected"' : '')
795 . '>' . __('Use text field') . ':</option>' . "\n"
796 . ' </select>' . "\n"
797 . '</span>' . "\n"
798 . '<input type="text" name="hostname" maxlength="'
799 . $hostname_length . '" value="'
800 . htmlspecialchars(isset($GLOBALS['hostname']) ? $GLOBALS['hostname'] : '')
801 . '" title="' . __('Host')
802 . '" onchange="pred_hostname.value = \'userdefined\';" />' . "\n"
803 . PMA_showHint(__('When Host table is used, this field is ignored and values stored in Host table are used instead.'))
804 . '</div>' . "\n"
805 . '<div class="item">' . "\n"
806 . '<label for="select_pred_password">' . "\n"
807 . ' ' . __('Password') . ':' . "\n"
808 . '</label>' . "\n"
809 . '<span class="options">' . "\n"
810 . ' <select name="pred_password" id="select_pred_password" title="'
811 . __('Password') . '"' . "\n"
812 . ' onchange="if (this.value == \'none\') { pma_pw.value = \'\'; pma_pw2.value = \'\'; } else if (this.value == \'userdefined\') { pma_pw.focus(); pma_pw.select(); }">' . "\n"
813 . ($mode == 'change' ? ' <option value="keep" selected="selected">' . __('Do not change the password') . '</option>' . "\n" : '')
814 . ' <option value="none"';
815 if (isset($GLOBALS['username']) && $mode != 'change') {
816 echo ' selected="selected"';
817 }
818 echo '>' . __('No Password') . '</option>' . "\n"
819 . ' <option value="userdefined"' . (isset($GLOBALS['username']) ? '' : ' selected="selected"') . '>' . __('Use text field') . ':</option>' . "\n"
820 . ' </select>' . "\n"
821 . '</span>' . "\n"
822 . '<input type="password" id="text_pma_pw" name="pma_pw" title="' . __('Password') . '" onchange="pred_password.value = \'userdefined\';" />' . "\n"
823 . '</div>' . "\n"
824 . '<div class="item" id="div_element_before_generate_password">' . "\n"
825 . '<label for="text_pma_pw2">' . "\n"
826 . ' ' . __('Re-type') . ':' . "\n"
827 . '</label>' . "\n"
828 . '<span class="options">&nbsp;</span>' . "\n"
829 . '<input type="password" name="pma_pw2" id="text_pma_pw2" title="' . __('Re-type') . '" onchange="pred_password.value = \'userdefined\';" />' . "\n"
830 . '</div>' . "\n"
831 // Generate password added here via jQuery
832 . '</fieldset>' . "\n";
833 } // end of the 'PMA_displayUserAndHostFields()' function
834
835 /**
836 * Changes / copies a user, part I
837 */
838 if (isset($_REQUEST['change_copy'])) {
839 $user_host_condition =
840 ' WHERE `User`'
841 .' = \'' . PMA_sqlAddslashes($old_username) . "'"
842 .' AND `Host`'
843 .' = \'' . PMA_sqlAddslashes($old_hostname) . '\';';
844 $row = PMA_DBI_fetch_single_row('SELECT * FROM `mysql`.`user` ' . $user_host_condition);
845 if (! $row) {
846 PMA_Message::notice(__('No user found.'))->display();
847 unset($_REQUEST['change_copy']);
848 } else {
849 extract($row, EXTR_OVERWRITE);
850 // Recent MySQL versions have the field "Password" in mysql.user,
851 // so the previous extract creates $Password but this script
852 // uses $password
853 if (!isset($password) && isset($Password)) {
854 $password = $Password;
855 }
856 $queries = array();
857 }
858 }
859
860
861 /**
862 * Adds a user
863 * (Changes / copies a user, part II)
864 */
865 if (isset($_REQUEST['adduser_submit']) || isset($_REQUEST['change_copy'])) {
866 $sql_query = '';
867 if ($pred_username == 'any') {
868 $username = '';
869 }
870 switch ($pred_hostname) {
871 case 'any':
872 $hostname = '%';
873 break;
874 case 'localhost':
875 $hostname = 'localhost';
876 break;
877 case 'hosttable':
878 $hostname = '';
879 break;
880 case 'thishost':
881 $_user_name = PMA_DBI_fetch_value('SELECT USER()');
882 $hostname = substr($_user_name, (strrpos($_user_name, '@') + 1));
883 unset($_user_name);
884 break;
885 }
886 $sql = "SELECT '1' FROM `mysql`.`user`"
887 . " WHERE `User` = '" . PMA_sqlAddslashes($username) . "'"
888 . " AND `Host` = '" . PMA_sqlAddslashes($hostname) . "';";
889 if (PMA_DBI_fetch_value($sql) == 1) {
890 $message = PMA_Message::error(__('The user %s already exists!'));
891 $message->addParam('[i]\'' . $username . '\'@\'' . $hostname . '\'[/i]');
892 $_REQUEST['adduser'] = true;
893 } else {
894
895 $create_user_real = 'CREATE USER \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\'';
896
897 $real_sql_query =
898 'GRANT ' . join(', ', PMA_extractPrivInfo()) . ' ON *.* TO \''
899 . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\'';
900 if ($pred_password != 'none' && $pred_password != 'keep') {
901 $sql_query = $real_sql_query . ' IDENTIFIED BY \'***\'';
902 $real_sql_query .= ' IDENTIFIED BY \'' . PMA_sqlAddslashes($pma_pw) . '\'';
903 if (isset($create_user_real)) {
904 $create_user_show = $create_user_real . ' IDENTIFIED BY \'***\'';
905 $create_user_real .= ' IDENTIFIED BY \'' . PMA_sqlAddslashes($pma_pw) . '\'';
906 }
907 } else {
908 if ($pred_password == 'keep' && !empty($password)) {
909 $real_sql_query .= ' IDENTIFIED BY PASSWORD \'' . $password . '\'';
910 if (isset($create_user_real)) {
911 $create_user_real .= ' IDENTIFIED BY PASSWORD \'' . $password . '\'';
912 }
913 }
914 $sql_query = $real_sql_query;
915 if (isset($create_user_real)) {
916 $create_user_show = $create_user_real;
917 }
918 }
919 /**
920 * @todo similar code appears twice in this script
921 */
922 if ((isset($Grant_priv) && $Grant_priv == 'Y')
923 || (isset($max_questions) || isset($max_connections)
924 || isset($max_updates) || isset($max_user_connections))) {
925 $real_sql_query .= ' WITH';
926 $sql_query .= ' WITH';
927 if (isset($Grant_priv) && $Grant_priv == 'Y') {
928 $real_sql_query .= ' GRANT OPTION';
929 $sql_query .= ' GRANT OPTION';
930 }
931 if (isset($max_questions)) {
932 // avoid negative values
933 $max_questions = max(0, (int)$max_questions);
934 $real_sql_query .= ' MAX_QUERIES_PER_HOUR ' . $max_questions;
935 $sql_query .= ' MAX_QUERIES_PER_HOUR ' . $max_questions;
936 }
937 if (isset($max_connections)) {
938 $max_connections = max(0, (int)$max_connections);
939 $real_sql_query .= ' MAX_CONNECTIONS_PER_HOUR ' . $max_connections;
940 $sql_query .= ' MAX_CONNECTIONS_PER_HOUR ' . $max_connections;
941 }
942 if (isset($max_updates)) {
943 $max_updates = max(0, (int)$max_updates);
944 $real_sql_query .= ' MAX_UPDATES_PER_HOUR ' . $max_updates;
945 $sql_query .= ' MAX_UPDATES_PER_HOUR ' . $max_updates;
946 }
947 if (isset($max_user_connections)) {
948 $max_user_connections = max(0, (int)$max_user_connections);
949 $real_sql_query .= ' MAX_USER_CONNECTIONS ' . $max_user_connections;
950 $sql_query .= ' MAX_USER_CONNECTIONS ' . $max_user_connections;
951 }
952 }
953 if (isset($create_user_real)) {
954 $create_user_real .= ';';
955 $create_user_show .= ';';
956 }
957 $real_sql_query .= ';';
958 $sql_query .= ';';
959 if (empty($_REQUEST['change_copy'])) {
960 $_error = false;
961
962 if (isset($create_user_real)) {
963 if (! PMA_DBI_try_query($create_user_real)) {
964 $_error = true;
965 }
966 $sql_query = $create_user_show . $sql_query;
967 }
968
969 if ($_error || ! PMA_DBI_try_query($real_sql_query)) {
970 $_REQUEST['createdb'] = false;
971 $message = PMA_Message::rawError(PMA_DBI_getError());
972 } else {
973 $message = PMA_Message::success(__('You have added a new user.'));
974 }
975
976 switch (PMA_ifSetOr($_REQUEST['createdb'], '0')) {
977 case '1' :
978 // Create database with same name and grant all privileges
979 $q = 'CREATE DATABASE IF NOT EXISTS '
980 . PMA_backquote(PMA_sqlAddslashes($username)) . ';';
981 $sql_query .= $q;
982 if (! PMA_DBI_try_query($q)) {
983 $message = PMA_Message::rawError(PMA_DBI_getError());
984 break;
985 }
986
987
988 /**
989 * If we are not in an Ajax request, we can't reload navigation now
990 */
991 if($GLOBALS['is_ajax_request'] != true) {
992 // this is needed in case tracking is on:
993 $GLOBALS['db'] = $username;
994 $GLOBALS['reload'] = TRUE;
995 PMA_reloadNavigation();
996 }
997
998 $q = 'GRANT ALL PRIVILEGES ON '
999 . PMA_backquote(PMA_sqlAddslashes($username)) . '.* TO \''
1000 . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
1001 $sql_query .= $q;
1002 if (! PMA_DBI_try_query($q)) {
1003 $message = PMA_Message::rawError(PMA_DBI_getError());
1004 }
1005 break;
1006 case '2' :
1007 // Grant all privileges on wildcard name (username\_%)
1008 $q = 'GRANT ALL PRIVILEGES ON '
1009 . PMA_backquote(PMA_sqlAddslashes($username) . '\_%') . '.* TO \''
1010 . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
1011 $sql_query .= $q;
1012 if (! PMA_DBI_try_query($q)) {
1013 $message = PMA_Message::rawError(PMA_DBI_getError());
1014 }
1015 break;
1016 case '3' :
1017 // Grant all privileges on the specified database to the new user
1018 $q = 'GRANT ALL PRIVILEGES ON '
1019 . PMA_backquote(PMA_sqlAddslashes($dbname)) . '.* TO \''
1020 . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
1021 $sql_query .= $q;
1022 if (! PMA_DBI_try_query($q)) {
1023 $message = PMA_Message::rawError(PMA_DBI_getError());
1024 }
1025 break;
1026 case '0' :
1027 default :
1028 break;
1029 }
1030 } else {
1031 if (isset($create_user_real)) {
1032 $queries[] = $create_user_real;
1033 }
1034 $queries[] = $real_sql_query;
1035 // we put the query containing the hidden password in
1036 // $queries_for_display, at the same position occupied
1037 // by the real query in $queries
1038 $tmp_count = count($queries);
1039 if (isset($create_user_real)) {
1040 $queries_for_display[$tmp_count - 2] = $create_user_show;
1041 }
1042 $queries_for_display[$tmp_count - 1] = $sql_query;
1043 }
1044 unset($res, $real_sql_query);
1045 }
1046 }
1047
1048
1049 /**
1050 * Changes / copies a user, part III
1051 */
1052 if (isset($_REQUEST['change_copy'])) {
1053 $user_host_condition =
1054 ' WHERE `User`'
1055 .' = \'' . PMA_sqlAddslashes($old_username) . "'"
1056 .' AND `Host`'
1057 .' = \'' . PMA_sqlAddslashes($old_hostname) . '\';';
1058 $res = PMA_DBI_query('SELECT * FROM `mysql`.`db`' . $user_host_condition);
1059 while ($row = PMA_DBI_fetch_assoc($res)) {
1060 $queries[] =
1061 'GRANT ' . join(', ', PMA_extractPrivInfo($row))
1062 .' ON ' . PMA_backquote($row['Db']) . '.*'
1063 .' TO \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\''
1064 . ($row['Grant_priv'] == 'Y' ? ' WITH GRANT OPTION;' : ';');
1065 }
1066 PMA_DBI_free_result($res);
1067 $res = PMA_DBI_query(
1068 'SELECT `Db`, `Table_name`, `Table_priv`'
1069 .' FROM `mysql`.`tables_priv`' . $user_host_condition,
1070 $GLOBALS['userlink'], PMA_DBI_QUERY_STORE);
1071 while ($row = PMA_DBI_fetch_assoc($res)) {
1072
1073 $res2 = PMA_DBI_QUERY(
1074 'SELECT `Column_name`, `Column_priv`'
1075 .' FROM `mysql`.`columns_priv`'
1076 .' WHERE `User`'
1077 .' = \'' . PMA_sqlAddslashes($old_username) . "'"
1078 .' AND `Host`'
1079 .' = \'' . PMA_sqlAddslashes($old_hostname) . '\''
1080 .' AND `Db`'
1081 .' = \'' . PMA_sqlAddslashes($row['Db']) . "'"
1082 .' AND `Table_name`'
1083 .' = \'' . PMA_sqlAddslashes($row['Table_name']) . "'"
1084 .';',
1085 null, PMA_DBI_QUERY_STORE);
1086
1087 $tmp_privs1 = PMA_extractPrivInfo($row);
1088 $tmp_privs2 = array(
1089 'Select' => array(),
1090 'Insert' => array(),
1091 'Update' => array(),
1092 'References' => array()
1093 );
1094
1095 while ($row2 = PMA_DBI_fetch_assoc($res2)) {
1096 $tmp_array = explode(',', $row2['Column_priv']);
1097 if (in_array('Select', $tmp_array)) {
1098 $tmp_privs2['Select'][] = $row2['Column_name'];
1099 }
1100 if (in_array('Insert', $tmp_array)) {
1101 $tmp_privs2['Insert'][] = $row2['Column_name'];
1102 }
1103 if (in_array('Update', $tmp_array)) {
1104 $tmp_privs2['Update'][] = $row2['Column_name'];
1105 }
1106 if (in_array('References', $tmp_array)) {
1107 $tmp_privs2['References'][] = $row2['Column_name'];
1108 }
1109 unset($tmp_array);
1110 }
1111 if (count($tmp_privs2['Select']) > 0 && !in_array('SELECT', $tmp_privs1)) {
1112 $tmp_privs1[] = 'SELECT (`' . join('`, `', $tmp_privs2['Select']) . '`)';
1113 }
1114 if (count($tmp_privs2['Insert']) > 0 && !in_array('INSERT', $tmp_privs1)) {
1115 $tmp_privs1[] = 'INSERT (`' . join('`, `', $tmp_privs2['Insert']) . '`)';
1116 }
1117 if (count($tmp_privs2['Update']) > 0 && !in_array('UPDATE', $tmp_privs1)) {
1118 $tmp_privs1[] = 'UPDATE (`' . join('`, `', $tmp_privs2['Update']) . '`)';
1119 }
1120 if (count($tmp_privs2['References']) > 0 && !in_array('REFERENCES', $tmp_privs1)) {
1121 $tmp_privs1[] = 'REFERENCES (`' . join('`, `', $tmp_privs2['References']) . '`)';
1122 }
1123 unset($tmp_privs2);
1124 $queries[] =
1125 'GRANT ' . join(', ', $tmp_privs1)
1126 . ' ON ' . PMA_backquote($row['Db']) . '.' . PMA_backquote($row['Table_name'])
1127 . ' TO \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\''
1128 . (in_array('Grant', explode(',', $row['Table_priv'])) ? ' WITH GRANT OPTION;' : ';');
1129 }
1130 }
1131
1132
1133 /**
1134 * Updates privileges
1135 */
1136 if (!empty($update_privs)) {
1137 $db_and_table = PMA_WildcardEscapeForGrant($db_and_table, $dbname, (isset($tablename) ? $tablename : ''));
1138
1139 $sql_query0 =
1140 'REVOKE ALL PRIVILEGES ON ' . $db_and_table
1141 . ' FROM \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
1142 if (!isset($Grant_priv) || $Grant_priv != 'Y') {
1143 $sql_query1 =
1144 'REVOKE GRANT OPTION ON ' . $db_and_table
1145 . ' FROM \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
1146 } else {
1147 $sql_query1 = '';
1148 }
1149
1150 // Should not do a GRANT USAGE for a table-specific privilege, it
1151 // causes problems later (cannot revoke it)
1152 if (! (isset($tablename) && 'USAGE' == implode('', PMA_extractPrivInfo()))) {
1153 $sql_query2 =
1154 'GRANT ' . join(', ', PMA_extractPrivInfo())
1155 . ' ON ' . $db_and_table
1156 . ' TO \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\'';
1157
1158 /**
1159 * @todo similar code appears twice in this script
1160 */
1161 if ((isset($Grant_priv) && $Grant_priv == 'Y')
1162 || (! isset($dbname)
1163 && (isset($max_questions) || isset($max_connections)
1164 || isset($max_updates) || isset($max_user_connections))))
1165 {
1166 $sql_query2 .= 'WITH';
1167 if (isset($Grant_priv) && $Grant_priv == 'Y') {
1168 $sql_query2 .= ' GRANT OPTION';
1169 }
1170 if (isset($max_questions)) {
1171 $max_questions = max(0, (int)$max_questions);
1172 $sql_query2 .= ' MAX_QUERIES_PER_HOUR ' . $max_questions;
1173 }
1174 if (isset($max_connections)) {
1175 $max_connections = max(0, (int)$max_connections);
1176 $sql_query2 .= ' MAX_CONNECTIONS_PER_HOUR ' . $max_connections;
1177 }
1178 if (isset($max_updates)) {
1179 $max_updates = max(0, (int)$max_updates);
1180 $sql_query2 .= ' MAX_UPDATES_PER_HOUR ' . $max_updates;
1181 }
1182 if (isset($max_user_connections)) {
1183 $max_user_connections = max(0, (int)$max_user_connections);
1184 $sql_query2 .= ' MAX_USER_CONNECTIONS ' . $max_user_connections;
1185 }
1186 }
1187 $sql_query2 .= ';';
1188 }
1189 if (! PMA_DBI_try_query($sql_query0)) {
1190 // this query may fail, but this does not matter :o)
1191 $sql_query0 = '';
1192 }
1193 if (isset($sql_query1) && !PMA_DBI_try_query($sql_query1)) {
1194 // this one may fail, too...
1195 $sql_query1 = '';
1196 }
1197 if (isset($sql_query2)) {
1198 PMA_DBI_query($sql_query2);
1199 } else {
1200 $sql_query2 = '';
1201 }
1202 $sql_query = $sql_query0 . ' ' . $sql_query1 . ' ' . $sql_query2;
1203 $message = PMA_Message::success(__('You have updated the privileges for %s.'));
1204 $message->addParam('\'' . htmlspecialchars($username) . '\'@\'' . htmlspecialchars($hostname) . '\'');
1205 }
1206
1207
1208 /**
1209 * Revokes Privileges
1210 */
1211 if (isset($_REQUEST['revokeall'])) {
1212 $db_and_table = PMA_WildcardEscapeForGrant($db_and_table, $dbname, isset($tablename) ? $tablename : '');
1213
1214 $sql_query0 =
1215 'REVOKE ALL PRIVILEGES ON ' . $db_and_table
1216 . ' FROM \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
1217 $sql_query1 =
1218 'REVOKE GRANT OPTION ON ' . $db_and_table
1219 . ' FROM \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
1220
1221 PMA_DBI_query($sql_query0);
1222 if (! PMA_DBI_try_query($sql_query1)) {
1223 // this one may fail, too...
1224 $sql_query1 = '';
1225 }
1226 $sql_query = $sql_query0 . ' ' . $sql_query1;
1227 $message = PMA_Message::success(__('You have revoked the privileges for %s'));
1228 $message->addParam('\'' . htmlspecialchars($username) . '\'@\'' . htmlspecialchars($hostname) . '\'');
1229 if (! isset($tablename)) {
1230 unset($dbname);
1231 } else {
1232 unset($tablename);
1233 }
1234 }
1235
1236
1237 /**
1238 * Updates the password
1239 */
1240 if (isset($_REQUEST['change_pw'])) {
1241 // similar logic in user_password.php
1242 $message = '';
1243
1244 if ($nopass == 0 && isset($pma_pw) && isset($pma_pw2)) {
1245 if ($pma_pw != $pma_pw2) {
1246 $message = PMA_Message::error(__('The passwords aren\'t the same!'));
1247 } elseif (empty($pma_pw) || empty($pma_pw2)) {
1248 $message = PMA_Message::error(__('The password is empty!'));
1249 }
1250 } // end if
1251
1252 // here $nopass could be == 1
1253 if (empty($message)) {
1254
1255 $hashing_function = (!empty($pw_hash) && $pw_hash == 'old' ? 'OLD_' : '')
1256 . 'PASSWORD';
1257
1258 // in $sql_query which will be displayed, hide the password
1259 $sql_query = 'SET PASSWORD FOR \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\' = ' . (($pma_pw == '') ? '\'\'' : $hashing_function . '(\'' . preg_replace('@.@s', '*', $pma_pw) . '\')');
1260 $local_query = 'SET PASSWORD FOR \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\' = ' . (($pma_pw == '') ? '\'\'' : $hashing_function . '(\'' . PMA_sqlAddslashes($pma_pw) . '\')');
1261 PMA_DBI_try_query($local_query)
1262 or PMA_mysqlDie(PMA_DBI_getError(), $sql_query, FALSE, $err_url);
1263 $message = PMA_Message::success(__('The password for %s was changed successfully.'));
1264 $message->addParam('\'' . htmlspecialchars($username) . '\'@\'' . htmlspecialchars($hostname) . '\'');
1265 }
1266 }
1267
1268
1269 /**
1270 * Deletes users
1271 * (Changes / copies a user, part IV)
1272 */
1273
1274 if (isset($_REQUEST['delete']) || (isset($_REQUEST['change_copy']) && $_REQUEST['mode'] < 4)) {
1275 if (isset($_REQUEST['change_copy'])) {
1276 $selected_usr = array($old_username . '&amp;#27;' . $old_hostname);
1277 } else {
1278 $selected_usr = $_REQUEST['selected_usr'];
1279 $queries = array();
1280 }
1281 foreach ($selected_usr as $each_user) {
1282 list($this_user, $this_host) = explode('&amp;#27;', $each_user);
1283 $queries[] = '# ' . sprintf(__('Deleting %s'), '\'' . $this_user . '\'@\'' . $this_host . '\'') . ' ...';
1284 $queries[] = 'DROP USER \'' . PMA_sqlAddslashes($this_user) . '\'@\'' . PMA_sqlAddslashes($this_host) . '\';';
1285
1286 if (isset($_REQUEST['drop_users_db'])) {
1287 $queries[] = 'DROP DATABASE IF EXISTS ' . PMA_backquote($this_user) . ';';
1288 $GLOBALS['reload'] = TRUE;
1289
1290 if($GLOBALS['is_ajax_request'] != true) {
1291 PMA_reloadNavigation();
1292 }
1293 }
1294 }
1295 if (empty($_REQUEST['change_copy'])) {
1296 if (empty($queries)) {
1297 $message = PMA_Message::error(__('No users selected for deleting!'));
1298 } else {
1299 if ($_REQUEST['mode'] == 3) {
1300 $queries[] = '# ' . __('Reloading the privileges') . ' ...';
1301 $queries[] = 'FLUSH PRIVILEGES;';
1302 }
1303 $drop_user_error = '';
1304 foreach ($queries as $sql_query) {
1305 if ($sql_query{0} != '#') {
1306 if (! PMA_DBI_try_query($sql_query, $GLOBALS['userlink'])) {
1307 $drop_user_error .= PMA_DBI_getError() . "\n";
1308 }
1309 }
1310 }
1311 // tracking sets this, causing the deleted db to be shown in navi
1312 unset($GLOBALS['db']);
1313
1314 $sql_query = join("\n", $queries);
1315 if (! empty($drop_user_error)) {
1316 $message = PMA_Message::rawError($drop_user_error);
1317 } else {
1318 $message = PMA_Message::success(__('The selected users have been deleted successfully.'));
1319 }
1320 }
1321 unset($queries);
1322 }
1323 }
1324
1325
1326 /**
1327 * Changes / copies a user, part V
1328 */
1329 if (isset($_REQUEST['change_copy'])) {
1330 $tmp_count = 0;
1331 foreach ($queries as $sql_query) {
1332 if ($sql_query{0} != '#') {
1333 PMA_DBI_query($sql_query);
1334 }
1335 // when there is a query containing a hidden password, take it
1336 // instead of the real query sent
1337 if (isset($queries_for_display[$tmp_count])) {
1338 $queries[$tmp_count] = $queries_for_display[$tmp_count];
1339 }
1340 $tmp_count++;
1341 }
1342 $message = PMA_Message::success();
1343 $sql_query = join("\n", $queries);
1344 }
1345
1346
1347 /**
1348 * Reloads the privilege tables into memory
1349 */
1350 if (isset($_REQUEST['flush_privileges'])) {
1351 $sql_query = 'FLUSH PRIVILEGES;';
1352 PMA_DBI_query($sql_query);
1353 $message = PMA_Message::success(__('The privileges were reloaded successfully.'));
1354 }
1355
1356 /**
1357 * defines some standard links
1358 */
1359 $link_edit = '<a class="edit_user_anchor ' . $conditional_class . '" href="server_privileges.php?' . $GLOBALS['url_query']
1360 . '&amp;username=%s'
1361 . '&amp;hostname=%s'
1362 . '&amp;dbname=%s'
1363 . '&amp;tablename=%s">'
1364 . PMA_getIcon('b_usredit.png', __('Edit Privileges'))
1365 . '</a>';
1366
1367 $link_revoke = '<a href="server_privileges.php?' . $GLOBALS['url_query']
1368 . '&amp;username=%s'
1369 . '&amp;hostname=%s'
1370 . '&amp;dbname=%s'
1371 . '&amp;tablename=%s'
1372 . '&amp;revokeall=1">'
1373 . PMA_getIcon('b_usrdrop.png', __('Revoke'))
1374 . '</a>';
1375
1376 $link_export = '<a class="export_user_anchor ' . $conditional_class . '" href="server_privileges.php?' . $GLOBALS['url_query']
1377 . '&amp;username=%s'
1378 . '&amp;hostname=%s'
1379 . '&amp;initial=%s'
1380 . '&amp;export=1">'
1381 . PMA_getIcon('b_tblexport.png', __('Export'))
1382 . '</a>';
1383
1384 /**
1385 * If we are in an Ajax request for Create User/Edit User/Revoke User/Flush Privileges,
1386 * show $message and exit.
1387 */
1388 if( $GLOBALS['is_ajax_request'] && !isset($_REQUEST['export']) && !isset($_REQUEST['adduser']) && !isset($_REQUEST['initial']) && !isset($_REQUEST['showall']) && !isset($_REQUEST['edit_user_dialog'])) {
1389
1390 if(isset($sql_query)) {
1391 $extra_data['sql_query'] = PMA_showMessage(NULL, $sql_query);
1392 }
1393
1394 if(isset($_REQUEST['adduser_submit']) || isset($_REQUEST['change_copy'])) {
1395 /**
1396 * generate html on the fly for the new user that was just created.
1397 */
1398 $new_user_string = '<tr>'."\n"
1399 .'<td> <input type="checkbox" name="selected_usr[]" id="checkbox_sel_users_" value="' . htmlspecialchars($username) . '&amp;#27;' . htmlspecialchars($hostname) . '" /> </td>'."\n"
1400 .'<td><label for="checkbox_sel_users_">' . (empty($username) ? '<span style="color: #FF0000">' . __('Any') . '</span>' : htmlspecialchars($username) ) . '</label></td>' . "\n"
1401 .'<td>' . htmlspecialchars($hostname) . '</td>' . "\n";
1402 $new_user_string .= '<td>';
1403
1404 if(!empty($password) || isset($pma_pw)) {
1405 $new_user_string .= __('Yes');
1406 }
1407 else {
1408 $new_user_string .= '<span style="color: #FF0000">' . __('No') . '</span>';
1409 };
1410
1411 $new_user_string .= '</td>'."\n";
1412 $new_user_string .= '<td><tt>' . join(', ', PMA_extractPrivInfo('', true)) . '</tt></td>'; //Fill in privileges here
1413 $new_user_string .= '<td>';
1414
1415 if((isset($Grant_priv) && $Grant_priv == 'Y')) {
1416 $new_user_string .= __('Yes');
1417 }
1418 else {
1419 $new_user_string .= __('No');
1420 }
1421
1422 $new_user_string .='</td>';
1423
1424 $new_user_string .= '<td>'.sprintf($link_edit, urlencode($username), urlencode($hostname), '', '' ).'</td>'."\n";
1425 $new_user_string .= '<td>'.sprintf($link_export, urlencode($username), urlencode($hostname), (isset($initial) ? $initial : '')).'</td>'."\n";
1426
1427 $new_user_string .= '</tr>';
1428
1429 $extra_data['new_user_string'] = $new_user_string;
1430
1431 /**
1432 * Generate the string for this alphabet's initial, to update the user
1433 * pagination
1434 */
1435 $new_user_initial = strtoupper(substr($username, 0, 1));
1436 $new_user_initial_string = '<a href="server_privileges.php?' . $GLOBALS['url_query'] . '&initial=' . $new_user_initial
1437 .'">' . $new_user_initial . '</a>';
1438 $extra_data['new_user_initial'] = $new_user_initial;
1439 $extra_data['new_user_initial_string'] = $new_user_initial_string;
1440 }
1441
1442 if(isset($update_privs)) {
1443 $new_privileges = join(', ', PMA_extractPrivInfo('', true));
1444
1445 $extra_data['new_privileges'] = $new_privileges;
1446 }
1447
1448 PMA_ajaxResponse($message, $message->isSuccess(), $extra_data);
1449 }
1450
1451 /**
1452 * Displays the links
1453 */
1454 if (isset($viewing_mode) && $viewing_mode == 'db') {
1455 $db = $checkprivs;
1456 $url_query .= '&amp;goto=db_operations.php';
1457
1458 // Gets the database structure
1459 $sub_part = '_structure';
1460 require './libraries/db_info.inc.php';
1461 echo "\n";
1462 } else {
1463 require './libraries/server_links.inc.php';
1464 }
1465
1466
1467 /**
1468 * Displays the page
1469 */
1470
1471 // export user definition
1472 if (isset($_REQUEST['export'])) {
1473 echo '<h2>' . __('User') . ' \'' . htmlspecialchars($username) . '\'@\'' . htmlspecialchars($hostname) . '\'</h2>';
1474 echo '<textarea cols="' . $GLOBALS['cfg']['TextareaCols'] . '" rows="' . $GLOBALS['cfg']['TextareaRows'] . '">';
1475 $grants = PMA_DBI_fetch_result("SHOW GRANTS FOR '" . PMA_sqlAddslashes($username) . "'@'" . PMA_sqlAddslashes($hostname) . "'");
1476 foreach($grants as $one_grant) {
1477 echo $one_grant . ";\n\n";
1478 }
1479 echo '</textarea>';
1480 unset($username, $hostname, $grants, $one_grant);
1481 if( $GLOBALS['is_ajax_request']) {
1482 exit;
1483 }
1484 }
1485
1486 if (empty($_REQUEST['adduser']) && (! isset($checkprivs) || ! strlen($checkprivs))) {
1487 if (! isset($username)) {
1488 // No username is given --> display the overview
1489 echo '<h2>' . "\n"
1490 . PMA_getIcon('b_usrlist.png')
1491 . __('User overview') . "\n"
1492 . '</h2>' . "\n";
1493
1494 $sql_query =
1495 'SELECT *,' .
1496 " IF(`Password` = _latin1 '', 'N', 'Y') AS 'Password'" .
1497 ' FROM `mysql`.`user`';
1498
1499 $sql_query .= (isset($initial) ? PMA_RangeOfUsers($initial) : '');
1500
1501 $sql_query .= ' ORDER BY `User` ASC, `Host` ASC;';
1502 $res = PMA_DBI_try_query($sql_query, null, PMA_DBI_QUERY_STORE);
1503
1504 if (! $res) {
1505 // the query failed! This may have two reasons:
1506 // - the user does not have enough privileges
1507 // - the privilege tables use a structure of an earlier version.
1508 // so let's try a more simple query
1509
1510 $sql_query = 'SELECT * FROM `mysql`.`user`';
1511 $res = PMA_DBI_try_query($sql_query, null, PMA_DBI_QUERY_STORE);
1512
1513 if (!$res) {
1514 PMA_Message::error(__('No Privileges'))->display();
1515 PMA_DBI_free_result($res);
1516 unset($res);
1517 } else {
1518 // This message is hardcoded because I will replace it by
1519 // a automatic repair feature soon.
1520 $raw = 'Your privilege table structure seems to be older than'
1521 . ' this MySQL version!<br />'
1522 . 'Please run the <tt>mysql_upgrade</tt> command'
1523 . '(<tt>mysql_fix_privilege_tables</tt> on older systems)'
1524 . ' that should be included in your MySQL server distribution'
1525 . ' to solve this problem!';
1526 PMA_Message::rawError($raw)->display();
1527 }
1528 } else {
1529
1530 // we also want users not in table `user` but in other table
1531 $tables = PMA_DBI_fetch_result('SHOW TABLES FROM `mysql`;');
1532
1533 $tables_to_search_for_users = array(
1534 'user', 'db', 'tables_priv', 'columns_priv', 'procs_priv',
1535 );
1536
1537 $db_rights_sqls = array();
1538 foreach ($tables_to_search_for_users as $table_search_in) {
1539 if (in_array($table_search_in, $tables)) {
1540 $db_rights_sqls[] = 'SELECT DISTINCT `User`, `Host` FROM `mysql`.`' . $table_search_in . '` ' . (isset($initial) ? PMA_RangeOfUsers($initial) : '');
1541 }
1542 }
1543
1544 $user_defaults = array(
1545 'User' => '',
1546 'Host' => '%',
1547 'Password' => '?',
1548 'Grant_priv' => 'N',
1549 'privs' => array('USAGE'),
1550 );
1551
1552 // for all initials, even non A-Z
1553 $array_initials = array();
1554 // for the rights
1555 $db_rights = array();
1556
1557 $db_rights_sql = '(' . implode(') UNION (', $db_rights_sqls) . ')'
1558 .' ORDER BY `User` ASC, `Host` ASC';
1559
1560 $db_rights_result = PMA_DBI_query($db_rights_sql);
1561
1562 while ($db_rights_row = PMA_DBI_fetch_assoc($db_rights_result)) {
1563 $db_rights_row = array_merge($user_defaults, $db_rights_row);
1564 $db_rights[$db_rights_row['User']][$db_rights_row['Host']] =
1565 $db_rights_row;
1566 }
1567 PMA_DBI_free_result($db_rights_result);
1568 unset($db_rights_sql, $db_rights_sqls, $db_rights_result, $db_rights_row);
1569 ksort($db_rights);
1570
1571 /**
1572 * Displays the initials
1573 * In an Ajax request, we don't need to show this
1574 */
1575
1576 if( $GLOBALS['is_ajax_request'] != true ) {
1577
1578 // initialize to FALSE the letters A-Z
1579 for ($letter_counter = 1; $letter_counter < 27; $letter_counter++) {
1580 if (! isset($array_initials[chr($letter_counter + 64)])) {
1581 $array_initials[chr($letter_counter + 64)] = FALSE;
1582 }
1583 }
1584
1585 $initials = PMA_DBI_try_query('SELECT DISTINCT UPPER(LEFT(`User`,1)) FROM `user` ORDER BY `User` ASC', null, PMA_DBI_QUERY_STORE);
1586 while (list($tmp_initial) = PMA_DBI_fetch_row($initials)) {
1587 $array_initials[$tmp_initial] = TRUE;
1588 }
1589
1590 // Display the initials, which can be any characters, not
1591 // just letters. For letters A-Z, we add the non-used letters
1592 // as greyed out.
1593
1594 uksort($array_initials, "strnatcasecmp");
1595
1596 echo '<table id="initials_table" class="' . $conditional_class . '" <cellspacing="5"><tr>';
1597 foreach ($array_initials as $tmp_initial => $initial_was_found) {
1598 if ($initial_was_found) {
1599 echo '<td><a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;initial=' . urlencode($tmp_initial) . '">' . $tmp_initial . '</a></td>' . "\n";
1600 } else {
1601 echo '<td>' . $tmp_initial . '</td>';
1602 }
1603 }
1604 echo '<td><a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;showall=1">[' . __('Show all') . ']</a></td>' . "\n";
1605 echo '</tr></table>';
1606 }
1607
1608 /**
1609 * Display the user overview
1610 * (if less than 50 users, display them immediately)
1611 */
1612
1613 if (isset($initial) || isset($showall) || PMA_DBI_num_rows($res) < 50) {
1614
1615 while ($row = PMA_DBI_fetch_assoc($res)) {
1616 $row['privs'] = PMA_extractPrivInfo($row, true);
1617 $db_rights[$row['User']][$row['Host']] = $row;
1618 }
1619 @PMA_DBI_free_result($res);
1620 unset($res);
1621
1622 echo '<form name="usersForm" id="usersForm" action="server_privileges.php" method="post">' . "\n"
1623 . PMA_generate_common_hidden_inputs('', '')
1624 . ' <table id="tableuserrights" class="data">' . "\n"
1625 . ' <thead>' . "\n"
1626 . ' <tr><th></th>' . "\n"
1627 . ' <th>' . __('User') . '</th>' . "\n"
1628 . ' <th>' . __('Host') . '</th>' . "\n"
1629 . ' <th>' . __('Password') . '</th>' . "\n"
1630 . ' <th>' . __('Global privileges') . ' '
1631 . PMA_showHint(__(' Note: MySQL privilege names are expressed in English ')) . '</th>' . "\n"
1632 . ' <th>' . __('Grant') . '</th>' . "\n"
1633 . ' <th colspan="2">' . __('Action') . '</th>' . "\n";
1634 echo ' </tr>' . "\n";
1635 echo ' </thead>' . "\n";
1636 echo ' <tbody>' . "\n";
1637 $odd_row = true;
1638 $index_checkbox = -1;
1639 foreach ($db_rights as $user) {
1640 $index_checkbox++;
1641 ksort($user);
1642 foreach ($user as $host) {
1643 $index_checkbox++;
1644 echo ' <tr class="' . ($odd_row ? 'odd' : 'even') . '">' . "\n"
1645 . ' <td><input type="checkbox" name="selected_usr[]" id="checkbox_sel_users_'
1646 . $index_checkbox . '" value="'
1647 . htmlspecialchars($host['User'] . '&amp;#27;' . $host['Host'])
1648 . '"'
1649 . (empty($GLOBALS['checkall']) ? '' : ' checked="checked"')
1650 . ' /></td>' . "\n"
1651 . ' <td><label for="checkbox_sel_users_' . $index_checkbox . '">' . (empty($host['User']) ? '<span style="color: #FF0000">' . __('Any') . '</span>' : htmlspecialchars($host['User'])) . '</label></td>' . "\n"
1652 . ' <td>' . htmlspecialchars($host['Host']) . '</td>' . "\n";
1653 echo ' <td>';
1654 switch ($host['Password']) {
1655 case 'Y':
1656 echo __('Yes');
1657 break;
1658 case 'N':
1659 echo '<span style="color: #FF0000">' . __('No') . '</span>';
1660 break;
1661 // this happens if this is a definition not coming from mysql.user
1662 default:
1663 echo '--'; // in future version, replace by "not present"
1664 break;
1665 } // end switch
1666 echo '</td>' . "\n"
1667 . ' <td><tt>' . "\n"
1668 . ' ' . implode(',' . "\n" . ' ', $host['privs']) . "\n"
1669 . ' </tt></td>' . "\n"
1670 . ' <td>' . ($host['Grant_priv'] == 'Y' ? __('Yes') : __('No')) . '</td>' . "\n"
1671 . ' <td align="center">';
1672 printf($link_edit, urlencode($host['User']), urlencode($host['Host']), '', '');
1673 echo '</td>';
1674 echo '<td align="center">';
1675 printf($link_export, urlencode($host['User']), urlencode($host['Host']), (isset($initial) ? $initial : ''));
1676 echo '</td>';
1677 echo '</tr>';
1678 $odd_row = ! $odd_row;
1679 }
1680 }
1681
1682 unset($user, $host, $odd_row);
1683 echo ' </tbody></table>' . "\n"
1684 .'<img class="selectallarrow"'
1685 .' src="' . $pmaThemeImage . 'arrow_' . $text_dir . '.png"'
1686 .' width="38" height="22"'
1687 .' alt="' . __('With selected:') . '" />' . "\n"
1688 .'<a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;checkall=1"'
1689 .' onclick="if (markAllRows(\'usersForm\')) return false;">'
1690 . __('Check All') . '</a>' . "\n"
1691 .'/' . "\n"
1692 .'<a href="server_privileges.php?' . $GLOBALS['url_query'] . '"'
1693 .' onclick="if (unMarkAllRows(\'usersForm\')) return false;">'
1694 . __('Uncheck All') . '</a>' . "\n";
1695
1696 // add/delete user fieldset
1697 echo ' <fieldset id="fieldset_add_user">' . "\n"
1698 . ' <a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;adduser=1" class="' . $conditional_class . '">' . "\n"
1699 . PMA_getIcon('b_usradd.png')
1700 . ' ' . __('Add a new User') . '</a>' . "\n"
1701 . ' </fieldset>' . "\n"
1702 . ' <fieldset id="fieldset_delete_user">'
1703 . ' <legend>' . "\n"
1704 . PMA_getIcon('b_usrdrop.png')
1705 . ' ' . __('Remove selected users') . '' . "\n"
1706 . ' </legend>' . "\n"
1707 . ' <input type="hidden" name="mode" value="2" />' . "\n"
1708 . '(' . __('Revoke all active privileges from the users and delete them afterwards.') . ')<br />' . "\n"
1709 . ' <input type="checkbox" title="' . __('Drop the databases that have the same names as the users.') . '" name="drop_users_db" id="checkbox_drop_users_db" />' . "\n"
1710 . ' <label for="checkbox_drop_users_db" title="' . __('Drop the databases that have the same names as the users.') . '">' . "\n"
1711 . ' ' . __('Drop the databases that have the same names as the users.') . "\n"
1712 . ' </label>' . "\n"
1713 . ' </fieldset>' . "\n"
1714 . ' <fieldset id="fieldset_delete_user_footer" class="tblFooters">' . "\n"
1715 . ' <input type="submit" name="delete" value="' . __('Go') . '" id="buttonGo" class="' . $conditional_class . '"/>' . "\n"
1716 . ' </fieldset>' . "\n"
1717 . '</form>' . "\n";
1718 } else {
1719
1720 unset ($row);
1721 echo ' <fieldset id="fieldset_add_user">' . "\n"
1722 . ' <a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;adduser=1">' . "\n"
1723 . PMA_getIcon('b_usradd.png')
1724 . ' ' . __('Add a new User') . '</a>' . "\n"
1725 . ' </fieldset>' . "\n";
1726 } // end if (display overview)
1727
1728 if( $GLOBALS['is_ajax_request'] ) {
1729 exit;
1730 }
1731
1732 $flushnote = new PMA_Message(__('Note: phpMyAdmin gets the users\' privileges directly from MySQL\'s privilege tables. The content of these tables may differ from the privileges the server uses, if they have been changed manually. In this case, you should %sreload the privileges%s before you continue.'), PMA_Message::NOTICE);
1733 $flushnote->addParam('<a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;flush_privileges=1" id="reload_privileges_anchor" class="' . $conditional_class . '">', false);
1734 $flushnote->addParam('</a>', false);
1735 $flushnote->display();
1736 }
1737
1738
1739 } else {
1740
1741 // A user was selected -> display the user's properties
1742
1743 // In an Ajax request, prevent cached values from showing
1744 if($GLOBALS['is_ajax_request'] == true) {
1745 header('Cache-Control: no-cache');
1746 }
1747
1748 echo '<h2>' . "\n"
1749 . PMA_getIcon('b_usredit.png')
1750 . __('Edit Privileges') . ': '
1751 . __('User') ;
1752
1753 if (isset($dbname)) {
1754 echo ' <i><a href="server_privileges.php?'
1755 . $GLOBALS['url_query'] . '&amp;username=' . htmlspecialchars(urlencode($username))
1756 . '&amp;hostname=' . htmlspecialchars(urlencode($hostname)) . '&amp;dbname=&amp;tablename=">\''
1757 . htmlspecialchars($username) . '\'@\'' . htmlspecialchars($hostname)
1758 . '\'</a></i>' . "\n";
1759 $url_dbname = urlencode(str_replace(array('\_', '\%'), array('_', '%'), $dbname));
1760
1761 echo ' - ' . ($dbname_is_wildcard ? __('Databases') : __('Database') );
1762 if (isset($tablename)) {
1763 echo ' <i><a href="server_privileges.php?' . $GLOBALS['url_query']
1764 . '&amp;username=' . htmlspecialchars(urlencode($username)) . '&amp;hostname=' . htmlspecialchars(urlencode($hostname))
1765 . '&amp;dbname=' . htmlspecialchars($url_dbname) . '&amp;tablename=">' . htmlspecialchars($dbname) . '</a></i>';
1766 echo ' - ' . __('Table') . ' <i>' . htmlspecialchars($tablename) . '</i>';
1767 } else {
1768 echo ' <i>' . htmlspecialchars($dbname) . '</i>';
1769 }
1770
1771 } else {
1772 echo ' <i>\'' . htmlspecialchars($username) . '\'@\'' . htmlspecialchars($hostname)
1773 . '\'</i>' . "\n";
1774
1775 }
1776 echo '</h2>' . "\n";
1777
1778
1779 $sql = "SELECT '1' FROM `mysql`.`user`"
1780 . " WHERE `User` = '" . PMA_sqlAddslashes($username) . "'"
1781 . " AND `Host` = '" . PMA_sqlAddslashes($hostname) . "';";
1782 $user_does_not_exists = (bool) ! PMA_DBI_fetch_value($sql);
1783 unset($sql);
1784 if ($user_does_not_exists) {
1785 PMA_Message::warning(__('The selected user was not found in the privilege table.'))->display();
1786 PMA_displayLoginInformationFields();
1787 //require './libraries/footer.inc.php';
1788 }
1789
1790 echo '<form name="usersForm" id="addUsersForm_' . $random_n . '" action="server_privileges.php" method="post">' . "\n";
1791 $_params = array(
1792 'username' => $username,
1793 'hostname' => $hostname,
1794 );
1795 if (isset($dbname)) {
1796 $_params['dbname'] = $dbname;
1797 if (isset($tablename)) {
1798 $_params['tablename'] = $tablename;
1799 }
1800 }
1801 echo PMA_generate_common_hidden_inputs($_params);
1802
1803 PMA_displayPrivTable(PMA_ifSetOr($dbname, '*', 'length'),
1804 PMA_ifSetOr($tablename, '*', 'length'));
1805
1806 echo '</form>' . "\n";
1807
1808 if (! isset($tablename) && empty($dbname_is_wildcard)) {
1809
1810 // no table name was given, display all table specific rights
1811 // but only if $dbname contains no wildcards
1812
1813 // table header
1814 echo '<form action="server_privileges.php" method="post">' . "\n"
1815 . PMA_generate_common_hidden_inputs('', '')
1816 . '<input type="hidden" name="username" value="' . htmlspecialchars($username) . '" />' . "\n"
1817 . '<input type="hidden" name="hostname" value="' . htmlspecialchars($hostname) . '" />' . "\n"
1818 . '<fieldset>' . "\n"
1819 . '<legend>' . (! isset($dbname) ? __('Database-specific privileges') : __('Table-specific privileges')) . '</legend>' . "\n"
1820 . '<table class="data">' . "\n"
1821 . '<thead>' . "\n"
1822 . '<tr><th>' . (! isset($dbname) ? __('Database') : __('Table')) . '</th>' . "\n"
1823 . ' <th>' . __('Privileges') . '</th>' . "\n"
1824 . ' <th>' . __('Grant') . '</th>' . "\n"
1825 . ' <th>' . (! isset($dbname) ? __('Table-specific privileges') : __('Column-specific privileges')) . '</th>' . "\n"
1826 . ' <th colspan="2">' . __('Action') . '</th>' . "\n"
1827 . '</tr>' . "\n"
1828 . '</thead>' . "\n"
1829 . '<tbody>' . "\n";
1830
1831 $user_host_condition =
1832 ' WHERE `User`'
1833 . ' = \'' . PMA_sqlAddslashes($username) . "'"
1834 . ' AND `Host`'
1835 . ' = \'' . PMA_sqlAddslashes($hostname) . "'";
1836
1837 // table body
1838 // get data
1839
1840 // we also want privielgs for this user not in table `db` but in other table
1841 $tables = PMA_DBI_fetch_result('SHOW TABLES FROM `mysql`;');
1842 if (! isset($dbname)) {
1843
1844 // no db name given, so we want all privs for the given user
1845
1846 $tables_to_search_for_users = array(
1847 'tables_priv', 'columns_priv',
1848 );
1849
1850 $db_rights_sqls = array();
1851 foreach ($tables_to_search_for_users as $table_search_in) {
1852 if (in_array($table_search_in, $tables)) {
1853 $db_rights_sqls[] = '
1854 SELECT DISTINCT `Db`
1855 FROM `mysql`.' . PMA_backquote($table_search_in)
1856 . $user_host_condition;
1857 }
1858 }
1859
1860 $user_defaults = array(
1861 'Db' => '',
1862 'Grant_priv' => 'N',
1863 'privs' => array('USAGE'),
1864 'Table_privs' => true,
1865 );
1866
1867 // for the rights
1868 $db_rights = array();
1869
1870 $db_rights_sql = '(' . implode(') UNION (', $db_rights_sqls) . ')'
1871 .' ORDER BY `Db` ASC';
1872
1873 $db_rights_result = PMA_DBI_query($db_rights_sql);
1874
1875 while ($db_rights_row = PMA_DBI_fetch_assoc($db_rights_result)) {
1876 $db_rights_row = array_merge($user_defaults, $db_rights_row);
1877 // only Db names in the table `mysql`.`db` uses wildcards
1878 // as we are in the db specific rights display we want
1879 // all db names escaped, also from other sources
1880 $db_rights_row['Db'] = PMA_escape_mysql_wildcards(
1881 $db_rights_row['Db']);
1882 $db_rights[$db_rights_row['Db']] = $db_rights_row;
1883 }
1884
1885 PMA_DBI_free_result($db_rights_result);
1886 unset($db_rights_sql, $db_rights_sqls, $db_rights_result, $db_rights_row);
1887
1888 $sql_query = 'SELECT * FROM `mysql`.`db`' . $user_host_condition . ' ORDER BY `Db` ASC';
1889 $res = PMA_DBI_query($sql_query);
1890 $sql_query = '';
1891
1892 while ($row = PMA_DBI_fetch_assoc($res)) {
1893 if (isset($db_rights[$row['Db']])) {
1894 $db_rights[$row['Db']] = array_merge($db_rights[$row['Db']], $row);
1895 } else {
1896 $db_rights[$row['Db']] = $row;
1897 }
1898 // there are db specific rights for this user
1899 // so we can drop this db rights
1900 $db_rights[$row['Db']]['can_delete'] = true;
1901 }
1902 PMA_DBI_free_result($res);
1903 unset($row, $res);
1904
1905 } else {
1906
1907 // db name was given,
1908 // so we want all user specific rights for this db
1909
1910 $user_host_condition .=
1911 ' AND `Db`'
1912 .' LIKE \'' . PMA_sqlAddslashes($dbname) . "'";
1913
1914 $tables_to_search_for_users = array(
1915 'columns_priv',
1916 );
1917
1918 $db_rights_sqls = array();
1919 foreach ($tables_to_search_for_users as $table_search_in) {
1920 if (in_array($table_search_in, $tables)) {
1921 $db_rights_sqls[] = '
1922 SELECT DISTINCT `Table_name`
1923 FROM `mysql`.' . PMA_backquote($table_search_in)
1924 . $user_host_condition;
1925 }
1926 }
1927
1928 $user_defaults = array(
1929 'Table_name' => '',
1930 'Grant_priv' => 'N',
1931 'privs' => array('USAGE'),
1932 'Column_priv' => true,
1933 );
1934
1935 // for the rights
1936 $db_rights = array();
1937
1938 $db_rights_sql = '(' . implode(') UNION (', $db_rights_sqls) . ')'
1939 .' ORDER BY `Table_name` ASC';
1940
1941 $db_rights_result = PMA_DBI_query($db_rights_sql);
1942
1943 while ($db_rights_row = PMA_DBI_fetch_assoc($db_rights_result)) {
1944 $db_rights_row = array_merge($user_defaults, $db_rights_row);
1945 $db_rights[$db_rights_row['Table_name']] = $db_rights_row;
1946 }
1947 PMA_DBI_free_result($db_rights_result);
1948 unset($db_rights_sql, $db_rights_sqls, $db_rights_result, $db_rights_row);
1949
1950 $sql_query =
1951 'SELECT `Table_name`,'
1952 .' `Table_priv`,'
1953 .' IF(`Column_priv` = _latin1 \'\', 0, 1)'
1954 .' AS \'Column_priv\''
1955 .' FROM `mysql`.`tables_priv`'
1956 . $user_host_condition
1957 .' ORDER BY `Table_name` ASC;';
1958 $res = PMA_DBI_query($sql_query);
1959 $sql_query = '';
1960
1961 while ($row = PMA_DBI_fetch_assoc($res)) {
1962 if (isset($db_rights[$row['Table_name']])) {
1963 $db_rights[$row['Table_name']] = array_merge($db_rights[$row['Table_name']], $row);
1964 } else {
1965 $db_rights[$row['Table_name']] = $row;
1966 }
1967 }
1968 PMA_DBI_free_result($res);
1969 unset($row, $res);
1970 }
1971 ksort($db_rights);
1972
1973 // display rows
1974 if (count($db_rights) < 1) {
1975 echo '<tr class="odd">' . "\n"
1976 . ' <td colspan="6"><center><i>' . __('None') . '</i></center></td>' . "\n"
1977 . '</tr>' . "\n";
1978 } else {
1979 $odd_row = true;
1980 $found_rows = array();
1981 //while ($row = PMA_DBI_fetch_assoc($res)) {
1982 foreach ($db_rights as $row) {
1983 $found_rows[] = (! isset($dbname)) ? $row['Db'] : $row['Table_name'];
1984
1985 echo '<tr class="' . ($odd_row ? 'odd' : 'even') . '">' . "\n"
1986 . ' <td>' . htmlspecialchars((! isset($dbname)) ? $row['Db'] : $row['Table_name']) . '</td>' . "\n"
1987 . ' <td><tt>' . "\n"
1988 . ' ' . join(',' . "\n" . ' ', PMA_extractPrivInfo($row, TRUE)) . "\n"
1989 . ' </tt></td>' . "\n"
1990 . ' <td>' . ((((! isset($dbname)) && $row['Grant_priv'] == 'Y') || (isset($dbname) && in_array('Grant', explode(',', $row['Table_priv'])))) ? __('Yes') : __('No')) . '</td>' . "\n"
1991 . ' <td>';
1992 if (! empty($row['Table_privs']) || ! empty ($row['Column_priv'])) {
1993 echo __('Yes');
1994 } else {
1995 echo __('No');
1996 }
1997 echo '</td>' . "\n"
1998 . ' <td>';
1999 printf($link_edit, htmlspecialchars(urlencode($username)),
2000 urlencode(htmlspecialchars($hostname)),
2001 urlencode((! isset($dbname)) ? $row['Db'] : htmlspecialchars($dbname)),
2002 urlencode((! isset($dbname)) ? '' : $row['Table_name']));
2003 echo '</td>' . "\n"
2004 . ' <td>';
2005 if (! empty($row['can_delete']) || isset($row['Table_name']) && strlen($row['Table_name'])) {
2006 printf($link_revoke, htmlspecialchars(urlencode($username)),
2007 urlencode(htmlspecialchars($hostname)),
2008 urlencode((! isset($dbname)) ? $row['Db'] : htmlspecialchars($dbname)),
2009 urlencode((! isset($dbname)) ? '' : $row['Table_name']));
2010 }
2011 echo '</td>' . "\n"
2012 . '</tr>' . "\n";
2013 $odd_row = ! $odd_row;
2014 } // end while
2015 }
2016 unset($row);
2017 echo '</tbody>' . "\n"
2018 . '</table>' . "\n";
2019
2020 if (! isset($dbname)) {
2021
2022 // no database name was given, display select db
2023
2024 $pred_db_array =PMA_DBI_fetch_result('SHOW DATABASES;');
2025
2026 echo ' <label for="text_dbname">' . __('Add privileges on the following database') . ':</label>' . "\n";
2027 if (!empty($pred_db_array)) {
2028 echo ' <select name="pred_dbname" onchange="this.form.submit();">' . "\n"
2029 . ' <option value="" selected="selected">' . __('Use text field') . ':</option>' . "\n";
2030 foreach ($pred_db_array as $current_db) {
2031 $current_db = PMA_escape_mysql_wildcards($current_db);
2032 // cannot use array_diff() once, outside of the loop,
2033 // because the list of databases has special characters
2034 // already escaped in $found_rows,
2035 // contrary to the output of SHOW DATABASES
2036 if (empty($found_rows) || ! in_array($current_db, $found_rows)) {
2037 echo ' <option value="' . htmlspecialchars($current_db) . '">'
2038 . htmlspecialchars($current_db) . '</option>' . "\n";
2039 }
2040 }
2041 echo ' </select>' . "\n";
2042 }
2043 echo ' <input type="text" id="text_dbname" name="dbname" />' . "\n"
2044 . PMA_showHint(__('Wildcards % and _ should be escaped with a \ to use them literally'));
2045 } else {
2046 echo ' <input type="hidden" name="dbname" value="' . htmlspecialchars($dbname) . '"/>' . "\n"
2047 . ' <label for="text_tablename">' . __('Add privileges on the following table') . ':</label>' . "\n";
2048 if ($res = @PMA_DBI_try_query('SHOW TABLES FROM ' . PMA_backquote(PMA_unescape_mysql_wildcards($dbname)) . ';', null, PMA_DBI_QUERY_STORE)) {
2049 $pred_tbl_array = array();
2050 while ($row = PMA_DBI_fetch_row($res)) {
2051 if (!isset($found_rows) || !in_array($row[0], $found_rows)) {
2052 $pred_tbl_array[] = $row[0];
2053 }
2054 }
2055 PMA_DBI_free_result($res);
2056 unset($res, $row);
2057 if (!empty($pred_tbl_array)) {
2058 echo ' <select name="pred_tablename" onchange="this.form.submit();">' . "\n"
2059 . ' <option value="" selected="selected">' . __('Use text field') . ':</option>' . "\n";
2060 foreach ($pred_tbl_array as $current_table) {
2061 echo ' <option value="' . htmlspecialchars($current_table) . '">' . htmlspecialchars($current_table) . '</option>' . "\n";
2062 }
2063 echo ' </select>' . "\n";
2064 }
2065 } else {
2066 unset($res);
2067 }
2068 echo ' <input type="text" id="text_tablename" name="tablename" />' . "\n";
2069 }
2070 echo '</fieldset>' . "\n";
2071 echo '<fieldset class="tblFooters">' . "\n"
2072 . ' <input type="submit" value="' . __('Go') . '" />'
2073 . '</fieldset>' . "\n"
2074 . '</form>' . "\n";
2075
2076 }
2077
2078 // Provide a line with links to the relevant database and table
2079 if (isset($dbname) && empty($dbname_is_wildcard)) {
2080 echo '[ ' . __('Database')
2081 . ' <a href="' . $GLOBALS['cfg']['DefaultTabDatabase'] . '?'
2082 . $GLOBALS['url_query'] . '&amp;db=' . $url_dbname . '&amp;reload=1">'
2083 . htmlspecialchars($dbname) . ': ' . PMA_getTitleForTarget($GLOBALS['cfg']['DefaultTabDatabase']) . "</a> ]\n";
2084
2085 if (isset($tablename)) {
2086 echo ' [ ' . __('Table') . ' <a href="'
2087 . $GLOBALS['cfg']['DefaultTabTable'] . '?' . $GLOBALS['url_query']
2088 . '&amp;db=' . $url_dbname . '&amp;table=' . htmlspecialchars(urlencode($tablename))
2089 . '&amp;reload=1">' . htmlspecialchars($tablename) . ': '
2090 . PMA_getTitleForTarget($GLOBALS['cfg']['DefaultTabTable'])
2091 . "</a> ]\n";
2092 }
2093 unset($url_dbname);
2094 }
2095
2096 if (! isset($dbname) && ! $user_does_not_exists) {
2097 require_once './libraries/display_change_password.lib.php';
2098
2099 echo '<form action="server_privileges.php" method="post" onsubmit="return checkPassword(this);">' . "\n"
2100 . PMA_generate_common_hidden_inputs('', '')
2101 . '<input type="hidden" name="old_username" value="' . htmlspecialchars($username) . '" />' . "\n"
2102 . '<input type="hidden" name="old_hostname" value="' . htmlspecialchars($hostname) . '" />' . "\n"
2103 . '<fieldset id="fieldset_change_copy_user">' . "\n"
2104 . ' <legend>' . __('Change Login Information / Copy User') . '</legend>' . "\n";
2105 PMA_displayLoginInformationFields('change');
2106 echo ' <fieldset>' . "\n"
2107 . ' <legend>' . __('Create a new user with the same privileges and ...') . '</legend>' . "\n";
2108 $choices = array(
2109 '4' => __('... keep the old one.'),
2110 '1' => __(' ... delete the old one from the user tables.'),
2111 '2' => __(' ... revoke all active privileges from the old one and delete it afterwards.'),
2112 '3' => __(' ... delete the old one from the user tables and reload the privileges afterwards.'));
2113 PMA_display_html_radio('mode', $choices, '4', true);
2114 unset($choices);
2115
2116 echo ' </fieldset>' . "\n"
2117 . '</fieldset>' . "\n"
2118 . '<fieldset id="fieldset_change_copy_user_footer" class="tblFooters">' . "\n"
2119 . ' <input type="submit" name="change_copy" value="' . __('Go') . '" />' . "\n"
2120 . '</fieldset>' . "\n"
2121 . '</form>' . "\n";
2122 }
2123 }
2124 } elseif (isset($_REQUEST['adduser'])) {
2125
2126 // Add a new user
2127 $GLOBALS['url_query'] .= '&amp;adduser=1';
2128 echo '<h2>' . "\n"
2129 . PMA_getIcon('b_usradd.png') . __('Add a new User') . "\n"
2130 . '</h2>' . "\n"
2131 . '<form name="usersForm" id="addUsersForm_' . $random_n . '" action="server_privileges.php" method="post">' . "\n"
2132 . PMA_generate_common_hidden_inputs('', '');
2133 PMA_displayLoginInformationFields('new');
2134 echo '<fieldset id="fieldset_add_user_database">' . "\n"
2135 . '<legend>' . __('Database for user') . '</legend>' . "\n";
2136
2137 $default_choice = 0;
2138 $choices = array(
2139 '0' => _pgettext('Create none database for user', 'None'),
2140 '1' => __('Create database with same name and grant all privileges'),
2141 '2' => __('Grant all privileges on wildcard name (username\\_%)'));
2142
2143 if ( !empty($dbname) ) {
2144 $choices['3'] = sprintf( __('Grant all privileges on database &quot;%s&quot;'), htmlspecialchars($dbname));
2145 $default_choice = 3;
2146 echo '<input type="hidden" name="dbname" value="' . htmlspecialchars($dbname) . '" />' . "\n";
2147 }
2148
2149 // 4th parameter set to true to add line breaks
2150 // 5th parameter set to false to avoid htmlspecialchars() escaping in the label
2151 // since we have some HTML in some labels
2152 PMA_display_html_radio('createdb', $choices, $default_choice, true, false);
2153 unset($choices);
2154 unset($default_choice);
2155
2156 echo '</fieldset>' . "\n";
2157 PMA_displayPrivTable('*', '*', FALSE);
2158 echo ' <fieldset id="fieldset_add_user_footer" class="tblFooters">' . "\n"
2159 . ' <input type="submit" name="adduser_submit" value="' . __('Go') . '" />' . "\n"
2160 . ' </fieldset>' . "\n"
2161 . '</form>' . "\n";
2162 } else {
2163 // check the privileges for a particular database.
2164 echo '<form id="usersForm"><table id="tablespecificuserrights" class="data">' . "\n"
2165 . '<caption class="tblHeaders">' . "\n"
2166 . PMA_getIcon('b_usrcheck.png')
2167 . ' ' . sprintf(__('Users having access to &quot;%s&quot;'), '<a href="' . $GLOBALS['cfg']['DefaultTabDatabase'] . '?' . PMA_generate_common_url($checkprivs) . '">' . htmlspecialchars($checkprivs) . '</a>') . "\n"
2168 . '</caption>' . "\n"
2169 . '<thead>' . "\n"
2170 . ' <tr><th>' . __('User') . '</th>' . "\n"
2171 . ' <th>' . __('Host') . '</th>' . "\n"
2172 . ' <th>' . __('Type') . '</th>' . "\n"
2173 . ' <th>' . __('Privileges') . '</th>' . "\n"
2174 . ' <th>' . __('Grant') . '</th>' . "\n"
2175 . ' <th>' . __('Action') . '</th>' . "\n"
2176 . ' </tr>' . "\n"
2177 . '</thead>' . "\n"
2178 . '<tbody>' . "\n";
2179 $odd_row = TRUE;
2180 unset($row, $row1, $row2);
2181
2182 // now, we build the table...
2183 $list_of_privileges =
2184 '`User`, '
2185 . '`Host`, '
2186 . '`Select_priv`, '
2187 . '`Insert_priv`, '
2188 . '`Update_priv`, '
2189 . '`Delete_priv`, '
2190 . '`Create_priv`, '
2191 . '`Drop_priv`, '
2192 . '`Grant_priv`, '
2193 . '`Index_priv`, '
2194 . '`Alter_priv`, '
2195 . '`References_priv`, '
2196 . '`Create_tmp_table_priv`, '
2197 . '`Lock_tables_priv`, '
2198 . '`Create_view_priv`, '
2199 . '`Show_view_priv`, '
2200 . '`Create_routine_priv`, '
2201 . '`Alter_routine_priv`, '
2202 . '`Execute_priv`';
2203
2204 $list_of_compared_privileges =
2205 '`Select_priv` = \'N\''
2206 . ' AND `Insert_priv` = \'N\''
2207 . ' AND `Update_priv` = \'N\''
2208 . ' AND `Delete_priv` = \'N\''
2209 . ' AND `Create_priv` = \'N\''
2210 . ' AND `Drop_priv` = \'N\''
2211 . ' AND `Grant_priv` = \'N\''
2212 . ' AND `References_priv` = \'N\''
2213 . ' AND `Create_tmp_table_priv` = \'N\''
2214 . ' AND `Lock_tables_priv` = \'N\''
2215 . ' AND `Create_view_priv` = \'N\''
2216 . ' AND `Show_view_priv` = \'N\''
2217 . ' AND `Create_routine_priv` = \'N\''
2218 . ' AND `Alter_routine_priv` = \'N\''
2219 . ' AND `Execute_priv` = \'N\'';
2220
2221 if (PMA_MYSQL_INT_VERSION >= 50106) {
2222 $list_of_privileges .=
2223 ', `Event_priv`, '
2224 . '`Trigger_priv`';
2225 $list_of_compared_privileges .=
2226 ' AND `Event_priv` = \'N\''
2227 . ' AND `Trigger_priv` = \'N\'';
2228 }
2229
2230 $sql_query =
2231 '(SELECT ' . $list_of_privileges . ', `Db`'
2232 .' FROM `mysql`.`db`'
2233 .' WHERE \'' . PMA_sqlAddslashes($checkprivs) . "'"
2234 .' LIKE `Db`'
2235 .' AND NOT (' . $list_of_compared_privileges. ')) '
2236 .'UNION '
2237 .'(SELECT ' . $list_of_privileges . ', \'*\' AS `Db`'
2238 .' FROM `mysql`.`user` '
2239 .' WHERE NOT (' . $list_of_compared_privileges . ')) '
2240 .' ORDER BY `User` ASC,'
2241 .' `Host` ASC,'
2242 .' `Db` ASC;';
2243 $res = PMA_DBI_query($sql_query);
2244 $row = PMA_DBI_fetch_assoc($res);
2245 if ($row) {
2246 $found = TRUE;
2247 }
2248
2249 if ($found) {
2250 while (TRUE) {
2251 // prepare the current user
2252 $current_privileges = array();
2253 $current_user = $row['User'];
2254 $current_host = $row['Host'];
2255 while ($row && $current_user == $row['User'] && $current_host == $row['Host']) {
2256 $current_privileges[] = $row;
2257 $row = PMA_DBI_fetch_assoc($res);
2258 }
2259 echo ' <tr class="' . ($odd_row ? 'odd' : 'even') . '">' . "\n"
2260 . ' <td';
2261 if (count($current_privileges) > 1) {
2262 echo ' rowspan="' . count($current_privileges) . '"';
2263 }
2264 echo '>' . (empty($current_user) ? '<span style="color: #FF0000">' . __('Any') . '</span>' : htmlspecialchars($current_user)) . "\n"
2265 . ' </td>' . "\n"
2266 . ' <td';
2267 if (count($current_privileges) > 1) {
2268 echo ' rowspan="' . count($current_privileges) . '"';
2269 }
2270 echo '>' . htmlspecialchars($current_host) . '</td>' . "\n";
2271 foreach ($current_privileges as $current) {
2272 echo ' <td>' . "\n"
2273 . ' ';
2274 if (!isset($current['Db']) || $current['Db'] == '*') {
2275 echo __('global');
2276 } elseif ($current['Db'] == PMA_escape_mysql_wildcards($checkprivs)) {
2277 echo __('database-specific');
2278 } else {
2279 echo __('wildcard'), ': <tt>' . htmlspecialchars($current['Db']) . '</tt>';
2280 }
2281 echo "\n"
2282 . ' </td>' . "\n"
2283 . ' <td>' . "\n"
2284 . ' <tt>' . "\n"
2285 . ' ' . join(',' . "\n" . ' ', PMA_extractPrivInfo($current, TRUE)) . "\n"
2286 . ' </tt>' . "\n"
2287 . ' </td>' . "\n"
2288 . ' <td>' . "\n"
2289 . ' ' . ($current['Grant_priv'] == 'Y' ? __('Yes') : __('No')) . "\n"
2290 . ' </td>' . "\n"
2291 . ' <td>' . "\n";
2292 printf($link_edit, urlencode($current_user),
2293 urlencode($current_host),
2294 urlencode(! isset($current['Db']) || $current['Db'] == '*' ? '' : $current['Db']),
2295 '');
2296 echo '</td>' . "\n"
2297 . ' </tr>' . "\n";
2298 }
2299 if (empty($row) && empty($row1) && empty($row2)) {
2300 break;
2301 }
2302 $odd_row = ! $odd_row;
2303 }
2304 } else {
2305 echo ' <tr class="odd">' . "\n"
2306 . ' <td colspan="6">' . "\n"
2307 . ' ' . __('No user found.') . "\n"
2308 . ' </td>' . "\n"
2309 . ' </tr>' . "\n";
2310 }
2311 echo '</tbody>' . "\n"
2312 . '</table></form>' . "\n";
2313
2314 // Offer to create a new user for the current database
2315 echo '<fieldset id="fieldset_add_user">' . "\n"
2316 . ' <a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;adduser=1&amp;dbname=' . htmlspecialchars($checkprivs) .'">' . "\n"
2317 . PMA_getIcon('b_usradd.png')
2318 . ' ' . __('Add a new User') . '</a>' . "\n"
2319 . '</fieldset>' . "\n";
2320
2321 } // end if (empty($_REQUEST['adduser']) && empty($checkprivs)) ... elseif ... else ...
2322
2323
2324 /**
2325 * Displays the footer
2326 */
2327 echo "\n\n";
2328 require './libraries/footer.inc.php';
2329
2330 ?>