?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Translation update done using Pootle.
[phpmyadmin/testing.git] / server_privileges.php
blobe43614360b6c27616c312d1a0b7ba56cb6095a70
1 <?php
2 /* vim: set expandtab sw=4 ts=4 sts=4: */
3 /**
4 *
5 * @package phpMyAdmin
6 */
7
8 /**
9 *
10 */
11 require_once './libraries/common.inc.php';
12
13 /**
14 * Does the common work
15 */
16 $GLOBALS['js_include'][] = 'server_privileges.js';
17 $GLOBALS['js_include'][] = 'functions.js';
18 $GLOBALS['js_include'][] = 'jquery/jquery-ui-1.8.custom.js';
19
20 require './libraries/server_common.inc.php';
21
22 if ($GLOBALS['cfg']['AjaxEnable']) {
23 $conditional_class = 'ajax';
24 } else {
25 $conditional_class = '';
26 }
27
28 /**
29 * Messages are built using the message name
30 */
31 $strPrivDescAllPrivileges = __('Includes all privileges except GRANT.');
32 $strPrivDescAlter = __('Allows altering the structure of existing tables.');
33 $strPrivDescAlterRoutine = __('Allows altering and dropping stored routines.');
34 $strPrivDescCreateDb = __('Allows creating new databases and tables.');
35 $strPrivDescCreateRoutine = __('Allows creating stored routines.');
36 $strPrivDescCreateTbl = __('Allows creating new tables.');
37 $strPrivDescCreateTmpTable = __('Allows creating temporary tables.');
38 $strPrivDescCreateUser = __('Allows creating, dropping and renaming user accounts.');
39 $strPrivDescCreateView = __('Allows creating new views.');
40 $strPrivDescDelete = __('Allows deleting data.');
41 $strPrivDescDropDb = __('Allows dropping databases and tables.');
42 $strPrivDescDropTbl = __('Allows dropping tables.');
43 $strPrivDescEvent = __('Allows to set up events for the event scheduler');
44 $strPrivDescExecute = __('Allows executing stored routines.');
45 $strPrivDescFile = __('Allows importing data from and exporting data into files.');
46 $strPrivDescGrant = __('Allows adding users and privileges without reloading the privilege tables.');
47 $strPrivDescIndex = __('Allows creating and dropping indexes.');
48 $strPrivDescInsert = __('Allows inserting and replacing data.');
49 $strPrivDescLockTables = __('Allows locking tables for the current thread.');
50 $strPrivDescMaxConnections = __('Limits the number of new connections the user may open per hour.');
51 $strPrivDescMaxQuestions = __('Limits the number of queries the user may send to the server per hour.');
52 $strPrivDescMaxUpdates = __('Limits the number of commands that change any table or database the user may execute per hour.');
53 $strPrivDescMaxUserConnections = __('Limits the number of simultaneous connections the user may have.');
54 $strPrivDescProcess = __('Allows viewing processes of all users');
55 $strPrivDescReferences = __('Has no effect in this MySQL version.');
56 $strPrivDescReload = __('Allows reloading server settings and flushing the server\'s caches.');
57 $strPrivDescReplClient = __('Allows the user to ask where the slaves / masters are.');
58 $strPrivDescReplSlave = __('Needed for the replication slaves.');
59 $strPrivDescSelect = __('Allows reading data.');
60 $strPrivDescShowDb = __('Gives access to the complete list of databases.');
61 $strPrivDescShowView = __('Allows performing SHOW CREATE VIEW queries.');
62 $strPrivDescShutdown = __('Allows shutting down the server.');
63 $strPrivDescSuper = __('Allows connecting, even if maximum number of connections is reached; required for most administrative operations like setting global variables or killing threads of other users.');
64 $strPrivDescTrigger = __('Allows creating and dropping triggers');
65 $strPrivDescUpdate = __('Allows changing data.');
66 $strPrivDescUsage = __('No privileges.');
67
68 /**
69 * Checks if a dropdown box has been used for selecting a database / table
70 */
71 if (PMA_isValid($_REQUEST['pred_tablename'])) {
72 $tablename = $_REQUEST['pred_tablename'];
73 unset($pred_tablename);
74 } elseif (PMA_isValid($_REQUEST['tablename'])) {
75 $tablename = $_REQUEST['tablename'];
76 } else {
77 unset($tablename);
78 }
79
80 if (PMA_isValid($_REQUEST['pred_dbname'])) {
81 $dbname = $_REQUEST['pred_dbname'];
82 unset($pred_dbname);
83 } elseif (PMA_isValid($_REQUEST['dbname'])) {
84 $dbname = $_REQUEST['dbname'];
85 } else {
86 unset($dbname);
87 unset($tablename);
88 }
89
90 if (isset($dbname)) {
91 $db_and_table = PMA_backquote(PMA_unescape_mysql_wildcards($dbname)) . '.';
92 if (isset($tablename)) {
93 $db_and_table .= PMA_backquote($tablename);
94 } else {
95 $db_and_table .= '*';
96 }
97 } else {
98 $db_and_table = '*.*';
99 }
100
101 // check if given $dbname is a wildcard or not
102 if (isset($dbname)) {
103 //if (preg_match('/\\\\(?:_|%)/i', $dbname)) {
104 if (preg_match('/(?<!\\\\)(?:_|%)/i', $dbname)) {
105 $dbname_is_wildcard = true;
106 } else {
107 $dbname_is_wildcard = false;
108 }
109 }
110
111 /**
112 * Checks if the user is allowed to do what he tries to...
113 */
114 if (!$is_superuser) {
115 require './libraries/server_links.inc.php';
116 echo '<h2>' . "\n"
117 . PMA_getIcon('b_usrlist.png')
118 . __('Privileges') . "\n"
119 . '</h2>' . "\n";
120 PMA_Message::error(__('No Privileges'))->display();
121 require './libraries/footer.inc.php';
122 }
123
124 $random_n = mt_rand(0,1000000); // a random number that will be appended to the id of the user forms
125
126 /**
127 * Escapes wildcard in a database+table specification
128 * before using it in a GRANT statement.
129 *
130 * Escaping a wildcard character in a GRANT is only accepted at the global
131 * or database level, not at table level; this is why I remove
132 * the escaping character. Internally, in mysql.tables_priv.Db there are
133 * no escaping (for example test_db) but in mysql.db you'll see test\_db
134 * for a db-specific privilege.
135 *
136 * @param string $db_and_table
137 * @param string $dbname
138 * @param string $tablename
139 * @return string the escaped (if necessary) $db_and_table
140 */
141 function PMA_WildcardEscapeForGrant($db_and_table, $dbname, $tablename) {
142
143 if (! strlen($dbname)) {
144 $db_and_table = '*.*';
145 } else {
146 if (strlen($tablename)) {
147 $db_and_table = PMA_backquote(PMA_unescape_mysql_wildcards($dbname)) . '.';
148 $db_and_table .= PMA_backquote($tablename);
149 } else {
150 $db_and_table = PMA_backquote($dbname) . '.';
151 $db_and_table .= '*';
152 }
153 }
154 return $db_and_table;
155 }
156
157 /**
158 * Generates a condition on the user name
159 *
160 * @param string the user's initial
161 * @return string the generated condition
162 */
163 function PMA_RangeOfUsers($initial = '')
164 {
165 // strtolower() is used because the User field
166 // might be BINARY, so LIKE would be case sensitive
167 if (!empty($initial)) {
168 $ret = " WHERE `User` LIKE '" . $initial . "%'"
169 . " OR `User` LIKE '" . strtolower($initial) . "%'";
170 } else {
171 $ret = '';
172 }
173 return $ret;
174 } // end function
175
176 /**
177 * Extracts the privilege information of a priv table row
178 *
179 * @param array $row the row
180 * @param boolean $enableHTML add <dfn> tag with tooltips
181 *
182 * @global ressource $user_link the database connection
183 *
184 * @return array
185 */
186 function PMA_extractPrivInfo($row = '', $enableHTML = FALSE)
187 {
188 $grants = array(
189 array('Select_priv', 'SELECT', __('Allows reading data.')),
190 array('Insert_priv', 'INSERT', __('Allows inserting and replacing data.')),
191 array('Update_priv', 'UPDATE', __('Allows changing data.')),
192 array('Delete_priv', 'DELETE', __('Allows deleting data.')),
193 array('Create_priv', 'CREATE', __('Allows creating new databases and tables.')),
194 array('Drop_priv', 'DROP', __('Allows dropping databases and tables.')),
195 array('Reload_priv', 'RELOAD', __('Allows reloading server settings and flushing the server\'s caches.')),
196 array('Shutdown_priv', 'SHUTDOWN', __('Allows shutting down the server.')),
197 array('Process_priv', 'PROCESS', __('Allows viewing processes of all users')),
198 array('File_priv', 'FILE', __('Allows importing data from and exporting data into files.')),
199 array('References_priv', 'REFERENCES', __('Has no effect in this MySQL version.')),
200 array('Index_priv', 'INDEX', __('Allows creating and dropping indexes.')),
201 array('Alter_priv', 'ALTER', __('Allows altering the structure of existing tables.')),
202 array('Show_db_priv', 'SHOW DATABASES', __('Gives access to the complete list of databases.')),
203 array('Super_priv', 'SUPER', __('Allows connecting, even if maximum number of connections is reached; required for most administrative operations like setting global variables or killing threads of other users.')),
204 array('Create_tmp_table_priv', 'CREATE TEMPORARY TABLES', __('Allows creating temporary tables.')),
205 array('Lock_tables_priv', 'LOCK TABLES', __('Allows locking tables for the current thread.')),
206 array('Repl_slave_priv', 'REPLICATION SLAVE', __('Needed for the replication slaves.')),
207 array('Repl_client_priv', 'REPLICATION CLIENT', __('Allows the user to ask where the slaves / masters are.')),
208 array('Create_view_priv', 'CREATE VIEW', __('Allows creating new views.')),
209 array('Event_priv', 'EVENT', __('Allows to set up events for the event scheduler')),
210 array('Trigger_priv', 'TRIGGER', __('Allows creating and dropping triggers')),
211 // for table privs:
212 array('Create View_priv', 'CREATE VIEW', __('Allows creating new views.')),
213 array('Show_view_priv', 'SHOW VIEW', __('Allows performing SHOW CREATE VIEW queries.')),
214 // for table privs:
215 array('Show view_priv', 'SHOW VIEW', __('Allows performing SHOW CREATE VIEW queries.')),
216 array('Create_routine_priv', 'CREATE ROUTINE', __('Allows creating stored routines.')),
217 array('Alter_routine_priv', 'ALTER ROUTINE', __('Allows altering and dropping stored routines.')),
218 array('Create_user_priv', 'CREATE USER', __('Allows creating, dropping and renaming user accounts.')),
219 array('Execute_priv', 'EXECUTE', __('Allows executing stored routines.')),
220 );
221
222 if (!empty($row) && isset($row['Table_priv'])) {
223 $row1 = PMA_DBI_fetch_single_row(
224 'SHOW COLUMNS FROM `mysql`.`tables_priv` LIKE \'Table_priv\';',
225 'ASSOC', $GLOBALS['userlink']);
226 $av_grants = explode('\',\'', substr($row1['Type'], 5, strlen($row1['Type']) - 7));
227 unset($row1);
228 $users_grants = explode(',', $row['Table_priv']);
229 foreach ($av_grants as $current_grant) {
230 $row[$current_grant . '_priv'] = in_array($current_grant, $users_grants) ? 'Y' : 'N';
231 }
232 unset($current_grant);
233 unset($av_grants);
234 unset($users_grants);
235 }
236 $privs = array();
237 $allPrivileges = TRUE;
238 foreach ($grants as $current_grant) {
239 if ((!empty($row) && isset($row[$current_grant[0]]))
240 || (empty($row) && isset($GLOBALS[$current_grant[0]]))) {
241 if ((!empty($row) && $row[$current_grant[0]] == 'Y')
242 || (empty($row)
243 && ($GLOBALS[$current_grant[0]] == 'Y'
244 || (is_array($GLOBALS[$current_grant[0]])
245 && count($GLOBALS[$current_grant[0]]) == $GLOBALS['column_count']
246 && empty($GLOBALS[$current_grant[0] . '_none'])))))
247 {
248 if ($enableHTML) {
249 $privs[] = '<dfn title="' . $current_grant[2] . '">' . $current_grant[1] . '</dfn>';
250 } else {
251 $privs[] = $current_grant[1];
252 }
253 } elseif (!empty($GLOBALS[$current_grant[0]])
254 && is_array($GLOBALS[$current_grant[0]])
255 && empty($GLOBALS[$current_grant[0] . '_none'])) {
256 if ($enableHTML) {
257 $priv_string = '<dfn title="' . $current_grant[2] . '">' . $current_grant[1] . '</dfn>';
258 } else {
259 $priv_string = $current_grant[1];
260 }
261 $privs[] = $priv_string . ' (`' . join('`, `', $GLOBALS[$current_grant[0]]) . '`)';
262 } else {
263 $allPrivileges = FALSE;
264 }
265 }
266 }
267 if (empty($privs)) {
268 if ($enableHTML) {
269 $privs[] = '<dfn title="' . __('No privileges.') . '">USAGE</dfn>';
270 } else {
271 $privs[] = 'USAGE';
272 }
273 } elseif ($allPrivileges && (!isset($GLOBALS['grant_count']) || count($privs) == $GLOBALS['grant_count'])) {
274 if ($enableHTML) {
275 $privs = array('<dfn title="' . __('Includes all privileges except GRANT.') . '">ALL PRIVILEGES</dfn>');
276 } else {
277 $privs = array('ALL PRIVILEGES');
278 }
279 }
280 return $privs;
281 } // end of the 'PMA_extractPrivInfo()' function
282
283 /**
284 * Displays on which column(s) a table-specific privilege is granted
285 */
286 function PMA_display_column_privs($columns, $row, $name_for_select,
287 $priv_for_header, $name, $name_for_dfn, $name_for_current)
288 {
289 echo ' <div class="item" id="div_item_' . $name . '">' . "\n"
290 . ' <label for="select_' . $name . '_priv">' . "\n"
291 . ' <tt><dfn title="' . $name_for_dfn . '">'
292 . $priv_for_header . '</dfn></tt>' . "\n"
293 . ' </label><br />' . "\n"
294 . ' <select id="select_' . $name . '_priv" name="'
295 . $name_for_select . '[]" multiple="multiple" size="8">' . "\n";
296
297 foreach ($columns as $current_column => $current_column_privileges) {
298 echo ' <option value="' . htmlspecialchars($current_column) . '"';
299 if ($row[$name_for_select] == 'Y' || $current_column_privileges[$name_for_current]) {
300 echo ' selected="selected"';
301 }
302 echo '>' . htmlspecialchars($current_column) . '</option>' . "\n";
303 }
304
305 echo ' </select>' . "\n"
306 . ' <i>' . __('Or') . '</i>' . "\n"
307 . ' <label for="checkbox_' . $name_for_select
308 . '_none"><input type="checkbox"'
309 . (empty($GLOBALS['checkall']) ? '' : ' checked="checked"')
310 . ' name="' . $name_for_select . '_none" id="checkbox_'
311 . $name_for_select . '_none" title="' . _pgettext('None privileges', 'None') . '" />'
312 . _pgettext('None privileges', 'None') . '</label>' . "\n"
313 . ' </div>' . "\n";
314 } // end function
315
316
317 /**
318 * Displays the privileges form table
319 *
320 * @param string $db the database
321 * @param string $table the table
322 * @param boolean $submit wheather to display the submit button or not
323 * @global array $cfg the phpMyAdmin configuration
324 * @global ressource $user_link the database connection
325 *
326 * @return void
327 */
328 function PMA_displayPrivTable($db = '*', $table = '*', $submit = TRUE)
329 {
330 global $random_n;
331
332 if ($db == '*') {
333 $table = '*';
334 }
335
336 if (isset($GLOBALS['username'])) {
337 $username = $GLOBALS['username'];
338 $hostname = $GLOBALS['hostname'];
339 if ($db == '*') {
340 $sql_query =
341 "SELECT * FROM `mysql`.`user`"
342 ." WHERE `User` = '" . PMA_sqlAddslashes($username) . "'"
343 ." AND `Host` = '" . PMA_sqlAddslashes($hostname) . "';";
344 } elseif ($table == '*') {
345 $sql_query =
346 "SELECT * FROM `mysql`.`db`"
347 ." WHERE `User` = '" . PMA_sqlAddslashes($username) . "'"
348 ." AND `Host` = '" . PMA_sqlAddslashes($hostname) . "'"
349 ." AND '" . PMA_unescape_mysql_wildcards($db) . "'"
350 ." LIKE `Db`;";
351 } else {
352 $sql_query =
353 "SELECT `Table_priv`"
354 ." FROM `mysql`.`tables_priv`"
355 ." WHERE `User` = '" . PMA_sqlAddslashes($username) . "'"
356 ." AND `Host` = '" . PMA_sqlAddslashes($hostname) . "'"
357 ." AND `Db` = '" . PMA_unescape_mysql_wildcards($db) . "'"
358 ." AND `Table_name` = '" . PMA_sqlAddslashes($table) . "';";
359 }
360 $row = PMA_DBI_fetch_single_row($sql_query);
361 }
362 if (empty($row)) {
363 if ($table == '*') {
364 if ($db == '*') {
365 $sql_query = 'SHOW COLUMNS FROM `mysql`.`user`;';
366 } elseif ($table == '*') {
367 $sql_query = 'SHOW COLUMNS FROM `mysql`.`db`;';
368 }
369 $res = PMA_DBI_query($sql_query);
370 while ($row1 = PMA_DBI_fetch_row($res)) {
371 if (substr($row1[0], 0, 4) == 'max_') {
372 $row[$row1[0]] = 0;
373 } else {
374 $row[$row1[0]] = 'N';
375 }
376 }
377 PMA_DBI_free_result($res);
378 } else {
379 $row = array('Table_priv' => '');
380 }
381 }
382 if (isset($row['Table_priv'])) {
383 $row1 = PMA_DBI_fetch_single_row(
384 'SHOW COLUMNS FROM `mysql`.`tables_priv` LIKE \'Table_priv\';',
385 'ASSOC', $GLOBALS['userlink']);
386 // note: in MySQL 5.0.3 we get "Create View', 'Show view';
387 // the View for Create is spelled with uppercase V
388 // the view for Show is spelled with lowercase v
389 // and there is a space between the words
390
391 $av_grants = explode('\',\'', substr($row1['Type'], strpos($row1['Type'], '(') + 2, strpos($row1['Type'], ')') - strpos($row1['Type'], '(') - 3));
392 unset($row1);
393 $users_grants = explode(',', $row['Table_priv']);
394
395 foreach ($av_grants as $current_grant) {
396 $row[$current_grant . '_priv'] = in_array($current_grant, $users_grants) ? 'Y' : 'N';
397 }
398 unset($row['Table_priv'], $current_grant, $av_grants, $users_grants);
399
400 // get collumns
401 $res = PMA_DBI_try_query('SHOW COLUMNS FROM ' . PMA_backquote(PMA_unescape_mysql_wildcards($db)) . '.' . PMA_backquote($table) . ';');
402 $columns = array();
403 if ($res) {
404 while ($row1 = PMA_DBI_fetch_row($res)) {
405 $columns[$row1[0]] = array(
406 'Select' => FALSE,
407 'Insert' => FALSE,
408 'Update' => FALSE,
409 'References' => FALSE
410 );
411 }
412 PMA_DBI_free_result($res);
413 }
414 unset($res, $row1);
415 }
416 // t a b l e - s p e c i f i c p r i v i l e g e s
417 if (! empty($columns)) {
418 $res = PMA_DBI_query(
419 'SELECT `Column_name`, `Column_priv`'
420 .' FROM `mysql`.`columns_priv`'
421 .' WHERE `User`'
422 .' = \'' . PMA_sqlAddslashes($username) . "'"
423 .' AND `Host`'
424 .' = \'' . PMA_sqlAddslashes($hostname) . "'"
425 .' AND `Db`'
426 .' = \'' . PMA_sqlAddslashes(PMA_unescape_mysql_wildcards($db)) . "'"
427 .' AND `Table_name`'
428 .' = \'' . PMA_sqlAddslashes($table) . '\';');
429
430 while ($row1 = PMA_DBI_fetch_row($res)) {
431 $row1[1] = explode(',', $row1[1]);
432 foreach ($row1[1] as $current) {
433 $columns[$row1[0]][$current] = TRUE;
434 }
435 }
436 PMA_DBI_free_result($res);
437 unset($res, $row1, $current);
438
439 echo '<input type="hidden" name="grant_count" value="' . count($row) . '" />' . "\n"
440 . '<input type="hidden" name="column_count" value="' . count($columns) . '" />' . "\n"
441 . '<fieldset id="fieldset_user_priv">' . "\n"
442 . ' <legend>' . __('Table-specific privileges')
443 . PMA_showHint(__(' Note: MySQL privilege names are expressed in English '))
444 . '</legend>' . "\n";
445
446
447
448 // privs that are attached to a specific column
449 PMA_display_column_privs($columns, $row, 'Select_priv',
450 'SELECT', 'select', __('Allows reading data.'), 'Select');
451
452 PMA_display_column_privs($columns, $row, 'Insert_priv',
453 'INSERT', 'insert', __('Allows inserting and replacing data.'), 'Insert');
454
455 PMA_display_column_privs($columns, $row, 'Update_priv',
456 'UPDATE', 'update', __('Allows changing data.'), 'Update');
457
458 PMA_display_column_privs($columns, $row, 'References_priv',
459 'REFERENCES', 'references', __('Has no effect in this MySQL version.'), 'References');
460
461 // privs that are not attached to a specific column
462
463 echo ' <div class="item">' . "\n";
464 foreach ($row as $current_grant => $current_grant_value) {
465 if (in_array(substr($current_grant, 0, (strlen($current_grant) - 5)),
466 array('Select', 'Insert', 'Update', 'References'))) {
467 continue;
468 }
469 // make a substitution to match the messages variables;
470 // also we must substitute the grant we get, because we can't generate
471 // a form variable containing blanks (those would get changed to
472 // an underscore when receiving the POST)
473 if ($current_grant == 'Create View_priv') {
474 $tmp_current_grant = 'CreateView_priv';
475 $current_grant = 'Create_view_priv';
476 } elseif ($current_grant == 'Show view_priv') {
477 $tmp_current_grant = 'ShowView_priv';
478 $current_grant = 'Show_view_priv';
479 } else {
480 $tmp_current_grant = $current_grant;
481 }
482
483 echo ' <div class="item">' . "\n"
484 . ' <input type="checkbox"'
485 . (empty($GLOBALS['checkall']) ? '' : ' checked="checked"')
486 . ' name="' . $current_grant . '" id="checkbox_' . $current_grant
487 . '" value="Y" '
488 . ($current_grant_value == 'Y' ? 'checked="checked" ' : '')
489 . 'title="';
490
491 echo (isset($GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5))])
492 ? $GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5))]
493 : $GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5)) . 'Tbl']) . '"/>' . "\n";
494
495 echo ' <label for="checkbox_' . $current_grant
496 . '"><tt><dfn title="'
497 . (isset($GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5))])
498 ? $GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5))]
499 : $GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5)) . 'Tbl'])
500 . '">' . strtoupper(substr($current_grant, 0, strlen($current_grant) - 5)) . '</dfn></tt></label>' . "\n"
501 . ' </div>' . "\n";
502 } // end foreach ()
503
504 echo ' </div>' . "\n";
505 // for Safari 2.0.2
506 echo ' <div class="clearfloat"></div>' . "\n";
507
508 } else {
509
510 // g l o b a l o r d b - s p e c i f i c
511 //
512 // d a t a
513 $privTable[0] = array(
514 array('Select', 'SELECT', __('Allows reading data.')),
515 array('Insert', 'INSERT', __('Allows inserting and replacing data.')),
516 array('Update', 'UPDATE', __('Allows changing data.')),
517 array('Delete', 'DELETE', __('Allows deleting data.'))
518 );
519 if ($db == '*') {
520 $privTable[0][] = array('File', 'FILE', __('Allows importing data from and exporting data into files.'));
521 }
522
523 // s t r u c t u r e
524 $privTable[1] = array(
525 array('Create', 'CREATE', ($table == '*' ? __('Allows creating new databases and tables.') : __('Allows creating new tables.'))),
526 array('Alter', 'ALTER', __('Allows altering the structure of existing tables.')),
527 array('Index', 'INDEX', __('Allows creating and dropping indexes.')),
528 array('Drop', 'DROP', ($table == '*' ? __('Allows dropping databases and tables.') : __('Allows dropping tables.'))),
529 array('Create_tmp_table', 'CREATE TEMPORARY TABLES', __('Allows creating temporary tables.')),
530 array('Show_view', 'SHOW VIEW', __('Allows performing SHOW CREATE VIEW queries.')),
531 array('Create_routine', 'CREATE ROUTINE', __('Allows creating stored routines.')),
532 array('Alter_routine', 'ALTER ROUTINE', __('Allows altering and dropping stored routines.')),
533 array('Execute', 'EXECUTE', __('Allows executing stored routines.')),
534 );
535 // this one is for a db-specific priv: Create_view_priv
536 if (isset($row['Create_view_priv'])) {
537 $privTable[1][] = array('Create_view', 'CREATE VIEW', __('Allows creating new views.'));
538 }
539 // this one is for a table-specific priv: Create View_priv
540 if (isset($row['Create View_priv'])) {
541 $privTable[1][] = array('Create View', 'CREATE VIEW', __('Allows creating new views.'));
542 }
543 if (isset($row['Event_priv'])) {
544 // MySQL 5.1.6
545 $privTable[1][] = array('Event', 'EVENT', __('Allows to set up events for the event scheduler'));
546 $privTable[1][] = array('Trigger', 'TRIGGER', __('Allows creating and dropping triggers'));
547 }
548
549 // a d m i n i s t r a t i o n
550 $privTable[2] = array(
551 array('Grant', 'GRANT', __('Allows adding users and privileges without reloading the privilege tables.')),
552 );
553 if ($db == '*') {
554 $privTable[2][] = array('Super', 'SUPER', __('Allows connecting, even if maximum number of connections is reached; required for most administrative operations like setting global variables or killing threads of other users.'));
555 $privTable[2][] = array('Process', 'PROCESS', __('Allows viewing processes of all users'));
556 $privTable[2][] = array('Reload', 'RELOAD', __('Allows reloading server settings and flushing the server\'s caches.'));
557 $privTable[2][] = array('Shutdown', 'SHUTDOWN', __('Allows shutting down the server.'));
558 $privTable[2][] = array('Show_db', 'SHOW DATABASES', __('Gives access to the complete list of databases.'));
559 }
560 $privTable[2][] = array('Lock_tables', 'LOCK TABLES', __('Allows locking tables for the current thread.'));
561 $privTable[2][] = array('References', 'REFERENCES', __('Has no effect in this MySQL version.'));
562 if ($db == '*') {
563 $privTable[2][] = array('Repl_client', 'REPLICATION CLIENT', __('Allows the user to ask where the slaves / masters are.'));
564 $privTable[2][] = array('Repl_slave', 'REPLICATION SLAVE', __('Needed for the replication slaves.'));
565 $privTable[2][] = array('Create_user', 'CREATE USER', __('Allows creating, dropping and renaming user accounts.'));
566 }
567 echo '<input type="hidden" name="grant_count" value="'
568 . (count($privTable[0]) + count($privTable[1]) + count($privTable[2]) - (isset($row['Grant_priv']) ? 1 : 0))
569 . '" />' . "\n"
570 . '<fieldset id="fieldset_user_global_rights">' . "\n"
571 . ' <legend>' . "\n"
572 . ' '
573 . ($db == '*'
574 ? __('Global privileges')
575 : ($table == '*'
576 ? __('Database-specific privileges')
577 : __('Table-specific privileges'))) . "\n"
578 . ' (<a href="server_privileges.php?'
579 . $GLOBALS['url_query'] . '&amp;checkall=1" onclick="setCheckboxes(\'addUsersForm_' . $random_n . '\', true); return false;">'
580 . __('Check All') . '</a> /' . "\n"
581 . ' <a href="server_privileges.php?'
582 . $GLOBALS['url_query'] . '" onclick="setCheckboxes(\'addUsersForm_' . $random_n . '\', false); return false;">'
583 . __('Uncheck All') . '</a>)' . "\n"
584 . ' </legend>' . "\n"
585 . ' <p><small><i>' . __(' Note: MySQL privilege names are expressed in English ') . '</i></small></p>' . "\n"
586 . ' <fieldset>' . "\n"
587 . ' <legend>' . __('Data') . '</legend>' . "\n";
588 foreach ($privTable[0] as $priv)
589 {
590 echo ' <div class="item">' . "\n"
591 . ' <input type="checkbox"'
592 . (empty($GLOBALS['checkall']) ? '' : ' checked="checked"')
593 . ' name="' . $priv[0] . '_priv" id="checkbox_' . $priv[0]
594 . '_priv" value="Y" '
595 . ($row[$priv[0] . '_priv'] == 'Y' ? 'checked="checked" ' : '')
596 . 'title="' . $priv[2] . '"/>' . "\n"
597 . ' <label for="checkbox_' . $priv[0]
598 . '_priv"><tt><dfn title="' . $priv[2] . '">' . $priv[1]
599 . '</dfn></tt></label>' . "\n"
600 . ' </div>' . "\n";
601 }
602 echo ' </fieldset>' . "\n"
603 . ' <fieldset>' . "\n"
604 . ' <legend>' . __('Structure') . '</legend>' . "\n";
605 foreach ($privTable[1] as $priv)
606 {
607 echo ' <div class="item">' . "\n"
608 . ' <input type="checkbox"'
609 . (empty($GLOBALS['checkall']) ? '' : ' checked="checked"')
610 . ' name="' . $priv[0] . '_priv" id="checkbox_' . $priv[0]
611 . '_priv" value="Y" '
612 . ($row[$priv[0] . '_priv'] == 'Y' ? 'checked="checked" ' : '')
613 . 'title="' . $priv[2] . '"/>' . "\n"
614 . ' <label for="checkbox_' . $priv[0]
615 . '_priv"><tt><dfn title="' . $priv[2] . '">' . $priv[1]
616 . '</dfn></tt></label>' . "\n"
617 . ' </div>' . "\n";
618 }
619 echo ' </fieldset>' . "\n"
620 . ' <fieldset>' . "\n"
621 . ' <legend>' . __('Administration') . '</legend>' . "\n";
622 foreach ($privTable[2] as $priv)
623 {
624 echo ' <div class="item">' . "\n"
625 . ' <input type="checkbox"'
626 . (empty($GLOBALS['checkall']) ? '' : ' checked="checked"')
627 . ' name="' . $priv[0] . '_priv" id="checkbox_' . $priv[0]
628 . '_priv" value="Y" '
629 . ($row[$priv[0] . '_priv'] == 'Y' ? 'checked="checked" ' : '')
630 . 'title="' . $priv[2] . '"/>' . "\n"
631 . ' <label for="checkbox_' . $priv[0]
632 . '_priv"><tt><dfn title="' . $priv[2] . '">' . $priv[1]
633 . '</dfn></tt></label>' . "\n"
634 . ' </div>' . "\n";
635 }
636
637 echo ' </fieldset>' . "\n";
638 // The "Resource limits" box is not displayed for db-specific privs
639 if ($db == '*') {
640 echo ' <fieldset>' . "\n"
641 . ' <legend>' . __('Resource limits') . '</legend>' . "\n"
642 . ' <p><small><i>' . __('Note: Setting these options to 0 (zero) removes the limit.') . '</i></small></p>' . "\n"
643 . ' <div class="item">' . "\n"
644 . ' <label for="text_max_questions"><tt><dfn title="'
645 . __('Limits the number of queries the user may send to the server per hour.') . '">MAX QUERIES PER HOUR</dfn></tt></label>' . "\n"
646 . ' <input type="text" name="max_questions" id="text_max_questions" value="'
647 . $row['max_questions'] . '" size="11" maxlength="11" title="' . __('Limits the number of queries the user may send to the server per hour.') . '" />' . "\n"
648 . ' </div>' . "\n"
649 . ' <div class="item">' . "\n"
650 . ' <label for="text_max_updates"><tt><dfn title="'
651 . __('Limits the number of commands that change any table or database the user may execute per hour.') . '">MAX UPDATES PER HOUR</dfn></tt></label>' . "\n"
652 . ' <input type="text" name="max_updates" id="text_max_updates" value="'
653 . $row['max_updates'] . '" size="11" maxlength="11" title="' . __('Limits the number of commands that change any table or database the user may execute per hour.') . '" />' . "\n"
654 . ' </div>' . "\n"
655 . ' <div class="item">' . "\n"
656 . ' <label for="text_max_connections"><tt><dfn title="'
657 . __('Limits the number of new connections the user may open per hour.') . '">MAX CONNECTIONS PER HOUR</dfn></tt></label>' . "\n"
658 . ' <input type="text" name="max_connections" id="text_max_connections" value="'
659 . $row['max_connections'] . '" size="11" maxlength="11" title="' . __('Limits the number of new connections the user may open per hour.') . '" />' . "\n"
660 . ' </div>' . "\n"
661 . ' <div class="item">' . "\n"
662 . ' <label for="text_max_user_connections"><tt><dfn title="'
663 . __('Limits the number of simultaneous connections the user may have.') . '">MAX USER_CONNECTIONS</dfn></tt></label>' . "\n"
664 . ' <input type="text" name="max_user_connections" id="text_max_user_connections" value="'
665 . $row['max_user_connections'] . '" size="11" maxlength="11" title="' . __('Limits the number of simultaneous connections the user may have.') . '" />' . "\n"
666 . ' </div>' . "\n"
667 . ' </fieldset>' . "\n";
668 }
669 // for Safari 2.0.2
670 echo ' <div class="clearfloat"></div>' . "\n";
671 }
672 echo '</fieldset>' . "\n";
673 if ($submit) {
674 echo '<fieldset id="fieldset_user_privtable_footer" class="tblFooters">' . "\n"
675 . ' <input type="submit" name="update_privs" value="' . __('Go') . '" />' . "\n"
676 . '</fieldset>' . "\n";
677 }
678 } // end of the 'PMA_displayPrivTable()' function
679
680
681 /**
682 * Displays the fields used by the "new user" form as well as the
683 * "change login information / copy user" form.
684 *
685 * @param string $mode are we creating a new user or are we just
686 * changing one? (allowed values: 'new', 'change')
687 * @global array $cfg the phpMyAdmin configuration
688 * @global ressource $user_link the database connection
689 *
690 * @return void
691 */
692 function PMA_displayLoginInformationFields($mode = 'new')
693 {
694 // Get user/host name lengths
695 $fields_info = PMA_DBI_get_fields('mysql', 'user');
696 $username_length = 16;
697 $hostname_length = 41;
698 foreach ($fields_info as $key => $val) {
699 if ($val['Field'] == 'User') {
700 strtok($val['Type'], '()');
701 $v = strtok('()');
702 if (is_int($v)) {
703 $username_length = $v;
704 }
705 } elseif ($val['Field'] == 'Host') {
706 strtok($val['Type'], '()');
707 $v = strtok('()');
708 if (is_int($v)) {
709 $hostname_length = $v;
710 }
711 }
712 }
713 unset($fields_info);
714
715 if (isset($GLOBALS['username']) && strlen($GLOBALS['username']) === 0) {
716 $GLOBALS['pred_username'] = 'any';
717 }
718 echo '<fieldset id="fieldset_add_user_login">' . "\n"
719 . '<legend>' . __('Login Information') . '</legend>' . "\n"
720 . '<div class="item">' . "\n"
721 . '<label for="select_pred_username">' . "\n"
722 . ' ' . __('User name') . ':' . "\n"
723 . '</label>' . "\n"
724 . '<span class="options">' . "\n"
725 . ' <select name="pred_username" id="select_pred_username" title="' . __('User name') . '"' . "\n"
726 . ' onchange="if (this.value == \'any\') { username.value = \'\'; } else if (this.value == \'userdefined\') { username.focus(); username.select(); }">' . "\n"
727 . ' <option value="any"' . ((isset($GLOBALS['pred_username']) && $GLOBALS['pred_username'] == 'any') ? ' selected="selected"' : '') . '>' . __('Any user') . '</option>' . "\n"
728 . ' <option value="userdefined"' . ((!isset($GLOBALS['pred_username']) || $GLOBALS['pred_username'] == 'userdefined') ? ' selected="selected"' : '') . '>' . __('Use text field') . ':</option>' . "\n"
729 . ' </select>' . "\n"
730 . '</span>' . "\n"
731 . '<input type="text" name="username" maxlength="'
732 . $username_length . '" title="' . __('User name') . '"'
733 . (empty($GLOBALS['username'])
734 ? ''
735 : ' value="' . htmlspecialchars(isset($GLOBALS['new_username'])
736 ? $GLOBALS['new_username']
737 : $GLOBALS['username']) . '"')
738 . ' onchange="pred_username.value = \'userdefined\';" />' . "\n"
739 . '</div>' . "\n"
740 . '<div class="item">' . "\n"
741 . '<label for="select_pred_hostname">' . "\n"
742 . ' ' . __('Host') . ':' . "\n"
743 . '</label>' . "\n"
744 . '<span class="options">' . "\n"
745 . ' <select name="pred_hostname" id="select_pred_hostname" title="' . __('Host') . '"' . "\n";
746 $_current_user = PMA_DBI_fetch_value('SELECT USER();');
747 if (! empty($_current_user)) {
748 $thishost = str_replace("'", '', substr($_current_user, (strrpos($_current_user, '@') + 1)));
749 if ($thishost == 'localhost' || $thishost == '127.0.0.1') {
750 unset($thishost);
751 }
752 }
753 echo ' onchange="if (this.value == \'any\') { hostname.value = \'%\'; } else if (this.value == \'localhost\') { hostname.value = \'localhost\'; } '
754 . (empty($thishost) ? '' : 'else if (this.value == \'thishost\') { hostname.value = \'' . addslashes(htmlspecialchars($thishost)) . '\'; } ')
755 . 'else if (this.value == \'hosttable\') { hostname.value = \'\'; } else if (this.value == \'userdefined\') { hostname.focus(); hostname.select(); }">' . "\n";
756 unset($_current_user);
757
758 // when we start editing a user, $GLOBALS['pred_hostname'] is not defined
759 if (!isset($GLOBALS['pred_hostname']) && isset($GLOBALS['hostname'])) {
760 switch (strtolower($GLOBALS['hostname'])) {
761 case 'localhost':
762 case '127.0.0.1':
763 $GLOBALS['pred_hostname'] = 'localhost';
764 break;
765 case '%':
766 $GLOBALS['pred_hostname'] = 'any';
767 break;
768 default:
769 $GLOBALS['pred_hostname'] = 'userdefined';
770 break;
771 }
772 }
773 echo ' <option value="any"'
774 . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'any')
775 ? ' selected="selected"' : '') . '>' . __('Any host')
776 . '</option>' . "\n"
777 . ' <option value="localhost"'
778 . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'localhost')
779 ? ' selected="selected"' : '') . '>' . __('Local')
780 . '</option>' . "\n";
781 if (!empty($thishost)) {
782 echo ' <option value="thishost"'
783 . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'thishost')
784 ? ' selected="selected"' : '') . '>' . __('This Host')
785 . '</option>' . "\n";
786 }
787 unset($thishost);
788 echo ' <option value="hosttable"'
789 . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'hosttable')
790 ? ' selected="selected"' : '') . '>' . __('Use Host Table')
791 . '</option>' . "\n"
792 . ' <option value="userdefined"'
793 . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'userdefined')
794 ? ' selected="selected"' : '')
795 . '>' . __('Use text field') . ':</option>' . "\n"
796 . ' </select>' . "\n"
797 . '</span>' . "\n"
798 . '<input type="text" name="hostname" maxlength="'
799 . $hostname_length . '" value="'
800 . htmlspecialchars(isset($GLOBALS['hostname']) ? $GLOBALS['hostname'] : '')
801 . '" title="' . __('Host')
802 . '" onchange="pred_hostname.value = \'userdefined\';" />' . "\n"
803 . PMA_showHint(__('When Host table is used, this field is ignored and values stored in Host table are used instead.'))
804 . '</div>' . "\n"
805 . '<div class="item">' . "\n"
806 . '<label for="select_pred_password">' . "\n"
807 . ' ' . __('Password') . ':' . "\n"
808 . '</label>' . "\n"
809 . '<span class="options">' . "\n"
810 . ' <select name="pred_password" id="select_pred_password" title="'
811 . __('Password') . '"' . "\n"
812 . ' onchange="if (this.value == \'none\') { pma_pw.value = \'\'; pma_pw2.value = \'\'; } else if (this.value == \'userdefined\') { pma_pw.focus(); pma_pw.select(); }">' . "\n"
813 . ($mode == 'change' ? ' <option value="keep" selected="selected">' . __('Do not change the password') . '</option>' . "\n" : '')
814 . ' <option value="none"';
815 if (isset($GLOBALS['username']) && $mode != 'change') {
816 echo ' selected="selected"';
817 }
818 echo '>' . __('No Password') . '</option>' . "\n"
819 . ' <option value="userdefined"' . (isset($GLOBALS['username']) ? '' : ' selected="selected"') . '>' . __('Use text field') . ':</option>' . "\n"
820 . ' </select>' . "\n"
821 . '</span>' . "\n"
822 . '<input type="password" id="text_pma_pw" name="pma_pw" title="' . __('Password') . '" onchange="pred_password.value = \'userdefined\';" />' . "\n"
823 . '</div>' . "\n"
824 . '<div class="item" id="div_element_before_generate_password">' . "\n"
825 . '<label for="text_pma_pw2">' . "\n"
826 . ' ' . __('Re-type') . ':' . "\n"
827 . '</label>' . "\n"
828 . '<span class="options">&nbsp;</span>' . "\n"
829 . '<input type="password" name="pma_pw2" id="text_pma_pw2" title="' . __('Re-type') . '" onchange="pred_password.value = \'userdefined\';" />' . "\n"
830 . '</div>' . "\n"
831 // Generate password added here via jQuery
832 . '</fieldset>' . "\n";
833 } // end of the 'PMA_displayUserAndHostFields()' function
834
835 /**
836 * Changes / copies a user, part I
837 */
838 if (isset($_REQUEST['change_copy'])) {
839 $user_host_condition =
840 ' WHERE `User`'
841 .' = \'' . PMA_sqlAddslashes($old_username) . "'"
842 .' AND `Host`'
843 .' = \'' . PMA_sqlAddslashes($old_hostname) . '\';';
844 $row = PMA_DBI_fetch_single_row('SELECT * FROM `mysql`.`user` ' . $user_host_condition);
845 if (! $row) {
846 PMA_Message::notice(__('No user found.'))->display();
847 unset($_REQUEST['change_copy']);
848 } else {
849 extract($row, EXTR_OVERWRITE);
850 // Recent MySQL versions have the field "Password" in mysql.user,
851 // so the previous extract creates $Password but this script
852 // uses $password
853 if (!isset($password) && isset($Password)) {
854 $password = $Password;
855 }
856 $queries = array();
857 }
858 }
859
860
861 /**
862 * Adds a user
863 * (Changes / copies a user, part II)
864 */
865 if (isset($_REQUEST['adduser_submit']) || isset($_REQUEST['change_copy'])) {
866 $sql_query = '';
867 if ($pred_username == 'any') {
868 $username = '';
869 }
870 switch ($pred_hostname) {
871 case 'any':
872 $hostname = '%';
873 break;
874 case 'localhost':
875 $hostname = 'localhost';
876 break;
877 case 'hosttable':
878 $hostname = '';
879 break;
880 case 'thishost':
881 $_user_name = PMA_DBI_fetch_value('SELECT USER()');
882 $hostname = substr($_user_name, (strrpos($_user_name, '@') + 1));
883 unset($_user_name);
884 break;
885 }
886 $sql = "SELECT '1' FROM `mysql`.`user`"
887 . " WHERE `User` = '" . PMA_sqlAddslashes($username) . "'"
888 . " AND `Host` = '" . PMA_sqlAddslashes($hostname) . "';";
889 if (PMA_DBI_fetch_value($sql) == 1) {
890 $message = PMA_Message::error(__('The user %s already exists!'));
891 $message->addParam('[i]\'' . $username . '\'@\'' . $hostname . '\'[/i]');
892 $_REQUEST['adduser'] = true;
893 $_add_user_error = true;
894 } else {
895
896 $create_user_real = 'CREATE USER \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\'';
897
898 $real_sql_query =
899 'GRANT ' . join(', ', PMA_extractPrivInfo()) . ' ON *.* TO \''
900 . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\'';
901 if ($pred_password != 'none' && $pred_password != 'keep') {
902 $sql_query = $real_sql_query . ' IDENTIFIED BY \'***\'';
903 $real_sql_query .= ' IDENTIFIED BY \'' . PMA_sqlAddslashes($pma_pw) . '\'';
904 if (isset($create_user_real)) {
905 $create_user_show = $create_user_real . ' IDENTIFIED BY \'***\'';
906 $create_user_real .= ' IDENTIFIED BY \'' . PMA_sqlAddslashes($pma_pw) . '\'';
907 }
908 } else {
909 if ($pred_password == 'keep' && !empty($password)) {
910 $real_sql_query .= ' IDENTIFIED BY PASSWORD \'' . $password . '\'';
911 if (isset($create_user_real)) {
912 $create_user_real .= ' IDENTIFIED BY PASSWORD \'' . $password . '\'';
913 }
914 }
915 $sql_query = $real_sql_query;
916 if (isset($create_user_real)) {
917 $create_user_show = $create_user_real;
918 }
919 }
920 /**
921 * @todo similar code appears twice in this script
922 */
923 if ((isset($Grant_priv) && $Grant_priv == 'Y')
924 || (isset($max_questions) || isset($max_connections)
925 || isset($max_updates) || isset($max_user_connections))) {
926 $real_sql_query .= ' WITH';
927 $sql_query .= ' WITH';
928 if (isset($Grant_priv) && $Grant_priv == 'Y') {
929 $real_sql_query .= ' GRANT OPTION';
930 $sql_query .= ' GRANT OPTION';
931 }
932 if (isset($max_questions)) {
933 // avoid negative values
934 $max_questions = max(0, (int)$max_questions);
935 $real_sql_query .= ' MAX_QUERIES_PER_HOUR ' . $max_questions;
936 $sql_query .= ' MAX_QUERIES_PER_HOUR ' . $max_questions;
937 }
938 if (isset($max_connections)) {
939 $max_connections = max(0, (int)$max_connections);
940 $real_sql_query .= ' MAX_CONNECTIONS_PER_HOUR ' . $max_connections;
941 $sql_query .= ' MAX_CONNECTIONS_PER_HOUR ' . $max_connections;
942 }
943 if (isset($max_updates)) {
944 $max_updates = max(0, (int)$max_updates);
945 $real_sql_query .= ' MAX_UPDATES_PER_HOUR ' . $max_updates;
946 $sql_query .= ' MAX_UPDATES_PER_HOUR ' . $max_updates;
947 }
948 if (isset($max_user_connections)) {
949 $max_user_connections = max(0, (int)$max_user_connections);
950 $real_sql_query .= ' MAX_USER_CONNECTIONS ' . $max_user_connections;
951 $sql_query .= ' MAX_USER_CONNECTIONS ' . $max_user_connections;
952 }
953 }
954 if (isset($create_user_real)) {
955 $create_user_real .= ';';
956 $create_user_show .= ';';
957 }
958 $real_sql_query .= ';';
959 $sql_query .= ';';
960 if (empty($_REQUEST['change_copy'])) {
961 $_error = false;
962
963 if (isset($create_user_real)) {
964 if (! PMA_DBI_try_query($create_user_real)) {
965 $_error = true;
966 }
967 $sql_query = $create_user_show . $sql_query;
968 }
969
970 if ($_error || ! PMA_DBI_try_query($real_sql_query)) {
971 $_REQUEST['createdb'] = false;
972 $message = PMA_Message::rawError(PMA_DBI_getError());
973 } else {
974 $message = PMA_Message::success(__('You have added a new user.'));
975 }
976
977 switch (PMA_ifSetOr($_REQUEST['createdb'], '0')) {
978 case '1' :
979 // Create database with same name and grant all privileges
980 $q = 'CREATE DATABASE IF NOT EXISTS '
981 . PMA_backquote(PMA_sqlAddslashes($username)) . ';';
982 $sql_query .= $q;
983 if (! PMA_DBI_try_query($q)) {
984 $message = PMA_Message::rawError(PMA_DBI_getError());
985 break;
986 }
987
988
989 /**
990 * If we are not in an Ajax request, we can't reload navigation now
991 */
992 if($GLOBALS['is_ajax_request'] != true) {
993 // this is needed in case tracking is on:
994 $GLOBALS['db'] = $username;
995 $GLOBALS['reload'] = TRUE;
996 PMA_reloadNavigation();
997 }
998
999 $q = 'GRANT ALL PRIVILEGES ON '
1000 . PMA_backquote(PMA_sqlAddslashes($username)) . '.* TO \''
1001 . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
1002 $sql_query .= $q;
1003 if (! PMA_DBI_try_query($q)) {
1004 $message = PMA_Message::rawError(PMA_DBI_getError());
1005 }
1006 break;
1007 case '2' :
1008 // Grant all privileges on wildcard name (username\_%)
1009 $q = 'GRANT ALL PRIVILEGES ON '
1010 . PMA_backquote(PMA_sqlAddslashes($username) . '\_%') . '.* TO \''
1011 . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
1012 $sql_query .= $q;
1013 if (! PMA_DBI_try_query($q)) {
1014 $message = PMA_Message::rawError(PMA_DBI_getError());
1015 }
1016 break;
1017 case '3' :
1018 // Grant all privileges on the specified database to the new user
1019 $q = 'GRANT ALL PRIVILEGES ON '
1020 . PMA_backquote(PMA_sqlAddslashes($dbname)) . '.* TO \''
1021 . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
1022 $sql_query .= $q;
1023 if (! PMA_DBI_try_query($q)) {
1024 $message = PMA_Message::rawError(PMA_DBI_getError());
1025 }
1026 break;
1027 case '0' :
1028 default :
1029 break;
1030 }
1031 } else {
1032 if (isset($create_user_real)) {
1033 $queries[] = $create_user_real;
1034 }
1035 $queries[] = $real_sql_query;
1036 // we put the query containing the hidden password in
1037 // $queries_for_display, at the same position occupied
1038 // by the real query in $queries
1039 $tmp_count = count($queries);
1040 if (isset($create_user_real)) {
1041 $queries_for_display[$tmp_count - 2] = $create_user_show;
1042 }
1043 $queries_for_display[$tmp_count - 1] = $sql_query;
1044 }
1045 unset($res, $real_sql_query);
1046 }
1047 }
1048
1049
1050 /**
1051 * Changes / copies a user, part III
1052 */
1053 if (isset($_REQUEST['change_copy'])) {
1054 $user_host_condition =
1055 ' WHERE `User`'
1056 .' = \'' . PMA_sqlAddslashes($old_username) . "'"
1057 .' AND `Host`'
1058 .' = \'' . PMA_sqlAddslashes($old_hostname) . '\';';
1059 $res = PMA_DBI_query('SELECT * FROM `mysql`.`db`' . $user_host_condition);
1060 while ($row = PMA_DBI_fetch_assoc($res)) {
1061 $queries[] =
1062 'GRANT ' . join(', ', PMA_extractPrivInfo($row))
1063 .' ON ' . PMA_backquote($row['Db']) . '.*'
1064 .' TO \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\''
1065 . ($row['Grant_priv'] == 'Y' ? ' WITH GRANT OPTION;' : ';');
1066 }
1067 PMA_DBI_free_result($res);
1068 $res = PMA_DBI_query(
1069 'SELECT `Db`, `Table_name`, `Table_priv`'
1070 .' FROM `mysql`.`tables_priv`' . $user_host_condition,
1071 $GLOBALS['userlink'], PMA_DBI_QUERY_STORE);
1072 while ($row = PMA_DBI_fetch_assoc($res)) {
1073
1074 $res2 = PMA_DBI_QUERY(
1075 'SELECT `Column_name`, `Column_priv`'
1076 .' FROM `mysql`.`columns_priv`'
1077 .' WHERE `User`'
1078 .' = \'' . PMA_sqlAddslashes($old_username) . "'"
1079 .' AND `Host`'
1080 .' = \'' . PMA_sqlAddslashes($old_hostname) . '\''
1081 .' AND `Db`'
1082 .' = \'' . PMA_sqlAddslashes($row['Db']) . "'"
1083 .' AND `Table_name`'
1084 .' = \'' . PMA_sqlAddslashes($row['Table_name']) . "'"
1085 .';',
1086 null, PMA_DBI_QUERY_STORE);
1087
1088 $tmp_privs1 = PMA_extractPrivInfo($row);
1089 $tmp_privs2 = array(
1090 'Select' => array(),
1091 'Insert' => array(),
1092 'Update' => array(),
1093 'References' => array()
1094 );
1095
1096 while ($row2 = PMA_DBI_fetch_assoc($res2)) {
1097 $tmp_array = explode(',', $row2['Column_priv']);
1098 if (in_array('Select', $tmp_array)) {
1099 $tmp_privs2['Select'][] = $row2['Column_name'];
1100 }
1101 if (in_array('Insert', $tmp_array)) {
1102 $tmp_privs2['Insert'][] = $row2['Column_name'];
1103 }
1104 if (in_array('Update', $tmp_array)) {
1105 $tmp_privs2['Update'][] = $row2['Column_name'];
1106 }
1107 if (in_array('References', $tmp_array)) {
1108 $tmp_privs2['References'][] = $row2['Column_name'];
1109 }
1110 unset($tmp_array);
1111 }
1112 if (count($tmp_privs2['Select']) > 0 && !in_array('SELECT', $tmp_privs1)) {
1113 $tmp_privs1[] = 'SELECT (`' . join('`, `', $tmp_privs2['Select']) . '`)';
1114 }
1115 if (count($tmp_privs2['Insert']) > 0 && !in_array('INSERT', $tmp_privs1)) {
1116 $tmp_privs1[] = 'INSERT (`' . join('`, `', $tmp_privs2['Insert']) . '`)';
1117 }
1118 if (count($tmp_privs2['Update']) > 0 && !in_array('UPDATE', $tmp_privs1)) {
1119 $tmp_privs1[] = 'UPDATE (`' . join('`, `', $tmp_privs2['Update']) . '`)';
1120 }
1121 if (count($tmp_privs2['References']) > 0 && !in_array('REFERENCES', $tmp_privs1)) {
1122 $tmp_privs1[] = 'REFERENCES (`' . join('`, `', $tmp_privs2['References']) . '`)';
1123 }
1124 unset($tmp_privs2);
1125 $queries[] =
1126 'GRANT ' . join(', ', $tmp_privs1)
1127 . ' ON ' . PMA_backquote($row['Db']) . '.' . PMA_backquote($row['Table_name'])
1128 . ' TO \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\''
1129 . (in_array('Grant', explode(',', $row['Table_priv'])) ? ' WITH GRANT OPTION;' : ';');
1130 }
1131 }
1132
1133
1134 /**
1135 * Updates privileges
1136 */
1137 if (!empty($update_privs)) {
1138 $db_and_table = PMA_WildcardEscapeForGrant($db_and_table, $dbname, (isset($tablename) ? $tablename : ''));
1139
1140 $sql_query0 =
1141 'REVOKE ALL PRIVILEGES ON ' . $db_and_table
1142 . ' FROM \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
1143 if (!isset($Grant_priv) || $Grant_priv != 'Y') {
1144 $sql_query1 =
1145 'REVOKE GRANT OPTION ON ' . $db_and_table
1146 . ' FROM \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
1147 } else {
1148 $sql_query1 = '';
1149 }
1150
1151 // Should not do a GRANT USAGE for a table-specific privilege, it
1152 // causes problems later (cannot revoke it)
1153 if (! (isset($tablename) && 'USAGE' == implode('', PMA_extractPrivInfo()))) {
1154 $sql_query2 =
1155 'GRANT ' . join(', ', PMA_extractPrivInfo())
1156 . ' ON ' . $db_and_table
1157 . ' TO \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\'';
1158
1159 /**
1160 * @todo similar code appears twice in this script
1161 */
1162 if ((isset($Grant_priv) && $Grant_priv == 'Y')
1163 || (! isset($dbname)
1164 && (isset($max_questions) || isset($max_connections)
1165 || isset($max_updates) || isset($max_user_connections))))
1166 {
1167 $sql_query2 .= 'WITH';
1168 if (isset($Grant_priv) && $Grant_priv == 'Y') {
1169 $sql_query2 .= ' GRANT OPTION';
1170 }
1171 if (isset($max_questions)) {
1172 $max_questions = max(0, (int)$max_questions);
1173 $sql_query2 .= ' MAX_QUERIES_PER_HOUR ' . $max_questions;
1174 }
1175 if (isset($max_connections)) {
1176 $max_connections = max(0, (int)$max_connections);
1177 $sql_query2 .= ' MAX_CONNECTIONS_PER_HOUR ' . $max_connections;
1178 }
1179 if (isset($max_updates)) {
1180 $max_updates = max(0, (int)$max_updates);
1181 $sql_query2 .= ' MAX_UPDATES_PER_HOUR ' . $max_updates;
1182 }
1183 if (isset($max_user_connections)) {
1184 $max_user_connections = max(0, (int)$max_user_connections);
1185 $sql_query2 .= ' MAX_USER_CONNECTIONS ' . $max_user_connections;
1186 }
1187 }
1188 $sql_query2 .= ';';
1189 }
1190 if (! PMA_DBI_try_query($sql_query0)) {
1191 // this query may fail, but this does not matter :o)
1192 $sql_query0 = '';
1193 }
1194 if (isset($sql_query1) && !PMA_DBI_try_query($sql_query1)) {
1195 // this one may fail, too...
1196 $sql_query1 = '';
1197 }
1198 if (isset($sql_query2)) {
1199 PMA_DBI_query($sql_query2);
1200 } else {
1201 $sql_query2 = '';
1202 }
1203 $sql_query = $sql_query0 . ' ' . $sql_query1 . ' ' . $sql_query2;
1204 $message = PMA_Message::success(__('You have updated the privileges for %s.'));
1205 $message->addParam('\'' . htmlspecialchars($username) . '\'@\'' . htmlspecialchars($hostname) . '\'');
1206 }
1207
1208
1209 /**
1210 * Revokes Privileges
1211 */
1212 if (isset($_REQUEST['revokeall'])) {
1213 $db_and_table = PMA_WildcardEscapeForGrant($db_and_table, $dbname, isset($tablename) ? $tablename : '');
1214
1215 $sql_query0 =
1216 'REVOKE ALL PRIVILEGES ON ' . $db_and_table
1217 . ' FROM \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
1218 $sql_query1 =
1219 'REVOKE GRANT OPTION ON ' . $db_and_table
1220 . ' FROM \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
1221
1222 PMA_DBI_query($sql_query0);
1223 if (! PMA_DBI_try_query($sql_query1)) {
1224 // this one may fail, too...
1225 $sql_query1 = '';
1226 }
1227 $sql_query = $sql_query0 . ' ' . $sql_query1;
1228 $message = PMA_Message::success(__('You have revoked the privileges for %s'));
1229 $message->addParam('\'' . htmlspecialchars($username) . '\'@\'' . htmlspecialchars($hostname) . '\'');
1230 if (! isset($tablename)) {
1231 unset($dbname);
1232 } else {
1233 unset($tablename);
1234 }
1235 }
1236
1237
1238 /**
1239 * Updates the password
1240 */
1241 if (isset($_REQUEST['change_pw'])) {
1242 // similar logic in user_password.php
1243 $message = '';
1244
1245 if ($nopass == 0 && isset($pma_pw) && isset($pma_pw2)) {
1246 if ($pma_pw != $pma_pw2) {
1247 $message = PMA_Message::error(__('The passwords aren\'t the same!'));
1248 } elseif (empty($pma_pw) || empty($pma_pw2)) {
1249 $message = PMA_Message::error(__('The password is empty!'));
1250 }
1251 } // end if
1252
1253 // here $nopass could be == 1
1254 if (empty($message)) {
1255
1256 $hashing_function = (!empty($pw_hash) && $pw_hash == 'old' ? 'OLD_' : '')
1257 . 'PASSWORD';
1258
1259 // in $sql_query which will be displayed, hide the password
1260 $sql_query = 'SET PASSWORD FOR \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\' = ' . (($pma_pw == '') ? '\'\'' : $hashing_function . '(\'' . preg_replace('@.@s', '*', $pma_pw) . '\')');
1261 $local_query = 'SET PASSWORD FOR \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\' = ' . (($pma_pw == '') ? '\'\'' : $hashing_function . '(\'' . PMA_sqlAddslashes($pma_pw) . '\')');
1262 PMA_DBI_try_query($local_query)
1263 or PMA_mysqlDie(PMA_DBI_getError(), $sql_query, FALSE, $err_url);
1264 $message = PMA_Message::success(__('The password for %s was changed successfully.'));
1265 $message->addParam('\'' . htmlspecialchars($username) . '\'@\'' . htmlspecialchars($hostname) . '\'');
1266 }
1267 }
1268
1269
1270 /**
1271 * Deletes users
1272 * (Changes / copies a user, part IV)
1273 */
1274
1275 if (isset($_REQUEST['delete']) || (isset($_REQUEST['change_copy']) && $_REQUEST['mode'] < 4)) {
1276 if (isset($_REQUEST['change_copy'])) {
1277 $selected_usr = array($old_username . '&amp;#27;' . $old_hostname);
1278 } else {
1279 $selected_usr = $_REQUEST['selected_usr'];
1280 $queries = array();
1281 }
1282 foreach ($selected_usr as $each_user) {
1283 list($this_user, $this_host) = explode('&amp;#27;', $each_user);
1284 $queries[] = '# ' . sprintf(__('Deleting %s'), '\'' . $this_user . '\'@\'' . $this_host . '\'') . ' ...';
1285 $queries[] = 'DROP USER \'' . PMA_sqlAddslashes($this_user) . '\'@\'' . PMA_sqlAddslashes($this_host) . '\';';
1286
1287 if (isset($_REQUEST['drop_users_db'])) {
1288 $queries[] = 'DROP DATABASE IF EXISTS ' . PMA_backquote($this_user) . ';';
1289 $GLOBALS['reload'] = TRUE;
1290
1291 if($GLOBALS['is_ajax_request'] != true) {
1292 PMA_reloadNavigation();
1293 }
1294 }
1295 }
1296 if (empty($_REQUEST['change_copy'])) {
1297 if (empty($queries)) {
1298 $message = PMA_Message::error(__('No users selected for deleting!'));
1299 } else {
1300 if ($_REQUEST['mode'] == 3) {
1301 $queries[] = '# ' . __('Reloading the privileges') . ' ...';
1302 $queries[] = 'FLUSH PRIVILEGES;';
1303 }
1304 $drop_user_error = '';
1305 foreach ($queries as $sql_query) {
1306 if ($sql_query{0} != '#') {
1307 if (! PMA_DBI_try_query($sql_query, $GLOBALS['userlink'])) {
1308 $drop_user_error .= PMA_DBI_getError() . "\n";
1309 }
1310 }
1311 }
1312 // tracking sets this, causing the deleted db to be shown in navi
1313 unset($GLOBALS['db']);
1314
1315 $sql_query = join("\n", $queries);
1316 if (! empty($drop_user_error)) {
1317 $message = PMA_Message::rawError($drop_user_error);
1318 } else {
1319 $message = PMA_Message::success(__('The selected users have been deleted successfully.'));
1320 }
1321 }
1322 unset($queries);
1323 }
1324 }
1325
1326
1327 /**
1328 * Changes / copies a user, part V
1329 */
1330 if (isset($_REQUEST['change_copy'])) {
1331 $tmp_count = 0;
1332 foreach ($queries as $sql_query) {
1333 if ($sql_query{0} != '#') {
1334 PMA_DBI_query($sql_query);
1335 }
1336 // when there is a query containing a hidden password, take it
1337 // instead of the real query sent
1338 if (isset($queries_for_display[$tmp_count])) {
1339 $queries[$tmp_count] = $queries_for_display[$tmp_count];
1340 }
1341 $tmp_count++;
1342 }
1343 $message = PMA_Message::success();
1344 $sql_query = join("\n", $queries);
1345 }
1346
1347
1348 /**
1349 * Reloads the privilege tables into memory
1350 */
1351 if (isset($_REQUEST['flush_privileges'])) {
1352 $sql_query = 'FLUSH PRIVILEGES;';
1353 PMA_DBI_query($sql_query);
1354 $message = PMA_Message::success(__('The privileges were reloaded successfully.'));
1355 }
1356
1357 /**
1358 * defines some standard links
1359 */
1360 $link_edit = '<a class="edit_user_anchor ' . $conditional_class . '" href="server_privileges.php?' . $GLOBALS['url_query']
1361 . '&amp;username=%s'
1362 . '&amp;hostname=%s'
1363 . '&amp;dbname=%s'
1364 . '&amp;tablename=%s">'
1365 . PMA_getIcon('b_usredit.png', __('Edit Privileges'))
1366 . '</a>';
1367
1368 $link_revoke = '<a href="server_privileges.php?' . $GLOBALS['url_query']
1369 . '&amp;username=%s'
1370 . '&amp;hostname=%s'
1371 . '&amp;dbname=%s'
1372 . '&amp;tablename=%s'
1373 . '&amp;revokeall=1">'
1374 . PMA_getIcon('b_usrdrop.png', __('Revoke'))
1375 . '</a>';
1376
1377 $link_export = '<a class="export_user_anchor ' . $conditional_class . '" href="server_privileges.php?' . $GLOBALS['url_query']
1378 . '&amp;username=%s'
1379 . '&amp;hostname=%s'
1380 . '&amp;initial=%s'
1381 . '&amp;export=1">'
1382 . PMA_getIcon('b_tblexport.png', __('Export'))
1383 . '</a>';
1384
1385 /**
1386 * If we are in an Ajax request for Create User/Edit User/Revoke User/Flush Privileges,
1387 * show $message and exit.
1388 */
1389 if( $GLOBALS['is_ajax_request'] && !isset($_REQUEST['export']) && (!isset($_REQUEST['adduser']) || $_add_user_error) && !isset($_REQUEST['initial']) && !isset($_REQUEST['showall']) && !isset($_REQUEST['edit_user_dialog'])) {
1390
1391 if(isset($sql_query)) {
1392 $extra_data['sql_query'] = PMA_showMessage(NULL, $sql_query);
1393 }
1394
1395 if(isset($_REQUEST['adduser_submit']) || isset($_REQUEST['change_copy'])) {
1396 /**
1397 * generate html on the fly for the new user that was just created.
1398 */
1399 $new_user_string = '<tr>'."\n"
1400 .'<td> <input type="checkbox" name="selected_usr[]" id="checkbox_sel_users_" value="' . htmlspecialchars($username) . '&amp;#27;' . htmlspecialchars($hostname) . '" /> </td>'."\n"
1401 .'<td><label for="checkbox_sel_users_">' . (empty($username) ? '<span style="color: #FF0000">' . __('Any') . '</span>' : htmlspecialchars($username) ) . '</label></td>' . "\n"
1402 .'<td>' . htmlspecialchars($hostname) . '</td>' . "\n";
1403 $new_user_string .= '<td>';
1404
1405 if(!empty($password) || isset($pma_pw)) {
1406 $new_user_string .= __('Yes');
1407 }
1408 else {
1409 $new_user_string .= '<span style="color: #FF0000">' . __('No') . '</span>';
1410 };
1411
1412 $new_user_string .= '</td>'."\n";
1413 $new_user_string .= '<td><tt>' . join(', ', PMA_extractPrivInfo('', true)) . '</tt></td>'; //Fill in privileges here
1414 $new_user_string .= '<td>';
1415
1416 if((isset($Grant_priv) && $Grant_priv == 'Y')) {
1417 $new_user_string .= __('Yes');
1418 }
1419 else {
1420 $new_user_string .= __('No');
1421 }
1422
1423 $new_user_string .='</td>';
1424
1425 $new_user_string .= '<td>'.sprintf($link_edit, urlencode($username), urlencode($hostname), '', '' ).'</td>'."\n";
1426 $new_user_string .= '<td>'.sprintf($link_export, urlencode($username), urlencode($hostname), (isset($initial) ? $initial : '')).'</td>'."\n";
1427
1428 $new_user_string .= '</tr>';
1429
1430 $extra_data['new_user_string'] = $new_user_string;
1431
1432 /**
1433 * Generate the string for this alphabet's initial, to update the user
1434 * pagination
1435 */
1436 $new_user_initial = strtoupper(substr($username, 0, 1));
1437 $new_user_initial_string = '<a href="server_privileges.php?' . $GLOBALS['url_query'] . '&initial=' . $new_user_initial
1438 .'">' . $new_user_initial . '</a>';
1439 $extra_data['new_user_initial'] = $new_user_initial;
1440 $extra_data['new_user_initial_string'] = $new_user_initial_string;
1441 }
1442
1443 if(isset($update_privs)) {
1444 $extra_data['db_specific_privs'] = false;
1445 if (isset($dbname_is_wildcard)) {
1446 $extra_data['db_specific_privs'] = !$dbname_is_wildcard;
1447 }
1448 $new_privileges = join(', ', PMA_extractPrivInfo('', true));
1449
1450 $extra_data['new_privileges'] = $new_privileges;
1451 }
1452
1453 PMA_ajaxResponse($message, $message->isSuccess(), $extra_data);
1454 }
1455
1456 /**
1457 * Displays the links
1458 */
1459 if (isset($viewing_mode) && $viewing_mode == 'db') {
1460 $db = $checkprivs;
1461 $url_query .= '&amp;goto=db_operations.php';
1462
1463 // Gets the database structure
1464 $sub_part = '_structure';
1465 require './libraries/db_info.inc.php';
1466 echo "\n";
1467 } else {
1468 require './libraries/server_links.inc.php';
1469 }
1470
1471
1472 /**
1473 * Displays the page
1474 */
1475
1476 // export user definition
1477 if (isset($_REQUEST['export'])) {
1478 echo '<h2>' . __('User') . ' \'' . htmlspecialchars($username) . '\'@\'' . htmlspecialchars($hostname) . '\'</h2>';
1479 echo '<textarea cols="' . $GLOBALS['cfg']['TextareaCols'] . '" rows="' . $GLOBALS['cfg']['TextareaRows'] . '">';
1480 $grants = PMA_DBI_fetch_result("SHOW GRANTS FOR '" . PMA_sqlAddslashes($username) . "'@'" . PMA_sqlAddslashes($hostname) . "'");
1481 foreach($grants as $one_grant) {
1482 echo $one_grant . ";\n\n";
1483 }
1484 echo '</textarea>';
1485 unset($username, $hostname, $grants, $one_grant);
1486 if( $GLOBALS['is_ajax_request']) {
1487 exit;
1488 }
1489 }
1490
1491 if (empty($_REQUEST['adduser']) && (! isset($checkprivs) || ! strlen($checkprivs))) {
1492 if (! isset($username)) {
1493 // No username is given --> display the overview
1494 echo '<h2>' . "\n"
1495 . PMA_getIcon('b_usrlist.png')
1496 . __('User overview') . "\n"
1497 . '</h2>' . "\n";
1498
1499 $sql_query =
1500 'SELECT *,' .
1501 " IF(`Password` = _latin1 '', 'N', 'Y') AS 'Password'" .
1502 ' FROM `mysql`.`user`';
1503
1504 $sql_query .= (isset($initial) ? PMA_RangeOfUsers($initial) : '');
1505
1506 $sql_query .= ' ORDER BY `User` ASC, `Host` ASC;';
1507 $res = PMA_DBI_try_query($sql_query, null, PMA_DBI_QUERY_STORE);
1508
1509 if (! $res) {
1510 // the query failed! This may have two reasons:
1511 // - the user does not have enough privileges
1512 // - the privilege tables use a structure of an earlier version.
1513 // so let's try a more simple query
1514
1515 $sql_query = 'SELECT * FROM `mysql`.`user`';
1516 $res = PMA_DBI_try_query($sql_query, null, PMA_DBI_QUERY_STORE);
1517
1518 if (!$res) {
1519 PMA_Message::error(__('No Privileges'))->display();
1520 PMA_DBI_free_result($res);
1521 unset($res);
1522 } else {
1523 // This message is hardcoded because I will replace it by
1524 // a automatic repair feature soon.
1525 $raw = 'Your privilege table structure seems to be older than'
1526 . ' this MySQL version!<br />'
1527 . 'Please run the <tt>mysql_upgrade</tt> command'
1528 . '(<tt>mysql_fix_privilege_tables</tt> on older systems)'
1529 . ' that should be included in your MySQL server distribution'
1530 . ' to solve this problem!';
1531 PMA_Message::rawError($raw)->display();
1532 }
1533 } else {
1534
1535 // we also want users not in table `user` but in other table
1536 $tables = PMA_DBI_fetch_result('SHOW TABLES FROM `mysql`;');
1537
1538 $tables_to_search_for_users = array(
1539 'user', 'db', 'tables_priv', 'columns_priv', 'procs_priv',
1540 );
1541
1542 $db_rights_sqls = array();
1543 foreach ($tables_to_search_for_users as $table_search_in) {
1544 if (in_array($table_search_in, $tables)) {
1545 $db_rights_sqls[] = 'SELECT DISTINCT `User`, `Host` FROM `mysql`.`' . $table_search_in . '` ' . (isset($initial) ? PMA_RangeOfUsers($initial) : '');
1546 }
1547 }
1548
1549 $user_defaults = array(
1550 'User' => '',
1551 'Host' => '%',
1552 'Password' => '?',
1553 'Grant_priv' => 'N',
1554 'privs' => array('USAGE'),
1555 );
1556
1557 // for all initials, even non A-Z
1558 $array_initials = array();
1559 // for the rights
1560 $db_rights = array();
1561
1562 $db_rights_sql = '(' . implode(') UNION (', $db_rights_sqls) . ')'
1563 .' ORDER BY `User` ASC, `Host` ASC';
1564
1565 $db_rights_result = PMA_DBI_query($db_rights_sql);
1566
1567 while ($db_rights_row = PMA_DBI_fetch_assoc($db_rights_result)) {
1568 $db_rights_row = array_merge($user_defaults, $db_rights_row);
1569 $db_rights[$db_rights_row['User']][$db_rights_row['Host']] =
1570 $db_rights_row;
1571 }
1572 PMA_DBI_free_result($db_rights_result);
1573 unset($db_rights_sql, $db_rights_sqls, $db_rights_result, $db_rights_row);
1574 ksort($db_rights);
1575
1576 /**
1577 * Displays the initials
1578 * In an Ajax request, we don't need to show this
1579 */
1580
1581 if( $GLOBALS['is_ajax_request'] != true ) {
1582
1583 // initialize to FALSE the letters A-Z
1584 for ($letter_counter = 1; $letter_counter < 27; $letter_counter++) {
1585 if (! isset($array_initials[chr($letter_counter + 64)])) {
1586 $array_initials[chr($letter_counter + 64)] = FALSE;
1587 }
1588 }
1589
1590 $initials = PMA_DBI_try_query('SELECT DISTINCT UPPER(LEFT(`User`,1)) FROM `user` ORDER BY `User` ASC', null, PMA_DBI_QUERY_STORE);
1591 while (list($tmp_initial) = PMA_DBI_fetch_row($initials)) {
1592 $array_initials[$tmp_initial] = TRUE;
1593 }
1594
1595 // Display the initials, which can be any characters, not
1596 // just letters. For letters A-Z, we add the non-used letters
1597 // as greyed out.
1598
1599 uksort($array_initials, "strnatcasecmp");
1600
1601 echo '<table id="initials_table" class="' . $conditional_class . '" <cellspacing="5"><tr>';
1602 foreach ($array_initials as $tmp_initial => $initial_was_found) {
1603 if ($initial_was_found) {
1604 echo '<td><a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;initial=' . urlencode($tmp_initial) . '">' . $tmp_initial . '</a></td>' . "\n";
1605 } else {
1606 echo '<td>' . $tmp_initial . '</td>';
1607 }
1608 }
1609 echo '<td><a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;showall=1">[' . __('Show all') . ']</a></td>' . "\n";
1610 echo '</tr></table>';
1611 }
1612
1613 /**
1614 * Display the user overview
1615 * (if less than 50 users, display them immediately)
1616 */
1617
1618 if (isset($initial) || isset($showall) || PMA_DBI_num_rows($res) < 50) {
1619
1620 while ($row = PMA_DBI_fetch_assoc($res)) {
1621 $row['privs'] = PMA_extractPrivInfo($row, true);
1622 $db_rights[$row['User']][$row['Host']] = $row;
1623 }
1624 @PMA_DBI_free_result($res);
1625 unset($res);
1626
1627 echo '<form name="usersForm" id="usersForm" action="server_privileges.php" method="post">' . "\n"
1628 . PMA_generate_common_hidden_inputs('', '')
1629 . ' <table id="tableuserrights" class="data">' . "\n"
1630 . ' <thead>' . "\n"
1631 . ' <tr><th></th>' . "\n"
1632 . ' <th>' . __('User') . '</th>' . "\n"
1633 . ' <th>' . __('Host') . '</th>' . "\n"
1634 . ' <th>' . __('Password') . '</th>' . "\n"
1635 . ' <th>' . __('Global privileges') . ' '
1636 . PMA_showHint(__(' Note: MySQL privilege names are expressed in English ')) . '</th>' . "\n"
1637 . ' <th>' . __('Grant') . '</th>' . "\n"
1638 . ' <th colspan="2">' . __('Action') . '</th>' . "\n";
1639 echo ' </tr>' . "\n";
1640 echo ' </thead>' . "\n";
1641 echo ' <tbody>' . "\n";
1642 $odd_row = true;
1643 $index_checkbox = -1;
1644 foreach ($db_rights as $user) {
1645 $index_checkbox++;
1646 ksort($user);
1647 foreach ($user as $host) {
1648 $index_checkbox++;
1649 echo ' <tr class="' . ($odd_row ? 'odd' : 'even') . '">' . "\n"
1650 . ' <td><input type="checkbox" name="selected_usr[]" id="checkbox_sel_users_'
1651 . $index_checkbox . '" value="'
1652 . htmlspecialchars($host['User'] . '&amp;#27;' . $host['Host'])
1653 . '"'
1654 . (empty($GLOBALS['checkall']) ? '' : ' checked="checked"')
1655 . ' /></td>' . "\n"
1656 . ' <td><label for="checkbox_sel_users_' . $index_checkbox . '">' . (empty($host['User']) ? '<span style="color: #FF0000">' . __('Any') . '</span>' : htmlspecialchars($host['User'])) . '</label></td>' . "\n"
1657 . ' <td>' . htmlspecialchars($host['Host']) . '</td>' . "\n";
1658 echo ' <td>';
1659 switch ($host['Password']) {
1660 case 'Y':
1661 echo __('Yes');
1662 break;
1663 case 'N':
1664 echo '<span style="color: #FF0000">' . __('No') . '</span>';
1665 break;
1666 // this happens if this is a definition not coming from mysql.user
1667 default:
1668 echo '--'; // in future version, replace by "not present"
1669 break;
1670 } // end switch
1671 echo '</td>' . "\n"
1672 . ' <td><tt>' . "\n"
1673 . ' ' . implode(',' . "\n" . ' ', $host['privs']) . "\n"
1674 . ' </tt></td>' . "\n"
1675 . ' <td>' . ($host['Grant_priv'] == 'Y' ? __('Yes') : __('No')) . '</td>' . "\n"
1676 . ' <td align="center">';
1677 printf($link_edit, urlencode($host['User']), urlencode($host['Host']), '', '');
1678 echo '</td>';
1679 echo '<td align="center">';
1680 printf($link_export, urlencode($host['User']), urlencode($host['Host']), (isset($initial) ? $initial : ''));
1681 echo '</td>';
1682 echo '</tr>';
1683 $odd_row = ! $odd_row;
1684 }
1685 }
1686
1687 unset($user, $host, $odd_row);
1688 echo ' </tbody></table>' . "\n"
1689 .'<img class="selectallarrow"'
1690 .' src="' . $pmaThemeImage . 'arrow_' . $text_dir . '.png"'
1691 .' width="38" height="22"'
1692 .' alt="' . __('With selected:') . '" />' . "\n"
1693 .'<a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;checkall=1"'
1694 .' onclick="if (markAllRows(\'usersForm\')) return false;">'
1695 . __('Check All') . '</a>' . "\n"
1696 .'/' . "\n"
1697 .'<a href="server_privileges.php?' . $GLOBALS['url_query'] . '"'
1698 .' onclick="if (unMarkAllRows(\'usersForm\')) return false;">'
1699 . __('Uncheck All') . '</a>' . "\n";
1700
1701 // add/delete user fieldset
1702 echo ' <fieldset id="fieldset_add_user">' . "\n"
1703 . ' <a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;adduser=1" class="' . $conditional_class . '">' . "\n"
1704 . PMA_getIcon('b_usradd.png')
1705 . ' ' . __('Add a new User') . '</a>' . "\n"
1706 . ' </fieldset>' . "\n"
1707 . ' <fieldset id="fieldset_delete_user">'
1708 . ' <legend>' . "\n"
1709 . PMA_getIcon('b_usrdrop.png')
1710 . ' ' . __('Remove selected users') . '' . "\n"
1711 . ' </legend>' . "\n"
1712 . ' <input type="hidden" name="mode" value="2" />' . "\n"
1713 . '(' . __('Revoke all active privileges from the users and delete them afterwards.') . ')<br />' . "\n"
1714 . ' <input type="checkbox" title="' . __('Drop the databases that have the same names as the users.') . '" name="drop_users_db" id="checkbox_drop_users_db" />' . "\n"
1715 . ' <label for="checkbox_drop_users_db" title="' . __('Drop the databases that have the same names as the users.') . '">' . "\n"
1716 . ' ' . __('Drop the databases that have the same names as the users.') . "\n"
1717 . ' </label>' . "\n"
1718 . ' </fieldset>' . "\n"
1719 . ' <fieldset id="fieldset_delete_user_footer" class="tblFooters">' . "\n"
1720 . ' <input type="submit" name="delete" value="' . __('Go') . '" id="buttonGo" class="' . $conditional_class . '"/>' . "\n"
1721 . ' </fieldset>' . "\n"
1722 . '</form>' . "\n";
1723 } else {
1724
1725 unset ($row);
1726 echo ' <fieldset id="fieldset_add_user">' . "\n"
1727 . ' <a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;adduser=1">' . "\n"
1728 . PMA_getIcon('b_usradd.png')
1729 . ' ' . __('Add a new User') . '</a>' . "\n"
1730 . ' </fieldset>' . "\n";
1731 } // end if (display overview)
1732
1733 if( $GLOBALS['is_ajax_request'] ) {
1734 exit;
1735 }
1736
1737 $flushnote = new PMA_Message(__('Note: phpMyAdmin gets the users\' privileges directly from MySQL\'s privilege tables. The content of these tables may differ from the privileges the server uses, if they have been changed manually. In this case, you should %sreload the privileges%s before you continue.'), PMA_Message::NOTICE);
1738 $flushnote->addParam('<a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;flush_privileges=1" id="reload_privileges_anchor" class="' . $conditional_class . '">', false);
1739 $flushnote->addParam('</a>', false);
1740 $flushnote->display();
1741 }
1742
1743
1744 } else {
1745
1746 // A user was selected -> display the user's properties
1747
1748 // In an Ajax request, prevent cached values from showing
1749 if($GLOBALS['is_ajax_request'] == true) {
1750 header('Cache-Control: no-cache');
1751 }
1752
1753 echo '<h2>' . "\n"
1754 . PMA_getIcon('b_usredit.png')
1755 . __('Edit Privileges') . ': '
1756 . __('User') ;
1757
1758 if (isset($dbname)) {
1759 echo ' <i><a href="server_privileges.php?'
1760 . $GLOBALS['url_query'] . '&amp;username=' . htmlspecialchars(urlencode($username))
1761 . '&amp;hostname=' . htmlspecialchars(urlencode($hostname)) . '&amp;dbname=&amp;tablename=">\''
1762 . htmlspecialchars($username) . '\'@\'' . htmlspecialchars($hostname)
1763 . '\'</a></i>' . "\n";
1764 $url_dbname = urlencode(str_replace(array('\_', '\%'), array('_', '%'), $dbname));
1765
1766 echo ' - ' . ($dbname_is_wildcard ? __('Databases') : __('Database') );
1767 if (isset($tablename)) {
1768 echo ' <i><a href="server_privileges.php?' . $GLOBALS['url_query']
1769 . '&amp;username=' . htmlspecialchars(urlencode($username)) . '&amp;hostname=' . htmlspecialchars(urlencode($hostname))
1770 . '&amp;dbname=' . htmlspecialchars($url_dbname) . '&amp;tablename=">' . htmlspecialchars($dbname) . '</a></i>';
1771 echo ' - ' . __('Table') . ' <i>' . htmlspecialchars($tablename) . '</i>';
1772 } else {
1773 echo ' <i>' . htmlspecialchars($dbname) . '</i>';
1774 }
1775
1776 } else {
1777 echo ' <i>\'' . htmlspecialchars($username) . '\'@\'' . htmlspecialchars($hostname)
1778 . '\'</i>' . "\n";
1779
1780 }
1781 echo '</h2>' . "\n";
1782
1783
1784 $sql = "SELECT '1' FROM `mysql`.`user`"
1785 . " WHERE `User` = '" . PMA_sqlAddslashes($username) . "'"
1786 . " AND `Host` = '" . PMA_sqlAddslashes($hostname) . "';";
1787 $user_does_not_exists = (bool) ! PMA_DBI_fetch_value($sql);
1788 unset($sql);
1789 if ($user_does_not_exists) {
1790 PMA_Message::warning(__('The selected user was not found in the privilege table.'))->display();
1791 PMA_displayLoginInformationFields();
1792 //require './libraries/footer.inc.php';
1793 }
1794
1795 echo '<form name="usersForm" id="addUsersForm_' . $random_n . '" action="server_privileges.php" method="post">' . "\n";
1796 $_params = array(
1797 'username' => $username,
1798 'hostname' => $hostname,
1799 );
1800 if (isset($dbname)) {
1801 $_params['dbname'] = $dbname;
1802 if (isset($tablename)) {
1803 $_params['tablename'] = $tablename;
1804 }
1805 }
1806 echo PMA_generate_common_hidden_inputs($_params);
1807
1808 PMA_displayPrivTable(PMA_ifSetOr($dbname, '*', 'length'),
1809 PMA_ifSetOr($tablename, '*', 'length'));
1810
1811 echo '</form>' . "\n";
1812
1813 if (! isset($tablename) && empty($dbname_is_wildcard)) {
1814
1815 // no table name was given, display all table specific rights
1816 // but only if $dbname contains no wildcards
1817
1818 // table header
1819 echo '<form action="server_privileges.php" method="post">' . "\n"
1820 . PMA_generate_common_hidden_inputs('', '')
1821 . '<input type="hidden" name="username" value="' . htmlspecialchars($username) . '" />' . "\n"
1822 . '<input type="hidden" name="hostname" value="' . htmlspecialchars($hostname) . '" />' . "\n"
1823 . '<fieldset>' . "\n"
1824 . '<legend>' . (! isset($dbname) ? __('Database-specific privileges') : __('Table-specific privileges')) . '</legend>' . "\n"
1825 . '<table class="data">' . "\n"
1826 . '<thead>' . "\n"
1827 . '<tr><th>' . (! isset($dbname) ? __('Database') : __('Table')) . '</th>' . "\n"
1828 . ' <th>' . __('Privileges') . '</th>' . "\n"
1829 . ' <th>' . __('Grant') . '</th>' . "\n"
1830 . ' <th>' . (! isset($dbname) ? __('Table-specific privileges') : __('Column-specific privileges')) . '</th>' . "\n"
1831 . ' <th colspan="2">' . __('Action') . '</th>' . "\n"
1832 . '</tr>' . "\n"
1833 . '</thead>' . "\n"
1834 . '<tbody>' . "\n";
1835
1836 $user_host_condition =
1837 ' WHERE `User`'
1838 . ' = \'' . PMA_sqlAddslashes($username) . "'"
1839 . ' AND `Host`'
1840 . ' = \'' . PMA_sqlAddslashes($hostname) . "'";
1841
1842 // table body
1843 // get data
1844
1845 // we also want privielgs for this user not in table `db` but in other table
1846 $tables = PMA_DBI_fetch_result('SHOW TABLES FROM `mysql`;');
1847 if (! isset($dbname)) {
1848
1849 // no db name given, so we want all privs for the given user
1850
1851 $tables_to_search_for_users = array(
1852 'tables_priv', 'columns_priv',
1853 );
1854
1855 $db_rights_sqls = array();
1856 foreach ($tables_to_search_for_users as $table_search_in) {
1857 if (in_array($table_search_in, $tables)) {
1858 $db_rights_sqls[] = '
1859 SELECT DISTINCT `Db`
1860 FROM `mysql`.' . PMA_backquote($table_search_in)
1861 . $user_host_condition;
1862 }
1863 }
1864
1865 $user_defaults = array(
1866 'Db' => '',
1867 'Grant_priv' => 'N',
1868 'privs' => array('USAGE'),
1869 'Table_privs' => true,
1870 );
1871
1872 // for the rights
1873 $db_rights = array();
1874
1875 $db_rights_sql = '(' . implode(') UNION (', $db_rights_sqls) . ')'
1876 .' ORDER BY `Db` ASC';
1877
1878 $db_rights_result = PMA_DBI_query($db_rights_sql);
1879
1880 while ($db_rights_row = PMA_DBI_fetch_assoc($db_rights_result)) {
1881 $db_rights_row = array_merge($user_defaults, $db_rights_row);
1882 // only Db names in the table `mysql`.`db` uses wildcards
1883 // as we are in the db specific rights display we want
1884 // all db names escaped, also from other sources
1885 $db_rights_row['Db'] = PMA_escape_mysql_wildcards(
1886 $db_rights_row['Db']);
1887 $db_rights[$db_rights_row['Db']] = $db_rights_row;
1888 }
1889
1890 PMA_DBI_free_result($db_rights_result);
1891 unset($db_rights_sql, $db_rights_sqls, $db_rights_result, $db_rights_row);
1892
1893 $sql_query = 'SELECT * FROM `mysql`.`db`' . $user_host_condition . ' ORDER BY `Db` ASC';
1894 $res = PMA_DBI_query($sql_query);
1895 $sql_query = '';
1896
1897 while ($row = PMA_DBI_fetch_assoc($res)) {
1898 if (isset($db_rights[$row['Db']])) {
1899 $db_rights[$row['Db']] = array_merge($db_rights[$row['Db']], $row);
1900 } else {
1901 $db_rights[$row['Db']] = $row;
1902 }
1903 // there are db specific rights for this user
1904 // so we can drop this db rights
1905 $db_rights[$row['Db']]['can_delete'] = true;
1906 }
1907 PMA_DBI_free_result($res);
1908 unset($row, $res);
1909
1910 } else {
1911
1912 // db name was given,
1913 // so we want all user specific rights for this db
1914
1915 $user_host_condition .=
1916 ' AND `Db`'
1917 .' LIKE \'' . PMA_sqlAddslashes($dbname) . "'";
1918
1919 $tables_to_search_for_users = array(
1920 'columns_priv',
1921 );
1922
1923 $db_rights_sqls = array();
1924 foreach ($tables_to_search_for_users as $table_search_in) {
1925 if (in_array($table_search_in, $tables)) {
1926 $db_rights_sqls[] = '
1927 SELECT DISTINCT `Table_name`
1928 FROM `mysql`.' . PMA_backquote($table_search_in)
1929 . $user_host_condition;
1930 }
1931 }
1932
1933 $user_defaults = array(
1934 'Table_name' => '',
1935 'Grant_priv' => 'N',
1936 'privs' => array('USAGE'),
1937 'Column_priv' => true,
1938 );
1939
1940 // for the rights
1941 $db_rights = array();
1942
1943 $db_rights_sql = '(' . implode(') UNION (', $db_rights_sqls) . ')'
1944 .' ORDER BY `Table_name` ASC';
1945
1946 $db_rights_result = PMA_DBI_query($db_rights_sql);
1947
1948 while ($db_rights_row = PMA_DBI_fetch_assoc($db_rights_result)) {
1949 $db_rights_row = array_merge($user_defaults, $db_rights_row);
1950 $db_rights[$db_rights_row['Table_name']] = $db_rights_row;
1951 }
1952 PMA_DBI_free_result($db_rights_result);
1953 unset($db_rights_sql, $db_rights_sqls, $db_rights_result, $db_rights_row);
1954
1955 $sql_query =
1956 'SELECT `Table_name`,'
1957 .' `Table_priv`,'
1958 .' IF(`Column_priv` = _latin1 \'\', 0, 1)'
1959 .' AS \'Column_priv\''
1960 .' FROM `mysql`.`tables_priv`'
1961 . $user_host_condition
1962 .' ORDER BY `Table_name` ASC;';
1963 $res = PMA_DBI_query($sql_query);
1964 $sql_query = '';
1965
1966 while ($row = PMA_DBI_fetch_assoc($res)) {
1967 if (isset($db_rights[$row['Table_name']])) {
1968 $db_rights[$row['Table_name']] = array_merge($db_rights[$row['Table_name']], $row);
1969 } else {
1970 $db_rights[$row['Table_name']] = $row;
1971 }
1972 }
1973 PMA_DBI_free_result($res);
1974 unset($row, $res);
1975 }
1976 ksort($db_rights);
1977
1978 // display rows
1979 if (count($db_rights) < 1) {
1980 echo '<tr class="odd">' . "\n"
1981 . ' <td colspan="6"><center><i>' . __('None') . '</i></center></td>' . "\n"
1982 . '</tr>' . "\n";
1983 } else {
1984 $odd_row = true;
1985 $found_rows = array();
1986 //while ($row = PMA_DBI_fetch_assoc($res)) {
1987 foreach ($db_rights as $row) {
1988 $found_rows[] = (! isset($dbname)) ? $row['Db'] : $row['Table_name'];
1989
1990 echo '<tr class="' . ($odd_row ? 'odd' : 'even') . '">' . "\n"
1991 . ' <td>' . htmlspecialchars((! isset($dbname)) ? $row['Db'] : $row['Table_name']) . '</td>' . "\n"
1992 . ' <td><tt>' . "\n"
1993 . ' ' . join(',' . "\n" . ' ', PMA_extractPrivInfo($row, TRUE)) . "\n"
1994 . ' </tt></td>' . "\n"
1995 . ' <td>' . ((((! isset($dbname)) && $row['Grant_priv'] == 'Y') || (isset($dbname) && in_array('Grant', explode(',', $row['Table_priv'])))) ? __('Yes') : __('No')) . '</td>' . "\n"
1996 . ' <td>';
1997 if (! empty($row['Table_privs']) || ! empty ($row['Column_priv'])) {
1998 echo __('Yes');
1999 } else {
2000 echo __('No');
2001 }
2002 echo '</td>' . "\n"
2003 . ' <td>';
2004 printf($link_edit, htmlspecialchars(urlencode($username)),
2005 urlencode(htmlspecialchars($hostname)),
2006 urlencode((! isset($dbname)) ? $row['Db'] : htmlspecialchars($dbname)),
2007 urlencode((! isset($dbname)) ? '' : $row['Table_name']));
2008 echo '</td>' . "\n"
2009 . ' <td>';
2010 if (! empty($row['can_delete']) || isset($row['Table_name']) && strlen($row['Table_name'])) {
2011 printf($link_revoke, htmlspecialchars(urlencode($username)),
2012 urlencode(htmlspecialchars($hostname)),
2013 urlencode((! isset($dbname)) ? $row['Db'] : htmlspecialchars($dbname)),
2014 urlencode((! isset($dbname)) ? '' : $row['Table_name']));
2015 }
2016 echo '</td>' . "\n"
2017 . '</tr>' . "\n";
2018 $odd_row = ! $odd_row;
2019 } // end while
2020 }
2021 unset($row);
2022 echo '</tbody>' . "\n"
2023 . '</table>' . "\n";
2024
2025 if (! isset($dbname)) {
2026
2027 // no database name was given, display select db
2028
2029 $pred_db_array =PMA_DBI_fetch_result('SHOW DATABASES;');
2030
2031 echo ' <label for="text_dbname">' . __('Add privileges on the following database') . ':</label>' . "\n";
2032 if (!empty($pred_db_array)) {
2033 echo ' <select name="pred_dbname" onchange="this.form.submit();">' . "\n"
2034 . ' <option value="" selected="selected">' . __('Use text field') . ':</option>' . "\n";
2035 foreach ($pred_db_array as $current_db) {
2036 $current_db = PMA_escape_mysql_wildcards($current_db);
2037 // cannot use array_diff() once, outside of the loop,
2038 // because the list of databases has special characters
2039 // already escaped in $found_rows,
2040 // contrary to the output of SHOW DATABASES
2041 if (empty($found_rows) || ! in_array($current_db, $found_rows)) {
2042 echo ' <option value="' . htmlspecialchars($current_db) . '">'
2043 . htmlspecialchars($current_db) . '</option>' . "\n";
2044 }
2045 }
2046 echo ' </select>' . "\n";
2047 }
2048 echo ' <input type="text" id="text_dbname" name="dbname" />' . "\n"
2049 . PMA_showHint(__('Wildcards % and _ should be escaped with a \ to use them literally'));
2050 } else {
2051 echo ' <input type="hidden" name="dbname" value="' . htmlspecialchars($dbname) . '"/>' . "\n"
2052 . ' <label for="text_tablename">' . __('Add privileges on the following table') . ':</label>' . "\n";
2053 if ($res = @PMA_DBI_try_query('SHOW TABLES FROM ' . PMA_backquote(PMA_unescape_mysql_wildcards($dbname)) . ';', null, PMA_DBI_QUERY_STORE)) {
2054 $pred_tbl_array = array();
2055 while ($row = PMA_DBI_fetch_row($res)) {
2056 if (!isset($found_rows) || !in_array($row[0], $found_rows)) {
2057 $pred_tbl_array[] = $row[0];
2058 }
2059 }
2060 PMA_DBI_free_result($res);
2061 unset($res, $row);
2062 if (!empty($pred_tbl_array)) {
2063 echo ' <select name="pred_tablename" onchange="this.form.submit();">' . "\n"
2064 . ' <option value="" selected="selected">' . __('Use text field') . ':</option>' . "\n";
2065 foreach ($pred_tbl_array as $current_table) {
2066 echo ' <option value="' . htmlspecialchars($current_table) . '">' . htmlspecialchars($current_table) . '</option>' . "\n";
2067 }
2068 echo ' </select>' . "\n";
2069 }
2070 } else {
2071 unset($res);
2072 }
2073 echo ' <input type="text" id="text_tablename" name="tablename" />' . "\n";
2074 }
2075 echo '</fieldset>' . "\n";
2076 echo '<fieldset class="tblFooters">' . "\n"
2077 . ' <input type="submit" value="' . __('Go') . '" />'
2078 . '</fieldset>' . "\n"
2079 . '</form>' . "\n";
2080
2081 }
2082
2083 // Provide a line with links to the relevant database and table
2084 if (isset($dbname) && empty($dbname_is_wildcard)) {
2085 echo '[ ' . __('Database')
2086 . ' <a href="' . $GLOBALS['cfg']['DefaultTabDatabase'] . '?'
2087 . $GLOBALS['url_query'] . '&amp;db=' . $url_dbname . '&amp;reload=1">'
2088 . htmlspecialchars($dbname) . ': ' . PMA_getTitleForTarget($GLOBALS['cfg']['DefaultTabDatabase']) . "</a> ]\n";
2089
2090 if (isset($tablename)) {
2091 echo ' [ ' . __('Table') . ' <a href="'
2092 . $GLOBALS['cfg']['DefaultTabTable'] . '?' . $GLOBALS['url_query']
2093 . '&amp;db=' . $url_dbname . '&amp;table=' . htmlspecialchars(urlencode($tablename))
2094 . '&amp;reload=1">' . htmlspecialchars($tablename) . ': '
2095 . PMA_getTitleForTarget($GLOBALS['cfg']['DefaultTabTable'])
2096 . "</a> ]\n";
2097 }
2098 unset($url_dbname);
2099 }
2100
2101 if (! isset($dbname) && ! $user_does_not_exists) {
2102 require_once './libraries/display_change_password.lib.php';
2103
2104 echo '<form action="server_privileges.php" method="post" onsubmit="return checkPassword(this);">' . "\n"
2105 . PMA_generate_common_hidden_inputs('', '')
2106 . '<input type="hidden" name="old_username" value="' . htmlspecialchars($username) . '" />' . "\n"
2107 . '<input type="hidden" name="old_hostname" value="' . htmlspecialchars($hostname) . '" />' . "\n"
2108 . '<fieldset id="fieldset_change_copy_user">' . "\n"
2109 . ' <legend>' . __('Change Login Information / Copy User') . '</legend>' . "\n";
2110 PMA_displayLoginInformationFields('change');
2111 echo ' <fieldset>' . "\n"
2112 . ' <legend>' . __('Create a new user with the same privileges and ...') . '</legend>' . "\n";
2113 $choices = array(
2114 '4' => __('... keep the old one.'),
2115 '1' => __(' ... delete the old one from the user tables.'),
2116 '2' => __(' ... revoke all active privileges from the old one and delete it afterwards.'),
2117 '3' => __(' ... delete the old one from the user tables and reload the privileges afterwards.'));
2118 PMA_display_html_radio('mode', $choices, '4', true);
2119 unset($choices);
2120
2121 echo ' </fieldset>' . "\n"
2122 . '</fieldset>' . "\n"
2123 . '<fieldset id="fieldset_change_copy_user_footer" class="tblFooters">' . "\n"
2124 . ' <input type="submit" name="change_copy" value="' . __('Go') . '" />' . "\n"
2125 . '</fieldset>' . "\n"
2126 . '</form>' . "\n";
2127 }
2128 }
2129 } elseif (isset($_REQUEST['adduser'])) {
2130
2131 // Add a new user
2132 $GLOBALS['url_query'] .= '&amp;adduser=1';
2133 echo '<h2>' . "\n"
2134 . PMA_getIcon('b_usradd.png') . __('Add a new User') . "\n"
2135 . '</h2>' . "\n"
2136 . '<form name="usersForm" id="addUsersForm_' . $random_n . '" action="server_privileges.php" method="post">' . "\n"
2137 . PMA_generate_common_hidden_inputs('', '');
2138 PMA_displayLoginInformationFields('new');
2139 echo '<fieldset id="fieldset_add_user_database">' . "\n"
2140 . '<legend>' . __('Database for user') . '</legend>' . "\n";
2141
2142 $default_choice = 0;
2143 $choices = array(
2144 '0' => _pgettext('Create none database for user', 'None'),
2145 '1' => __('Create database with same name and grant all privileges'),
2146 '2' => __('Grant all privileges on wildcard name (username\\_%)'));
2147
2148 if ( !empty($dbname) ) {
2149 $choices['3'] = sprintf( __('Grant all privileges on database &quot;%s&quot;'), htmlspecialchars($dbname));
2150 $default_choice = 3;
2151 echo '<input type="hidden" name="dbname" value="' . htmlspecialchars($dbname) . '" />' . "\n";
2152 }
2153
2154 // 4th parameter set to true to add line breaks
2155 // 5th parameter set to false to avoid htmlspecialchars() escaping in the label
2156 // since we have some HTML in some labels
2157 PMA_display_html_radio('createdb', $choices, $default_choice, true, false);
2158 unset($choices);
2159 unset($default_choice);
2160
2161 echo '</fieldset>' . "\n";
2162 PMA_displayPrivTable('*', '*', FALSE);
2163 echo ' <fieldset id="fieldset_add_user_footer" class="tblFooters">' . "\n"
2164 . ' <input type="submit" name="adduser_submit" value="' . __('Go') . '" />' . "\n"
2165 . ' </fieldset>' . "\n"
2166 . '</form>' . "\n";
2167 } else {
2168 // check the privileges for a particular database.
2169 echo '<form id="usersForm"><table id="dbspecificuserrights" class="data">' . "\n"
2170 . '<caption class="tblHeaders">' . "\n"
2171 . PMA_getIcon('b_usrcheck.png')
2172 . ' ' . sprintf(__('Users having access to &quot;%s&quot;'), '<a href="' . $GLOBALS['cfg']['DefaultTabDatabase'] . '?' . PMA_generate_common_url($checkprivs) . '">' . htmlspecialchars($checkprivs) . '</a>') . "\n"
2173 . '</caption>' . "\n"
2174 . '<thead>' . "\n"
2175 . ' <tr><th>' . __('User') . '</th>' . "\n"
2176 . ' <th>' . __('Host') . '</th>' . "\n"
2177 . ' <th>' . __('Type') . '</th>' . "\n"
2178 . ' <th>' . __('Privileges') . '</th>' . "\n"
2179 . ' <th>' . __('Grant') . '</th>' . "\n"
2180 . ' <th>' . __('Action') . '</th>' . "\n"
2181 . ' </tr>' . "\n"
2182 . '</thead>' . "\n"
2183 . '<tbody>' . "\n";
2184 $odd_row = TRUE;
2185 unset($row, $row1, $row2);
2186
2187 // now, we build the table...
2188 $list_of_privileges =
2189 '`User`, '
2190 . '`Host`, '
2191 . '`Select_priv`, '
2192 . '`Insert_priv`, '
2193 . '`Update_priv`, '
2194 . '`Delete_priv`, '
2195 . '`Create_priv`, '
2196 . '`Drop_priv`, '
2197 . '`Grant_priv`, '
2198 . '`Index_priv`, '
2199 . '`Alter_priv`, '
2200 . '`References_priv`, '
2201 . '`Create_tmp_table_priv`, '
2202 . '`Lock_tables_priv`, '
2203 . '`Create_view_priv`, '
2204 . '`Show_view_priv`, '
2205 . '`Create_routine_priv`, '
2206 . '`Alter_routine_priv`, '
2207 . '`Execute_priv`';
2208
2209 $list_of_compared_privileges =
2210 '`Select_priv` = \'N\''
2211 . ' AND `Insert_priv` = \'N\''
2212 . ' AND `Update_priv` = \'N\''
2213 . ' AND `Delete_priv` = \'N\''
2214 . ' AND `Create_priv` = \'N\''
2215 . ' AND `Drop_priv` = \'N\''
2216 . ' AND `Grant_priv` = \'N\''
2217 . ' AND `References_priv` = \'N\''
2218 . ' AND `Create_tmp_table_priv` = \'N\''
2219 . ' AND `Lock_tables_priv` = \'N\''
2220 . ' AND `Create_view_priv` = \'N\''
2221 . ' AND `Show_view_priv` = \'N\''
2222 . ' AND `Create_routine_priv` = \'N\''
2223 . ' AND `Alter_routine_priv` = \'N\''
2224 . ' AND `Execute_priv` = \'N\'';
2225
2226 if (PMA_MYSQL_INT_VERSION >= 50106) {
2227 $list_of_privileges .=
2228 ', `Event_priv`, '
2229 . '`Trigger_priv`';
2230 $list_of_compared_privileges .=
2231 ' AND `Event_priv` = \'N\''
2232 . ' AND `Trigger_priv` = \'N\'';
2233 }
2234
2235 $sql_query =
2236 '(SELECT ' . $list_of_privileges . ', `Db`'
2237 .' FROM `mysql`.`db`'
2238 .' WHERE \'' . PMA_sqlAddslashes($checkprivs) . "'"
2239 .' LIKE `Db`'
2240 .' AND NOT (' . $list_of_compared_privileges. ')) '
2241 .'UNION '
2242 .'(SELECT ' . $list_of_privileges . ', \'*\' AS `Db`'
2243 .' FROM `mysql`.`user` '
2244 .' WHERE NOT (' . $list_of_compared_privileges . ')) '
2245 .' ORDER BY `User` ASC,'
2246 .' `Host` ASC,'
2247 .' `Db` ASC;';
2248 $res = PMA_DBI_query($sql_query);
2249 $row = PMA_DBI_fetch_assoc($res);
2250 if ($row) {
2251 $found = TRUE;
2252 }
2253
2254 if ($found) {
2255 while (TRUE) {
2256 // prepare the current user
2257 $current_privileges = array();
2258 $current_user = $row['User'];
2259 $current_host = $row['Host'];
2260 while ($row && $current_user == $row['User'] && $current_host == $row['Host']) {
2261 $current_privileges[] = $row;
2262 $row = PMA_DBI_fetch_assoc($res);
2263 }
2264 echo ' <tr class="' . ($odd_row ? 'odd' : 'even') . '">' . "\n"
2265 . ' <td';
2266 if (count($current_privileges) > 1) {
2267 echo ' rowspan="' . count($current_privileges) . '"';
2268 }
2269 echo '>' . (empty($current_user) ? '<span style="color: #FF0000">' . __('Any') . '</span>' : htmlspecialchars($current_user)) . "\n"
2270 . ' </td>' . "\n"
2271 . ' <td';
2272 if (count($current_privileges) > 1) {
2273 echo ' rowspan="' . count($current_privileges) . '"';
2274 }
2275 echo '>' . htmlspecialchars($current_host) . '</td>' . "\n";
2276 foreach ($current_privileges as $current) {
2277 echo ' <td>' . "\n"
2278 . ' ';
2279 if (!isset($current['Db']) || $current['Db'] == '*') {
2280 echo __('global');
2281 } elseif ($current['Db'] == PMA_escape_mysql_wildcards($checkprivs)) {
2282 echo __('database-specific');
2283 } else {
2284 echo __('wildcard'), ': <tt>' . htmlspecialchars($current['Db']) . '</tt>';
2285 }
2286 echo "\n"
2287 . ' </td>' . "\n"
2288 . ' <td>' . "\n"
2289 . ' <tt>' . "\n"
2290 . ' ' . join(',' . "\n" . ' ', PMA_extractPrivInfo($current, TRUE)) . "\n"
2291 . ' </tt>' . "\n"
2292 . ' </td>' . "\n"
2293 . ' <td>' . "\n"
2294 . ' ' . ($current['Grant_priv'] == 'Y' ? __('Yes') : __('No')) . "\n"
2295 . ' </td>' . "\n"
2296 . ' <td>' . "\n";
2297 printf($link_edit, urlencode($current_user),
2298 urlencode($current_host),
2299 urlencode(! isset($current['Db']) || $current['Db'] == '*' ? '' : $current['Db']),
2300 '');
2301 echo '</td>' . "\n"
2302 . ' </tr>' . "\n";
2303 }
2304 if (empty($row) && empty($row1) && empty($row2)) {
2305 break;
2306 }
2307 $odd_row = ! $odd_row;
2308 }
2309 } else {
2310 echo ' <tr class="odd">' . "\n"
2311 . ' <td colspan="6">' . "\n"
2312 . ' ' . __('No user found.') . "\n"
2313 . ' </td>' . "\n"
2314 . ' </tr>' . "\n";
2315 }
2316 echo '</tbody>' . "\n"
2317 . '</table></form>' . "\n";
2318
2319 // Offer to create a new user for the current database
2320 echo '<fieldset id="fieldset_add_user">' . "\n"
2321 . ' <a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;adduser=1&amp;dbname=' . htmlspecialchars($checkprivs) .'">' . "\n"
2322 . PMA_getIcon('b_usradd.png')
2323 . ' ' . __('Add a new User') . '</a>' . "\n"
2324 . '</fieldset>' . "\n";
2325
2326 } // end if (empty($_REQUEST['adduser']) && empty($checkprivs)) ... elseif ... else ...
2327
2328
2329 /**
2330 * Displays the footer
2331 */
2332 echo "\n\n";
2333 require './libraries/footer.inc.php';
2334
2335 ?>
test