WebSVN – MLAB – Blame – /Web/Maintenance/phpMyAdmin/server

250

kaklik

1

<?php

2

/* $Id: server_privileges.php,v 2.91.2.3 2006/05/17 10:24:14 lem9 Exp $ */

3

// vim: expandtab sw=4 ts=4 sts=4:

4

5

require_once('./libraries/common.lib.php');

6

7

/**

8

* Does the common work

9

*/

10

$js_to_run = 'server_privileges.js';

11

require('./libraries/server_common.inc.php');

12

13

14

/**

15

* Checks if a dropdown box has been used for selecting a database / table

16

*/

17

if (isset($pred_dbname) && strlen($pred_dbname)) {

18

$dbname = $pred_dbname;

19

unset($pred_dbname);

20

}

21

if (isset($pred_tablename) && strlen($pred_tablename)) {

22

$tablename = $pred_tablename;

23

unset($pred_tablename);

24

}

25

26

// check if given $dbanem is a wildcard or not

27

if ( isset( $dbname ) ) {

28

//if ( preg_match( '/\\\\(?:_|%)/i', $dbname ) ) {

29

if ( preg_match( '/(?<!\\\\)(?:_|%)/i', $dbname ) ) {

30

$dbname_is_wildcard = true;

31

} else {

32

$dbname_is_wildcard = false;

33

}

34

}

35

36

/**

37

* Checks if the user is allowed to do what he tries to...

38

*/

39

if (!$is_superuser) {

40

require('./libraries/server_links.inc.php');

41

echo '<h2>' . "\n"

42

       . ($GLOBALS['cfg']['MainPageIconic'] ? '<img class="icon" src="'. $GLOBALS['pmaThemeImage'] . 'b_usrlist.png" alt="" />' : '')

43

. $GLOBALS['strPrivileges'] . "\n"

44

. '</h2>' . "\n"

45

. $GLOBALS['strNoPrivileges'] . "\n";

46

require_once('./libraries/footer.inc.php');

47

}

48

49

/**

50

* Generates a condition on the user name

51

*

52

* @param string the user's initial

53

* @return string the generated condition

54

*/

55

function PMA_RangeOfUsers($initial = '') {

56

// strtolower() is used because the User field

57

// might be BINARY, so LIKE would be case sensitive

58

if (!empty($initial)) {

59

$ret = " WHERE " . PMA_convert_using('User')

60

. " LIKE " . PMA_convert_using($initial . '%', 'quoted')

61

. " OR ". PMA_convert_using('User')

62

. " LIKE " . PMA_convert_using(strtolower($initial) . '%', 'quoted');

63

} else {

64

$ret = '';

65

}

66

return $ret;

67

} // end function

68

69

/**

70

* Extracts the privilege information of a priv table row

71

*

72

* @param array $row the row

73

* @param boolean $enableHTML add <dfn> tag with tooltips

74

*

75

* @global ressource $user_link the database connection

76

*

77

* @return array

78

*/

79

function PMA_extractPrivInfo($row = '', $enableHTML = FALSE)

80

{

81

$grants = array(

82

array('Select_priv', 'SELECT', $GLOBALS['strPrivDescSelect']),

83

array('Insert_priv', 'INSERT', $GLOBALS['strPrivDescInsert']),

84

array('Update_priv', 'UPDATE', $GLOBALS['strPrivDescUpdate']),

85

array('Delete_priv', 'DELETE', $GLOBALS['strPrivDescDelete']),

86

array('Create_priv', 'CREATE', $GLOBALS['strPrivDescCreateDb']),

87

array('Drop_priv', 'DROP', $GLOBALS['strPrivDescDropDb']),

88

array('Reload_priv', 'RELOAD', $GLOBALS['strPrivDescReload']),

89

array('Shutdown_priv', 'SHUTDOWN', $GLOBALS['strPrivDescShutdown']),

90

        array('Process_priv', 'PROCESS', $GLOBALS['strPrivDescProcess' . ((!empty($row) && isset($row['Super_priv'])) || (empty($row) && isset($GLOBALS['Super_priv'])) ? '4' : '3')]),

91

array('File_priv', 'FILE', $GLOBALS['strPrivDescFile']),

92

array('References_priv', 'REFERENCES', $GLOBALS['strPrivDescReferences']),

93

array('Index_priv', 'INDEX', $GLOBALS['strPrivDescIndex']),

94

array('Alter_priv', 'ALTER', $GLOBALS['strPrivDescAlter']),

95

array('Show_db_priv', 'SHOW DATABASES', $GLOBALS['strPrivDescShowDb']),

96

array('Super_priv', 'SUPER', $GLOBALS['strPrivDescSuper']),

97

array('Create_tmp_table_priv', 'CREATE TEMPORARY TABLES', $GLOBALS['strPrivDescCreateTmpTable']),

98

array('Lock_tables_priv', 'LOCK TABLES', $GLOBALS['strPrivDescLockTables']),

99

array('Repl_slave_priv', 'REPLICATION SLAVE', $GLOBALS['strPrivDescReplSlave']),

100

array('Repl_client_priv', 'REPLICATION CLIENT', $GLOBALS['strPrivDescReplClient']),

101

array('Create_view_priv', 'CREATE VIEW', $GLOBALS['strPrivDescCreateView']),

102

// for table privs:

103

array('Create View_priv', 'CREATE VIEW', $GLOBALS['strPrivDescCreateView']),

104

array('Show_view_priv', 'SHOW VIEW', $GLOBALS['strPrivDescShowView']),

105

// for table privs:

106

array('Show view_priv', 'SHOW VIEW', $GLOBALS['strPrivDescShowView']),

107

array('Create_routine_priv', 'CREATE ROUTINE', $GLOBALS['strPrivDescCreateRoutine']),

108

array('Alter_routine_priv', 'ALTER ROUTINE', $GLOBALS['strPrivDescAlterRoutine']),

109

array('Create_user_priv', 'CREATE USER', $GLOBALS['strPrivDescCreateUser'])

110

);

111

if (PMA_MYSQL_INT_VERSION >= 40002 && PMA_MYSQL_INT_VERSION <50003) {

112

$grants[] = array('Execute_priv', 'EXECUTE', $GLOBALS['strPrivDescExecute']);

113

} else {

114

$grants[] = array('Execute_priv', 'EXECUTE', $GLOBALS['strPrivDescExecute5']);

115

}

116

117

if (!empty($row) && isset($row['Table_priv'])) {

118

$res = PMA_DBI_query(

119

'SHOW COLUMNS FROM `mysql`.`tables_priv` LIKE \'Table_priv\';',

120

$GLOBALS['userlink'] );

121

$row1 = PMA_DBI_fetch_assoc($res);

122

PMA_DBI_free_result($res);

123

$av_grants = explode ('\',\'', substr($row1['Type'], 5, strlen($row1['Type']) - 7));

124

unset($row1);

125

$users_grants = explode(',', $row['Table_priv']);

126

foreach ($av_grants as $current_grant) {

127

$row[$current_grant . '_priv'] = in_array($current_grant, $users_grants) ? 'Y' : 'N';

128

}

129

unset($current_grant);

130

unset($av_grants);

131

unset($users_grants);

132

}

133

$privs = array();

134

$allPrivileges = TRUE;

135

foreach ($grants as $current_grant) {

136

if ((!empty($row) && isset($row[$current_grant[0]])) || (empty($row) && isset($GLOBALS[$current_grant[0]]))) {

137

            if ((!empty($row) && $row[$current_grant[0]] == 'Y') || (empty($row) && ($GLOBALS[$current_grant[0]] == 'Y' || (is_array($GLOBALS[$current_grant[0]]) && count($GLOBALS[$current_grant[0]]) == $GLOBALS['column_count'] && empty($GLOBALS[$current_grant[0] . '_none']))))) {

138

if ($enableHTML) {

139

$privs[] = '<dfn title="' . $current_grant[2] . '">' . $current_grant[1] . '</dfn>';

140

} else {

141

$privs[] = $current_grant[1];

142

}

143

            } elseif (!empty($GLOBALS[$current_grant[0]]) && is_array($GLOBALS[$current_grant[0]]) && empty($GLOBALS[$current_grant[0] . '_none'])) {

144

if ($enableHTML) {

145

$priv_string = '<dfn title="' . $current_grant[2] . '">' . $current_grant[1] . '</dfn>';

146

} else {

147

$priv_string = $current_grant[1];

148

}

149

$privs[] = $priv_string . ' (`' . join('`, `', $GLOBALS[$current_grant[0]]) . '`)';

150

} else {

151

$allPrivileges = FALSE;

152

}

153

}

154

}

155

if (empty($privs)) {

156

if ($enableHTML) {

157

$privs[] = '<dfn title="' . $GLOBALS['strPrivDescUsage'] . '">USAGE</dfn>';

158

} else {

159

$privs[] = 'USAGE';

160

}

161

} elseif ($allPrivileges && (!isset($GLOBALS['grant_count']) || count($privs) == $GLOBALS['grant_count'])) {

162

if ($enableHTML) {

163

$privs = array('<dfn title="' . $GLOBALS['strPrivDescAllPrivileges'] . '">ALL PRIVILEGES</dfn>');

164

} else {

165

$privs = array('ALL PRIVILEGES');

166

}

167

}

168

return $privs;

169

} // end of the 'PMA_extractPrivInfo()' function

170

171

172

/**

173

* Displays on which column(s) a table-specific privilege is granted

174

*/

175

function PMA_display_column_privs($spaces, $columns, $row, $name_for_select, $priv_for_header, $name, $name_for_dfn, $name_for_current) {

176

177

echo $spaces . ' <div class="item" id="div_item_' . $name . '">' . "\n"

178

. $spaces . ' <label for="select_' . $name . '_priv">' . "\n"

179

. $spaces . ' <tt><dfn title="' . $name_for_dfn . '">' . $priv_for_header . '</dfn></tt>' . "\n"

180

. $spaces . ' </label>' . "\n"

181

           . $spaces . '        <select id="select_' . $name . '_priv" name="' . $name_for_select . '[]" multiple="multiple">' . "\n";

182

183

foreach ($columns as $current_column => $current_column_privileges) {

184

echo $spaces . ' <option value="' . htmlspecialchars($current_column) . '"';

185

if ($row[$name_for_select] == 'Y' || $current_column_privileges[$name_for_current]) {

186

echo ' selected="selected"';

187

}

188

echo '>' . htmlspecialchars($current_column) . '</option>' . "\n";

189

}

190

191

echo $spaces . ' </select>' . "\n"

192

. $spaces . ' <i>' . $GLOBALS['strOr'] . '</i>' . "\n"

193

           . $spaces . '        <label for="checkbox_' . $name_for_select . '_none"><input type="checkbox"' . (empty($GLOBALS['checkall']) ?  '' : ' checked="checked"') . ' name="' . $name_for_select . '_none" id="checkbox_' . $name_for_select . '_none" title="' . $GLOBALS['strNone'] . '" />'

194

. $GLOBALS['strNone'] . '</label>' . "\n"

195

. $spaces . ' </div>' . "\n";

196

} // end function

197

198

/**

199

* Displays the privileges form table

200

*

201

* @param string $db the database

202

* @param string $table the table

203

* @param boolean $submit wheather to display the submit button or not

204

* @param int $indent the indenting level of the code

205

*

206

* @global array $cfg the phpMyAdmin configuration

207

* @global ressource $user_link the database connection

208

*

209

* @return void

210

*/

211

function PMA_displayPrivTable($db = '*', $table = '*', $submit = TRUE, $indent = 0)

212

{

213

if ($db == '*') {

214

$table = '*';

215

}

216

$spaces = str_repeat( ' ', $indent );

217

218

if (isset($GLOBALS['username'])) {

219

$username = $GLOBALS['username'];

220

$hostname = $GLOBALS['hostname'];

221

if ($db == '*') {

222

$sql_query =

223

'SELECT * FROM `mysql`.`user`'

224

.' WHERE ' . PMA_convert_using('User')

225

.' = ' . PMA_convert_using(PMA_sqlAddslashes($username), 'quoted')

226

.' AND ' . PMA_convert_using('Host')

227

.' = ' . PMA_convert_using($hostname, 'quoted') . ';';

228

} elseif ($table == '*') {

229

$sql_query =

230

'SELECT * FROM `mysql`.`db`'

231

.' WHERE ' . PMA_convert_using('`User`')

232

.' = ' . PMA_convert_using(PMA_sqlAddslashes($username), 'quoted')

233

.' AND ' . PMA_convert_using('`Host`')

234

.' = ' . PMA_convert_using($hostname, 'quoted')

235

.' AND ' . PMA_convert_using( PMA_unescape_mysql_wildcards( $db ), 'quoted' )

236

.' LIKE ' . PMA_convert_using( '`Db`' ) . ';';

237

} else {

238

$sql_query =

239

'SELECT `Table_priv`'

240

.' FROM `mysql`.`tables_priv`'

241

.' WHERE ' . PMA_convert_using('`User`')

242

.' = ' . PMA_convert_using(PMA_sqlAddslashes($username), 'quoted')

243

.' AND ' .PMA_convert_using('`Host`')

244

.' = ' . PMA_convert_using( $hostname, 'quoted' )

245

.' AND ' .PMA_convert_using('`Db`')

246

.' = ' . PMA_convert_using( PMA_unescape_mysql_wildcards( $db ), 'quoted' )

247

.' AND ' . PMA_convert_using('`Table_name`')

248

.' = ' . PMA_convert_using($table, 'quoted') . ';';

249

}

250

$res = PMA_DBI_query($sql_query);

251

$row = PMA_DBI_fetch_assoc($res);

252

PMA_DBI_free_result($res);

253

}

254

if (empty($row)) {

255

if ($table == '*') {

256

if ($db == '*') {

257

$sql_query = 'SHOW COLUMNS FROM `mysql`.`user`;';

258

} elseif ($table == '*') {

259

$sql_query = 'SHOW COLUMNS FROM `mysql`.`db`;';

260

}

261

$res = PMA_DBI_query($sql_query);

262

while ($row1 = PMA_DBI_fetch_row($res)) {

263

if (substr($row1[0], 0, 4) == 'max_') {

264

$row[$row1[0]] = 0;

265

} else {

266

$row[$row1[0]] = 'N';

267

}

268

}

269

PMA_DBI_free_result($res);

270

} else {

271

$row = array('Table_priv' => '');

272

}

273

}

274

if (isset($row['Table_priv'])) {

275

$res = PMA_DBI_query(

276

'SHOW COLUMNS FROM `mysql`.`tables_priv` LIKE \'Table_priv\';',

277

$GLOBALS['userlink'] );

278

// note: in MySQL 5.0.3 we get "Create View', 'Show view';

279

// the View for Create is spelled with uppercase V

280

// the view for Show is spelled with lowercase v

281

// and there is a space between the words

282

283

$row1 = PMA_DBI_fetch_assoc($res);

284

PMA_DBI_free_result($res);

285

        $av_grants = explode ('\',\'', substr($row1['Type'], strpos($row1['Type'], '(') + 2, strpos($row1['Type'], ')') - strpos($row1['Type'], '(') - 3));

286

unset($res, $row1);

287

$users_grants = explode(',', $row['Table_priv']);

288

289

foreach ($av_grants as $current_grant) {

290

$row[$current_grant . '_priv'] = in_array($current_grant, $users_grants) ? 'Y' : 'N';

291

}

292

unset($row['Table_priv'], $current_grant, $av_grants, $users_grants);

293

294

// get collumns

295

$res = PMA_DBI_try_query('SHOW COLUMNS FROM `' . PMA_unescape_mysql_wildcards( $db ) . '`.`' . $table . '`;');

296

$columns = array();

297

if ( $res ) {

298

while ($row1 = PMA_DBI_fetch_row($res)) {

299

$columns[$row1[0]] = array(

300

'Select' => FALSE,

301

'Insert' => FALSE,

302

'Update' => FALSE,

303

'References' => FALSE

304

);

305

}

306

PMA_DBI_free_result($res);

307

}

308

unset($res, $row1);

309

}

310

// t a b l e - s p e c i f i c p r i v i l e g e s

311

if ( ! empty( $columns ) ) {

312

$res = PMA_DBI_query(

313

'SELECT `Column_name`, `Column_priv`'

314

.' FROM `mysql`.`columns_priv`'

315

.' WHERE ' . PMA_convert_using('`User`')

316

.' = ' . PMA_convert_using(PMA_sqlAddslashes($username), 'quoted')

317

.' AND ' . PMA_convert_using('`Host`')

318

.' = ' . PMA_convert_using($hostname, 'quoted')

319

.' AND ' . PMA_convert_using('`Db`')

320

.' = ' . PMA_convert_using( PMA_unescape_mysql_wildcards( $db ), 'quoted')

321

.' AND ' . PMA_convert_using('`Table_name`')

322

.' = ' . PMA_convert_using($table, 'quoted') . ';');

323

324

while ($row1 = PMA_DBI_fetch_row($res)) {

325

$row1[1] = explode(',', $row1[1]);

326

foreach ($row1[1] as $current) {

327

$columns[$row1[0]][$current] = TRUE;

328

}

329

}

330

PMA_DBI_free_result($res);

331

unset( $res, $row1, $current );

332

333

echo $spaces . '<input type="hidden" name="grant_count" value="' . count($row) . '" />' . "\n"

334

. $spaces . '<input type="hidden" name="column_count" value="' . count($columns) . '" />' . "\n"

335

. $spaces . '<fieldset id="fieldset_user_priv">' . "\n"

336

. $spaces . ' <legend>' . $GLOBALS['strTblPrivileges'] . '</legend>' . "\n"

337

. $spaces . ' <p><small><i>' . $GLOBALS['strEnglishPrivileges'] . '</i></small></p>' . "\n";

338

339

340

// privs that are attached to a specific column

341

        PMA_display_column_privs($spaces, $columns, $row, 'Select_priv', 'SELECT', 'select', $GLOBALS['strPrivDescSelect'], 'Select');

342

343

        PMA_display_column_privs($spaces, $columns, $row, 'Insert_priv', 'INSERT', 'insert', $GLOBALS['strPrivDescInsert'], 'Insert');

344

345

        PMA_display_column_privs($spaces, $columns, $row, 'Update_priv', 'UPDATE', 'update', $GLOBALS['strPrivDescUpdate'], 'Update');

346

347

        PMA_display_column_privs($spaces, $columns, $row, 'References_priv', 'REFERENCES', 'references', $GLOBALS['strPrivDescReferences'], 'References');

348

349

// privs that are not attached to a specific column

350

351

echo $spaces . ' <div class="item">' . "\n";

352

foreach ($row as $current_grant => $current_grant_value) {

353

            if (in_array(substr($current_grant, 0, (strlen($current_grant) - 5)), array('Select', 'Insert', 'Update', 'References'))) {

354

continue;

355

}

356

// make a substitution to match the messages variables;

357

// also we must substitute the grant we get, because we can't generate

358

// a form variable containing blanks (those would get changed to

359

// an underscore when receiving the POST)

360

if ($current_grant == 'Create View_priv') {

361

$tmp_current_grant = 'CreateView_priv';

362

$current_grant = 'Create_view_priv';

363

} elseif ($current_grant == 'Show view_priv') {

364

$tmp_current_grant = 'ShowView_priv';

365

$current_grant = 'Show_view_priv';

366

} else {

367

$tmp_current_grant = $current_grant;

368

}

369

370

echo $spaces . ' <div class="item">' . "\n"

371

               . $spaces . '            <input type="checkbox"' . (empty($GLOBALS['checkall']) ?  '' : ' checked="checked"') . ' name="' . $current_grant . '" id="checkbox_' . $current_grant . '" value="Y" ' . ($current_grant_value == 'Y' ? 'checked="checked" ' : '') . 'title="';

372

373

            echo (isset($GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5))]) ? $GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5))] : $GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5)) . 'Tbl']) . '"/>' . "\n";

374

375

            echo $spaces . '            <label for="checkbox_' . $current_grant . '"><tt><dfn title="' . (isset($GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5))]) ? $GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5))] : $GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5)) . 'Tbl']) . '">' . strtoupper(substr($current_grant, 0, strlen($current_grant) - 5)) . '</dfn></tt></label>' . "\n"

376

. $spaces . ' </div>' . "\n";

377

} // end foreach ()

378

379

echo $spaces . ' </div>' . "\n";

380

// for Safari 2.0.2

381

echo $spaces . ' <div class="clearfloat"></div>' . "\n";

382

383

} else {

384

385

// g l o b a l o r d b - s p e c i f i c

386

//

387

// d a t a

388

$privTable[0] = array(

389

array('Select', 'SELECT', $GLOBALS['strPrivDescSelect']),

390

array('Insert', 'INSERT', $GLOBALS['strPrivDescInsert']),

391

array('Update', 'UPDATE', $GLOBALS['strPrivDescUpdate']),

392

array('Delete', 'DELETE', $GLOBALS['strPrivDescDelete'])

393

);

394

if ($db == '*') {

395

$privTable[0][] = array('File', 'FILE', $GLOBALS['strPrivDescFile']);

396

}

397

398

// s t r u c t u r e

399

$privTable[1] = array(

400

            array('Create', 'CREATE', ($table == '*' ? $GLOBALS['strPrivDescCreateDb'] : $GLOBALS['strPrivDescCreateTbl'])),

401

array('Alter', 'ALTER', $GLOBALS['strPrivDescAlter']),

402

array('Index', 'INDEX', $GLOBALS['strPrivDescIndex']),

403

array('Drop', 'DROP', ($table == '*' ? $GLOBALS['strPrivDescDropDb'] : $GLOBALS['strPrivDescDropTbl']))

404

);

405

if (isset($row['Create_tmp_table_priv'])) {

406

            $privTable[1][] = array('Create_tmp_table', 'CREATE TEMPORARY TABLES', $GLOBALS['strPrivDescCreateTmpTable']);

407

}

408

// this one is for a db-specific priv: Create_view_priv

409

if (isset($row['Create_view_priv'])) {

410

$privTable[1][] = array('Create_view', 'CREATE VIEW', $GLOBALS['strPrivDescCreateView']);

411

}

412

// this one is for a table-specific priv: Create View_priv

413

if (isset($row['Create View_priv'])) {

414

$privTable[1][] = array('Create View', 'CREATE VIEW', $GLOBALS['strPrivDescCreateView']);

415

}

416

if (isset($row['Show_view_priv'])) {

417

$privTable[1][] = array('Show_view', 'SHOW VIEW', $GLOBALS['strPrivDescShowView']);

418

}

419

if (isset($row['Create_routine_priv'])) {

420

$privTable[1][] = array('Create_routine', 'CREATE ROUTINE', $GLOBALS['strPrivDescCreateRoutine']);

421

}

422

if (isset($row['Alter_routine_priv'])) {

423

$privTable[1][] = array('Alter_routine', 'ALTER ROUTINE', $GLOBALS['strPrivDescAlterRoutine']);

424

}

425

if (isset($row['Execute_priv'])) {

426

if (PMA_MYSQL_INT_VERSION >= 40002 && PMA_MYSQL_INT_VERSION <50003) {

427

$privTable[1][] = array('Execute', 'EXECUTE', $GLOBALS['strPrivDescExecute']);

428

} else {

429

$privTable[1][] = array('Execute', 'EXECUTE', $GLOBALS['strPrivDescExecute5']);

430

}

431

}

432

433

// a d m i n i s t r a t i o n

434

$privTable[2] = array();

435

if (isset($row['Grant_priv'])) {

436

$privTable[2][] = array('Grant', 'GRANT', $GLOBALS['strPrivDescGrant']);

437

}

438

if ($db == '*') {

439

if (isset($row['Super_priv'])) {

440

$privTable[2][] = array('Super', 'SUPER', $GLOBALS['strPrivDescSuper']);

441

$privTable[2][] = array('Process', 'PROCESS', $GLOBALS['strPrivDescProcess4']);

442

} else {

443

$privTable[2][] = array('Process', 'PROCESS', $GLOBALS['strPrivDescProcess3']);

444

}

445

$privTable[2][] = array('Reload', 'RELOAD', $GLOBALS['strPrivDescReload']);

446

$privTable[2][] = array('Shutdown', 'SHUTDOWN', $GLOBALS['strPrivDescShutdown']);

447

if (isset($row['Show_db_priv'])) {

448

$privTable[2][] = array('Show_db', 'SHOW DATABASES', $GLOBALS['strPrivDescShowDb']);

449

}

450

}

451

if (isset($row['Lock_tables_priv'])) {

452

$privTable[2][] = array('Lock_tables', 'LOCK TABLES', $GLOBALS['strPrivDescLockTables']);

453

}

454

$privTable[2][] = array('References', 'REFERENCES', $GLOBALS['strPrivDescReferences']);

455

if ($db == '*') {

456

//if (isset($row['Execute_priv'])) {

457

// $privTable[2][] = array('Execute', 'EXECUTE', $GLOBALS['strPrivDescExecute']);

458

//}

459

if (isset($row['Repl_client_priv'])) {

460

$privTable[2][] = array('Repl_client', 'REPLICATION CLIENT', $GLOBALS['strPrivDescReplClient']);

461

}

462

if (isset($row['Repl_slave_priv'])) {

463

$privTable[2][] = array('Repl_slave', 'REPLICATION SLAVE', $GLOBALS['strPrivDescReplSlave']);

464

}

465

if (isset($row['Create_user_priv'])) {

466

$privTable[2][] = array('Create_user', 'CREATE USER', $GLOBALS['strPrivDescCreateUser']);

467

}

468

}

469

        echo $spaces . '<input type="hidden" name="grant_count" value="' . (count($privTable[0]) + count($privTable[1]) + count($privTable[2]) - (isset($row['Grant_priv']) ? 1 : 0)) . '" />' . "\n"

470

. $spaces . '<fieldset id="fieldset_user_global_rights">' . "\n"

471

. $spaces . ' <legend>' . "\n"

472

           . $spaces . '        ' . ($db == '*' ? $GLOBALS['strGlobalPrivileges'] : ($table == '*' ? $GLOBALS['strDbPrivileges'] : $GLOBALS['strTblPrivileges'])) . "\n"

473

           . $spaces . '        ( <a href="./server_privileges.php?' . $GLOBALS['url_query'] .  '&amp;checkall=1" onclick="setCheckboxes(\'usersForm\', true); return false;">' . $GLOBALS['strCheckAll'] . '</a> /' . "\n"

474

           . $spaces . '        <a href="./server_privileges.php?' . $GLOBALS['url_query'] .  '" onclick="setCheckboxes(\'usersForm\', false); return false;">' . $GLOBALS['strUncheckAll'] . '</a> )' . "\n"

475

. $spaces . ' </legend>' . "\n"

476

. $spaces . ' <p><small><i>' . $GLOBALS['strEnglishPrivileges'] . '</i></small></p>' . "\n"

477

. $spaces . ' <fieldset>' . "\n"

478

. $spaces . ' <legend>' . $GLOBALS['strData'] . '</legend>' . "\n";

479

foreach ( $privTable[0] as $priv )

480

{

481

echo $spaces . ' <div class="item">' . "\n"

482

               . $spaces . '            <input type="checkbox"' . (empty($GLOBALS['checkall']) ?  '' : ' checked="checked"') . ' name="' . $priv[0] . '_priv" id="checkbox_' . $priv[0] . '_priv" value="Y" ' . ($row[$priv[0] . '_priv'] == 'Y' ? 'checked="checked" ' : '') . 'title="' . $priv[2] . '"/>' . "\n"

483

               . $spaces . '            <label for="checkbox_' . $priv[0] . '_priv"><tt><dfn title="' . $priv[2] . '">' . $priv[1] . '</dfn></tt></label>' . "\n"

484

. $spaces . ' </div>' . "\n";

485

}

486

echo $spaces . ' </fieldset>' . "\n"

487

. $spaces . ' <fieldset>' . "\n"

488

. $spaces . ' <legend>' . $GLOBALS['strStructure'] . '</legend>' . "\n";

489

foreach ( $privTable[1] as $priv )

490

{

491

echo $spaces . ' <div class="item">' . "\n"

492

               . $spaces . '            <input type="checkbox"' . (empty($GLOBALS['checkall']) ?  '' : ' checked="checked"') . ' name="' . $priv[0] . '_priv" id="checkbox_' . $priv[0] . '_priv" value="Y" ' . ($row[$priv[0] . '_priv'] == 'Y' ? 'checked="checked" ' : '') . 'title="' . $priv[2] . '"/>' . "\n"

493

               . $spaces . '            <label for="checkbox_' . $priv[0] . '_priv"><tt><dfn title="' . $priv[2] . '">' . $priv[1] . '</dfn></tt></label>' . "\n"

494

. $spaces . ' </div>' . "\n";

495

}

496

echo $spaces . ' </fieldset>' . "\n"

497

. $spaces . ' <fieldset>' . "\n"

498

. $spaces . ' <legend>' . $GLOBALS['strAdministration'] . '</legend>' . "\n";

499

foreach ( $privTable[2] as $priv )

500

{

501

echo $spaces . ' <div class="item">' . "\n"

502

               . $spaces . '            <input type="checkbox"' . (empty($GLOBALS['checkall']) ?  '' : ' checked="checked"') . ' name="' . $priv[0] . '_priv" id="checkbox_' . $priv[0] . '_priv" value="Y" ' . ($row[$priv[0] . '_priv'] == 'Y' ? 'checked="checked" ' : '') . 'title="' . $priv[2] . '"/>' . "\n"

503

               . $spaces . '            <label for="checkbox_' . $priv[0] . '_priv"><tt><dfn title="' . $priv[2] . '">' . $priv[1] . '</dfn></tt></label>' . "\n"

504

. $spaces . ' </div>' . "\n";

505

}

506

507

echo $spaces . ' </fieldset>' . "\n";

508

// The "Resource limits" box is not displayed for db-specific privs

509

if ($db == '*' && PMA_MYSQL_INT_VERSION >= 40002) {

510

echo $spaces . ' <fieldset>' . "\n"

511

. $spaces . ' <legend>' . $GLOBALS['strResourceLimits'] . '</legend>' . "\n"

512

. $spaces . ' <p><small><i>' . $GLOBALS['strZeroRemovesTheLimit'] . '</i></small></p>' . "\n"

513

. $spaces . ' <div class="item">' . "\n"

514

               . $spaces . '            <label for="text_max_questions"><tt><dfn title="' . $GLOBALS['strPrivDescMaxQuestions'] . '">MAX QUERIES PER HOUR</dfn></tt></label>' . "\n"

515

               . $spaces . '            <input type="text" name="max_questions" id="text_max_questions" value="' . $row['max_questions'] . '" size="11" maxlength="11" title="' . $GLOBALS['strPrivDescMaxQuestions'] . '" />' . "\n"

516

. $spaces . ' </div>' . "\n"

517

. $spaces . ' <div class="item">' . "\n"

518

               . $spaces . '            <label for="text_max_updates"><tt><dfn title="' . $GLOBALS['strPrivDescMaxUpdates'] . '">MAX UPDATES PER HOUR</dfn></tt></label>' . "\n"

519

               . $spaces . '            <input type="text" name="max_updates" id="text_max_updates" value="' . $row['max_updates'] . '" size="11" maxlength="11" title="' . $GLOBALS['strPrivDescMaxUpdates'] . '" />' . "\n"

520

. $spaces . ' </div>' . "\n"

521

. $spaces . ' <div class="item">' . "\n"

522

               . $spaces . '            <label for="text_max_connections"><tt><dfn title="' . $GLOBALS['strPrivDescMaxConnections'] . '">MAX CONNECTIONS PER HOUR</dfn></tt></label>' . "\n"

523

               . $spaces . '            <input type="text" name="max_connections" id="text_max_connections" value="' . $row['max_connections'] . '" size="11" maxlength="11" title="' . $GLOBALS['strPrivDescMaxConnections'] . '" />' . "\n"

524

. $spaces . ' </div>' . "\n";

525

526

if (PMA_MYSQL_INT_VERSION >= 50003) {

527

echo $spaces . ' <div class="item">' . "\n"

528

                   . $spaces . '            <label for="text_max_user_connections"><tt><dfn title="' . $GLOBALS['strPrivDescMaxUserConnections'] . '">MAX USER_CONNECTIONS</dfn></tt></label>' . "\n"

529

                   . $spaces . '            <input type="text" name="max_user_connections" id="text_max_user_connections" value="' . $row['max_user_connections'] . '" size="11" maxlength="11" title="' . $GLOBALS['strPrivDescMaxUserConnections'] . '" />' . "\n"

530

. $spaces . ' </div>' . "\n";

531

}

532

echo $spaces . ' </fieldset>' . "\n";

533

}

534

// for Safari 2.0.2

535

echo $spaces . ' <div class="clearfloat"></div>' . "\n";

536

}

537

echo $spaces . '</fieldset>' . "\n";

538

if ($submit) {

539

echo $spaces . '<fieldset id="fieldset_user_privtable_footer" class="tblFooters">' . "\n"

540

. $spaces . ' <input type="submit" name="update_privs" value="' . $GLOBALS['strGo'] . '" />' . "\n"

541

. $spaces . '</fieldset>' . "\n";

542

}

543

} // end of the 'PMA_displayPrivTable()' function

544

545

546

/**

547

* Displays the fields used by the "new user" form as well as the

548

* "change login information / copy user" form.

549

*

550

* @param string $mode are we creating a new user or are we just

551

* changing one? (allowed values: 'new', 'change')

552

* @param int $indent the indenting level of the code

553

*

554

* @global array $cfg the phpMyAdmin configuration

555

* @global ressource $user_link the database connection

556

*

557

* @return void

558

*/

559

function PMA_displayLoginInformationFields($mode = 'new', $indent = 0 ) {

560

$spaces = str_repeat( ' ', $indent);

561

562

// Get user/host name lengths

563

$fields_info = PMA_DBI_get_fields('mysql', 'user');

564

$username_length = 16;

565

$hostname_length = 41;

566

foreach ($fields_info as $key => $val) {

567

if ($val['Field'] == 'User') {

568

strtok($val['Type'], '()');

569

$v = strtok('()');

570

if (is_int($v)) {

571

$username_length = $v;

572

}

573

} elseif ($val['Field'] == 'Host') {

574

strtok($val['Type'], '()');

575

$v = strtok('()');

576

if (is_int($v)) {

577

$hostname_length = $v;

578

}

579

}

580

}

581

unset($fields_info);

582

583

if ( isset( $GLOBALS['username'] ) && strlen( $GLOBALS['username'] ) === 0 ) {

584

$GLOBALS['pred_username'] = 'any';

585

}

586

echo $spaces . '<fieldset id="fieldset_add_user_login">' . "\n"

587

. $spaces . '<legend>' . $GLOBALS['strLoginInformation'] . '</legend>' . "\n"

588

. $spaces . '<div class="item">' . "\n"

589

. $spaces . '<label for="select_pred_username">' . "\n"

590

. $spaces . ' ' . $GLOBALS['strUserName'] . ':' . "\n"

591

. $spaces . '</label>' . "\n"

592

. $spaces . '<span class="options">' . "\n"

593

       . $spaces . '    <select name="pred_username" id="select_pred_username" title="' . $GLOBALS['strUserName'] . '"' . "\n"

594

       . $spaces . '        onchange="if (this.value == \'any\') { username.value = \'\'; } else if (this.value == \'userdefined\') { username.focus(); username.select(); }">' . "\n"

595

       . $spaces . '        <option value="any"' . ((isset($GLOBALS['pred_username']) && $GLOBALS['pred_username'] == 'any') ? ' selected="selected"' : '') . '>' . $GLOBALS['strAnyUser'] . '</option>' . "\n"

596

       . $spaces . '        <option value="userdefined"' . ((!isset($GLOBALS['pred_username']) || $GLOBALS['pred_username'] == 'userdefined') ? ' selected="selected"' : '') . '>' . $GLOBALS['strUseTextField'] . ':</option>' . "\n"

597

. $spaces . ' </select>' . "\n"

598

. $spaces . '</span>' . "\n"

599

       . $spaces . '<input type="text" name="username" maxlength="' . $username_length . '" title="' . $GLOBALS['strUserName'] . '"' . (empty($GLOBALS['username']) ? '' : ' value="' . (isset($GLOBALS['new_username']) ? $GLOBALS['new_username'] : $GLOBALS['username']) . '"') . ' onchange="pred_username.value = \'userdefined\';" />' . "\n"

600

. $spaces . '</div>' . "\n"

601

. $spaces . '<div class="item">' . "\n"

602

. $spaces . '<label for="select_pred_hostname">' . "\n"

603

. $spaces . ' ' . $GLOBALS['strHost'] . ':' . "\n"

604

. $spaces . '</label>' . "\n"

605

. $spaces . '<span class="options">' . "\n"

606

       . $spaces . '    <select name="pred_hostname" id="select_pred_hostname" title="' . $GLOBALS['strHost'] . '"' . "\n";

607

$res = PMA_DBI_query('SELECT USER();');

608

$row = PMA_DBI_fetch_row($res);

609

PMA_DBI_free_result($res);

610

unset($res);

611

if (!empty($row[0])) {

612

$thishost = str_replace("'", '', substr($row[0], (strrpos($row[0], '@') + 1)));

613

if ($thishost == 'localhost' || $thishost == '127.0.0.1') {

614

unset($thishost);

615

}

616

}

617

    echo $spaces . '    onchange="if (this.value == \'any\') { hostname.value = \'%\'; } else if (this.value == \'localhost\') { hostname.value = \'localhost\'; } '

618

       . (empty($thishost) ? '' : 'else if (this.value == \'thishost\') { hostname.value = \'' . addslashes(htmlspecialchars($thishost)) . '\'; } ')

619

       . 'else if (this.value == \'hosttable\') { hostname.value = \'\'; } else if (this.value == \'userdefined\') { hostname.focus(); hostname.select(); }">' . "\n";

620

unset($row);

621

622

// when we start editing a user, $GLOBALS['pred_hostname'] is not defined

623

if (!isset($GLOBALS['pred_hostname']) && isset($GLOBALS['hostname'])) {

624

switch (strtolower($GLOBALS['hostname'])) {

625

case 'localhost':

626

case '127.0.0.1':

627

$GLOBALS['pred_hostname'] = 'localhost';

628

break;

629

case '%':

630

$GLOBALS['pred_hostname'] = 'any';

631

break;

632

default:

633

$GLOBALS['pred_hostname'] = 'userdefined';

634

break;

635

}

636

}

637

    echo $spaces . '        <option value="any"' . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'any') ? ' selected="selected"' : '') . '>' . $GLOBALS['strAnyHost'] . '</option>' . "\n"

638

       . $spaces . '        <option value="localhost"' . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'localhost') ? ' selected="selected"' : '') . '>' . $GLOBALS['strLocalhost'] . '</option>' . "\n";

639

if (!empty($thishost)) {

640

        echo $spaces . '        <option value="thishost"' . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'thishost') ? ' selected="selected"' : '') . '>' . $GLOBALS['strThisHost'] . '</option>' . "\n";

641

}

642

unset($thishost);

643

    echo $spaces . '        <option value="hosttable"' . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'hosttable') ? ' selected="selected"' : '') . '>' . $GLOBALS['strUseHostTable'] . '</option>' . "\n"

644

       . $spaces . '        <option value="userdefined"' . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'userdefined') ? ' selected="selected"' : '') . '>' . $GLOBALS['strUseTextField'] . ':</option>' . "\n"

645

. $spaces . ' </select>' . "\n"

646

. $spaces . '</span>' . "\n"

647

       . $spaces . '<input type="text" name="hostname" maxlength="' . $hostname_length . '" value="' . ( isset($GLOBALS['hostname']) ? $GLOBALS['hostname'] : '' ) . '" title="' . $GLOBALS['strHost'] . '" onchange="pred_hostname.value = \'userdefined\';" />' . "\n"

648

. $spaces . '</div>' . "\n"

649

. $spaces . '<div class="item">' . "\n"

650

. $spaces . '<label for="select_pred_password">' . "\n"

651

. $spaces . ' ' . $GLOBALS['strPassword'] . ':' . "\n"

652

. $spaces . '</label>' . "\n"

653

. $spaces . '<span class="options">' . "\n"

654

       . $spaces . '    <select name="pred_password" id="select_pred_password" title="' . $GLOBALS['strPassword'] . '"' . "\n"

655

       . $spaces . '            onchange="if (this.value == \'none\') { pma_pw.value = \'\'; pma_pw2.value = \'\'; } else if (this.value == \'userdefined\') { pma_pw.focus(); pma_pw.select(); }">' . "\n"

656

       . ($mode == 'change' ? $spaces . '            <option value="keep" selected="selected">' . $GLOBALS['strKeepPass'] . '</option>' . "\n" : '')

657

. $spaces . ' <option value="none"';

658

if ( isset( $GLOBALS['username'] ) && $mode != 'change' ) {

659

echo ' selected="selected"';

660

}

661

echo $spaces . '>' . $GLOBALS['strNoPassword'] . '</option>' . "\n"

662

       . $spaces . '        <option value="userdefined"' . ( isset( $GLOBALS['username'] ) ? '' : ' selected="selected"') . '>' . $GLOBALS['strUseTextField'] . ':</option>' . "\n"

663

. $spaces . ' </select>' . "\n"

664

. $spaces . '</span>' . "\n"

665

       . $spaces . '<input type="password" id="text_pma_pw" name="pma_pw" title="' . $GLOBALS['strPassword'] . '" onchange="pred_password.value = \'userdefined\';" />' . "\n"

666

. $spaces . '</div>' . "\n"

667

. $spaces . '<div class="item">' . "\n"

668

. $spaces . '<label for="text_pma_pw2">' . "\n"

669

. $spaces . ' ' . $GLOBALS['strReType'] . ':' . "\n"

670

. $spaces . '</label>' . "\n"

671

. $spaces . '<span class="options"> </span>' . "\n"

672

       . $spaces . '<input type="password" name="pma_pw2" id="text_pma_pw2" title="' . $GLOBALS['strReType'] . '" onchange="pred_password.value = \'userdefined\';" />' . "\n"

673

. $spaces . '</div>' . "\n"

674

. $spaces . '<div class="item">' . "\n"

675

. $spaces . '<label for="button_generate_password">' . "\n"

676

. $spaces . ' ' . $GLOBALS['strGeneratePassword'] . ':' . "\n"

677

. $spaces . '</label>' . "\n"

678

. $spaces . '<span class="options">' . "\n"

679

       . $spaces . '    <input type="button" id="button_generate_password" value="' . $GLOBALS['strGenerate'] . '" onclick="suggestPassword()" />' . "\n"

680

       . $spaces . '    <input type="button" id="button_copy_password" value="' . $GLOBALS['strCopy'] . '" onclick="suggestPasswordCopy(this.form)" />' . "\n"

681

. $spaces . '</span>' . "\n"

682

. $spaces . '<input type="text" name="generated_pw" id="generated_pw" />' . "\n"

683

. $spaces . '</div>' . "\n"

684

. $spaces . '</fieldset>' . "\n";

685

} // end of the 'PMA_displayUserAndHostFields()' function

686

687

688

/**

689

* Changes / copies a user, part I

690

*/

691

if (!empty($change_copy)) {

692

$user_host_condition =

693

' WHERE ' . PMA_convert_using('User')

694

.' = ' . PMA_convert_using(PMA_sqlAddslashes($old_username), 'quoted')

695

.' AND ' . PMA_convert_using('Host')

696

.' = ' . PMA_convert_using($old_hostname, 'quoted') . ';';

697

$res = PMA_DBI_query('SELECT * FROM `mysql`.`user` ' . $user_host_condition);

698

if (!$res) {

699

$message = $GLOBALS['strNoUsersFound'];

700

unset($change_copy);

701

} else {

702

$row = PMA_DBI_fetch_assoc($res);

703

extract($row, EXTR_OVERWRITE);

704

// Recent MySQL versions have the field "Password" in mysql.user,

705

// so the previous extract creates $Password but this script

706

// uses $password

707

if (!isset($password) && isset($Password)) {

708

$password=$Password;

709

}

710

PMA_DBI_free_result($res);

711

$queries = array();

712

}

713

}

714

715

716

/**

717

* Adds a user

718

* (Changes / copies a user, part II)

719

*/

720

if (!empty($adduser_submit) || !empty($change_copy)) {

721

unset($sql_query);

722

if ($pred_username == 'any') {

723

$username = '';

724

}

725

switch ($pred_hostname) {

726

case 'any':

727

$hostname = '%';

728

break;

729

case 'localhost':

730

$hostname = 'localhost';

731

break;

732

case 'hosttable':

733

$hostname = '';

734

break;

735

case 'thishost':

736

$res = PMA_DBI_query('SELECT USER();');

737

$row = PMA_DBI_fetch_row($res);

738

PMA_DBI_free_result($res);

739

unset($res);

740

$hostname = substr($row[0], (strrpos($row[0], '@') + 1));

741

unset($row);

742

break;

743

}

744

$res = PMA_DBI_query(

745

'SELECT \'foo\' FROM `mysql`.`user`'

746

.' WHERE ' . PMA_convert_using('User')

747

.' = ' . PMA_convert_using(PMA_sqlAddslashes($username), 'quoted')

748

.' AND ' . PMA_convert_using('Host')

749

.' = ' . PMA_convert_using($hostname, 'quoted') . ';',

750

null, PMA_DBI_QUERY_STORE);

751

if (PMA_DBI_num_rows($res) == 1) {

752

PMA_DBI_free_result($res);

753

$message = sprintf($GLOBALS['strUserAlreadyExists'], '[i]\'' . $username . '\'@\'' . $hostname . '\'[/i]');

754

$adduser = 1;

755

} else {

756

PMA_DBI_free_result($res);

757

758

if (50002 <= PMA_MYSQL_INT_VERSION) {

759

// MySQL 5 requires CREATE USER before any GRANT on this user can done

760

$create_user_real = 'CREATE USER \'' . PMA_sqlAddslashes($username) . '\'@\'' . $hostname . '\'';

761

}

762

763

$real_sql_query =

764

'GRANT ' . join(', ', PMA_extractPrivInfo()) . ' ON *.* TO \''

765

. PMA_sqlAddslashes($username) . '\'@\'' . $hostname . '\'';

766

if ($pred_password != 'none' && $pred_password != 'keep') {

767

$pma_pw_hidden = str_repeat('*', strlen($pma_pw));

768

$sql_query = $real_sql_query . ' IDENTIFIED BY \'' . $pma_pw_hidden . '\'';

769

$real_sql_query .= ' IDENTIFIED BY \'' . PMA_sqlAddslashes($pma_pw) . '\'';

770

if ( isset( $create_user_real ) ) {

771

$create_user_show = $create_user_real . ' IDENTIFIED BY \'' . $pma_pw_hidden . '\'';

772

$create_user_real .= ' IDENTIFIED BY \'' . PMA_sqlAddslashes($pma_pw) . '\'';

773

}

774

} else {

775

if ($pred_password == 'keep' && !empty($password)) {

776

$real_sql_query .= ' IDENTIFIED BY PASSWORD \'' . $password . '\'';

777

if ( isset( $create_user_real ) ) {

778

$create_user_real .= ' IDENTIFIED BY PASSWORD \'' . $password . '\'';

779

}

780

}

781

$sql_query = $real_sql_query;

782

if ( isset( $create_user_real ) ) {

783

$create_user_show = $create_user_real;

784

}

785

}

786

// FIXME: similar code appears twice in this script

787

        if ((isset($Grant_priv) && $Grant_priv == 'Y') || (PMA_MYSQL_INT_VERSION >= 40002 && (isset($max_questions) || isset($max_connections) || isset($max_updates) || isset($max_user_connections)))) {

788

$real_sql_query .= 'WITH';

789

$sql_query .= 'WITH';

790

if (isset($Grant_priv) && $Grant_priv == 'Y') {

791

$real_sql_query .= ' GRANT OPTION';

792

$sql_query .= ' GRANT OPTION';

793

}

794

if (PMA_MYSQL_INT_VERSION >= 40002) {

795

if (isset($max_questions)) {

796

// avoid negative values

797

$max_questions = max(0, (int)$max_questions);

798

$real_sql_query .= ' MAX_QUERIES_PER_HOUR ' . $max_questions;

799

$sql_query .= ' MAX_QUERIES_PER_HOUR ' . $max_questions;

800

}

801

if (isset($max_connections)) {

802

$max_connections = max(0, (int)$max_connections);

803

$real_sql_query .= ' MAX_CONNECTIONS_PER_HOUR ' . $max_connections;

804

$sql_query .= ' MAX_CONNECTIONS_PER_HOUR ' . $max_connections;

805

}

806

if (isset($max_updates)) {

807

$max_updates = max(0, (int)$max_updates);

808

$real_sql_query .= ' MAX_UPDATES_PER_HOUR ' . $max_updates;

809

$sql_query .= ' MAX_UPDATES_PER_HOUR ' . $max_updates;

810

}

811

}

812

if (PMA_MYSQL_INT_VERSION >= 50003) {

813

if (isset($max_user_connections)) {

814

$max_user_connections = max(0, (int)$max_user_connections);

815

$real_sql_query .= ' MAX_USER_CONNECTIONS ' . $max_user_connections;

816

$sql_query .= ' MAX_USER_CONNECTIONS ' . $max_user_connections;

817

}

818

}

819

}

820

if ( isset( $create_user_real ) ) {

821

$create_user_real .= ';';

822

$create_user_show .= ';';

823

}

824

$real_sql_query .= ';';

825

$sql_query .= ';';

826

if (empty($change_copy)) {

827

if ( isset( $create_user_real ) ) {

828

PMA_DBI_try_query($create_user_real) or PMA_mysqlDie(PMA_DBI_getError(), $create_user_show);

829

$sql_query = $create_user_show . $sql_query;

830

}

831

PMA_DBI_try_query($real_sql_query) or PMA_mysqlDie(PMA_DBI_getError(), $sql_query);

832

$message = $GLOBALS['strAddUserMessage'];

833

} else {

834

if ( isset( $create_user_real ) ) {

835

$queries[] = $create_user_real;

836

}

837

$queries[] = $real_sql_query;

838

// we put the query containing the hidden password in

839

// $queries_for_display, at the same position occupied

840

// by the real query in $queries

841

$tmp_count = count($queries);

842

if ( isset( $create_user_real ) ) {

843

$queries_for_display[$tmp_count - 2] = $create_user_show;

844

}

845

$queries_for_display[$tmp_count - 1] = $sql_query;

846

}

847

unset($res, $real_sql_query);

848

}

849

}

850

851

852

/**

853

* Changes / copies a user, part III

854

*/

855

if (!empty($change_copy)) {

856

$user_host_condition =

857

' WHERE ' . PMA_convert_using('User')

858

.' = ' . PMA_convert_using(PMA_sqlAddslashes($old_username), 'quoted')

859

.' AND ' . PMA_convert_using('Host')

860

.' = ' . PMA_convert_using($old_hostname, 'quoted') . ';';

861

$res = PMA_DBI_query('SELECT * FROM `mysql`.`db`' . $user_host_condition );

862

while ($row = PMA_DBI_fetch_assoc($res)) {

863

$queries[] =

864

'GRANT ' . join(', ', PMA_extractPrivInfo($row))

865

.' ON `' . $row['Db'] . '`.*'

866

.' TO \'' . PMA_sqlAddslashes($username) . '\'@\'' . $hostname . '\''

867

. ( $row['Grant_priv'] == 'Y' ? ' WITH GRANT OPTION;' : ';' );

868

}

869

PMA_DBI_free_result($res);

870

$res = PMA_DBI_query(

871

'SELECT `Db`, `Table_name`, `Table_priv`'

872

.' FROM `mysql`.`tables_priv`' . $user_host_condition,

873

$GLOBALS['userlink'], PMA_DBI_QUERY_STORE );

874

while ($row = PMA_DBI_fetch_assoc($res)) {

875

876

$res2 = PMA_DBI_QUERY(

877

'SELECT `Column_name`, `Column_priv`'

878

.' FROM `mysql`.`columns_priv`'

879

.' WHERE ' . PMA_convert_using('User')

880

.' = ' . PMA_convert_using(PMA_sqlAddslashes($old_username), 'quoted')

881

.' AND ' . PMA_convert_using('`Host`')

882

.' = ' . PMA_convert_using($old_hostname, 'quoted')

883

.' AND ' . PMA_convert_using('`Db`')

884

.' = ' . PMA_convert_using($row['Db'], 'quoted')

885

.' AND ' . PMA_convert_using('`Table_name`')

886

.' = ' . PMA_convert_using($row['Table_name'], 'quoted')

887

.';',

888

null, PMA_DBI_QUERY_STORE);

889

890

$tmp_privs1 = PMA_extractPrivInfo($row);

891

$tmp_privs2 = array(

892

'Select' => array(),

893

'Insert' => array(),

894

'Update' => array(),

895

'References' => array()

896

);

897

898

while ($row2 = PMA_DBI_fetch_assoc($res2)) {

899

$tmp_array = explode(',', $row2['Column_priv']);

900

if (in_array('Select', $tmp_array)) {

901

$tmp_privs2['Select'][] = $row2['Column_name'];

902

}

903

if (in_array('Insert', $tmp_array)) {

904

$tmp_privs2['Insert'][] = $row2['Column_name'];

905

}

906

if (in_array('Update', $tmp_array)) {

907

$tmp_privs2['Update'][] = $row2['Column_name'];

908

}

909

if (in_array('References', $tmp_array)) {

910

$tmp_privs2['References'][] = $row2['Column_name'];

911

}

912

unset($tmp_array);

913

}

914

if (count($tmp_privs2['Select']) > 0 && !in_array('SELECT', $tmp_privs1)) {

915

$tmp_privs1[] = 'SELECT (`' . join('`, `', $tmp_privs2['Select']) . '`)';

916

}

917

if (count($tmp_privs2['Insert']) > 0 && !in_array('INSERT', $tmp_privs1)) {

918

$tmp_privs1[] = 'INSERT (`' . join('`, `', $tmp_privs2['Insert']) . '`)';

919

}

920

if (count($tmp_privs2['Update']) > 0 && !in_array('UPDATE', $tmp_privs1)) {

921

$tmp_privs1[] = 'UPDATE (`' . join('`, `', $tmp_privs2['Update']) . '`)';

922

}

923

if (count($tmp_privs2['References']) > 0 && !in_array('REFERENCES', $tmp_privs1)) {

924

$tmp_privs1[] = 'REFERENCES (`' . join('`, `', $tmp_privs2['References']) . '`)';

925

}

926

unset($tmp_privs2);

927

$queries[] =

928

'GRANT ' . join(', ', $tmp_privs1)

929

. ' ON `' . $row['Db'] . '`.`' . $row['Table_name']

930

. '` TO \'' . PMA_sqlAddslashes($username) . '\'@\'' . $hostname . '\''

931

. (in_array('Grant', explode(',', $row['Table_priv'])) ? ' WITH GRANT OPTION;' : ';');

932

}

933

}

934

935

936

/**

937

* Updates privileges

938

*/

939

if (!empty($update_privs)) {

940

// escaping a wildcard character in a GRANT is only accepted at the global

941

// or database level, not at table level; this is why I remove

942

// the escaping character

943

// Note: in the phpMyAdmin list of Database-specific privileges,

944

// we will have for example

945

// test\_db SELECT (this one is for privileges on a db level)

946

// test_db USAGE (this one is for table-specific privileges)

947

//

948

// It looks curious but reflects the way MySQL works

949

950

if (! isset($dbname) || ! strlen($dbname)) {

951

$db_and_table = '*.*';

952

} else {

953

if ( isset( $tablename ) && strlen($tablename) ) {

954

$db_and_table = PMA_backquote( PMA_unescape_mysql_wildcards( $dbname ) ) . '.';

955

$db_and_table .= PMA_backquote( $tablename );

956

} else {

957

$db_and_table = PMA_backquote( $dbname ) . '.';

958

$db_and_table .= '*';

959

}

960

}

961

962

$sql_query0 =

963

'REVOKE ALL PRIVILEGES ON ' . $db_and_table

964

. ' FROM \'' . PMA_sqlAddslashes($username) . '\'@\'' . $hostname . '\';';

965

if (!isset($Grant_priv) || $Grant_priv != 'Y') {

966

$sql_query1 =

967

'REVOKE GRANT OPTION ON ' . $db_and_table

968

. ' FROM \'' . PMA_sqlAddslashes($username) . '\'@\'' . $hostname . '\';';

969

}

970

$sql_query2 =

971

'GRANT ' . join(', ', PMA_extractPrivInfo())

972

. ' ON ' . $db_and_table

973

. ' TO \'' . PMA_sqlAddslashes($username) . '\'@\'' . $hostname . '\'';

974

975

// FIXME: similar code appears twice in this script

976

if ( ( isset($Grant_priv) && $Grant_priv == 'Y')

977

|| ( ( ! isset($dbname) || ! strlen($dbname) ) && PMA_MYSQL_INT_VERSION >= 40002

978

&& ( isset($max_questions) || isset($max_connections)

979

|| isset($max_updates) || isset($max_user_connections))))

980

{

981

$sql_query2 .= 'WITH';

982

if (isset($Grant_priv) && $Grant_priv == 'Y') {

983

$sql_query2 .= ' GRANT OPTION';

984

}

985

if (PMA_MYSQL_INT_VERSION >= 40002) {

986

if (isset($max_questions)) {

987

$max_questions = max(0, (int)$max_questions);

988

$sql_query2 .= ' MAX_QUERIES_PER_HOUR ' . $max_questions;

989

}

990

if (isset($max_connections)) {

991

$max_connections = max(0, (int)$max_connections);

992

$sql_query2 .= ' MAX_CONNECTIONS_PER_HOUR ' . $max_connections;

993

}

994

if (isset($max_updates)) {

995

$max_updates = max(0, (int)$max_updates);

996

$sql_query2 .= ' MAX_UPDATES_PER_HOUR ' . $max_updates;

997

}

998

}

999

if (PMA_MYSQL_INT_VERSION >= 50003) {

1000

if (isset($max_user_connections)) {

1001

$max_user_connections = max(0, (int)$max_user_connections);

1002

$sql_query2 .= ' MAX_USER_CONNECTIONS ' . $max_user_connections;

1003

}

1004

}

1005

}

1006

$sql_query2 .= ';';

1007

if (!PMA_DBI_try_query($sql_query0)) { // this query may fail, but this does not matter :o)

1008

unset($sql_query0);

1009

}

1010

if (isset($sql_query1) && !PMA_DBI_try_query($sql_query1)) { // this one may fail, too...

1011

unset($sql_query1);

1012

}

1013

PMA_DBI_query($sql_query2);

1014

$sql_query = (isset($sql_query0) ? $sql_query0 . ' ' : '')

1015

. (isset($sql_query1) ? $sql_query1 . ' ' : '')

1016

. $sql_query2;

1017

$message = sprintf($GLOBALS['strUpdatePrivMessage'], '\'' . $username . '\'@\'' . $hostname . '\'');

1018

}

1019

1020

1021

/**

1022

* Revokes Privileges

1023

*/

1024

if (!empty($revokeall)) {

1025

1026

if ( ! isset($dbname) || ! strlen($dbname) ) {

1027

$db_and_table = '*.*';

1028

} else {

1029

if ( ! isset( $tablename ) || ! strlen($tablename) ) {

1030

$db_and_table = PMA_backquote( $dbname ) . '.';

1031

$db_and_table .= '*';

1032

} else {

1033

$db_and_table = PMA_backquote( PMA_unescape_mysql_wildcards( $dbname ) ) . '.';

1034

$db_and_table .= PMA_backquote( $tablename );

1035

}

1036

}

1037

1038

$sql_query0 =

1039

'REVOKE ALL PRIVILEGES ON ' . $db_and_table

1040

. ' FROM \'' . $username . '\'@\'' . $hostname . '\';';

1041

$sql_query1 =

1042

'REVOKE GRANT OPTION ON ' . $db_and_table

1043

. ' FROM \'' . $username . '\'@\'' . $hostname . '\';';

1044

PMA_DBI_query($sql_query0);

1045

if (!PMA_DBI_try_query($sql_query1)) { // this one may fail, too...

1046

unset($sql_query1);

1047

}

1048

$sql_query = $sql_query0 . (isset($sql_query1) ? ' ' . $sql_query1 : '');

1049

$message = sprintf($GLOBALS['strRevokeMessage'], '\'' . $username . '\'@\'' . $hostname . '\'');

1050

if ( ! isset($tablename) || ! strlen($tablename) ) {

1051

unset($dbname);

1052

} else {

1053

unset($tablename);

1054

}

1055

}

1056

1057

1058

/**

1059

* Updates the password

1060

*/

1061

if (!empty($change_pw)) {

1062

if ($nopass == 1) {

1063

$sql_query = 'SET PASSWORD FOR \'' . $username . '\'@\'' . $hostname . '\' = \'\';';

1064

PMA_DBI_query($sql_query);

1065

$message = sprintf($GLOBALS['strPasswordChanged'], '\'' . $username . '\'@\'' . $hostname . '\'');

1066

} elseif (empty($pma_pw) || empty($pma_pw2)) {

1067

$message = $GLOBALS['strPasswordEmpty'];

1068

} elseif ($pma_pw != $pma_pw2) {

1069

$message = $GLOBALS['strPasswordNotSame'];

1070

} else {

1071

$hidden_pw = '';

1072

for ($i = 0; $i < strlen($pma_pw); $i++) {

1073

$hidden_pw .= '*';

1074

}

1075

        $local_query = 'SET PASSWORD FOR \'' . PMA_sqlAddslashes($username) . '\'@\'' . $hostname . '\' = PASSWORD(\'' . PMA_sqlAddslashes($pma_pw) . '\')';

1076

        $sql_query = 'SET PASSWORD FOR \'' . PMA_sqlAddslashes($username) . '\'@\'' . $hostname . '\' = PASSWORD(\'' . $hidden_pw . '\')';

1077

PMA_DBI_try_query($local_query) or PMA_mysqlDie(PMA_DBI_getError(), $sql_query);

1078

$message = sprintf($GLOBALS['strPasswordChanged'], '\'' . $username . '\'@\'' . $hostname . '\'');

1079

}

1080

}

1081

1082

1083

/**

1084

* Deletes users

1085

* (Changes / copies a user, part IV)

1086

*/

1087

$user_host_separator = chr(27);

1088

1089

if (!empty($delete) || (!empty($change_copy) && $mode < 4)) {

1090

if (!empty($change_copy)) {

1091

$selected_usr = array($old_username . $user_host_separator . $old_hostname);

1092

} else {

1093

$queries = array();

1094

}

1095

for ($i = 0; isset($selected_usr[$i]); $i++) {

1096

list($this_user, $this_host) = explode($user_host_separator, $selected_usr[$i]);

1097

$queries[] = '# ' . sprintf($GLOBALS['strDeleting'], '\'' . $this_user . '\'@\'' . $this_host . '\'') . ' ...';

1098

if ( PMA_MYSQL_INT_VERSION >= 50002 ) {

1099

$queries[] = 'DROP USER \'' . PMA_sqlAddslashes($this_user) . '\'@\'' . $this_host . '\';';

1100

} else {

1101

if ($mode == 2) {

1102

// The SHOW GRANTS query may fail if the user has not been loaded

1103

// into memory

1104

                $res = PMA_DBI_try_query('SHOW GRANTS FOR \'' . PMA_sqlAddslashes($this_user) . '\'@\'' . $this_host . '\';');

1105

if ($res) {

1106

                    $queries[] = 'REVOKE ALL PRIVILEGES ON *.* FROM \'' . PMA_sqlAddslashes($this_user) . '\'@\'' . $this_host . '\';';

1107

while ($row = PMA_DBI_fetch_row($res)) {

1108

                        $this_table = substr($row[0], (strpos($row[0], 'ON') + 3), (strpos($row[0], ' TO ') - strpos($row[0], 'ON') - 3));

1109

if ($this_table != '*.*') {

1110

                            $queries[] = 'REVOKE ALL PRIVILEGES ON ' . $this_table . ' FROM \'' . PMA_sqlAddslashes($this_user) . '\'@\'' . $this_host . '\';';

1111

1112

if (strpos($row[0], 'WITH GRANT OPTION')) {

1113

                                $queries[] = 'REVOKE GRANT OPTION ON ' . $this_table . ' FROM \'' . PMA_sqlAddslashes($this_user) . '\'@\'' . $this_host . '\';';

1114

}

1115

}

1116

unset($this_table);

1117

}

1118

PMA_DBI_free_result($res);

1119

}

1120

unset($res);

1121

}

1122

if ( PMA_MYSQL_INT_VERSION >= 40101 ) {

1123

$queries[] = 'DROP USER \'' . PMA_sqlAddslashes($this_user) . '\'@\'' . $this_host . '\';';

1124

} else {

1125

                $queries[] = 'DELETE FROM `mysql`.`user` WHERE ' . PMA_convert_using('User') . ' = ' . PMA_convert_using(PMA_sqlAddslashes($this_user), 'quoted') . ' AND ' . PMA_convert_using('Host') . ' = ' . PMA_convert_using($this_host, 'quoted') . ';';

1126

}

1127

if ($mode != 2) {

1128

// If we REVOKE the table grants, we should not need to modify the

1129

// `mysql`.`db`, `mysql`.`tables_priv` and `mysql`.`columns_priv` tables manually...

1130

$user_host_condition =

1131

' WHERE ' . PMA_convert_using('User')

1132

. ' = ' . PMA_convert_using(PMA_sqlAddslashes($this_user), 'quoted')

1133

. ' AND ' . PMA_convert_using('Host')

1134

. ' = ' . PMA_convert_using($this_host, 'quoted') . ';';

1135

$queries[] = 'DELETE FROM `mysql`.`db`' . $user_host_condition;

1136

$queries[] = 'DELETE FROM `mysql`.`tables_priv`' . $user_host_condition;

1137

$queries[] = 'DELETE FROM `mysql`.`columns_priv`' . $user_host_condition;

1138

}

1139

}

1140

if (!empty($drop_users_db)) {

1141

$queries[] = 'DROP DATABASE IF EXISTS ' . PMA_backquote($this_user) . ';';

1142

$GLOBALS['reload'] = TRUE;

1143

PMA_reloadNavigation();

1144

}

1145

}

1146

if (empty($change_copy)) {

1147

if (empty($queries)) {

1148

$show_error_header = TRUE;

1149

$message = $GLOBALS['strDeleteNoUsersSelected'];

1150

} else {

1151

if ($mode == 3) {

1152

$queries[] = '# ' . $GLOBALS['strReloadingThePrivileges'] . ' ...';

1153

$queries[] = 'FLUSH PRIVILEGES;';

1154

}

1155

foreach ($queries as $sql_query) {

1156

if ($sql_query{0} != '#') {

1157

PMA_DBI_query($sql_query, $GLOBALS['userlink']);

1158

}

1159

}

1160

$sql_query = join("\n", $queries);

1161

$message = $GLOBALS['strUsersDeleted'];

1162

}

1163

unset($queries);

1164

}

1165

}

1166

1167

1168

/**

1169

* Changes / copies a user, part V

1170

*/

1171

if (!empty($change_copy)) {

1172

$tmp_count = 0;

1173

foreach ($queries as $sql_query) {

1174

if ($sql_query{0} != '#') {

1175

PMA_DBI_query($sql_query);

1176

}

1177

// when there is a query containing a hidden password, take it

1178

// instead of the real query sent

1179

if (isset($queries_for_display[$tmp_count])) {

1180

$queries[$tmp_count] = $queries_for_display[$tmp_count];

1181

}

1182

$tmp_count++;

1183

}

1184

$message = $GLOBALS['strSuccess'];

1185

$sql_query = join("\n", $queries);

1186

}

1187

1188

1189

/**

1190

* Reloads the privilege tables into memory

1191

*/

1192

if (!empty($flush_privileges)) {

1193

$sql_query = 'FLUSH PRIVILEGES;';

1194

PMA_DBI_query($sql_query);

1195

$message = $GLOBALS['strPrivilegesReloaded'];

1196

}

1197

1198

1199

/**

1200

* Displays the links

1201

*/

1202

if (isset($viewing_mode) && $viewing_mode == 'db') {

1203

$db = $checkprivs;

1204

$url_query .= '&goto=db_operations.php';

1205

1206

// Gets the database structure

1207

$sub_part = '_structure';

1208

require('./libraries/db_details_db_info.inc.php');

1209

echo "\n";

1210

} else {

1211

require('./libraries/server_links.inc.php');

1212

}

1213

1214

1215

/**

1216

* defines some standard links

1217

*/

1218

$link_edit = '<a href="server_privileges.php?' . $GLOBALS['url_query']

1219

.'&username=%s'

1220

.'&hostname=%s'

1221

.'&dbname=%s'

1222

.'&tablename=%s">';

1223

if ( $GLOBALS['cfg']['PropertiesIconic'] ) {

1224

    $link_edit .= '<img class="icon" src="' . $GLOBALS['pmaThemeImage'] . 'b_usredit.png" width="16" height="16" alt="' . $GLOBALS['strEditPrivileges'] . '" title="' . $GLOBALS['strEditPrivileges'] . '" />';

1225

} else {

1226

$link_edit .= $GLOBALS['strEditPrivileges'];

1227

}

1228

$link_edit .= '</a>';

1229

1230

$link_revoke = '<a href="server_privileges.php?' . $GLOBALS['url_query']

1231

.'&username=%s'

1232

.'&hostname=%s'

1233

.'&dbname=%s'

1234

.'&tablename=%s'

1235

.'&revokeall=1">';

1236

if ( $GLOBALS['cfg']['PropertiesIconic'] ) {

1237

    $link_revoke .= '<img class="icon" src="' . $GLOBALS['pmaThemeImage'] . 'b_usrdrop.png" width="16" height="16" alt="' . $GLOBALS['strRevoke'] . '" title="' . $GLOBALS['strRevoke'] . '" />';

1238

} else {

1239

$link_revoke .= $GLOBALS['strRevoke'];

1240

}

1241

$link_revoke .= '</a>';

1242

1243

/**

1244

* Displays the page

1245

*/

1246

if ( empty( $adduser ) && ( ! isset( $checkprivs ) || ! strlen($checkprivs) ) ) {

1247

if ( ! isset( $username ) ) {

1248

// No username is given --> display the overview

1249

echo '<h2>' . "\n"

1250

           . ($GLOBALS['cfg']['MainPageIconic'] ? '<img class="icon" src="'. $GLOBALS['pmaThemeImage'] . 'b_usrlist.png" alt="" />' : '')

1251

. $GLOBALS['strUserOverview'] . "\n"

1252

. '</h2>' . "\n";

1253

1254

$sql_query =

1255

'SELECT `User`,' .

1256

' `Host`,' .

1257

            '       IF(`Password` = ' . (PMA_MYSQL_INT_VERSION >= 40100 ? '_latin1 ' : '') . '\'\', \'N\', \'Y\') AS \'Password\',' .

1258

' `Select_priv`,' .

1259

' `Insert_priv`,' .

1260

' `Update_priv`,' .

1261

' `Delete_priv`,' .

1262

' `Index_priv`,' .

1263

' `Alter_priv`,' .

1264

' `Create_priv`,' .

1265

' `Drop_priv`,' .

1266

' `Grant_priv`,' .

1267

' `References_priv`,' .

1268

' `Reload_priv`,' .

1269

' `Shutdown_priv`,' .

1270

' `Process_priv`,' .

1271

' `File_priv`';

1272

1273

if (PMA_MYSQL_INT_VERSION >= 40002) {

1274

            $sql_query .= ', `Show_db_priv`, `Super_priv`, `Create_tmp_table_priv`, `Lock_tables_priv`, `Execute_priv`, `Repl_slave_priv`, `Repl_client_priv`';

1275

}

1276

1277

if (PMA_MYSQL_INT_VERSION >= 50001) {

1278

$sql_query .= ', `Create_view_priv`, `Show_view_priv`';

1279

}

1280

1281

if (PMA_MYSQL_INT_VERSION >= 50003) {

1282

$sql_query .= ', `Create_user_priv`, `Create_routine_priv`, `Alter_routine_priv`';

1283

}

1284

1285

$sql_query .= ' FROM `mysql`.`user`';

1286

1287

$sql_query .= (isset($initial) ? PMA_RangeOfUsers($initial) : '');

1288

1289

$sql_query .= ' ORDER BY `User` ASC, `Host` ASC;';

1290

$res = PMA_DBI_try_query($sql_query, null, PMA_DBI_QUERY_STORE);

1291

1292

if (! $res) {

1293

// the query failed! This may have two reasons:

1294

// - the user does not have enough privileges

1295

// - the privilege tables use a structure of an earlier version.

1296

// so let's try a more simple query

1297

1298

$sql_query = 'SELECT * FROM `mysql`.`user`';

1299

$res = PMA_DBI_try_query($sql_query, null, PMA_DBI_QUERY_STORE);

1300

1301

if (!$res) {

1302

echo '<i>' . $GLOBALS['strNoPrivileges'] . '</i>' . "\n";

1303

PMA_DBI_free_result($res);

1304

unset($res);

1305

} else {

1306

// rabus: This message is hardcoded because I will replace it by

1307

// a automatic repair feature soon.

1308

echo '<div class="warning">' . "\n"

1309

                   . '    Warning: Your privilege table structure seems to be older than this MySQL version!<br />' . "\n"

1310

                   . '    Please run the script <tt>mysql_fix_privilege_tables</tt> that should be included in your MySQL server distribution to solve this problem!' . "\n"

1311

. '</div><br />' . "\n";

1312

}

1313

} else {

1314

1315

// we also want users not in table `user` but in other table

1316

$tables = PMA_DBI_fetch_result('SHOW TABLES FROM `mysql`;');

1317

1318

$tables_to_search_for_users = array(

1319

'user', 'db', 'tables_priv', 'columns_priv', 'procs_priv',

1320

);

1321

1322

$db_rights_sqls = array();

1323

foreach ( $tables_to_search_for_users as $table_search_in ) {

1324

if ( in_array( $table_search_in, $tables ) ) {

1325

                    $db_rights_sqls[] = 'SELECT DISTINCT `User`, `Host` FROM `mysql`.`' . $table_search_in . '` ' . (isset($initial) ? PMA_RangeOfUsers($initial) : '');

1326

}

1327

}

1328

1329

$user_defaults = array(

1330

'User' => '',

1331

'Host' => '%',

1332

'Password' => '?',

1333

'Grant_priv' => 'N',

1334

'privs' => array( 'USAGE' ),

1335

);

1336

1337

// for all initials, even non A-Z

1338

$array_initials = array();

1339

// for the rights

1340

$db_rights = array();

1341

1342

// do not use UNION DISTINCT, as it's not allowed before

1343

// MySQL 4.0.17, and because "it does nothing" (cf manual)

1344

if ( PMA_MYSQL_INT_VERSION >= 40000 ) {

1345

$db_rights_sql = '(' . implode( ') UNION (', $db_rights_sqls ) . ')'

1346

.' ORDER BY `User` ASC, `Host` ASC';

1347

1348

$db_rights_result = PMA_DBI_query( $db_rights_sql );

1349

1350

while ( $db_rights_row = PMA_DBI_fetch_assoc( $db_rights_result ) ) {

1351

$db_rights_row = array_merge( $user_defaults, $db_rights_row );

1352

$db_rights[$db_rights_row['User']][$db_rights_row['Host']] =

1353

$db_rights_row;

1354

}

1355

} else {

1356

foreach ( $db_rights_sqls as $db_rights_sql ) {

1357

$db_rights_result = PMA_DBI_query( $db_rights_sql );

1358

1359

while ( $db_rights_row = PMA_DBI_fetch_assoc( $db_rights_result ) ) {

1360

$db_rights_row = array_merge( $user_defaults, $db_rights_row );

1361

$db_rights[$db_rights_row['User']][$db_rights_row['Host']] =

1362

$db_rights_row;

1363

}

1364

}

1365

}

1366

PMA_DBI_free_result( $db_rights_result );

1367

unset( $db_rights_sql, $db_rights_sqls, $db_rights_result, $db_rights_row );

1368

ksort( $db_rights );

1369

1370

/**

1371

* Displays the initials

1372

*/

1373

1374

// initialize to FALSE the letters A-Z

1375

for ($letter_counter = 1; $letter_counter < 27; $letter_counter++) {

1376

if ( ! isset( $array_initials[chr($letter_counter + 64)] ) ) {

1377

$array_initials[chr($letter_counter + 64)] = FALSE;

1378

}

1379

}

1380

1381

            $initials = PMA_DBI_try_query('SELECT DISTINCT UPPER(LEFT(' . PMA_convert_using('User') . ',1)) FROM `user` ORDER BY `User` ASC', null, PMA_DBI_QUERY_STORE);

1382

while (list($tmp_initial) = PMA_DBI_fetch_row($initials)) {

1383

$array_initials[$tmp_initial] = TRUE;

1384

}

1385

1386

// Display the initials, which can be any characters, not

1387

// just letters. For letters A-Z, we add the non-used letters

1388

// as greyed out.

1389

1390

uksort( $array_initials, "strnatcasecmp" );

1391

1392

echo '<table cellspacing="5"><tr>';

1393

foreach ($array_initials as $tmp_initial => $initial_was_found) {

1394

if ($initial_was_found) {

1395

                    echo '<td><a href="' . $PHP_SELF . '?' . $GLOBALS['url_query'] . '&amp;initial=' . urlencode($tmp_initial) . '">' . $tmp_initial . '</a></td>' . "\n";

1396

} else {

1397

echo '<td>' . $tmp_initial . '</td>';

1398

}

1399

}

1400

            echo '<td><a href="' . $PHP_SELF . '?' . $GLOBALS['url_query'] . '&amp;showall=1">[' . $GLOBALS['strShowAll'] . ']</a></td>' . "\n";

1401

echo '</tr></table>';

1402

1403

/**

1404

* Display the user overview

1405

* (if less than 50 users, display them immediately)

1406

*/

1407

1408

if (isset($initial) || isset($showall) || PMA_DBI_num_rows($res) < 50) {

1409

1410

while ( $row = PMA_DBI_fetch_assoc( $res ) ) {

1411

$row['privs'] = PMA_extractPrivInfo( $row, true );

1412

$db_rights[$row['User']][$row['Host']] = $row;

1413

}

1414

@PMA_DBI_free_result( $res );

1415

unset( $res );

1416

1417

echo '<form name="usersForm" id="usersForm" action="server_privileges.php" method="post">' . "\n"

1418

. PMA_generate_common_hidden_inputs('', '', 1)

1419

. ' <table id="tableuserrights" class="data">' . "\n"

1420

. ' <thead>' . "\n"

1421

. ' <tr><td></td>' . "\n"

1422

. ' <th>' . $GLOBALS['strUser'] . '</th>' . "\n"

1423

. ' <th>' . $GLOBALS['strHost'] . '</th>' . "\n"

1424

. ' <th>' . $GLOBALS['strPassword'] . '</th>' . "\n"

1425

. ' <th>' . $GLOBALS['strGlobalPrivileges'] . ' '

1426

. PMA_showHint( $GLOBALS['strEnglishPrivileges'] ) . '</th>' . "\n"

1427

. ' <th>' . $GLOBALS['strGrantOption'] . '</th>' . "\n"

1428

                   . '            ' . ($GLOBALS['cfg']['PropertiesIconic'] ? '<td></td>' : '<th>' . $GLOBALS['strAction'] . '</th>') . "\n";

1429

echo ' </tr>' . "\n";

1430

echo ' </thead>' . "\n";

1431

echo ' <tbody>' . "\n";

1432

$odd_row = true;

1433

$index_checkbox = -1;

1434

foreach ( $db_rights as $user ) {

1435

$index_checkbox++;

1436

ksort( $user );

1437

foreach ( $user as $host ) {

1438

$index_checkbox++;

1439

echo ' <tr class="' . ( $odd_row ? 'odd' : 'even' ) . '">' . "\n"

1440

                           . '            <td><input type="checkbox" name="selected_usr[]" id="checkbox_sel_users_' . $index_checkbox . '" value="' . str_replace( chr(27), '&#27;', htmlentities($host['User'] . $user_host_separator . $host['Host'] ) ) . '"' . (empty($GLOBALS['checkall']) ?  '' : ' checked="checked"') . ' /></td>' . "\n"

1441

                           . '            <td><label for="checkbox_sel_users_' . $index_checkbox . '">' . (empty($host['User']) ? '<span style="color: #FF0000">' . $GLOBALS['strAny'] . '</span>' : htmlspecialchars($host['User'])) . '</label></td>' . "\n"

1442

. ' <td>' . htmlspecialchars($host['Host']) . '</td>' . "\n";

1443

echo ' <td>';

1444

switch ($host['Password']) {

1445

case 'Y':

1446

echo $GLOBALS['strYes'];

1447

break;

1448

case 'N':

1449

echo '<span style="color: #FF0000">' . $GLOBALS['strNo'] . '</span>';

1450

break;

1451

// this happens if this is a definition not coming from mysql.user

1452

default:

1453

echo '--'; // in future version, replace by "not present"

1454

break;

1455

} // end switch

1456

echo '</td>' . "\n"

1457

. ' <td><tt>' . "\n"

1458

. ' ' . implode( ',' . "\n" . ' ', $host['privs'] ) . "\n"

1459

. ' </tt></td>' . "\n"

1460

                           . '            <td>' . ($host['Grant_priv'] == 'Y' ? $GLOBALS['strYes'] : $GLOBALS['strNo']) . '</td>' . "\n"

1461

. ' <td align="center">';

1462

printf( $link_edit, urlencode( $host['User'] ),

1463

urlencode( $host['Host'] ), '', '' );

1464

echo '</td>' . "\n"

1465

. ' </tr>' . "\n";

1466

$odd_row = ! $odd_row;

1467

}

1468

}

1469

1470

unset( $user, $host, $odd_row );

1471

echo ' </tbody></table>' . "\n"

1472

.'<img class="selectallarrow"'

1473

.' src="' . $pmaThemeImage . 'arrow_' . $text_dir . '.png"'

1474

.' width="38" height="22"'

1475

.' alt="' . $GLOBALS['strWithChecked'] . '" />' . "\n"

1476

.'<a href="./server_privileges.php?' . $GLOBALS['url_query'] . '&checkall=1"'

1477

.' onclick="if ( markAllRows(\'usersForm\') ) return false;">'

1478

. $GLOBALS['strCheckAll'] . '</a>' . "\n"

1479

.'/' . "\n"

1480

.'<a href="server_privileges.php?' . $GLOBALS['url_query'] . '"'

1481

.' onclick="if ( unMarkAllRows(\'usersForm\') ) return false;">'

1482

. $GLOBALS['strUncheckAll'] . '</a>' . "\n";

1483

1484

// add/delete user fieldset

1485

echo ' <fieldset id="fieldset_add_user">' . "\n"

1486

. ' <a href="server_privileges.php?' . $GLOBALS['url_query'] . '&adduser=1">' . "\n"

1487

                   . ($GLOBALS['cfg']['PropertiesIconic'] ? '            <img class="icon" src="' . $pmaThemeImage . 'b_usradd.png" width="16" height="16" alt="" />' . "\n" : '' )

1488

. ' ' . $GLOBALS['strAddUser'] . '</a>' . "\n"

1489

. ' </fieldset>' . "\n"

1490

. ' <fieldset id="fieldset_delete_user">'

1491

. ' <legend>' . "\n"

1492

                   . ($GLOBALS['cfg']['PropertiesIconic'] ? '            <img class="icon" src="' . $pmaThemeImage . 'b_usrdrop.png" width="16" height="16" alt="" />' . "\n" : '' )

1493

. ' ' . $GLOBALS['strRemoveSelectedUsers'] . '' . "\n"

1494

. ' </legend>' . "\n";

1495

1496

// before MySQL 4.1.1, we offer some choices for the delete

1497

// mode, but for 4.1.1+, it will be done with REVOKEing the

1498

// privileges then a DROP USER (even no REVOKE at all

1499

// for MySQL 5), so no need to offer so many options

1500

if (PMA_MYSQL_INT_VERSION < 40101) {

1501

                   echo '        <input type="radio" title="' . $GLOBALS['strJustDelete'] . ' ' . $GLOBALS['strJustDeleteDescr'] . '" name="mode" id="radio_mode_1" value="1" checked="checked" />' . "\n"

1502

                   . '        <label for="radio_mode_1" title="' . $GLOBALS['strJustDelete'] . ' ' . $GLOBALS['strJustDeleteDescr'] . '">' . "\n"

1503

. ' ' . $GLOBALS['strJustDelete'] . "\n"

1504

. ' </label><br />' . "\n"

1505

                   . '        <input type="radio" title="' . $GLOBALS['strRevokeAndDelete'] . ' ' . $GLOBALS['strRevokeAndDeleteDescr'] . '" name="mode" id="radio_mode_2" value="2" />' . "\n"

1506

                   . '        <label for="radio_mode_2" title="' . $GLOBALS['strRevokeAndDelete'] . ' ' . $GLOBALS['strRevokeAndDeleteDescr'] . '">' . "\n"

1507

. ' ' . $GLOBALS['strRevokeAndDelete'] . "\n"

1508

. ' </label><br />' . "\n"

1509

                   . '        <input type="radio" title="' . $GLOBALS['strDeleteAndFlush'] . ' ' . $GLOBALS['strDeleteAndFlushDescr'] . '" name="mode" id="radio_mode_3" value="3" />' . "\n"

1510

                   . '        <label for="radio_mode_3" title="' . $GLOBALS['strDeleteAndFlush'] . ' ' . $GLOBALS['strDeleteAndFlushDescr'] . '">' . "\n"

1511

. ' ' . $GLOBALS['strDeleteAndFlush'] . "\n"

1512

. ' </label><br />' . "\n";

1513

} else {

1514

echo ' <input type="hidden" name="mode" value="2" />' . "\n"

1515

. '( ' . $GLOBALS['strRevokeAndDelete'] . ' )<br />' . "\n";

1516

}

1517

1518

                 echo '        <input type="checkbox" title="' . $GLOBALS['strDropUsersDb'] . '" name="drop_users_db" id="checkbox_drop_users_db" />' . "\n"

1519

. ' <label for="checkbox_drop_users_db" title="' . $GLOBALS['strDropUsersDb'] . '">' . "\n"

1520

. ' ' . $GLOBALS['strDropUsersDb'] . "\n"

1521

. ' </label>' . "\n"

1522

. ' </fieldset>' . "\n"

1523

. ' <fieldset id="fieldset_delete_user_footer" class="tblFooters">' . "\n"

1524

                   . '        <input type="submit" name="delete" value="' . $GLOBALS['strGo'] . '" id="buttonGo" />' . "\n"

1525

. ' </fieldset>' . "\n";

1526

} else {

1527

1528

unset ($row);

1529

echo ' <fieldset id="fieldset_add_user">' . "\n"

1530

. ' <a href="server_privileges.php?' . $GLOBALS['url_query'] . '&adduser=1">' . "\n"

1531

                   . ($GLOBALS['cfg']['PropertiesIconic'] ? '            <img class="icon" src="' . $pmaThemeImage . 'b_usradd.png" width="16" height="16" alt="" />' . "\n" : '' )

1532

. ' ' . $GLOBALS['strAddUser'] . '</a>' . "\n"

1533

. ' </fieldset>' . "\n";

1534

} // end if (display overview)

1535

echo '</form>' . "\n"

1536

. '<div class="warning">' . "\n"

1537

               . '    ' . sprintf($GLOBALS['strFlushPrivilegesNote'], '<a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;flush_privileges=1">', '</a>') . "\n"

1538

. '</div>' . "\n";

1539

}

1540

1541

1542

} else {

1543

1544

// A user was selected -> display the user's properties

1545

1546

echo '<h2>' . "\n"

1547

           . ($GLOBALS['cfg']['PropertiesIconic'] ? '<img class="icon" src="' . $pmaThemeImage . 'b_usredit.png" width="16" height="16" alt="" />' : '' )

1548

           . $GLOBALS['strUser'] . ' <i><a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;username=' . urlencode($username) . '&amp;hostname=' . urlencode($hostname) . '">\'' . htmlspecialchars($username) . '\'@\'' . htmlspecialchars($hostname) . '\'</a></i>' . "\n";

1549

if ( isset( $dbname ) && strlen($dbname) ) {

1550

if ( $dbname_is_wildcard ) {

1551

echo ' - ' . $GLOBALS['strDatabases'];

1552

} else {

1553

echo ' - ' . $GLOBALS['strDatabase'];

1554

}

1555

            echo ' <i><a href="' . $GLOBALS['cfg']['DefaultTabDatabase'] . '?' . $GLOBALS['url_query'] . '&amp;db=' . urlencode($dbname) . '&amp;reload=1">' . htmlspecialchars($dbname) . '</a></i>' . "\n";

1556

if ( isset( $tablename ) && strlen($tablename) ) {

1557

                echo '    - ' . $GLOBALS['strTable'] . ' <i><a href="' . $GLOBALS['cfg']['DefaultTabTable'] . '?' . $GLOBALS['url_query'] . '&amp;db=' . urlencode($dbname) . '&amp;table=' . urlencode($tablename) . '&amp;reload=1">' . htmlspecialchars($tablename) . '</a></i>' . "\n";

1558

}

1559

}

1560

echo ' : ' . $GLOBALS['strEditPrivileges'] . '</h2>' . "\n";

1561

        $res = PMA_DBI_query('SELECT \'foo\' FROM `mysql`.`user` WHERE ' . PMA_convert_using('User') . ' = ' . PMA_convert_using(PMA_sqlAddslashes($username), 'quoted') . ' AND ' . PMA_convert_using('Host') . ' = ' . PMA_convert_using($hostname, 'quoted') . ';', null, PMA_DBI_QUERY_STORE);

1562

$user_does_not_exists = (PMA_DBI_num_rows( $res ) < 1);

1563

PMA_DBI_free_result($res);

1564

unset($res);

1565

if ( $user_does_not_exists ) {

1566

echo $GLOBALS['strUserNotFound'];

1567

PMA_displayLoginInformationFields();

1568

//require_once('./libraries/footer.inc.php');

1569

}

1570

echo '<form name="usersForm" id="usersForm" action="server_privileges.php" method="post">' . "\n"

1571

. PMA_generate_common_hidden_inputs('', '', 3)

1572

. '<input type="hidden" name="username" value="' . htmlspecialchars($username) . '" />' . "\n"

1573

. '<input type="hidden" name="hostname" value="' . htmlspecialchars($hostname) . '" />' . "\n";

1574

if ( isset( $dbname ) && strlen($dbname) ) {

1575

echo '<input type="hidden" name="dbname" value="' . htmlspecialchars($dbname) . '" />' . "\n";

1576

if ( isset( $tablename ) && strlen($tablename) ) {

1577

echo ' <input type="hidden" name="tablename" value="' . htmlspecialchars($tablename) . '" />' . "\n";

1578

}

1579

}

1580

PMA_displayPrivTable((( ! isset( $dbname ) || ! strlen($dbname) ) ? '*' : $dbname),

1581

            ((( ! isset( $dbname ) || ! strlen($dbname) ) || ( ! isset( $tablename ) || ! strlen($tablename) )) ? '*' : $tablename),

1582

TRUE, 3);

1583

echo '</form>' . "\n";

1584

1585

if ( ( ! isset( $tablename ) || ! strlen($tablename) ) && empty( $dbname_is_wildcard ) ) {

1586

1587

// no table name was given, display all table specific rights

1588

// but only if $dbname contains no wildcards

1589

1590

// table header

1591

echo '<form action="server_privileges.php" method="post">' . "\n"

1592

. PMA_generate_common_hidden_inputs('', '', 6)

1593

. '<input type="hidden" name="username" value="' . htmlspecialchars($username) . '" />' . "\n"

1594

. '<input type="hidden" name="hostname" value="' . htmlspecialchars($hostname) . '" />' . "\n"

1595

. '<fieldset>' . "\n"

1596

               . '<legend>' . (( ! isset( $dbname ) || ! strlen($dbname) ) ? $GLOBALS['strDbPrivileges'] : $GLOBALS['strTblPrivileges']) . '</legend>' . "\n"

1597

. '<table class="data">' . "\n"

1598

. '<thead>' . "\n"

1599

               . '<tr><th>' . (( ! isset( $dbname ) || ! strlen($dbname) ) ? $GLOBALS['strDatabase'] : $GLOBALS['strTable']) . '</th>' . "\n"

1600

. ' <th>' . $GLOBALS['strPrivileges'] . '</th>' . "\n"

1601

. ' <th>' . $GLOBALS['strGrantOption'] . '</th>' . "\n"

1602

               . '    <th>' . (( ! isset( $dbname ) || ! strlen($dbname) ) ? $GLOBALS['strTblPrivileges'] : $GLOBALS['strColumnPrivileges']) . '</th>' . "\n"

1603

. ' <th colspan="2">' . $GLOBALS['strAction'] . '</th>' . "\n"

1604

. '</tr>' . "\n"

1605

. '</thead>' . "\n"

1606

. '<tbody>' . "\n";

1607

1608

$user_host_condition =

1609

' WHERE ' . PMA_convert_using('`User`')

1610

. ' = ' . PMA_convert_using(PMA_sqlAddslashes($username), 'quoted')

1611

. ' AND ' . PMA_convert_using('`Host`')

1612

. ' = ' . PMA_convert_using($hostname, 'quoted');

1613

1614

// table body

1615

// get data

1616

1617

// we also want privielgs for this user not in table `db` but in other table

1618

$tables = PMA_DBI_fetch_result('SHOW TABLES FROM `mysql`;');

1619

if ( ( ! isset( $dbname ) || ! strlen($dbname) ) ) {

1620

1621

// no db name given, so we want all privs for the given user

1622

1623

$tables_to_search_for_users = array(

1624

'tables_priv', 'columns_priv',

1625

);

1626

1627

$db_rights_sqls = array();

1628

foreach ( $tables_to_search_for_users as $table_search_in ) {

1629

if ( in_array( $table_search_in, $tables ) ) {

1630

$db_rights_sqls[] = '

1631

SELECT DISTINCT `Db`

1632

FROM `mysql`.`' . $table_search_in . '`

1633

' . $user_host_condition;

1634

}

1635

}

1636

1637

$user_defaults = array(

1638

'Db' => '',

1639

'Grant_priv' => 'N',

1640

'privs' => array( 'USAGE' ),

1641

'Table_privs' => true,

1642

);

1643

1644

// for the rights

1645

$db_rights = array();

1646

1647

if ( PMA_MYSQL_INT_VERSION >= 40000 ) {

1648

$db_rights_sql = '(' . implode( ') UNION (', $db_rights_sqls ) . ')'

1649

.' ORDER BY `Db` ASC';

1650

1651

$db_rights_result = PMA_DBI_query( $db_rights_sql );

1652

1653

while ( $db_rights_row = PMA_DBI_fetch_assoc( $db_rights_result ) ) {

1654

$db_rights_row = array_merge( $user_defaults, $db_rights_row );

1655

// only Db names in the table `mysql`.`db` uses wildcards

1656

// as we are in the db specific rights display we want

1657

// all db names escaped, also from other sources

1658

$db_rights_row['Db'] = PMA_escape_mysql_wildcards(

1659

$db_rights_row['Db'] );

1660

$db_rights[$db_rights_row['Db']] = $db_rights_row;

1661

}

1662

} else {

1663

foreach ( $db_rights_sqls as $db_rights_sql ) {

1664

$db_rights_result = PMA_DBI_query( $db_rights_sql );

1665

1666

while ( $db_rights_row = PMA_DBI_fetch_assoc( $db_rights_result ) ) {

1667

$db_rights_row = array_merge( $user_defaults, $db_rights_row );

1668

$db_rights[$db_rights_row['Db']] = $db_rights_row;

1669

}

1670

}

1671

}

1672

PMA_DBI_free_result( $db_rights_result );

1673

unset( $db_rights_sql, $db_rights_sqls, $db_rights_result, $db_rights_row );

1674

1675

$sql_query = 'SELECT * FROM `mysql`.`db`' . $user_host_condition . ' ORDER BY `Db` ASC';

1676

$res = PMA_DBI_query( $sql_query );

1677

unset( $sql_query );

1678

1679

while ( $row = PMA_DBI_fetch_assoc( $res ) ) {

1680

if ( isset( $db_rights[$row['Db']] ) ) {

1681

$db_rights[$row['Db']] = array_merge( $db_rights[$row['Db']], $row );

1682

} else {

1683

$db_rights[$row['Db']] = $row;

1684

}

1685

// there are db specific rights for this user

1686

// so we can drop this db rights

1687

$db_rights[$row['Db']]['can_delete'] = true;

1688

}

1689

PMA_DBI_free_result( $res );

1690

unset( $row, $res );

1691

1692

} else {

1693

1694

// db name was given,

1695

// so we want all user specific rights for this db

1696

1697

$user_host_condition .=

1698

' AND ' . PMA_convert_using('`Db`')

1699

.' LIKE ' . PMA_convert_using( $dbname, 'quoted' );

1700

1701

$tables_to_search_for_users = array(

1702

'columns_priv',

1703

);

1704

1705

$db_rights_sqls = array();

1706

foreach ( $tables_to_search_for_users as $table_search_in ) {

1707

if ( in_array( $table_search_in, $tables ) ) {

1708

$db_rights_sqls[] = '

1709

SELECT DISTINCT `Table_name`

1710

FROM `mysql`.`' . $table_search_in . '`

1711

' . $user_host_condition;

1712

}

1713

}

1714

1715

$user_defaults = array(

1716

'Table_name' => '',

1717

'Grant_priv' => 'N',

1718

'privs' => array( 'USAGE' ),

1719

'Column_priv' => true,

1720

);

1721

1722

// for the rights

1723

$db_rights = array();

1724

1725

if ( PMA_MYSQL_INT_VERSION >= 40000 ) {

1726

$db_rights_sql = '(' . implode( ') UNION (', $db_rights_sqls ) . ')'

1727

.' ORDER BY `Table_name` ASC';

1728

1729

$db_rights_result = PMA_DBI_query( $db_rights_sql );

1730

1731

while ( $db_rights_row = PMA_DBI_fetch_assoc( $db_rights_result ) ) {

1732

$db_rights_row = array_merge( $user_defaults, $db_rights_row );

1733

$db_rights[$db_rights_row['Table_name']] = $db_rights_row;

1734

}

1735

} else {

1736

foreach ( $db_rights_sqls as $db_rights_sql ) {

1737

$db_rights_result = PMA_DBI_query( $db_rights_sql );

1738

1739

while ( $db_rights_row = PMA_DBI_fetch_assoc( $db_rights_result ) ) {

1740

$db_rights_row = array_merge( $user_defaults, $db_rights_row );

1741

$db_rights[$db_rights_row['Table_name']] = $db_rights_row;

1742

}

1743

}

1744

}

1745

PMA_DBI_free_result( $db_rights_result );

1746

unset( $db_rights_sql, $db_rights_sqls, $db_rights_result, $db_rights_row );

1747

1748

$sql_query =

1749

'SELECT `Table_name`,'

1750

.' `Table_priv`,'

1751

.' IF(`Column_priv` = ' . (PMA_MYSQL_INT_VERSION >= 40100 ? '_latin1 ' : '') . ' \'\', 0, 1)'

1752

.' AS \'Column_priv\''

1753

.' FROM `mysql`.`tables_priv`'

1754

. $user_host_condition

1755

.' ORDER BY `Table_name` ASC;';

1756

$res = PMA_DBI_query( $sql_query );

1757

unset( $sql_query );

1758

1759

while ( $row = PMA_DBI_fetch_assoc( $res ) ) {

1760

if ( isset( $db_rights[$row['Table_name']] ) ) {

1761

$db_rights[$row['Table_name']] = array_merge( $db_rights[$row['Table_name']], $row );

1762

} else {

1763

$db_rights[$row['Table_name']] = $row;

1764

}

1765

}

1766

PMA_DBI_free_result( $res );

1767

unset( $row, $res );

1768

}

1769

ksort( $db_rights );

1770

1771

// display rows

1772

if ( count( $db_rights ) < 1 ) {

1773

echo '<tr class="odd">' . "\n"

1774

. ' <td colspan="6"><center><i>' . $GLOBALS['strNone'] . '</i></center></td>' . "\n"

1775

. '</tr>' . "\n";

1776

} else {

1777

$odd_row = true;

1778

$found_rows = array();

1779

//while ( $row = PMA_DBI_fetch_assoc( $res ) ) {

1780

foreach ( $db_rights as $row ) {

1781

$found_rows[] = ( ! isset( $dbname ) || ! strlen($dbname) ) ? $row['Db'] : $row['Table_name'];

1782

1783

echo '<tr class="' . ( $odd_row ? 'odd' : 'even' ) . '">' . "\n"

1784

                       . '    <td>' . htmlspecialchars(( ! isset( $dbname ) || ! strlen($dbname) ) ? $row['Db'] : $row['Table_name']) . '</td>' . "\n"

1785

. ' <td><tt>' . "\n"

1786

. ' ' . join(',' . "\n" . ' ', PMA_extractPrivInfo($row, TRUE)) . "\n"

1787

. ' </tt></td>' . "\n"

1788

                       . '    <td>' . (((( ! isset( $dbname ) || ! strlen($dbname) ) && $row['Grant_priv'] == 'Y') || (isset($dbname) && strlen($dbname) && in_array('Grant', explode(',', $row['Table_priv'])))) ? $GLOBALS['strYes'] : $GLOBALS['strNo']) . '</td>' . "\n"

1789

. ' <td>';

1790

if ( ! empty( $row['Table_privs'] ) || ! empty ( $row['Column_priv'] ) ) {

1791

echo $GLOBALS['strYes'];

1792

} else {

1793

echo $GLOBALS['strNo'];

1794

}

1795

echo '</td>' . "\n"

1796

. ' <td>';

1797

printf( $link_edit, urlencode( $username ),

1798

urlencode( $hostname ),

1799

urlencode( ( ! isset( $dbname ) || ! strlen($dbname) ) ? $row['Db'] : $dbname ),

1800

urlencode( ( ! isset( $dbname ) || ! strlen($dbname) ) ? '' : $row['Table_name'] ) );

1801

echo '</td>' . "\n"

1802

. ' <td>';

1803

if ( ! empty( $row['can_delete'] ) || isset( $row['Table_name'] ) && strlen($row['Table_name']) ) {

1804

printf( $link_revoke, urlencode( $username ),

1805

urlencode( $hostname ),

1806

urlencode( ( ! isset( $dbname ) || ! strlen($dbname) ) ? $row['Db'] : $dbname ),

1807

urlencode( ( ! isset( $dbname ) || ! strlen($dbname) ) ? '' : $row['Table_name'] ) );

1808

}

1809

echo '</td>' . "\n"

1810

. '</tr>' . "\n";

1811

$odd_row = ! $odd_row;

1812

} // end while

1813

}

1814

unset($row);

1815

echo '</tbody>' . "\n"

1816

. '</table>' . "\n";

1817

1818

if ( ! isset( $dbname ) || ! strlen($dbname) ) {

1819

1820

// no database name was give, display select db

1821

1822

if ( ! empty( $found_rows ) ) {

1823

$pred_db_array = array_diff(

1824

PMA_DBI_fetch_result( 'SHOW DATABASES;' ),

1825

$found_rows );

1826

} else {

1827

$pred_db_array =PMA_DBI_fetch_result( 'SHOW DATABASES;' );

1828

}

1829

1830

echo ' <label for="text_dbname">' . $GLOBALS['strAddPrivilegesOnDb'] . ':</label>' . "\n";

1831

if (!empty($pred_db_array)) {

1832

echo ' <select name="pred_dbname" onchange="this.form.submit();">' . "\n"

1833

                       . '        <option value="" selected="selected">' . $GLOBALS['strUseTextField'] . ':</option>' . "\n";

1834

foreach ($pred_db_array as $current_db) {

1835

$current_db = PMA_escape_mysql_wildcards( $current_db );

1836

echo ' <option value="' . htmlspecialchars( $current_db ) . '">'

1837

. htmlspecialchars( $current_db ) . '</option>' . "\n";

1838

}

1839

echo ' </select>' . "\n";

1840

}

1841

echo ' <input type="text" id="text_dbname" name="dbname" />' . "\n"

1842

.PMA_showHint( $GLOBALS['strEscapeWildcards'] );

1843

} else {

1844

echo ' <input type="hidden" name="dbname" value="' . htmlspecialchars($dbname) . '"/>' . "\n"

1845

. ' <label for="text_tablename">' . $GLOBALS['strAddPrivilegesOnTbl'] . ':</label>' . "\n";

1846

                if ($res = @PMA_DBI_try_query('SHOW TABLES FROM ' . PMA_backquote($dbname) . ';', null, PMA_DBI_QUERY_STORE)) {

1847

$pred_tbl_array = array();

1848

while ($row = PMA_DBI_fetch_row($res)) {

1849

if (!isset($found_rows) || !in_array($row[0], $found_rows)) {

1850

$pred_tbl_array[] = $row[0];

1851

}

1852

}

1853

PMA_DBI_free_result($res);

1854

unset( $res, $row );

1855

if (!empty($pred_tbl_array)) {

1856

echo ' <select name="pred_tablename" onchange="this.form.submit();">' . "\n"

1857

                           . '        <option value="" selected="selected">' . $GLOBALS['strUseTextField'] . ':</option>' . "\n";

1858

foreach ($pred_tbl_array as $current_table) {

1859

                            echo '        <option value="' . htmlspecialchars($current_table) . '">' . htmlspecialchars($current_table) . '</option>' . "\n";

1860

}

1861

echo ' </select>' . "\n";

1862

}

1863

} else {

1864

unset($res);

1865

}

1866

echo ' <input type="text" id="text_tablename" name="tablename" />' . "\n";

1867

}

1868

echo '</fieldset>' . "\n";

1869

echo '<fieldset class="tblFooters">' . "\n"

1870

. ' <input type="submit" value="' . $GLOBALS['strGo'] . '" />'

1871

. '</fieldset>' . "\n"

1872

. '</form>' . "\n";

1873

}

1874

1875

if ( ( ! isset( $dbname ) || ! strlen($dbname) ) && ! $user_does_not_exists ) {

1876

echo '<form action="server_privileges.php" method="post" onsubmit="return checkPassword(this);">' . "\n"

1877

. PMA_generate_common_hidden_inputs('', '', 3)

1878

. '<input type="hidden" name="username" value="' . htmlspecialchars($username) . '" />' . "\n"

1879

. '<input type="hidden" name="hostname" value="' . htmlspecialchars($hostname) . '" />' . "\n"

1880

. '<fieldset id="fieldset_change_password">' . "\n"

1881

. ' <legend>' . $GLOBALS['strChangePassword'] . '</legend>' . "\n"

1882

. ' <table class="data">' . "\n"

1883

. ' <tr class="odd noclick">' . "\n"

1884

               . '        <td><input type="radio" name="nopass" value="1" id="radio_nopass_1" onclick="pw_pma_pw.value=\'\'; pw_pma_pw2.value=\'\';" /></td>' . "\n"

1885

               . '        <td colspan="2"><label for="radio_nopass_1">' . $GLOBALS['strNoPassword'] . '</label></td>' . "\n"

1886

. ' </tr>' . "\n"

1887

. ' <tr class="even noclick">' . "\n"

1888

               . '        <td><input type="radio" name="nopass" value="0" id="radio_nopass_0" onclick="document.getElementById(\'pw_pma_pw\').focus();" /></td>' . "\n"

1889

. ' <td><label for="radio_nopass_0">' . $GLOBALS['strPassword'] . ':</label></td>' . "\n"

1890

               . '        <td><input type="password" name="pma_pw" id="pw_pma_pw" onchange="radio_nopass_0.checked = true;" /></td>' . "\n"

1891

. ' </tr>' . "\n"

1892

. ' <tr class="odd noclick">' . "\n"

1893

. ' <td></td>' . "\n"

1894

. ' <td><label for="pw_pma_pw2">' . $GLOBALS['strReType'] . ':</label></td>' . "\n"

1895

               . '        <td><input type="password" name="pma_pw2" id="pw_pma_pw2" onchange="radio_nopass_0.checked = true;" /></td>' . "\n"

1896

. ' </tr>' . "\n"

1897

. ' </table>' . "\n"

1898

. '</fieldset>' . "\n"

1899

. '<fieldset id="fieldset_change_password_footer" class="tblFooters">' . "\n"

1900

. ' <input type="submit" name="change_pw" value="' . $GLOBALS['strGo'] . '" />' . "\n"

1901

. '</fieldset>' . "\n"

1902

. '</form>' . "\n"

1903

. '<form action="server_privileges.php" method="post" onsubmit="return checkPassword(this);">' . "\n"

1904

. PMA_generate_common_hidden_inputs('', '', 3)

1905

. '<input type="hidden" name="old_username" value="' . htmlspecialchars($username) . '" />' . "\n"

1906

. '<input type="hidden" name="old_hostname" value="' . htmlspecialchars($hostname) . '" />' . "\n"

1907

. '<fieldset id="fieldset_change_copy_user">' . "\n"

1908

. ' <legend>' . $GLOBALS['strChangeCopyUser'] . '</legend>' . "\n";

1909

PMA_displayLoginInformationFields('change', 3 );

1910

echo ' <fieldset>' . "\n"

1911

. ' <legend>' . $GLOBALS['strChangeCopyMode'] . '</legend>' . "\n"

1912

               . '        <input type="radio" name="mode" value="4" id="radio_mode_4" checked="checked" /><label for="radio_mode_4">' . "\n"

1913

. ' ' . $GLOBALS['strChangeCopyModeCopy'] . "\n"

1914

. ' </label><br />' . "\n"

1915

               . '        <input type="radio" name="mode" value="1" id="radio_mode_1" /><label for="radio_mode_1">' . "\n"

1916

. ' ' . $GLOBALS['strChangeCopyModeJustDelete'] . "\n"

1917

. ' </label><br />' . "\n"

1918

               . '        <input type="radio" name="mode" value="2" id="radio_mode_2" /><label for="radio_mode_2">' . "\n"

1919

. ' ' . $GLOBALS['strChangeCopyModeRevoke'] . "\n"

1920

. ' </label><br />' . "\n"

1921

               . '        <input type="radio" name="mode" value="3" id="radio_mode_3" /><label for="radio_mode_3">' . "\n"

1922

. ' ' . $GLOBALS['strChangeCopyModeDeleteAndReload'] . "\n"

1923

. ' </label>' . "\n"

1924

. ' </fieldset>' . "\n"

1925

. '</fieldset>' . "\n"

1926

. '<fieldset id="fieldset_change_copy_user_footer" class="tblFooters">' . "\n"

1927

. ' <input type="submit" name="change_copy" value="' . $GLOBALS['strGo'] . '" />' . "\n"

1928

. '</fieldset>' . "\n"

1929

. '</form>' . "\n";

1930

}

1931

}

1932

} elseif (!empty($adduser)) {

1933

// Add a new user

1934

$GLOBALS['url_query'] .= '&adduser=1';

1935

echo '<h2>' . "\n"

1936

       . ($GLOBALS['cfg']['PropertiesIconic'] ? '<img class="icon" src="' . $pmaThemeImage . 'b_usradd.png" width="16" height="16" alt="" />' : '' )

1937

. ' ' . $GLOBALS['strAddUser'] . "\n"

1938

. '</h2>' . "\n"

1939

       . '<form name="usersForm" id="usersForm" action="server_privileges.php" method="post" onsubmit="return checkAddUser(this);">' . "\n"

1940

. PMA_generate_common_hidden_inputs('', '', 1);

1941

PMA_displayLoginInformationFields('new', 2);

1942

PMA_displayPrivTable('*', '*', FALSE, 1);

1943

echo ' <fieldset id="fieldset_add_user_footer" class="tblFooters">' . "\n"

1944

. ' <input type="submit" name="adduser_submit" value="' . $GLOBALS['strGo'] . '" />' . "\n"

1945

. ' </fieldset>' . "\n"

1946

. '</form>' . "\n";

1947

} else {

1948

// check the privileges for a particular database.

1949

echo '<table id="tablespecificuserrights" class="data">' . "\n"

1950

. '<caption class="tblHeaders">' . "\n"

1951

       . ($GLOBALS['cfg']['PropertiesIconic'] ? '            <img class="icon" src="' . $pmaThemeImage . 'b_usrcheck.png" width="16" height="16" alt="" />' . "\n" : '' )

1952

       . '    ' . sprintf($GLOBALS['strUsersHavingAccessToDb'], '<a href="' . $GLOBALS['cfg']['DefaultTabDatabase'] . '?' . PMA_generate_common_url($checkprivs) . '">' .  htmlspecialchars($checkprivs) . '</a>') . "\n"

1953

. '</caption>' . "\n"

1954

. '<thead>' . "\n"

1955

. ' <tr><th>' . $GLOBALS['strUser'] . '</th>' . "\n"

1956

. ' <th>' . $GLOBALS['strHost'] . '</th>' . "\n"

1957

. ' <th>' . $GLOBALS['strType'] . '</th>' . "\n"

1958

. ' <th>' . $GLOBALS['strPrivileges'] . '</th>' . "\n"

1959

. ' <th>' . $GLOBALS['strGrantOption'] . '</th>' . "\n"

1960

. ' <th>' . $GLOBALS['strAction'] . '</th>' . "\n"

1961

. ' </tr>' . "\n"

1962

. '</thead>' . "\n"

1963

. '<tbody>' . "\n";

1964

$odd_row = TRUE;

1965

unset($row);

1966

unset($row1);

1967

unset($row2);

1968

// now, we build the table...

1969

if (PMA_MYSQL_INT_VERSION >= 40000) {

1970

// Starting with MySQL 4.0.0, we may use UNION SELECTs and this makes

1971

// the job much easier here!

1972

1973

$no = PMA_convert_using('N', 'quoted');

1974

1975

$list_of_privileges =

1976

PMA_convert_using('Select_priv') . ' AS Select_priv, '

1977

. PMA_convert_using('Insert_priv') . ' AS Insert_priv, '

1978

. PMA_convert_using('Update_priv') . ' AS Update_priv, '

1979

. PMA_convert_using('Delete_priv') . ' AS Delete_priv, '

1980

. PMA_convert_using('Create_priv') . ' AS Create_priv, '

1981

. PMA_convert_using('Drop_priv') . ' AS Drop_priv, '

1982

. PMA_convert_using('Grant_priv') . ' AS Grant_priv, '

1983

. PMA_convert_using('References_priv') . ' AS References_priv';

1984

1985

$list_of_compared_privileges =

1986

PMA_convert_using('Select_priv') . ' = ' . $no

1987

. ' AND ' . PMA_convert_using('Insert_priv') . ' = ' . $no

1988

. ' AND ' . PMA_convert_using('Update_priv') . ' = ' . $no

1989

. ' AND ' . PMA_convert_using('Delete_priv') . ' = ' . $no

1990

. ' AND ' . PMA_convert_using('Create_priv') . ' = ' . $no

1991

. ' AND ' . PMA_convert_using('Drop_priv') . ' = ' . $no

1992

. ' AND ' . PMA_convert_using('Grant_priv') . ' = ' . $no

1993

. ' AND ' . PMA_convert_using('References_priv') . ' = ' . $no;

1994

1995

$sql_query =

1996

'(SELECT ' . PMA_convert_using('`User`') . ' AS `User`, '

1997

. PMA_convert_using('`Host`') . ' AS `Host`, '

1998

. PMA_convert_using('`Db`') . ' AS `Db`, '

1999

. $list_of_privileges

2000

.' FROM `mysql`.`db`'

2001

.' WHERE ' . PMA_convert_using( $checkprivs, 'quoted' )

2002

.' LIKE ' . PMA_convert_using('`Db`')

2003

.' AND NOT (' . $list_of_compared_privileges. ')) '

2004

.'UNION '

2005

.'(SELECT ' . PMA_convert_using('`User`') . ' AS `User`, '

2006

. PMA_convert_using('`Host`') . ' AS `Host`, '

2007

. PMA_convert_using('*', 'quoted') .' AS `Db`, '

2008

. $list_of_privileges

2009

.' FROM `mysql`.`user` '

2010

.' WHERE NOT (' . $list_of_compared_privileges . ')) '

2011

.' ORDER BY `User` ASC,'

2012

.' `Host` ASC,'

2013

.' `Db` ASC;';

2014

$res = PMA_DBI_query($sql_query);

2015

$row = PMA_DBI_fetch_assoc($res);

2016

if ($row) {

2017

$found = TRUE;

2018

}

2019

} else {

2020

// With MySQL 3, we need 2 seperate queries here.

2021

        $sql_query = 'SELECT * FROM `mysql`.`user` WHERE NOT (`Select_priv` = \'N\' AND `Insert_priv` = \'N\' AND `Update_priv` = \'N\' AND `Delete_priv` = \'N\' AND `Create_priv` = \'N\' AND `Drop_priv` = \'N\' AND `Grant_priv` = \'N\' AND `References_priv` = \'N\') ORDER BY `User` ASC, `Host` ASC;';

2022

$res1 = PMA_DBI_query($sql_query);

2023

$row1 = PMA_DBI_fetch_assoc($res1);

2024

$sql_query =

2025

'SELECT * FROM `mysql`.`db`'

2026

.' WHERE \'' . $checkprivs . '\''

2027

.' LIKE `Db`'

2028

.' AND NOT (`Select_priv` = \'N\''

2029

.' AND `Insert_priv` = \'N\''

2030

.' AND `Update_priv` = \'N\''

2031

.' AND `Delete_priv` = \'N\''

2032

.' AND `Create_priv` = \'N\''

2033

.' AND `Drop_priv` = \'N\''

2034

.' AND `Grant_priv` = \'N\''

2035

.' AND `References_priv` = \'N\')'

2036

.' ORDER BY `User` ASC, `Host` ASC;';

2037

$res2 = PMA_DBI_query($sql_query);

2038

$row2 = PMA_DBI_fetch_assoc($res2);

2039

if ($row1 || $row2) {

2040

$found = TRUE;

2041

}

2042

} // end if (PMA_MYSQL_INT_VERSION >= 40000) ... else ...

2043

if ($found) {

2044

while (TRUE) {

2045

// prepare the current user

2046

if (PMA_MYSQL_INT_VERSION >= 40000) {

2047

$current_privileges = array();

2048

$current_user = $row['User'];

2049

$current_host = $row['Host'];

2050

while ($row && $current_user == $row['User'] && $current_host == $row['Host']) {

2051

$current_privileges[] = $row;

2052

$row = PMA_DBI_fetch_assoc($res);

2053

}

2054

} else {

2055

$current_privileges = array();

2056

                if ($row1 && (!$row2 || ($row1['User'] < $row2['User'] || ($row1['User'] == $row2['User'] && $row1['Host'] <= $row2['Host'])))) {

2057

$current_user = $row1['User'];

2058

$current_host = $row1['Host'];

2059

$current_privileges = array($row1);

2060

$row1 = PMA_DBI_fetch_assoc($res1);

2061

} else {

2062

$current_user = $row2['User'];

2063

$current_host = $row2['Host'];

2064

$current_privileges = array();

2065

}

2066

while ($row2 && $current_user == $row2['User'] && $current_host == $row2['Host']) {

2067

$current_privileges[] = $row2;

2068

$row2 = PMA_DBI_fetch_assoc($res2);

2069

}

2070

}

2071

echo ' <tr class="' . ( $odd_row ? 'odd' : 'even' ) . '">' . "\n"

2072

. ' <td';

2073

if (count($current_privileges) > 1) {

2074

echo ' rowspan="' . count($current_privileges) . '"';

2075

}

2076

            echo '>' . (empty($current_user) ? '<span style="color: #FF0000">' . $GLOBALS['strAny'] . '</span>' : htmlspecialchars($current_user)) . "\n"

2077

. ' </td>' . "\n"

2078

. ' <td';

2079

if (count($current_privileges) > 1) {

2080

echo ' rowspan="' . count($current_privileges) . '"';

2081

}

2082

echo '>' . htmlspecialchars($current_host) . '</td>' . "\n";

2083

foreach ($current_privileges as $current) {

2084

echo ' <td>' . "\n"

2085

. ' ';

2086

if (!isset($current['Db']) || $current['Db'] == '*') {

2087

echo $GLOBALS['strGlobal'];

2088

} elseif ( $current['Db'] == PMA_escape_mysql_wildcards( $checkprivs ) ) {

2089

echo $GLOBALS['strDbSpecific'];

2090

} else {

2091

echo $GLOBALS['strWildcard'], ': <tt>' . htmlspecialchars($current['Db']) . '</tt>';

2092

}

2093

echo "\n"

2094

. ' </td>' . "\n"

2095

. ' <td>' . "\n"

2096

. ' <tt>' . "\n"

2097

                   . '                ' . join(',' . "\n" . '                ', PMA_extractPrivInfo($current, TRUE)) . "\n"

2098

. ' </tt>' . "\n"

2099

. ' </td>' . "\n"

2100

. ' <td>' . "\n"

2101

. ' ' . ($current['Grant_priv'] == 'Y' ? $GLOBALS['strYes'] : $GLOBALS['strNo']) . "\n"

2102

. ' </td>' . "\n"

2103

. ' <td>' . "\n";

2104

printf( $link_edit, urlencode( $current_user ),

2105

urlencode( $current_host ),

2106

urlencode( ! isset( $current['Db'] ) || $current['Db'] == '*' ? '' : $current['Db'] ),

2107

'' );

2108

echo '</td>' . "\n"

2109

. ' </tr>' . "\n";

2110

}

2111

if (empty($row) && empty($row1) && empty($row2)) {

2112

break;

2113

}

2114

$odd_row = ! $odd_row;

2115

}

2116

} else {

2117

echo ' <tr class="odd">' . "\n"

2118

. ' <td colspan="6">' . "\n"

2119

. ' ' . $GLOBALS['strNoUsersFound'] . "\n"

2120

. ' </td>' . "\n"

2121

. ' </tr>' . "\n";

2122

}

2123

echo '</tbody>' . "\n"

2124

. '</table>' . "\n";

2125

} // end if (empty($adduser) && empty($checkprivs)) ... elseif ... else ...

2126

2127

2128

/**

2129

* Displays the footer

2130

*/

2131

echo "\n\n";

2132

require_once('./libraries/footer.inc.php');

2133

2134

?>

Subversion Repositories – MLAB

(root)/Web/Maintenance/phpMyAdmin/server_privileges.php @ 250

Rev