?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Translation update done using Pootle.
[phpmyadmin/dkf.git] / server_privileges.php
blob87c71b81f6ce1b37b3e7ce629b5981567cbab59c
1 <?php
2 /* vim: set expandtab sw=4 ts=4 sts=4: */
3 /**
4 *
5 * @version $Id$
6 * @package phpMyAdmin
7 */
8
9 /**
10 *
11 */
12 require_once './libraries/common.inc.php';
13
14 /**
15 * Does the common work
16 */
17 $GLOBALS['js_include'][] = 'server_privileges.js';
18 $GLOBALS['js_include'][] = 'functions.js';
19 require './libraries/server_common.inc.php';
20
21
22 /**
23 * Checks if a dropdown box has been used for selecting a database / table
24 */
25 if (PMA_isValid($_REQUEST['pred_tablename'])) {
26 $tablename = $_REQUEST['pred_tablename'];
27 unset($pred_tablename);
28 } elseif (PMA_isValid($_REQUEST['tablename'])) {
29 $tablename = $_REQUEST['tablename'];
30 } else {
31 unset($tablename);
32 }
33
34 if (PMA_isValid($_REQUEST['pred_dbname'])) {
35 $dbname = $_REQUEST['pred_dbname'];
36 unset($pred_dbname);
37 } elseif (PMA_isValid($_REQUEST['dbname'])) {
38 $dbname = $_REQUEST['dbname'];
39 } else {
40 unset($dbname);
41 unset($tablename);
42 }
43
44 if (isset($dbname)) {
45 $db_and_table = PMA_backquote(PMA_unescape_mysql_wildcards($dbname)) . '.';
46 if (isset($tablename)) {
47 $db_and_table .= PMA_backquote($tablename);
48 } else {
49 $db_and_table .= '*';
50 }
51 } else {
52 $db_and_table = '*.*';
53 }
54
55 // check if given $dbname is a wildcard or not
56 if (isset($dbname)) {
57 //if (preg_match('/\\\\(?:_|%)/i', $dbname)) {
58 if (preg_match('/(?<!\\\\)(?:_|%)/i', $dbname)) {
59 $dbname_is_wildcard = true;
60 } else {
61 $dbname_is_wildcard = false;
62 }
63 }
64
65 /**
66 * Checks if the user is allowed to do what he tries to...
67 */
68 if (!$is_superuser) {
69 require './libraries/server_links.inc.php';
70 echo '<h2>' . "\n"
71 . PMA_getIcon('b_usrlist.png')
72 . __('Privileges') . "\n"
73 . '</h2>' . "\n";
74 PMA_Message::error(__('No Privileges'))->display();
75 require_once './libraries/footer.inc.php';
76 }
77
78 /**
79 * Escapes wildcard in a database+table specification
80 * before using it in a GRANT statement.
81 *
82 * Escaping a wildcard character in a GRANT is only accepted at the global
83 * or database level, not at table level; this is why I remove
84 * the escaping character. Internally, in mysql.tables_priv.Db there are
85 * no escaping (for example test_db) but in mysql.db you'll see test\_db
86 * for a db-specific privilege.
87 *
88 * @param string $db_and_table
89 * @param string $dbname
90 * @param string $tablename
91 * @return string the escaped (if necessary) $db_and_table
92 */
93 function PMA_WildcardEscapeForGrant($db_and_table, $dbname, $tablename) {
94
95 if (! strlen($dbname)) {
96 $db_and_table = '*.*';
97 } else {
98 if (strlen($tablename)) {
99 $db_and_table = PMA_backquote(PMA_unescape_mysql_wildcards($dbname)) . '.';
100 $db_and_table .= PMA_backquote($tablename);
101 } else {
102 $db_and_table = PMA_backquote($dbname) . '.';
103 $db_and_table .= '*';
104 }
105 }
106 return $db_and_table;
107 }
108
109 /**
110 * Generates a condition on the user name
111 *
112 * @param string the user's initial
113 * @return string the generated condition
114 */
115 function PMA_RangeOfUsers($initial = '')
116 {
117 // strtolower() is used because the User field
118 // might be BINARY, so LIKE would be case sensitive
119 if (!empty($initial)) {
120 $ret = " WHERE `User` LIKE '" . $initial . "%'"
121 . " OR `User` LIKE '" . strtolower($initial) . "%'";
122 } else {
123 $ret = '';
124 }
125 return $ret;
126 } // end function
127
128 /**
129 * Extracts the privilege information of a priv table row
130 *
131 * @param array $row the row
132 * @param boolean $enableHTML add <dfn> tag with tooltips
133 *
134 * @global ressource $user_link the database connection
135 *
136 * @return array
137 */
138 function PMA_extractPrivInfo($row = '', $enableHTML = FALSE)
139 {
140 $grants = array(
141 array('Select_priv', 'SELECT', __('Allows reading data.')),
142 array('Insert_priv', 'INSERT', __('Allows inserting and replacing data.')),
143 array('Update_priv', 'UPDATE', __('Allows changing data.')),
144 array('Delete_priv', 'DELETE', __('Allows deleting data.')),
145 array('Create_priv', 'CREATE', __('Allows creating new databases and tables.')),
146 array('Drop_priv', 'DROP', __('Allows dropping databases and tables.')),
147 array('Reload_priv', 'RELOAD', __('Allows reloading server settings and flushing the server\'s caches.')),
148 array('Shutdown_priv', 'SHUTDOWN', __('Allows shutting down the server.')),
149 array('Process_priv', 'PROCESS', __('Allows viewing processes of all users')),
150 array('File_priv', 'FILE', __('Allows importing data from and exporting data into files.')),
151 array('References_priv', 'REFERENCES', __('Has no effect in this MySQL version.')),
152 array('Index_priv', 'INDEX', __('Allows creating and dropping indexes.')),
153 array('Alter_priv', 'ALTER', __('Allows altering the structure of existing tables.')),
154 array('Show_db_priv', 'SHOW DATABASES', __('Gives access to the complete list of databases.')),
155 array('Super_priv', 'SUPER', __('Allows connecting, even if maximum number of connections is reached; required for most administrative operations like setting global variables or killing threads of other users.')),
156 array('Create_tmp_table_priv', 'CREATE TEMPORARY TABLES', __('Allows creating temporary tables.')),
157 array('Lock_tables_priv', 'LOCK TABLES', __('Allows locking tables for the current thread.')),
158 array('Repl_slave_priv', 'REPLICATION SLAVE', __('Needed for the replication slaves.')),
159 array('Repl_client_priv', 'REPLICATION CLIENT', __('Allows the user to ask where the slaves / masters are.')),
160 array('Create_view_priv', 'CREATE VIEW', __('Allows creating new views.')),
161 array('Event_priv', 'EVENT', __('Allows to set up events for the event scheduler')),
162 array('Trigger_priv', 'TRIGGER', __('Allows creating and dropping triggers')),
163 // for table privs:
164 array('Create View_priv', 'CREATE VIEW', __('Allows creating new views.')),
165 array('Show_view_priv', 'SHOW VIEW', __('Allows performing SHOW CREATE VIEW queries.')),
166 // for table privs:
167 array('Show view_priv', 'SHOW VIEW', __('Allows performing SHOW CREATE VIEW queries.')),
168 array('Create_routine_priv', 'CREATE ROUTINE', __('Allows creating stored routines.')),
169 array('Alter_routine_priv', 'ALTER ROUTINE', __('Allows altering and dropping stored routines.')),
170 array('Create_user_priv', 'CREATE USER', __('Allows creating, dropping and renaming user accounts.')),
171 array('Execute_priv', 'EXECUTE', __('Allows executing stored routines.')),
172 );
173
174 if (!empty($row) && isset($row['Table_priv'])) {
175 $row1 = PMA_DBI_fetch_single_row(
176 'SHOW COLUMNS FROM `mysql`.`tables_priv` LIKE \'Table_priv\';',
177 'ASSOC', $GLOBALS['userlink']);
178 $av_grants = explode('\',\'', substr($row1['Type'], 5, strlen($row1['Type']) - 7));
179 unset($row1);
180 $users_grants = explode(',', $row['Table_priv']);
181 foreach ($av_grants as $current_grant) {
182 $row[$current_grant . '_priv'] = in_array($current_grant, $users_grants) ? 'Y' : 'N';
183 }
184 unset($current_grant);
185 unset($av_grants);
186 unset($users_grants);
187 }
188 $privs = array();
189 $allPrivileges = TRUE;
190 foreach ($grants as $current_grant) {
191 if ((!empty($row) && isset($row[$current_grant[0]]))
192 || (empty($row) && isset($GLOBALS[$current_grant[0]]))) {
193 if ((!empty($row) && $row[$current_grant[0]] == 'Y')
194 || (empty($row)
195 && ($GLOBALS[$current_grant[0]] == 'Y'
196 || (is_array($GLOBALS[$current_grant[0]])
197 && count($GLOBALS[$current_grant[0]]) == $GLOBALS['column_count']
198 && empty($GLOBALS[$current_grant[0] . '_none'])))))
199 {
200 if ($enableHTML) {
201 $privs[] = '<dfn title="' . $current_grant[2] . '">' . $current_grant[1] . '</dfn>';
202 } else {
203 $privs[] = $current_grant[1];
204 }
205 } elseif (!empty($GLOBALS[$current_grant[0]])
206 && is_array($GLOBALS[$current_grant[0]])
207 && empty($GLOBALS[$current_grant[0] . '_none'])) {
208 if ($enableHTML) {
209 $priv_string = '<dfn title="' . $current_grant[2] . '">' . $current_grant[1] . '</dfn>';
210 } else {
211 $priv_string = $current_grant[1];
212 }
213 $privs[] = $priv_string . ' (`' . join('`, `', $GLOBALS[$current_grant[0]]) . '`)';
214 } else {
215 $allPrivileges = FALSE;
216 }
217 }
218 }
219 if (empty($privs)) {
220 if ($enableHTML) {
221 $privs[] = '<dfn title="' . __('No privileges.') . '">USAGE</dfn>';
222 } else {
223 $privs[] = 'USAGE';
224 }
225 } elseif ($allPrivileges && (!isset($GLOBALS['grant_count']) || count($privs) == $GLOBALS['grant_count'])) {
226 if ($enableHTML) {
227 $privs = array('<dfn title="' . __('Includes all privileges except GRANT.') . '">ALL PRIVILEGES</dfn>');
228 } else {
229 $privs = array('ALL PRIVILEGES');
230 }
231 }
232 return $privs;
233 } // end of the 'PMA_extractPrivInfo()' function
234
235 /**
236 * Displays on which column(s) a table-specific privilege is granted
237 */
238 function PMA_display_column_privs($columns, $row, $name_for_select,
239 $priv_for_header, $name, $name_for_dfn, $name_for_current)
240 {
241 echo ' <div class="item" id="div_item_' . $name . '">' . "\n"
242 . ' <label for="select_' . $name . '_priv">' . "\n"
243 . ' <tt><dfn title="' . $name_for_dfn . '">'
244 . $priv_for_header . '</dfn></tt>' . "\n"
245 . ' </label><br />' . "\n"
246 . ' <select id="select_' . $name . '_priv" name="'
247 . $name_for_select . '[]" multiple="multiple" size="8">' . "\n";
248
249 foreach ($columns as $current_column => $current_column_privileges) {
250 echo ' <option value="' . htmlspecialchars($current_column) . '"';
251 if ($row[$name_for_select] == 'Y' || $current_column_privileges[$name_for_current]) {
252 echo ' selected="selected"';
253 }
254 echo '>' . htmlspecialchars($current_column) . '</option>' . "\n";
255 }
256
257 echo ' </select>' . "\n"
258 . ' <i>' . __('Or') . '</i>' . "\n"
259 . ' <label for="checkbox_' . $name_for_select
260 . '_none"><input type="checkbox"'
261 . (empty($GLOBALS['checkall']) ? '' : ' checked="checked"')
262 . ' name="' . $name_for_select . '_none" id="checkbox_'
263 . $name_for_select . '_none" title="' . _pgettext('None privileges', 'None') . '" />'
264 . _pgettext('None privileges', 'None') . '</label>' . "\n"
265 . ' </div>' . "\n";
266 } // end function
267
268
269 /**
270 * Displays the privileges form table
271 *
272 * @param string $db the database
273 * @param string $table the table
274 * @param boolean $submit wheather to display the submit button or not
275 * @global array $cfg the phpMyAdmin configuration
276 * @global ressource $user_link the database connection
277 *
278 * @return void
279 */
280 function PMA_displayPrivTable($db = '*', $table = '*', $submit = TRUE)
281 {
282 if ($db == '*') {
283 $table = '*';
284 }
285
286 if (isset($GLOBALS['username'])) {
287 $username = $GLOBALS['username'];
288 $hostname = $GLOBALS['hostname'];
289 if ($db == '*') {
290 $sql_query =
291 "SELECT * FROM `mysql`.`user`"
292 ." WHERE `User` = '" . PMA_sqlAddslashes($username) . "'"
293 ." AND `Host` = '" . PMA_sqlAddslashes($hostname) . "';";
294 } elseif ($table == '*') {
295 $sql_query =
296 "SELECT * FROM `mysql`.`db`"
297 ." WHERE `User` = '" . PMA_sqlAddslashes($username) . "'"
298 ." AND `Host` = '" . PMA_sqlAddslashes($hostname) . "'"
299 ." AND '" . PMA_unescape_mysql_wildcards($db) . "'"
300 ." LIKE `Db`;";
301 } else {
302 $sql_query =
303 "SELECT `Table_priv`"
304 ." FROM `mysql`.`tables_priv`"
305 ." WHERE `User` = '" . PMA_sqlAddslashes($username) . "'"
306 ." AND `Host` = '" . PMA_sqlAddslashes($hostname) . "'"
307 ." AND `Db` = '" . PMA_unescape_mysql_wildcards($db) . "'"
308 ." AND `Table_name` = '" . PMA_sqlAddslashes($table) . "';";
309 }
310 $row = PMA_DBI_fetch_single_row($sql_query);
311 }
312 if (empty($row)) {
313 if ($table == '*') {
314 if ($db == '*') {
315 $sql_query = 'SHOW COLUMNS FROM `mysql`.`user`;';
316 } elseif ($table == '*') {
317 $sql_query = 'SHOW COLUMNS FROM `mysql`.`db`;';
318 }
319 $res = PMA_DBI_query($sql_query);
320 while ($row1 = PMA_DBI_fetch_row($res)) {
321 if (substr($row1[0], 0, 4) == 'max_') {
322 $row[$row1[0]] = 0;
323 } else {
324 $row[$row1[0]] = 'N';
325 }
326 }
327 PMA_DBI_free_result($res);
328 } else {
329 $row = array('Table_priv' => '');
330 }
331 }
332 if (isset($row['Table_priv'])) {
333 $row1 = PMA_DBI_fetch_single_row(
334 'SHOW COLUMNS FROM `mysql`.`tables_priv` LIKE \'Table_priv\';',
335 'ASSOC', $GLOBALS['userlink']);
336 // note: in MySQL 5.0.3 we get "Create View', 'Show view';
337 // the View for Create is spelled with uppercase V
338 // the view for Show is spelled with lowercase v
339 // and there is a space between the words
340
341 $av_grants = explode('\',\'', substr($row1['Type'], strpos($row1['Type'], '(') + 2, strpos($row1['Type'], ')') - strpos($row1['Type'], '(') - 3));
342 unset($row1);
343 $users_grants = explode(',', $row['Table_priv']);
344
345 foreach ($av_grants as $current_grant) {
346 $row[$current_grant . '_priv'] = in_array($current_grant, $users_grants) ? 'Y' : 'N';
347 }
348 unset($row['Table_priv'], $current_grant, $av_grants, $users_grants);
349
350 // get collumns
351 $res = PMA_DBI_try_query('SHOW COLUMNS FROM ' . PMA_backquote(PMA_unescape_mysql_wildcards($db)) . '.' . PMA_backquote($table) . ';');
352 $columns = array();
353 if ($res) {
354 while ($row1 = PMA_DBI_fetch_row($res)) {
355 $columns[$row1[0]] = array(
356 'Select' => FALSE,
357 'Insert' => FALSE,
358 'Update' => FALSE,
359 'References' => FALSE
360 );
361 }
362 PMA_DBI_free_result($res);
363 }
364 unset($res, $row1);
365 }
366 // t a b l e - s p e c i f i c p r i v i l e g e s
367 if (! empty($columns)) {
368 $res = PMA_DBI_query(
369 'SELECT `Column_name`, `Column_priv`'
370 .' FROM `mysql`.`columns_priv`'
371 .' WHERE `User`'
372 .' = \'' . PMA_sqlAddslashes($username) . "'"
373 .' AND `Host`'
374 .' = \'' . PMA_sqlAddslashes($hostname) . "'"
375 .' AND `Db`'
376 .' = \'' . PMA_sqlAddslashes(PMA_unescape_mysql_wildcards($db)) . "'"
377 .' AND `Table_name`'
378 .' = \'' . PMA_sqlAddslashes($table) . '\';');
379
380 while ($row1 = PMA_DBI_fetch_row($res)) {
381 $row1[1] = explode(',', $row1[1]);
382 foreach ($row1[1] as $current) {
383 $columns[$row1[0]][$current] = TRUE;
384 }
385 }
386 PMA_DBI_free_result($res);
387 unset($res, $row1, $current);
388
389 echo '<input type="hidden" name="grant_count" value="' . count($row) . '" />' . "\n"
390 . '<input type="hidden" name="column_count" value="' . count($columns) . '" />' . "\n"
391 . '<fieldset id="fieldset_user_priv">' . "\n"
392 . ' <legend>' . __('Table-specific privileges')
393 . PMA_showHint(__(' Note: MySQL privilege names are expressed in English '))
394 . '</legend>' . "\n";
395
396
397
398 // privs that are attached to a specific column
399 PMA_display_column_privs($columns, $row, 'Select_priv',
400 'SELECT', 'select', __('Allows reading data.'), 'Select');
401
402 PMA_display_column_privs($columns, $row, 'Insert_priv',
403 'INSERT', 'insert', __('Allows inserting and replacing data.'), 'Insert');
404
405 PMA_display_column_privs($columns, $row, 'Update_priv',
406 'UPDATE', 'update', __('Allows changing data.'), 'Update');
407
408 PMA_display_column_privs($columns, $row, 'References_priv',
409 'REFERENCES', 'references', __('Has no effect in this MySQL version.'), 'References');
410
411 // privs that are not attached to a specific column
412
413 echo ' <div class="item">' . "\n";
414 foreach ($row as $current_grant => $current_grant_value) {
415 if (in_array(substr($current_grant, 0, (strlen($current_grant) - 5)),
416 array('Select', 'Insert', 'Update', 'References'))) {
417 continue;
418 }
419 // make a substitution to match the messages variables;
420 // also we must substitute the grant we get, because we can't generate
421 // a form variable containing blanks (those would get changed to
422 // an underscore when receiving the POST)
423 if ($current_grant == 'Create View_priv') {
424 $tmp_current_grant = 'CreateView_priv';
425 $current_grant = 'Create_view_priv';
426 } elseif ($current_grant == 'Show view_priv') {
427 $tmp_current_grant = 'ShowView_priv';
428 $current_grant = 'Show_view_priv';
429 } else {
430 $tmp_current_grant = $current_grant;
431 }
432
433 echo ' <div class="item">' . "\n"
434 . ' <input type="checkbox"'
435 . (empty($GLOBALS['checkall']) ? '' : ' checked="checked"')
436 . ' name="' . $current_grant . '" id="checkbox_' . $current_grant
437 . '" value="Y" '
438 . ($current_grant_value == 'Y' ? 'checked="checked" ' : '')
439 . 'title="';
440
441 echo (isset($GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5))])
442 ? $GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5))]
443 : $GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5)) . 'Tbl']) . '"/>' . "\n";
444
445 echo ' <label for="checkbox_' . $current_grant
446 . '"><tt><dfn title="'
447 . (isset($GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5))])
448 ? $GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5))]
449 : $GLOBALS['strPrivDesc' . substr($tmp_current_grant, 0, (strlen($tmp_current_grant) - 5)) . 'Tbl'])
450 . '">' . strtoupper(substr($current_grant, 0, strlen($current_grant) - 5)) . '</dfn></tt></label>' . "\n"
451 . ' </div>' . "\n";
452 } // end foreach ()
453
454 echo ' </div>' . "\n";
455 // for Safari 2.0.2
456 echo ' <div class="clearfloat"></div>' . "\n";
457
458 } else {
459
460 // g l o b a l o r d b - s p e c i f i c
461 //
462 // d a t a
463 $privTable[0] = array(
464 array('Select', 'SELECT', __('Allows reading data.')),
465 array('Insert', 'INSERT', __('Allows inserting and replacing data.')),
466 array('Update', 'UPDATE', __('Allows changing data.')),
467 array('Delete', 'DELETE', __('Allows deleting data.'))
468 );
469 if ($db == '*') {
470 $privTable[0][] = array('File', 'FILE', __('Allows importing data from and exporting data into files.'));
471 }
472
473 // s t r u c t u r e
474 $privTable[1] = array(
475 array('Create', 'CREATE', ($table == '*' ? __('Allows creating new databases and tables.') : __('Allows creating new tables.'))),
476 array('Alter', 'ALTER', __('Allows altering the structure of existing tables.')),
477 array('Index', 'INDEX', __('Allows creating and dropping indexes.')),
478 array('Drop', 'DROP', ($table == '*' ? __('Allows dropping databases and tables.') : __('Allows dropping tables.'))),
479 array('Create_tmp_table', 'CREATE TEMPORARY TABLES', __('Allows creating temporary tables.')),
480 array('Show_view', 'SHOW VIEW', __('Allows performing SHOW CREATE VIEW queries.')),
481 array('Create_routine', 'CREATE ROUTINE', __('Allows creating stored routines.')),
482 array('Alter_routine', 'ALTER ROUTINE', __('Allows altering and dropping stored routines.')),
483 array('Execute', 'EXECUTE', __('Allows executing stored routines.')),
484 );
485 // this one is for a db-specific priv: Create_view_priv
486 if (isset($row['Create_view_priv'])) {
487 $privTable[1][] = array('Create_view', 'CREATE VIEW', __('Allows creating new views.'));
488 }
489 // this one is for a table-specific priv: Create View_priv
490 if (isset($row['Create View_priv'])) {
491 $privTable[1][] = array('Create View', 'CREATE VIEW', __('Allows creating new views.'));
492 }
493 if (isset($row['Event_priv'])) {
494 // MySQL 5.1.6
495 $privTable[1][] = array('Event', 'EVENT', __('Allows to set up events for the event scheduler'));
496 $privTable[1][] = array('Trigger', 'TRIGGER', __('Allows creating and dropping triggers'));
497 }
498
499 // a d m i n i s t r a t i o n
500 $privTable[2] = array(
501 array('Grant', 'GRANT', __('Allows adding users and privileges without reloading the privilege tables.')),
502 );
503 if ($db == '*') {
504 $privTable[2][] = array('Super', 'SUPER', __('Allows connecting, even if maximum number of connections is reached; required for most administrative operations like setting global variables or killing threads of other users.'));
505 $privTable[2][] = array('Process', 'PROCESS', __('Allows viewing processes of all users'));
506 $privTable[2][] = array('Reload', 'RELOAD', __('Allows reloading server settings and flushing the server\'s caches.'));
507 $privTable[2][] = array('Shutdown', 'SHUTDOWN', __('Allows shutting down the server.'));
508 $privTable[2][] = array('Show_db', 'SHOW DATABASES', __('Gives access to the complete list of databases.'));
509 }
510 $privTable[2][] = array('Lock_tables', 'LOCK TABLES', __('Allows locking tables for the current thread.'));
511 $privTable[2][] = array('References', 'REFERENCES', __('Has no effect in this MySQL version.'));
512 if ($db == '*') {
513 $privTable[2][] = array('Repl_client', 'REPLICATION CLIENT', __('Allows the user to ask where the slaves / masters are.'));
514 $privTable[2][] = array('Repl_slave', 'REPLICATION SLAVE', __('Needed for the replication slaves.'));
515 $privTable[2][] = array('Create_user', 'CREATE USER', __('Allows creating, dropping and renaming user accounts.'));
516 }
517 echo '<input type="hidden" name="grant_count" value="'
518 . (count($privTable[0]) + count($privTable[1]) + count($privTable[2]) - (isset($row['Grant_priv']) ? 1 : 0))
519 . '" />' . "\n"
520 . '<fieldset id="fieldset_user_global_rights">' . "\n"
521 . ' <legend>' . "\n"
522 . ' '
523 . ($db == '*'
524 ? __('Global privileges')
525 : ($table == '*'
526 ? __('Database-specific privileges')
527 : __('Table-specific privileges'))) . "\n"
528 . ' (<a href="server_privileges.php?'
529 . $GLOBALS['url_query'] . '&amp;checkall=1" onclick="setCheckboxes(\'usersForm\', true); return false;">'
530 . __('Check All') . '</a> /' . "\n"
531 . ' <a href="server_privileges.php?'
532 . $GLOBALS['url_query'] . '" onclick="setCheckboxes(\'usersForm\', false); return false;">'
533 . __('Uncheck All') . '</a>)' . "\n"
534 . ' </legend>' . "\n"
535 . ' <p><small><i>' . __(' Note: MySQL privilege names are expressed in English ') . '</i></small></p>' . "\n"
536 . ' <fieldset>' . "\n"
537 . ' <legend>' . __('Data') . '</legend>' . "\n";
538 foreach ($privTable[0] as $priv)
539 {
540 echo ' <div class="item">' . "\n"
541 . ' <input type="checkbox"'
542 . (empty($GLOBALS['checkall']) ? '' : ' checked="checked"')
543 . ' name="' . $priv[0] . '_priv" id="checkbox_' . $priv[0]
544 . '_priv" value="Y" '
545 . ($row[$priv[0] . '_priv'] == 'Y' ? 'checked="checked" ' : '')
546 . 'title="' . $priv[2] . '"/>' . "\n"
547 . ' <label for="checkbox_' . $priv[0]
548 . '_priv"><tt><dfn title="' . $priv[2] . '">' . $priv[1]
549 . '</dfn></tt></label>' . "\n"
550 . ' </div>' . "\n";
551 }
552 echo ' </fieldset>' . "\n"
553 . ' <fieldset>' . "\n"
554 . ' <legend>' . __('Structure') . '</legend>' . "\n";
555 foreach ($privTable[1] as $priv)
556 {
557 echo ' <div class="item">' . "\n"
558 . ' <input type="checkbox"'
559 . (empty($GLOBALS['checkall']) ? '' : ' checked="checked"')
560 . ' name="' . $priv[0] . '_priv" id="checkbox_' . $priv[0]
561 . '_priv" value="Y" '
562 . ($row[$priv[0] . '_priv'] == 'Y' ? 'checked="checked" ' : '')
563 . 'title="' . $priv[2] . '"/>' . "\n"
564 . ' <label for="checkbox_' . $priv[0]
565 . '_priv"><tt><dfn title="' . $priv[2] . '">' . $priv[1]
566 . '</dfn></tt></label>' . "\n"
567 . ' </div>' . "\n";
568 }
569 echo ' </fieldset>' . "\n"
570 . ' <fieldset>' . "\n"
571 . ' <legend>' . __('Administration') . '</legend>' . "\n";
572 foreach ($privTable[2] as $priv)
573 {
574 echo ' <div class="item">' . "\n"
575 . ' <input type="checkbox"'
576 . (empty($GLOBALS['checkall']) ? '' : ' checked="checked"')
577 . ' name="' . $priv[0] . '_priv" id="checkbox_' . $priv[0]
578 . '_priv" value="Y" '
579 . ($row[$priv[0] . '_priv'] == 'Y' ? 'checked="checked" ' : '')
580 . 'title="' . $priv[2] . '"/>' . "\n"
581 . ' <label for="checkbox_' . $priv[0]
582 . '_priv"><tt><dfn title="' . $priv[2] . '">' . $priv[1]
583 . '</dfn></tt></label>' . "\n"
584 . ' </div>' . "\n";
585 }
586
587 echo ' </fieldset>' . "\n";
588 // The "Resource limits" box is not displayed for db-specific privs
589 if ($db == '*') {
590 echo ' <fieldset>' . "\n"
591 . ' <legend>' . __('Resource limits') . '</legend>' . "\n"
592 . ' <p><small><i>' . __('Note: Setting these options to 0 (zero) removes the limit.') . '</i></small></p>' . "\n"
593 . ' <div class="item">' . "\n"
594 . ' <label for="text_max_questions"><tt><dfn title="'
595 . __('Limits the number of queries the user may send to the server per hour.') . '">MAX QUERIES PER HOUR</dfn></tt></label>' . "\n"
596 . ' <input type="text" name="max_questions" id="text_max_questions" value="'
597 . $row['max_questions'] . '" size="11" maxlength="11" title="' . __('Limits the number of queries the user may send to the server per hour.') . '" />' . "\n"
598 . ' </div>' . "\n"
599 . ' <div class="item">' . "\n"
600 . ' <label for="text_max_updates"><tt><dfn title="'
601 . __('Limits the number of commands that change any table or database the user may execute per hour.') . '">MAX UPDATES PER HOUR</dfn></tt></label>' . "\n"
602 . ' <input type="text" name="max_updates" id="text_max_updates" value="'
603 . $row['max_updates'] . '" size="11" maxlength="11" title="' . __('Limits the number of commands that change any table or database the user may execute per hour.') . '" />' . "\n"
604 . ' </div>' . "\n"
605 . ' <div class="item">' . "\n"
606 . ' <label for="text_max_connections"><tt><dfn title="'
607 . __('Limits the number of new connections the user may open per hour.') . '">MAX CONNECTIONS PER HOUR</dfn></tt></label>' . "\n"
608 . ' <input type="text" name="max_connections" id="text_max_connections" value="'
609 . $row['max_connections'] . '" size="11" maxlength="11" title="' . __('Limits the number of new connections the user may open per hour.') . '" />' . "\n"
610 . ' </div>' . "\n"
611 . ' <div class="item">' . "\n"
612 . ' <label for="text_max_user_connections"><tt><dfn title="'
613 . __('Limits the number of simultaneous connections the user may have.') . '">MAX USER_CONNECTIONS</dfn></tt></label>' . "\n"
614 . ' <input type="text" name="max_user_connections" id="text_max_user_connections" value="'
615 . $row['max_user_connections'] . '" size="11" maxlength="11" title="' . __('Limits the number of simultaneous connections the user may have.') . '" />' . "\n"
616 . ' </div>' . "\n"
617 . ' </fieldset>' . "\n";
618 }
619 // for Safari 2.0.2
620 echo ' <div class="clearfloat"></div>' . "\n";
621 }
622 echo '</fieldset>' . "\n";
623 if ($submit) {
624 echo '<fieldset id="fieldset_user_privtable_footer" class="tblFooters">' . "\n"
625 . ' <input type="submit" name="update_privs" value="' . __('Go') . '" />' . "\n"
626 . '</fieldset>' . "\n";
627 }
628 } // end of the 'PMA_displayPrivTable()' function
629
630
631 /**
632 * Displays the fields used by the "new user" form as well as the
633 * "change login information / copy user" form.
634 *
635 * @param string $mode are we creating a new user or are we just
636 * changing one? (allowed values: 'new', 'change')
637 * @global array $cfg the phpMyAdmin configuration
638 * @global ressource $user_link the database connection
639 *
640 * @return void
641 */
642 function PMA_displayLoginInformationFields($mode = 'new')
643 {
644 // Get user/host name lengths
645 $fields_info = PMA_DBI_get_fields('mysql', 'user');
646 $username_length = 16;
647 $hostname_length = 41;
648 foreach ($fields_info as $key => $val) {
649 if ($val['Field'] == 'User') {
650 strtok($val['Type'], '()');
651 $v = strtok('()');
652 if (is_int($v)) {
653 $username_length = $v;
654 }
655 } elseif ($val['Field'] == 'Host') {
656 strtok($val['Type'], '()');
657 $v = strtok('()');
658 if (is_int($v)) {
659 $hostname_length = $v;
660 }
661 }
662 }
663 unset($fields_info);
664
665 if (isset($GLOBALS['username']) && strlen($GLOBALS['username']) === 0) {
666 $GLOBALS['pred_username'] = 'any';
667 }
668 echo '<fieldset id="fieldset_add_user_login">' . "\n"
669 . '<legend>' . __('Login Information') . '</legend>' . "\n"
670 . '<div class="item">' . "\n"
671 . '<label for="select_pred_username">' . "\n"
672 . ' ' . __('User name') . ':' . "\n"
673 . '</label>' . "\n"
674 . '<span class="options">' . "\n"
675 . ' <select name="pred_username" id="select_pred_username" title="' . __('User name') . '"' . "\n"
676 . ' onchange="if (this.value == \'any\') { username.value = \'\'; } else if (this.value == \'userdefined\') { username.focus(); username.select(); }">' . "\n"
677 . ' <option value="any"' . ((isset($GLOBALS['pred_username']) && $GLOBALS['pred_username'] == 'any') ? ' selected="selected"' : '') . '>' . __('Any user') . '</option>' . "\n"
678 . ' <option value="userdefined"' . ((!isset($GLOBALS['pred_username']) || $GLOBALS['pred_username'] == 'userdefined') ? ' selected="selected"' : '') . '>' . __('Use text field') . ':</option>' . "\n"
679 . ' </select>' . "\n"
680 . '</span>' . "\n"
681 . '<input type="text" name="username" maxlength="'
682 . $username_length . '" title="' . __('User name') . '"'
683 . (empty($GLOBALS['username'])
684 ? ''
685 : ' value="' . htmlspecialchars(isset($GLOBALS['new_username'])
686 ? $GLOBALS['new_username']
687 : $GLOBALS['username']) . '"')
688 . ' onchange="pred_username.value = \'userdefined\';" />' . "\n"
689 . '</div>' . "\n"
690 . '<div class="item">' . "\n"
691 . '<label for="select_pred_hostname">' . "\n"
692 . ' ' . __('Host') . ':' . "\n"
693 . '</label>' . "\n"
694 . '<span class="options">' . "\n"
695 . ' <select name="pred_hostname" id="select_pred_hostname" title="' . __('Host') . '"' . "\n";
696 $_current_user = PMA_DBI_fetch_value('SELECT USER();');
697 if (! empty($_current_user)) {
698 $thishost = str_replace("'", '', substr($_current_user, (strrpos($_current_user, '@') + 1)));
699 if ($thishost == 'localhost' || $thishost == '127.0.0.1') {
700 unset($thishost);
701 }
702 }
703 echo ' onchange="if (this.value == \'any\') { hostname.value = \'%\'; } else if (this.value == \'localhost\') { hostname.value = \'localhost\'; } '
704 . (empty($thishost) ? '' : 'else if (this.value == \'thishost\') { hostname.value = \'' . addslashes(htmlspecialchars($thishost)) . '\'; } ')
705 . 'else if (this.value == \'hosttable\') { hostname.value = \'\'; } else if (this.value == \'userdefined\') { hostname.focus(); hostname.select(); }">' . "\n";
706 unset($_current_user);
707
708 // when we start editing a user, $GLOBALS['pred_hostname'] is not defined
709 if (!isset($GLOBALS['pred_hostname']) && isset($GLOBALS['hostname'])) {
710 switch (strtolower($GLOBALS['hostname'])) {
711 case 'localhost':
712 case '127.0.0.1':
713 $GLOBALS['pred_hostname'] = 'localhost';
714 break;
715 case '%':
716 $GLOBALS['pred_hostname'] = 'any';
717 break;
718 default:
719 $GLOBALS['pred_hostname'] = 'userdefined';
720 break;
721 }
722 }
723 echo ' <option value="any"'
724 . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'any')
725 ? ' selected="selected"' : '') . '>' . __('Any host')
726 . '</option>' . "\n"
727 . ' <option value="localhost"'
728 . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'localhost')
729 ? ' selected="selected"' : '') . '>' . __('Local')
730 . '</option>' . "\n";
731 if (!empty($thishost)) {
732 echo ' <option value="thishost"'
733 . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'thishost')
734 ? ' selected="selected"' : '') . '>' . __('This Host')
735 . '</option>' . "\n";
736 }
737 unset($thishost);
738 echo ' <option value="hosttable"'
739 . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'hosttable')
740 ? ' selected="selected"' : '') . '>' . __('Use Host Table')
741 . '</option>' . "\n"
742 . ' <option value="userdefined"'
743 . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'userdefined')
744 ? ' selected="selected"' : '')
745 . '>' . __('Use text field') . ':</option>' . "\n"
746 . ' </select>' . "\n"
747 . '</span>' . "\n"
748 . '<input type="text" name="hostname" maxlength="'
749 . $hostname_length . '" value="'
750 . htmlspecialchars(isset($GLOBALS['hostname']) ? $GLOBALS['hostname'] : '')
751 . '" title="' . __('Host')
752 . '" onchange="pred_hostname.value = \'userdefined\';" />' . "\n"
753 . PMA_showHint(__('When Host table is used, this field is ignored and values stored in Host table are used instead.'))
754 . '</div>' . "\n"
755 . '<div class="item">' . "\n"
756 . '<label for="select_pred_password">' . "\n"
757 . ' ' . __('Password') . ':' . "\n"
758 . '</label>' . "\n"
759 . '<span class="options">' . "\n"
760 . ' <select name="pred_password" id="select_pred_password" title="'
761 . __('Password') . '"' . "\n"
762 . ' onchange="if (this.value == \'none\') { pma_pw.value = \'\'; pma_pw2.value = \'\'; } else if (this.value == \'userdefined\') { pma_pw.focus(); pma_pw.select(); }">' . "\n"
763 . ($mode == 'change' ? ' <option value="keep" selected="selected">' . __('Do not change the password') . '</option>' . "\n" : '')
764 . ' <option value="none"';
765 if (isset($GLOBALS['username']) && $mode != 'change') {
766 echo ' selected="selected"';
767 }
768 echo '>' . __('No Password') . '</option>' . "\n"
769 . ' <option value="userdefined"' . (isset($GLOBALS['username']) ? '' : ' selected="selected"') . '>' . __('Use text field') . ':</option>' . "\n"
770 . ' </select>' . "\n"
771 . '</span>' . "\n"
772 . '<input type="password" id="text_pma_pw" name="pma_pw" title="' . __('Password') . '" onchange="pred_password.value = \'userdefined\';" />' . "\n"
773 . '</div>' . "\n"
774 . '<div class="item">' . "\n"
775 . '<label for="text_pma_pw2">' . "\n"
776 . ' ' . __('Re-type') . ':' . "\n"
777 . '</label>' . "\n"
778 . '<span class="options">&nbsp;</span>' . "\n"
779 . '<input type="password" name="pma_pw2" id="text_pma_pw2" title="' . __('Re-type') . '" onchange="pred_password.value = \'userdefined\';" />' . "\n"
780 . '</div>' . "\n"
781 . '<div class="item">' . "\n"
782 . '<label for="button_generate_password">' . "\n"
783 . ' ' . __('Generate Password') . ':' . "\n"
784 . '</label>' . "\n"
785 . '<span class="options">' . "\n"
786 . ' <input type="button" id="button_generate_password" value="' . __('Generate') . '" onclick="suggestPassword(this.form)" />' . "\n"
787 . '</span>' . "\n"
788 . '<input type="text" name="generated_pw" id="generated_pw" />' . "\n"
789 . '</div>' . "\n"
790 . '</fieldset>' . "\n";
791 } // end of the 'PMA_displayUserAndHostFields()' function
792
793 /**
794 * Changes / copies a user, part I
795 */
796 if (isset($_REQUEST['change_copy'])) {
797 $user_host_condition =
798 ' WHERE `User`'
799 .' = \'' . PMA_sqlAddslashes($old_username) . "'"
800 .' AND `Host`'
801 .' = \'' . PMA_sqlAddslashes($old_hostname) . '\';';
802 $row = PMA_DBI_fetch_single_row('SELECT * FROM `mysql`.`user` ' . $user_host_condition);
803 if (! $row) {
804 PMA_Message::notice(__('No user found.'))->display();
805 unset($_REQUEST['change_copy']);
806 } else {
807 extract($row, EXTR_OVERWRITE);
808 // Recent MySQL versions have the field "Password" in mysql.user,
809 // so the previous extract creates $Password but this script
810 // uses $password
811 if (!isset($password) && isset($Password)) {
812 $password = $Password;
813 }
814 $queries = array();
815 }
816 }
817
818
819 /**
820 * Adds a user
821 * (Changes / copies a user, part II)
822 */
823 if (isset($_REQUEST['adduser_submit']) || isset($_REQUEST['change_copy'])) {
824 $sql_query = '';
825 if ($pred_username == 'any') {
826 $username = '';
827 }
828 switch ($pred_hostname) {
829 case 'any':
830 $hostname = '%';
831 break;
832 case 'localhost':
833 $hostname = 'localhost';
834 break;
835 case 'hosttable':
836 $hostname = '';
837 break;
838 case 'thishost':
839 $_user_name = PMA_DBI_fetch_value('SELECT USER()');
840 $hostname = substr($_user_name, (strrpos($_user_name, '@') + 1));
841 unset($_user_name);
842 break;
843 }
844 $sql = "SELECT '1' FROM `mysql`.`user`"
845 . " WHERE `User` = '" . PMA_sqlAddslashes($username) . "'"
846 . " AND `Host` = '" . PMA_sqlAddslashes($hostname) . "';";
847 if (PMA_DBI_fetch_value($sql) == 1) {
848 $message = PMA_Message::error(__('The user %s already exists!'));
849 $message->addParam('[i]\'' . $username . '\'@\'' . $hostname . '\'[/i]');
850 $_REQUEST['adduser'] = true;
851 } else {
852
853 $create_user_real = 'CREATE USER \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\'';
854
855 $real_sql_query =
856 'GRANT ' . join(', ', PMA_extractPrivInfo()) . ' ON *.* TO \''
857 . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\'';
858 if ($pred_password != 'none' && $pred_password != 'keep') {
859 $sql_query = $real_sql_query . ' IDENTIFIED BY \'***\'';
860 $real_sql_query .= ' IDENTIFIED BY \'' . PMA_sqlAddslashes($pma_pw) . '\'';
861 if (isset($create_user_real)) {
862 $create_user_show = $create_user_real . ' IDENTIFIED BY \'***\'';
863 $create_user_real .= ' IDENTIFIED BY \'' . PMA_sqlAddslashes($pma_pw) . '\'';
864 }
865 } else {
866 if ($pred_password == 'keep' && !empty($password)) {
867 $real_sql_query .= ' IDENTIFIED BY PASSWORD \'' . $password . '\'';
868 if (isset($create_user_real)) {
869 $create_user_real .= ' IDENTIFIED BY PASSWORD \'' . $password . '\'';
870 }
871 }
872 $sql_query = $real_sql_query;
873 if (isset($create_user_real)) {
874 $create_user_show = $create_user_real;
875 }
876 }
877 /**
878 * @todo similar code appears twice in this script
879 */
880 if ((isset($Grant_priv) && $Grant_priv == 'Y')
881 || (isset($max_questions) || isset($max_connections)
882 || isset($max_updates) || isset($max_user_connections))) {
883 $real_sql_query .= ' WITH';
884 $sql_query .= ' WITH';
885 if (isset($Grant_priv) && $Grant_priv == 'Y') {
886 $real_sql_query .= ' GRANT OPTION';
887 $sql_query .= ' GRANT OPTION';
888 }
889 if (isset($max_questions)) {
890 // avoid negative values
891 $max_questions = max(0, (int)$max_questions);
892 $real_sql_query .= ' MAX_QUERIES_PER_HOUR ' . $max_questions;
893 $sql_query .= ' MAX_QUERIES_PER_HOUR ' . $max_questions;
894 }
895 if (isset($max_connections)) {
896 $max_connections = max(0, (int)$max_connections);
897 $real_sql_query .= ' MAX_CONNECTIONS_PER_HOUR ' . $max_connections;
898 $sql_query .= ' MAX_CONNECTIONS_PER_HOUR ' . $max_connections;
899 }
900 if (isset($max_updates)) {
901 $max_updates = max(0, (int)$max_updates);
902 $real_sql_query .= ' MAX_UPDATES_PER_HOUR ' . $max_updates;
903 $sql_query .= ' MAX_UPDATES_PER_HOUR ' . $max_updates;
904 }
905 if (isset($max_user_connections)) {
906 $max_user_connections = max(0, (int)$max_user_connections);
907 $real_sql_query .= ' MAX_USER_CONNECTIONS ' . $max_user_connections;
908 $sql_query .= ' MAX_USER_CONNECTIONS ' . $max_user_connections;
909 }
910 }
911 if (isset($create_user_real)) {
912 $create_user_real .= ';';
913 $create_user_show .= ';';
914 }
915 $real_sql_query .= ';';
916 $sql_query .= ';';
917 if (empty($_REQUEST['change_copy'])) {
918 $_error = false;
919
920 if (isset($create_user_real)) {
921 if (! PMA_DBI_try_query($create_user_real)) {
922 $_error = true;
923 }
924 $sql_query = $create_user_show . $sql_query;
925 }
926
927 if ($_error || ! PMA_DBI_try_query($real_sql_query)) {
928 $_REQUEST['createdb'] = false;
929 $message = PMA_Message::rawError(PMA_DBI_getError());
930 } else {
931 $message = PMA_Message::success(__('You have added a new user.'));
932 }
933
934 switch (PMA_ifSetOr($_REQUEST['createdb'], '0')) {
935 case '1' :
936 // Create database with same name and grant all privileges
937 $q = 'CREATE DATABASE IF NOT EXISTS '
938 . PMA_backquote(PMA_sqlAddslashes($username)) . ';';
939 $sql_query .= $q;
940 if (! PMA_DBI_try_query($q)) {
941 $message = PMA_Message::rawError(PMA_DBI_getError());
942 break;
943 }
944 $GLOBALS['reload'] = TRUE;
945 PMA_reloadNavigation();
946
947 $q = 'GRANT ALL PRIVILEGES ON '
948 . PMA_backquote(PMA_sqlAddslashes($username)) . '.* TO \''
949 . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
950 $sql_query .= $q;
951 if (! PMA_DBI_try_query($q)) {
952 $message = PMA_Message::rawError(PMA_DBI_getError());
953 }
954 break;
955 case '2' :
956 // Grant all privileges on wildcard name (username\_%)
957 $q = 'GRANT ALL PRIVILEGES ON '
958 . PMA_backquote(PMA_sqlAddslashes($username) . '\_%') . '.* TO \''
959 . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
960 $sql_query .= $q;
961 if (! PMA_DBI_try_query($q)) {
962 $message = PMA_Message::rawError(PMA_DBI_getError());
963 }
964 break;
965 case '3' :
966 // Grant all privileges on the specified database to the new user
967 $q = 'GRANT ALL PRIVILEGES ON '
968 . PMA_backquote(PMA_sqlAddslashes($dbname)) . '.* TO \''
969 . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
970 $sql_query .= $q;
971 if (! PMA_DBI_try_query($q)) {
972 $message = PMA_Message::rawError(PMA_DBI_getError());
973 }
974 break;
975 case '0' :
976 default :
977 break;
978 }
979 } else {
980 if (isset($create_user_real)) {
981 $queries[] = $create_user_real;
982 }
983 $queries[] = $real_sql_query;
984 // we put the query containing the hidden password in
985 // $queries_for_display, at the same position occupied
986 // by the real query in $queries
987 $tmp_count = count($queries);
988 if (isset($create_user_real)) {
989 $queries_for_display[$tmp_count - 2] = $create_user_show;
990 }
991 $queries_for_display[$tmp_count - 1] = $sql_query;
992 }
993 unset($res, $real_sql_query);
994 }
995 }
996
997
998 /**
999 * Changes / copies a user, part III
1000 */
1001 if (isset($_REQUEST['change_copy'])) {
1002 $user_host_condition =
1003 ' WHERE `User`'
1004 .' = \'' . PMA_sqlAddslashes($old_username) . "'"
1005 .' AND `Host`'
1006 .' = \'' . PMA_sqlAddslashes($old_hostname) . '\';';
1007 $res = PMA_DBI_query('SELECT * FROM `mysql`.`db`' . $user_host_condition);
1008 while ($row = PMA_DBI_fetch_assoc($res)) {
1009 $queries[] =
1010 'GRANT ' . join(', ', PMA_extractPrivInfo($row))
1011 .' ON ' . PMA_backquote($row['Db']) . '.*'
1012 .' TO \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\''
1013 . ($row['Grant_priv'] == 'Y' ? ' WITH GRANT OPTION;' : ';');
1014 }
1015 PMA_DBI_free_result($res);
1016 $res = PMA_DBI_query(
1017 'SELECT `Db`, `Table_name`, `Table_priv`'
1018 .' FROM `mysql`.`tables_priv`' . $user_host_condition,
1019 $GLOBALS['userlink'], PMA_DBI_QUERY_STORE);
1020 while ($row = PMA_DBI_fetch_assoc($res)) {
1021
1022 $res2 = PMA_DBI_QUERY(
1023 'SELECT `Column_name`, `Column_priv`'
1024 .' FROM `mysql`.`columns_priv`'
1025 .' WHERE `User`'
1026 .' = \'' . PMA_sqlAddslashes($old_username) . "'"
1027 .' AND `Host`'
1028 .' = \'' . PMA_sqlAddslashes($old_hostname) . '\''
1029 .' AND `Db`'
1030 .' = \'' . PMA_sqlAddslashes($row['Db']) . "'"
1031 .' AND `Table_name`'
1032 .' = \'' . PMA_sqlAddslashes($row['Table_name']) . "'"
1033 .';',
1034 null, PMA_DBI_QUERY_STORE);
1035
1036 $tmp_privs1 = PMA_extractPrivInfo($row);
1037 $tmp_privs2 = array(
1038 'Select' => array(),
1039 'Insert' => array(),
1040 'Update' => array(),
1041 'References' => array()
1042 );
1043
1044 while ($row2 = PMA_DBI_fetch_assoc($res2)) {
1045 $tmp_array = explode(',', $row2['Column_priv']);
1046 if (in_array('Select', $tmp_array)) {
1047 $tmp_privs2['Select'][] = $row2['Column_name'];
1048 }
1049 if (in_array('Insert', $tmp_array)) {
1050 $tmp_privs2['Insert'][] = $row2['Column_name'];
1051 }
1052 if (in_array('Update', $tmp_array)) {
1053 $tmp_privs2['Update'][] = $row2['Column_name'];
1054 }
1055 if (in_array('References', $tmp_array)) {
1056 $tmp_privs2['References'][] = $row2['Column_name'];
1057 }
1058 unset($tmp_array);
1059 }
1060 if (count($tmp_privs2['Select']) > 0 && !in_array('SELECT', $tmp_privs1)) {
1061 $tmp_privs1[] = 'SELECT (`' . join('`, `', $tmp_privs2['Select']) . '`)';
1062 }
1063 if (count($tmp_privs2['Insert']) > 0 && !in_array('INSERT', $tmp_privs1)) {
1064 $tmp_privs1[] = 'INSERT (`' . join('`, `', $tmp_privs2['Insert']) . '`)';
1065 }
1066 if (count($tmp_privs2['Update']) > 0 && !in_array('UPDATE', $tmp_privs1)) {
1067 $tmp_privs1[] = 'UPDATE (`' . join('`, `', $tmp_privs2['Update']) . '`)';
1068 }
1069 if (count($tmp_privs2['References']) > 0 && !in_array('REFERENCES', $tmp_privs1)) {
1070 $tmp_privs1[] = 'REFERENCES (`' . join('`, `', $tmp_privs2['References']) . '`)';
1071 }
1072 unset($tmp_privs2);
1073 $queries[] =
1074 'GRANT ' . join(', ', $tmp_privs1)
1075 . ' ON ' . PMA_backquote($row['Db']) . '.' . PMA_backquote($row['Table_name'])
1076 . ' TO \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\''
1077 . (in_array('Grant', explode(',', $row['Table_priv'])) ? ' WITH GRANT OPTION;' : ';');
1078 }
1079 }
1080
1081
1082 /**
1083 * Updates privileges
1084 */
1085 if (!empty($update_privs)) {
1086 $db_and_table = PMA_WildcardEscapeForGrant($db_and_table, $dbname, (isset($tablename) ? $tablename : ''));
1087
1088 $sql_query0 =
1089 'REVOKE ALL PRIVILEGES ON ' . $db_and_table
1090 . ' FROM \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
1091 if (!isset($Grant_priv) || $Grant_priv != 'Y') {
1092 $sql_query1 =
1093 'REVOKE GRANT OPTION ON ' . $db_and_table
1094 . ' FROM \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
1095 } else {
1096 $sql_query1 = '';
1097 }
1098
1099 // Should not do a GRANT USAGE for a table-specific privilege, it
1100 // causes problems later (cannot revoke it)
1101 if (! (isset($tablename) && 'USAGE' == implode('', PMA_extractPrivInfo()))) {
1102 $sql_query2 =
1103 'GRANT ' . join(', ', PMA_extractPrivInfo())
1104 . ' ON ' . $db_and_table
1105 . ' TO \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\'';
1106
1107 /**
1108 * @todo similar code appears twice in this script
1109 */
1110 if ((isset($Grant_priv) && $Grant_priv == 'Y')
1111 || (! isset($dbname)
1112 && (isset($max_questions) || isset($max_connections)
1113 || isset($max_updates) || isset($max_user_connections))))
1114 {
1115 $sql_query2 .= 'WITH';
1116 if (isset($Grant_priv) && $Grant_priv == 'Y') {
1117 $sql_query2 .= ' GRANT OPTION';
1118 }
1119 if (isset($max_questions)) {
1120 $max_questions = max(0, (int)$max_questions);
1121 $sql_query2 .= ' MAX_QUERIES_PER_HOUR ' . $max_questions;
1122 }
1123 if (isset($max_connections)) {
1124 $max_connections = max(0, (int)$max_connections);
1125 $sql_query2 .= ' MAX_CONNECTIONS_PER_HOUR ' . $max_connections;
1126 }
1127 if (isset($max_updates)) {
1128 $max_updates = max(0, (int)$max_updates);
1129 $sql_query2 .= ' MAX_UPDATES_PER_HOUR ' . $max_updates;
1130 }
1131 if (isset($max_user_connections)) {
1132 $max_user_connections = max(0, (int)$max_user_connections);
1133 $sql_query2 .= ' MAX_USER_CONNECTIONS ' . $max_user_connections;
1134 }
1135 }
1136 $sql_query2 .= ';';
1137 }
1138 if (! PMA_DBI_try_query($sql_query0)) {
1139 // this query may fail, but this does not matter :o)
1140 $sql_query0 = '';
1141 }
1142 if (isset($sql_query1) && !PMA_DBI_try_query($sql_query1)) {
1143 // this one may fail, too...
1144 $sql_query1 = '';
1145 }
1146 if (isset($sql_query2)) {
1147 PMA_DBI_query($sql_query2);
1148 } else {
1149 $sql_query2 = '';
1150 }
1151 $sql_query = $sql_query0 . ' ' . $sql_query1 . ' ' . $sql_query2;
1152 $message = PMA_Message::success(__('You have updated the privileges for %s.'));
1153 $message->addParam('\'' . $username . '\'@\'' . $hostname . '\'');
1154 }
1155
1156
1157 /**
1158 * Revokes Privileges
1159 */
1160 if (isset($_REQUEST['revokeall'])) {
1161 $db_and_table = PMA_WildcardEscapeForGrant($db_and_table, $dbname, isset($tablename) ? $tablename : '');
1162
1163 $sql_query0 =
1164 'REVOKE ALL PRIVILEGES ON ' . $db_and_table
1165 . ' FROM \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
1166 $sql_query1 =
1167 'REVOKE GRANT OPTION ON ' . $db_and_table
1168 . ' FROM \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\';';
1169
1170 PMA_DBI_query($sql_query0);
1171 if (! PMA_DBI_try_query($sql_query1)) {
1172 // this one may fail, too...
1173 $sql_query1 = '';
1174 }
1175 $sql_query = $sql_query0 . ' ' . $sql_query1;
1176 $message = PMA_Message::success(__('You have revoked the privileges for %s'));
1177 $message->addParam('\'' . $username . '\'@\'' . $hostname . '\'');
1178 if (! isset($tablename)) {
1179 unset($dbname);
1180 } else {
1181 unset($tablename);
1182 }
1183 }
1184
1185
1186 /**
1187 * Updates the password
1188 */
1189 if (isset($_REQUEST['change_pw'])) {
1190 // similar logic in user_password.php
1191 $message = '';
1192
1193 if ($nopass == 0 && isset($pma_pw) && isset($pma_pw2)) {
1194 if ($pma_pw != $pma_pw2) {
1195 $message = PMA_Message::error(__('The passwords aren\'t the same!'));
1196 } elseif (empty($pma_pw) || empty($pma_pw2)) {
1197 $message = PMA_Message::error(__('The password is empty!'));
1198 }
1199 } // end if
1200
1201 // here $nopass could be == 1
1202 if (empty($message)) {
1203
1204 $hashing_function = (!empty($pw_hash) && $pw_hash == 'old' ? 'OLD_' : '')
1205 . 'PASSWORD';
1206
1207 // in $sql_query which will be displayed, hide the password
1208 $sql_query = 'SET PASSWORD FOR \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\' = ' . (($pma_pw == '') ? '\'\'' : $hashing_function . '(\'' . preg_replace('@.@s', '*', $pma_pw) . '\')');
1209 $local_query = 'SET PASSWORD FOR \'' . PMA_sqlAddslashes($username) . '\'@\'' . PMA_sqlAddslashes($hostname) . '\' = ' . (($pma_pw == '') ? '\'\'' : $hashing_function . '(\'' . PMA_sqlAddslashes($pma_pw) . '\')');
1210 PMA_DBI_try_query($local_query)
1211 or PMA_mysqlDie(PMA_DBI_getError(), $sql_query, FALSE, $err_url);
1212 $message = PMA_Message::success(__('The password for %s was changed successfully.'));
1213 $message->addParam('\'' . $username . '\'@\'' . $hostname . '\'');
1214 }
1215 }
1216
1217
1218 /**
1219 * Deletes users
1220 * (Changes / copies a user, part IV)
1221 */
1222
1223 if (isset($_REQUEST['delete']) || (isset($_REQUEST['change_copy']) && $_REQUEST['mode'] < 4)) {
1224 if (isset($_REQUEST['change_copy'])) {
1225 $selected_usr = array($old_username . '&amp;#27;' . $old_hostname);
1226 } else {
1227 $selected_usr = $_REQUEST['selected_usr'];
1228 $queries = array();
1229 }
1230 foreach ($selected_usr as $each_user) {
1231 list($this_user, $this_host) = explode('&amp;#27;', $each_user);
1232 $queries[] = '# ' . sprintf(__('Deleting %s'), '\'' . $this_user . '\'@\'' . $this_host . '\'') . ' ...';
1233 $queries[] = 'DROP USER \'' . PMA_sqlAddslashes($this_user) . '\'@\'' . PMA_sqlAddslashes($this_host) . '\';';
1234
1235 if (isset($_REQUEST['drop_users_db'])) {
1236 $queries[] = 'DROP DATABASE IF EXISTS ' . PMA_backquote($this_user) . ';';
1237 $GLOBALS['reload'] = TRUE;
1238 PMA_reloadNavigation();
1239 }
1240 }
1241 if (empty($_REQUEST['change_copy'])) {
1242 if (empty($queries)) {
1243 $message = PMA_Message::error(__('No users selected for deleting!'));
1244 } else {
1245 if ($_REQUEST['mode'] == 3) {
1246 $queries[] = '# ' . __('Reloading the privileges') . ' ...';
1247 $queries[] = 'FLUSH PRIVILEGES;';
1248 }
1249 $drop_user_error = '';
1250 foreach ($queries as $sql_query) {
1251 if ($sql_query{0} != '#') {
1252 if (! PMA_DBI_try_query($sql_query, $GLOBALS['userlink'])) {
1253 $drop_user_error .= PMA_DBI_getError() . "\n";
1254 }
1255 }
1256 }
1257 $sql_query = join("\n", $queries);
1258 if (! empty($drop_user_error)) {
1259 $message = PMA_Message::rawError($drop_user_error);
1260 } else {
1261 $message = PMA_Message::success(__('The selected users have been deleted successfully.'));
1262 }
1263 }
1264 unset($queries);
1265 }
1266 }
1267
1268
1269 /**
1270 * Changes / copies a user, part V
1271 */
1272 if (isset($_REQUEST['change_copy'])) {
1273 $tmp_count = 0;
1274 foreach ($queries as $sql_query) {
1275 if ($sql_query{0} != '#') {
1276 PMA_DBI_query($sql_query);
1277 }
1278 // when there is a query containing a hidden password, take it
1279 // instead of the real query sent
1280 if (isset($queries_for_display[$tmp_count])) {
1281 $queries[$tmp_count] = $queries_for_display[$tmp_count];
1282 }
1283 $tmp_count++;
1284 }
1285 $message = PMA_Message::success();
1286 $sql_query = join("\n", $queries);
1287 }
1288
1289
1290 /**
1291 * Reloads the privilege tables into memory
1292 */
1293 if (isset($_REQUEST['flush_privileges'])) {
1294 $sql_query = 'FLUSH PRIVILEGES;';
1295 PMA_DBI_query($sql_query);
1296 $message = PMA_Message::success(__('The privileges were reloaded successfully.'));
1297 }
1298
1299
1300 /**
1301 * Displays the links
1302 */
1303 if (isset($viewing_mode) && $viewing_mode == 'db') {
1304 $db = $checkprivs;
1305 $url_query .= '&amp;goto=db_operations.php';
1306
1307 // Gets the database structure
1308 $sub_part = '_structure';
1309 require './libraries/db_info.inc.php';
1310 echo "\n";
1311 } else {
1312 require './libraries/server_links.inc.php';
1313 }
1314
1315
1316 /**
1317 * defines some standard links
1318 */
1319 $link_edit = '<a href="server_privileges.php?' . $GLOBALS['url_query']
1320 . '&amp;username=%s'
1321 . '&amp;hostname=%s'
1322 . '&amp;dbname=%s'
1323 . '&amp;tablename=%s">'
1324 . PMA_getIcon('b_usredit.png', __('Edit Privileges'))
1325 . '</a>';
1326
1327 $link_revoke = '<a href="server_privileges.php?' . $GLOBALS['url_query']
1328 . '&amp;username=%s'
1329 . '&amp;hostname=%s'
1330 . '&amp;dbname=%s'
1331 . '&amp;tablename=%s'
1332 . '&amp;revokeall=1">'
1333 . PMA_getIcon('b_usrdrop.png', __('Revoke'))
1334 . '</a>';
1335
1336 $link_export = '<a href="server_privileges.php?' . $GLOBALS['url_query']
1337 . '&amp;username=%s'
1338 . '&amp;hostname=%s'
1339 . '&amp;initial=%s'
1340 . '&amp;export=1">'
1341 . PMA_getIcon('b_tblexport.png', __('Export'))
1342 . '</a>';
1343
1344 /**
1345 * Displays the page
1346 */
1347
1348 // export user definition
1349 if (isset($_REQUEST['export'])) {
1350 echo '<h2>' . __('User') . ' \'' . htmlspecialchars($username) . '\'@\'' . htmlspecialchars($hostname) . '\'</h2>';
1351 echo '<textarea cols="' . $GLOBALS['cfg']['TextareaCols'] . '" rows="' . $GLOBALS['cfg']['TextareaRows'] . '">';
1352 $grants = PMA_DBI_fetch_result("SHOW GRANTS FOR '" . PMA_sqlAddslashes($username) . "'@'" . PMA_sqlAddslashes($hostname) . "'");
1353 foreach($grants as $one_grant) {
1354 echo $one_grant . ";\n\n";
1355 }
1356 echo '</textarea>';
1357 unset($username, $hostname, $grants, $one_grant);
1358 }
1359
1360 if (empty($_REQUEST['adduser']) && (! isset($checkprivs) || ! strlen($checkprivs))) {
1361 if (! isset($username)) {
1362 // No username is given --> display the overview
1363 echo '<h2>' . "\n"
1364 . PMA_getIcon('b_usrlist.png')
1365 . __('User overview') . "\n"
1366 . '</h2>' . "\n";
1367
1368 $sql_query =
1369 'SELECT *,' .
1370 " IF(`Password` = _latin1 '', 'N', 'Y') AS 'Password'" .
1371 ' FROM `mysql`.`user`';
1372
1373 $sql_query .= (isset($initial) ? PMA_RangeOfUsers($initial) : '');
1374
1375 $sql_query .= ' ORDER BY `User` ASC, `Host` ASC;';
1376 $res = PMA_DBI_try_query($sql_query, null, PMA_DBI_QUERY_STORE);
1377
1378 if (! $res) {
1379 // the query failed! This may have two reasons:
1380 // - the user does not have enough privileges
1381 // - the privilege tables use a structure of an earlier version.
1382 // so let's try a more simple query
1383
1384 $sql_query = 'SELECT * FROM `mysql`.`user`';
1385 $res = PMA_DBI_try_query($sql_query, null, PMA_DBI_QUERY_STORE);
1386
1387 if (!$res) {
1388 PMA_Message::error(__('No Privileges'))->display();
1389 PMA_DBI_free_result($res);
1390 unset($res);
1391 } else {
1392 // This message is hardcoded because I will replace it by
1393 // a automatic repair feature soon.
1394 $raw = 'Your privilege table structure seems to be older than'
1395 . ' this MySQL version!<br />'
1396 . 'Please run the <tt>mysql_upgrade</tt> command'
1397 . '(<tt>mysql_fix_privilege_tables</tt> on older systems)'
1398 . ' that should be included in your MySQL server distribution'
1399 . ' to solve this problem!';
1400 PMA_Message::rawError($raw)->display();
1401 }
1402 } else {
1403
1404 // we also want users not in table `user` but in other table
1405 $tables = PMA_DBI_fetch_result('SHOW TABLES FROM `mysql`;');
1406
1407 $tables_to_search_for_users = array(
1408 'user', 'db', 'tables_priv', 'columns_priv', 'procs_priv',
1409 );
1410
1411 $db_rights_sqls = array();
1412 foreach ($tables_to_search_for_users as $table_search_in) {
1413 if (in_array($table_search_in, $tables)) {
1414 $db_rights_sqls[] = 'SELECT DISTINCT `User`, `Host` FROM `mysql`.`' . $table_search_in . '` ' . (isset($initial) ? PMA_RangeOfUsers($initial) : '');
1415 }
1416 }
1417
1418 $user_defaults = array(
1419 'User' => '',
1420 'Host' => '%',
1421 'Password' => '?',
1422 'Grant_priv' => 'N',
1423 'privs' => array('USAGE'),
1424 );
1425
1426 // for all initials, even non A-Z
1427 $array_initials = array();
1428 // for the rights
1429 $db_rights = array();
1430
1431 $db_rights_sql = '(' . implode(') UNION (', $db_rights_sqls) . ')'
1432 .' ORDER BY `User` ASC, `Host` ASC';
1433
1434 $db_rights_result = PMA_DBI_query($db_rights_sql);
1435
1436 while ($db_rights_row = PMA_DBI_fetch_assoc($db_rights_result)) {
1437 $db_rights_row = array_merge($user_defaults, $db_rights_row);
1438 $db_rights[$db_rights_row['User']][$db_rights_row['Host']] =
1439 $db_rights_row;
1440 }
1441 PMA_DBI_free_result($db_rights_result);
1442 unset($db_rights_sql, $db_rights_sqls, $db_rights_result, $db_rights_row);
1443 ksort($db_rights);
1444
1445 /**
1446 * Displays the initials
1447 */
1448
1449 // initialize to FALSE the letters A-Z
1450 for ($letter_counter = 1; $letter_counter < 27; $letter_counter++) {
1451 if (! isset($array_initials[chr($letter_counter + 64)])) {
1452 $array_initials[chr($letter_counter + 64)] = FALSE;
1453 }
1454 }
1455
1456 $initials = PMA_DBI_try_query('SELECT DISTINCT UPPER(LEFT(`User`,1)) FROM `user` ORDER BY `User` ASC', null, PMA_DBI_QUERY_STORE);
1457 while (list($tmp_initial) = PMA_DBI_fetch_row($initials)) {
1458 $array_initials[$tmp_initial] = TRUE;
1459 }
1460
1461 // Display the initials, which can be any characters, not
1462 // just letters. For letters A-Z, we add the non-used letters
1463 // as greyed out.
1464
1465 uksort($array_initials, "strnatcasecmp");
1466
1467 echo '<table cellspacing="5"><tr>';
1468 foreach ($array_initials as $tmp_initial => $initial_was_found) {
1469 if ($initial_was_found) {
1470 echo '<td><a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;initial=' . urlencode($tmp_initial) . '">' . $tmp_initial . '</a></td>' . "\n";
1471 } else {
1472 echo '<td>' . $tmp_initial . '</td>';
1473 }
1474 }
1475 echo '<td><a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;showall=1">[' . __('Show all') . ']</a></td>' . "\n";
1476 echo '</tr></table>';
1477
1478 /**
1479 * Display the user overview
1480 * (if less than 50 users, display them immediately)
1481 */
1482
1483 if (isset($initial) || isset($showall) || PMA_DBI_num_rows($res) < 50) {
1484
1485 while ($row = PMA_DBI_fetch_assoc($res)) {
1486 $row['privs'] = PMA_extractPrivInfo($row, true);
1487 $db_rights[$row['User']][$row['Host']] = $row;
1488 }
1489 @PMA_DBI_free_result($res);
1490 unset($res);
1491
1492 echo '<form name="usersForm" id="usersForm" action="server_privileges.php" method="post">' . "\n"
1493 . PMA_generate_common_hidden_inputs('', '')
1494 . ' <table id="tableuserrights" class="data">' . "\n"
1495 . ' <thead>' . "\n"
1496 . ' <tr><th></th>' . "\n"
1497 . ' <th>' . __('User') . '</th>' . "\n"
1498 . ' <th>' . __('Host') . '</th>' . "\n"
1499 . ' <th>' . __('Password') . '</th>' . "\n"
1500 . ' <th>' . __('Global privileges') . ' '
1501 . PMA_showHint(__(' Note: MySQL privilege names are expressed in English ')) . '</th>' . "\n"
1502 . ' <th>' . __('Grant') . '</th>' . "\n"
1503 . ' <th colspan="2">' . __('Action') . '</th>' . "\n";
1504 echo ' </tr>' . "\n";
1505 echo ' </thead>' . "\n";
1506 echo ' <tbody>' . "\n";
1507 $odd_row = true;
1508 $index_checkbox = -1;
1509 foreach ($db_rights as $user) {
1510 $index_checkbox++;
1511 ksort($user);
1512 foreach ($user as $host) {
1513 $index_checkbox++;
1514 echo ' <tr class="' . ($odd_row ? 'odd' : 'even') . '">' . "\n"
1515 . ' <td><input type="checkbox" name="selected_usr[]" id="checkbox_sel_users_'
1516 . $index_checkbox . '" value="'
1517 . htmlspecialchars($host['User'] . '&amp;#27;' . $host['Host'])
1518 . '"'
1519 . (empty($GLOBALS['checkall']) ? '' : ' checked="checked"')
1520 . ' /></td>' . "\n"
1521 . ' <td><label for="checkbox_sel_users_' . $index_checkbox . '">' . (empty($host['User']) ? '<span style="color: #FF0000">' . __('Any') . '</span>' : htmlspecialchars($host['User'])) . '</label></td>' . "\n"
1522 . ' <td>' . htmlspecialchars($host['Host']) . '</td>' . "\n";
1523 echo ' <td>';
1524 switch ($host['Password']) {
1525 case 'Y':
1526 echo __('Yes');
1527 break;
1528 case 'N':
1529 echo '<span style="color: #FF0000">' . __('No') . '</span>';
1530 break;
1531 // this happens if this is a definition not coming from mysql.user
1532 default:
1533 echo '--'; // in future version, replace by "not present"
1534 break;
1535 } // end switch
1536 echo '</td>' . "\n"
1537 . ' <td><tt>' . "\n"
1538 . ' ' . implode(',' . "\n" . ' ', $host['privs']) . "\n"
1539 . ' </tt></td>' . "\n"
1540 . ' <td>' . ($host['Grant_priv'] == 'Y' ? __('Yes') : __('No')) . '</td>' . "\n"
1541 . ' <td align="center">';
1542 printf($link_edit, urlencode($host['User']), urlencode($host['Host']), '', '');
1543 echo '</td>';
1544 echo '<td align="center">';
1545 printf($link_export, urlencode($host['User']), urlencode($host['Host']), (isset($initial) ? $initial : ''));
1546 echo '</td>';
1547 echo '</tr>';
1548 $odd_row = ! $odd_row;
1549 }
1550 }
1551
1552 unset($user, $host, $odd_row);
1553 echo ' </tbody></table>' . "\n"
1554 .'<img class="selectallarrow"'
1555 .' src="' . $pmaThemeImage . 'arrow_' . $text_dir . '.png"'
1556 .' width="38" height="22"'
1557 .' alt="' . __('With selected:') . '" />' . "\n"
1558 .'<a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;checkall=1"'
1559 .' onclick="if (markAllRows(\'usersForm\')) return false;">'
1560 . __('Check All') . '</a>' . "\n"
1561 .'/' . "\n"
1562 .'<a href="server_privileges.php?' . $GLOBALS['url_query'] . '"'
1563 .' onclick="if (unMarkAllRows(\'usersForm\')) return false;">'
1564 . __('Uncheck All') . '</a>' . "\n";
1565
1566 // add/delete user fieldset
1567 echo ' <fieldset id="fieldset_add_user">' . "\n"
1568 . ' <a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;adduser=1">' . "\n"
1569 . PMA_getIcon('b_usradd.png')
1570 . ' ' . __('Add a new User') . '</a>' . "\n"
1571 . ' </fieldset>' . "\n"
1572 . ' <fieldset id="fieldset_delete_user">'
1573 . ' <legend>' . "\n"
1574 . PMA_getIcon('b_usrdrop.png')
1575 . ' ' . __('Remove selected users') . '' . "\n"
1576 . ' </legend>' . "\n"
1577 . ' <input type="hidden" name="mode" value="2" />' . "\n"
1578 . '(' . __('Revoke all active privileges from the users and delete them afterwards.') . ')<br />' . "\n"
1579 . ' <input type="checkbox" title="' . __('Drop the databases that have the same names as the users.') . '" name="drop_users_db" id="checkbox_drop_users_db" />' . "\n"
1580 . ' <label for="checkbox_drop_users_db" title="' . __('Drop the databases that have the same names as the users.') . '">' . "\n"
1581 . ' ' . __('Drop the databases that have the same names as the users.') . "\n"
1582 . ' </label>' . "\n"
1583 . ' </fieldset>' . "\n"
1584 . ' <fieldset id="fieldset_delete_user_footer" class="tblFooters">' . "\n"
1585 . ' <input type="submit" name="delete" value="' . __('Go') . '" id="buttonGo" />' . "\n"
1586 . ' </fieldset>' . "\n"
1587 . '</form>' . "\n";
1588 } else {
1589
1590 unset ($row);
1591 echo ' <fieldset id="fieldset_add_user">' . "\n"
1592 . ' <a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;adduser=1">' . "\n"
1593 . PMA_getIcon('b_usradd.png')
1594 . ' ' . __('Add a new User') . '</a>' . "\n"
1595 . ' </fieldset>' . "\n";
1596 } // end if (display overview)
1597 $flushnote = new PMA_Message(__('Note: phpMyAdmin gets the users\' privileges directly from MySQL\'s privilege tables. The content of these tables may differ from the privileges the server uses, if they have been changed manually. In this case, you should %sreload the privileges%s before you continue.'), PMA_Message::NOTICE);
1598 $flushnote->addParam('<a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;flush_privileges=1">', false);
1599 $flushnote->addParam('</a>', false);
1600 $flushnote->display();
1601 }
1602
1603
1604 } else {
1605
1606 // A user was selected -> display the user's properties
1607
1608 echo '<h2>' . "\n"
1609 . PMA_getIcon('b_usredit.png')
1610 . __('Edit Privileges') . ': '
1611 . __('User') ;
1612
1613 if (isset($dbname)) {
1614 echo ' <i><a href="server_privileges.php?'
1615 . $GLOBALS['url_query'] . '&amp;username=' . urlencode($username)
1616 . '&amp;hostname=' . urlencode($hostname) . '&amp;dbname=&amp;tablename=">\''
1617 . htmlspecialchars($username) . '\'@\'' . htmlspecialchars($hostname)
1618 . '\'</a></i>' . "\n";
1619 $url_dbname = urlencode(str_replace(array('\_', '\%'), array('_', '%'), $dbname));
1620
1621 echo ' - ' . ($dbname_is_wildcard ? __('Databases') : __('Database') );
1622 if (isset($tablename)) {
1623 echo ' <i><a href="server_privileges.php?' . $GLOBALS['url_query']
1624 . '&amp;username=' . urlencode($username) . '&amp;hostname=' . urlencode($hostname)
1625 . '&amp;dbname=' . $url_dbname . '&amp;tablename=">' . htmlspecialchars($dbname) . '</a></i>';
1626 echo ' - ' . __('Table') . ' <i>' . htmlspecialchars($tablename) . '</i>';
1627 } else {
1628 echo ' <i>' . htmlspecialchars($dbname) . '</i>';
1629 }
1630
1631 } else {
1632 echo ' <i>\'' . htmlspecialchars($username) . '\'@\'' . htmlspecialchars($hostname)
1633 . '\'</i>' . "\n";
1634
1635 }
1636 echo '</h2>' . "\n";
1637
1638
1639 $sql = "SELECT '1' FROM `mysql`.`user`"
1640 . " WHERE `User` = '" . PMA_sqlAddslashes($username) . "'"
1641 . " AND `Host` = '" . PMA_sqlAddslashes($hostname) . "';";
1642 $user_does_not_exists = (bool) ! PMA_DBI_fetch_value($sql);
1643 unset($sql);
1644 if ($user_does_not_exists) {
1645 PMA_Message::warning(__('The selected user was not found in the privilege table.'))->display();
1646 PMA_displayLoginInformationFields();
1647 //require_once './libraries/footer.inc.php';
1648 }
1649
1650 echo '<form name="usersForm" id="usersForm" action="server_privileges.php" method="post">' . "\n";
1651 $_params = array(
1652 'username' => $username,
1653 'hostname' => $hostname,
1654 );
1655 if (isset($dbname)) {
1656 $_params['dbname'] = $dbname;
1657 if (isset($tablename)) {
1658 $_params['tablename'] = $tablename;
1659 }
1660 }
1661 echo PMA_generate_common_hidden_inputs($_params);
1662
1663 PMA_displayPrivTable(PMA_ifSetOr($dbname, '*', 'length'),
1664 PMA_ifSetOr($tablename, '*', 'length'));
1665
1666 echo '</form>' . "\n";
1667
1668 if (! isset($tablename) && empty($dbname_is_wildcard)) {
1669
1670 // no table name was given, display all table specific rights
1671 // but only if $dbname contains no wildcards
1672
1673 // table header
1674 echo '<form action="server_privileges.php" method="post">' . "\n"
1675 . PMA_generate_common_hidden_inputs('', '')
1676 . '<input type="hidden" name="username" value="' . htmlspecialchars($username) . '" />' . "\n"
1677 . '<input type="hidden" name="hostname" value="' . htmlspecialchars($hostname) . '" />' . "\n"
1678 . '<fieldset>' . "\n"
1679 . '<legend>' . (! isset($dbname) ? __('Database-specific privileges') : __('Table-specific privileges')) . '</legend>' . "\n"
1680 . '<table class="data">' . "\n"
1681 . '<thead>' . "\n"
1682 . '<tr><th>' . (! isset($dbname) ? __('Database') : __('Table')) . '</th>' . "\n"
1683 . ' <th>' . __('Privileges') . '</th>' . "\n"
1684 . ' <th>' . __('Grant') . '</th>' . "\n"
1685 . ' <th>' . (! isset($dbname) ? __('Table-specific privileges') : __('Column-specific privileges')) . '</th>' . "\n"
1686 . ' <th colspan="2">' . __('Action') . '</th>' . "\n"
1687 . '</tr>' . "\n"
1688 . '</thead>' . "\n"
1689 . '<tbody>' . "\n";
1690
1691 $user_host_condition =
1692 ' WHERE `User`'
1693 . ' = \'' . PMA_sqlAddslashes($username) . "'"
1694 . ' AND `Host`'
1695 . ' = \'' . PMA_sqlAddslashes($hostname) . "'";
1696
1697 // table body
1698 // get data
1699
1700 // we also want privielgs for this user not in table `db` but in other table
1701 $tables = PMA_DBI_fetch_result('SHOW TABLES FROM `mysql`;');
1702 if (! isset($dbname)) {
1703
1704 // no db name given, so we want all privs for the given user
1705
1706 $tables_to_search_for_users = array(
1707 'tables_priv', 'columns_priv',
1708 );
1709
1710 $db_rights_sqls = array();
1711 foreach ($tables_to_search_for_users as $table_search_in) {
1712 if (in_array($table_search_in, $tables)) {
1713 $db_rights_sqls[] = '
1714 SELECT DISTINCT `Db`
1715 FROM `mysql`.' . PMA_backquote($table_search_in)
1716 . $user_host_condition;
1717 }
1718 }
1719
1720 $user_defaults = array(
1721 'Db' => '',
1722 'Grant_priv' => 'N',
1723 'privs' => array('USAGE'),
1724 'Table_privs' => true,
1725 );
1726
1727 // for the rights
1728 $db_rights = array();
1729
1730 $db_rights_sql = '(' . implode(') UNION (', $db_rights_sqls) . ')'
1731 .' ORDER BY `Db` ASC';
1732
1733 $db_rights_result = PMA_DBI_query($db_rights_sql);
1734
1735 while ($db_rights_row = PMA_DBI_fetch_assoc($db_rights_result)) {
1736 $db_rights_row = array_merge($user_defaults, $db_rights_row);
1737 // only Db names in the table `mysql`.`db` uses wildcards
1738 // as we are in the db specific rights display we want
1739 // all db names escaped, also from other sources
1740 $db_rights_row['Db'] = PMA_escape_mysql_wildcards(
1741 $db_rights_row['Db']);
1742 $db_rights[$db_rights_row['Db']] = $db_rights_row;
1743 }
1744
1745 PMA_DBI_free_result($db_rights_result);
1746 unset($db_rights_sql, $db_rights_sqls, $db_rights_result, $db_rights_row);
1747
1748 $sql_query = 'SELECT * FROM `mysql`.`db`' . $user_host_condition . ' ORDER BY `Db` ASC';
1749 $res = PMA_DBI_query($sql_query);
1750 $sql_query = '';
1751
1752 while ($row = PMA_DBI_fetch_assoc($res)) {
1753 if (isset($db_rights[$row['Db']])) {
1754 $db_rights[$row['Db']] = array_merge($db_rights[$row['Db']], $row);
1755 } else {
1756 $db_rights[$row['Db']] = $row;
1757 }
1758 // there are db specific rights for this user
1759 // so we can drop this db rights
1760 $db_rights[$row['Db']]['can_delete'] = true;
1761 }
1762 PMA_DBI_free_result($res);
1763 unset($row, $res);
1764
1765 } else {
1766
1767 // db name was given,
1768 // so we want all user specific rights for this db
1769
1770 $user_host_condition .=
1771 ' AND `Db`'
1772 .' LIKE \'' . PMA_sqlAddslashes($dbname) . "'";
1773
1774 $tables_to_search_for_users = array(
1775 'columns_priv',
1776 );
1777
1778 $db_rights_sqls = array();
1779 foreach ($tables_to_search_for_users as $table_search_in) {
1780 if (in_array($table_search_in, $tables)) {
1781 $db_rights_sqls[] = '
1782 SELECT DISTINCT `Table_name`
1783 FROM `mysql`.' . PMA_backquote($table_search_in)
1784 . $user_host_condition;
1785 }
1786 }
1787
1788 $user_defaults = array(
1789 'Table_name' => '',
1790 'Grant_priv' => 'N',
1791 'privs' => array('USAGE'),
1792 'Column_priv' => true,
1793 );
1794
1795 // for the rights
1796 $db_rights = array();
1797
1798 $db_rights_sql = '(' . implode(') UNION (', $db_rights_sqls) . ')'
1799 .' ORDER BY `Table_name` ASC';
1800
1801 $db_rights_result = PMA_DBI_query($db_rights_sql);
1802
1803 while ($db_rights_row = PMA_DBI_fetch_assoc($db_rights_result)) {
1804 $db_rights_row = array_merge($user_defaults, $db_rights_row);
1805 $db_rights[$db_rights_row['Table_name']] = $db_rights_row;
1806 }
1807 PMA_DBI_free_result($db_rights_result);
1808 unset($db_rights_sql, $db_rights_sqls, $db_rights_result, $db_rights_row);
1809
1810 $sql_query =
1811 'SELECT `Table_name`,'
1812 .' `Table_priv`,'
1813 .' IF(`Column_priv` = _latin1 \'\', 0, 1)'
1814 .' AS \'Column_priv\''
1815 .' FROM `mysql`.`tables_priv`'
1816 . $user_host_condition
1817 .' ORDER BY `Table_name` ASC;';
1818 $res = PMA_DBI_query($sql_query);
1819 $sql_query = '';
1820
1821 while ($row = PMA_DBI_fetch_assoc($res)) {
1822 if (isset($db_rights[$row['Table_name']])) {
1823 $db_rights[$row['Table_name']] = array_merge($db_rights[$row['Table_name']], $row);
1824 } else {
1825 $db_rights[$row['Table_name']] = $row;
1826 }
1827 }
1828 PMA_DBI_free_result($res);
1829 unset($row, $res);
1830 }
1831 ksort($db_rights);
1832
1833 // display rows
1834 if (count($db_rights) < 1) {
1835 echo '<tr class="odd">' . "\n"
1836 . ' <td colspan="6"><center><i>' . __('None') . '</i></center></td>' . "\n"
1837 . '</tr>' . "\n";
1838 } else {
1839 $odd_row = true;
1840 $found_rows = array();
1841 //while ($row = PMA_DBI_fetch_assoc($res)) {
1842 foreach ($db_rights as $row) {
1843 $found_rows[] = (! isset($dbname)) ? $row['Db'] : $row['Table_name'];
1844
1845 echo '<tr class="' . ($odd_row ? 'odd' : 'even') . '">' . "\n"
1846 . ' <td>' . htmlspecialchars((! isset($dbname)) ? $row['Db'] : $row['Table_name']) . '</td>' . "\n"
1847 . ' <td><tt>' . "\n"
1848 . ' ' . join(',' . "\n" . ' ', PMA_extractPrivInfo($row, TRUE)) . "\n"
1849 . ' </tt></td>' . "\n"
1850 . ' <td>' . ((((! isset($dbname)) && $row['Grant_priv'] == 'Y') || (isset($dbname) && in_array('Grant', explode(',', $row['Table_priv'])))) ? __('Yes') : __('No')) . '</td>' . "\n"
1851 . ' <td>';
1852 if (! empty($row['Table_privs']) || ! empty ($row['Column_priv'])) {
1853 echo __('Yes');
1854 } else {
1855 echo __('No');
1856 }
1857 echo '</td>' . "\n"
1858 . ' <td>';
1859 printf($link_edit, urlencode($username),
1860 urlencode($hostname),
1861 urlencode((! isset($dbname)) ? $row['Db'] : $dbname),
1862 urlencode((! isset($dbname)) ? '' : $row['Table_name']));
1863 echo '</td>' . "\n"
1864 . ' <td>';
1865 if (! empty($row['can_delete']) || isset($row['Table_name']) && strlen($row['Table_name'])) {
1866 printf($link_revoke, urlencode($username),
1867 urlencode($hostname),
1868 urlencode((! isset($dbname)) ? $row['Db'] : $dbname),
1869 urlencode((! isset($dbname)) ? '' : $row['Table_name']));
1870 }
1871 echo '</td>' . "\n"
1872 . '</tr>' . "\n";
1873 $odd_row = ! $odd_row;
1874 } // end while
1875 }
1876 unset($row);
1877 echo '</tbody>' . "\n"
1878 . '</table>' . "\n";
1879
1880 if (! isset($dbname)) {
1881
1882 // no database name was given, display select db
1883
1884 $pred_db_array =PMA_DBI_fetch_result('SHOW DATABASES;');
1885
1886 echo ' <label for="text_dbname">' . __('Add privileges on the following database') . ':</label>' . "\n";
1887 if (!empty($pred_db_array)) {
1888 echo ' <select name="pred_dbname" onchange="this.form.submit();">' . "\n"
1889 . ' <option value="" selected="selected">' . __('Use text field') . ':</option>' . "\n";
1890 foreach ($pred_db_array as $current_db) {
1891 $current_db = PMA_escape_mysql_wildcards($current_db);
1892 // cannot use array_diff() once, outside of the loop,
1893 // because the list of databases has special characters
1894 // already escaped in $found_rows,
1895 // contrary to the output of SHOW DATABASES
1896 if (empty($found_rows) || ! in_array($current_db, $found_rows)) {
1897 echo ' <option value="' . htmlspecialchars($current_db) . '">'
1898 . htmlspecialchars($current_db) . '</option>' . "\n";
1899 }
1900 }
1901 echo ' </select>' . "\n";
1902 }
1903 echo ' <input type="text" id="text_dbname" name="dbname" />' . "\n"
1904 . PMA_showHint(__('Wildcards % and _ should be escaped with a \ to use them literally'));
1905 } else {
1906 echo ' <input type="hidden" name="dbname" value="' . htmlspecialchars($dbname) . '"/>' . "\n"
1907 . ' <label for="text_tablename">' . __('Add privileges on the following table') . ':</label>' . "\n";
1908 if ($res = @PMA_DBI_try_query('SHOW TABLES FROM ' . PMA_backquote(PMA_unescape_mysql_wildcards($dbname)) . ';', null, PMA_DBI_QUERY_STORE)) {
1909 $pred_tbl_array = array();
1910 while ($row = PMA_DBI_fetch_row($res)) {
1911 if (!isset($found_rows) || !in_array($row[0], $found_rows)) {
1912 $pred_tbl_array[] = $row[0];
1913 }
1914 }
1915 PMA_DBI_free_result($res);
1916 unset($res, $row);
1917 if (!empty($pred_tbl_array)) {
1918 echo ' <select name="pred_tablename" onchange="this.form.submit();">' . "\n"
1919 . ' <option value="" selected="selected">' . __('Use text field') . ':</option>' . "\n";
1920 foreach ($pred_tbl_array as $current_table) {
1921 echo ' <option value="' . htmlspecialchars($current_table) . '">' . htmlspecialchars($current_table) . '</option>' . "\n";
1922 }
1923 echo ' </select>' . "\n";
1924 }
1925 } else {
1926 unset($res);
1927 }
1928 echo ' <input type="text" id="text_tablename" name="tablename" />' . "\n";
1929 }
1930 echo '</fieldset>' . "\n";
1931 echo '<fieldset class="tblFooters">' . "\n"
1932 . ' <input type="submit" value="' . __('Go') . '" />'
1933 . '</fieldset>' . "\n"
1934 . '</form>' . "\n";
1935
1936 }
1937
1938 // Provide a line with links to the relevant database and table
1939 if (isset($dbname) && empty($dbname_is_wildcard)) {
1940 echo '[ ' . __('Database')
1941 . ' <a href="' . $GLOBALS['cfg']['DefaultTabDatabase'] . '?'
1942 . $GLOBALS['url_query'] . '&amp;db=' . $url_dbname . '&amp;reload=1">'
1943 . htmlspecialchars($dbname) . ': ' . PMA_getTitleForTarget($GLOBALS['cfg']['DefaultTabDatabase']) . "</a> ]\n";
1944
1945 if (isset($tablename)) {
1946 echo ' [ ' . __('Table') . ' <a href="'
1947 . $GLOBALS['cfg']['DefaultTabTable'] . '?' . $GLOBALS['url_query']
1948 . '&amp;db=' . $url_dbname . '&amp;table=' . urlencode($tablename)
1949 . '&amp;reload=1">' . htmlspecialchars($tablename) . ': '
1950 . PMA_getTitleForTarget($GLOBALS['cfg']['DefaultTabTable'])
1951 . "</a> ]\n";
1952 }
1953 unset($url_dbname);
1954 }
1955
1956 if (! isset($dbname) && ! $user_does_not_exists) {
1957 require_once './libraries/display_change_password.lib.php';
1958
1959 echo '<form action="server_privileges.php" method="post" onsubmit="return checkPassword(this);">' . "\n"
1960 . PMA_generate_common_hidden_inputs('', '')
1961 . '<input type="hidden" name="old_username" value="' . htmlspecialchars($username) . '" />' . "\n"
1962 . '<input type="hidden" name="old_hostname" value="' . htmlspecialchars($hostname) . '" />' . "\n"
1963 . '<fieldset id="fieldset_change_copy_user">' . "\n"
1964 . ' <legend>' . __('Change Login Information / Copy User') . '</legend>' . "\n";
1965 PMA_displayLoginInformationFields('change');
1966 echo ' <fieldset>' . "\n"
1967 . ' <legend>' . __('Create a new user with the same privileges and ...') . '</legend>' . "\n";
1968 $choices = array(
1969 '4' => __('... keep the old one.'),
1970 '1' => __(' ... delete the old one from the user tables.'),
1971 '2' => __(' ... revoke all active privileges from the old one and delete it afterwards.'),
1972 '3' => __(' ... delete the old one from the user tables and reload the privileges afterwards.'));
1973 PMA_display_html_radio('mode', $choices, '4', true);
1974 unset($choices);
1975
1976 echo ' </fieldset>' . "\n"
1977 . '</fieldset>' . "\n"
1978 . '<fieldset id="fieldset_change_copy_user_footer" class="tblFooters">' . "\n"
1979 . ' <input type="submit" name="change_copy" value="' . __('Go') . '" />' . "\n"
1980 . '</fieldset>' . "\n"
1981 . '</form>' . "\n";
1982 }
1983 }
1984 } elseif (isset($_REQUEST['adduser'])) {
1985 // Add a new user
1986 $GLOBALS['url_query'] .= '&amp;adduser=1';
1987 echo '<h2>' . "\n"
1988 . PMA_getIcon('b_usradd.png') . __('Add a new User') . "\n"
1989 . '</h2>' . "\n"
1990 . '<form name="usersForm" id="usersForm" action="server_privileges.php" method="post" onsubmit="return checkAddUser(this);">' . "\n"
1991 . PMA_generate_common_hidden_inputs('', '');
1992 PMA_displayLoginInformationFields('new');
1993 echo '<fieldset id="fieldset_add_user_database">' . "\n"
1994 . '<legend>' . __('Database for user') . '</legend>' . "\n";
1995
1996 $default_choice = 0;
1997 $choices = array(
1998 '0' => _pgettext('Create none database for user', 'None'),
1999 '1' => __('Create database with same name and grant all privileges'),
2000 '2' => __('Grant all privileges on wildcard name (username\\_%)'));
2001
2002 if ( !empty($dbname) ) {
2003 $choices['3'] = sprintf( __('Grant all privileges on database &quot;%s&quot;'), htmlspecialchars($dbname));
2004 $default_choice = 3;
2005 echo '<input type="hidden" name="dbname" value="' . htmlspecialchars($dbname) . '" />' . "\n";
2006 }
2007
2008 // 4th parameter set to true to add line breaks
2009 // 5th parameter set to false to avoid htmlspecialchars() escaping in the label
2010 // since we have some HTML in some labels
2011 PMA_display_html_radio('createdb', $choices, $default_choice, true, false);
2012 unset($choices);
2013 unset($default_choice);
2014
2015 echo '</fieldset>' . "\n";
2016 PMA_displayPrivTable('*', '*', FALSE);
2017 echo ' <fieldset id="fieldset_add_user_footer" class="tblFooters">' . "\n"
2018 . ' <input type="submit" name="adduser_submit" value="' . __('Go') . '" />' . "\n"
2019 . ' </fieldset>' . "\n"
2020 . '</form>' . "\n";
2021 } else {
2022 // check the privileges for a particular database.
2023 echo '<table id="tablespecificuserrights" class="data">' . "\n"
2024 . '<caption class="tblHeaders">' . "\n"
2025 . PMA_getIcon('b_usrcheck.png')
2026 . ' ' . sprintf(__('Users having access to &quot;%s&quot;'), '<a href="' . $GLOBALS['cfg']['DefaultTabDatabase'] . '?' . PMA_generate_common_url($checkprivs) . '">' . htmlspecialchars($checkprivs) . '</a>') . "\n"
2027 . '</caption>' . "\n"
2028 . '<thead>' . "\n"
2029 . ' <tr><th>' . __('User') . '</th>' . "\n"
2030 . ' <th>' . __('Host') . '</th>' . "\n"
2031 . ' <th>' . __('Type') . '</th>' . "\n"
2032 . ' <th>' . __('Privileges') . '</th>' . "\n"
2033 . ' <th>' . __('Grant') . '</th>' . "\n"
2034 . ' <th>' . __('Action') . '</th>' . "\n"
2035 . ' </tr>' . "\n"
2036 . '</thead>' . "\n"
2037 . '<tbody>' . "\n";
2038 $odd_row = TRUE;
2039 unset($row, $row1, $row2);
2040
2041 // now, we build the table...
2042 $list_of_privileges =
2043 '`User`, '
2044 . '`Host`, '
2045 . '`Select_priv`, '
2046 . '`Insert_priv`, '
2047 . '`Update_priv`, '
2048 . '`Delete_priv`, '
2049 . '`Create_priv`, '
2050 . '`Drop_priv`, '
2051 . '`Grant_priv`, '
2052 . '`Index_priv`, '
2053 . '`Alter_priv`, '
2054 . '`References_priv`, '
2055 . '`Create_tmp_table_priv`, '
2056 . '`Lock_tables_priv`, '
2057 . '`Create_view_priv`, '
2058 . '`Show_view_priv`, '
2059 . '`Create_routine_priv`, '
2060 . '`Alter_routine_priv`, '
2061 . '`Execute_priv`';
2062
2063 $list_of_compared_privileges =
2064 '`Select_priv` = \'N\''
2065 . ' AND `Insert_priv` = \'N\''
2066 . ' AND `Update_priv` = \'N\''
2067 . ' AND `Delete_priv` = \'N\''
2068 . ' AND `Create_priv` = \'N\''
2069 . ' AND `Drop_priv` = \'N\''
2070 . ' AND `Grant_priv` = \'N\''
2071 . ' AND `References_priv` = \'N\''
2072 . ' AND `Create_tmp_table_priv` = \'N\''
2073 . ' AND `Lock_tables_priv` = \'N\''
2074 . ' AND `Create_view_priv` = \'N\''
2075 . ' AND `Show_view_priv` = \'N\''
2076 . ' AND `Create_routine_priv` = \'N\''
2077 . ' AND `Alter_routine_priv` = \'N\''
2078 . ' AND `Execute_priv` = \'N\'';
2079
2080 if (PMA_MYSQL_INT_VERSION >= 50106) {
2081 $list_of_privileges .=
2082 ', `Event_priv`, '
2083 . '`Trigger_priv`';
2084 $list_of_compared_privileges .=
2085 ' AND `Event_priv` = \'N\''
2086 . ' AND `Trigger_priv` = \'N\'';
2087 }
2088
2089 $sql_query =
2090 '(SELECT ' . $list_of_privileges . ', `Db`'
2091 .' FROM `mysql`.`db`'
2092 .' WHERE \'' . PMA_sqlAddslashes($checkprivs) . "'"
2093 .' LIKE `Db`'
2094 .' AND NOT (' . $list_of_compared_privileges. ')) '
2095 .'UNION '
2096 .'(SELECT ' . $list_of_privileges . ', \'*\' AS `Db`'
2097 .' FROM `mysql`.`user` '
2098 .' WHERE NOT (' . $list_of_compared_privileges . ')) '
2099 .' ORDER BY `User` ASC,'
2100 .' `Host` ASC,'
2101 .' `Db` ASC;';
2102 $res = PMA_DBI_query($sql_query);
2103 $row = PMA_DBI_fetch_assoc($res);
2104 if ($row) {
2105 $found = TRUE;
2106 }
2107
2108 if ($found) {
2109 while (TRUE) {
2110 // prepare the current user
2111 $current_privileges = array();
2112 $current_user = $row['User'];
2113 $current_host = $row['Host'];
2114 while ($row && $current_user == $row['User'] && $current_host == $row['Host']) {
2115 $current_privileges[] = $row;
2116 $row = PMA_DBI_fetch_assoc($res);
2117 }
2118 echo ' <tr class="' . ($odd_row ? 'odd' : 'even') . '">' . "\n"
2119 . ' <td';
2120 if (count($current_privileges) > 1) {
2121 echo ' rowspan="' . count($current_privileges) . '"';
2122 }
2123 echo '>' . (empty($current_user) ? '<span style="color: #FF0000">' . __('Any') . '</span>' : htmlspecialchars($current_user)) . "\n"
2124 . ' </td>' . "\n"
2125 . ' <td';
2126 if (count($current_privileges) > 1) {
2127 echo ' rowspan="' . count($current_privileges) . '"';
2128 }
2129 echo '>' . htmlspecialchars($current_host) . '</td>' . "\n";
2130 foreach ($current_privileges as $current) {
2131 echo ' <td>' . "\n"
2132 . ' ';
2133 if (!isset($current['Db']) || $current['Db'] == '*') {
2134 echo __('global');
2135 } elseif ($current['Db'] == PMA_escape_mysql_wildcards($checkprivs)) {
2136 echo __('database-specific');
2137 } else {
2138 echo __('wildcard'), ': <tt>' . htmlspecialchars($current['Db']) . '</tt>';
2139 }
2140 echo "\n"
2141 . ' </td>' . "\n"
2142 . ' <td>' . "\n"
2143 . ' <tt>' . "\n"
2144 . ' ' . join(',' . "\n" . ' ', PMA_extractPrivInfo($current, TRUE)) . "\n"
2145 . ' </tt>' . "\n"
2146 . ' </td>' . "\n"
2147 . ' <td>' . "\n"
2148 . ' ' . ($current['Grant_priv'] == 'Y' ? __('Yes') : __('No')) . "\n"
2149 . ' </td>' . "\n"
2150 . ' <td>' . "\n";
2151 printf($link_edit, urlencode($current_user),
2152 urlencode($current_host),
2153 urlencode(! isset($current['Db']) || $current['Db'] == '*' ? '' : $current['Db']),
2154 '');
2155 echo '</td>' . "\n"
2156 . ' </tr>' . "\n";
2157 }
2158 if (empty($row) && empty($row1) && empty($row2)) {
2159 break;
2160 }
2161 $odd_row = ! $odd_row;
2162 }
2163 } else {
2164 echo ' <tr class="odd">' . "\n"
2165 . ' <td colspan="6">' . "\n"
2166 . ' ' . __('No user found.') . "\n"
2167 . ' </td>' . "\n"
2168 . ' </tr>' . "\n";
2169 }
2170 echo '</tbody>' . "\n"
2171 . '</table>' . "\n";
2172
2173 // Offer to create a new user for the current database
2174 echo '<fieldset id="fieldset_add_user">' . "\n"
2175 . ' <a href="server_privileges.php?' . $GLOBALS['url_query'] . '&amp;adduser=1&amp;dbname=' . $checkprivs .'">' . "\n"
2176 . PMA_getIcon('b_usradd.png')
2177 . ' ' . __('Add a new User') . '</a>' . "\n"
2178 . '</fieldset>' . "\n";
2179
2180 } // end if (empty($_REQUEST['adduser']) && empty($checkprivs)) ... elseif ... else ...
2181
2182
2183 /**
2184 * Displays the footer
2185 */
2186 echo "\n\n";
2187 require_once './libraries/footer.inc.php';
2188
2189 ?>