server_privileges.php

一个用PHP编写的

        echo $spaces . '<fieldset id="fieldset_user_privtable_footer" class="tblFooters">' . "\n"
           . $spaces . '    <input type="submit" name="update_privs" value="' . $GLOBALS['strGo'] . '" />' . "\n"
           . $spaces . '</fieldset>' . "\n";
    }
} // end of the 'PMA_displayPrivTable()' function


/**
 * Displays the fields used by the "new user" form as well as the
 * "change login information / copy user" form.
 *
 * @param   string     $mode    are we creating a new user or are we just
 *                              changing  one? (allowed values: 'new', 'change')
 * @param   int        $indent  the indenting level of the code
 *
 * @global  array      $cfg     the phpMyAdmin configuration
 * @global  ressource  $user_link the database connection
 *
 * @return  void
 */
function PMA_displayLoginInformationFields($mode = 'new', $indent = 0 ) {
    $spaces = str_repeat( '    ', $indent);

    // Get user/host name lengths
    $fields_info = PMA_DBI_get_fields('mysql', 'user');
    $username_length = 16;
    $hostname_length = 41;
    foreach ($fields_info as $key => $val) {
        if ($val['Field'] == 'User') {
            strtok($val['Type'], '()');
            $v = strtok('()');
            if (is_int($v)) {
                $username_length = $v;
            }
        } elseif ($val['Field'] == 'Host') {
            strtok($val['Type'], '()');
            $v = strtok('()');
            if (is_int($v)) {
                $hostname_length = $v;
            }
        }
    }
    unset($fields_info);

    if ( isset( $GLOBALS['username'] ) && strlen( $GLOBALS['username'] ) === 0 ) {
        $GLOBALS['pred_username'] = 'any';
    }
    echo $spaces . '<fieldset id="fieldset_add_user_login">' . "\n"
       . $spaces . '<legend>' . $GLOBALS['strLoginInformation'] . '</legend>' . "\n"
       . $spaces . '<div class="item">' . "\n"
       . $spaces . '<label for="select_pred_username">' . "\n"
       . $spaces . '    ' . $GLOBALS['strUserName'] . ':' . "\n"
       . $spaces . '</label>' . "\n"
       . $spaces . '<span class="options">' . "\n"
       . $spaces . '    <select name="pred_username" id="select_pred_username" title="' . $GLOBALS['strUserName'] . '"' . "\n"
       . $spaces . '        onchange="if (this.value == \'any\') { username.value = \'\'; } else if (this.value == \'userdefined\') { username.focus(); username.select(); }">' . "\n"
       . $spaces . '        <option value="any"' . ((isset($GLOBALS['pred_username']) && $GLOBALS['pred_username'] == 'any') ? ' selected="selected"' : '') . '>' . $GLOBALS['strAnyUser'] . '</option>' . "\n"
       . $spaces . '        <option value="userdefined"' . ((!isset($GLOBALS['pred_username']) || $GLOBALS['pred_username'] == 'userdefined') ? ' selected="selected"' : '') . '>' . $GLOBALS['strUseTextField'] . ':</option>' . "\n"
       . $spaces . '    </select>' . "\n"
       . $spaces . '</span>' . "\n"
       . $spaces . '<input type="text" name="username" maxlength="' . $username_length . '" title="' . $GLOBALS['strUserName'] . '"' . (empty($GLOBALS['username']) ? '' : ' value="' . (isset($GLOBALS['new_username']) ? $GLOBALS['new_username'] : $GLOBALS['username']) . '"') . ' onchange="pred_username.value = \'userdefined\';" />' . "\n"
       . $spaces . '</div>' . "\n"
       . $spaces . '<div class="item">' . "\n"
       . $spaces . '<label for="select_pred_hostname">' . "\n"
       . $spaces . '    ' . $GLOBALS['strHost'] . ':' . "\n"
       . $spaces . '</label>' . "\n"
       . $spaces . '<span class="options">' . "\n"
       . $spaces . '    <select name="pred_hostname" id="select_pred_hostname" title="' . $GLOBALS['strHost'] . '"' . "\n";
    $res = PMA_DBI_query('SELECT USER();');
    $row = PMA_DBI_fetch_row($res);
    PMA_DBI_free_result($res);
    unset($res);
    if (!empty($row[0])) {
        $thishost = str_replace("'", '', substr($row[0], (strrpos($row[0], '@') + 1)));
        if ($thishost == 'localhost' || $thishost == '127.0.0.1') {
            unset($thishost);
        }
    }
    echo $spaces . '    onchange="if (this.value == \'any\') { hostname.value = \'%\'; } else if (this.value == \'localhost\') { hostname.value = \'localhost\'; } '
       . (empty($thishost) ? '' : 'else if (this.value == \'thishost\') { hostname.value = \'' . addslashes(htmlspecialchars($thishost)) . '\'; } ')
       . 'else if (this.value == \'hosttable\') { hostname.value = \'\'; } else if (this.value == \'userdefined\') { hostname.focus(); hostname.select(); }">' . "\n";
    unset($row);

    // when we start editing a user, $GLOBALS['pred_hostname'] is not defined
    if (!isset($GLOBALS['pred_hostname']) && isset($GLOBALS['hostname'])) {
        switch (strtolower($GLOBALS['hostname'])) {
            case 'localhost':
            case '127.0.0.1':
                $GLOBALS['pred_hostname'] = 'localhost';
                break;
            case '%':
                $GLOBALS['pred_hostname'] = 'any';
                break;
            default:
                $GLOBALS['pred_hostname'] = 'userdefined';
                break;
        }
    }
    echo $spaces . '        <option value="any"' . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'any') ? ' selected="selected"' : '') . '>' . $GLOBALS['strAnyHost'] . '</option>' . "\n"
       . $spaces . '        <option value="localhost"' . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'localhost') ? ' selected="selected"' : '') . '>' . $GLOBALS['strLocalhost'] . '</option>' . "\n";
    if (!empty($thishost)) {
        echo $spaces . '        <option value="thishost"' . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'thishost') ? ' selected="selected"' : '') . '>' . $GLOBALS['strThisHost'] . '</option>' . "\n";
    }
    unset($thishost);
    echo $spaces . '        <option value="hosttable"' . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'hosttable') ? ' selected="selected"' : '') . '>' . $GLOBALS['strUseHostTable'] . '</option>' . "\n"
       . $spaces . '        <option value="userdefined"' . ((isset($GLOBALS['pred_hostname']) && $GLOBALS['pred_hostname'] == 'userdefined') ? ' selected="selected"' : '') . '>' . $GLOBALS['strUseTextField'] . ':</option>' . "\n"
       . $spaces . '    </select>' . "\n"
       . $spaces . '</span>' . "\n"
       . $spaces . '<input type="text" name="hostname" maxlength="' . $hostname_length . '" value="' . ( isset($GLOBALS['hostname']) ? $GLOBALS['hostname'] : '' ) . '" title="' . $GLOBALS['strHost'] . '" onchange="pred_hostname.value = \'userdefined\';" />' . "\n"
       . $spaces . '</div>' . "\n"
       . $spaces . '<div class="item">' . "\n"
       . $spaces . '<label for="select_pred_password">' . "\n"
       . $spaces . '    ' . $GLOBALS['strPassword'] . ':' . "\n"
       . $spaces . '</label>' . "\n"
       . $spaces . '<span class="options">' . "\n"
       . $spaces . '    <select name="pred_password" id="select_pred_password" title="' . $GLOBALS['strPassword'] . '"' . "\n"
       . $spaces . '            onchange="if (this.value == \'none\') { pma_pw.value = \'\'; pma_pw2.value = \'\'; } else if (this.value == \'userdefined\') { pma_pw.focus(); pma_pw.select(); }">' . "\n"
       . ($mode == 'change' ? $spaces . '            <option value="keep" selected="selected">' . $GLOBALS['strKeepPass'] . '</option>' . "\n" : '')
       . $spaces . '        <option value="none"';
    if ( isset( $GLOBALS['username'] ) && $mode != 'change' ) {
        echo '  selected="selected"';
    }
    echo $spaces . '>' . $GLOBALS['strNoPassword'] . '</option>' . "\n"
       . $spaces . '        <option value="userdefined"' . ( isset( $GLOBALS['username'] ) ? '' : ' selected="selected"') . '>' . $GLOBALS['strUseTextField'] . ':</option>' . "\n"
       . $spaces . '    </select>' . "\n"
       . $spaces . '</span>' . "\n"
       . $spaces . '<input type="password" id="text_pma_pw" name="pma_pw" title="' . $GLOBALS['strPassword'] . '" onchange="pred_password.value = \'userdefined\';" />' . "\n"
       . $spaces . '</div>' . "\n"
       . $spaces . '<div class="item">' . "\n"
       . $spaces . '<label for="text_pma_pw2">' . "\n"
       . $spaces . '    ' . $GLOBALS['strReType'] . ':' . "\n"
       . $spaces . '</label>' . "\n"
       . $spaces . '<span class="options">&nbsp;</span>' . "\n"
       . $spaces . '<input type="password" name="pma_pw2" id="text_pma_pw2" title="' . $GLOBALS['strReType'] . '" onchange="pred_password.value = \'userdefined\';" />' . "\n"
       . $spaces . '</div>' . "\n"
       . $spaces . '<div class="item">' . "\n"
       . $spaces . '<label for="button_generate_password">' . "\n"
       . $spaces . '    ' . $GLOBALS['strGeneratePassword'] . ':' . "\n"
       . $spaces . '</label>' . "\n"
       . $spaces . '<span class="options">' . "\n"
       . $spaces . '    <input type="button" id="button_generate_password" value="' . $GLOBALS['strGenerate'] . '" onclick="suggestPassword()" />' . "\n"
       . $spaces . '    <input type="button" id="button_copy_password" value="' . $GLOBALS['strCopy'] . '" onclick="suggestPasswordCopy(this.form)" />' . "\n"
       . $spaces . '</span>' . "\n"
       . $spaces . '<input type="text" name="generated_pw" id="generated_pw" />' . "\n"
       . $spaces . '</div>' . "\n"
       . $spaces . '</fieldset>' . "\n";
} // end of the 'PMA_displayUserAndHostFields()' function


/**
 * Changes / copies a user, part I
 */
if (!empty($change_copy)) {
    $user_host_condition =
        ' WHERE ' . PMA_convert_using('User')
        .' = ' . PMA_convert_using(PMA_sqlAddslashes($old_username), 'quoted')
        .' AND ' . PMA_convert_using('Host')
        .' = ' . PMA_convert_using($old_hostname, 'quoted') . ';';
    $res = PMA_DBI_query('SELECT * FROM `mysql`.`user` ' . $user_host_condition);
    if (!$res) {
        $message = $GLOBALS['strNoUsersFound'];
        unset($change_copy);
    } else {
        $row = PMA_DBI_fetch_assoc($res);
        extract($row, EXTR_OVERWRITE);
        // Recent MySQL versions have the field "Password" in mysql.user,
        // so the previous extract creates $Password but this script
        // uses $password
        if (!isset($password) && isset($Password)) {
            $password=$Password;
        }
        PMA_DBI_free_result($res);
        $queries = array();
    }
}


/**
 * Adds a user
 *   (Changes / copies a user, part II)
 */
if (!empty($adduser_submit) || !empty($change_copy)) {
    unset($sql_query);
    if ($pred_username == 'any') {
        $username = '';
    }
    switch ($pred_hostname) {
        case 'any':
            $hostname = '%';
            break;
        case 'localhost':
            $hostname = 'localhost';
            break;
        case 'hosttable':
            $hostname = '';
            break;
        case 'thishost':
            $res = PMA_DBI_query('SELECT USER();');
            $row = PMA_DBI_fetch_row($res);
            PMA_DBI_free_result($res);
            unset($res);
            $hostname = substr($row[0], (strrpos($row[0], '@') + 1));
            unset($row);
            break;
    }
    $res = PMA_DBI_query(
        'SELECT \'foo\' FROM `mysql`.`user`'
        .' WHERE ' . PMA_convert_using('User')
        .' = ' . PMA_convert_using(PMA_sqlAddslashes($username), 'quoted')
        .' AND ' . PMA_convert_using('Host')
        .' = ' . PMA_convert_using($hostname, 'quoted') . ';',
        null, PMA_DBI_QUERY_STORE);
    if (PMA_DBI_num_rows($res) == 1) {
        PMA_DBI_free_result($res);
        $message = sprintf($GLOBALS['strUserAlreadyExists'], '[i]\'' . $username . '\'@\'' . $hostname . '\'[/i]');
        $adduser = 1;
    } else {
        PMA_DBI_free_result($res);

        if (50002 <= PMA_MYSQL_INT_VERSION) {
            // MySQL 5 requires CREATE USER before any GRANT on this user can done
            $create_user_real = 'CREATE USER \'' . PMA_sqlAddslashes($username) . '\'@\'' . $hostname . '\'';
        }

        $real_sql_query =
            'GRANT ' . join(', ', PMA_extractPrivInfo()) . ' ON *.* TO \''
            . PMA_sqlAddslashes($username) . '\'@\'' . $hostname . '\'';
        if ($pred_password != 'none' && $pred_password != 'keep') {
            $pma_pw_hidden = str_repeat('*', strlen($pma_pw));
            $sql_query = $real_sql_query . ' IDENTIFIED BY \'' . $pma_pw_hidden . '\'';
            $real_sql_query .= ' IDENTIFIED BY \'' . PMA_sqlAddslashes($pma_pw) . '\'';
            if ( isset( $create_user_real ) ) {
                $create_user_show = $create_user_real . ' IDENTIFIED BY \'' . $pma_pw_hidden . '\'';
                $create_user_real .= ' IDENTIFIED BY \'' . PMA_sqlAddslashes($pma_pw) . '\'';
            }
        } else {
            if ($pred_password == 'keep' && !empty($password)) {
                $real_sql_query .= ' IDENTIFIED BY PASSWORD \'' . $password . '\'';
                if ( isset( $create_user_real ) ) {
                    $create_user_real .= ' IDENTIFIED BY PASSWORD \'' . $password . '\'';
                }
            }
            $sql_query = $real_sql_query;
            if ( isset( $create_user_real ) ) {
                $create_user_show = $create_user_real;
            }
        }
        // FIXME: similar code appears twice in this script
        if ((isset($Grant_priv) && $Grant_priv == 'Y') || (PMA_MYSQL_INT_VERSION >= 40002 && (isset($max_questions) || isset($max_connections) || isset($max_updates) || isset($max_user_connections)))) {
            $real_sql_query .= 'WITH';
            $sql_query .= 'WITH';
            if (isset($Grant_priv) && $Grant_priv == 'Y') {
                $real_sql_query .= ' GRANT OPTION';
                $sql_query .= ' GRANT OPTION';
            }
            if (PMA_MYSQL_INT_VERSION >= 40002) {
                if (isset($max_questions)) {
                    // avoid negative values
                    $max_questions = max(0, (int)$max_questions);
                    $real_sql_query .= ' MAX_QUERIES_PER_HOUR ' . $max_questions;
                    $sql_query .= ' MAX_QUERIES_PER_HOUR ' . $max_questions;
                }
                if (isset($max_connections)) {
                    $max_connections = max(0, (int)$max_connections);
                    $real_sql_query .= ' MAX_CONNECTIONS_PER_HOUR ' . $max_connections;
                    $sql_query .= ' MAX_CONNECTIONS_PER_HOUR ' . $max_connections;
                }
                if (isset($max_updates)) {
                    $max_updates = max(0, (int)$max_updates);