query("SHOW PRIVILEGES"); while ($row = $result->fetch_assoc()) { foreach (explode(",", $row["Context"]) as $context) { $privileges[$context][$row["Privilege"]] = $row["Comment"]; } } $result->free(); $privileges["Server Admin"] += $privileges["File access on server"]; $privileges["Databases"]["Create routine"] = $privileges["Procedures"]["Create routine"]; $privileges["Columns"] = array(); foreach (array("Select", "Insert", "Update", "References") as $val) { $privileges["Columns"][$val] = $privileges["Tables"][$val]; } unset($privileges["Server Admin"]["Usage"]); unset($privileges["Procedures"]["Create routine"]); foreach ($privileges["Tables"] as $key => $val) { unset($privileges["Databases"][$key]); } function all_privileges(&$grants, $privileges) { foreach ($privileges as $privilege => $val) { if ($privilege != "Grant option") { $grants[strtoupper($privilege)] = true; } } } $new_grants = array(); if ($_POST) { foreach ($_POST["objects"] as $key => $val) { $new_grants[$val] = ((array) $new_grants[$val]) + ((array) $_POST["grants"][$key]); } } $grants = array(); $old_pass = ""; if (isset($_GET["host"]) && ($result = $mysql->query("SHOW GRANTS FOR '" . $mysql->escape_string($_GET["user"]) . "'@'" . $mysql->escape_string($_GET["host"]) . "'"))) { //! Use information_schema for MySQL 5 - column names in column privileges are not escaped while ($row = $result->fetch_row()) { if (preg_match('~GRANT (.*) ON (.*) TO ~', $row[0], $match)) { //! escape the part between ON and TO if ($match[1] == "ALL PRIVILEGES") { if ($match[2] == "*.*") { all_privileges($grants[$match[2]], $privileges["Server Admin"]); } if (substr($match[2], -1) == "*") { all_privileges($grants[$match[2]], $privileges["Databases"]); all_privileges($grants[$match[2]], (array) $privileges["Procedures"]); } all_privileges($grants[$match[2]], $privileges["Tables"]); } elseif (preg_match_all('~ *([^(,]*[^ ,(])( *\\([^)]+\\))?~', $match[1], $matches, PREG_SET_ORDER)) { foreach ($matches as $val) { $grants["$match[2]$val[2]"][$val[1]] = true; } } } if (preg_match('~ WITH GRANT OPTION~', $row[0])) { //! don't check inside strings and identifiers $grants[$match[2]]["GRANT OPTION"] = true; } if (preg_match("~ IDENTIFIED BY PASSWORD '([^']+)~", $row[0], $match)) { $old_pass = $match[1]; } } $result->free(); } if ($_POST && !$error) { $old_user = (isset($_GET["host"]) ? $mysql->escape_string($_GET["user"]) . "'@'" . $mysql->escape_string($_GET["host"]) : ""); $new_user = $mysql->escape_string($_POST["user"]) . "'@'" . $mysql->escape_string($_POST["host"]); $pass = $mysql->escape_string($_POST["pass"]); if ($_POST["drop"]) { query_redirect("DROP USER '$old_user'", $SELF . "privileges=", lang('User has been dropped.')); } elseif ($old_user == $new_user || $mysql->query(($mysql->server_info < 5 ? "GRANT USAGE ON *.* TO" : "CREATE USER") . " '$new_user' IDENTIFIED BY" . ($_POST["hashed"] ? " PASSWORD" : "") . " '$pass'")) { if ($old_user == $new_user) { $mysql->query("SET PASSWORD FOR '$new_user' = " . ($_POST["hashed"] ? "'$pass'" : "PASSWORD('$pass')")); } $revoke = array(); foreach ($new_grants as $object => $grant) { if (isset($_GET["grant"])) { $grant = array_filter($grant); } $grant = array_keys($grant); if (isset($_GET["grant"])) { $revoke = array_diff(array_keys(array_filter($new_grants[$object], 'strlen')), $grant); } elseif ($old_user == $new_user) { $old_grant = array_keys((array) $grants[$object]); $revoke = array_diff($old_grant, $grant); $grant = array_diff($grant, $old_grant); unset($grants[$object]); } if (preg_match('~^(.+)(\\(.*\\))?$~U', $object, $match) && ( ($grant && !$mysql->query("GRANT " . implode("$match[2], ", $grant) . "$match[2] ON $match[1] TO '$new_user'")) //! SQL injection || ($revoke && !$mysql->query("REVOKE " . implode("$match[2], ", $revoke) . "$match[2] ON $match[1] FROM '$new_user'")) )) { $error = $mysql->error; if ($old_user != $new_user) { $mysql->query("DROP USER '$new_user'"); } break; } } if (!$error) { if (isset($_GET["host"]) && $old_user != $new_user) { $mysql->query("DROP USER '$old_user'"); } elseif (!isset($_GET["grant"])) { foreach ($grants as $object => $revoke) { if (preg_match('~^(.+)(\\(.*\\))?$~U', $object, $match)) { $mysql->query("REVOKE " . implode("$match[2], ", array_keys($revoke)) . "$match[2] ON $match[1] FROM '$new_user'"); } } } redirect($SELF . "privileges=", (isset($_GET["host"]) ? lang('User has been altered.') : lang('User has been created.'))); } } if (!$error) { $error = $mysql->error; } } page_header((isset($_GET["host"]) ? lang('Username') . ": " . htmlspecialchars("$_GET[user]@$_GET[host]") : lang('Create user')), $error, array("privileges" => lang('Privileges'))); if ($_POST) { $row = $_POST; $grants = $new_grants; } else { $row = $_GET + array("host" => "localhost"); $row["pass"] = $old_pass; if (strlen($old_pass)) { $row["hashed"] = true; } $grants[""] = true; } ?>