package MySQLaccess;

use File::Temp qw(tempfile tmpnam);

use Fcntl;

BEGIN {

# ****************************

# static information...

$VERSION = "2.06, 20 Dec 2000";

$0 =~ m%/([^/]+)$%o;

$script = $1;

$script = 'MySQLAccess' unless $script;

$script_conf = "$script.conf";

$script_log = $ENV{'HOME'}."/$script.log";

# ****************************

# information on MySQL

$MYSQL = '@bindir@/mysql'; # path to mysql executable

$SERVER = '3.21';

$MYSQL_OPT = ' --batch --unbuffered';

$ACCESS_DB = 'mysql'; # name of DB with grant-tables

$ACCESS_H = 'host'; #

$ACCESS_U = 'user'; #

$ACCESS_D = 'db'; #

# Add/Edit privileges

$ACCESS_H_TMP = 'host_tmp';

$ACCESS_U_TMP = 'user_tmp';

$ACCESS_D_TMP = 'db_tmp';

$ACCESS_H_BCK = 'host_backup';

$ACCESS_U_BCK = 'user_backup';

$ACCESS_D_BCK = 'db_backup';

$DIFF = '/usr/bin/diff';

$MYSQLDUMP = '@bindir@/mysqldump';

#path to mysqldump executable

$MYSQLADMIN= 'http://foobar.com/MySQLadmin';

#URL of CGI for manipulating

#the temporary grant-tables

}

END {

unlink $MYSQL_CNF if defined $MYSQL_CNF and not $DEBUG;

}

$INFO = <<"_INFO";

$OPTIONS = <<_OPTIONS;

$RELEASE = <<'_RELEASE';

$TODO = <<_TODO;

$HOWTO = <<_HOWTO;

use Getopt::Long;

use Sys::Hostname;

use IPC::Open3;

$DEBUG = 0;

$|=1;

$MYSQL_CNF = tmpnam();

%MYSQL_CNF = (client => { },

mysql => { },

mysqldump => { },

);

$NEW_USER = 'ANY_NEW_USER';

$NEW_DB = 'ANY_NEW_DB' ;

($CMD,$CGI) = GetMode();

MySQLaccess::Report::Print_Header();

MySQLaccess::Debug::Print(1, "Reading configuration file...");

if (-f "./$script_conf") {

require "./$script_conf";

}

elsif (-f "@sysconfdir@/$script_conf") {

require "@sysconfdir@/$script_conf";

}

elsif (-f "/etc/$script_conf") {

require "/etc/$script_conf";

}

if ($MySQLaccess::CMD) { #command-line version

# ----------------------------

# Get options from commandline

$Getopt::Long::ignorecase=0; #case sensitive options

if ( grep(/\-\?/,@ARGV) ) { MySQLaccess::Report::Print_Usage(); exit 0; }

GetOptions("help" => \$Param{'help'}

,"host|h=s" => \$Param{'host'}

,"user|u=s" => \$Param{'user'}

,"password|p:s" => \$Param{'password'}

,"db|d=s" => \$Param{'db'}

,"superuser|U=s" => \$Param{'superuser'}

,"spassword|P:s" => \$Param{'spassword'}

,"rhost|H=s" => \$Param{'rhost'}

,"old_server" => \$Param{'old_server'}

,"debug=i" => \$Param{'DEBUG'}

,"brief|b" => \$Param{'brief'}

,"table|t" => \$Param{'table'}

,"relnotes" => \$Param{'relnotes'}

,"plan" => \$Param{'plan'}

,"howto" => \$Param{'howto'}

,"version|v" => \$Param{'version'}

,"preview" => \$Param{'preview'}

,"copy" => \$Param{'copy'}

,"commit" => \$Param{'commit'}

,'rollback' => \$Param{'rollback'}

);

# -----------------------------

# set DEBUG

$DEBUG = $Param{'DEBUG'} if ($Param{'DEBUG'}>=$DEBUG);

# -----------------------------

# check for things which aren't

# declared as options:

# 2 arguments: (user,db) -> ('localhost','user','db')

if ($#ARGV == 1) {

MySQLaccess::Debug::Print(2,"$script called with 2 arguments:");

$Param{'host'} = $Param{'host'} || 'localhost';

$Param{'user'} = $ARGV[0] || $Param{'user'};

$Param{'db'} = $ARGV[1] || $Param{'db'};

}

# 3 arguments: (host,user,db)

if ($#ARGV == 2) {

MySQLaccess::Debug::Print(2,"$script called with 3 arguments:");

$Param{'host'} = $ARGV[0] || $Param{'host'};

$Param{'user'} = $ARGV[1] || $Param{'user'};

$Param{'db'} = $ARGV[2] || $Param{'db'};

}

# -------------------------------------

# prompt for user password if requested

if ( defined($Param{'password'}) && length($Param{'password'}) == 0 ) {

$Param{'password'} = PromptPass(

"Password for MySQL user $Param{'user'}: ");

}

}

if ($MySQLaccess::CGI) { #CGI-version

require CGI;

$Q = new CGI;

$Param{'help'} = $Q->param('help') ;

$Param{'host'} = $Q->param('host') || $Q->param('h') || $Param{'host'};

$Param{'user'} = $Q->param('user') || $Q->param('u') || $Param{'user'};

$Param{'db'} = $Q->param('db') || $Q->param('d') || $Param{'db'};

$Param{'password'} = $Q->param('password') || $Q->param('p') || $Param{'password'};

$Param{'superuser'} = $Q->param('superuser') || $Q->param('U') || $Param{'superuser'};

$Param{'spassword'} = $Q->param('spassword') || $Q->param('P') || $Param{'spassword'};

$Param{'rhost'} = $Q->param('rhost') || $Q->param('H') || $Param{'rhost'};

$Param{'old_server'}= $Q->param('old_server')|| $Param{'old_server'};

$Param{'debug'} = $Q->param('debug') || $Param{'debug'};

$Param{'brief'} = $Q->param('brief') || $Param{'brief'};

$Param{'table'} = $Q->param('table') || $Param{'table'};

$Param{'relnotes'} = $Q->param('relnotes');

$Param{'plan'} = $Q->param('plan');

$Param{'howto'} = $Q->param('howto');

$Param{'version'} = $Q->param('version') ? $Q->param('version') : $Q->param('v');

$Param{'edit'} = $Q->param('edit');

$Param{'preview'} = $Q->param('preview');

$Param{'copy'} = $Q->param('copy');

$Param{'commit'} = $Q->param('commit');

$Param{'rollback'} = $Q->param('rollback');

# -----------------------------

# set DEBUG

$DEBUG = $Q->param('debug') if ($Q->param('debug')>=$DEBUG);

}

if (defined($Param{'table'})) { undef($Param{'brief'}); }

if (defined($Param{'preview'}) or

defined($Param{'copy'}) or

defined($Param{'commit'}) or

defined($Param{'rollback'}) ) { $Param{'edit'}='on'; }

if (!defined($Param{'host'})) { $Param{'host'}='localhost'; }

push(@MySQLaccess::Grant::Error,'not_found_mysql') if !(-x $MYSQL);

push(@MySQLaccess::Grant::Error,'not_found_diff') if !(-x $DIFF);

push(@MySQLaccess::Grant::Error,'not_found_mysqldump') if !(-x $MYSQLDUMP);

if (@MySQLaccess::Grant::Error) {

MySQLaccess::Report::Print_Error_Messages() ;

exit 0;

}

$print_usage=1;

if ( defined($Param{'version'}) ) {

MySQLaccess::Report::Print_Version();

$print_usage=0;

MySQLaccess::Report::Print_Footer();

MySQLaccess::DB::CloseConnection();

exit 0;

}

if ( defined($Param{'relnotes'}) ) {

MySQLaccess::Report::Print_Relnotes();

$print_usage=0;

MySQLaccess::Report::Print_Footer();

MySQLaccess::DB::CloseConnection();

exit 0;

}

if ( defined($Param{'plan'}) ) {

MySQLaccess::Report::Print_Plans();

$print_usage=0;

MySQLaccess::Report::Print_Footer();

MySQLaccess::DB::CloseConnection();

exit 0;

}

if ( defined($Param{'howto'}) ) {

MySQLaccess::Report::Print_HowTo();

$print_usage=0;

MySQLaccess::Report::Print_Footer();

MySQLaccess::DB::CloseConnection();

exit 0;

}

if ( defined($Param{'help'})

or !defined($Param{'user'})

or !defined($Param{'host'})

or !defined($Param{'db'})

) {

push(@MySQLaccess::Grant::Error,'user_required') unless defined($Param{'user'});

push(@MySQLaccess::Grant::Error,'db_required') unless defined($Param{'db'});

push(@MySQLaccess::Grant::Error,'host_required') unless defined($Param{'host'});

MySQLaccess::Report::Print_Usage() if $print_usage;

exit 0;

}

$localhost = MySQLaccess::Host::LocalHost();

$local_ip = MySQLaccess::Host::Name2IP($localhost);

$MySQLaccess::Host::localhost = MySQLaccess::Host::LocalHost();

$MySQLaccess::Host::local_ip = MySQLaccess::Host::Name2IP($localhost);

MySQLaccess::Debug::Print(3, "localhost name=$localhost, ip=$local_ip");

$MySQLaccess::Host::SERVER = $Param{'old_server'} ? '3.20' : $SERVER;

MergeConfigFiles();

die "Unsafe config file found: $unsafeConfig\n" if $unsafeConfig;

if (defined($Param{'superuser'})) {

$MYSQL_CNF{'mysql'}{'user'} = $Param{'superuser'};

$MYSQL_CNF{'mysqldump'}{'user'} = $Param{'superuser'};

}

if (defined($Param{'spassword'})) {

if ( $CMD && length($Param{'spassword'}) == 0 ) {

$Param{'spassword'} =

PromptPass("Password for MySQL superuser $Param{'superuser'}: ");

}

if ( length($Param{'spassword'}) > 0 ) {

$MYSQL_CNF{'mysql'}{'password'} = $Param{'spassword'};

$MYSQL_CNF{'mysqldump'}{'password'} = $Param{'spassword'};

}

}

WriteTempConfigFile();

if ( $nerror=MySQLaccess::DB::OpenConnection() ) {

MySQLaccess::Report::Print_Error_Access($nerror);

exit 0;

}

if ($nerror=MySQLaccess::Grant::ReadTables()) {

MySQLaccess::Report::Print_Error_Access($nerror);

exit 0;

};

if ($Param{'edit'} and $nerror=MySQLaccess::Grant::ReadTables('tmp')) {

MySQLaccess::Report::Print_Error_Access($nerror);

exit 0;

}

if ( defined($Param{'copy'}) ) {

$nerror=MySQLaccess::DB::LoadTmpTables();

if ($nerror) {

MySQLaccess::Report::Print_Error_Access($nerror);

exit 0;

}

my $msg = "The grant-rules are copied from the grant-tables to\n"

. "the temporary tables.";

MySQLaccess::Report::Print_Message([$msg]);

}

if ( defined($Param{'preview'}) ) {

$aref=MySQLaccess::Grant::Diff_Privileges();

MySQLaccess::Report::Print_Diff_ACL($aref);

}

if ( defined($Param{'commit'}) ) {

if ($nerror = MySQLaccess::DB::CommitGrantTables()) {

MySQLaccess::Report::Print_Error_Access($nerror);

exit 0;

}

my $msg = "The grant-rules have been copied from the temporary tables\n"

. "to the grant-tables.";

my $msg1= "Don't forget to do an 'mysqladmin reload' before these\n"

. "changes take effect.";

my $msg2= "A backup-version of your original grant-rules are saved in the\n"

. "backup-tables, so you can always perform a 1-level rollback.";

MySQLaccess::Report::Print_Message([$msg,$msg1,$msg2]);

}

if ( defined($Param{'rollback'}) ) {

if ($nerror = MySQLaccess::DB::RollbackGrantTables()) {

MySQLaccess::Report::Print_Error_Access($nerror);

exit 0;

}

my $msg = "The old grant-rules have been copied back from the backup tables\n"

. "to the grant-tables.";

my $msg1= "Don't forget to do an 'mysqladmin reload' before these\n"

. "changes take effect.";

MySQLaccess::Report::Print_Message([$msg,$msg1]);

}

if ( defined($Param{'edit'})) {

if ($MySQLaccess::CGI ) {

MySQLaccess::Report::Print_Edit();

$print_usage=0;

MySQLaccess::Report::Print_Footer();

MySQLaccess::DB::CloseConnection();

exit 0;

}

else {

MySQLaccess::Report::Print_Edit();

$print_usage=0;

MySQLaccess::Report::Print_Footer();

MySQLaccess::DB::CloseConnection();

exit 0;

}

}

@all_dbs = @{MySQLaccess::DB::Get_All_dbs($Param{'db'})};

@all_users = @{MySQLaccess::DB::Get_All_users($Param{'user'})};

@all_hosts = @{MySQLaccess::DB::Get_All_hosts($Param{'host'})};

my %Access = ();

foreach $host (@all_hosts) {

foreach $user (@all_users) {

foreach $db (@all_dbs) {

MySQLaccess::Grant::Initialize();

%Access = MySQLaccess::Grant::Get_Access_Rights($host,$user,$db);

MySQLaccess::Report::Print_Access_rights($host,$user,$db,\%Access);

}

}

}

MySQLaccess::Report::Print_Footer();

MySQLaccess::DB::CloseConnection();

exit 0;

sub GetMode {

my $cmd=0;

my $cgi=0;

if (defined($ENV{'HTTP_HOST'})) { $cmd=0; $cgi=1; }

else { $cmd=1; $cgi=0; }

return ($cmd,$cgi);

}

sub PromptPass {

my ($prompt) = @_;

my $password;

$ENV{PATH} = "/bin:/usr/bin";

$ENV{IFS} = " \t\n";

$ENV{SHELL} = "/bin/sh";

system "stty -echo";

print $prompt;

chomp($password = <STDIN>);

print "\n";

system "stty echo";

$password;

}

sub CheckUnsafeFile {

my ($fname) = @_;

my ($dev, $ino, $mode, $nlink,

$uid, $gid, $rdev, $size,

$atime, $mtime, $ctime, $blksize, $blocks) = stat($fname);

if ( $uid != $< ) { # unsafe if owned by other than current user

return 1;

}

if ( $mode & 066 ) { # unsafe if accessible by other

return 1;

}

$fname =~ s#/[^/]+$##;

if ( (length $fname) > 0 ) {

return CheckUnsafeDir($fname);

}

return 0;

}

sub CheckUnsafeDir {

my ($fname) = @_;

my ($dev, $ino, $mode, $nlink,

$uid, $gid, $rdev, $size,

$atime, $mtime, $ctime, $blksize, $blocks) = stat($fname);

# not owned by me or root

if ( ($uid != $<) && ($uid != 0) ) {

return 1;

}

if ( $mode & 022 ) { # unsafe if writable by other

return 1 unless $mode & 01000; # but sticky bit ok

}

$fname =~ s#/[^/]+$##;

if ( (length $fname) > 0 ) {

return CheckUnsafeDir($fname);

}

return 0;

}

sub MergeConfigFile {

my ($fname) = @_;

my ($group, $item, $value);

if ( open CNF, $fname ) {

while (<CNF>) {

s/^\s+//;

next if /^[#;]/;

if ( /\[\s*(\w+)\s*]/ ) {

$group = $1;

$group =~ tr/A-Z/a-z/;

if ( !exists $MYSQL_CNF{$group} ) {

undef $group;

}

} elsif ( defined $group ) {

($item, $value) = /((?:\w|-)+)\s*=\s*(\S+)/;

# don't unquote backslashes as we just write it back out

if ( defined $item ) {

if ( $item =~ /^password$/ ) {

if ( CheckUnsafeFile($fname) ) {

$unsafeConfig = $fname;

}

}

if ( $group eq 'client' ) {

$MYSQL_CNF{'mysql'}{$item} = $value;

$MYSQL_CNF{'mysqldump'}{$item} = $value;

} else {

$MYSQL_CNF{$group}{$item} = $value;

}

}

}

}

close(CNF);

}

}

sub MergeConfigFiles {

my ($name,$pass,$uid,$gid,$quota,$comment,$gcos,$dir,$shell) = getpwuid $<;

MergeConfigFile("@sysconfdir@/my.cnf");

MergeConfigFile("/etc/my.cnf");

MergeConfigFile("$dir/.my.cnf");

}

sub WriteTempConfigFile {

sysopen CNFFILE, $MYSQL_CNF, O_RDWR|O_CREAT|O_EXCL, 0700

or die "sysopen $MYSQL_CNF: $!";

# groups may be in any order, generic groups such as [client] assumed

# here to be empty

foreach $group (keys %MYSQL_CNF) {

print CNFFILE "[$group]\n";

foreach $item (keys %{$MYSQL_CNF{$group}}) {

if ( defined $MYSQL_CNF{$group}{$item} ) {

print CNFFILE "$item=$MYSQL_CNF{$group}{$item}\n";

} else {

print CNFFILE "$item\n";

}

}

print CNFFILE "\n";

}

close(CNFFILE);

}

package MySQLaccess::DB;

BEGIN {

$DEBUG = 2;

$DEBUG = $MySQLaccess::DEBUG unless ($DEBUG);

# Error-messages from the MySQL client

%ACCESS_ERR= ('Access_denied' => 'Access denied'

,'Dbaccess_denied' => 'Access to database denied'

,'Unrecognized_option' => 'unrecognized option'

,'Unknown_table' => "Can't find file:"

,'unknown_error' => '^ERROR:'

);

}