Issues in PrivilegesController.php - New Issues - Inspection of "Merge pull request #104 from HuasoFoundries/analys..." - HuasoFoundries/phpPgAdmin6 - Measure and Improve Code Quality continuously with Scrutinizer

Passed

Push — master ( 442876...4ec1bc )

by Felipe

created 2018-03-09 23:17 UTC

src/controllers/PrivilegesController.php (2 issues)

Labels

Coding Style 2

Severity

Informational 2

<?php


/*
 * PHPPgAdmin v6.0.0-beta.30
 */

namespace PHPPgAdmin\Controller;

/**
 * PrivilegesController controller class.
 */
class PrivilegesController extends BaseController
{
    public $controller_name = 'PrivilegesController';
    public $table_place     = 'privileges-privileges';

    /**
     * Default method to render the controller according to the action parameter.
     */
    public function render()
    {
        $lang   = $this->lang;
        $action = $this->action;

        $this->printHeader($lang['strprivileges']);
        $this->printBody();

        switch ($action) {
            case 'save':
                if (isset($_REQUEST['cancel'])) {
                    $this->doDefault();
                } else {
                    $this->doAlter(false, $_REQUEST['mode']);
                }

                break;
            case 'alter':
                $this->doAlter(true, $_REQUEST['mode']);

                break;
            default:
                $this->doDefault();

                break;
        }

        $this->printFooter();
    }

    /**
     * Show permissions on a database, namespace, relation, language or function.
     *
     * @param mixed $msg

     */
    public function doDefault($msg = '')
    {
        $lang   = $this->lang;
        $action = $this->action;
        $data   = $this->misc->getDatabaseAccessor();

        $this->printTrail($_REQUEST['subject']);

        // @@@FIXME: This switch is just a temporary solution,
        // need a better way, maybe every type of object should
        // have a tab bar???
        switch ($_REQUEST['subject']) {
            case 'server':
            case 'database':
            case 'schema':
            case 'table':
            case 'column':
            case 'view':
                $this->printTabs($_REQUEST['subject'], 'privileges');

                break;
            default:
                $this->printTitle($lang['strprivileges'], 'pg.privilege');
        }
        $this->printMsg($msg);

        // Determine whether object should be ref'd by name or oid.
        if (isset($_REQUEST[$_REQUEST['subject'] . '_oid'])) {
            $object = $_REQUEST[$_REQUEST['subject'] . '_oid'];
        } else {
            $object = $_REQUEST[$_REQUEST['subject']];
        }

        // Get the privileges on the object, given its type
        if ('column' == $_REQUEST['subject']) {
            $privileges = $data->getPrivileges($object, 'column', $_REQUEST['table']);
        } else {
            $privileges = $data->getPrivileges($object, $_REQUEST['subject']);
        }

        if (sizeof($privileges) > 0) {
            echo "<table>\n";
            if ($data->hasRoles()) {
                echo "<tr><th class=\"data\">{$lang['strrole']}</th>";
            } else {
                echo "<tr><th class=\"data\">{$lang['strtype']}</th><th class=\"data\">{$lang['struser']}/{$lang['strgroup']}</th>";
            }

            foreach ($data->privlist[$_REQUEST['subject']] as $v2) {
                // Skip over ALL PRIVILEGES
                if ('ALL PRIVILEGES' == $v2) {
                    continue;
                }

                echo "<th class=\"data\">{$v2}</th>\n";
            }
            if ($data->hasGrantOption()) {
                echo "<th class=\"data\">{$lang['strgrantor']}</th>";
            }
            echo "</tr>\n";

            // Loop over privileges, outputting them
            $i = 0;
            foreach ($privileges as $v) {
                $id = (0 == ($i % 2) ? '1' : '2');
                echo "<tr class=\"data{$id}\">\n";
                if (!$data->hasRoles()) {
                    echo '<td>', $this->misc->printVal($v[0]), "</td>\n";
                }

                echo '<td>', $this->misc->printVal($v[1]), "</td>\n";
                foreach ($data->privlist[$_REQUEST['subject']] as $v2) {
                    // Skip over ALL PRIVILEGES
                    if ('ALL PRIVILEGES' == $v2) {
                        continue;
                    }

                    echo '<td>';
                    if (in_array($v2, $v[2], true)) {
                        echo $lang['stryes'];
                    } else {
                        echo $lang['strno'];
                    }

                    // If we have grant option for this, end mark
                    if ($data->hasGrantOption() && in_array($v2, $v[4], true)) {
                        echo $lang['strasterisk'];
                    }

                    echo "</td>\n";
                }
                if ($data->hasGrantOption()) {
                    echo '<td>', $this->misc->printVal($v[3]), "</td>\n";
                }
                echo "</tr>\n";
                ++$i;
            }

            echo '</table>';
        } else {
            echo "<p>{$lang['strnoprivileges']}</p>\n";
        }

        // Links for granting to a user or group
        switch ($_REQUEST['subject']) {
            case 'table':
            case 'view':
            case 'sequence':
            case 'function':
            case 'tablespace':
                $alllabel = "showall{$_REQUEST['subject']}s";
                $allurl   = "{$_REQUEST['subject']}s.php";
                $alltxt   = $lang["strshowall{$_REQUEST['subject']}s"];

                break;
            case 'schema':
                $alllabel = 'showallschemas';
                $allurl   = 'schemas.php';
                $alltxt   = $lang['strshowallschemas'];

                break;
            case 'database':
                $alllabel = 'showalldatabases';
                $allurl   = 'alldb.php';
                $alltxt   = $lang['strshowalldatabases'];

                break;
        }

        $subject = $_REQUEST['subject'];
        $object  = $_REQUEST[$_REQUEST['subject']];

        if ('function' == $_REQUEST['subject']) {
            $objectoid = $_REQUEST[$_REQUEST['subject'] . '_oid'];
            $urlvars   = [
                'action'         => 'alter',
                'server'         => $_REQUEST['server'],
                'database'       => $_REQUEST['database'],
                'schema'         => $_REQUEST['schema'],
                $subject         => $object,
                "{$subject}_oid" => $objectoid,
                'subject'        => $subject,
            ];
        } elseif ('column' == $_REQUEST['subject']) {
            $urlvars = [
                'action'   => 'alter',
                'server'   => $_REQUEST['server'],
                'database' => $_REQUEST['database'],
                'schema'   => $_REQUEST['schema'],
                $subject   => $object,
                'subject'  => $subject,
            ];

            if (isset($_REQUEST['table'])) {
                $urlvars['table'] = $_REQUEST['table'];
            } else {
                $urlvars['view'] = $_REQUEST['view'];
            }
        } else {
            $urlvars = [
                'action'   => 'alter',
                'server'   => $_REQUEST['server'],
                'database' => $_REQUEST['database'],
                $subject   => $object,
                'subject'  => $subject,
            ];
            if (isset($_REQUEST['schema'])) {
                $urlvars['schema'] = $_REQUEST['schema'];
            }
        }

        $navlinks = [
            'grant'  => [
                'attr'    => [
                    'href' => [
                        'url'     => 'privileges.php',
                        'urlvars' => array_merge($urlvars, ['mode' => 'grant']),
                    ],
                ],
                'content' => $lang['strgrant'],
            ],
            'revoke' => [
                'attr'    => [
                    'href' => [
                        'url'     => 'privileges.php',
                        'urlvars' => array_merge($urlvars, ['mode' => 'revoke']),
                    ],
                ],
                'content' => $lang['strrevoke'],
            ],
        ];

        if (isset($allurl)) {
            $navlinks[$alllabel] = [
                'attr'    => [
                    'href' => [
                        'url'     => $allurl,
                        'urlvars' => [
                            'server'   => $_REQUEST['server'],
                            'database' => $_REQUEST['database'],
                        ],
                    ],
                ],
                'content' => $alltxt,
            ];
            if (isset($_REQUEST['schema'])) {
                $navlinks[$alllabel]['attr']['href']['urlvars']['schema'] = $_REQUEST['schema'];
            }
        }

        $this->printNavLinks($navlinks, $this->table_place, get_defined_vars());
    }

    /**
     * Grant permissions on an object to a user.
     *
     * @param $confirm To show entry screen
     * @param $mode 'grant' or 'revoke'
     * @param $msg (optional) A message to show
     */
    public function doAlter($confirm, $mode, $msg = '')
    {
        $lang   = $this->lang;
        $action = $this->action;
        $data   = $this->misc->getDatabaseAccessor();

        if (!isset($_REQUEST['username'])) {
            $_REQUEST['username'] = [];
        }

        if (!isset($_REQUEST['groupname'])) {
            $_REQUEST['groupname'] = [];
        }

        if (!isset($_REQUEST['privilege'])) {
            $_REQUEST['privilege'] = [];
        }

        if ($confirm) {
            // Get users from the database
            $users = $data->getUsers();
            // Get groups from the database
            $groups = $data->getGroups();

            $this->printTrail($_REQUEST['subject']);

            switch ($mode) {
                case 'grant':
                    $this->printTitle($lang['strgrant'], 'pg.privilege.grant');

                    break;
                case 'revoke':
                    $this->printTitle($lang['strrevoke'], 'pg.privilege.revoke');

                    break;
            }
            $this->printMsg($msg);

            echo '<form action="' . \SUBFOLDER . "/src/views/privileges.php\" method=\"post\">\n";
            echo "<table>\n";
            echo "<tr><th class=\"data left\">{$lang['strusers']}</th>\n";
            echo '<td class="data1"><select name="username[]" multiple="multiple" size="', min(6, $users->recordCount()), "\">\n";
            while (!$users->EOF) {
                $uname = htmlspecialchars($users->fields['usename']);
                echo "<option value=\"{$uname}\"",
                in_array($users->fields['usename'], $_REQUEST['username'], true) ? ' selected="selected"' : '', ">{$uname}</option>\n";
                $users->moveNext();
            }
            echo "</select></td></tr>\n";
            echo "<tr><th class=\"data left\">{$lang['strgroups']}</th>\n";
            echo "<td class=\"data1\">\n";
            echo '<input type="checkbox" id="public" name="public"', (isset($_REQUEST['public']) ? ' checked="checked"' : ''), " /><label for=\"public\">PUBLIC</label>\n";
            // Only show groups if there are groups!
            if ($groups->recordCount() > 0) {
                echo '<br /><select name="groupname[]" multiple="multiple" size="', min(6, $groups->recordCount()), "\">\n";
                while (!$groups->EOF) {
                    $gname = htmlspecialchars($groups->fields['groname']);
                    echo "<option value=\"{$gname}\"",
                    in_array($groups->fields['groname'], $_REQUEST['groupname'], true) ? ' selected="selected"' : '', ">{$gname}</option>\n";
                    $groups->moveNext();
                }
                echo "</select>\n";
            }
            echo "</td></tr>\n";
            echo "<tr><th class=\"data left required\">{$lang['strprivileges']}</th>\n";
            echo "<td class=\"data1\">\n";
            foreach ($data->privlist[$_REQUEST['subject']] as $v) {
                $v = htmlspecialchars($v);
                echo "<input type=\"checkbox\" id=\"privilege[${v}]\" name=\"privilege[${v}]\"",
                isset($_REQUEST['privilege'][$v]) ? ' checked="checked"' : '', " /><label for=\"privilege[${v}]\">{$v}</label><br />\n";
            }
            echo "</td></tr>\n";
            // Grant option
            if ($data->hasGrantOption()) {
                echo "<tr><th class=\"data left\">{$lang['stroptions']}</th>\n";
                echo "<td class=\"data1\">\n";
                if ('grant' == $mode) {
                    echo '<input type="checkbox" id="grantoption" name="grantoption"',
                    isset($_REQUEST['grantoption']) ? ' checked="checked"' : '', " /><label for=\"grantoption\">GRANT OPTION</label>\n";
                } elseif ('revoke' == $mode) {
                    echo '<input type="checkbox" id="grantoption" name="grantoption"',
                    isset($_REQUEST['grantoption']) ? ' checked="checked"' : '', " /><label for=\"grantoption\">GRANT OPTION FOR</label><br />\n";
                    echo '<input type="checkbox" id="cascade" name="cascade"',
                    isset($_REQUEST['cascade']) ? ' checked="checked"' : '', " /><label for=\"cascade\">CASCADE</label><br />\n";
                }
                echo "</td></tr>\n";
            }
            echo "</table>\n";

            echo "<p><input type=\"hidden\" name=\"action\" value=\"save\" />\n";
            echo '<input type="hidden" name="mode" value="', htmlspecialchars($mode), "\" />\n";
            echo '<input type="hidden" name="subject" value="', htmlspecialchars($_REQUEST['subject']), "\" />\n";
            if (isset($_REQUEST[$_REQUEST['subject'] . '_oid'])) {
                echo '<input type="hidden" name="', htmlspecialchars($_REQUEST['subject'] . '_oid'),
                '" value="', htmlspecialchars($_REQUEST[$_REQUEST['subject'] . '_oid']), "\" />\n";
            }

            echo '<input type="hidden" name="', htmlspecialchars($_REQUEST['subject']),
            '" value="', htmlspecialchars($_REQUEST[$_REQUEST['subject']]), "\" />\n";
            if ('column' == $_REQUEST['subject']) {
                echo '<input type="hidden" name="table" value="',
                htmlspecialchars($_REQUEST['table']), "\" />\n";
            }

            echo $this->misc->form;
            if ('grant' == $mode) {
                echo "<input type=\"submit\" name=\"grant\" value=\"{$lang['strgrant']}\" />\n";
            } elseif ('revoke' == $mode) {
                echo "<input type=\"submit\" name=\"revoke\" value=\"{$lang['strrevoke']}\" />\n";
            }

            echo "<input type=\"submit\" name=\"cancel\" value=\"{$lang['strcancel']}\" /></p>";
            echo "</form>\n";
        } else {
            // Determine whether object should be ref'd by name or oid.
            if (isset($_REQUEST[$_REQUEST['subject'] . '_oid'])) {
                $object = $_REQUEST[$_REQUEST['subject'] . '_oid'];
            } else {
                $object = $_REQUEST[$_REQUEST['subject']];
            }

            if (isset($_REQUEST['table'])) {
                $table = $_REQUEST['table'];
            } else {
                $table = null;
            }

            $status = $data->setPrivileges(
                ('grant' == $mode) ? 'GRANT' : 'REVOKE',
                $_REQUEST['subject'],
                $object,
                isset($_REQUEST['public']),
                $_REQUEST['username'],
                $_REQUEST['groupname'],
                array_keys($_REQUEST['privilege']),
                isset($_REQUEST['grantoption']),
                isset($_REQUEST['cascade']),
                $table
            );

            if (0 == $status) {
                $this->doDefault($lang['strgranted']);
            } elseif ($status == -3 || $status == -4) {
                $this->doAlter(true, $_REQUEST['mode'], $lang['strgrantbad']);
            } else {
                $this->doAlter(true, $_REQUEST['mode'], $lang['strgrantfailed']);
            }
        }
    }
}


1			<?php
2
			0 ignored issues – show Coding Style introduced 2018-02-15 15:30 UTC by Report Bug Copy Issue Report Show Similar Issues like this You must use "/**" style comments for a file comment Loading history...
3			/*
4			* PHPPgAdmin v6.0.0-beta.30
5			*/
6
7			namespace PHPPgAdmin\Controller;
8
9			/**
10			* PrivilegesController controller class.
11			*/
12			class PrivilegesController extends BaseController
13			{
14			public $controller_name = 'PrivilegesController';
15			public $table_place = 'privileges-privileges';
16
17			/**
18			* Default method to render the controller according to the action parameter.
19			*/
20			public function render()
21			{
22			$lang = $this->lang;
23			$action = $this->action;
24
25			$this->printHeader($lang['strprivileges']);
26			$this->printBody();
27
28			switch ($action) {
29			case 'save':
30			if (isset($_REQUEST['cancel'])) {
31			$this->doDefault();
32			} else {
33			$this->doAlter(false, $_REQUEST['mode']);
34			}
35
36			break;
37			case 'alter':
38			$this->doAlter(true, $_REQUEST['mode']);
39
40			break;
41			default:
42			$this->doDefault();
43
44			break;
45			}
46
47			$this->printFooter();
48			}
49
50			/**
51			* Show permissions on a database, namespace, relation, language or function.
52			*
53			* @param mixed $msg
			1 ignored issue – show Coding Style introduced 2018-02-15 19:22 UTC by Report Bug Copy Issue Report Show Similar Issues like this Missing parameter comment Loading history...
54			*/
55			public function doDefault($msg = '')
56			{
57			$lang = $this->lang;
58			$action = $this->action;
59			$data = $this->misc->getDatabaseAccessor();
60
61			$this->printTrail($_REQUEST['subject']);
62
63			// @@@FIXME: This switch is just a temporary solution,
64			// need a better way, maybe every type of object should
65			// have a tab bar???
66			switch ($_REQUEST['subject']) {
67			case 'server':
68			case 'database':
69			case 'schema':
70			case 'table':
71			case 'column':
72			case 'view':
73			$this->printTabs($_REQUEST['subject'], 'privileges');
74
75			break;
76			default:
77			$this->printTitle($lang['strprivileges'], 'pg.privilege');
78			}
79			$this->printMsg($msg);
80
81			// Determine whether object should be ref'd by name or oid.
82			if (isset($_REQUEST[$_REQUEST['subject'] . '_oid'])) {
83			$object = $_REQUEST[$_REQUEST['subject'] . '_oid'];
84			} else {
85			$object = $_REQUEST[$_REQUEST['subject']];
86			}
87
88			// Get the privileges on the object, given its type
89			if ('column' == $_REQUEST['subject']) {
90			$privileges = $data->getPrivileges($object, 'column', $_REQUEST['table']);
91			} else {
92			$privileges = $data->getPrivileges($object, $_REQUEST['subject']);
93			}
94
95			if (sizeof($privileges) > 0) {
96			echo "<table>\n";
97			if ($data->hasRoles()) {
98			echo "<tr><th class=\"data\">{$lang['strrole']}</th>";
99			} else {
100			echo "<tr><th class=\"data\">{$lang['strtype']}</th><th class=\"data\">{$lang['struser']}/{$lang['strgroup']}</th>";
101			}
102
103			foreach ($data->privlist[$_REQUEST['subject']] as $v2) {
104			// Skip over ALL PRIVILEGES
105			if ('ALL PRIVILEGES' == $v2) {
106			continue;
107			}
108
109			echo "<th class=\"data\">{$v2}</th>\n";
110			}
111			if ($data->hasGrantOption()) {
112			echo "<th class=\"data\">{$lang['strgrantor']}</th>";
113			}
114			echo "</tr>\n";
115
116			// Loop over privileges, outputting them
117			$i = 0;
118			foreach ($privileges as $v) {
119			$id = (0 == ($i % 2) ? '1' : '2');
120			echo "<tr class=\"data{$id}\">\n";
121			if (!$data->hasRoles()) {
122			echo '<td>', $this->misc->printVal($v[0]), "</td>\n";
123			}
124
125			echo '<td>', $this->misc->printVal($v[1]), "</td>\n";
126			foreach ($data->privlist[$_REQUEST['subject']] as $v2) {
127			// Skip over ALL PRIVILEGES
128			if ('ALL PRIVILEGES' == $v2) {
129			continue;
130			}
131
132			echo '<td>';
133			if (in_array($v2, $v[2], true)) {
134			echo $lang['stryes'];
135			} else {
136			echo $lang['strno'];
137			}
138
139			// If we have grant option for this, end mark
140			if ($data->hasGrantOption() && in_array($v2, $v[4], true)) {
141			echo $lang['strasterisk'];
142			}
143
144			echo "</td>\n";
145			}
146			if ($data->hasGrantOption()) {
147			echo '<td>', $this->misc->printVal($v[3]), "</td>\n";
148			}
149			echo "</tr>\n";
150			++$i;
151			}
152
153			echo '</table>';
154			} else {
155			echo "<p>{$lang['strnoprivileges']}</p>\n";
156			}
157
158			// Links for granting to a user or group
159			switch ($_REQUEST['subject']) {
160			case 'table':
161			case 'view':
162			case 'sequence':
163			case 'function':
164			case 'tablespace':
165			$alllabel = "showall{$_REQUEST['subject']}s";
166			$allurl = "{$_REQUEST['subject']}s.php";
167			$alltxt = $lang["strshowall{$_REQUEST['subject']}s"];
168
169			break;
170			case 'schema':
171			$alllabel = 'showallschemas';
172			$allurl = 'schemas.php';
173			$alltxt = $lang['strshowallschemas'];
174
175			break;
176			case 'database':
177			$alllabel = 'showalldatabases';
178			$allurl = 'alldb.php';
179			$alltxt = $lang['strshowalldatabases'];
180
181			break;
182			}
183
184			$subject = $_REQUEST['subject'];
185			$object = $_REQUEST[$_REQUEST['subject']];
186
187			if ('function' == $_REQUEST['subject']) {
188			$objectoid = $_REQUEST[$_REQUEST['subject'] . '_oid'];
189			$urlvars = [
190			'action' => 'alter',
191			'server' => $_REQUEST['server'],
192			'database' => $_REQUEST['database'],
193			'schema' => $_REQUEST['schema'],
194			$subject => $object,
195			"{$subject}_oid" => $objectoid,
196			'subject' => $subject,
197			];
198			} elseif ('column' == $_REQUEST['subject']) {
199			$urlvars = [
200			'action' => 'alter',
201			'server' => $_REQUEST['server'],
202			'database' => $_REQUEST['database'],
203			'schema' => $_REQUEST['schema'],
204			$subject => $object,
205			'subject' => $subject,
206			];
207
208			if (isset($_REQUEST['table'])) {
209			$urlvars['table'] = $_REQUEST['table'];
210			} else {
211			$urlvars['view'] = $_REQUEST['view'];
212			}
213			} else {
214			$urlvars = [
215			'action' => 'alter',
216			'server' => $_REQUEST['server'],
217			'database' => $_REQUEST['database'],
218			$subject => $object,
219			'subject' => $subject,
220			];
221			if (isset($_REQUEST['schema'])) {
222			$urlvars['schema'] = $_REQUEST['schema'];
223			}
224			}
225
226			$navlinks = [
227			'grant' => [
228			'attr' => [
229			'href' => [
230			'url' => 'privileges.php',
231			'urlvars' => array_merge($urlvars, ['mode' => 'grant']),
232			],
233			],
234			'content' => $lang['strgrant'],
235			],
236			'revoke' => [
237			'attr' => [
238			'href' => [
239			'url' => 'privileges.php',
240			'urlvars' => array_merge($urlvars, ['mode' => 'revoke']),
241			],
242			],
243			'content' => $lang['strrevoke'],
244			],
245			];
246
247			if (isset($allurl)) {
248			$navlinks[$alllabel] = [
249			'attr' => [
250			'href' => [
251			'url' => $allurl,
252			'urlvars' => [
253			'server' => $_REQUEST['server'],
254			'database' => $_REQUEST['database'],
255			],
256			],
257			],
258			'content' => $alltxt,
259			];
260			if (isset($_REQUEST['schema'])) {
261			$navlinks[$alllabel]['attr']['href']['urlvars']['schema'] = $_REQUEST['schema'];
262			}
263			}
264
265			$this->printNavLinks($navlinks, $this->table_place, get_defined_vars());
266			}
267
268			/**
269			* Grant permissions on an object to a user.
270			*
271			* @param $confirm To show entry screen
272			* @param $mode 'grant' or 'revoke'
273			* @param $msg (optional) A message to show
274			*/
275			public function doAlter($confirm, $mode, $msg = '')
276			{
277			$lang = $this->lang;
278			$action = $this->action;
279			$data = $this->misc->getDatabaseAccessor();
280
281			if (!isset($_REQUEST['username'])) {
282			$_REQUEST['username'] = [];
283			}
284
285			if (!isset($_REQUEST['groupname'])) {
286			$_REQUEST['groupname'] = [];
287			}
288
289			if (!isset($_REQUEST['privilege'])) {
290			$_REQUEST['privilege'] = [];
291			}
292
293			if ($confirm) {
294			// Get users from the database
295			$users = $data->getUsers();
296			// Get groups from the database
297			$groups = $data->getGroups();
298
299			$this->printTrail($_REQUEST['subject']);
300
301			switch ($mode) {
302			case 'grant':
303			$this->printTitle($lang['strgrant'], 'pg.privilege.grant');
304
305			break;
306			case 'revoke':
307			$this->printTitle($lang['strrevoke'], 'pg.privilege.revoke');
308
309			break;
310			}
311			$this->printMsg($msg);
312
313			echo '<form action="' . \SUBFOLDER . "/src/views/privileges.php\" method=\"post\">\n";
314			echo "<table>\n";
315			echo "<tr><th class=\"data left\">{$lang['strusers']}</th>\n";
316			echo '<td class="data1"><select name="username[]" multiple="multiple" size="', min(6, $users->recordCount()), "\">\n";
317			while (!$users->EOF) {
318			$uname = htmlspecialchars($users->fields['usename']);
319			echo "<option value=\"{$uname}\"",
320			in_array($users->fields['usename'], $_REQUEST['username'], true) ? ' selected="selected"' : '', ">{$uname}</option>\n";
321			$users->moveNext();
322			}
323			echo "</select></td></tr>\n";
324			echo "<tr><th class=\"data left\">{$lang['strgroups']}</th>\n";
325			echo "<td class=\"data1\">\n";
326			echo '<input type="checkbox" id="public" name="public"', (isset($_REQUEST['public']) ? ' checked="checked"' : ''), " /><label for=\"public\">PUBLIC</label>\n";
327			// Only show groups if there are groups!
328			if ($groups->recordCount() > 0) {
329			echo '<br /><select name="groupname[]" multiple="multiple" size="', min(6, $groups->recordCount()), "\">\n";
330			while (!$groups->EOF) {
331			$gname = htmlspecialchars($groups->fields['groname']);
332			echo "<option value=\"{$gname}\"",
333			in_array($groups->fields['groname'], $_REQUEST['groupname'], true) ? ' selected="selected"' : '', ">{$gname}</option>\n";
334			$groups->moveNext();
335			}
336			echo "</select>\n";
337			}
338			echo "</td></tr>\n";
339			echo "<tr><th class=\"data left required\">{$lang['strprivileges']}</th>\n";
340			echo "<td class=\"data1\">\n";
341			foreach ($data->privlist[$_REQUEST['subject']] as $v) {
342			$v = htmlspecialchars($v);
343			echo "<input type=\"checkbox\" id=\"privilege[${v}]\" name=\"privilege[${v}]\"",
344			isset($_REQUEST['privilege'][$v]) ? ' checked="checked"' : '', " /><label for=\"privilege[${v}]\">{$v}</label><br />\n";
345			}
346			echo "</td></tr>\n";
347			// Grant option
348			if ($data->hasGrantOption()) {
349			echo "<tr><th class=\"data left\">{$lang['stroptions']}</th>\n";
350			echo "<td class=\"data1\">\n";
351			if ('grant' == $mode) {
352			echo '<input type="checkbox" id="grantoption" name="grantoption"',
353			isset($_REQUEST['grantoption']) ? ' checked="checked"' : '', " /><label for=\"grantoption\">GRANT OPTION</label>\n";
354			} elseif ('revoke' == $mode) {
355			echo '<input type="checkbox" id="grantoption" name="grantoption"',
356			isset($_REQUEST['grantoption']) ? ' checked="checked"' : '', " /><label for=\"grantoption\">GRANT OPTION FOR</label><br />\n";
357			echo '<input type="checkbox" id="cascade" name="cascade"',
358			isset($_REQUEST['cascade']) ? ' checked="checked"' : '', " /><label for=\"cascade\">CASCADE</label><br />\n";
359			}
360			echo "</td></tr>\n";
361			}
362			echo "</table>\n";
363
364			echo "<p><input type=\"hidden\" name=\"action\" value=\"save\" />\n";
365			echo '<input type="hidden" name="mode" value="', htmlspecialchars($mode), "\" />\n";
366			echo '<input type="hidden" name="subject" value="', htmlspecialchars($_REQUEST['subject']), "\" />\n";
367			if (isset($_REQUEST[$_REQUEST['subject'] . '_oid'])) {
368			echo '<input type="hidden" name="', htmlspecialchars($_REQUEST['subject'] . '_oid'),
369			'" value="', htmlspecialchars($_REQUEST[$_REQUEST['subject'] . '_oid']), "\" />\n";
370			}
371
372			echo '<input type="hidden" name="', htmlspecialchars($_REQUEST['subject']),
373			'" value="', htmlspecialchars($_REQUEST[$_REQUEST['subject']]), "\" />\n";
374			if ('column' == $_REQUEST['subject']) {
375			echo '<input type="hidden" name="table" value="',
376			htmlspecialchars($_REQUEST['table']), "\" />\n";
377			}
378
379			echo $this->misc->form;
380			if ('grant' == $mode) {
381			echo "<input type=\"submit\" name=\"grant\" value=\"{$lang['strgrant']}\" />\n";
382			} elseif ('revoke' == $mode) {
383			echo "<input type=\"submit\" name=\"revoke\" value=\"{$lang['strrevoke']}\" />\n";
384			}
385
386			echo "<input type=\"submit\" name=\"cancel\" value=\"{$lang['strcancel']}\" /></p>";
387			echo "</form>\n";
388			} else {
389			// Determine whether object should be ref'd by name or oid.
390			if (isset($_REQUEST[$_REQUEST['subject'] . '_oid'])) {
391			$object = $_REQUEST[$_REQUEST['subject'] . '_oid'];
392			} else {
393			$object = $_REQUEST[$_REQUEST['subject']];
394			}
395
396			if (isset($_REQUEST['table'])) {
397			$table = $_REQUEST['table'];
398			} else {
399			$table = null;
400			}
401
402			$status = $data->setPrivileges(
403			('grant' == $mode) ? 'GRANT' : 'REVOKE',
404			$_REQUEST['subject'],
405			$object,
406			isset($_REQUEST['public']),
407			$_REQUEST['username'],
408			$_REQUEST['groupname'],
409			array_keys($_REQUEST['privilege']),
410			isset($_REQUEST['grantoption']),
411			isset($_REQUEST['cascade']),
412			$table
413			);
414
415			if (0 == $status) {
416			$this->doDefault($lang['strgranted']);
417			} elseif ($status == -3 \|\| $status == -4) {
418			$this->doAlter(true, $_REQUEST['mode'], $lang['strgrantbad']);
419			} else {
420			$this->doAlter(true, $_REQUEST['mode'], $lang['strgrantfailed']);
421			}
422			}
423			}
424			}
425

HuasoFoundries / phpPgAdmin6

Push — master ( 442876...4ec1bc )

src/controllers/PrivilegesController.php (2 issues)

Labels

Severity

Introduced By

Duplication Side-by-Side

Filter issues like