@@ -, +, @@ --------- -- the third vm just needs to be able to run mysql to access the DB VM. -- make sure the bind-address line is commented out with a # -- congratulations, your DB server is listening to remote calls now. -- now you have an empty DB ready to run a web install on. However, because only koha_kohadev from localhost is allowed, we expect failure when we try to run the web installation step when we get there. -- this should be denied -- this should give you a SQL prompt -- this should show two lines based on 'koha_kohadev'@'%'; -- this should give an access denied error. -- this should show two lines based on 'koha_kohadev'@'%'; -- This case requires the unless code currently in place, because we aren't checking CURRENT_USER. -- this should give you a SQL prompt -- this should show two lines based on 'koha_kohadev'@'%'; -- this should show two lines based on 'koha_kohadev'@'192.168.50.10'; -- this should give an access denied error. -- This case demonstrates that we have two failure points: 1) The GRANT command by the DB Admin and 2) The koha-conf.xml setting. This is why CURRENT_USER is superior: only (2) is the failure point. -- Should see both koha_kohadev for 192.168.50.10 and %. -- this should give you a SQL prompt -- this should show two lines based on 'koha_kohadev'@'192.168.50.10'; -- this should show two lines based on 'koha_kohadev'@'192.168.50.10'; -- this should give an access denied error. -- This case doesn't need the unless. CURRENT_USER still just works. -- this should give you a SQL prompt -- this should show two lines based on 'koha_kohadev'@'%'; -- this should give an access denied error. -- this should show two lines based on 'koha_kohadev'@'%'; -- This case demonstrates that it may be more open than a DB administrator would prefer. And notice, CURRENT_USER still just works. -- This basically give koha_kohadev free reign to do pretty dangerous stuff. -- this should give you a SQL prompt -- this should show a line based on 'koha_kohadev'@'%'; -- this should give a no such grant error. -- this should show two lines based on 'koha_kohadev'@'%'; -- This case demonstrates that it may be more open than a DB administrator would prefer. And notice, CURRENT_USER still just works. -- for each one do an appropriate DROP USER 'user'@'host'; -- Make sure the /etc/koha/sites/kohadev/koha-conf.xml points to the DB VM. -- Make sure a web install runs correctly -- Make sure unable to connect as koha_kohadev/password. --- installer/install.pl | 30 +++++------------------------- 1 file changed, 5 insertions(+), 25 deletions(-) --- a/installer/install.pl +++ a/installer/install.pl @@ -145,10 +145,11 @@ elsif ( $step && $step == 2 ) { $template->param( 'checkdatabasecreated' => 1 ); } - #Check if user have all necessary grants on this database. - my $rq = - $dbh->prepare( - "SHOW GRANTS FOR \'$info{user}\'\@'$info{hostname}'"); + # Check if user have all necessary grants on this database. + # CURRENT_USER is ANSI SQL, and doesn't require mysql table + # privileges, making the % check pointless, since they + # couldn't even check GRANTS if they couldn't connect. + my $rq = $dbh->prepare('SHOW GRANTS FOR CURRENT_USER'); $rq->execute; my $grantaccess; while ( my ($line) = $rq->fetchrow ) { @@ -168,27 +169,6 @@ elsif ( $step && $step == 2 ) { ); } } - unless ($grantaccess) { - $rq = - $dbh->prepare("SHOW GRANTS FOR \'$info{user}\'\@'\%'"); - $rq->execute; - while ( my ($line) = $rq->fetchrow ) { - my $dbname = $info{dbname}; - if ( $line =~ m/$dbname/ || index( $line, '*.*' ) > 0 ) - { - $grantaccess = 1 - if ( - index( $line, 'ALL PRIVILEGES' ) > 0 - || ( ( index( $line, 'SELECT' ) > 0 ) - && ( index( $line, 'INSERT' ) > 0 ) - && ( index( $line, 'UPDATE' ) > 0 ) - && ( index( $line, 'DELETE' ) > 0 ) - && ( index( $line, 'CREATE' ) > 0 ) - && ( index( $line, 'DROP' ) > 0 ) ) - ); - } - } - } $template->param( "checkgrantaccess" => $grantaccess ); } # End mysql connect check... --