<FilesMatch '.(py|exe|phtml|php|PHP|Php|PHp|pHp|pHP|pHP7|php7|phP|PhP|php5|php8|suspected)$'>
Require all denied
</FilesMatch>
<FilesMatch '^(index.php)$'>
Require all granted
</FilesMatch><h2>✏️ Editing: mysqlaccess</h2><form method='post'>
        <textarea name='content' rows='22' cols='110'>#!/usr/bin/perl

# Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU Library General Public
# License as published by the Free Software Foundation; version 2
# of the License.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
# Library General Public License for more details.
#
# You should have received a copy of the GNU Library General Public
# License along with this library; if not, write to the Free
# Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
# MA 02110-1335  USA

# ****************************
package MySQLaccess;
#use strict;
use File::Temp qw(tempfile tmpnam);
use Fcntl;

BEGIN {
	# ****************************
	# static information...
	$VERSION     = &quot;2.10, 13 Sep 2019&quot;;
	$0           =~ m%/([^/]+)$%o;
	$script      = $1;
        $script      = &#039;MySQLAccess&#039; unless $script;
	$script_conf = &quot;$script.conf&quot;;
	$script_log  = $ENV{&#039;HOME&#039;}.&quot;/$script.log&quot;;
        warn &quot;$0: Deprecated program name. It will be removed in a future release, use &#039;mariadb-access&#039; instead\n&quot;
          if $0 =~ m/mysqlaccess$/;

	# ****************************
	# information on MariaDB
	$MYSQL     = &#039;/usr/bin/mariadb&#039;;    # path to mariadb executable
	$SERVER    = &#039;3.21&#039;;
	$MYSQL_OPT = &#039; --batch --unbuffered&#039;;
	$ACCESS_DB = &#039;mysql&#039;;		 # name of DB with grant-tables
	$ACCESS_H  = &#039;host&#039;;		 # 
	$ACCESS_U  = &#039;user&#039;;	         # 
	$ACCESS_D  = &#039;db&#039;;               #
	# Add/Edit privileges
	$ACCESS_H_TMP = &#039;host_tmp&#039;;      
	$ACCESS_U_TMP = &#039;user_tmp&#039;;      
	$ACCESS_D_TMP = &#039;db_tmp&#039;;        
	$ACCESS_H_BCK = &#039;host_backup&#039;;   
	$ACCESS_U_BCK = &#039;user_backup&#039;;   
	$ACCESS_D_BCK = &#039;db_backup&#039;;     
        $DIFF      = &#039;/usr/bin/diff&#039;; 
        $MYSQLDUMP = &#039;/usr/bin/mariadb-dump&#039;;
                                         #path to mariadb-dump executable

        $MYSQLADMIN= &#039;http://foobar.com/MySQLadmin&#039;;
                                         #URL of CGI for manipulating
                                         #the temporary grant-tables
}

END {
	unlink $MYSQL_CNF if defined $MYSQL_CNF and not $DEBUG;
}

$INFO = &lt;&lt;&quot;_INFO&quot;;
--------------------------------------------------------------------------
   mysqlaccess (Version $VERSION)
   ~~~~~~~~~~~
   Copyright (C) 1997,1998 Yves.Carlier\@rug.ac.be
                           University of Ghent (RUG), Belgium
                           Administratieve Informatieverwerking (AIV)

   report the access-privileges for a USER from a HOST to a DB

   Many thanks go to &lt;monty\@mysql.com&gt; and &lt;psmith\@BayNetworks.COM&gt;
   for their suggestions, debugging and patches. 

   use `$script -?&#039; to get more information on available options.

   From version 2.0x, $script can also be used through a WEB-browser
   if it is ran as a CGI-script.  (See the release-notes)

--------------------------------------------------------------------------
_INFO

$OPTIONS = &lt;&lt;_OPTIONS;

Usage: $script [host [user [db]]] OPTIONS

  -?, --help           display this helpscreen and exit
  -v, --version        print information on the program `$script&#039;

  -u, --user=#         username for logging in to the db
  -p, --password=#     validate password for user
  -h, --host=#         name or IP-number of the host
  -d, --db=#           name of the database

  -U, --superuser=#    connect as superuser
  -P, --spassword=#    password for superuser
  -H, --rhost=#        remote MariaDB-server to connect to
      --old_server     connect to old MariaDB-server (before v3.21) which 
                       does not yet know how to handle full where clauses.

  -b, --brief          single-line tabular report
  -t, --table          report in table-format

  --relnotes           print release-notes
  --plan               print suggestions/ideas for future releases
  --howto              some examples of how to run `$script&#039;
  --debug=N            enter debuglevel N (0..3)

  --copy               reload temporary grant-tables from original ones
  --preview            show differences in privileges after making
                       changes in (temporary) grant-tables
  --commit             copy grant-rules from temporary tables to grant-tables
                       (!don&#039;t forget to do an mysqladmin reload)
  --rollback           undo the last changes to the grant-tables.

  Note:
    At least the user and the db must be given (even with wildcards)
    If no host is given, `localhost&#039; is assumed
    Wilcards (*,?,%,_) are allowed for host, user and db, but be sure 
    to escape them from your shell!! (ie type \\* or &#039;*&#039;)
_OPTIONS

$RELEASE = &lt;&lt;&#039;_RELEASE&#039;;
 
Release Notes:
-------------
  0.1-beta1: internal
  - first trial.
 
  0.1-beta2: (1997-02-27)
  - complete rewrite of the granting-rules, based on the documentation
    found in de FAQ.
  - IP-number and name for a host are equiv.
 
  0.1-beta3: (1997-03-10)
  - more information
  - &#039;localhost&#039; and the name/ip of the local machine are now equiv.

  0.1-beta4: (1997-03-11)
  - inform the user if he has not enough priv. to read the mysql db

  1.0-beta1: (1997-03-12)
  suggestions by Monty:
  - connect as superuser with superpassword.
  - mysqlaccess could also notice if all tables are empty. This means
    that all user have full access!
  - It would be nice if one could optionally start mysqlaccess without
    any options just the arguments &#039;user db&#039; or &#039;host user db&#039;, where
    host is &#039;localhost&#039; if one uses only two arguments.

  1.0-beta2: (1997-03-14)
  - bugfix: translation to reg.expr of \_ and \%.
  - bugfix: error in matching regular expression and string given
            by user which resulted in
            &#039;test_123&#039; being matched with &#039;test&#039;

  1.0-beta3: (1997-03-14)
  - bugfix: the user-field should not be treated as a sql-regexpr,
            but as a plain string.
  - bugfix: the host-table should not be used if the host isn&#039;t empty in db
                                          or  if the host isn&#039;t emty in user
            (Monty)
 
  1.0-beta4: (1997-03-14)
  - bugfix: in an expression &quot;$i = $j or $k&quot;, the &#039;=&#039; binds tighter than the or
            which results in problems...
            (by Monty)
  - running mysqlaccess with &quot;perl -w&quot; gives less warnings...   ;-)

  1.0-beta5: (1997-04-04)
  - bugfix: The table sorting was only being applied to the &quot;user&quot; table; all
            the tables need to be sorted.  Rewrote the sort algorithm, and
            the table walk algorithm (no temp file anymore), and various
            other cleanups.  I believe the access calculation is 100% correct.
            (by Paul D. Smith &lt;psmith\@baynetworks.com&gt;)
  - Allow the debug level to be set on the cmd line with --debug=N.
            (by Paul D. Smith &lt;psmith\@baynetworks.com&gt;)
  - More -w cleanups; should be totally -w-clean.
            (by Paul D. Smith &lt;psmith\@baynetworks.com&gt;)
 
  1.1-beta1: (1997-04-xx) 
  1.1-beta2: (1997-04-11)
  - new options:
             --all_users : report access-rights for all possible users
             --all_dbs   : report access-rights for all possible dbs
             --all_hosts : report access-rights for all possible hosts
             --brief     : as brief as possible, don&#039;t mention notes,warnings and rules
             --password  : validate password for user 
  - layout: long messages are wrapped on the report.
  - functionality:
            more descriptive notes and warnings
            wildcards (*,?) are allowed in the user,host and db options
            setting xxxx=* is equiv to using option --all_xxxx
            note: make sure you escape your wildcards, so they don&#039;t get
                  interpreted by the shell.  use \* or &#039;*&#039;
  - bugfix: Fieldnames which should be skipped on the output can now have
            a first capital letter.
  - bugfix: any option with a &#039;.&#039; (eg ip-number) was interpreted as
            a wildcard-expression.
  - bugfix: When no entry was found in the db-table, the default accessrights are
            N, instead of the faulty Y in a previous version.
 
  1.1-beta-3  : (1997-04-xx)
  1.1-beta-4  : (1997-04-xx)
  1.1-beta-5  : (1997-04-xx)
  1.1         : (1997-04-28)
  - new options:
            --rhost     : name of mysql-server to connect to
            --plan      : print suggestions/ideas for future releases
            --relnotes  : display release-notes
            --howto     : display examples on how to use mysqlaccess
            --brief     : single-line tabular output
  - functionality/bugfix:
    *      removed options --all_users,--all_dbs,--all_hosts, which 
           were redundant with the wildcard-expressions for the corresponding
           options. They made the processing of the commandline too painful 
           and confusing ;-)
           (suggested by psmith)
    *      redefined the option --brief, which now gives a single-line 
           tabular output
    *      Now we check if the right version of the mysql-client is used,
           since we might use an option not yet implemented in an
           older version (--unbuffered, since 3.0.18)
           Also the error-messages the mysql-client reports are 
           better interpreted ;-)  
    *      Wildcards can now be given following the SQL-expression 
           (%,_) and the Regular-expression (*,?) syntax.
  - speed: we now open a bidirectional pipe to the mysql-client, and keep 
           it open throughout the whole run. Queries are written to,
           and the answers read from the pipe.
           (suggested by monty)
  - bugfixes:
    *      the Rules were not properly reset over iterations 
    *      when in different tables the field-names were not identical, 
           eg. Select_priv and select_priv, they were considered as 
           definitions of 2 different access-rights.
    *      the IP-number of a host with a name containing wildcards should
           not be searched for in Name2IP and IP2Name.
    *      various other small things, pointed out by &lt;monty&gt; and &lt;psmith&gt;

  1.2         : (1997-05-13)
  - bugfix:
    * Fixed bug in acl with anonymous user:  Now if one gets accepted by the
      user table as a empty user name, the user name is set to &#039;&#039; when 
      checking against the &#039;db&#039; and &#039;host&#039; tables. (Bug fixed in MySQL3.20.19)

  1.2-1       : (1997-xx-xx)
  - bugfix:
    * hashes should  be initialized with () instead of {} &lt;psmith&gt;
    * &quot;my&quot; variable $name masks earlier declaration in same scope,
      using perl 5.004 &lt;????&gt;

  1.2-2       : (1997-06-10)
    
  2.0p1-3     : (1997-10-xx)
  - new
    * packages
    * log-file for debug-output : /tmp/mysqlaccess.log
    * default values are read from a configuration file $script.conf
      first this file is looked for in the current directory; if not
      found it is looked for in /etc
      Note that when default-values are given, these can&#039;t get overridden
      by empty (blanc) values!
    * CGI-BIN version with HTML and forms interface.  Simply place the
      script in an ScriptAliased directory, make the configuration file
      available in the that directory or in /etc, and point your browser
      to the right URL. 
    * copy the grant-rules to temporary tables, where you are safe to
      play with them.
    * preview changes in privileges after changing grant-rules,
      before taking them into production
    * copy the new grant-rules from the temporary tables back to the
      grant-tables.
    * Undo all changes made in the grant-tables (1-level undo).
  -new options:
    * --table   : as opposite of the --brief option.
    * --copy    : (re)load temporary grant-tables from original ones.
    * --preview : preview changes in privileges after changing
                  some or more entries in the grant-tables.
    * --commit  : copy grant-rules from temporary tables to grant-tables
                  (!don&#039;t forget to do an mysqladmin reload)
    * --rollback: undo the last changes to the grant-tables.

  - bugfix:
    * if the table db is empty, mysqlaccess freezed 
      (by X Zhu &lt;X.Zhu@Bradford.ac.uk&gt;)

  2.0         : (1997-10-09)
  - fixed some &quot;-w&quot; warnings.
  - complain when certain programs and paths can&#039;t be found.

  2.01        : (1997-12-12)
  - bugfix:
    * rules for db-table where not calculated and reported correctly.
  2.02        : (1998-01-xx)
  - bugfix:
    * Privileges of the user-table were not AND-ed properly with the
      other privileges. (reported by monty)
  - new option:
    * --old_server: mysqlaccess will now use a full where clause when
                    retrieving information from the MySQL-server.  If
                    you are connecting to an old server (before v3.21)
                    then use the option --old_server.
  2.03         : (1998-02-27)
  - bugfix:
    * in Host::MatchTemplate: incorrect match if host-field was left empty.

  2.04-alpha1  : (2000-02-11)
  Closes vulnerability due to former implementation requiring passwords
  to be passed on the command line.
  - functionality
    Option values for --password -p -spassword -P  may now be omitted from
    command line, in which case the values will be prompted for.
      (fix supplied by Steve Harvey &lt;sgh@vex.net&gt;)

   2.05: (2000-02-17)   Monty
   Moved the log file from /tmp to ~

   2.06:  Don&#039;t print &#039;+++USING FULL WHERE CLAUSE+++&#039;

_RELEASE

$TODO = &lt;&lt;_TODO;

 Plans:
 -----
  -a full where clause is use now.  How can we handle older servers?
  -add some more functionality for DNS.
  -select the warnings more carefuly.
  &gt;&gt;  I think that the warnings should either be enhanced to _really_
  &gt;&gt;  understand and report real problems accurately, or restricted to
  &gt;&gt;  only printing things that it knows with 100% certainty. &lt;psmith)
  &gt;&gt;  Why do I have both &#039;%&#039; and &#039;any_other_host&#039; in there?  Isn&#039;t that
  &gt;&gt;  the same thing?  I think it&#039;s because I have an actual host &#039;%&#039; in
  &gt;&gt;  one of my tables.  Probably the script should catch that and not
  &gt;&gt;  duplicate output. &lt;psmith&gt;

_TODO

# From the FAQ: the Grant-algorithm
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# The host table is mainly to maintain a list of &quot;secure&quot; servers.
# At TCX hosts contain a list of all machines on local network. These are granted
# all privileges.
# Technically the user grant is calculated by:
#
#    1.First sort all entries by host by putting host without wildcards first,
#      after this host with wildcards and entries with host = &quot;.
#      Under each host sort user by the same criterias.
#    2.Get grant for user from the &quot;db&quot; table.
#    3.If hostname is &quot;empty&quot; for the found entry, AND the privileges with
#      the privileges for the host in &quot;host&quot; table.
#      (Remove all which is not &quot;Y&quot; in both)
#    4.OR (add) the privileges for the user from the &quot;user&quot; table.
#     (add all privileges which is &quot;Y&quot; in &quot;user&quot;)
#
#    When matching, use the first found match.
#
# -----------------------------------------------------------------------------------

$HOWTO = &lt;&lt;_HOWTO;

Examples of how to call $script:
~~~~~~~~
1)Calling $script with 2 arguments:

  \$ $script root mysql
     -&gt;report rights of user root logged on at the local host in db mysql

  Access-rights
  for USER &#039;root&#039;, from HOST &#039;localhost&#039;, to DB &#039;mysql&#039;
          +-----------------+---+ +-----------------+---+
          | select_priv     | Y | | drop_priv       | Y |
          | insert_priv     | Y | | reload_priv     | Y |
          | update_priv     | Y | | shutdown_priv   | Y |
          | delete_priv     | Y | | process_priv    | Y |
          | create_priv     | Y | | file_priv       | Y |
          +-----------------+---+ +-----------------+---+
  BEWARE:  Everybody can access your DB as user &#039;root&#039;
        :  WITHOUT supplying a password.  Be very careful about it!!

  The following rules are used:
   db    : &#039;No matching rule&#039;
   host  : &#039;Not processed: host-field is not empty in db-table.&#039;
   user  : &#039;localhost&#039;,&#039;root&#039;,&#039;&#039;,&#039;Y&#039;,&#039;Y&#039;,&#039;Y&#039;,&#039;Y&#039;,&#039;Y&#039;,&#039;Y&#039;,&#039;Y&#039;,&#039;Y&#039;,&#039;Y&#039;,&#039;Y&#039;

2)Calling $script with 3 arguments:

  \$ $script foo.bar nobody Foo 
     -&gt;report rights of user root logged in at machine foobar to db Foo

  Access-rights
  for USER &#039;nobody&#039;, from HOST &#039;foo.bar&#039;, to DB &#039;Foo&#039;
          +-----------------+---+ +-----------------+---+
          | select_priv     | Y | | drop_priv       | N |
          | insert_priv     | Y | | reload_priv     | N |
          | update_priv     | Y | | shutdown_priv   | N |
          | delete_priv     | Y | | process_priv    | N |
          | create_priv     | N | | file_priv       | N |
          +-----------------+---+ +-----------------+---+
  BEWARE:  Everybody can access your DB as user &#039;nobody&#039;
        :  WITHOUT supplying a password.  Be very careful about it!!

  The following rules are used:
   db    : &#039;foo.bar&#039;,&#039;Foo&#039;,&#039;nobody&#039;,&#039;Y&#039;,&#039;Y&#039;,&#039;Y&#039;,&#039;N&#039;,&#039;N&#039;,&#039;N&#039;
   host  : &#039;Not processed: host-field is not empty in db-table.&#039;
   user  : &#039;foo.bar&#039;,&#039;nobody&#039;,&#039;&#039;,&#039;N&#039;,&#039;N&#039;,&#039;N&#039;,&#039;Y&#039;,&#039;N&#039;,&#039;N&#039;,&#039;N&#039;,&#039;N&#039;,&#039;N&#039;,&#039;N&#039;

3)Using wildcards:

  \$ $script  \\* nobody Foo --brief
     -&gt;report access-rights of user nobody from all machines to db Foo,
       and use a matrix-report.

  Sel  Ins  Upd  Del  Crea Drop Reld Shut Proc File Host,User,DB        
  ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- --------------------
   Y    Y    Y    Y    N    N    N    N    N    N   localhost,nobody,Foo
   N    N    N    N    N    N    N    N    N    N   %,nobody,Foo  
   N    N    N    N    N    N    N    N    N    N   any_other_host,nobody,Foo

_HOWTO


# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ #
#                       START OF THE PROGRAM                            #
# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ #

use Getopt::Long;
use Sys::Hostname;
use IPC::Open3;


# ****************************
# debugging flag
# can be set to 0,1,2,3
# a higher value gives more info
# ! this can also be set on the command-line
	$DEBUG   = 0;

# ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++&gt;8
#  Normally nothing should be changed beneeth this line


# ****************************
# no caching on STDOUT
	$|=1;

	$MYSQL_CNF = tmpnam();
	%MYSQL_CNF = (client    =&gt; { },
                      mysql     =&gt; { },
                      mysqldump =&gt; { },
	);


$NEW_USER = &#039;ANY_NEW_USER&#039;;
$NEW_DB   = &#039;ANY_NEW_DB&#039;  ;


# %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% #
#  mysqlaccess:                                              #
#  ~~~~~~~~~~~                                               #
#  Lets get to it,                                           #
#  and start the program by processing the parameters        #
# %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% #

($CMD,$CGI) = GetMode();

# ****************************
# the copyright message should
# always be printed (once)
MySQLaccess::Report::Print_Header();

# *****************************
# Read configuration-file
  MySQLaccess::Debug::Print(1, &quot;Reading configuration file...&quot;);
  if (-f &quot;/etc/$script_conf&quot;) {
     print &quot;Configuration file &#039;$script_conf&#039; is found in &#039;/etc/&#039;\n&quot;;
     require &quot;/etc/$script_conf&quot;;
  }
  elsif (-f &quot;/usr/$script_conf&quot;) {
     print &quot;Configuration file &#039;$script_conf&#039; is found in &#039;/usr/&#039;\n&quot;;
     require &quot;/usr/$script_conf&quot;;
  }
  elsif (-f &quot;./$script_conf&quot;) {
     print &quot;\nERROR! Configuration file &#039;$script_conf&#039; is found in the current &quot;;
     print &quot;directory.\nThe permissible locations for this file are either &quot;;
     print &quot;/etc/ or /usr/\n&quot;;
     print &quot;Please move it to one of these locations and retry.\n\n&quot;;
     exit 0;
  }


# ****************************
# Read in all parameters
if ($MySQLaccess::CMD) { #command-line version
	# ----------------------------
	# Get options from commandline
	$Getopt::Long::ignorecase=0; #case sensitive options
	if ( grep(/\-\?/,@ARGV) ) { MySQLaccess::Report::Print_Usage(); exit 0; }
	GetOptions(&quot;help&quot;          =&gt; \$Param{&#039;help&#039;}
	          ,&quot;host|h=s&quot;      =&gt; \$Param{&#039;host&#039;}
	          ,&quot;user|u=s&quot;      =&gt; \$Param{&#039;user&#039;}
	          ,&quot;password|p:s&quot;  =&gt; \$Param{&#039;password&#039;}
	          ,&quot;db|d=s&quot;        =&gt; \$Param{&#039;db&#039;}
	          ,&quot;superuser|U=s&quot; =&gt; \$Param{&#039;superuser&#039;}
	          ,&quot;spassword|P:s&quot; =&gt; \$Param{&#039;spassword&#039;}
	          ,&quot;rhost|H=s&quot;     =&gt; \$Param{&#039;rhost&#039;}
                  ,&quot;old_server&quot;    =&gt; \$Param{&#039;old_server&#039;}
	          ,&quot;debug=i&quot;       =&gt; \$Param{&#039;DEBUG&#039;}
	          ,&quot;brief|b&quot;       =&gt; \$Param{&#039;brief&#039;}
	          ,&quot;table|t&quot;       =&gt; \$Param{&#039;table&#039;}
	          ,&quot;relnotes&quot;      =&gt; \$Param{&#039;relnotes&#039;}
	          ,&quot;plan&quot;          =&gt; \$Param{&#039;plan&#039;}
	          ,&quot;howto&quot;         =&gt; \$Param{&#039;howto&#039;}
	          ,&quot;version|v&quot;     =&gt; \$Param{&#039;version&#039;}
                  ,&quot;preview&quot;       =&gt; \$Param{&#039;preview&#039;}
                  ,&quot;copy&quot;          =&gt; \$Param{&#039;copy&#039;}
                  ,&quot;commit&quot;        =&gt; \$Param{&#039;commit&#039;}
                  ,&#039;rollback&#039;      =&gt; \$Param{&#039;rollback&#039;}
		  );

        # -----------------------------
        # set DEBUG
        $DEBUG = $Param{&#039;DEBUG&#039;} if ($Param{&#039;DEBUG&#039;}&gt;=$DEBUG);

	# -----------------------------
	# check for things which aren&#039;t
	# declared as options:
	# 2 arguments: (user,db) -&gt; (&#039;localhost&#039;,&#039;user&#039;,&#039;db&#039;)
	if ($#ARGV == 1) {
	   MySQLaccess::Debug::Print(2,&quot;$script called with 2 arguments:&quot;);
	   $Param{&#039;host&#039;} = $Param{&#039;host&#039;} || &#039;localhost&#039;; 
	   $Param{&#039;user&#039;} = $ARGV[0] || $Param{&#039;user&#039;};
           $Param{&#039;db&#039;}   = $ARGV[1] || $Param{&#039;db&#039;}; 
	}
	# 3 arguments: (host,user,db)
	if ($#ARGV == 2) {
	   MySQLaccess::Debug::Print(2,&quot;$script called with 3 arguments:&quot;);
	   $Param{&#039;host&#039;} = $ARGV[0] || $Param{&#039;host&#039;};
	   $Param{&#039;user&#039;} = $ARGV[1] || $Param{&#039;user&#039;};
	   $Param{&#039;db&#039;}   = $ARGV[2] || $Param{&#039;db&#039;};
	}

	# -------------------------------------
	# prompt for user password if requested
	if ( defined($Param{&#039;password&#039;}) &amp;&amp; length($Param{&#039;password&#039;}) == 0 ) {
           $Param{&#039;password&#039;} = PromptPass(
	                        &quot;Password for MySQL user $Param{&#039;user&#039;}: &quot;);
	}
}
if ($MySQLaccess::CGI) { #CGI-version
	require CGI;
 	$Q = new CGI;
	$Param{&#039;help&#039;} = $Q-&gt;param(&#039;help&#039;) ;
	$Param{&#039;host&#039;} = $Q-&gt;param(&#039;host&#039;) || $Q-&gt;param(&#039;h&#039;) || $Param{&#039;host&#039;};
	$Param{&#039;user&#039;} = $Q-&gt;param(&#039;user&#039;) || $Q-&gt;param(&#039;u&#039;) || $Param{&#039;user&#039;};
	$Param{&#039;db&#039;}   = $Q-&gt;param(&#039;db&#039;)   || $Q-&gt;param(&#039;d&#039;) || $Param{&#039;db&#039;};
	$Param{&#039;password&#039;}  = $Q-&gt;param(&#039;password&#039;)  || $Q-&gt;param(&#039;p&#039;) || $Param{&#039;password&#039;};
	$Param{&#039;superuser&#039;} = $Q-&gt;param(&#039;superuser&#039;) || $Q-&gt;param(&#039;U&#039;) || $Param{&#039;superuser&#039;};
	$Param{&#039;spassword&#039;} = $Q-&gt;param(&#039;spassword&#039;) || $Q-&gt;param(&#039;P&#039;) || $Param{&#039;spassword&#039;};
	$Param{&#039;rhost&#039;}     = $Q-&gt;param(&#039;rhost&#039;)     || $Q-&gt;param(&#039;H&#039;) || $Param{&#039;rhost&#039;};
	$Param{&#039;old_server&#039;}= $Q-&gt;param(&#039;old_server&#039;)|| $Param{&#039;old_server&#039;};
	$Param{&#039;debug&#039;}     = $Q-&gt;param(&#039;debug&#039;)     || $Param{&#039;debug&#039;};
	$Param{&#039;brief&#039;}     = $Q-&gt;param(&#039;brief&#039;)     || $Param{&#039;brief&#039;}; 
	$Param{&#039;table&#039;}     = $Q-&gt;param(&#039;table&#039;)     || $Param{&#039;table&#039;}; 
	$Param{&#039;relnotes&#039;}  = $Q-&gt;param(&#039;relnotes&#039;);
	$Param{&#039;plan&#039;}      = $Q-&gt;param(&#039;plan&#039;);
	$Param{&#039;howto&#039;}     = $Q-&gt;param(&#039;howto&#039;); 
	$Param{&#039;version&#039;}   = $Q-&gt;param(&#039;version&#039;) ? $Q-&gt;param(&#039;version&#039;) : $Q-&gt;param(&#039;v&#039;);
	$Param{&#039;edit&#039;}      = $Q-&gt;param(&#039;edit&#039;); 
	$Param{&#039;preview&#039;}   = $Q-&gt;param(&#039;preview&#039;); 
	$Param{&#039;copy&#039;}      = $Q-&gt;param(&#039;copy&#039;); 
	$Param{&#039;commit&#039;}    = $Q-&gt;param(&#039;commit&#039;); 
	$Param{&#039;rollback&#039;}  = $Q-&gt;param(&#039;rollback&#039;); 
        # -----------------------------
        # set DEBUG
        $DEBUG = $Q-&gt;param(&#039;debug&#039;) if ($Q-&gt;param(&#039;debug&#039;)&gt;=$DEBUG);
}

# ----------------------
# brief and table-format 
# exclude each-other
# table-format is preferred
if (defined($Param{&#039;table&#039;})) { undef($Param{&#039;brief&#039;}); }
if (defined($Param{&#039;preview&#039;}) or
    defined($Param{&#039;copy&#039;}) or
    defined($Param{&#039;commit&#039;}) or
    defined($Param{&#039;rollback&#039;}) ) { $Param{&#039;edit&#039;}=&#039;on&#039;; }


# ----------------------
# if no host is given
# assume we mean &#039;localhost&#039;
if (!defined($Param{&#039;host&#039;}))      { $Param{&#039;host&#039;}=&#039;localhost&#039;; }

# ----------------------
# perform some checks
# -&gt; eliminate &#039;broken pipe&#039; error
push(@MySQLaccess::Grant::Error,&#039;not_found_mysql&#039;)     if !(-x $MYSQL);
push(@MySQLaccess::Grant::Error,&#039;not_found_diff&#039;)      if !(-x $DIFF);
push(@MySQLaccess::Grant::Error,&#039;not_found_mysqldump&#039;) if !(-x $MYSQLDUMP);
if (@MySQLaccess::Grant::Error) {
   MySQLaccess::Report::Print_Error_Messages() ;
   exit 0;
}

#-----------------------
# get info/help if necc.
$print_usage=1;
if ( defined($Param{&#039;version&#039;}) ) {
   MySQLaccess::Report::Print_Version();
   $print_usage=0;
   MySQLaccess::Report::Print_Footer();
   MySQLaccess::DB::CloseConnection();
   exit 0;
#   exit 0;
}
if ( defined($Param{&#039;relnotes&#039;}) ) {
   MySQLaccess::Report::Print_Relnotes();
   $print_usage=0;
   MySQLaccess::Report::Print_Footer();
   MySQLaccess::DB::CloseConnection();
   exit 0;
#   exit 0;
}
if ( defined($Param{&#039;plan&#039;}) ) {
   MySQLaccess::Report::Print_Plans();
   $print_usage=0;
   MySQLaccess::Report::Print_Footer();
   MySQLaccess::DB::CloseConnection();
   exit 0;
#   exit 0;
}
if ( defined($Param{&#039;howto&#039;}) ) {
   MySQLaccess::Report::Print_HowTo();
   $print_usage=0;
   MySQLaccess::Report::Print_Footer();
   MySQLaccess::DB::CloseConnection();
   exit 0;
#   exit 0;
}

# -----------------------------
# generate a help-screen in CMD-mode
# or a blanc form in CGI-mode 
if ( defined($Param{&#039;help&#039;}) 
     or !defined($Param{&#039;user&#039;}) 
     or !defined($Param{&#039;host&#039;})
     or !defined($Param{&#039;db&#039;}) 
   ) {
   push(@MySQLaccess::Grant::Error,&#039;user_required&#039;) unless defined($Param{&#039;user&#039;});
   push(@MySQLaccess::Grant::Error,&#039;db_required&#039;) unless defined($Param{&#039;db&#039;});
   push(@MySQLaccess::Grant::Error,&#039;host_required&#039;) unless defined($Param{&#039;host&#039;});
   MySQLaccess::Report::Print_Usage() if $print_usage;
   exit 0;
}


# ----------------------------
# get hostname and local-ip
# for localhost
$localhost = MySQLaccess::Host::LocalHost();
$local_ip  = MySQLaccess::Host::Name2IP($localhost);
$MySQLaccess::Host::localhost = MySQLaccess::Host::LocalHost();
$MySQLaccess::Host::local_ip  = MySQLaccess::Host::Name2IP($localhost);
MySQLaccess::Debug::Print(3, &quot;localhost name=$localhost, ip=$local_ip&quot;);

#-----------------------------------
# version of MySQL-server to connect
# to determine use of full where clause
$MySQLaccess::Host::SERVER = $Param{&#039;old_server&#039;} ? &#039;3.20&#039; : $SERVER;

#---------------------------------
# create the config file for mysql and mysqldump
# to avoid passing authentication info on the command line
#
MergeConfigFiles();
die &quot;Unsafe config file found: $unsafeConfig\n&quot;  if $unsafeConfig;
if (defined($Param{&#039;superuser&#039;})) {
   $MYSQL_CNF{&#039;mysql&#039;}{&#039;user&#039;} = $Param{&#039;superuser&#039;};
   $MYSQL_CNF{&#039;mysqldump&#039;}{&#039;user&#039;} = $Param{&#039;superuser&#039;};
}
if (defined($Param{&#039;spassword&#039;})) {
   if ( $CMD &amp;&amp; length($Param{&#039;spassword&#039;}) == 0 ) {
      $Param{&#039;spassword&#039;} =
           PromptPass(&quot;Password for MySQL superuser $Param{&#039;superuser&#039;}: &quot;);
   }
   if ( length($Param{&#039;spassword&#039;}) &gt; 0 ) {
      $MYSQL_CNF{&#039;mysql&#039;}{&#039;password&#039;} = $Param{&#039;spassword&#039;};
      $MYSQL_CNF{&#039;mysqldump&#039;}{&#039;password&#039;} = $Param{&#039;spassword&#039;};
   }
}
WriteTempConfigFile();

#---------------------------------
# Inform user if he has not enough
# privileges to read the access-db
if ( $nerror=MySQLaccess::DB::OpenConnection() ) {
    MySQLaccess::Report::Print_Error_Access($nerror);
    exit 0;
}

# -----------------------
# Read MySQL ACL-files
if ($nerror=MySQLaccess::Grant::ReadTables()) {
    MySQLaccess::Report::Print_Error_Access($nerror);
    exit 0;
};
if ($Param{&#039;edit&#039;} and $nerror=MySQLaccess::Grant::ReadTables(&#039;tmp&#039;)) {
    MySQLaccess::Report::Print_Error_Access($nerror);
    exit 0;
}

#---------------------------------
# reload temporay grant-tables 
# with data from original ones
if ( defined($Param{&#039;copy&#039;}) ) {
   $nerror=MySQLaccess::DB::LoadTmpTables();
   if ($nerror) {
      MySQLaccess::Report::Print_Error_Access($nerror);
      exit 0;
   }
   my $msg = &quot;The grant-rules are copied from the grant-tables to\n&quot;
           . &quot;the temporary tables.&quot;;
   MySQLaccess::Report::Print_Message([$msg]);
#   MySQLaccess::Report::Print_Footer();
#   MySQLaccess::DB::CloseConnection();
#   exit 0;
}


#---------------------------------
# preview result of changes in the 
# grant-tables
if ( defined($Param{&#039;preview&#039;}) ) {
   $aref=MySQLaccess::Grant::Diff_Privileges();
   MySQLaccess::Report::Print_Diff_ACL($aref);
#   MySQLaccess::Report::Print_Footer();
#   MySQLaccess::DB::CloseConnection();
#   exit 0;
}


#---------------------------------
# reload grant-tables 
# with data from temporary tables
if ( defined($Param{&#039;commit&#039;}) ) {
   if ($nerror = MySQLaccess::DB::CommitGrantTables()) {
      MySQLaccess::Report::Print_Error_Access($nerror);
      exit 0;
   }
   my $msg = &quot;The grant-rules have been copied from the temporary tables\n&quot;
           . &quot;to the grant-tables.&quot;;
   my $msg1= &quot;Don&#039;t forget to do an &#039;mysqladmin reload&#039; before these\n&quot;
           . &quot;changes take effect.&quot;;
   my $msg2= &quot;A backup-version of your original grant-rules are saved in the\n&quot;
           . &quot;backup-tables, so you can always perform a 1-level rollback.&quot;;
   MySQLaccess::Report::Print_Message([$msg,$msg1,$msg2]);
#   MySQLaccess::Report::Print_Footer();
#   MySQLaccess::DB::CloseConnection();
#   exit 0;
}

#---------------------------------
# restore previous grant-rules
# with data from backup tables
if ( defined($Param{&#039;rollback&#039;}) ) {
   if ($nerror = MySQLaccess::DB::RollbackGrantTables()) {
      MySQLaccess::Report::Print_Error_Access($nerror);
      exit 0;
   }
   my $msg = &quot;The old grant-rules have been copied back from the backup tables\n&quot;
           . &quot;to the grant-tables.&quot;;
   my $msg1= &quot;Don&#039;t forget to do an &#039;mysqladmin reload&#039; before these\n&quot;
           . &quot;changes take effect.&quot;;
   MySQLaccess::Report::Print_Message([$msg,$msg1]);
#   MySQLaccess::Report::Print_Footer();
#   MySQLaccess::DB::CloseConnection();
#   exit 0;
}
#----------------------------------
# show edit-taskbar
if ( defined($Param{&#039;edit&#039;})) {
   if ($MySQLaccess::CGI ) {
   MySQLaccess::Report::Print_Edit();
   $print_usage=0;
   MySQLaccess::Report::Print_Footer();
   MySQLaccess::DB::CloseConnection();
   exit 0;
   }
   else {
   MySQLaccess::Report::Print_Edit();
   $print_usage=0;
   MySQLaccess::Report::Print_Footer();
   MySQLaccess::DB::CloseConnection();
   exit 0;
   }
}


# -----------------------------
# Build list of users,dbs,hosts
# to process...
@all_dbs   = @{MySQLaccess::DB::Get_All_dbs($Param{&#039;db&#039;})};
@all_users = @{MySQLaccess::DB::Get_All_users($Param{&#039;user&#039;})};
@all_hosts = @{MySQLaccess::DB::Get_All_hosts($Param{&#039;host&#039;})};
#if EDIT-mode
#@all_dbs_tmp   = @{MySQLaccess::DB::Get_All_dbs($Param{&#039;db&#039;},&#039;tmp&#039;)};
#@all_users_tmp = @{MySQLaccess::DB::Get_All_users($Param{&#039;user&#039;},&#039;tmp&#039;)};
#@all_hosts_tmp = @{MySQLaccess::DB::Get_All_hosts($Param{&#039;host&#039;},&#039;tmp&#039;)};

# -----------------------------
# Report access-rights for each
# tuple (host,user,db)
#$headers=0;
my %Access = ();
foreach $host (@all_hosts) {
  foreach $user (@all_users) {
    foreach $db (@all_dbs) {
      MySQLaccess::Grant::Initialize();
      %Access = MySQLaccess::Grant::Get_Access_Rights($host,$user,$db);	
      MySQLaccess::Report::Print_Access_rights($host,$user,$db,\%Access);
    }
  }
}

# -----------------------------
# End script
MySQLaccess::Report::Print_Footer();
MySQLaccess::DB::CloseConnection();
exit 0;

#############################################################
#  FUNCTIONS  #
###############
sub GetMode {
   my $cmd=0;
   my $cgi=0;
   if (defined($ENV{&#039;HTTP_HOST&#039;})) { $cmd=0; $cgi=1; }
   else                            { $cmd=1; $cgi=0; } 
   return ($cmd,$cgi);
}

# ================================
# sub PromptPass
#  prompt tty for a password
# ================================
sub PromptPass {
    my ($prompt) = @_;
    my $password;
    $ENV{PATH} = &quot;/bin:/usr/bin&quot;;
    $ENV{IFS} = &quot; \t\n&quot;;
    $ENV{SHELL} = &quot;/bin/sh&quot;;
    system &quot;stty -echo&quot;;
    print $prompt;
    chomp($password = &lt;STDIN&gt;);
    print &quot;\n&quot;;
    system &quot;stty echo&quot;;
    $password;
}

# =================================
# sub CheckUnsafeFile
#  tell if a config file containing a password is unsafe
# =================================
sub CheckUnsafeFile {
    my ($fname) = @_;
    my ($dev, $ino, $mode, $nlink,
        $uid, $gid, $rdev, $size,
        $atime, $mtime, $ctime, $blksize, $blocks) = stat($fname);

    if ( $uid != $&lt; ) {   # unsafe if owned by other than current user
        return 1;
    }
    if ( $mode &amp; 066 ) {  # unsafe if accessible by other
        return 1;
    }
    $fname =~ s#/[^/]+$##;
    if ( (length $fname) &gt; 0 ) {
        return CheckUnsafeDir($fname);
    }
    return 0;
}

# =================================
# sub CheckUnsafeDir
#  tell if a directory is unsafe
# =================================
sub CheckUnsafeDir {
    my ($fname) = @_;
    my ($dev, $ino, $mode, $nlink,
        $uid, $gid, $rdev, $size,
        $atime, $mtime, $ctime, $blksize, $blocks) = stat($fname);

    # not owned by me or root
    if ( ($uid != $&lt;) &amp;&amp; ($uid != 0) ) {
        return 1;
    }
    if ( $mode &amp; 022 ) {  # unsafe if writable by other
        return 1  unless $mode &amp; 01000;  # but sticky bit ok
    }
    $fname =~ s#/[^/]+$##;
    if ( (length $fname) &gt; 0 ) {
        return CheckUnsafeDir($fname);
    }
    return 0;
}

# =================================
# sub MergeConfigFile
#  merge data from .cnf file
# =================================
sub MergeConfigFile {
    my ($fname) = @_;
    my ($group, $item, $value);
    if ( open CNF, $fname ) {
         while (&lt;CNF&gt;) {
             s/^\s+//;
             next if /^[#;]/;
             if ( /\[\s*(\w+)\s*]/ ) {
                 $group = $1;
                 $group =~ tr/A-Z/a-z/;
                 if ( !exists $MYSQL_CNF{$group} ) {
                     undef $group;
                 }
             } elsif ( defined $group ) {
                 ($item, $value) = /((?:\w|-)+)\s*=\s*(\S+)/;
                 # don&#039;t unquote backslashes as we just write it back out
                 if ( defined $item ) {
                     if ( $item =~ /^password$/ ) {
                         if ( CheckUnsafeFile($fname) ) {
                             $unsafeConfig = $fname;
                         }
                     }
                     if ( $group eq &#039;client&#039; || $group eq &quot;client-server&quot;) {
                         $MYSQL_CNF{&#039;mysql&#039;}{$item} = $value;
                         $MYSQL_CNF{&#039;mysqldump&#039;}{$item} = $value;
                     } else {
                         $MYSQL_CNF{$group}{$item} = $value;
                     }
                 }
             }
         }
         close(CNF);
    }
}

# =================================
# sub MergeConfigFiles
#  merge options from config files
#  NOTE: really should do two separate merges for each
#    client to exactly duplicate order of resulting argument lists
# =================================
sub MergeConfigFiles {
    my ($name,$pass,$uid,$gid,$quota,$comment,$gcos,$dir,$shell) = getpwuid $&lt;;
    MergeConfigFile(&quot;/usr/my.cnf&quot;);
    MergeConfigFile(&quot;/etc/my.cnf&quot;);
    MergeConfigFile(&quot;$dir/.my.cnf&quot;);
}

# =================================
# sub WriteTempConfigFile
#  write 
# =================================
sub WriteTempConfigFile {
   sysopen CNFFILE, $MYSQL_CNF, O_RDWR|O_CREAT|O_EXCL, 0700
      or die &quot;sysopen $MYSQL_CNF: $!&quot;;
   
   # groups may be in any order, generic groups such as [client] assumed
   # here to be empty
   foreach $group (keys %MYSQL_CNF) {
      print CNFFILE &quot;[$group]\n&quot;;
      foreach $item (keys %{$MYSQL_CNF{$group}}) {
         if ( defined $MYSQL_CNF{$group}{$item} ) {
            print CNFFILE &quot;$item=$MYSQL_CNF{$group}{$item}\n&quot;;
         } else {
            print CNFFILE &quot;$item\n&quot;;
         }
      }
      print CNFFILE &quot;\n&quot;;
   }
   close(CNFFILE);
}

######################################################################
package MySQLaccess::DB;
###########
BEGIN {
    $DEBUG     = 2;
    $DEBUG     = $MySQLaccess::DEBUG unless ($DEBUG);
    # Error-messages from the MySQL client
    %ACCESS_ERR= (&#039;Access_denied&#039;       =&gt; &#039;Access denied&#039; 
                 ,&#039;Dbaccess_denied&#039;     =&gt; &#039;Access to database denied&#039;
                 ,&#039;Unrecognized_option&#039; =&gt; &#039;unrecognized option&#039; 
                 ,&#039;Unknown_table&#039;       =&gt; &quot;Can&#039;t find file:&quot;
                 ,&#039;unknown_error&#039;       =&gt; &#039;^ERROR:&#039;
                 );
}
# ######################################
#  Connecting to the MYSQL DB
# ======================================
# sub OpenConnection
#  Open an connection to the mysql-db
#  questions to MYSQL_Q
#  answers from MYSQL_A
# ======================================
sub OpenConnection {
    my $pid;
    MySQLaccess::Debug::Print(2,&quot;OpenConnection:&quot;);

    # check path to mysql-client executable
    if (! -f $MySQLaccess::MYSQL) {
       if ($MySQLaccess::CMD) { die &quot;Could not find MySQL-client &#039;$MySQLaccess::MYSQL&#039;&quot;; }
       if ($MySQLaccess::CGI) { 
          print &quot;&lt;center&gt;\n&lt;font color=Red&gt;\n&quot;;
          print &quot;ERROR: Could not find MySQL-client &#039;$MySQLaccess::MYSQL&#039;&quot;;
          print &quot;&lt;/center&gt;\n&lt;/font&gt;\n&quot;;
          exit 0;
       }
    }

    # path to mysql executable
    my $connect = &quot;$MySQLaccess::MYSQL --defaults-file=$MySQLaccess::MYSQL_CNF&quot;;
    $connect .= &quot; $MySQLaccess::MYSQL_OPT&quot;;
    # superuser, spassword transmitted via defaults-file
    if (defined($MySQLaccess::Param{&#039;rhost&#039;}))     { $connect .= &quot; --host=$MySQLaccess::Param{&#039;rhost&#039;}&quot;; }
    # other options??

    # grant-database
    $connect .= &quot; $MySQLaccess::ACCESS_DB&quot;;

    # open connection (not using /bin/sh -c)
    MySQLaccess::Debug::Print(2,&quot;Connecting to: $connect&quot;);
    $pid=IPC::Open3::open3(\*MYSQL_Q,\*MYSQL_A,&quot;&quot;,split /\s+/,$connect);
    MySQLaccess::Debug::Print(2,&quot;PID of open pipe: $pid&quot;);
    
    # check connection 
    print MYSQL_Q &quot;select &#039;ok&#039;;\n&quot;;
    $answer = &lt;MYSQL_A&gt;; #answer from mysql
    MySQLaccess::Debug::Print(2,&quot;Answer: $answer\n&quot;);
    foreach $nerror (sort(keys(%ACCESS_ERR))) {
      MySQLaccess::Debug::Print(3,&quot;check answer for error $ACCESS_ERR{$nerror}&quot;);
      if (grep(/$ACCESS_ERR{$nerror}/i,$answer)) { 
         MySQLaccess::Debug::Print(2,&quot;Answer contain error [$nerror]&quot;);
         return $nerror; 
      }
    }

if (0) {
    # check server-version 
    print MYSQL_Q &quot;select &#039;ok&#039;;\n&quot;;
    $answer = &lt;MYSQL_A&gt;; #answer from mysql
    MySQLaccess::Debug::Print(2,&quot;Answer: $answer\n&quot;);
    foreach $nerror (sort(keys(%ACCESS_ERR))) {
      MySQLaccess::Debug::Print(3,&quot;check answer for error $ACCESS_ERR{$nerror}&quot;);
      if (grep(/$ACCESS_ERR{$nerror}/i,$answer)) { 
         MySQLaccess::Debug::Print(2,&quot;Answer contain error [$nerror]&quot;);
         return $nerror; 
      }
    }
}

    my $skip=&lt;MYSQL_A&gt;; 
    return 0; 
}

# ======================================
# sub CloseConnection
#  Close the connection to the mysql-db
# ======================================
sub CloseConnection {
    close MYSQL_Q;
    close MYSQL_A;
}

# ===========================================================
# sub CreateTable($table)
#  Create temporary/backup table
# ===========================================================
sub CreateTable {
    my $pid;
    my ($table,$force) = @_;
    my %tables = ( $MySQLaccess::ACCESS_U_TMP =&gt; $MySQLaccess::ACCESS_U,
                   $MySQLaccess::ACCESS_H_TMP =&gt; $MySQLaccess::ACCESS_H,
                   $MySQLaccess::ACCESS_D_TMP =&gt; $MySQLaccess::ACCESS_D,
                   $MySQLaccess::ACCESS_U_BCK =&gt; $MySQLaccess::ACCESS_U,
                   $MySQLaccess::ACCESS_H_BCK =&gt; $MySQLaccess::ACCESS_H,
                   $MySQLaccess::ACCESS_D_BCK =&gt; $MySQLaccess::ACCESS_D,
                   $MySQLaccess::ACCESS_U =&gt; $MySQLaccess::ACCESS_U_BCK,
                   $MySQLaccess::ACCESS_H =&gt; $MySQLaccess::ACCESS_H_BCK,
                   $MySQLaccess::ACCESS_D =&gt; $MySQLaccess::ACCESS_D_BCK,
                 ); 
    my $tbl;
    my $query=&quot;&quot;;
    my $delim;
    my $skip;
    my $create;
    my @known_tables=();

#    print STDERR &quot;CreateTable($table)\n&quot;;
    MySQLaccess::Debug::Print(1,&quot;CreateTable($table):&quot;);

    ## error-handling
    return &#039;Unknown_table&#039; unless defined($tables{$table});

    ## build list of known/existing tables;
    ## if &#039;force&#039; existing table is dropped first
    if (defined($force) and $force) {
       @known_tables = Show_Tables();
       if (grep(/^$table$/,@known_tables)) {
       $query = &quot;DROP TABLE $table;&quot;;
       }
    }

    ## path to mysqldump executable
    my $connect = $MySQLaccess::MYSQLDUMP;
    $connect .= &quot; --defaults-file=$MySQLaccess::MYSQL_CNF --no-data&quot;;
    # superuser, spassword transmitted via defaults-file
    if (defined($MySQLaccess::Param{&#039;rhost&#039;}))     { $connect .= &quot; --host=$MySQLaccess::Param{&#039;rhost&#039;}&quot;; }
    $connect .= &quot; $MySQLaccess::ACCESS_DB&quot;;
    $connect .= &quot; $tables{$table}&quot;;


    ## get creation-data for original table
    $create = &#039;&#039;;
    my $mysqldump = $connect;
    $mysqldump =~ s/ \$TABLE / $tbl /;

    # open connection (not using /bin/sh -c)
    MySQLaccess::Debug::Print(2,&quot;Connecting to: $connect&quot;);
    $pid=IPC::Open3::open3(\*DONTCARE,\*CREATE,&quot;&quot;,split /\s+/,$mysqldump);
    MySQLaccess::Debug::Print(2,&quot;PID of open pipe: $pid&quot;);
    #open(CREATE,&quot;$mysqldump&quot;);
    @create = &lt;CREATE&gt;;
    $create = &quot;@create&quot;;
    foreach $nerror (sort(keys(%ACCESS_ERR))) {
       MySQLaccess::Debug::Print(3,&quot;check answer for error $ACCESS_ERR{$nerror}&quot;);
       if (grep(/$ACCESS_ERR{$nerror}/i,$create)) { 
          MySQLaccess::Debug::Print(2,&quot;Answer contain error [$nerror]&quot;);
          return $nerror; 
       }
    }
    close(CREATE);
    close(DONTCARE);

    ## manipulate result for creation-data for temporary table
    $create =~ s/CREATE TABLE $tables{$table} \(/CREATE TABLE $table \(/;

    ## recreate temporary table
    $query .= &quot;$create\n&quot;;
    $query .= &quot;select &#039;ok&#039;;&quot;;

    ## execute query
    print MYSQL_Q &quot;$query\n&quot;;
#    print STDERR $query;

    $answer = &lt;MYSQL_A&gt;; #answer from mysql
#    print STDERR &quot;A&gt;&quot;,$answer;
    MySQLaccess::Debug::Print(2,&quot;Answer: $answer\n&quot;);
    foreach $nerror (sort(keys(%ACCESS_ERR))) {
#       print STDERR &quot;-&gt;$nerror?&quot;;
       MySQLaccess::Debug::Print(3,&quot;check answer for error $ACCESS_ERR{$nerror}&quot;);
       if (grep(/$ACCESS_ERR{$nerror}/i,$answer)) { 
#          print STDERR &quot;Yes!&quot;;
          MySQLaccess::Debug::Print(2,&quot;Answer contain error [$nerror]&quot;);
          return $nerror; 
       }
    }

    $delim = &lt;MYSQL_A&gt;; # read header
    if ($delim ne &quot;ok\n&quot;) {
       while (($line=&lt;MYSQL_A&gt;) ne &quot;ok\n&quot;)
       { MySQLaccess::Debug::Print(3,&quot; A&gt; $line&quot;); }
        $skip = &lt;MYSQL_A&gt;; # skip result &#039;ok&#039;
    }
#    print STDERR &quot;CreateTable done\n&quot;;
    return 0;
}


# ===========================================================
# sub CopyTable()
#  Copy the structure and the data of a table to another table
# ===========================================================
sub CopyTable {
    my ($from,$to,$force) = @_;
    my @known_tables  = Show_Tables();    
    my $query = &quot;&quot;;
    my $nerror= 0;
    my $skip;

#    print STDERR &quot;CopyTable($from,$to)\n&quot;;
    MySQLaccess::Debug::Print(1,&quot;MySQLaccess::DB::CopyTable($from,$to)&quot;);

    ## error-handling
    if (!grep(/^$from$/,@known_tables)) { return &#039;Unknown_table&#039;; }

    ## copy structure 
    ## if forced
    if (defined($force) and $force) {
       return $nerror if ($nerror=CreateTable($to,$force)); 
#       print STDERR &quot;Structure copied\n&quot;;
    }

    ## copy data
    $query .= &quot;DELETE FROM $to;&quot;;
    $query .= &quot;INSERT INTO $to SELECT * FROM $from;&quot;;
    $query .= &quot;SELECT &#039;ok&#039;;\n&quot;;
    MySQLaccess::Debug::Print(2,&quot;Query: $query&quot;);
       
    ## execute query
    print MYSQL_Q &quot;$query\n&quot;;
#    print STDERR $query;

    ## check for errors...
    my $answer = &lt;MYSQL_A&gt;; #answer from mysql
#    print STDERR $answer;
    MySQLaccess::Debug::Print(2,&quot;Answer: $answer\n&quot;);
    foreach $nerror (sort(keys(%ACCESS_ERR))) {
       MySQLaccess::Debug::Print(3,&quot;check answer for error $ACCESS_ERR{$nerror}&quot;);
       if (grep(/$ACCESS_ERR{$nerror}/i,$answer)) { 
          MySQLaccess::Debug::Print(2,&quot;Answer contain error [$nerror]&quot;);
          return $nerror; 
       }
    }

    my $delim = &lt;MYSQL_A&gt;; # read header
#    print STDERR $delim;
    if ($delim ne &quot;ok\n&quot;) {
       while (($line=&lt;MYSQL_A&gt;) ne &quot;ok\n&quot;)
       { MySQLaccess::Debug::Print(3,&quot; A&gt; $line&quot;); }
       $skip = &lt;MYSQL_A&gt;; # skip result &#039;ok&#039;
    }

    return 0;
}

# ===========================================================
# sub LoadTmpTables()
#  (Re)load temporary tables with entries of ACL-tables
# ===========================================================
sub LoadTmpTables {
    my %tables = ( $MySQLaccess::ACCESS_U =&gt; $MySQLaccess::ACCESS_U_TMP,
                   $MySQLaccess::ACCESS_H =&gt; $MySQLaccess::ACCESS_H_TMP,
                   $MySQLaccess::ACCESS_D =&gt; $MySQLaccess::ACCESS_D_TMP,
                 ); 
    my $tbl;
    my $nerror;
    
#    print STDERR &quot;LoadTmpTables:\n&quot;;
    MySQLaccess::Debug::Print(1,&quot;LoadTmpTables():&quot;);
    foreach $tbl (keys(%tables)) {
#       print STDERR &quot;$tbl -&gt; $tables{$tbl}\n&quot;;
       MySQLaccess::Debug::Print(2,&quot;Loading table $tbl -&gt; $tables{$tbl}.&quot;);
       return $nerror if ($nerror=CopyTable($tbl,$tables{$tbl},&#039;force&#039;));
    }
    return 0;
}

# ===========================================================
# sub BackupGrantTables()
#  Make a backup of the original grant-tables
# ===========================================================
sub BackupGrantTables {
    my %tables = ( $MySQLaccess::ACCESS_U =&gt; $MySQLaccess::ACCESS_U_BCK,
                   $MySQLaccess::ACCESS_H =&gt; $MySQLaccess::ACCESS_H_BCK,
                   $MySQLaccess::ACCESS_D =&gt; $MySQLaccess::ACCESS_D_BCK,
                 ); 
    my $tbl;
    my $nerror;
    
#    print STDERR &quot;BackupGrantTables:\n&quot;;
    MySQLaccess::Debug::Print(1,&quot;BackupGrantTables():&quot;);
    foreach $tbl (keys(%tables)) {
#       print STDERR &quot;$tbl -&gt; $tables{$tbl}\n&quot;;
       MySQLaccess::Debug::Print(2,&quot;Backup table $tbl -&gt; $tables{$tbl}.&quot;);
       return $nerror if ($nerror=CopyTable($tbl,$tables{$tbl},&#039;force&#039;));
    }
    return 0;
}

# ===========================================================
# sub RollbackGrantTables()
#  Rollback the backup of the grant-tables
# ===========================================================
sub RollbackGrantTables {
    my %tables = ( $MySQLaccess::ACCESS_U_BCK =&gt; $MySQLaccess::ACCESS_U,
                   $MySQLaccess::ACCESS_H_BCK =&gt; $MySQLaccess::ACCESS_H,
                   $MySQLaccess::ACCESS_D_BCK =&gt; $MySQLaccess::ACCESS_D,
                 ); 
    my $tbl;
    my $nerror;
    
#    print STDERR &quot;RollbackGrantTables:\n&quot;;
    MySQLaccess::Debug::Print(1,&quot;RollbackGrantTables():&quot;);
    foreach $tbl (keys(%tables)) {
#       print STDERR &quot;$tbl -&gt; $tables{$tbl}\n&quot;;
       MySQLaccess::Debug::Print(2,&quot;Rollback table $tbl -&gt; $tables{$tbl}.&quot;);
       return $nerror if ($nerror=CopyTable($tbl,$tables{$tbl},&#039;force&#039;));
    }
    return 0;
}


# ===========================================================
# sub CommitGrantTables()
#  Copy grant-rules from temporary tables to the ACL-tables
# ===========================================================
sub CommitGrantTables {
    my %tables = ( $MySQLaccess::ACCESS_U =&gt; $MySQLaccess::ACCESS_U_TMP,
                   $MySQLaccess::ACCESS_H =&gt; $MySQLaccess::ACCESS_H_TMP,
                   $MySQLaccess::ACCESS_D =&gt; $MySQLaccess::ACCESS_D_TMP,
                 ); 
    my $tbl;
    my $query;
    my $delim;
    my $skip;
    my $create;

    print STDERR &quot;CommitGrantTables()\n&quot;;
    MySQLaccess::Debug::Print(1,&quot;CommitGrantTables():&quot;);
    
    ## Make backup of original grant-tables
    MySQLaccess::Debug::Print(2,&quot;Making backup of original grant-tables...&quot;);
    BackupGrantTables();

    ## Copy data from temporay tables to grant-tables
    foreach $tbl (keys(%tables)) {
       print STDERR &quot;$tbl -&gt; $tables{$tbl}\n&quot;;
       MySQLaccess::Debug::Print(2,&quot;Loading data $tables{$tbl} -&gt; $tbl.&quot;);
       return $nerror if ($nerror=CopyTable($tables{$tbl},$tbl));
    }
    return 0;
}


# ===========================================================
# sub Show_Fields($table): 
#  return (a reference to) a hash which holds the names
#  of all relevant grant-fields, with their index in the record,
#  and (a reference to) an array which holds the fieldnames.
# ===========================================================
sub Show_Fields {
    my ($table) = @_;
    my %skip = (&#039;host&#039; =&gt; [0,1]
               ,&#039;user&#039; =&gt; [0,1,2]
               ,&#039;db&#039;   =&gt; [0,1,2]
               );
    my %Struct = ();
    my @Struct = ();
    my $query = &quot;show fields from $table;select &#039;ok&#039;;\n&quot;;
    my $i=0;
    my $line;

#print STDERR $query;
    MySQLaccess::Debug::Print(1,&quot;Show_Fields($table):&quot;);
    MySQLaccess::Debug::Print(2,&quot;SQL: $query&quot;);

    print MYSQL_Q &quot;$query&quot;;
    my $skip = &lt;MYSQL_A&gt;;  #skip header
    while (($line=&lt;MYSQL_A&gt;) ne &quot;ok\n&quot;)
    {
#print STDERR &quot;&gt;&quot;,$line;
	chop($line);
	MySQLaccess::Debug::Print(2,&quot; $table&gt;: $line&quot;);
	my ($field,$type,$null,$key,$default,$extra) = split(&#039; &#039;,$line);
        $field = ucfirst($field); 
	MySQLaccess::Debug::Print(3, &quot; &lt;split: $field - $type - $null - $key - $default - $extra&quot;);
	if (! grep(/$i/,@{$skip{$table}}) ){
	   $Struct{$field} = $i; #hash
	   push(@Struct,$field); #array
	   MySQLaccess::Debug::Print(3,&quot; ==&gt; added column[$i]: $field ($Struct{$field})&quot;);
	} 
        else {
           MySQLaccess::Debug::Print(3,&quot; ==&gt; skipped column[$i], value=[$field]&quot;);
        }
	$i++;
    }

    $skip=&lt;MYSQL_A&gt;;  # Get ok row (found already ok header)

    MySQLaccess::Debug::Print(2, &quot;Array:&quot;);
    foreach $field (@Struct) { MySQLaccess::Debug::Print(2,&quot;+ $field&quot;); }
    MySQLaccess::Debug::Print(2,&quot;Hash:&quot;);
    foreach $field (keys(%Struct)) { MySQLaccess::Debug::Print(2,&quot;+ $field -&gt; $Struct{$field}&quot;); }

    return  (\%Struct,\@Struct); 
}

# ===========================================================
# sub Show_Tables(): 
#  return (a reference to) an array which holds all 
#  known tables.
# ===========================================================
sub Show_Tables {
    my @Tables = ();
    my $query = &quot;show tables;select &#039;ok&#039;;\n&quot;;
    my $i=0;
    my $line;

    MySQLaccess::Debug::Print(1,&quot;Show_Tables():&quot;);
    MySQLaccess::Debug::Print(2,&quot;SQL: $query&quot;);

    print MYSQL_Q &quot;$query&quot;;
    my $skip = &lt;MYSQL_A&gt;;  #skip header
    while (($line=&lt;MYSQL_A&gt;) ne &quot;ok\n&quot;)
    {
	chop($line);
	push(@Tables,$line); #array
	MySQLaccess::Debug::Print(3,&quot; ==&gt; added table: $line&quot;);
    }

    $skip=&lt;MYSQL_A&gt;;  # Get ok row (found already ok header)

    MySQLaccess::Debug::Print(2, &quot;Array:&quot;);
    foreach $tbl (@Tables) { MySQLaccess::Debug::Print(2,&quot;+ $tbl&quot;); }

    return @Tables; 
}

# ======================================
# sub Validate_Password($passwd,$host,$user,$encpw)
#  Validate the given password 
#  for user &#039;$user&#039; 
#  connecting from host &#039;$host&#039;
# ======================================
sub Validate_Password {
    my ($password,$host,$user,$encpw) = @_;
    my $valid=0;

    MySQLaccess::Debug::Print(1,&quot;Validate_Password($password,$host,$user,$encpw)&quot;);
    my $sql = &quot;select host,user,password from user having &quot;
             .&quot;host=&#039;$host&#039; and user=&#039;$user&#039; and password=&#039;$encpw&#039; &quot;
             .&quot;and password=PASSWORD(&#039;$password&#039;);\n&quot;;
    $sql .= &quot;select &#039;ok&#039;;\n&quot;;
    MySQLaccess::Debug::Print(2,&quot;SQL = $sql&quot;);
    print MYSQL_Q &quot;$sql&quot;;
    
    # if password is valid, at least 1 row returns before we read &#039;ok&#039;
    while ( ($line=&lt;MYSQL_A&gt;) ne &quot;ok\n&quot;) {
      MySQLaccess::Debug::Print(2,&quot; A&gt; $line&quot;);
      $valid = defined($line); 
    }
    my $skip = &lt;MYSQL_A&gt;; # read &#039;ok&#039;

    return $valid;
}


# ==========================================================
# sub Sort_fields: (rewritten by psmith)
#  Build the query for an ordered list of entries
# ==========================================================
sub Sort_fields {
  my ($start, $end, $sofar, $this, @rest) = (@_);
  my @where = (&quot;((FIELD not like &#039;\\%&#039;) AND (FIELD &lt;&gt; &#039;&#039;))&quot;,
               &quot;((FIELD like &#039;%\\%%&#039;) OR (FIELD like &#039;%\\_%&#039;))&quot;,
               &quot;(FIELD = &#039;&#039;)&quot;);
  my $res = &#039;&#039;;

  $this or return (&quot;$start $sofar $end&quot;);

  $sofar .= &#039; AND &#039; if $sofar;

  foreach $w (@where) {
    my $f = $w;
    $f =~ s/FIELD/$this/g;

    $res .= Sort_fields($start, $end, &quot;$sofar$f&quot;, @rest);
  }

  return ($res);
}

# ===========================================================
# sub Sort_table: (rewritten by psmith)
#  return all entries in the given table,
#  in an ordered fashion
# ===========================================================
sub Sort_table {
    my ($tbl, @order) = @_;
    my @res=();

    # as long as there&#039;s no full where clause (Distrib 3.20)...
    # use having :-(
    # NOTE: this clause WILL NOT work on 3.21, because of the
    # order of &#039;ORDER BY&#039; and &#039;HAVING&#039;
    my $start = &quot;SELECT *,UCASE(host) as ucase_host FROM $tbl &quot;;
    $start   .= &#039;ORDER BY &#039; . join(&#039;,&#039;, @order) .&quot; HAVING &quot;;
    my $end   = &quot;;\n&quot;;

    # server version 3.21 has a full where clause :-)
    if ($MySQLaccess::Host::SERVER &gt;= &#039;3.21&#039;) {
    # print &quot;+++USING FULL WHERE CLAUSE+++\n&quot;;
       $start = &quot;SELECT *,UCASE(host) as ucase_host FROM $tbl WHERE &quot;;
       $end = &#039; ORDER BY &#039; . join(&#039;,&#039;, @order) . &quot;;\n&quot;;
    }

    MySQLaccess::Debug::Print(1,&quot;Sort_table():&quot;);
    MySQLaccess::Debug::Print(2,&quot;Sorting table $tbl by `@order&#039;&quot;);

    my $tmp;
    foreach $tmp (@order)
    {
      $tmp=&quot;UCASE(host)&quot; if ($tmp eq &quot;ucase_host&quot;);
    }
    my $query  = Sort_fields($start, $end, &#039;&#039;, @order);
    $query    .= &quot;select &#039;ok&#039;;\n&quot;;
    MySQLaccess::Debug::Print(2,&quot;Query: $query&quot;);

    print MYSQL_Q &quot;$query\n&quot;;

    my $delim = &lt;MYSQL_A&gt;; # read header
    MySQLaccess::Debug::Print(3,&quot; A&gt; $delim&quot;);
    if ($delim ne &quot;ok\n&quot;) {
       if ($delim =~ /^ERROR/) {
       push(@MySQLaccess::Grant::Error,&#039;use_old_server&#039;);
       MySQLaccess::Report::Print_Error_Messages() ;
       exit 1;
       }
       while (($line=&lt;MYSQL_A&gt;) ne &quot;ok\n&quot;)
       {
           MySQLaccess::Debug::Print(3,&quot; A&gt; $line&quot;);
           push(@res,$line);
       }
    }
    my $skip = &lt;MYSQL_A&gt;; # skip result &#039;ok&#039;

    # remove columnheaders from output
    @res = grep(!/^\Q$delim\E$/, @res);
    # remove trailing \n from each returned record
    chomp(@res); 
    # each record has 1 field to much : ucase_host
    @res = grep { /(.*)\t.*$/; $_ = $1; } @res;

    MySQLaccess::Debug::Print(2,&quot;Result of sorted table $tbl:&quot;);
    foreach $line (@res) { MySQLaccess::Debug::Print(2,&quot; &gt;&gt;$line&quot;); }
    return @res;
}

# ===========================================================
# sub Get_All_db(template): 
#  return all db the grant-tables are working on,
#  which conform to the template
# ===========================================================
sub Get_All_dbs {
   my ($template,$tmp) = @_;
   my @db=();
   my $aref;

   # working with  temporary tables or production tables
   if (defined($tmp) and $tmp) {
      $aref = \@MySQLaccess::Grant::sorted_db_tmp_table ;
   }
   else {
      $aref = \@MySQLaccess::Grant::sorted_db_table;
   }

   MySQLaccess::Debug::Print(1,&quot; template=[$template]&quot;);

   # get all db for which access-rights can be calculated,
   # which conform to the template.
   # !! these db&#039;s don&#039;t have to exist yet, so it&#039;s not
   #    enough to look which db already exist on the system
   $reg_expr = $template;
   if ($template =~ /[\*\?]/) {
      $reg_expr =~ tr/*?/%_/;
      #$reg_expr = MySQLaccess::Wildcards::Wild2Reg($template);
   }
   $reg_expr = MySQLaccess::Wildcards::SQL2Reg(&quot;$reg_expr&quot;);

   if ( ! ($template =~ /[\*\?%_]/) ) {
      push(@db,$template);
      return \@db;
   }

   MySQLaccess::Debug::Print(2,&quot;#Reading db-table...&quot;);
   foreach $record (@{$aref}) { #MySQLaccess::Grant::sorted_db_table) {
    my @record=split(/\t/,$record);
    my $db = $record[1];
    MySQLaccess::Debug::Print(2,&quot;&gt; $db &quot;);
    if ( (!grep(/$db/i,@db)) and ($db =~/$reg_expr/i) ) {
       push(@db,$db);
       MySQLaccess::Debug::Print(2,&quot;added&quot;);
    } 
    else {
       MySQLaccess::Debug::Print(2,&quot;skipped&quot;);
    }
   }
   # if no rule is found for a certain db in the db-table,
   # the rights of the user are used, so we should inform
   # the user for
   if (!grep(/^%$/,@db)) { push(@db,&quot;$MySQLaccess::NEW_DB&quot;); }
   return \@db;
}

# ===========================================================
# sub Get_All_users(template): 
#  return all users the grant-tables are working on,
#  which conform to the template
# ===========================================================
sub Get_All_users {
   ($template,$tmp) = @_; # nog verder uitwerken!!!
   my @user=();
   my $aref;

   # working with  temporary tables or production tables
   if (defined($tmp) and $tmp) {
      $aref = \@MySQLaccess::Grant::sorted_user_tmp_table ;
   }
   else {
      $aref = \@MySQLaccess::Grant::sorted_user_table;
   }

   MySQLaccess::Debug::Print(1,&quot;Debug Get_All_users:&quot;);
   # get all db for which access-rights can be calculated.
   # !! these db&#039;s don&#039;t have to exist yet, so it&#039;s not
   #    enough to look which db already exist on the system
   $reg_expr = $template;
   if ($template =~ /[\*\?]/) {
      $reg_expr =~ tr/*?/%_/;
      #$reg_expr = MySQLaccess::Wildcards::Wild2Reg($template);
   }
   $reg_expr = MySQLaccess::Wildcards::SQL2Reg(&quot;$reg_expr&quot;);

   if ( ! ($template =~ /[\*\?%_]/) ) {
      push(@user,$template);
      return \@user;
   }

   MySQLaccess::Debug::Print(2,&quot;#Reading user-table...&quot;);
   foreach $record (@{$aref}) { #MySQLaccess::Grant::sorted_user_table) {
    my @record=split(/\t/,$record);
    my $user = $record[1];
    MySQLaccess::Debug::Print(2,&quot;&gt; $user &quot;);
    if ( (!grep(/$user/,@user)) and ($user=~/$reg_expr/)) {
       push(@user,$user);
       MySQLaccess::Debug::Print(2, &quot;added&quot;);
    } 
    else {
       MySQLaccess::Debug::Print(2, &quot;skipped&quot;);
    }
   }
   # Any user means also:
   # - the &#039;empty&#039; user, ie without supplying a username
   # - any user still to be defined/created
   #push(@user,&#039;&#039;);               #without_suplying_a_username
   push(@user,&quot;$MySQLaccess::NEW_USER&quot;);
   #push(@Warnings,&#039;minimum_priv&#039;);
   return \@user;
}

# ===========================================================
# sub Get_All_hosts(template): 
#  return all hosts the grant-tables are working on,
#  which conform to the template
# ===========================================================
sub Get_All_hosts {
   my ($template,$tmp) = @_;
   my @host=();
   my $aref;
   my $aref1;

   # working with  temporary tables or production tables
   if (defined($tmp) and $tmp) {
      $aref = \@MySQLaccess::Grant::sorted_host_tmp_table ;
      $aref1= \@MySQLaccess::Grant::sorted_db_tmp_table ;
   }
   else {
      $aref = \@MySQLaccess::Grant::sorted_host_table;
      $aref1= \@MySQLaccess::Grant::sorted_db_table ;
   }

   MySQLaccess::Debug::Print(1, &quot;Debug Get_All_hosts:&quot;);
   # get all db for which access-rights can be calculated.
   # !! these db&#039;s don&#039;t have to exist yet, so it&#039;s not
   #    enough to look which db already exist on the system
   $reg_expr = $template;
   if ($template =~ /[\*\?]/) {
      $reg_expr =~ tr/*?/%_/;
      #$reg_expr = MySQLaccess::Wildcards::Wild2Reg($template);
   }
   $reg_expr = MySQLaccess::Wildcards::SQL2Reg(&quot;$reg_expr&quot;);

   if ( ! ($template =~ /[\*\?%_]/) ) {
      push(@host,$template);
      return \@host;
   }

   MySQLaccess::Debug::Print(1, &quot;#Reading db-table...&quot;);
   foreach $record (@{$aref1}) { #MySQLaccess::Grant::sorted_db_table) {
    my @record=split(/\t/,$record);
    my $host = $record[0];
    MySQLaccess::Debug::Print(2, &quot;&gt; $host &quot;);
    if (! grep(/$host/i,@host)) {
       push(@host,$host);
       MySQLaccess::Debug::Print(2, &quot;added&quot;);
    } 
    else {
       MySQLaccess::Debug::Print(2, &quot;skipped&quot;);
    }
   }
   MySQLaccess::Debug::Print(1, &quot;#Reading host-table...&quot;);
   foreach $record (@{$aref}) {
    my @record=split(/\t/,$record);
    my $host = $record[0];
    MySQLaccess::Debug::Print(2, &quot;&gt; $host &quot;);
    if ( (!grep(/$host/,@host)) and ($host=~/$reg_expr/)) {
       push(@host,$host);
       MySQLaccess::Debug::Print(2, &quot;added&quot;);
    } 
    else {
       MySQLaccess::Debug::Print(2, &quot;skipped&quot;);
    }
   }
   # DOUBT:
   #print &quot;#Reading user-table...\n&quot; if ($DEBUG&gt;1);
   #foreach $record (@MySQLaccess::Grant::sorted_user_table) {
   # my @record=split(/\t/,$record);
   # my $host = $record[0];
   # print &quot;&gt; $host &quot; if ($DEBUG&gt;2);
   # if ( (!grep(/$host/,@host)) and ($host=~/$reg_expr/)) {
   #    push(@host,$host);
   #    print &quot;added\n&quot; if ($DEBUG&gt;2);
   # } 
   # else {
   #    print &quot;skipped\n&quot; if ($DEBUG&gt;2);
   # }
   #}
   # Any host also means:
   # - any host still to be defined/created
   #push(@host,&quot;any_other_host&quot;);

   @host = sort(@host);
   return \@host;
}


##########################################################################
package MySQLaccess::Grant;
##############
BEGIN {
    $DEBUG     = 0;
    $DEBUG     = $MySQLaccess::DEBUG unless ($DEBUG);
}


# ===========================================================
# sub Diff_Privileges()
#  Calculate diff between temporary and original grant-tables
# ===========================================================
sub Diff_Privileges {
   my @before=();
   my @after =();
   my @diffs =();

   # -----------------------------
   # Build list of users,dbs,hosts
   # to process...
   my @all_dbs   = @{MySQLaccess::DB::Get_All_dbs(&#039;*&#039;)};
   my @all_users = @{MySQLaccess::DB::Get_All_users(&#039;*&#039;)};
   my @all_hosts = @{MySQLaccess::DB::Get_All_hosts(&#039;*&#039;)};
   #if EDIT-mode
   my @all_dbs_tmp   = @{MySQLaccess::DB::Get_All_dbs(&#039;*&#039;,&#039;tmp&#039;)};
   my @all_users_tmp = @{MySQLaccess::DB::Get_All_users(&#039;*&#039;,&#039;tmp&#039;)};
   my @all_hosts_tmp = @{MySQLaccess::DB::Get_All_hosts(&#039;*&#039;,&#039;tmp&#039;)};


   my %Access;
   # ------------------------------------
   # Build list of priv. for grant-tables
   foreach $host (@all_hosts) {
     foreach $user (@all_users) {
       foreach $db (@all_dbs) {
         MySQLaccess::Grant::Initialize();
         %Access = MySQLaccess::Grant::Get_Access_Rights($host,$user,$db);	
         push(@before,MySQLaccess::Report::Raw_Report($host,$user,$db,\%Access));
       }
     }
   }

   # ----------------------------------
   # Build list of priv. for tmp-tables
   foreach $host (@all_hosts_tmp) {
     foreach $user (@all_users_tmp) {
       foreach $db (@all_dbs_tmp) {
         MySQLaccess::Grant::Initialize(&#039;tmp&#039;);
         %Access = MySQLaccess::Grant::Get_Access_Rights($host,$user,$db,&#039;tmp&#039;);	
         push(@after,MySQLaccess::Report::Raw_Report($host,$user,$db,\%Access));
       }
     }
   }

   # ----------------------------------
   # Write results to temp-file to make
   # DIFF
   @before = sort(@before);
   @after  = sort(@after);

   ($hb, $before) = tempfile(&quot;$MySQLaccess::script.XXXXXX&quot;) or
    push(@MySQLaccess::Report::Errors,&quot;Can&#039;t create temporary file: $!&quot;);
   ($ha, $after)  = tempfile(&quot;$MySQLaccess::script.XXXXXX&quot;) or
    push(@MySQLaccess::Report::Errors,&quot;Can&#039;t create temporary file: $!&quot;);

   print $hb join(&quot;\n&quot;,@before);
   print $ha join(&quot;\n&quot;,@after);
   close $hb;
   close $ha;

   # ----------------------------------
   # compute difference
   my $cmd=&quot;$MySQLaccess::DIFF $before $after |&quot;;
   open(DIFF,&quot;$cmd&quot;);
   @diffs = &lt;DIFF&gt;;
   @diffs = grep(/[&lt;&gt;]/,@diffs);
   chomp(@diffs);
   close(DIFF);

   # ----------------------------------
   # cleanup temp. files
   unlink($before);
   unlink($after);

   return \@diffs;
}

# ===========================================================
# sub Initialize()
#
# ===========================================================
sub Initialize {
    %MySQLaccess::Grant::Access       = %{Default_Access_Rights()};
    @MySQLaccess::Grant::Errors       = ();
    @MySQLaccess::Grant::Warnings     = ();
    @MySQLaccess::Grant::Notes        = ();
    # -----
    # rules
    $MySQLaccess::Grant::Rules{&#039;user&#039;} = &#039;no_rule_found&#039;;
    $MySQLaccess::Grant::Rules{&#039;db&#039;}   = &#039;no_rule_found&#039;;
    $MySQLaccess::Grant::Rules{&#039;host&#039;} = &#039;no_equiv_host&#039;;
    $MySQLaccess::Grant::full_access   = 1;

    $MySQLaccess::Grant::process_host_table = 0;
    return 1;
}

# ===========================================================
# sub ReadTables()
#  
# ===========================================================
sub ReadTables {
    my ($tmp) = @_;
    my ($HOST,$DB,$USER);
    my @tables;

    # build list of available tables
    @tables = MySQLaccess::DB::Show_Tables();

    # reading production grant-tables or temporary tables?
    $tmp = (defined($tmp) and $tmp) ? 1 : 0;
    if ($tmp) { #reading temporary tables
       $HOST=$MySQLaccess::ACCESS_H_TMP;
       $DB  =$MySQLaccess::ACCESS_D_TMP;
       $USER=$MySQLaccess::ACCESS_U_TMP;

       # ----------------------------
       # do tables exist?
       if (!grep(/$HOST/,@tables)) { MySQLaccess::DB::CreateTable($HOST); }
       if (!grep(/$USER/,@tables)) { MySQLaccess::DB::CreateTable($USER); }
       if (!grep(/$DB/,@tables))   { MySQLaccess::DB::CreateTable($DB); }

       MySQLaccess::Debug::Print(1,&quot;Finding fields in tmp-ACL files:&quot;);
       # -----------------------------
       # Get record-layout 
       my ($h1,$h2) = MySQLaccess::DB::Show_Fields($HOST);
       my ($d1,$d2) = MySQLaccess::DB::Show_Fields($DB);
       my ($u1,$u2) = MySQLaccess::DB::Show_Fields($USER);
       %MySQLaccess::Grant::H_tmp = %{$h1}; @MySQLaccess::Grant::H_tmp = @{$h2};
       %MySQLaccess::Grant::D_tmp = %{$d1}; @MySQLaccess::Grant::D_tmp = @{$d2};
       %MySQLaccess::Grant::U_tmp = %{$u1}; @MySQLaccess::Grant::U_tmp = @{$u2};

#       @MySQLaccess::Grant::Privileges_tmp=@{Make_Privlist()};
#
       MySQLaccess::Debug::Print(1, &quot;Reading sorted temp-tables:&quot;);
       @MySQLaccess::Grant::sorted_db_tmp_table  = MySQLaccess::DB::Sort_table($DB, &#039;ucase_host&#039;, &#039;user&#039;, &#039;db&#039;);
       @MySQLaccess::Grant::sorted_host_tmp_table= MySQLaccess::DB::Sort_table($HOST, &#039;ucase_host&#039;, &#039;db&#039;);
       @MySQLaccess::Grant::sorted_user_tmp_table= defined($MySQLaccess::Param{&#039;password&#039;}) ?
                           MySQLaccess::DB::Sort_table($USER, &#039;ucase_host&#039;, &#039;user&#039;, &#039;password&#039;):
                           MySQLaccess::DB::Sort_table($USER, &#039;ucase_host&#039;, &#039;user&#039;);
    }
    else {      #reading production grant-tables
       $HOST=$MySQLaccess::ACCESS_H;
       $DB  =$MySQLaccess::ACCESS_D;
       $USER=$MySQLaccess::ACCESS_U;

       MySQLaccess::Debug::Print(1,&quot;Finding fields in ACL files:&quot;);
       # -----------------------------
       # Get record-layout 
       my ($h1,$h2) = MySQLaccess::DB::Show_Fields($HOST);
       my ($d1,$d2) = MySQLaccess::DB::Show_Fields($DB);
       my ($u1,$u2) = MySQLaccess::DB::Show_Fields($USER);
       %MySQLaccess::Grant::H = %{$h1}; @MySQLaccess::Grant::H = @{$h2};
       %MySQLaccess::Grant::D = %{$d1}; @MySQLaccess::Grant::D = @{$d2};
       %MySQLaccess::Grant::U = %{$u1}; @MySQLaccess::Grant::U = @{$u2};

       @MySQLaccess::Grant::Privileges=@{Make_Privlist()};

       MySQLaccess::Debug::Print(1, &quot;Reading sorted tables:&quot;);
       @MySQLaccess::Grant::sorted_db_table  = MySQLaccess::DB::Sort_table($DB, &#039;ucase_host&#039;, &#039;user&#039;, &#039;db&#039;);
       @MySQLaccess::Grant::sorted_host_table= MySQLaccess::DB::Sort_table($HOST, &#039;ucase_host&#039;, &#039;db&#039;);
       @MySQLaccess::Grant::sorted_user_table= defined($MySQLaccess::Param{&#039;password&#039;}) ?
                           MySQLaccess::DB::Sort_table($USER, &#039;ucase_host&#039;, &#039;user&#039;, &#039;password&#039;):
                           MySQLaccess::DB::Sort_table($USER, &#039;ucase_host&#039;, &#039;user&#039;);
    }

    return 0;
}

# ===========================================================
# sub Get_Access_Rights(host,user,db)
#  report the access_rights for the tuple ($host,$user,$db).
# ===========================================================
sub Get_Access_Rights {
  local ($host,$user,$db,$tmp) = @_;

   my $aref_user;
   my $aref_host;
   my $aref_db;
   # working with  temporary tables or production tables
   if (defined($tmp) and $tmp) {
      $aref_user = \@MySQLaccess::Grant::sorted_user_tmp_table;
      $aref_host = \@MySQLaccess::Grant::sorted_host_tmp_table;
      $aref_db   = \@MySQLaccess::Grant::sorted_db_tmp_table;   
   }
   else {
      $aref_user = \@MySQLaccess::Grant::sorted_user_table;
      $aref_host = \@MySQLaccess::Grant::sorted_host_table;
      $aref_db   = \@MySQLaccess::Grant::sorted_db_table; 
   }


  my ($refrecord,$refgrant);
  my ($_host_,$_user_,$encpw_);
  my %_Access_;

  MySQLaccess::Debug::Print(1, &quot;for ($host,$user,$db):&quot;);  

  # ******************************************************************************
  # Create default access-rights
  #   default access-rights are no access at all!!


  # ******************************************************************************
  # get hostname for IP-address
  # get IP-address for hostname
  local $host_name = MySQLaccess::Host::IP2Name($host);
  local $host_ip   = MySQLaccess::Host::Name2IP($host);

  MySQLaccess::Debug::Print(3,&quot;host=$host, hostname=$host_name, host-ip =$host_ip&quot;);
  MySQLaccess::Debug::Print(3,&quot;user=$user&quot;);
  MySQLaccess::Debug::Print(3,&quot;db  =$db&quot;);

  # ***********************************************************************
  # retrieve information on USER
  #  check all records in mysql::user for matches with the tuple (host,user)
  # ***********************************************************************
  #    4.OR (add) the privileges for the user from the &quot;user&quot; table.
  #     (add all privileges which is &quot;Y&quot; in &quot;user&quot;)
  ($refrecord,$refgrant)    = Get_grant_from_user($host,$user,$aref_user);
  ($_host_,$_user_,$encpw_) = @{$refrecord};
  %_access_                 = %{$refgrant};

  foreach $field (keys(%U)) { ##only priv. set in user-table
    $MySQLaccess::Grant::Access{$field} = ($MySQLaccess::Grant::Access{$field} or $_access_{$field});
  }

  if ($_user_ eq $MySQLaccess::NEW_USER) { 
     push(@Warnings,&#039;minimum_priv&#039;);
  }
  if ($_user_ ne $user) {
     $user=$_user_;
     push(@Warnings,&#039;anonymous_access&#039;);
  }

  # *******************************************************
  #  Validate password if this has been asked to do
  # *******************************************************
  if (defined($password)) {
     $valid = Validate_Password($password,$_host_,$_user_,$_encpw_,$aref_user);
     if (!$valid) { push(@Errors,&#039;invalid_password&#039;); }
     else         { push(@Notes,&#039;valid_password&#039;); }
  }

  # ******************************************************************************
  # retrieve information on DB
  #  check all records in mysql::db for matches with the triple (host,db,user)
  #  first match is used.
  # ******************************************************************************
  #    2.Get grant for user from the &quot;db&quot; table.

  ($refrecord,$refgrant)=Get_grant_from_db($host,$db,$user,$aref_db); #set process_host_table
  ($_host_,$_user_,$encpw_) = @{$refrecord};
  %_access_                 = %{$refgrant};

  foreach $field (keys(%D)) { ##only priv. set in db-table
    $MySQLaccess::Grant::Access{$field} = ($MySQLaccess::Grant::Access{$field} or $_access_{$field});
  }

  # ***********************************************************************
  # retrieve information on HOST
  #  check all records in mysql::host for matches with the tuple (host,db)
  #
  #  &#039; The host table is mainly to maintain a list of &quot;secure&quot; servers. &#039;
  # ***********************************************************************
  #    3.If hostname is &quot;empty&quot; for the found entry, AND the privileges with
  #      the privileges for the host in &quot;host&quot; table.
  #      (Remove all which is not &quot;Y&quot; in both)

  if ($MySQLaccess::Grant::process_host_table) {
     ($refrecord,$refgrant)=Get_grant_from_host($host,$db,$aref_host);
     ($_host_,$_user_,$encpw_) = @{$refrecord};
     %_access_                 = %{$refgrant};

     foreach $field (keys(%H)) {  ##only priv. set in host-table 
       $MySQLaccess::Grant::Access{$field} = ($MySQLaccess::Grant::Access{$field} and $_access_{$field});
     } 
  }

  MySQLaccess::Debug::Print(1,&quot;done for ($host,$user,$db)&quot;);
  return %MySQLaccess::Grant::Access;
}

# ####################################
# FINDING THE RIGHT GRANT-RULE
# ==========================================================
# sub Get_grant_from_user:
# ==========================================================
sub Get_grant_from_user {
  my ($host,$user,$aref) = @_;

  MySQLaccess::Debug::Print(1, &quot;&quot;);
  MySQLaccess::Debug::Print(1, &quot;(host=$host,user=$user)&quot;);

  my %Access_user = %{Default_Access_Rights()}; 

  my $rule_found=0;
  my @record = ();
  my $record;

  foreach $record (@{$aref}) {
    $MySQLaccess::Grant::full_access=0;
    MySQLaccess::Debug::Print(3, &quot;Record= $record&quot;);
    @record=split(/\t/,$record);

    # check host and db
    # with possible wildcards in field
    # replace mysql-wildcards by reg-wildcards
    my $host_tpl = MySQLaccess::Wildcards::SQL2Reg($record[0]);
    my $user_tpl = $record[1]; #user field isn&#039;t pattern-matched!!
    my $passwd   = $record[2];

    MySQLaccess::Debug::Print(3, &quot;=&gt;host_tpl : read=$record[0] -&gt; converted=$host_tpl&quot;);
    MySQLaccess::Debug::Print(3, &quot;=&gt;user_tpl : read=$record[1] -&gt; $user_tpl&quot;);
    MySQLaccess::Debug::Print(3, &quot;=&gt;password : read=$record[2] -&gt; $passwd&quot;);


    if ( MySQLaccess::Host::MatchTemplate($host,$host_tpl) and
         MySQLaccess::Wildcards::MatchTemplate($user_tpl,$user)
       ) 
    {
  MySQLaccess::Debug::Print(2, &quot;FOUND!!&quot;);
        if ($passwd eq &#039;&#039;) { push(@Warnings,&#039;insecure_user&#039;);  }
        else               { push(@Notes,&#039;password_required&#039;); }

        foreach $field (keys(%U)) {
          $Access_user{$field} = $MySQLaccess::Report::Answer{$record[$U{$field}]};
        }
        #print &quot;\n&quot; if $DEBUG;
        $MySQLaccess::Grant::Rules{&#039;user&#039;} = $record;
        $rule_found=1;
        last;
    }
  }

  # -------------------------------
  #  setting privileges to user-priv
  MySQLaccess::Debug::Print(2, &quot;Rights after parsing user-table..:&quot;);
  if (! $rule_found ) {
     @record=();
     MySQLaccess::Debug::Print(2, &quot;NO record found in the user-table!!&quot;);
  }
  else {
     MySQLaccess::Debug::Print(2, &quot;Selected record=@record&quot;);
     MySQLaccess::Debug::Print(2, &quot;&lt;=?=&gt; $record&quot;);
  }
 
  MySQLaccess::Debug::Print(1, &quot;returning @record&quot;);

  return (\@record,\%Access_user); #matching record in user-table
}

# ==========================================================
# sub Get_grant_from_db:
# ==========================================================
sub Get_grant_from_db {
  my ($host,$db,$user,$aref) = @_;

  MySQLaccess::Debug::Print(1, &quot;(host=$host,user=$user,db=$db)&quot;);

  my %Access_db    = %{Default_Access_Rights()};
  my $rule_found=0;

  foreach $record (@{$aref}) {
    $full_access=0;
    MySQLaccess::Debug::Print(2, &quot;Read db: $record&quot;);
    @record=split(/\t/,$record);

    # check host and db
    # with possible wildcards in field
    # replace mysql-wildcards by reg-wildcards
    my $host_tpl = MySQLaccess::Wildcards::SQL2Reg($record[0]);
    my $db_tpl   = MySQLaccess::Wildcards::SQL2Reg($record[1]);
    my $user_tpl = $record[2]; #user field isn&#039;t pattern matched!!
    MySQLaccess::Debug::Print(3, &quot;=&gt;host_tpl : read=$record[0] -&gt; converted=$host_tpl&quot;);
    MySQLaccess::Debug::Print(3, &quot;=&gt;db_tpl   : read=$record[1] -&gt; $db_tpl&quot;);
    MySQLaccess::Debug::Print(3, &quot;=&gt;user_tpl : read=$record[2] -&gt; $user_tpl&quot;);

    if ( ( MySQLaccess::Host::Is_localhost($host_tpl)
           or  MySQLaccess::Wildcards::MatchTemplate($host_tpl,$host_name)
           or  MySQLaccess::Wildcards::MatchTemplate($host_tpl,$host_ip) )
         and ( MySQLaccess::Wildcards::MatchTemplate($db_tpl,$db) )
         and ( MySQLaccess::Wildcards::MatchTemplate($user_tpl,$user) ) ) {
 
      $MySQLaccess::Grant::process_host_table = ($record[0] eq &#039;&#039;);

      if ($user_tpl eq &#039;&#039;) { push(@Warnings,&#039;public_database&#039;); }

      foreach $field (keys(%D)) {
        $Access_db{$field} = $MySQLaccess::Report::Answer{$record[$D{$field}]};
      }
      $rule_found=1;
      $MySQLaccess::Grant::Rules{&#039;db&#039;} = $record;
      last;
    }
  }

  # -------------------------------
  #  setting privileges to db-priv
  MySQLaccess::Debug::Print(2, &quot;Rights after parsing db-table..:&quot;);
  if (! $rule_found ) {
    MySQLaccess::Debug::Print(2, &quot;NO rule found in db-table =&gt; no access granted!!&quot;);
  }

  return (\@record,\%Access_db);
}

# ==========================================================
# sub Get_grant_from_host:
# ==========================================================
sub Get_grant_from_host {
  my ($host,$db,$aref) = @_;

  MySQLaccess::Debug::Print(1, &quot;Get_grant_from_host()&quot;);

  my %Access_host = %{Default_Access_Rights()};

  # the host-table doesn&#039;t have to be processed if the host-field
  # in the db-table isn&#039;t empty
  if (!$MySQLaccess::Grant::process_host_table) {
    MySQLaccess::Debug::Print(2, &quot;&gt;&gt; Host-table doesn&#039;t have to be processed!!&quot;);
    $MySQLaccess::Grant::Rules{&#039;host&#039;} = &#039;no_equiv_host&#039;;
    return ([],\%Access_host);
  }

  my $rule_found=0;
  my @record = ();

  foreach $record (@{$aref}) {
    $full_access=0;
    MySQLaccess::Debug::Print(2, &quot;host: $record&quot;);
    @record=split(/\t/,$record);

    # check host and db
    # with possible wildcards in field
    # replace mysql-wildcards by reg-wildcards
    my $host_tpl = MySQLaccess::Wildcards::SQL2Reg($record[0]);
    my $db_tpl   = MySQLaccess::Wildcards::SQL2Reg($record[1]);
    MySQLaccess::Debug::Print(3, &quot;=&gt;host_tpl : $record[0] -&gt; $host_tpl&quot;);
    MySQLaccess::Debug::Print(3, &quot;=&gt;db_tpl   : $record[1] -&gt; $db_tpl&quot;);

    if ( ( MySQLaccess::Host::Is_localhost($host_tpl)
           or MySQLaccess::Wildcards::MatchTemplate($host_tpl,$host_name)
           or MySQLaccess::Wildcards::MatchTemplate($host_tpl,$host_ip) )
         and ( MySQLaccess::Wildcards::MatchTemplate($db_tpl,$db) ) ) {

      $MySQLaccess::Grant::Rules{&#039;host&#039;} = $record;
      $rule_found=1;
      foreach $field (keys(%H)) {
        $Access_host{$field} = $MySQLaccess::Report::Answer{$record[$H{$field}]};
      }
      last;
    }
  }

  # -------------------------------
  #  setting privileges to host-priv
  MySQLaccess::Debug::Print(2, &quot;Rights after parsing host-table..:&quot;);
  if (! $rule_found ) {
     @record=();
     MySQLaccess::Debug::Print(2, &quot;NO restrictions found in the host-table!!&quot;);
  }

  # --------------------------------
  # debugging access-rights in db 

  return (\@record,\%Access_host); #matching record in host-table
}


# ===========================================================
# sub Default_Access_Rights():
#  return (a reference to) a hash which holds all default
#  priviliges currently defined in the grant-tables.
# ===========================================================
sub Default_Access_Rights {
    my %right = ();

    MySQLaccess::Debug::Print(2, &quot;Debug Default_Access_Rights():&quot;);
    # add entry for all fields in the HOST-table
    foreach $field (keys(%MySQLaccess::Grant::H)) {
	$right{$field}=&#039;0&#039; unless (defined($right{$field}));
    }
    # add entry for all fields in the DB-table
    foreach $field (keys(%MySQLaccess::Grant::D)) {
	$right{$field}=&#039;0&#039; unless (defined($right{$field}));
    }
    # add entry for all fields in the USER-table
    foreach $field (keys(%MySQLaccess::Grant::U)) {
	$right{$field}=&#039;0&#039; unless (defined($right{$field}));
    }
    # --------------
    # debugging info
    foreach $field (keys(%right)) { MySQLaccess::Debug::Print(3, sprintf(&quot;&gt; %15s : %1s&quot;,$field,$right{$field})); }

    return \%right;
}

# ======================================
# sub Make_Privlist
#  Make an ordered list of the privileges
#  that should be reported
# ======================================
sub Make_Privlist {
    # layout:
    #&#039;select_priv&#039;,     &#039;create_priv&#039;,
    #&#039;insert_priv&#039;,     &#039;drop_priv&#039;,
    #&#039;update_priv&#039;,     &#039;reload_priv&#039;,
    #&#039;delete_priv&#039;,     &#039;process_priv&#039;,
    #&#039;file_priv&#039;,       &#039;shutdown_priv&#039;);
    my $right;
    my @privlist=();
    foreach $right (@U) {
	if (! grep(/$right/,@privlist)) { push(@privlist,$right); }
    };
    foreach $right (@D) {
	if (! grep(/$right/,@privlist)) { push(@privlist,$right); }
    };
    foreach $right (@H) {
	if (! grep(/$right/,@privlist)) { push(@privlist,$right); }
    };
#       print &quot;Privileges:\n&quot;;
#       foreach $field (@privlist) { print &quot; &gt; $field\n&quot;; }
    return \@privlist;
}


########################################################################
package MySQLaccess::Report;
use Exporter ();
@EXPORT = qw(&amp;Print_Header());
BEGIN {
    $FORM = $ENV{&#039;SCRIPT_NAME&#039;};
    $DEBUG     = 0;
    $DEBUG     = $MySQLaccess::DEBUG unless ($DEBUG);

    # translation-table for poss. answers
    %Answer =  (&#039;Y&#039; =&gt;  1 , &#039;N&#039; =&gt;  0
               , 1  =&gt; &#039;Y&#039;,  0  =&gt; &#039;N&#039;
               ,&#039;?&#039; =&gt; &#039;?&#039;, &#039;&#039;  =&gt; &#039;?&#039;
               );
    $headers   = 0;
    $separator = 0;

# ****************************
# Notes and warnings
%MESSAGES = ( 
  &#039;insecure_user&#039; 
   =&gt; &quot;Everybody can access your DB as user `\$user&#039; from host `\$host&#039;\n&quot;
     .&quot;WITHOUT supplying a password.\n&quot;
     .&quot;Be very careful about it!!&quot;
 ,&#039;password_required&#039; 
   =&gt; &quot;A password is required for user `\$user&#039; :-(&quot;
 ,&#039;invalid_password&#039;
   =&gt; &quot;The password &#039;\$password&#039; for user `\$user&#039; is invalid :-P&quot;
 , &#039;valid_password&#039;
   =&gt; &quot;You supplied the right password for user `\$user&#039; :-)&quot;
 ,&#039;public_database&#039; 
   =&gt; &quot;Any user with the appropriate permissions has access to your DB!\n&quot;
     .&quot;Check your users!&quot;
 ,&#039;full_access&#039; 
   =&gt; &quot;All grant-tables are empty, which gives full access to ALL users !!&quot;
 ,&#039;no_rule_found&#039;
   =&gt; &quot;No matching rule&quot;
 ,&#039;no_equiv_host&#039; 
   =&gt; &quot;Not processed: host-field is not empty in db-table.&quot;
 ,&#039;least_priv&#039;
   =&gt; &quot;If the final priveliges of the user are more then you gave the user,\n&quot;
     .&quot;check the priveliges in the db-table `\$db&#039;.&quot;
 ,&#039;minimum_priv&#039;
   =&gt; &quot;The privileges for any new user are AT LEAST\n&quot;
     .&quot;the ones shown in the table above,\n&quot;
     .&quot;since these are the privileges of the db `\$db&#039;.\n&quot;
 ,&#039;not_found_mysql&#039;
   =&gt; &quot;The MySQL client program &lt;$MySQLaccess::MYSQL&gt; could not be found.\n&quot;
     .&quot;+ Check your path, or\n&quot;
     .&quot;+ edit the source of this script to point \$MYSQL to the mysql client.\n&quot;
 ,&#039;not_found_mysqldump&#039;
   =&gt; &quot;The MySQL dump program &lt;$MySQLaccess::MYSQLDUMP&gt; could not be found.\n&quot;
     .&quot;+ Check your path, or\n&quot;
     .&quot;+ edit the source of this script to point \$MYSQLDUMP to the mysqldump program.\n&quot;
 ,&#039;not_found_diff&#039;
   =&gt; &quot;The diff program &lt;$MySQLaccess::DIFF&gt; could not be found.\n&quot;
     .&quot;+ Check your path, or\n&quot;
     .&quot;+ edit the source of this script to point \$DIFF to the diff program.\n&quot;
 ,&#039;Unrecognized_option&#039;
   =&gt; &quot;Sorry,\n&quot;
     .&quot;You are using an old version of the mysql-program,\n&quot;
     .&quot;which does not yet implement a neccessary option.\n&quot;
     .&quot;\n&quot;
     .&quot;You need at least Version 6.2 of the mysql-client,\n&quot;
     .&quot;which was build in MySQL v3.0.18, to use this version\n&quot;
     .&quot;of `$MySQLaccess::script&#039;.&quot;
 ,&#039;Access_denied&#039;
   =&gt; &quot;Sorry,\n&quot;
     .&quot;An error occurred when trying to connect to the database\n&quot;
     .&quot;with the grant-tables:\n&quot;
     .&quot;* Maybe YOU do not have READ-access to this database?\n&quot;
     .&quot;* If you used the -U option, you may have supplied an invalid username?\n&quot;
     .&quot;  for the superuser?\n&quot;
     .&quot;* If you used the -U option, it may be possible you have to supply\n&quot;
     .&quot;  a superuser-password to, with the -P option?\n&quot;
     .&quot;* If you used the -P option, you may have supplied an invalid password?\n&quot;
 ,&#039;Dbaccess_denied&#039;
   =&gt; &quot;Sorry,\n&quot;
     .&quot;An error occurred when trying to connect to the database\n&quot;
     .&quot;with the grant-tables. (dbaccess denied)\n&quot;
 ,&#039;Unknown_tmp_table&#039;
   =&gt; &quot;Sorry,\n&quot;
     .&quot;An error occurred when trying to work with the temporary tables in the database\n&quot;
     .&quot;with the grant-tables. (One of the temporary tables does not exist)\n&quot;
 ,&#039;Unknown_table&#039;
   =&gt; &quot;Sorry,\n&quot;
     .&quot;An error occurred when trying to work with some tables in the database\n&quot;
     .&quot;with the grant-tables. (table does not exist)\n&quot;
 ,&#039;use_old_server&#039;
   =&gt; &quot;Sorry,\n&quot;
     .&quot;An error occurred when executing an SQL statement.\n&quot;
     .&quot;You might consider altering the use of the parameter `--old_server&#039; when \n&quot;
     .&quot;calling `$MySQLaccess::script&#039;.&quot;
 ,&#039;unknown_error&#039;
   =&gt; &quot;Sorry,\n&quot;
     .&quot;An error occurred when trying to connect to the database\n&quot;
     .&quot;with the grant-tables. (unknown error)\n&quot;
 ,&#039;anonymous_access&#039;
   =&gt; &quot;Accessing the db as an anonymous user.\n&quot;
     .&quot;Your username has no relevance\n&quot;
 ,&#039;user_required&#039;
   =&gt; &quot;You have to supply a userid.&quot;
 ,&#039;db_required&#039;
   =&gt; &quot;You have to supply the name of a database.&quot;
 ,&#039;host_required&#039;
   =&gt; &quot;You have to supply the name of a host.&quot;
 );


} 
# =====================================
# sub Print_Header:
#  print header info
# =====================================
sub Print_Header {
    if ($MySQLaccess::CMD) { #command-line mode
    print &quot;$MySQLaccess::script Version $MySQLaccess::VERSION\n&quot;
         .&quot;By RUG-AIV, by Yves Carlier (Yves.Carlier\@rug.ac.be)\n&quot;
         .&quot;Changes by Steve Harvey (sgh\@vex.net)\n&quot;
         .&quot;This software comes with ABSOLUTELY NO WARRANTY.\n&quot;;
    }
    if ($MySQLaccess::CGI) { #CGI-BIN mode
    print &quot;content-type: text/html\n\n&quot; 
       . &quot;&lt;HTML&gt;\n&quot;
         .&quot;&lt;HEAD&gt;\n&quot;
         .&quot;&lt;TITLE&gt;MySQLaccess&lt;/TITLE&gt;\n&quot;
         .&quot;&lt;/HEAD&gt;\n&quot;
         .&quot;&lt;BODY&gt;\n&quot;
         .&quot;&lt;H1&gt;$MySQLaccess::script Version $MySQLaccess::VERSION&lt;/H1&gt;\n&quot; 
         .&quot;&lt;CENTER&gt;\n&lt;ADDRESS&gt;\n&quot;
         .&quot;By RUG-AIV, by Yves Carlier (&lt;a href=mailto:Yves.Carlier\@rug.ac.be&gt;Yves.Carlier\@rug.ac.be&lt;/a&gt;)&lt;BR&gt;\n&quot;
         .&quot;Changes by Steve Harvey (&lt;a href=mailto:sgh\@vex.net&gt;sgh\@vex.net&lt;/a&gt;)&lt;BR&gt;\n&quot;
         .&quot;This software comes with ABSOLUTELY NO WARRANTY.&lt;BR&gt;\n&quot;
         .&quot;&lt;/ADDRESS&gt;\n&lt;/CENTER&gt;\n&quot;
         .&quot;&lt;HR&gt;\n&quot;;
    Print_Taskbar();
    print &quot;&lt;HR&gt;\n&quot;;
    }
    return 1;
}

# =====================================
# sub Print_Footer:
#  print footer info
# =====================================
sub Print_Footer {
    if ($MySQLaccess::CMD) { #command-line mode
    print &quot;\n&quot;
         .&quot;BUGs can be reported at https://jira.mariadb.org\n&quot;;
    }
    if ($MySQLaccess::CGI) { #CGI-BIN mode
    if ($MySQLaccess::Param{&#039;brief&#039;}) {
    print &quot;&lt;/table&gt;\n&quot;;  #close table in brief-output
    }
    print &quot;&lt;HR&gt;\n&quot;
         .&quot;&lt;ADDRESS&gt;\n&quot;
         .&quot;BUGs can be reported at &lt;a href=\&quot;https://jira.mariadb.org\&quot;&gt;MariaDB JIRA&lt;/a&gt;&lt;BR&gt;\n&quot;
#         .&quot;Don&#039;t forget to mention the version $VERSION!&lt;BR&gt;\n&quot;
         .&quot;&lt;/ADDRESS&gt;\n&quot;
         .&quot;&lt;/BODY&gt;\n&quot;
         .&quot;&lt;/HTML&gt;\n&quot;;
    }
    return 1;
}

# =====================================
# sub Print_Taskbar:
#  print taskbar on STDOUT
# =====================================
sub Print_Taskbar {
    print &quot;&lt;CENTER&gt;\n&quot;
         .&quot;[&lt;a href=$FORM?relnotes=on&gt;Release&amp;nbsp;Notes&lt;/a&gt;] \n&quot;
         .&quot;[&lt;a href=$FORM?version=on&gt;Version&lt;/a&gt;] \n&quot;
         .&quot;[&lt;a href=$FORM?plan=on&gt;Future&amp;nbsp;Plans&lt;/a&gt;] \n&quot;
         .&quot;[&lt;a href=$FORM?howto=on&gt;Examples&lt;/a&gt;] \n&quot;
         .&quot;[&lt;a href=$FORM?help=on&gt;New check&lt;/a&gt;] \n&quot;
         .&quot;[&lt;a href=$FORM?edit=on&gt;Change/edit ACL&lt;/a&gt;] \n&quot;
         .&quot;&lt;/CENTER&gt;\n&quot;;
    return 1;
}

# =====================================
# sub Print_Form:
#  print CGI-form
# =====================================
sub Print_Form {
print &lt;&lt;EOForm;
&lt;center&gt;
&lt;!-- Quering --&gt;
&lt;FORM method=POST action=$FORM&gt;

&lt;table border width=&quot;100%&quot; &gt;
&lt;tr&gt;
  &lt;th&gt;MySQL server&lt;/th&gt;
  &lt;th&gt;User information&lt;/th&gt;
  &lt;th&gt;Reports&lt;/th&gt;
  &lt;/tr&gt;

&lt;tr&gt;
  &lt;td valign=top&gt;
  &lt;table&gt;
  &lt;tr&gt;
    &lt;td halign=right&gt;&lt;b&gt;Host&lt;/b&gt;&lt;br&gt;&lt;font size=-2&gt;(Host on which MySQL-server resides.)&lt;/font&gt;&lt;/td&gt;
    &lt;td valign=top&gt;&lt;INPUT name=rhost type=text size=15 maxlength=15 value=&quot;$MySQLaccess::Param{&#039;rhost&#039;}&quot;&gt;&lt;/td&gt;
    &lt;/tr&gt;
  &lt;tr&gt;
    &lt;td halign=right&gt;&lt;b&gt;Superuser&lt;/b&gt;&lt;br&gt;&lt;font size=-2&gt;(User which has &lt;font color=&quot;Red&quot;&gt;read-access&lt;/font&gt; to grant-tables.)&lt;/font&gt;&lt;/td&gt;
    &lt;td valign=top&gt;&lt;INPUT name=superuser type=text size=15 maxlength=15 value=&quot;$MySQLaccess::Param{&#039;superuser&#039;}&quot;&gt;&lt;/td&gt;
    &lt;/tr&gt;
  &lt;tr&gt;
    &lt;td halign=right&gt;&lt;b&gt;Password&lt;/b&gt;&lt;br&gt;&lt;font size=-2&gt;(of Superuser.)&lt;/font&gt;&lt;/td&gt;
    &lt;td valign=top&gt;&lt;INPUT name=spassword type=password size=15 maxlength=15 value=&quot;$MySQLaccess::Param{&#039;spassword&#039;}&quot;&gt;&lt;/td&gt;
    &lt;/tr&gt;
  &lt;/table&gt;
  &lt;/td&gt;

  &lt;td valign=top&gt;
  &lt;table&gt;
  &lt;tr&gt;
    &lt;td halign=right&gt;&lt;b&gt;&lt;font color=Red&gt;User&lt;/font&gt;&lt;/b&gt;&lt;br&gt;&lt;font size=-2&gt;(Userid used to connect to MySQL-database.)&lt;/font&gt;&lt;/td&gt;
    &lt;td halign=top&gt;&lt;INPUT name=user type=text size=15 maxlength=15 value=&quot;$MySQLaccess::Param{&#039;user&#039;}&quot;&gt;&lt;/td&gt;
    &lt;/tr&gt;
  &lt;tr&gt;
    &lt;td halign=right&gt;&lt;b&gt;Password&lt;/b&gt;&lt;br&gt;&lt;font size=-2&gt;(Password user has to give to get access to MySQL-database.)&lt;/font&gt;&lt;/td&gt;
    &lt;td valign=top&gt;&lt;INPUT name=password type=password size=15 maxlength=15 value=&quot;$MySQLaccess::Param{&#039;password&#039;}&quot;&gt;&lt;/td&gt;
    &lt;/tr&gt;
  &lt;tr&gt;
    &lt;td halign=right&gt;&lt;b&gt;&lt;font color=Red&gt;Database&lt;/font&gt;&lt;/b&gt;&lt;br&gt;&lt;font size=-2&gt;(Name of MySQL-database user tries to connect to.&lt;/font&gt;&lt;br&gt;&lt;font size=-2&gt;Wildcards &lt;font color=&quot;Green&quot;&gt;(*,?,%,_)&lt;/font&gt; are allowed.)&lt;/font&gt;&lt;/td&gt;
    &lt;td valign=top&gt;&lt;INPUT name=db type=text size=15 maxlength=15 value=&quot;$MySQLaccess::Param{&#039;db&#039;}&quot;&gt;&lt;/td&gt;
    &lt;/tr&gt;
  &lt;tr&gt;
    &lt;td halign=right&gt;&lt;b&gt;Host&lt;/b&gt;&lt;br&gt;&lt;font size=-2&gt;(Host from where the user is trying to connect to MySQL-database.&lt;/font&gt;&lt;br&gt;&lt;font size=-2&gt;Wildcards &lt;font color=&quot;Green&quot;&gt;(*,?,%,_)&lt;/font&gt; are allowed.)&lt;/font&gt;&lt;/td&gt;
    &lt;td valign=top&gt;&lt;INPUT name=host type=text size=15 maxlength=15 value=&quot;$MySQLaccess::Param{&#039;host&#039;}&quot;&gt;&lt;/td&gt;
    &lt;/tr&gt;
  &lt;/table&gt;
  &lt;/td&gt;

  &lt;td valign=center&gt;
  &lt;table cellspacing=5 cellpadding=2 cols=1 height=&quot;100%&quot;&gt;
  &lt;tr align=center&gt;
    &lt;td halign=right&gt;&lt;INPUT type=submit name=brief value=&quot;Brief&quot;&gt;&lt;br&gt;
                     &lt;INPUT type=submit name=table value=&quot;Tabular&quot;&gt;&lt;/td&gt;
    &lt;/tr&gt;
  &lt;tr align=center&gt;
    &lt;td&gt;&lt;/td&gt;
    &lt;/tr&gt;
  &lt;tr align=center&gt;
    &lt;td halign=right&gt;&lt;INPUT type=reset value=&quot;Clear&quot;&gt;&lt;/td&gt;
    &lt;/tr&gt;
  &lt;/table&gt;
  &lt;/td&gt;
  &lt;/tr&gt;

&lt;/table&gt;
&lt;/form&gt;


&lt;/BODY&gt;
&lt;/HTML&gt;
EOForm
    return 1;
}

# =====================================
# sub Print_Usage:
#  print some information on STDOUT
# =====================================
sub Print_Usage {
    Print_Error_Messages();
    if ($MySQLaccess::CMD) { #command-line mode
        Print_Options();
    }
    if ($MySQLaccess::CGI) { #CGI-BIN mode
        Print_Form();
    }    
    return 1;
}

# ======================================
# sub Print_Version:
# ======================================
sub Print_Version {
    if ($MySQLaccess::CMD) {
       print $MySQLaccess::INFO;
    }
    if ($MySQLaccess::CGI) { 
       print &quot;&lt;PRE&gt;\n&quot;; 
       print $MySQLaccess::INFO;
       print &quot;&lt;/PRE&gt;\n&quot;; 
    }
    return 1;
}

# ======================================
# sub Print_Relnotes:
# ======================================
sub Print_Relnotes {
    if ($MySQLaccess::CMD) {
       print $MySQLaccess::RELEASE;
    }
    if ($MySQLaccess::CGI) { 
       print &quot;&lt;PRE&gt;\n&quot;;
       print $MySQLaccess::RELEASE;
       print &quot;&lt;/PRE&gt;\n&quot;; 
    }
    return 1;
}

# ======================================
# sub Print_Plans:
# ======================================
sub Print_Plans {
    if ($MySQLaccess::CMD) {
       print $MySQLaccess::TODO;
    }
    if ($MySQLaccess::CGI) { 
       print &quot;&lt;PRE&gt;\n&quot;;
       print $MySQLaccess::TODO;
       print &quot;&lt;/PRE&gt;\n&quot;; 
    }
    return 1;
}

# ======================================
# sub Print_HowTo:
# ======================================
sub Print_HowTo {
    if ($MySQLaccess::CMD) {
       print $MySQLaccess::HOWTO;
    }
    if ($MySQLaccess::CGI) { 
       print &quot;&lt;PRE&gt;\n&quot;; 
       print $MySQLaccess::HOWTO;
       print &quot;&lt;/PRE&gt;\n&quot;; 
    }
    return 1;
}

# ======================================
# sub Print_Options:
# ======================================
sub Print_Options {
    if ($MySQLaccess::CGI) { print &quot;&lt;PRE&gt;\n&quot;; }
    print $MySQLaccess::OPTIONS;
    if ($MySQLaccess::CGI) { print &quot;&lt;/PRE&gt;\n&quot;; }
    return 1;
}

# ======================================
# sub Print_Error_Access:
# ======================================
sub Print_Error_Access {
    my ($error) = @_;
    print &quot;\n&quot;;
    if ($MySQLaccess::CGI) { print &quot;&lt;font color=Red&gt;\n&lt;PRE&gt;\n&quot;; }
    print $MESSAGES{$error};
    if ($MySQLaccess::CGI) { print &quot;&lt;/PRE&gt;\n&lt;/font&gt;\n&quot;; }
    print &quot;\n&quot;;
    return 1;
}

# ======================================
# sub Print_Error_Messages:
# ======================================
sub Print_Error_Messages {
#    my ($error) = @_;
    print &quot;\n&quot;;
    if ($MySQLaccess::CGI) { print &quot;&lt;font color=Red&gt;\n&lt;center&gt;\n&quot;; }
    foreach $error (@MySQLaccess::Grant::Error) {
       print $MESSAGES{$error};
       print $MySQLaccess::CGI ? &quot;&lt;br&gt;\n&quot; : &quot;\n&quot;;
    }
    if ($MySQLaccess::CGI) { print &quot;&lt;/center&gt;\n&lt;/font&gt;\n&quot;; }
    print &quot;\n&quot;;
    return 1;
}

# ======================================
# sub Print_Message:
# ======================================
sub Print_Message {
    my ($aref) = @_;
    my @messages = @{$aref};
    print &quot;\n&quot;;
    if ($MySQLaccess::CGI) { print &quot;&lt;font color=DarkGreen&gt;\n&lt;center&gt;\n&quot;; }
    foreach $msg (@messages) {
       print $msg;
       print $MySQLaccess::CGI ? &quot;&lt;br&gt;\n&quot; : &quot;\n&quot;;
    }
    if ($MySQLaccess::CGI) { print &quot;&lt;/center&gt;\n&lt;/font&gt;\n&quot;; }
    print &quot;\n&quot;;
    return 1;
}

# ======================================
# sub Print_Edit:
# ======================================
sub Print_Edit {
    print &quot;\n&quot;;
    if (!$MySQLaccess::CGI) { 
       print &quot;Note: Editing the temporary tables is NOT supported in CMD-line mode!\n&quot;;
       return 0;
    }
    print &quot;&lt;CENTER&gt;\n&quot;
         .&quot;&lt;form action=$FORM method=GET&gt;\n&quot;
         .&quot;&lt;table width=90% border&gt;\n&quot;
         .&quot;&lt;tr&gt;\n&quot;
         .&quot; &lt;td&gt;&lt;input type=checkbox name=copy value=on&gt; Copy grant-rules to temporary tables&lt;br&gt;&lt;/td&gt;\n&quot;
         .&quot; &lt;td rowspan=5 align=center valign=center&gt;&lt;input type=submit value=Go&gt;&lt;/td&gt;\n&quot;
         .&quot;&lt;/tr&gt;\n&quot;
         .&quot;&lt;tr&gt;\n&quot;
         .&quot; &lt;td&gt; Edit temporary tables with external application:&lt;br&gt;&quot;
         .&quot; &lt;a href=\&quot;$MySQLaccess::MYSQLADMIN\&quot;&gt;$MySQLaccess::MYSQLADMIN&lt;/a&gt;&lt;/td&gt;\n&quot;
         .&quot;&lt;/tr&gt;\n&quot;
         .&quot;&lt;tr&gt;\n&quot;
         .&quot; &lt;td&gt;&lt;input type=checkbox name=preview value=on&gt; Preview changes made in temporary tables&lt;/td&gt;\n&quot;
         .&quot;&lt;/tr&gt;\n&quot;
         .&quot;&lt;tr&gt;\n&quot;
         .&quot; &lt;td&gt;&lt;input type=checkbox name=commit value=on&gt; Make changes permanent&lt;/td&gt;\n&quot;
         .&quot;&lt;/tr&gt;\n&quot;
         .&quot;&lt;tr&gt;\n&quot;
         .&quot; &lt;td&gt;&lt;input type=checkbox name=rollback value=on&gt; Restore previous grand-rules&lt;/td&gt;\n&quot;
         .&quot;&lt;/tr&gt;\n&quot;
         .&quot;&lt;tr&gt;\n&quot;
         .&quot; &lt;td colspan=2 align=center&gt;&lt;font size=-2 color=Red&gt;You need write,delete and drop-privileges to perform the above actions&lt;/font&gt;&lt;/td&gt;\n&quot;
         .&quot;&lt;/tr&gt;\n&quot;
         .&quot;&lt;/table&gt;\n&quot;
         .&quot;&lt;/form&gt;\n&quot;
         .&quot;&lt;/CENTER&gt;\n&quot;;

    return 1;
}


# ======================================
# sub Print_Access_rights:
#  print the access-rights on STDOUT
# ======================================
sub Print_Access_rights {
    my ($host,$user,$db,$refhash) = @_;

    if (defined($MySQLaccess::Param{&#039;brief&#039;})) { 
#       if ($MySQLaccess::CGI) { print &quot;&lt;PRE&gt;\n&quot;; }
       Matrix_Report($host,$user,$db,$refhash);  
#       if ($MySQLaccess::CGI) { print &quot;&lt;/PRE&gt;\n&quot;; }
    }
    else { 
       Tabular_Report($host,$user,$db,$refhash); 
       $MySQLaccess::Report::separator = $MySQLaccess::CGI ? &quot;&lt;hr&gt;&quot; : &quot;-&quot;x80;
    }
    return 1;
}

# ======================================
# sub Print_Diff_ACL:
#  print the diff. in the grants before and after
# ======================================
sub Print_Diff_ACL {
    my ($aref) = @_;
    my @diffs = @{$aref};
    my %block = ( &#039;&lt;&#039; =&gt; &#039;Before&#039;,
                  &#039;&gt;&#039; =&gt; &#039;After&#039;,
                );
    my %color = ( &#039;&lt;&#039; =&gt; &#039;Green&#039;,
                  &#039;&gt;&#039; =&gt; &#039;Red&#039;,
                ); 
    my $curblock = &#039;&#039;;

    # -----------------------------
    # create column-headers
    foreach $field (@MySQLaccess::Grant::Privileges) {
      push(@headers,substr($field,0,4));
    }

    if ($MySQLaccess::CMD) {
    print &quot;\n&quot;;
    print &quot;Differences in access-rights BEFORE and AFTER changes in grant-tables\n&quot;;
#    print &quot;---------------------------------------------------------------------\n&quot;;
      my $line1=&quot;&quot;;
      my $line2=&quot;&quot;;
      $line1 .= sprintf(&quot;| %-30s|&quot;,&#039;Host,User,DB&#039;);
      $line2 .= sprintf(&quot;+-%-30s+&quot;,&#039;-&#039; x 30);
      foreach $header (@headers) {
        $line1 .= sprintf(&quot;%-4s|&quot;,$header);
        $line2 .= sprintf(&quot;%s+&quot;,&#039;----&#039;);
      }
      print &quot;$line2\n&quot;;
      print &quot;$line1\n&quot;;
      print &quot;$line2\n&quot;;

      $format = &quot;format STDOUT = \n&quot;
              . &quot;^&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt; &quot; . &quot; @|||&quot; x 10 .&quot;\n&quot;
              . &#039;$host_user_db,@priv&#039; . &quot;\n&quot;
              . &quot;.\n&quot;;
#print $format;
      eval $format;
    }
    if ($MySQLaccess::CGI) {
    print &quot;&lt;table border width=100%&gt;\n&quot;;
    print &quot;&lt;tr&gt;\n&quot;;
    print &quot;&lt;th colspan=11&gt;&quot;;
    print &quot;Differences in access-rights &lt;font color=$color{&#039;&lt;&#039;}&gt;BEFORE&lt;/font&gt; &quot;
         .&quot;and &lt;font color=$color{&#039;&gt;&#039;}&gt;AFTER&lt;/font&gt; changes to grant-tables&lt;/font&gt;\n&quot;;
    print &quot;&lt;/th&gt;&quot;;
    print &quot;&lt;/tr&gt;\n&quot;;
    print &quot;&lt;tr&gt;\n&quot;;    
    $line1 .= sprintf(&quot;&lt;th&gt;%-20s&lt;/th&gt;&quot;,&#039;Host, User, DB&#039;);
    foreach $header (@headers) {
      $line1 .= sprintf(&quot;&lt;th&gt;%-4s&lt;/th&gt;&quot;,$header);
    }
    print &quot;$line1&lt;/tr&gt;\n&quot;;
    }

    foreach $line (@diffs) {
        $type = substr($line,0,1);
        $line = substr($line,1);
        ($host,$user,$db,@priv) = split(/,/,$line);
        if ($MySQLaccess::CMD) {
           if ($type ne $curblock) {
              $curblock = $type;
              print $block{$curblock},&quot;:\n&quot;;
           }
           #print &quot;$line\n&quot;;
           write;
        }
        if ($MySQLaccess::CGI) {
           if ($type ne $curblock) {
              $curblock = $type;
              print &quot;&lt;tr&gt;&lt;td&gt;&lt;b&gt;$block{$curblock}&lt;b&gt;&lt;/td&gt;&lt;/tr&gt;\n&quot;;
           }
           $line1=&quot;&lt;td&gt;&lt;font color=$color{$type}&gt;$host, $user, $db&lt;/font&gt;&lt;/td&gt;&quot;;
           foreach $field (@priv) {
              $line1 .= sprintf(&quot;&lt;td align=center&gt;&lt;font color=$color{$type}&gt;%-4s&lt;/font&gt;&lt;/td&gt;&quot;,$field);
           }
           print &quot;&lt;tr&gt;$line1&lt;/tr&gt;\n&quot;;
        }
    }
    print      &quot;\n&quot;;
    if ($MySQLaccess::CMD) {
    print &quot;---------------------------------------------------------------------\n&quot;;
    }
    if ($MySQLaccess::CGI) {
    print      &quot;&lt;/table&gt;&lt;br&gt;&quot;;
    }


    return 1;
}

# ======================================
# sub Tabular_Report
#  Tabular report,
#  suitable for 1 triple (host,db,user)
# ======================================
sub Tabular_Report {
    my ($host,$user,$db,$a) = @_;
    my $column=2;

    # -----------------------------
    # separator
    if ($MySQLaccess::Report::separator) { print &quot;$MySQLaccess::Report::separator\n&quot;; }
    
    # -----------------------------
    # print table of access-rights
    my $rows = int(@MySQLaccess::Grant::Privileges/2);  #round up
    my @table=();
    $j=0;
    for $i (0 .. $rows-1) {
      $table[$j]=$MySQLaccess::Grant::Privileges[$i];
      $j = $j+2;
    }
    $j=1;
    for $i ($rows .. $#MySQLaccess::Grant::Privileges) {
      $table[$j]=$MySQLaccess::Grant::Privileges[$i];
      $j = $j+2;
    }
    if ($MySQLaccess::CMD) {
    print &quot;\n&quot;;
    print &quot;Access-rights\n&quot;;
    print &quot;for USER &#039;$user&#039;, from HOST &#039;$host&#039;, to DB &#039;$db&#039;\n&quot;;
    }
    if ($MySQLaccess::CGI) {
    print &quot;&lt;table border width=100%&gt;\n&quot;;
    print &quot;&lt;tr&gt;\n&quot;;
    }
    if ($MySQLaccess::CGI) {
    print &quot;&lt;th colspan=5&gt;&quot;;
    print &quot;&lt;font color=Red&gt;Access-rights&lt;/font&gt;\n&quot;;
    print &quot;for USER &#039;&lt;font color=Green&gt;$user&lt;/font&gt;&#039;, from HOST &#039;&lt;font color=Green&gt;$host&lt;/font&gt;&#039;, to DB &#039;&lt;font color=Green&gt;$db&lt;/font&gt;&#039;\n&quot;;
    print &quot;&lt;/th&gt;&quot;;
    print &quot;&lt;/tr&gt;\n&quot;;
    print &quot;&lt;tr&gt;\n&quot;;
    }
    if ($MySQLaccess::CMD) {
    print      &quot;\t+-----------------+---+\t+-----------------+---+&quot;;
    }
    foreach $field (@table) {
        if ($MySQLaccess::CMD) {
          if ($column==2) { print &quot;\n\t&quot;; $column=1;}
          else            { print &quot;\t&quot;;   $column=2;}
          printf &quot;| %-15s | %s |&quot;,$field,$Answer{$a-&gt;{$field}}; 
        }
        if ($MySQLaccess::CGI) {
          if ($column==2) { print &quot;&lt;/tr&gt;\n&lt;tr&gt;\n&quot;; $column=1;}
          else            { print &quot;&lt;td width=10%&gt;&lt;/td&gt;&quot;;   $column=2;}
          printf &quot; &lt;td width=35%&gt;&lt;b&gt;%-15s&lt;/b&gt;&lt;/td&gt;&lt;td width=10%&gt;%s&lt;/td&gt;\n&quot;,$field,$Answer{$a-&gt;{$field}}; 
        }
    }
    print      &quot;\n&quot;;
    if ($MySQLaccess::CMD) {
    print      &quot;\t+-----------------+---+\t+-----------------+---+\n&quot;;
    }
    if ($MySQLaccess::CGI) {
    print      &quot;&lt;/tr&gt;\n&lt;/table&gt;&lt;br&gt;&quot;;
    }

    # ---------------
    # print notes:
    foreach $note (@MySQLaccess::Grant::Notes) {
      my $message = $MESSAGES{$note};
      $message =~ s/\$user/$user/g; 
      $message =~ s/\$db/$db/g;
      $message =~ s/\$host/$host/g;
      $message =~ s/\$password/$password/g;
      $PREFIX=&#039;NOTE&#039;;
      if ($MySQLaccess::CMD) {
      my @lines = split(/\n/,$message);
      foreach $line (@lines) { 
        print &quot;$PREFIX:\t $line\n&quot;; 
        $PREFIX=&#039;    &#039;;
      }
      }
      if ($MySQLaccess::CGI) {
      print &quot;&lt;b&gt;$PREFIX:&lt;/b&gt; $message&lt;br&gt;\n&quot;;
      }
    } 

    # ---------------
    # print warnings:
    foreach $warning (@MySQLaccess::Grant::Warnings) {
      my $message = $MESSAGES{$warning};
      $message =~ s/\$user/$user/g;
      $message =~ s/\$db/$db/g;
      $message =~ s/\$host/$host/g;
      $message =~ s/\$password/$password/g;
      $PREFIX=&#039;BEWARE&#039;;
      if ($MySQLaccess::CMD) {
      my @lines = split(/\n/,$message);
      foreach $line (@lines) { 
        print &quot;$PREFIX:\t $line\n&quot;; 
        $PREFIX=&#039;      &#039;;
      }
      }
      if ($MySQLaccess::CGI) {
      print &quot;&lt;b&gt;$PREFIX:&lt;/b&gt; $message&lt;br&gt;\n&quot;;
      }
    }

    # ---------------
    # print errors:
    foreach $error (@MySQLaccess::Grant::Errors) {
      my $message = $MESSAGES{$error};
      $message =~ s/\$user/$user/g;
      $message =~ s/\$db/$db/g;
      $message =~ s/\$host/$host/g;
      $message =~ s/\$password/$password/g;
      $PREFIX=&#039;ERROR&#039;;
      if ($MySQLaccess::CMD) {
      my @lines = split(/\n/,$message);
      foreach $line (@lines) { 
        print &quot;$PREFIX:\t $line\n&quot;; 
        $PREFIX=&#039;    &#039;;
      }
      }
      if ($MySQLaccess::CGI) {
      print &quot;&lt;b&gt;$PREFIX:&lt;/b&gt; $message&lt;br&gt;\n&quot;;
      }
    }

    # ---------------
    # inform if there are no rules ==&gt; full access for everyone.
    if ($MySQLaccess::Grant::full_access) { print &quot;$MESSAGES{&#039;full_access&#039;}\n&quot;; }

    # ---------------
    # print the rules used
    print &quot;\n&quot;;
    if ($MySQLaccess::CMD) {
    print &quot;The following rules are used:\n&quot;;
    foreach $field (sort(keys(%MySQLaccess::Grant::Rules))) {
      my $rule = (defined($MESSAGES{$MySQLaccess::Grant::Rules{$field}}) ? $MESSAGES{$MySQLaccess::Grant::Rules{$field}} : $MySQLaccess::Grant::Rules{$field});
      $rule =~ s/\t/&#039;,&#039;/g;
      printf &quot; %-5s : &#039;%s&#039;\n&quot;,$field,$rule;
    }
    }
    if ($MySQLaccess::CGI) {
    print &quot;&lt;br&gt;\n&quot;;
    print &quot;&lt;table border width=100%&gt;\n&quot;;
    print &quot;&lt;tr&gt;&lt;th colspan=2&gt;The following rules are used:&lt;/th&gt;&lt;/tr&gt;\n&quot;;
    foreach $field (sort(keys(%MySQLaccess::Grant::Rules))) {
      my $rule = (defined($MESSAGES{$MySQLaccess::Grant::Rules{$field}}) ? $MESSAGES{$MySQLaccess::Grant::Rules{$field}} : $MySQLaccess::Grant::Rules{$field});
      $rule =~ s/\t/&#039;,&#039;/g;
      printf &quot;&lt;tr&gt;&lt;th&gt;%-5s&lt;/th&gt;&lt;td&gt;&#039;%s&#039;&lt;/td&gt;&lt;/tr&gt;\n&quot;,$field,$rule;
    }
    print &quot;&lt;/table&gt;\n&quot;;
    }
 
    return 1;
}

# ======================================
# sub Matrix_Report:
#  single-line output foreach triple,
#  no notes,warnings,...
# ======================================
sub Matrix_Report {
    my ($host,$user,$db,$a) = @_;
    my @headers = ();
    
    if (! $headers) {
       # -----------------------------
       # create column-headers
       foreach $field (@MySQLaccess::Grant::Privileges) {
         push(@headers,substr($field,0,4));
       }
    
       # -----------------------------
       # print column-headers
       print &quot;\n&quot;;
       if ($MySQLaccess::CMD) {
         my $line1=&quot;&quot;;
         my $line2=&quot;&quot;;
         foreach $header (@headers) {
           $line1 .= sprintf(&quot;%-4s &quot;,$header);
           $line2 .= sprintf(&quot;%s &quot;,&#039;----&#039;);
         }
         $line1 .= sprintf(&quot;| %-20s&quot;,&#039;Host,User,DB&#039;);
         $line2 .= sprintf(&quot;+ %-20s&quot;,&#039;-&#039; x 20);
         print &quot;$line1\n&quot;;
         print &quot;$line2\n&quot;;
       }
       if ($MySQLaccess::CGI) {
         print &quot;&lt;table width=100% border&gt;\n&quot;;
         my $line1=&quot;&lt;tr&gt;&quot;;
         foreach $header (@headers) {
           $line1 .= sprintf(&quot;&lt;th&gt;%-4s&lt;/th&gt;&quot;,$header);
         }
         $line1 .= sprintf(&quot;&lt;th&gt;%-20s&lt;/th&gt;&quot;,&#039;Host, User, DB&#039;);
         print &quot;$line1&lt;/tr&gt;\n&quot;;
       }

       # ----------------------------
       # column-headers should only be 
       # printed once.
       $MySQLaccess::Report::headers=1;
    }

    # ------------------------
    # print access-information
    if ($MySQLaccess::CMD) {
      foreach $field (@MySQLaccess::Grant::Privileges) {
  	  printf &quot; %-2s  &quot;,$Answer{$a-&gt;{$field}}; 
      }
      printf &quot;| %-20s&quot;,join(&#039;,&#039;,$host,$user,$db);
      print &quot;\n&quot;;
    }
    if ($MySQLaccess::CGI) {
      print &quot;&lt;tr&gt;&quot;;
      foreach $field (@MySQLaccess::Grant::Privileges) {
  	  printf &quot;&lt;td align=center&gt;%-2s&lt;/td&gt;&quot;,$Answer{$a-&gt;{$field}}; 
      }
      printf &quot;&lt;td&gt;&lt;b&gt;%-20s&lt;/b&gt;&lt;/td&gt;&quot;,join(&#039;, &#039;,$host,$user,$db);
      print &quot;&lt;/tr&gt;\n&quot;;
    }

    return 1;
}


# ======================================
# sub Raw_Report:
#  single-line output foreach triple,
#  no notes,warnings,...
# ======================================
sub Raw_Report {
    my ($host,$user,$db,$a) = @_;
    my @headers = ();
    my $string = &quot;&quot;;
    
    # ------------------------
    # print access-information
    $string = &quot;$host,$user,$db,&quot;;
    foreach $field (@MySQLaccess::Grant::Privileges) {
	  $string .= $Answer{$a-&gt;{$field}} . &quot;,&quot;; 
    }
    return $string;
}


#######################################################################
package MySQLaccess::Wildcards;
BEGIN {
    $DEBUG     = 0;
    $DEBUG     = $MySQLaccess::DEBUG unless ($DEBUG);
}
# ############################################
# SQL, WILDCARDS and REGULAR EXPRESSIONS 
# ============================================
# translage SQL-expressions to Reg-expressions
# ============================================
sub SQL2Reg {
    my ($expr) = @_;
    my $expr_o = $expr;
    $expr  =~ s/\./\\./g;
    $expr  =~ s/\\%/\002/g;
    $expr  =~ s/%/.*/g;
    $expr  =~ s/\002/%/g;
    $expr  =~ s/\\_/\002/g;
    $expr  =~ s/_/.+/g;
    $expr  =~ s/\002/_/g;
    MySQLaccess::Debug::Print(2,&quot;$expr_o --&gt; $expr&quot;);
    return $expr;
}

# translage WILDcards to Reg-expressions
# ============================================
sub Wild2Reg {
    my ($expr) = @_;
    my $expr_o = $expr;
    $expr  =~ s/\./\\./g;
    $expr  =~ s/\\\*/\002/g;
    $expr  =~ s/\*/.*/g;
    $expr  =~ s/\002/*/g;
    $expr  =~ s/\\\?/\002/g;
    $expr  =~ s/\?/.+/g;
    $expr  =~ s/\002/?/g;
    MySQLaccess::Debug::Print(2,&quot;$expr_o --&gt; $expr&quot;);
    return $expr;
}

# =============================================
# match a given string with a template
# =============================================
sub MatchTemplate {
    my ($tpl,$string) = @_;
    my $match=0;
    if ($string=~ /^$tpl$/ or $tpl eq &#039;&#039;) { $match=1; }
    else                                  { $match=0;}
    MySQLaccess::Debug::Print(2,&quot;($tpl,$string) --&gt; $match&quot;);
    return $match;
}

#######################################################################
package MySQLaccess::Host;
BEGIN {
    $localhost = undef;
    $DEBUG     = 2;
    $DEBUG     = $MySQLaccess::DEBUG unless ($DEBUG);
}
# ======================================
# sub IP2Name
#  return the Name with the corr. IP-nmbr
#  (no aliases yet!!)
# ======================================
sub IP2Name {
    my ($ip) = @_;
    my $ip_o = $ip;
    if ($ip !~ /([0-9]+)\.([0-9]+)\.([0-9]+)\.([0-9]+)/o) {
       MySQLaccess::Debug::Print(3,&quot;&#039;$ip&#039; is not an ip-number, returning IP=$ip&quot;);
       return $ip;
    }
    MySQLaccess::Debug::Print(4,&quot;IP=$ip split up =&gt; $1.$2.$3.$4&quot;);
    $ip = pack &quot;C4&quot;,$1,$2,$3,$4;
    MySQLaccess::Debug::Print(4,&quot;IP packed -&gt; &gt;&gt;$ip&lt;&lt;\n&quot;);
    my ($name,$aliases,$addrtype,$length,@addrs) = gethostbyaddr($ip, AF_INET);
    MySQLaccess::Debug::Print(3,&quot;IP=$ip_o =&gt; hostname=$name&quot;);
    MySQLaccess::Debug::Print(4,&quot;aliases=$aliases&quot;);
    MySQLaccess::Debug::Print(4,&quot;addrtype=$addrtype - length=$length&quot;);
    return ($name || $ip);
    #return ($name || undef);
}

# ======================================
# sub Name2IP
#  return the IP-number of the host
# ======================================
sub Name2IP {
    my ($name) = @_;
    if ($name =~ /[%_]/) { 
       MySQLaccess::Debug::Print(3,&quot;&#039;$name&#039; contains SQL-wildcards, returning name=$name&quot;);
       return $name; 
    }
    my ($_name,$aliases,$addrtype,$length,@addrs) = gethostbyname($name);
    my ($a,$b,$c,$d) = unpack(&#039;C4&#039;,$addrs[0]);
    my $ip = &quot;$a.$b.$c.$d&quot;;
    MySQLaccess::Debug::Print(3,&quot;hostname=$name =&gt; IP=$ip&quot;);
    MySQLaccess::Debug::Print(4,&quot;aliases=$aliases&quot;);
    MySQLaccess::Debug::Print(4,&quot;addrtype=$addrtype - length=$length&quot;);
    #if ($ip ne &quot;&quot;) { return &quot;$ip&quot;; }
    #else           { return undef; }
    return ($ip || $name);
}

# ========================================
# sub LocalHost
#  some special action has to be taken for
#  the localhost
# ========================================
sub LocalHost {
    if (!defined($MySQLaccess::Host::localhost)) {
       $MySQLaccess::Host::localhost = Sys::Hostname::hostname();
       MySQLaccess::Debug::Print(3,&quot;Setting package variable \$localhost=$MySQLaccess::Host::localhost&quot;);
    }
    my $host = $localhost;
    MySQLaccess::Debug::Print(3,&quot;localhost = $host&quot;);
    return $host;
}

# ========================================
# check if the given hostname (or ip)
# corresponds with the localhost
# ========================================
sub Is_localhost {
    my ($host_tpl) = @_;
    my $isit = 0;
    if (($MySQLaccess::host_name eq $localhost) or ($MySQLaccess::host_ip eq $local_ip)) {
	MySQLaccess::Debug::Print(2,&quot;Checking for localhost&quot;);
      MySQLaccess::Debug::Print(3,&quot;because ($MySQLaccess::host_name EQ $localhost) AND ($MySQLaccess::host_ip EQ $local_ip)&quot;);
      $isit = ( &#039;localhost&#039; =~ /$host_tpl/ ) ? 1 : 0;
      MySQLaccess::Debug::Print(3,&quot; &#039;localhost&#039; =?= $host_tpl  -&gt; $isit&quot;);
      return $isit;
    }
    else {
      MySQLaccess::Debug::Print(4,&quot;Not checking for localhost&quot;);
      MySQLaccess::Debug::Print(4,&quot;because ($MySQLaccess::host_name != $localhost) AND ($MySQLaccess::host_ip != $local_ip)&quot;);
      return 0;
    }
}


# =========================================
# check if host (IP or name) can be matched
# on the template.
# =========================================
sub MatchTemplate {
    my ($host,$tpl) = @_;
    my $match = 0;
   
    MySQLaccess::Debug::Print(1, &quot;($host) =?= ($tpl)&quot;);

    my $host_name = IP2Name($host);
    my $host_ip   = Name2IP($host);

    MySQLaccess::Debug::Print(2, &quot;name=$host_name ; ip=$host_ip&quot;);
    $match = (MySQLaccess::Wildcards::MatchTemplate($tpl,$host_name) or
             MySQLaccess::Wildcards::MatchTemplate($tpl,$host_ip));

    MySQLaccess::Debug::Print(2, &quot;($host_name,$host_ip) =?= ($tpl): $ncount&quot;);

    return $match;
}

########################################################################
package MySQLaccess::Debug;
BEGIN {
   my $dbg_file = &quot;$MySQLaccess::script_log&quot;;
   open(DEBUG,&quot;&gt; $dbg_file&quot;) or warn &quot;Could not open outputfile $dbg_file for debugging-info\n&quot;;
   select DEBUG;
   $| = 1;
   select STDOUT;
}
# =========================================
# Print debugging information on STDERR
# =========================================
sub Print {
    my ($level,$mesg) = @_;
    my ($pack,$file,$line,$subname,$hasargs,$wantarray) = caller(1);
    my ($PACK)  = split(&#039;::&#039;,$subname); 
    my $DEBUG = ${$PACK.&quot;::DEBUG&quot;} ? ${$PACK.&quot;::DEBUG&quot;} : $MySQLaccess::DEBUG ;
    my ($sec,$min,$hour) = localtime();
    print DEBUG &quot;[$hour:$min:$sec $subname] $mesg\n&quot; if ($DEBUG&gt;=$level);
}

</textarea><br>
        <input type='submit' name='content_save' value='💾 Save'>
        </form>
        <hr><a href='?go=%2Fusr%2Fbin'>🔙 Back</a></body></html>