JFIF$        dd7 

Viewing File: /usr/local/cpanel/scripts/unsuspendmysqlusers

#!/usr/local/cpanel/3rdparty/bin/perl

# cpanel - scripts/unsuspendmysqlusers             Copyright 2022 cPanel, L.L.C.
#                                                           All rights reserved.
# copyright@cpanel.net                                         http://cpanel.net
# This code is subject to the cPanel license. Unauthorized copying is prohibited

package scripts::unsuspendmysqlusers;

use cPstrict;

=encoding utf-8

=head1 NAME

unsuspendmysqlusers

=head1 USAGE

    unsuspendmysqlusers [--local-only] [--team] <username>

=cut

#----------------------------------------------------------------------

use parent 'Cpanel::HelpfulScript';

use Cpanel::DB::Map::Reader                ();
use Cpanel::DB::Utils                      ();
use Cpanel::Mysql::Passwd                  ();
use Cpanel::MysqlUtils::Connect            ();
use Cpanel::MysqlUtils::Quote              ();
use Cpanel::MysqlUtils::Compat             ();
use Cpanel::MysqlUtils::Compat::Suspension ();
use Cpanel::MysqlUtils::Command            ();
use Cpanel::Logger                         ();
use Cpanel::MysqlUtils::Version            ();

use constant _OPTIONS => (
    'local-only',
    'team',
);

use constant _ACCEPT_UNNAMED => 1;

#----------------------------------------------------------------------

__PACKAGE__->new(@ARGV)->run() if !caller;

sub run ($self) {
    my ($username) = $self->getopt_unnamed();
    if ( !length $username ) {
        die $self->full_help();
    }

    return unsuspend( $username, $self->getopt('team'), $self->getopt('local-only') );
}

sub unsuspend ( $cpuser, $team, $local_only_yn = 0 ) {
    my $logger = Cpanel::Logger->new();

    my ( $team_owner, $team_user, $mysql_team_user );

    # unsuspend the team-user mysql account alone
    if ( defined $team ) {
        ( $team_owner, $team_user ) = split /_/, $cpuser;
        $mysql_team_user = $cpuser;
        $cpuser          = $team_owner;
    }
    my $map = Cpanel::DB::Map::Reader->new( 'cpuser' => $cpuser, engine => 'mysql' );

    my @user_list = $map->get_dbusers_plus_cpses();

    # Case48428 - Need to include the parent user associated with the database and not just virtual users
    # when suspending accounts in MySQL.
    # Also, the DB map datastore might have a different owner name associated with the user
    # account which the databases are tied to.
    my @db_owner = (
        $cpuser,
        Cpanel::DB::Utils::username_to_dbowner($cpuser),
    );
    push @user_list, @db_owner;

    Cpanel::MysqlUtils::Connect::connect();

    # In order for the unsuspend code to work with account that have
    # been migrated from older versions of mysql/maria we need to
    # fixup the mysql users table to be in the expected state.
    #
    # Cpanel::MysqlUtils::Compat::Suspension::normalize_suspension will
    # convert the accounts that have the old style suspension system
    # to be locked if the server supports it.
    Cpanel::MysqlUtils::Compat::Suspension::normalize_suspension(
        Cpanel::MysqlUtils::Connect::get_singleton(),
    );

    my $row_name = Cpanel::MysqlUtils::Compat::get_mysql_user_auth_field();

    my $user_list = !defined $team ? join ',', map { Cpanel::MysqlUtils::Quote::quote($_) } @user_list : Cpanel::MysqlUtils::Quote::quote($mysql_team_user);
    my $result    = Cpanel::MysqlUtils::Command::sqlcmd("SELECT User, Host, $row_name from mysql.user WHERE user IN ($user_list);") || '';
    my @lines     = split /\n/, $result;
    my %result;
    foreach my $line (@lines) {
        my ( $key, $host, $value ) = split /\s+/, $line, 3;
        next if $local_only_yn && !_host_is_local($host);

        $result{$key}{$host} = $value || '*' x 41;
    }

    my $mysql = Cpanel::Mysql::Passwd->new( { cpuser => $cpuser } );

    foreach my $user ( keys %result ) {
        foreach my $host ( keys %{ $result{$user} } ) {
            if ( length( $result{$user}{$host} ) == 41 ) {

                # New style suspension
                if ( $result{$user}{$host} =~ m/^\-/ ) {
                    $result{$user}{$host} =~ s/\-//;

                    # Handling for NULL passwords
                    if ( $result{$user}{$host} =~ m/^\*+$/ ) {
                        $logger->info("MySQL user $user has a blank password!");
                        $result{$user}{$host} = '';
                    }
                    else {
                        $result{$user}{$host} = reverse $result{$user}{$host};
                        $result{$user}{$host} = '*' . $result{$user}{$host};
                    }
                }

                # Legacy suspension
                elsif ( $result{$user}{$host} =~ m/^\+/ ) {
                    $result{$user}{$host} =~ s/\+/\*/;
                }

                # Old passwords passed with new length
                elsif ( $result{$user}{$host} =~ m/^!+([0-9a-f]{16})$/ ) {
                    $result{$user}{$host} = reverse($1);
                }
            }
            elsif ( length( $result{$user}{$host} ) == 40 ) {
                $result{$user}{$host} = '*' . $result{$user}{$host};
                if ( $result{$user}{$host} =~ m/^\*+$/ ) {
                    $result{$user}{$host} = '';
                }
            }
            else {    # Case 76857
                $result{$user}{$host} =~ s/^!([0-9a-f]{16})/reverse($1)/e;
            }
        }
    }

    my @sql_cmds;

    foreach my $user ( keys %result ) {
        foreach my $host ( keys %{ $result{$user} } ) {
            my $pass = $result{$user}{$host};

            my $mysql_version = _long_mysql_version_or_default();

            # Per docs on MySQL 5.7.6 - https://dev.mysql.com/doc/refman/5.7/en/grant.html
            # We can no longer use GRANT statements to change the password.
            # However, since 5.7 ships with Account Locking capabilities, we will utilize that instead to lock the accounts.
            if ( Cpanel::MysqlUtils::Version::is_at_least( $mysql_version, '5.7.6' )
                && !Cpanel::MysqlUtils::Version::is_at_least( $mysql_version, '10.0.0' ) ) {

                push @sql_cmds, 'ALTER USER ' . Cpanel::MysqlUtils::Quote::quote($user) . '@' . Cpanel::MysqlUtils::Quote::quote($host) . ' ACCOUNT UNLOCK;';

            }
            else {
                # Passing in 1 to specify a password change
                $mysql->passwduser_hash( $user => $pass, 1 );
            }
        }
    }

    push @sql_cmds, 'FLUSH PRIVILEGES';

    # This must be done in the foreground or pkgacct will break.
    Cpanel::MysqlUtils::Command::sqlcmd( \@sql_cmds );

    return 1;

}

sub _host_is_local ($host) {
    require Cpanel::NAT;
    require Cpanel::Domain::Local;

    $host = Cpanel::NAT::get_local_ip($host);

    return Cpanel::Domain::Local::domain_or_ip_is_on_local_server($host);
}

sub _long_mysql_version_or_default {
    local $@;
    my $long_version = eval { Cpanel::MysqlUtils::Version::current_mysql_version()->{'long'} };

    if ($@) {

        # current_mysql_version has extensive logic to determine the current
        # version.  If it fails, MySQL is likely beyond repair and we need to reinstall.
        return $Cpanel::MysqlUtils::Version::DEFAULT_MYSQL_RELEASE_TO_ASSUME_IS_INSTALLED;
    }

    return $long_version;
}

1;
Back to Directory  nL+D550H?Mx ,D"v]qv;6*Zqn)ZP0!1 A "#a$2Qr D8 a Ri[f\mIykIw0cuFcRı?lO7к_f˓[C$殷WF<_W ԣsKcëIzyQy/_LKℂ;C",pFA:/]=H  ~,ls/9ć:[=/#f;)x{ٛEQ )~ =𘙲r*2~ a _V=' kumFD}KYYC)({ *g&f`툪ry`=^cJ.I](*`wq1dđ#̩͑0;H]u搂@:~וKL Nsh}OIR*8:2 !lDJVo(3=M(zȰ+i*NAr6KnSl)!JJӁ* %݉?|D}d5:eP0R;{$X'xF@.ÊB {,WJuQɲRI;9QE琯62fT.DUJ;*cP A\ILNj!J۱+O\͔]ޒS߼Jȧc%ANolՎprULZԛerE2=XDXgVQeӓk yP7U*omQIs,K`)6\G3t?pgjrmۛجwluGtfh9uyP0D;Uڽ"OXlif$)&|ML0Zrm1[HXPlPR0'G=i2N+0e2]]9VTPO׮7h(F*癈'=QVZDF,d߬~TX G[`le69CR(!S2!P <0x<!1AQ "Raq02Br#SCTb ?Ζ"]mH5WR7k.ۛ!}Q~+yԏz|@T20S~Kek *zFf^2X*(@8r?CIuI|֓>^ExLgNUY+{.RѪ τV׸YTD I62'8Y27'\TP.6d&˦@Vqi|8-OΕ]ʔ U=TL8=;6c| !qfF3aů&~$l}'NWUs$Uk^SV:U# 6w++s&r+nڐ{@29 gL u"TÙM=6(^"7r}=6YݾlCuhquympǦ GjhsǜNlɻ}o7#S6aw4!OSrD57%|?x>L |/nD6?/8w#[)L7+6〼T ATg!%5MmZ/c-{1_Je"|^$'O&ޱմTrb$w)R$& N1EtdU3Uȉ1pM"N*(DNyd96.(jQ)X 5cQɎMyW?Q*!R>6=7)Xj5`J]e8%t!+'!1Q5 !1 AQaqё#2"0BRb?Gt^## .llQT $v,,m㵜5ubV =sY+@d{N! dnO<.-B;_wJt6;QJd.Qc%p{ 1,sNDdFHI0ГoXшe黅XۢF:)[FGXƹ/w_cMeD,ʡcc.WDtA$j@:) -# u c1<@ۗ9F)KJ-hpP]_x[qBlbpʖw q"LFGdƶ*s+ډ_Zc"?%t[IP 6J]#=ɺVvvCGsGh1 >)6|ey?Lӣm,4GWUi`]uJVoVDG< SB6ϏQ@ TiUlyOU0kfV~~}SZ@*WUUi##; s/[=!7}"WN]'(L! ~y5g9T̅JkbM' +s:S +B)v@Mj e Cf jE 0Y\QnzG1д~Wo{T9?`Rmyhsy3!HAD]mc1~2LSu7xT;j$`}4->L#vzŏILS ֭T{rjGKC;bpU=-`BsK.SFw4Mq]ZdHS0)tLg