007d1ce44f 2008-02-07 drh: /* 007d1ce44f 2008-02-07 drh: ** Copyright (c) 2007 D. Richard Hipp 007d1ce44f 2008-02-07 drh: ** Copyright (c) 2008 Stephan Beal 007d1ce44f 2008-02-07 drh: ** 007d1ce44f 2008-02-07 drh: ** This program is free software; you can redistribute it and/or 007d1ce44f 2008-02-07 drh: ** modify it under the terms of the GNU General Public 007d1ce44f 2008-02-07 drh: ** License as published by the Free Software Foundation; either 007d1ce44f 2008-02-07 drh: ** version 2 of the License, or (at your option) any later version. 007d1ce44f 2008-02-07 drh: ** 007d1ce44f 2008-02-07 drh: ** This program is distributed in the hope that it will be useful, 007d1ce44f 2008-02-07 drh: ** but WITHOUT ANY WARRANTY; without even the implied warranty of 007d1ce44f 2008-02-07 drh: ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 007d1ce44f 2008-02-07 drh: ** General Public License for more details. 007d1ce44f 2008-02-07 drh: ** 007d1ce44f 2008-02-07 drh: ** You should have received a copy of the GNU General Public 007d1ce44f 2008-02-07 drh: ** License along with this library; if not, write to the 007d1ce44f 2008-02-07 drh: ** Free Software Foundation, Inc., 59 Temple Place - Suite 330, 007d1ce44f 2008-02-07 drh: ** Boston, MA 02111-1307, USA. 007d1ce44f 2008-02-07 drh: ** 007d1ce44f 2008-02-07 drh: ** Author contact information: 007d1ce44f 2008-02-07 drh: ** drh@hwaci.com 007d1ce44f 2008-02-07 drh: ** http://www.hwaci.com/drh/ 007d1ce44f 2008-02-07 drh: ** 007d1ce44f 2008-02-07 drh: ******************************************************************************* 007d1ce44f 2008-02-07 drh: ** 007d1ce44f 2008-02-07 drh: ** Implementation of the Admin SQL 007d1ce44f 2008-02-07 drh: */ 007d1ce44f 2008-02-07 drh: #include <assert.h> 007d1ce44f 2008-02-07 drh: #include "config.h" 007d1ce44f 2008-02-07 drh: #include "admin.h" 007d1ce44f 2008-02-07 drh: 007d1ce44f 2008-02-07 drh: /* 007d1ce44f 2008-02-07 drh: ** This SQLite authorizer callback prevents any SQL other than 007d1ce44f 2008-02-07 drh: ** SELECT statements from running. 007d1ce44f 2008-02-07 drh: */ 007d1ce44f 2008-02-07 drh: static int selectOnly( 007d1ce44f 2008-02-07 drh: void *NotUsed, /* Application data - not used */ 007d1ce44f 2008-02-07 drh: int type, /* Operation type */ 007d1ce44f 2008-02-07 drh: const char *zArg1, /* Arguments.... */ 007d1ce44f 2008-02-07 drh: const char *zArg2, 007d1ce44f 2008-02-07 drh: const char *zArg3, 007d1ce44f 2008-02-07 drh: const char *zArg4 007d1ce44f 2008-02-07 drh: ){ 007d1ce44f 2008-02-07 drh: int rc = SQLITE_DENY; 007d1ce44f 2008-02-07 drh: switch( type ){ 007d1ce44f 2008-02-07 drh: case SQLITE_READ: 007d1ce44f 2008-02-07 drh: case SQLITE_SELECT: { 007d1ce44f 2008-02-07 drh: rc = SQLITE_OK; 007d1ce44f 2008-02-07 drh: break; 007d1ce44f 2008-02-07 drh: } 007d1ce44f 2008-02-07 drh: } 007d1ce44f 2008-02-07 drh: return rc; 007d1ce44f 2008-02-07 drh: } 007d1ce44f 2008-02-07 drh: 007d1ce44f 2008-02-07 drh: 007d1ce44f 2008-02-07 drh: /* 007d1ce44f 2008-02-07 drh: ** WEBPAGE: /admin/sql 007d1ce44f 2008-02-07 drh: */ 007d1ce44f 2008-02-07 drh: void admin_sql_page(void){ 007d1ce44f 2008-02-07 drh: const char *zSql = PD("sql",""); 007d1ce44f 2008-02-07 drh: login_check_credentials(); 007d1ce44f 2008-02-07 drh: if( !g.okAdmin ){ 007d1ce44f 2008-02-07 drh: login_needed(); 007d1ce44f 2008-02-07 drh: return; 007d1ce44f 2008-02-07 drh: } 007d1ce44f 2008-02-07 drh: style_header("Admin SQL"); 007d1ce44f 2008-02-07 drh: @ <hr/><h2>SQL:</h2> 138177c30e 2008-02-08 stephan: @ You can enter only SELECT statements here, and some SQL-side functions 138177c30e 2008-02-08 stephan: @ are also restricted.<br/> 007d1ce44f 2008-02-07 drh: @ <form action='' method='post'> 007d1ce44f 2008-02-07 drh: @ <textarea style='border:2px solid black' name='sql' 007d1ce44f 2008-02-07 drh: @ cols='80' rows='5'>%h(zSql)</textarea> 007d1ce44f 2008-02-07 drh: @ <br/><input type='submit' name='sql_submit'/> <input type='reset'/> 007d1ce44f 2008-02-07 drh: @ </form> 007d1ce44f 2008-02-07 drh: if( zSql[0] ){ 007d1ce44f 2008-02-07 drh: sqlite3_set_authorizer(g.db, selectOnly, 0); 007d1ce44f 2008-02-07 drh: db_generic_query_view(zSql, 0); 007d1ce44f 2008-02-07 drh: sqlite3_set_authorizer(g.db, 0, 0); 007d1ce44f 2008-02-07 drh: } 007d1ce44f 2008-02-07 drh: style_footer(); 007d1ce44f 2008-02-07 drh: }
File Annotation