(self, query2=False)
| 27 | |
| 28 | class Enumeration(GenericEnumeration): |
| 29 | def getRoles(self, query2=False): |
| 30 | infoMsg = "fetching database users roles" |
| 31 | |
| 32 | rootQuery = queries[DBMS.ORACLE].roles |
| 33 | |
| 34 | if conf.user == CURRENT_USER: |
| 35 | infoMsg += " for current user" |
| 36 | conf.user = self.getCurrentUser() |
| 37 | |
| 38 | logger.info(infoMsg) |
| 39 | |
| 40 | # Set containing the list of DBMS administrators |
| 41 | areAdmins = set() |
| 42 | |
| 43 | if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: |
| 44 | if query2: |
| 45 | query = rootQuery.inband.query2 |
| 46 | condition = rootQuery.inband.condition2 |
| 47 | else: |
| 48 | query = rootQuery.inband.query |
| 49 | condition = rootQuery.inband.condition |
| 50 | |
| 51 | if conf.user: |
| 52 | users = conf.user.split(',') |
| 53 | query += " WHERE " |
| 54 | query += " OR ".join("%s = '%s'" % (condition, user) for user in sorted(users)) |
| 55 | |
| 56 | values = inject.getValue(query, blind=False, time=False) |
| 57 | |
| 58 | if not values and not query2: |
| 59 | infoMsg = "trying with table 'USER_ROLE_PRIVS'" |
| 60 | logger.info(infoMsg) |
| 61 | |
| 62 | return self.getRoles(query2=True) |
| 63 | |
| 64 | if not isNoneValue(values): |
| 65 | for value in values: |
| 66 | user = None |
| 67 | roles = set() |
| 68 | |
| 69 | for count in xrange(0, len(value or [])): |
| 70 | # The first column is always the username |
| 71 | if count == 0: |
| 72 | user = value[count] |
| 73 | |
| 74 | # The other columns are the roles |
| 75 | else: |
| 76 | role = value[count] |
| 77 | |
| 78 | # In Oracle we get the list of roles as string |
| 79 | roles.add(role) |
| 80 | |
| 81 | if user in kb.data.cachedUsersRoles: |
| 82 | kb.data.cachedUsersRoles[user] = list(roles.union(kb.data.cachedUsersRoles[user])) |
| 83 | else: |
| 84 | kb.data.cachedUsersRoles[user] = list(roles) |
| 85 | |
| 86 | if not kb.data.cachedUsersRoles and isInferenceAvailable() and not conf.direct: |
nothing calls this directly
no test coverage detected