--- template/en/default/admin/admin.html.tmpl~	2010-08-25 17:35:09.000000000 -0700
+++ template/en/default/admin/admin.html.tmpl	2010-10-07 10:06:20.000000000 -0700
@@ -123,6 +123,12 @@
         <dd class="[% class %]">Set queries which will be run at some specified date
         and time, and get the result of these queries directly per email. This is a
         good way to create reminders and to keep track of the activity in your installation.</dd>
+
+        [% class = user.groups.admin ? "" : "forbidden" %]
+        <dt class="[% class %]"><a href="editsql.cgi">Execute SQL statements</a></dt>
+        <dd class="[% class %]">This will allow Bugzilla admins to execute Sql queries
+	against the datebase directly. It's the quickest way to shoot you in your foot!
+	But sometimes it's needed for some configurations.</dd>
       </dl>
     </td>
   </tr>
--- template/en/default/admin/sql/index.html.tmpl~	1969-12-31 16:00:00.000000000 -0800
+++ template/en/default/admin/sql/index.html.tmpl	2010-10-07 14:54:31.000000000 -0700
@@ -0,0 +1,43 @@
+[%# INTERFACE:
+  # sql_token:
+  # sql_output:
+  #%]
+
+[% PROCESS "global/field-descs.none.tmpl" %]
+
+[% PROCESS global/header.html.tmpl
+  title = "Sql"
+  doc_section = "sql.html"
+%]
+
+[% IF sql_output %]
+[% IF last_sql %]
+<h4>Last Sql statements:</h4>
+<pre>
+[% last_sql %]
+</pre>
+<br />
+
+[% END %]
+
+<h4>Output of the last Sql statements:</h4>
+<pre>
+[% sql_output %]
+</pre>
+<br />
+
+[% END %]
+
+<h4>Statement to execute:</h4>
+<p>Please use only single-quotes (') in your statements for now!!</p>
+
+<form id="sql_form" action="editsql.cgi" method="POST">
+  <textarea name="sql_input" cols=80 rows=10></textarea>
+  <p>
+    <input type="hidden" name="action" value="execute">
+    <input type="hidden" name="token" value="[% token FILTER html %]">
+    <input type="submit" id="Execute" value="Execute"> -
+    <a href="editsql.cgi">Cancel Changes</a>
+  </p>
+</form>
+[% PROCESS global/footer.html.tmpl %]
--- editsql.cgi~	1969-12-31 16:00:00.000000000 -0800
+++ editsql.cgi	2010-10-07 17:32:14.000000000 -0700
@@ -0,0 +1,118 @@
+#!__PERL_BINARY__ -wT
+# -*- Mode: perl; indent-tabs-mode: nil -*-
+
+use strict;
+use lib qw(. lib);
+
+use Bugzilla;
+use Bugzilla::Constants;
+use Bugzilla::Error;
+use Bugzilla::Util;
+use Bugzilla::Field;
+use Bugzilla::Token;
+
+my $cgi = Bugzilla->cgi;
+my $template = Bugzilla->template;
+my $vars = {};
+
+# Make sure the user is logged in and is an administrator.
+my $user = Bugzilla->login(LOGIN_REQUIRED);
+$user->in_group('admin')
+  || ThrowUserError('auth_failure', {group  => 'admin',
+                                     action => 'run',
+                                     object => 'administrative_pages'});
+
+my $action = trim($cgi->param('action') || '');
+my $token  = $cgi->param('token');
+
+print $cgi->header();
+
+# Show an index page
+if (!$action) {
+  $vars->{'token'} = issue_session_token('sql_form');
+
+  $template->process('admin/sql/index.html.tmpl', $vars)
+    || ThrowTemplateError($template->error());
+}
+# Submit a sql fragment and return the output.
+elsif ($action eq 'execute') {
+  check_token_data($token, 'sql_form');
+
+  $vars->{'last_sql'} = $cgi->param('sql_input');
+  $vars->{'sql_output'} = _execute($cgi->param('sql_input'));
+
+  $vars->{'token'} = issue_session_token('sql_form');
+
+  $template->process('admin/sql/index.html.tmpl', $vars)
+    || ThrowTemplateError($template->error());
+}
+else {
+  ThrowUserError('no_valid_action', {'field' => 'sql'});
+}
+
+sub _execute() {
+  my $sql_input = shift;
+
+  chomp($sql_input);
+
+  return "Empty statement!" unless ($sql_input && length($sql_input) > 0);
+
+  my $lc = Bugzilla->localconfig;
+
+  return "This works currently only for MySQL!!" unless (lc($lc->{db_driver}) eq 'mysql');
+
+  my ($host, $port, $user, $password, $database, $execute);
+  
+  if ($lc->{db_sock}) {
+    $host = "--socket=" . $lc->{db_sock};
+  }
+  elsif ($lc->{db_host}) {
+    $host = "--host=" . $lc->{db_host};
+  }
+  else {
+    $host = "--host=localhost";
+  }
+
+  if ($host =~ m/^--host/ && $lc->{db_port}) {
+    $port = "--port=" . $lc->{db_port};
+  }
+
+  if ($lc->{db_user}) {
+    $user = "--user=" . $lc->{db_user};
+  }
+
+  if ($lc->{db_pass}) {
+    $password = "--password=" . $lc->{db_pass};
+  }
+
+  if ($lc->{db_name}) {
+    $database = "--database=" . $lc->{db_name};
+  }
+
+  $sql_input =~ s/\n//gs;
+  if ($sql_input =~ m/^([^\\"]+)$/) {
+    $sql_input = $1;
+  }
+  else {
+    return "String not understood:-(";
+  }
+
+  $execute = "--execute=\"" . $sql_input . "\"";
+
+  print STDERR "execute: /usr/bin/mysql $host $port $user $password $database $execute 2>&1\n";
+
+  my $output = `/usr/bin/mysql --table $host $port $user $password $database $execute 2>&1`;
+  my $ret_code = $? >> 8;
+  my $ret_comment = "\nOK\n";
+
+  $ret_comment = "\nCommand failed!!\n" if ($ret_code != 0);
+
+  if ($output) {
+    $output .= $ret_comment;
+  }
+  else {
+    $output = $ret_comment;
+  }
+
+  return $output;
+}