Changeset 140 for trunk/dns.cgi


Ignore:
Timestamp:
10/13/11 17:13:36 (13 years ago)
Author:
Kris Deugau
Message:

/trunk

ACL fixups:

  • Default Records are only viewable by an admin
  • Remove links for group operations user is not permitted to access, also rename "Manage groups" to "View groups" if the user does not have any of group add/edit/delete permissions

Lightly tweak error message handling for group operations to
more easily overload it for different errors
TODO note and fixme notes about deleting groups with stuff
still in them

File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/dns.cgi

    r139 r140  
    305305} elsif ($webvar{page} eq 'reclist') {
    306306
    307   $page->param(mayeditsoa => $permissions{admin} || $permissions{domain_edit});
     307# hmm.  where do we send them?
     308  if ($webvar{defrec} eq 'y' && !$permissions{admin}) {
     309    $page->param(errmsg => "You are not permitted to edit default records");
     310    $page->param(perm_err => 1);
     311  } else {
     312
     313    $page->param(mayeditsoa => $permissions{admin} || $permissions{domain_edit});
    308314##fixme:  ACL needs pondering.  Does "edit domain" interact with record add/remove/etc?
    309315# Note this seems to be answered "no" in Vega.
    310316# ACLs
    311   $page->param(record_create    => ($permissions{admin} || $permissions{record_create}) );
     317    $page->param(record_create  => ($permissions{admin} || $permissions{record_create}) );
    312318#  $page->param(record_edit     => ($permissions{admin} || $permissions{record_edit}) );
    313   $page->param(record_delete    => ($permissions{admin} || $permissions{record_delete}) );
     319    $page->param(record_delete  => ($permissions{admin} || $permissions{record_delete}) );
    314320
    315321  # Handle record list for both default records (per-group) and live domain records
    316322
    317   $page->param(defrec => $webvar{defrec});
    318   $page->param(id => $webvar{id});
    319   $page->param(curpage => $webvar{page});
    320 
    321   my $count = getRecCount($dbh, $webvar{defrec}, $webvar{id}, $filter);
    322 
    323   $sortby = 'host';
     323    $page->param(defrec => $webvar{defrec});
     324    $page->param(id => $webvar{id});
     325    $page->param(curpage => $webvar{page});
     326
     327    my $count = getRecCount($dbh, $webvar{defrec}, $webvar{id}, $filter);
     328
     329    $sortby = 'host';
    324330# sort/order
    325   $session->param($webvar{page}.'sortby', $webvar{sortby}) if $webvar{sortby};
    326   $session->param($webvar{page}.'order', $webvar{order}) if $webvar{order};
    327 
    328   $sortby = $session->param($webvar{page}.'sortby') if $session->param($webvar{page}.'sortby');
    329   $sortorder = $session->param($webvar{page}.'order') if $session->param($webvar{page}.'order');
     331    $session->param($webvar{page}.'sortby', $webvar{sortby}) if $webvar{sortby};
     332    $session->param($webvar{page}.'order', $webvar{order}) if $webvar{order};
     333
     334    $sortby = $session->param($webvar{page}.'sortby') if $session->param($webvar{page}.'sortby');
     335    $sortorder = $session->param($webvar{page}.'order') if $session->param($webvar{page}.'order');
    330336
    331337# set up the headers
    332   my @cols = ('host', 'type', 'val', 'distance', 'weight', 'port', 'ttl');
    333   my %colheads = (host => 'Name', type => 'Type', val => 'Address',
     338    my @cols = ('host', 'type', 'val', 'distance', 'weight', 'port', 'ttl');
     339    my %colheads = (host => 'Name', type => 'Type', val => 'Address',
    334340        distance => 'Distance', weight => 'Weight', port => 'Port', ttl => 'TTL');
    335   my %custom = (id => $webvar{id}, defrec => $webvar{defrec});
    336   fill_colheads($sortby, $sortorder, \@cols, \%colheads, \%custom);
     341    my %custom = (id => $webvar{id}, defrec => $webvar{defrec});
     342    fill_colheads($sortby, $sortorder, \@cols, \%colheads, \%custom);
    337343
    338344# fill the page-count and first-previous-next-last-all details
    339   fill_pgcount($count,"records",
     345    fill_pgcount($count,"records",
    340346        ($webvar{defrec} eq 'y' ? "group ".groupName($dbh,$webvar{id}) : domainName($dbh,$webvar{id})));
    341   fill_fpnla($count);  # should put some params on this sub...
    342 
    343   $page->param(defrec => $webvar{defrec});
    344   if ($webvar{defrec} eq 'y') {
    345     showdomain('y',$curgroup);
    346   } else {
    347     showdomain('n',$webvar{id});
    348     $page->param(logdom => 1);
    349   }
    350 
    351   $page->param(errmsg => $webvar{errmsg}) if $webvar{errmsg};
     347    fill_fpnla($count);  # should put some params on this sub...
     348
     349    $page->param(defrec => $webvar{defrec});
     350    if ($webvar{defrec} eq 'y') {
     351      showdomain('y',$curgroup);
     352    } else {
     353      showdomain('n',$webvar{id});
     354##fixme:  permission for viewing logs?
     355      $page->param(logdom => 1);
     356    }
     357
     358    $page->param(errmsg => $webvar{errmsg}) if $webvar{errmsg};
     359
     360  } # close "you can't edit default records" check
    352361
    353362} elsif ($webvar{page} eq 'record') {
    … …  
    414423        unless ($permissions{admin} || $permissions{record_edit});
    415424
     425# check perms to see if the record is "out of scope" for the user
    416426    $page->param(todo           => "Update record");
    417427    $page->param(recact         => "update");
    … …  
    573583
    574584  listgroups();
     585
     586# Permissions!
     587  $page->param(addgrp => $permissions{admin} || $permissions{group_create});
     588  $page->param(edgrp => $permissions{admin} || $permissions{group_edit});
     589  $page->param(delgrp => $permissions{admin} || $permissions{group_delete});
     590
     591  $page->param(errmsg => $webvar{errmsg}) if $webvar{errmsg};
    575592  $page->param(curpage => $webvar{page});
    576593
    … …  
    616633  if (!defined($webvar{del})) {
    617634    $page->param(del_getconf => 1);
     635
     636##fixme
     637# do a check for "group has stuff in it", and splatter a big warning
     638# up along with an unchecked-by-default check box to YES DAMMIT DELETE THE WHOLE THING
     639
    618640#    $page->param(groupname => groupName($dbh,$webvar{id}));
    619641# print some neato things?
    … …  
    628650# need to find failure mode
    629651      logaction(0, $session->param("username"), $webvar{curgroup}, "Failure deleting group $deleteme: $msg");
    630       changepage(page => "grpman", del_failed => 1, errmsg => $msg);
     652      changepage(page => "grpman", errmsg => "Error deleting group $deleteme: $msg");
    631653    } else {
    632654##fixme: need to clean up log when deleting a major container
    … …  
    643665} elsif ($webvar{page} eq 'edgroup') {
    644666
    645   changepage(page => "grpman", errmsg => "You are not permitted to edit groups", id => $webvar{parentid})
     667  changepage(page => "grpman", errmsg => "You are not permitted to edit groups")
    646668        unless ($permissions{admin} || $permissions{group_edit});
    647669
    … …  
    12541276  $page->param(logingrp_num => $logingroup);
    12551277
     1278  $page->param(maydefrec => $permissions{admin});
    12561279  $page->param(mayimport => $permissions{admin} || $permissions{domain_create});
    12571280  $page->param(maybulk => $permissions{admin} || $permissions{domain_edit} || $permissions{domain_create} || $permissions{domain_delete});
     1281
     1282  $page->param(chggrps => ($permissions{admin} || $permissions{group_create} || $permissions{group_edit} || $permissions{group_delete}));
    12581283
    12591284  # group tree.  should go elsewhere, probably
    … …  
    16401665
    16411666  my @childgroups;
    1642   getChildren($dbh, $logingroup, \@childgroups, 'all') if $searchsubs;
     1667  getChildren($dbh, $curgroup, \@childgroups, 'all') if $searchsubs;
    16431668  my $childlist = join(',',@childgroups);
    16441669
    1645   my $sql = "SELECT count(*) FROM groups WHERE parent_group_id IN ($logingroup".($childlist ? ",$childlist" : '').")".
     1670  my $sql = "SELECT count(*) FROM groups WHERE parent_group_id IN ($curgroup".($childlist ? ",$childlist" : '').")".
    16461671        ($startwith ? " AND group_name ~* '^[$startwith]'" : '').
    16471672        ($filter ? " AND group_name ~* '$filter'" : '');
    … …  
    16871712        "LEFT OUTER JOIN users u ON u.group_id=g.group_id ".
    16881713        "LEFT OUTER JOIN domains d ON d.group_id=g.group_id ".
    1689         "WHERE g.parent_group_id IN ($logingroup".($childlist ? ",$childlist" : '').") ".
     1714        "WHERE g.parent_group_id IN ($curgroup".($childlist ? ",$childlist" : '').") ".
    16901715##fixme:  don't do variable subs in SQL, use placeholders and params in ->execute()
    16911716        ($startwith ? " AND g.group_name ~* '^[$startwith]'" : '').
    … …  
    17061731    $row{bg} = ($rownum++)%2;
    17071732    $row{sid} = $sid;
     1733    $row{edgrp} = ($permissions{admin} || $permissions{group_edit});
     1734    $row{delgrp} = ($permissions{admin} || $permissions{group_delete});
    17081735    push @grouplist, \%row;
    17091736  }
Note: See TracChangeset for help on using the changeset viewer.