Changeset 178 for trunk/dns.cgi

Timestamp:

12/02/11 13:19:15 (12 years ago)

Author:

Kris Deugau

Message:

/trunk

Security review (See #30)

• fix up ACL handling in group modification; as with user editing, the user may not make any change that includes access that user does not already have. This may mean removing a permission previously set but which the user doesn't have.

File:

• trunk/dns.cgi (modified) (3 diffs)

trunk/dns.cgi

@@ -754 +754 @@
     $session->clear('resultmsg');
   }
+  if ($session->param('warnmsg')) {
+    $page->param(warnmsg => $session->param('warnmsg'));
+    $session->clear('warnmsg');
+  }
   if ($session->param('errmsg')) {
     $page->param(errmsg => $session->param('errmsg'));
@@ -841 +845 @@
     getPermissions($dbh, 'group', $webvar{gid}, \%curperms);
     my %chperms;
+    my $alterperms = 0;
     foreach (@permtypes) {
       $webvar{$_} = 0 if !defined($webvar{$_});
       $webvar{$_} = 1 if $webvar{$_} eq 'on';
-      $chperms{$_} = $webvar{$_} if $curperms{$_} ne $webvar{$_};
+      if ($permissions{admin} || $permissions{$_}) {
+        $chperms{$_} = $webvar{$_} if $curperms{$_} ne $webvar{$_};
+      } else {
+        $alterperms = 1;
+        $chperms{$_} = 0;
+      }
     }
     my ($code,$msg) = changePermissions($dbh, 'group', $webvar{gid}, \%chperms);
@@ -850 +860 @@
       logaction(0, $session->param("username"), $webvar{gid},
         "Updated default permissions in group $webvar{gid} (".groupName($dbh, $webvar{gid}).")");
-      changepage(page => "grpman", resultmsg =>
-        "Updated default permissions in group ".groupName($dbh, $webvar{gid}));
+      if ($alterperms) {
+        changepage(page => "grpman", warnmsg =>
+                "You can only grant permissions you hold.  Default permissions in group ".
+                groupName($dbh, $webvar{gid})." updated with reduced access");
+      } else {
+        changepage(page => "grpman", resultmsg =>
+                "Updated default permissions in group ".groupName($dbh, $webvar{gid}));
+      }
     }
     # no point in doing extra work