Changeset 179

Timestamp:

12/02/11 15:37:10 (13 years ago)

Author:

Kris Deugau

Message:

/trunk

Fix up ACL and scope checks on groups (see #30)

• check correct ACL permission for group creation
• check parent group of a new group is in-scope for user
• make sure new groups do not exceed the ACL given to the user
• normalize action reporting (success and warning) compared to the same actions elsewhere
• check scope deleting a group
• check scope editing a group

File:

• trunk/dns.cgi (modified) (4 diffs)

trunk/dns.cgi

@@ -766 +766 @@
 } elsif ($webvar{page} eq 'newgrp') {
 
-  changepage(page => "grpman", errmsg => "You are not permitted to add groups", id => $webvar{parentid})
-        unless ($permissions{admin} || $permissions{group_add});
+  changepage(page => "grpman", errmsg => "You are not permitted to add groups")
+        unless ($permissions{admin} || $permissions{group_create});
 
   # do.. uhh.. stuff.. if we have no webvar{action}
   if ($webvar{action} && $webvar{action} eq 'add') {
+
+    # security check - does the user have permission to access this entity?
+    if (!check_scope(id => $webvar{pargroup}, type => 'group')) {
+      changepage(page => "grpman", errmsg => "You are not permitted to add a group to the requested parent group");
+    }
+
     my %newperms;
+    my $alterperms = 0;
     foreach (@permtypes) {
       $newperms{$_} = 0;
-      $newperms{$_} = (defined($webvar{$_}) && $webvar{$_} eq 'on' ? 1 : 0);
+      if ($permissions{admin} || $permissions{$_}) { 
+        $newperms{$_} = (defined($webvar{$_}) && $webvar{$_} eq 'on' ? 1 : 0);
+      } else { 
+        $alterperms = 1; 
+      }
     }
     # not gonna provide the 4th param: template-or-clone flag, just yet
@@ -780 +791 @@
     if ($code eq 'OK') {
       logaction(0, $session->param("username"), $webvar{pargroup}, "Added group $webvar{newgroup}");
-      changepage(page => "grpman");
+      if ($alterperms) {
+        changepage(page => "grpman", warnmsg => 
+                "You can only grant permissions you hold.  New group $webvar{newgroup} added with reduced access.");
+      } else {
+        changepage(page => "grpman", resultmsg => "Added group $webvar{newgroup}");
+      }
     }
     # no point in doing extra work
@@ -801 +817 @@
         unless ($permissions{admin} || $permissions{group_delete});
 
+  # security check - does the user have permission to access this entity?
+  if (!check_scope(id => $webvar{id}, type => 'group')) {
+    changepage(page => "grpman", errmsg => "You are not permitted to delete the requested group");
+  }
+
   $page->param(id => $webvar{id});
   # first pass = confirm y/n (sorta)
@@ -839 +860 @@
   changepage(page => "grpman", errmsg => "You are not permitted to edit groups")
         unless ($permissions{admin} || $permissions{group_edit});
+
+  # security check - does the user have permission to access this entity?
+  if (!check_scope(id => $webvar{gid}, type => 'group')) {
+    changepage(page => "grpman", errmsg => "You are not permitted to edit the requested group");
+  }
 
   if ($webvar{action} eq 'updperms') {