Changeset 207


Ignore:
Timestamp:
12/19/11 17:20:54 (12 years ago)
Author:
Kris Deugau
Message:

/trunk

Fix overloaded-$webvar{action}-related buglet - changing the default
group can cause the page to mutate due to template/page overloading.
Reported by Reid Sutherland on the "Edit user" page, when clicking
a group to change the default group.

Group edit and bulk domain change pages tweaked although the impact
is limited to changing the starting data, not the page operation.

Location:
trunk
Files:
6 edited

Legend:

Unmodified
Added
Removed

  • trunk/dns.cgi

    r205 r207  
    807807        unless ($permissions{admin} || $permissions{group_create});
    808808
    809   # do.. uhh.. stuff.. if we have no webvar{action}
    810   if ($webvar{action} && $webvar{action} eq 'add') {
     809  # do.. uhh.. stuff.. if we have no webvar{grpaction}
     810  if ($webvar{grpaction} && $webvar{grpaction} eq 'add') {
    811811
    812812    # security check - does the user have permission to access this entity?
    … …  
    901901  }
    902902
    903   if ($webvar{action} eq 'updperms') {
     903  if ($webvar{grpaction} eq 'updperms') {
    904904    # extra safety check;  make sure user can't construct a URL to bypass ACLs
    905905    my %curperms;
    … …  
    994994  }
    995995
    996   if ($webvar{action} eq 'move') {
     996  if ($webvar{bulkaction} eq 'move') {
    997997    changepage(page => "domlist", errmsg => "You are not permitted to bulk-move domains")
    998998        unless ($permissions{admin} || ($permissions{domain_edit} && $permissions{domain_create} && $permissions{domain_delete}));
    … …  
    10291029    $page->param(bulkresults => \@bulkresults);
    10301030
    1031   } elsif ($webvar{action} eq 'deactivate' || $webvar{action} eq 'activate') {
    1032     changepage(page => "domlist", errmsg => "You are not permitted to bulk-$webvar{action} domains")
     1031  } elsif ($webvar{bulkaction} eq 'deactivate' || $webvar{bulkaction} eq 'activate') {
     1032    changepage(page => "domlist", errmsg => "You are not permitted to bulk-$webvar{bulkaction} domains")
    10331033        unless ($permissions{admin} || $permissions{domain_edit});
    1034     $page->param(action => "$webvar{action} domains");
     1034    $page->param(action => "$webvar{bulkaction} domains");
    10351035    my @bulkresults;
    10361036    foreach (keys %webvar) {
    … …  
    10461046      $row{domain} = domainName($dbh,$webvar{$_});
    10471047##fixme:  error handling on status change
    1048       my $stat = domStatus($dbh,$webvar{$_},($webvar{action} eq 'activate' ? 'domon' : 'domoff'));
     1048      my $stat = domStatus($dbh,$webvar{$_},($webvar{bulkaction} eq 'activate' ? 'domon' : 'domoff'));
    10491049      logaction($webvar{$_}, $session->param("username"), parentID($webvar{$_}, 'dom', 'group'),
    10501050                "Changed domain ".domainName($dbh, $webvar{$_})." state to ".($stat ? 'active' : 'inactive'));
    … …  
    10561056    $page->param(bulkresults => \@bulkresults);
    10571057
    1058   } elsif ($webvar{action} eq 'delete') {
     1058  } elsif ($webvar{bulkaction} eq 'delete') {
    10591059    changepage(page => "domlist", errmsg => "You are not permitted to bulk-delete domains")
    10601060        unless ($permissions{admin} || $permissions{domain_delete});
    1061     $page->param(action => "$webvar{action} domains");
     1061    $page->param(action => "$webvar{bulkaction} domains");
    10621062    my @bulkresults;
    10631063    foreach (keys %webvar) {
    … …  
    11551155  $page->param(is_admin => $permissions{admin});
    11561156
    1157   $webvar{action} = '' if !$webvar{action};
    1158 
    1159   if ($webvar{action} eq 'add' or $webvar{action} eq 'update') {
    1160 
    1161     $page->param(add => 1) if $webvar{action} eq 'add';
     1157  $webvar{useraction} = '' if !$webvar{useraction};
     1158
     1159  if ($webvar{useraction} eq 'add' or $webvar{useraction} eq 'update') {
     1160
     1161    $page->param(add => 1) if $webvar{useraction} eq 'add';
    11621162
    11631163    my ($code,$msg);
    … …  
    12081208        $permstring = 'i';
    12091209      }
    1210       if ($webvar{action} eq 'add') {
     1210      if ($webvar{useraction} eq 'add') {
    12111211        changepage(page => "useradmin", errmsg => "You do not have permission to add new users")
    12121212                unless $permissions{admin} || $permissions{user_create};
    … …  
    12441244        changepage(page => "useradmin", warnmsg =>
    12451245                "You can only grant permissions you hold.  $webvar{uname} ".
    1246                 ($webvar{action} eq 'add' ? 'added' : 'updated')." with reduced access.");
     1246                ($webvar{useraction} eq 'add' ? 'added' : 'updated')." with reduced access.");
    12471247      } else {
    12481248        changepage(page => "useradmin", resultmsg => "Successfully ".
    1249                 ($webvar{action} eq 'add' ? 'added' : 'updated')." user $webvar{uname}");
     1249                ($webvar{useraction} eq 'add' ? 'added' : 'updated')." user $webvar{uname}");
    12501250      }
    12511251
    … …  
    12531253    } else {
    12541254      $page->param(add_failed => 1);
    1255       $page->param(action => $webvar{action});
     1255      $page->param(action => $webvar{useraction});
    12561256      $page->param(set_permgroup => 1);
    12571257      if ($webvar{perms_type} eq 'inherit') {   # set permission class radio
    … …  
    12711271      fill_actypelist($webvar{accttype});
    12721272      fill_clonemelist();
    1273       logaction(0, $session->param("username"), $curgroup, "Failed to $webvar{action} user ".
     1273      logaction(0, $session->param("username"), $curgroup, "Failed to $webvar{useraction} user ".
    12741274        "$webvar{uname}: $msg")
    12751275        if $config{log_failures};
    12761276    }
    12771277
    1278   } elsif ($webvar{action} eq 'edit') {
     1278  } elsif ($webvar{useraction} eq 'edit') {
    12791279
    12801280    changepage(page => "useradmin", errmsg => "You do not have permission to edit users")

  • trunk/templates/bulkdomain.tmpl

    r166 r207  
    2121                <td>Action:</td>
    2222                <td align="left">
    23 <TMPL_IF maymove>               <input type="radio" name="action" value="move" checked="checked" /> Move to group: <select name="destgroup">
     23<TMPL_IF maymove>               <input type="radio" name="bulkaction" value="move" checked="checked" /> Move to group: <select name="destgroup">
    2424<TMPL_LOOP name=grouplist>              <option value="<TMPL_VAR NAME=groupval>"<TMPL_IF groupactive> selected="selected"</TMPL_IF>><TMPL_VAR name=groupname></option>
    2525</TMPL_LOOP>
    2626                </select><br /></TMPL_IF>
    27 <TMPL_IF maystatus>             <input type="radio" name="action" value="deactivate" /> Deactivate<br />
    28                 <input type="radio" name="action" value="activate" /> Activate<br /></TMPL_IF>
    29 <TMPL_IF maydelete>             <input type="radio" name="action" value="delete" /> Delete<br /></TMPL_IF>
     27<TMPL_IF maystatus>             <input type="radio" name="bulkaction" value="deactivate" /> Deactivate<br />
     28                <input type="radio" name="bulkaction" value="activate" /> Activate<br /></TMPL_IF>
     29<TMPL_IF maydelete>             <input type="radio" name="bulkaction" value="delete" /> Delete<br /></TMPL_IF>
    3030                </td>
    3131        </tr>

  • trunk/templates/edgroup.tmpl

    r100 r207  
    99<input type="hidden" name="sid" value="<TMPL_VAR NAME=sid>" />
    1010<input type="hidden" name="page" value="edgroup" />
    11 <input type="hidden" name="action" value="updperms" />
     11<input type="hidden" name="grpaction" value="updperms" />
    1212<input type="hidden" name="gid" value="<TMPL_VAR NAME=gid>" />
    1313

  • trunk/templates/newgrp.tmpl

    r133 r207  
    1010<input type="hidden" name="sid" value="<TMPL_VAR NAME=sid>" />
    1111<input type="hidden" name="page" value="newgrp" />
    12 <input type="hidden" name="action" value="add" />
     12<input type="hidden" name="grpaction" value="add" />
    1313
    1414<table class="container" width="450">

  • trunk/templates/user.tmpl

    r143 r207  
    1010<input type="hidden" name="sid" value="<TMPL_VAR NAME=sid>" />
    1111<input type="hidden" name="page" value="user" />
    12 <input type="hidden" name="action" value="<TMPL_VAR NAME=action>" />
     12<input type="hidden" name="useraction" value="<TMPL_VAR NAME=action>" />
    1313<TMPL_IF uid><input type="hidden" name="uid" value="<TMPL_VAR NAME=uid>" /></TMPL_IF>
    1414<TMPL_IF gid><input type="hidden" name="gid" value="<TMPL_VAR NAME=gid>" /></TMPL_IF>

  • trunk/templates/useradmin.tmpl

    r144 r207  
    3737<TMPL_LOOP name=usertable>
    3838<tr class="row<TMPL_VAR name=bg>">
    39         <td align="left"><TMPL_IF eduser><a href="dns.cgi?sid=<TMPL_VAR NAME=sid>&amp;page=user&amp;action=edit&amp;user=<TMPL_VAR NAME=userid>"><TMPL_VAR NAME=username></a><TMPL_ELSE><TMPL_VAR NAME=username></TMPL_IF></td>
     39        <td align="left"><TMPL_IF eduser><a href="dns.cgi?sid=<TMPL_VAR NAME=sid>&amp;page=user&amp;useraction=edit&amp;user=<TMPL_VAR NAME=userid>"><TMPL_VAR NAME=username></a><TMPL_ELSE><TMPL_VAR NAME=username></TMPL_IF></td>
    4040        <td class="data_nowrap"><TMPL_VAR name=userfull></td>
    4141        <td><TMPL_VAR name=usertype></td>
Note: See TracChangeset for help on using the changeset viewer.