Changeset 26 for trunk/dns.cgi

Timestamp:

11/05/09 15:40:13 (15 years ago)

Author:

Kris Deugau

Message:

/trunk

checkpoint

• move login redirect to after the database init so we can check users against the database
• add basic login handling
• tweak listings and loops to restrict access to domains/groups outside the group tree of the logged in user

File:

• trunk/dns.cgi (modified) (7 diffs)

trunk/dns.cgi

@@ -53 +53 @@
 my $group = ($webvar{group} ? $webvar{group} : 1);
 
-# handle login redirect
-if ($webvar{action} && $webvar{action} eq 'login') {
-  ##fixme:  need to actually do a user/pass check
-  changepage(page => "domlist");
-}
+# nrgh, can't handle login here because we don't have a database handle to check the user/pass with yet
 
 if ($webvar{action} && $webvar{action} eq 'chgroup') {
@@ -87 +83 @@
 # fiddle hardcoded "defaults" as per system/user (?) prefs
 initGlobals($dbh);
+
+# handle login redirect
+if ($webvar{action} && $webvar{action} eq 'login') {
+  my $sth = $dbh->prepare("SELECT user_id,group_id,password,firstname,lastname FROM users WHERE username=?");
+  $sth->execute($webvar{username});
+  my ($uid,$gid,$pass,$fname,$lname) = $sth->fetchrow_array;
+  $webvar{loginfailed} = 1 if !defined($uid);
+  $webvar{loginfailed} = 1 if $pass ne $webvar{password};
+
+  # set session bits
+  $session->param('logingroup',$gid);
+  $session->param('curgroup',$gid);
+
+  changepage(page => "domlist") if !defined($webvar{loginfailed});
+}
 
 ## Default page is a login page
@@ -104 +115 @@
 $page->param(sid => $sid);
 
-if ($webvar{page} eq 'domlist' or $webvar{page} eq 'index') {
+if ($webvar{page} eq 'login') {
+
+  $page->param(loginfailed => 1) if $webvar{loginfailed};
+##fixme:  set up session init to actually *check* for session timeout
+  $page->param(timeout => 1) if $webvar{sesstimeout};
+
+} elsif ($webvar{page} eq 'domlist' or $webvar{page} eq 'index') {
 
 # hmm.  seeing problems in some possibly-not-so-corner cases.
@@ -774 +791 @@
 
 sub listgroups {
-  my $sth = $dbh->prepare("select count(*) from groups");
+  my @childgroups;
+  getChildren($dbh, $logingroup, \@childgroups, 'all');
+  my $childlist = join(',',@childgroups);
+
+  my $sql = "SELECT count(*) FROM groups WHERE group_id IN ($logingroup".($childlist ? ",$childlist" : '').")";
+  my $sth = $dbh->prepare($sql);
+
   $sth->execute;
   my ($count) = ($sth->fetchrow_array);
-
 # fill page count and first-previous-next-last-all bits
 ##fixme - hardcoded group bit
@@ -785 +807 @@
   my @grouplist;
   $sth = $dbh->prepare("SELECT g.group_id, g.group_name, g2.group_name, ".
-        "count(distinct(u.email)), count(distinct(d.domain)) ".
+        "count(distinct(u.username)), count(distinct(d.domain)) ".
         "FROM groups g ".
         "INNER JOIN groups g2 ON g2.group_id=g.parent_group_id ".
         "LEFT OUTER JOIN users u ON u.group_id=g.group_id ".
         "LEFT OUTER JOIN domains d ON d.group_id=g.group_id ".
+        "WHERE g.group_id IN ($logingroup".($childlist ? ",$childlist" : '').") ".
         "GROUP BY g.group_id, g.group_name, g2.group_name ".
         "ORDER BY g.group_id".($offset eq 'all' ? '' : " LIMIT $perpage OFFSET ".$offset*$perpage));
@@ -813 +836 @@
   my $template_var = shift;
   my $cur = shift || $curgroup;
+
+  my @childgroups;
+  getChildren($dbh, $logingroup, \@childgroups, 'all');
+  my $childlist = join(',',@childgroups);
+
   # weesa gonna discard parent_group_id for now
-  my $sth = $dbh->prepare("SELECT group_id,parent_group_id,group_name FROM groups ORDER BY group_id");
+  my $sth = $dbh->prepare("SELECT group_id,parent_group_id,group_name FROM groups ".
+        "WHERE group_id IN ($logingroup".($childlist ? ",$childlist" : '').")".
+        "ORDER BY group_id");
   $sth->execute;
   my @grouplist;
@@ -830 +860 @@
 
 } # end fill_grouplist()
+
 
 sub list_users {