Changeset 319

Timestamp:

04/26/12 17:25:09 (13 years ago)

Author:

Kris Deugau

Message:

/trunk

Refine permissions handling:

• self_edit now has meaning; the user can edit (or delete) their own account but not others.
• Check on each request to see if a user was disabled, otherwise a user could keep their session active just by making a request just before the session expiry, indefinitely.
• Don't allow non-superusers to make changes to a superuser account

File:

• trunk/dns.cgi (modified) (5 diffs)

trunk/dns.cgi

@@ -286 +286 @@
 } # handle global webvar{action}s
 
+# finally check if the user was disabled.  we could just leave this for logout/session expiry,
+# but if they keep the session active they'll continue to have access long after being disabled.  :/
+# Treat it as a session expiry.
+if ($session->param('uid') && !userStatus($dbh, $session->param('uid')) ) {
+  $sid = '';
+  $session->delete;     # force expiry of the session Right Away
+  $session->flush;      # make sure it hits storage
+  changepage(page=> "login", sessexpired => 1);
+}
+
 # Misc Things To Do on most pages
 initPermissions($dbh, $session->param('uid'));
@@ -1089 +1099 @@
       $flag = 1 if isParent($dbh, $_, 'group', $webvar{id}, 'user');
     }
-    if ($flag && ($permissions{admin} || $permissions{user_edit})) {
+    if ($flag && ($permissions{admin} || $permissions{user_edit} ||
+        ($permissions{self_edit} && $webvar{id} == $session->param('uid')) )) {
       my $stat = userStatus($dbh,$webvar{id},$webvar{userstatus});
       $page->param(resultmsg => $DNSDB::resultstr);
@@ -1202 +1213 @@
       } else {
         changepage(page => "useradmin", errmsg => "You do not have permission to edit users")
-                unless $permissions{admin} || $permissions{user_edit};
+                unless $permissions{admin} || $permissions{user_edit} || 
+                        ($permissions{self_edit} && $session->param('uid') == $webvar{uid});
         # security check - does the user have permission to access this entity?
         if (!check_scope(id => $webvar{user}, type => 'user')) {
@@ -1259 +1271 @@
 
     changepage(page => "useradmin", errmsg => "You do not have permission to edit users")
-        unless $permissions{admin} || $permissions{user_edit};
+        unless $permissions{admin} || $permissions{user_edit} ||
+                ($permissions{self_edit} && $session->param('uid') == $webvar{user});
 
     # security check - does the user have permission to access this entity?
@@ -2082 +2095 @@
     $row{bg} = ($rownum++)%2;
     $row{sid} = $sid;
-    $row{eduser} = ($permissions{admin} || $permissions{user_edit});
-    $row{deluser} = ($permissions{admin} || $permissions{user_delete});
+    $row{eduser} = ($permissions{admin} ||
+        ($permissions{user_edit} && $data[3] ne 'S') || 
+        ($permissions{self_edit} && $data[0] == $session->param('uid')) );
+    $row{deluser} = ($permissions{admin} || ($permissions{user_delete} && $data[3] ne 'S'));
     push @userlist, \%row;
   }