Changeset 592 for trunk/DNSDB.pm

Timestamp:

02/13/14 17:43:02 (10 years ago)

Author:

Kris Deugau

Message:

/trunk

Review, fix, tweak, and fine-tune user permission add/update handling.

Confirm that it now correctly limits a user to granting only those
permissions they already hold, and only warns when the requested
permissions are really greater or mismatched.

Also catch a possible malicious escalation to superuser/admin status.

Confirm it *should* be impossible to generate this warning via normal
web UI actions; someone would have to manually construct a URL or POST
request with the appropriate fields.

See #30.

File:

• trunk/DNSDB.pm (modified) (2 diffs)

trunk/DNSDB.pm

@@ -1735 +1735 @@
 # Returns '>', '<', '=', '!'
 sub comparePermissions {
+  my $self = shift;
   my $p1 = shift;
   my $p2 = shift;
@@ -2816 +2817 @@
     # insert the user...  note we set inherited perms by default since
     # it's simple and cleans up some other bits of state
+##fixme:  need better handling of case of inherited or missing (!!) permissions entries
     my $sth = $dbh->prepare("INSERT INTO users ".
         "(group_id,username,password,firstname,lastname,phone,type,status,permission_id,inherit_perm) ".