Changeset 67 for trunk/dns.cgi

Timestamp:

11/30/10 18:01:27 (14 years ago)

Author:

Kris Deugau

Message:

/trunk

checkpoint
Add user ACL handling nearing function
Add user/edit user pages merged; they're next to identical anyway
Group list images tweaked with proper "alpha channel", CSS fiddled again

• final arrangement will probably be a couple of small triangles; pointing right for an expandable group, down for an expanded one

Option to add user to a different group removed

File:

• trunk/dns.cgi (modified) (3 diffs)

trunk/dns.cgi

@@ -571 +571 @@
   list_users();
 
+} elsif ($webvar{page} eq 'user') {
+
+  fill_actypelist();
+  fill_clonemelist();
+  my %grpperms;
+  getPermissions($dbh, 'group', $curgroup, \%grpperms);
+  fill_permissions($page, \%grpperms);
+  my $grppermlist = new HTML::Template(filename => "$templatedir/permlist.tmpl");
+  my %noaccess;
+  fill_permissions($grppermlist, \%grpperms, \%noaccess);
+  $grppermlist->param(info => 1);
+  $page->param(grpperms => $grppermlist->output);
+  $page->param(is_admin => $permissions{admin});
+
+#  if ($webvar{action} eq 'new') {
+#  } els
+  if ($webvar{action} eq 'add') {
+
+    my ($code,$msg);
+
+    my $alterperms = 0; # flag iff we need to force custom permissions due to user's current access limits
+
+    if ($webvar{pass1} ne $webvar{pass2}) {
+      $code = 'FAIL';
+      $msg = "Passwords don't match";
+    } else {
+# assemble a permission string - far simpler than trying to pass an
+# indeterminate set of permission flags individually
+
+# ooooh.
+# OOOOH.
+# We have to see if the user can add any particular permissions;  otherwise we have a priviledge escalation.  Whee.
+
+if (!$permissions{admin}) {
+  my %grpperms;
+  getPermissions($dbh, 'group', $curgroup, \%grpperms);
+  my $ret = comparePermissions(\%permissions, \%grpperms);
+  if ($ret ne '<' && $ret ne '!') {
+    # User's permissions are not a superset or equivalent to group.  Can't inherit
+    # (and include access user doesn't currently have), so we force custom.
+    $webvar{perms_type} = 'custom';
+    $alterperms = 1;
+  }
+}
+##work
+      my $permstring;
+      if ($webvar{perms_type} eq 'custom') {
+        $permstring = 'C:';
+        foreach (@permtypes) {
+          if ($permissions{admin}) {
+            $permstring .= ",$_" if defined($webvar{$_}) && $webvar{$_} eq 'on';
+          } else {
+            $permstring .= ",$_" if $permissions{$_} && defined($webvar{$_}) && $webvar{$_} eq 'on';
+          }
+        }
+        $page->param(perm_custom => 1);
+      } elsif ($permissions{admin} && $webvar{perms_type} eq 'clone') {
+        $permstring = "c:$webvar{clonesrc}";
+        $page->param(perm_clone => 1);
+      } else {
+        $permstring = 'i';
+      }
+      ($code,$msg) = addUser($dbh,$webvar{uname}, $curgroup, $webvar{pass1},
+        ($webvar{makeactive} eq 'on' ? 1 : 0), $webvar{accttype}, $permstring,
+        $webvar{fname}, $webvar{lname}, $webvar{phone});
+    }
+
+# hokay, a bit of magic to decide which page we hit.
+    if ($code eq 'OK') {
+##log
+      logaction(0, $session->param("username"), $webvar{group},
+        "Added user $webvar{uname} ($webvar{fname} $webvar{lname})");
+      if ($alterperms) {
+        changepage(page => "useradmin", warnmsg =>
+                "You can only grant permissions you hold.  $webvar{uname} added with reduced access.");
+      } else {
+        changepage(page => "useradmin");
+      }
+id => $webvar{id}, defrec => $webvar{defrec}
+    } else {
+# oddity - apparently, xhtml 1.0 strict swallows username as an HTML::Template var.  O_o
+      $page->param(add_failed => 1);
+      $page->param(uname => $webvar{uname});
+      $page->param(fname => $webvar{fname});
+      $page->param(lname => $webvar{lname});
+      $page->param(pass1 => $webvar{pass1});
+      $page->param(pass2 => $webvar{pass2});
+      $page->param(errmsg => $msg);
+      fill_actypelist();
+      fill_clonemelist();
+    }
+
+  } elsif ($webvar{action} eq 'edit') {
+  } elsif ($webvar{action} eq 'update') {
+  } else {
+    # default is "new"
+  }
+
 } elsif ($webvar{page} eq 'newuser') {
 
@@ -576 +674 @@
   fill_actypelist();
   fill_clonemelist();
+
+  my %grpperms;
+  getPermissions($dbh, 'group', $curgroup, \%grpperms);
+  fill_permissions($page, \%grpperms);
+
+  my $grppermlist = new HTML::Template(filename => "$templatedir/permlist.tmpl");
+  my %noaccess;
+  fill_permissions($grppermlist, \%grpperms, \%noaccess);
+  $grppermlist->param(info => 1);
+  $page->param(grpperms => $grppermlist->output);
 
 } elsif ($webvar{page} eq 'adduser') {
@@ -1451 +1559 @@
   my $template = shift; # may need to do several sets on a single page
   my $permset = shift;  # hashref to permissions on object
+  my $usercan = shift || \%permissions; # allow alternate user-is-allowed permission block
 
   foreach (@permtypes) {
-    $template->param("may_$_" => ($permissions{admin} || $permissions{$_}));
+    $template->param("may_$_" => ($usercan->{admin} || $usercan->{$_}));
     $template->param($_ => $permset->{$_});
   }