Changeset 83 for trunk/dns.cgi

Timestamp:

02/25/11 17:56:25 (13 years ago)

Author:

Kris Deugau

Message:

/trunk

Checkpoint; partial completion of user editing.

• general user metadata, username, and password can be changed
• permissions need to be clarified. Also affects group permission editing to some degree.

File:

• trunk/dns.cgi (modified) (8 diffs)

trunk/dns.cgi

@@ -19 +19 @@
 use Net::DNS;
 use DBI;
+use Data::Dumper;
 
 use lib '.';
@@ -592 +593 @@
 } elsif ($webvar{page} eq 'user') {
 
-  fill_actypelist();
+  #fill_actypelist($webvar{accttype});
   fill_clonemelist();
   my %grpperms;
   getPermissions($dbh, 'group', $curgroup, \%grpperms);
-  fill_permissions($page, \%grpperms);
+
   my $grppermlist = new HTML::Template(filename => "$templatedir/permlist.tmpl");
   my %noaccess;
@@ -602 +603 @@
   $grppermlist->param(info => 1);
   $page->param(grpperms => $grppermlist->output);
+
   $page->param(is_admin => $permissions{admin});
 
-#  if ($webvar{action} eq 'new') {
-#  } els
-  if ($webvar{action} eq 'add') {
+  if ($webvar{action} eq 'add' or $webvar{action} eq 'update') {
+
+    $page->param(add => 1) if $webvar{action} eq 'add';
 
     my ($code,$msg);
 
     my $alterperms = 0; # flag iff we need to force custom permissions due to user's current access limits
+    my %newperms;
 
     if ($webvar{pass1} ne $webvar{pass2}) {
@@ -616 +619 @@
       $msg = "Passwords don't match";
     } else {
-# assemble a permission string - far simpler than trying to pass an
-# indeterminate set of permission flags individually
-
-# ooooh.
-# OOOOH.
-# We have to see if the user can add any particular permissions;  otherwise we have a priviledge escalation.  Whee.
-
-if (!$permissions{admin}) {
-  my %grpperms;
-  getPermissions($dbh, 'group', $curgroup, \%grpperms);
-  my $ret = comparePermissions(\%permissions, \%grpperms);
-  if ($ret ne '<' && $ret ne '!') {
-    # User's permissions are not a superset or equivalent to group.  Can't inherit
-    # (and include access user doesn't currently have), so we force custom.
-    $webvar{perms_type} = 'custom';
-    $alterperms = 1;
-  }
-}
-##work
+
+      # assemble a permission string - far simpler than trying to pass an
+      # indeterminate set of permission flags individually
+
+      # But first, we have to see if the user can add any particular
+      # permissions;  otherwise we have a priviledge escalation.  Whee.
+
+      if (!$permissions{admin}) {
+        my %grpperms;
+        getPermissions($dbh, 'group', $curgroup, \%grpperms);
+        my $ret = comparePermissions(\%permissions, \%grpperms);
+        if ($ret ne '<' && $ret ne '!') {
+          # User's permissions are not a superset or equivalent to group.  Can't inherit
+          # (and include access user doesn't currently have), so we force custom.
+          $webvar{perms_type} = 'custom';
+          $alterperms = 1;
+        }
+      }
+
       my $permstring;
       if ($webvar{perms_type} eq 'custom') {
         $permstring = 'C:';
         foreach (@permtypes) {
+          $newperms{$_} = 0;
+          $newperms{$_} = 1 if $webvar{$_} eq 'on';
           if ($permissions{admin}) {
             $permstring .= ",$_" if defined($webvar{$_}) && $webvar{$_} eq 'on';
@@ -652 +657 @@
         $permstring = 'i';
       }
-      ($code,$msg) = addUser($dbh,$webvar{uname}, $curgroup, $webvar{pass1},
-        ($webvar{makeactive} eq 'on' ? 1 : 0), $webvar{accttype}, $permstring,
-        $webvar{fname}, $webvar{lname}, $webvar{phone});
-    }
-
-# hokay, a bit of magic to decide which page we hit.
+      if ($webvar{action} eq 'add') {
+        ($code,$msg) = addUser($dbh, $webvar{uname}, $curgroup, $webvar{pass1},
+                ($webvar{makeactive} eq 'on' ? 1 : 0), $webvar{accttype}, $permstring,
+                $webvar{fname}, $webvar{lname}, $webvar{phone});
+      } else {
+# User update is icky.  I'd really like to do this in one atomic
+# operation, but that would duplicate a **lot** of code in DNSDB.pm
+        # Allowing for changing group, but not coding web support just yet.
+        ($code,$msg) = updateUser($dbh, $webvar{uid}, $webvar{uname}, $webvar{gid}, $webvar{pass1},
+                ($webvar{makeactive} eq 'on' ? 1 : 0), $webvar{accttype},
+                $webvar{fname}, $webvar{lname}, $webvar{phone});
+        if ($code eq 'OK') {
+##fixme - need to actually get a correct permission set to pass in here,
+# also a flag to revert custom permissions to inherited
+##work
+          ($code,$msg) = changePermissions($dbh, 'user', $webvar{uid}, \%newperms);
+        }
+      }
+    }
+
     if ($code eq 'OK') {
-##log
+
       logaction(0, $session->param("username"), $webvar{group},
-        "Added user $webvar{uname} ($webvar{fname} $webvar{lname})");
+        ($webvar{action} eq 'add' ? 'Added' : 'Updated')." user $webvar{uname} ($webvar{fname} $webvar{lname})");
       if ($alterperms) {
         changepage(page => "useradmin", warnmsg =>
-                "You can only grant permissions you hold.  $webvar{uname} added with reduced access.");
+                "You can only grant permissions you hold.  $webvar{uname} ".
+                ($webvar{action} eq 'add' ? 'added' : 'updated')." with reduced access.");
       } else {
         changepage(page => "useradmin");
       }
+
+    # add/update failed:
     } else {
-# oddity - apparently, xhtml 1.0 strict swallows username as an HTML::Template var.  O_o
       $page->param(add_failed => 1);
+      $page->param(action => $webvar{action});
+      $page->param(set_permgroup => 1);
       $page->param(uname => $webvar{uname});
       $page->param(fname => $webvar{fname});
@@ -677 +700 @@
       $page->param(pass2 => $webvar{pass2});
       $page->param(errmsg => $msg);
-      fill_actypelist();
+      fill_permissions($page, \%newperms);
+      fill_actypelist($webvar{accttype});
       fill_clonemelist();
     }
 
   } elsif ($webvar{action} eq 'edit') {
-  } elsif ($webvar{action} eq 'update') {
+
+    $page->param(set_permgroup => 1);
+    $page->param(action => 'update');
+    $page->param(uid => $webvar{user});
+    fill_clonemelist();
+
+    my $userinfo = getUserData($dbh,$webvar{user});
+    fill_actypelist($userinfo->{type});
+    # not using this yet, but adding it now means we can *much* more easily do so later.
+    $page->param(gid => $webvar{group_id});
+
+    my %curperms;
+    getPermissions($dbh, 'user', $webvar{user}, \%curperms);
+    fill_permissions($page, \%curperms);
+
+    $page->param(uname => $userinfo->{username});
+    $page->param(fname => $userinfo->{firstname});
+    $page->param(lname => $userinfo->{lastname});
+    if ($userinfo->{inherit_perm}) {
+      $page->param(perm_inherit => 1);
+    } else {
+      $page->param(perm_custom => 1);
+    }
+
+#  } elsif ($webvar{action} eq 'update') {
   } else {
     # default is "new"
+    $page->param(add => 1);
+    $page->param(action => 'add');
+    fill_permissions($page, \%grpperms);
+    fill_actypelist();
   }
 
@@ -744 +796 @@
     $page->param(pass2 => $webvar{pass2});
     $page->param(errmsg => $msg);
-    fill_actypelist();
+    fill_actypelist($webvar{accttype});
     fill_clonemelist();
   }
@@ -1168 +1220 @@
 
 sub fill_actypelist {
+  my $curtype = shift || 'u';
+
   my @actypes;
 
   my %row1 = (actypeval => 'u', actypename => 'user');
-  $row1{typesel} = 1 if $webvar{accttype} eq 'u';
+  $row1{typesel} = 1 if $curtype eq 'u';
   push @actypes, \%row1;
 
   my %row2 = (actypeval => 'S', actypename => 'superuser');
-  $row2{typesel} = 1 if $webvar{accttype} eq 'S';
+  $row2{typesel} = 1 if $curtype eq 'S';
   push @actypes, \%row2;
 
-  $page->param(actypelist       => \@actypes);
+  $page->param(actypelist => \@actypes);
 }