Index: branches/acl/cgi-bin/main.cgi
===================================================================
--- branches/acl/cgi-bin/main.cgi	(revision 223)
+++ branches/acl/cgi-bin/main.cgi	(revision 225)
@@ -550,10 +550,12 @@
     print qq(<hr width="60%"><center><div class="heading">No allocations in ).
         qq($master.</div>\n).
-        qq(<form action="/ip/cgi-bin/main.cgi" method=POST>\n).
-        qq(<input type=hidden name=action value="delete">\n).
-        qq(<input type=hidden name=block value="$master">\n).
-        qq(<input type=hidden name=alloctype value="mm">\n).
-        qq(<input type=submit value=" Remove this master ">\n).
-        qq(</form></center>\n);
+	($IPDBacl{$authuser} =~ /d/ ?
+	        qq(<form action="/ip/cgi-bin/main.cgi" method=POST>\n).
+	        qq(<input type=hidden name=action value="delete">\n).
+	        qq(<input type=hidden name=block value="$master">\n).
+	        qq(<input type=hidden name=alloctype value="mm">\n).
+	        qq(<input type=submit value=" Remove this master ">\n).
+	        qq(</form></center>\n) :
+		'');
 
   } # end check for existence of routed blocks in master
@@ -636,10 +638,12 @@
     print qq(<hr width="60%"><center><div class="heading">No allocations in ).
 	qq($master.</div></center>\n).
-	qq(<form action="/ip/cgi-bin/main.cgi" method=POST>\n).
-	qq(<input type=hidden name=action value="delete">\n).
-	qq(<input type=hidden name=block value="$master">\n).
-	qq(<input type=hidden name=alloctype value="rm">\n).
-	qq(<input type=submit value=" Remove this block ">\n).
-	qq(</form>\n);
+	($IPDBacl{$authuser} =~ /d/ ?
+		qq(<form action="/ip/cgi-bin/main.cgi" method=POST>\n).
+		qq(<input type=hidden name=action value="delete">\n).
+		qq(<input type=hidden name=block value="$master">\n).
+		qq(<input type=hidden name=alloctype value="rm">\n).
+		qq(<input type=submit value=" Remove this block ">\n).
+		qq(</form>\n) :
+		'');
   }
 
@@ -718,5 +722,5 @@
     my @row = ( qq(<a href="/ip/cgi-bin/main.cgi?action=edit&block=$data[0]">$data[0]</a>),
 	$data[1],$data[2],$data[3],
-	( ($data[2] eq 'n') ?
+	( (($data[2] eq 'n') && ($IPDBacl{$authuser} =~ /d/)) ?
 	  ("<a href=\"/ip/cgi-bin/main.cgi?action=delete&block=$data[0]&".
 	   "alloctype=$data[4]\">Unassign this IP</a>") :
@@ -1100,10 +1104,4 @@
   $data[2] =~ s/\s//;
 
-##fixme LEGACY CODE
-  # Postfix "i" on pool IP types
-  if ($data[2] =~ /^[cdsmw]$/) {
-    $data[2] .= "i";
-  }
-
   open (HTML, "../editDisplay.html")
 	or croak "Could not open editDisplay.html :$!";
@@ -1116,5 +1114,7 @@
 # Needs thinking.  Have to allow changes to city to correct errors, no?
   $html =~ s/\$\$BLOCK\$\$/$webvar{block}/g;
-  $html =~ s/\$\$CITY\$\$/$data[3]/g;
+
+  if ($IPDBacl{$authuser} =~ /c/) {
+    $html =~ s/\$\$CUSTID\$\$/<input type=text name=custid value="$data[1]" maxlength=15 class="regular">/;
 
 # Screw it.  Changing allocation types gets very ugly VERY quickly- especially
@@ -1125,7 +1125,7 @@
 
 ##fixme The check here should be built from the database
-  if ($data[2] =~ /^.[ne]$/) {
-    # Block that can be changed
-    my $blockoptions = "<select name=alloctype><option".
+    if ($data[2] =~ /^.[ne]$/) {
+      # Block that can be changed
+      my $blockoptions = "<select name=alloctype><option".
 	(($data[2] eq 'me') ? ' selected' : '') ." value='me'>Dialup netblock</option>\n<option".
 	(($data[2] eq 'de') ? ' selected' : '') ." value='de'>Dynamic DSL netblock</option>\n<option". 	(($data[2] eq 'dc') ? ' selected' : '') ." value='dc'>Dynamic cable netblock</option>\n<option".
@@ -1136,15 +1136,45 @@
 	(($data[2] eq 'in') ? ' selected' : '') ." value='in'>Internal netblock</option>\n".
 	"</select>\n";
-    $html =~ s/\$\$TYPESELECT\$\$/$blockoptions/g;
+      $html =~ s/\$\$TYPESELECT\$\$/$blockoptions/g;
+    } else {
+      $html =~ s/\$\$TYPESELECT\$\$/$disp_alloctypes{$data[2]}<input type=hidden name=alloctype value="$data[2]">/g;
+    }
+    $html =~ s/\$\$CITY\$\$/<input type=text name=city value="$data[3]">/g;
+    $html =~ s/\$\$CIRCID\$\$/<input type="text" name="circid" value="$data[4]" maxlength=64 size=64 class="regular">/g;
+    $html =~ s/\$\$DESC\$\$/<input type="text" name="desc" value="$data[5]" maxlength=64 size=64 class="regular">/g;
+    $html =~ s|\$\$NOTES\$\$|<textarea rows="8" cols="64" name="notes" class="regular">$data[6]</textarea>|g;
   } else {
-    $html =~ s/\$\$TYPESELECT\$\$/$disp_alloctypes{$data[2]}<input type=hidden name=alloctype value="$data[2]">/g;
-  }
-
-  # These can be modified, although CustID changes may get ignored.
-  $html =~ s/\$\$CUSTID\$\$/$data[1]/g;
-  $html =~ s/\$\$TYPE\$\$/$data[2]/g;
-  $html =~ s/\$\$CIRCID\$\$/$data[4]/g;
-  $html =~ s/\$\$DESC\$\$/$data[5]/g;
-  $html =~ s/\$\$NOTES\$\$/$data[6]/g;
+    $html =~ s/\$\$CUSTID\$\$/$data[1]/g;
+    $html =~ s/\$\$TYPESELECT\$\$/$disp_alloctypes{$data[2]}/g;
+    $html =~ s/\$\$CITY\$\$/$data[3]/g;
+    $html =~ s/\$\$CIRCID\$\$/$data[4]/g;
+    $html =~ s/\$\$DESC\$\$/$data[5]/g;
+    $html =~ s/\$\$NOTES\$\$/$data[6]/g;
+  }
+
+  # More ACL trickery - we can live with forms that don't submit,
+  # but we can't leave the extra table rows there, and we *really*
+  # can't leave the submit buttons there.
+  my $updok = '';
+  my $i=2;
+  if ($IPDBacl{$authuser} =~ /c/) {
+    $updok = qq(<tr class="color$i"><td colspan=2 class=regular><div class="center">).
+	qq(<input type="submit" value=" Update this block " class="regular">).
+	"</div></td></tr></form>\n";
+    $i--;
+  }
+  $html =~ s/\$\$UPDOK\$\$/$updok/g;
+
+  my $delok = '';
+  if ($IPDBacl{$authuser} =~ /d/) {
+    $delok = qq(<form method="POST" action="main.cgi">
+	<tr class="color$i"><td colspan=2 class="regular"><div class=center>
+	<input type="hidden" name="action" value="delete">
+	<input type="hidden" name="block" value="$webvar{block}">
+	<input type="hidden" name="alloctype" value="$data[2]">
+	<input type=submit value=" Delete this block ">
+	</div></td></tr>);
+  }
+  $html =~ s/\$\$DELOK\$\$/$delok/;
 
   print $html;
@@ -1216,4 +1246,9 @@
 # Delete an allocation.
 sub remove {
+  if ($IPDBacl{$authuser} !~ /d/) {
+    printError("You shouldn't have been able to get here.  Access denied.");
+    return;
+  }
+
   #show confirm screen.
   open HTML, "../confirmRemove.html"
@@ -1305,4 +1340,8 @@
 # Remove IPs from pool listing if necessary
 sub finalDelete {
+  if ($IPDBacl{$authuser} !~ /d/) {
+    printError("You shouldn't have been able to get here.  Access denied.");
+    return;
+  }
 
   my ($code,$msg) = deleteBlock($ip_dbh, $webvar{block}, $webvar{alloctype});