Changeset 789 for trunk/cgi-bin/main.cgi

Timestamp:

12/10/15 16:49:01 (8 years ago)

Author:

Kris Deugau

Message:

/trunk

Add an ACL flag for merge operations. This is not automatically included
in the "Admin" priviledge per request, since a merge operation can
potentially wipe virtually the entire dataset. See #8.

File:

• trunk/cgi-bin/main.cgi (modified) (4 diffs)

trunk/cgi-bin/main.cgi

@@ -1063 +1063 @@
 
   # Need to find internal knobs to twist to actually vary these.  (Ab)use "change" flag for now
-  $page->param(maymerge => ($IPDBacl{$authuser} =~ /c/ && $blockinfo->{type} !~ /^.i$/));
+  $page->param(maymerge => ($IPDBacl{$authuser} =~ /m/ && $blockinfo->{type} !~ /^.i$/));
+
   if ($IPDBacl{$authuser} =~ /c/ && $blockinfo->{type} !~ /^.i$/) {
     if ($blockinfo->{type} =~ /^.p$/) {
@@ -1323 +1324 @@
 # Set up for merge
 sub prepMerge {
+  if ($IPDBacl{$authuser} !~ /m/) {
+    $aclerr = 'mergeblock';
+    return;
+  }
+
   my $binfo = getBlockData($ip_dbh, $webvar{block});
 
@@ -1348 +1354 @@
 # Show what will be merged, present warnings about data loss
 sub confMerge {
+  if ($IPDBacl{$authuser} !~ /m/) {
+    $aclerr = 'mergeblock';
+    return;
+  }
+
   if (!$webvar{newmask} || $webvar{newmask} !~ /^\d+$/) {
     $page->param(err => 'New netmask required');
@@ -1387 +1398 @@
 # Make it so
 sub doMerge {
+  if ($IPDBacl{$authuser} !~ /m/) {
+    $aclerr = 'mergeblock';
+    return;
+  }
+
   if (!$webvar{newmask} || $webvar{newmask} !~ /^\d+$/) {
     $page->param(err => 'New netmask required');