From 6f8972743e9430a8657ec91d0c3fa1a12281b061 Mon Sep 17 00:00:00 2001 From: JT Smith Date: Sun, 25 May 2003 01:37:27 +0000 Subject: [PATCH] Added secondary security. --- docs/upgrades/upgrade_5.2.6-5.3.0.sql | 7 ++ lib/WebGUI/Grouping.pm | 35 ++++++ lib/WebGUI/Macro/AdminBar.pm | 10 +- lib/WebGUI/Operation/Account.pm | 3 +- lib/WebGUI/Operation/Group.pm | 158 +++++++++++++++++++++++--- lib/WebGUI/Operation/User.pm | 108 +++++++++++++----- 6 files changed, 275 insertions(+), 46 deletions(-) diff --git a/docs/upgrades/upgrade_5.2.6-5.3.0.sql b/docs/upgrades/upgrade_5.2.6-5.3.0.sql index 02a057757..90e3c9b11 100644 --- a/docs/upgrades/upgrade_5.2.6-5.3.0.sql +++ b/docs/upgrades/upgrade_5.2.6-5.3.0.sql @@ -575,6 +575,13 @@ delete from international where languageId=1 and namespace='WebGUI' and internat insert into international (internationalId,languageId,namespace,message,lastUpdated,context) values (974,1,'WebGUI','Users can add themselves?', 1053778912,'Determines whether users can add themselves to this group.'); delete from international where languageId=1 and namespace='WebGUI' and internationalId=844; insert into international (internationalId,languageId,namespace,message,lastUpdated,context) values (844,1,'WebGUI','These macros have to do with users and logins.\r\n

\r\n\r\n^a; or ^a(); - My Account Link
\r\nA link to your account information. In addition you can change the link text by creating a macro like this ^a("Account Info");. \r\n

\r\n\r\nNOTES: You can also use the special case ^a(linkonly); to return only the URL to the account page and nothing more. Also, the .myAccountLink style sheet class is tied to this macro.\r\n

\r\n\r\n\r\n^AdminText();
\r\nDisplays a small text message to a user who is in admin mode. Example: ^AdminText("You are in admin mode!");\r\n

\r\n\r\n^AdminToggle; or ^AdminToggle();
\r\nPlaces a link on the page which is only visible to content managers and adminstrators. The link toggles on/off admin mode. You can optionally specify other messages to display like this: ^AdminToggle("Edit On","Edit Off");\r\n

\r\n\r\n^CanEditText();
\r\nDisplay a message to a user that can edit the current page.\r\n

\r\nExample: ^CanEditText(^AdminToggle;);\r\n

\r\n\r\n^EditableToggle; or ^EditableToggle();
\r\nExactly the same as AdminToggle, except that the toggle is only displayed if the user has the rights to edit the current page.\r\n

\r\n\r\n^GroupAdd();
\r\nUsing this macro you can allow users to add themselves to a group. The first parameter is the name of the group this user should be added to. The second parameter is a text string for the user to click on to add themselves to this group.\r\n

\r\nNOTE: If the user is not logged in, or or already belongs to the group, or the group is not set to allow auto adds, then no link will be displayed.\r\n

\r\n\r\n\r\n^GroupDelete();
\r\nUsing this macro you can allow users to delete themselves from a group. The first parameter is the name of the group this user should be deleted from. The second parameter is a text string for the user to click on to delete themselves from this group.\r\n

\r\nNOTE: If the user is not logged in or the user does not belong to the group, or the group is not set to allow auto deletes, then no link will be displayed.\r\n

\r\n\r\n^GroupText();
\r\nDisplays a small text message to the user if they belong to the specified group. And you can specify an alternate message to those who are not in the group.\r\n

\r\nExample: ^GroupText("Visitors","You need an account to do anything cool on this site!","We value our registered users!");\r\n

\r\n\r\n^L; or ^L(); - Login Box
\r\nA small login form. You can also configure this macro. You can set the width of the login box like this ^L(20);. You can also set the message displayed after the user is logged in like this ^L(20,Hi ^a(^@;);. Click %here% if you wanna log out!)\r\n

\r\n\r\nNOTE: The .loginBox style sheet class is tied to this macro.\r\n

\r\n\r\n^LoginToggle; or ^LoginToggle();
\r\nDisplays a "Login" or "Logout" message depending upon whether the user is logged in or not. You can optionally specify other labels like this: ^LoginToggle("Click here to log in.","Click here to log out.");. You can also use the special case ^LoginToggle(linkonly); to return only the URL with no label.\r\n

\r\n\r\n^@; - Username
\r\nThe username of the currently logged in user.\r\n

\r\n\r\n\r\n^#; - User ID
\r\nThe user id of the currently logged in user.\r\n

\r\n\r\n', 1053779917,NULL); +insert into groups (groupId,groupName,description) values (11,"Secondary Admins","Users that have limited administrative privileges."); +delete from international where languageId=1 and namespace='WebGUI' and internationalId=976; +insert into international (internationalId,languageId,namespace,message,lastUpdated,context) values (976,1,'WebGUI','Add Users', 1053800614,'This is the label for a box that shows a list of users to add to a particular group.'); +delete from international where languageId=1 and namespace='WebGUI' and internationalId=977; +insert into international (internationalId,languageId,namespace,message,lastUpdated,context) values (977,1,'WebGUI','Is secondary admin?', 1053803387,'A flag indicating whether the users has secondary administrative privileges for this group.'); +delete from international where languageId=1 and namespace='WebGUI' and internationalId=978; +insert into international (internationalId,languageId,namespace,message,lastUpdated,context) values (978,1,'WebGUI','User added successfully.', 1053804577,'A message used after secondary admin adds a user successfully.'); diff --git a/lib/WebGUI/Grouping.pm b/lib/WebGUI/Grouping.pm index a4dbb8300..db19142c6 100755 --- a/lib/WebGUI/Grouping.pm +++ b/lib/WebGUI/Grouping.pm @@ -38,6 +38,7 @@ This package provides an interface for managing WebGUI user and group groupings. $arrayRef = WebGUI::Grouping::getGroupsForUser($userId); $arrayRef = WebGUI::Grouping::getGroupsInGroup($groupId); $arrayRef = WebGUI::Grouping::getUsersInGroup($groupId); + $yesNo = WebGUI::Grouping::userGroupAdmin($userId,$groupId); $epoch = WebGUI::Grouping::userGroupExpireDate($userId,$groupId); =head1 METHODS @@ -295,6 +296,40 @@ sub getUsersInGroup { +#------------------------------------------------------------------- + +=head2 userGroupAdmin ( userId, groupId [, value ] ) + +Returns a 1 or 0 depending upon whether the user is a sub-admin for this group. + +=over + +=item userId + +An integer that is the unique identifier for a user. + +=item groupId + +An integer that is the unique identifier for a group. + +=item value + +If specified the admin flag will be set to this value. + +=back + +=cut + +sub userGroupAdmin { + if ($_[2]) { + WebGUI::SQL->write("update groupings set groupAdmin=$_[2] where groupId=$_[1] and userId=$_[0]"); + return $_[2]; + } else { + my ($admin) = WebGUI::SQL->quickArray("select groupAdmin from groupings where groupId=$_[1] and userId=$_[0]"); + return $admin; + } +} + #------------------------------------------------------------------- =head2 userGroupExpireDate ( userId, groupId [, epoch ] ) diff --git a/lib/WebGUI/Macro/AdminBar.pm b/lib/WebGUI/Macro/AdminBar.pm index a666e3009..dbc3b5458 100644 --- a/lib/WebGUI/Macro/AdminBar.pm +++ b/lib/WebGUI/Macro/AdminBar.pm @@ -105,12 +105,18 @@ sub process { WebGUI::URL::page('op=listGroups')=>WebGUI::International::get(5), WebGUI::URL::page('op=manageSettings')=>WebGUI::International::get(4), WebGUI::URL::page('op=listUsers')=>WebGUI::International::get(7), - WebGUI::URL::page('op=listRoots')=>WebGUI::International::get(410), WebGUI::URL::page('op=viewStatistics')=>WebGUI::International::get(144) ); - } + } elsif (WebGUI::Privilege::isInGroup(11)) { + %hash = ( + WebGUI::URL::page('op=listGroupsSecondary')=>WebGUI::International::get(5), + WebGUI::URL::page('op=addUserSecondary')=>WebGUI::International::get(169), + %hash + ); + } if (WebGUI::Privilege::isInGroup(4)) { %hash = ( + WebGUI::URL::page('op=listRoots')=>WebGUI::International::get(410), 'http://validator.w3.org/check?uri=http%3A%2F%2F'.$session{env}{SERVER_NAME}. WebGUI::URL::page()=>WebGUI::International::get(399), WebGUI::URL::page('op=manageClipboard')=>WebGUI::International::get(949), diff --git a/lib/WebGUI/Operation/Account.pm b/lib/WebGUI/Operation/Account.pm index 7dea5d6de..da5ed8f0c 100644 --- a/lib/WebGUI/Operation/Account.pm +++ b/lib/WebGUI/Operation/Account.pm @@ -37,7 +37,7 @@ our @EXPORT = qw(&www_viewMessageLogMessage &www_viewThreadSubscriptions &www_vi sub _accountOptions { my ($output); $output = '