extern/egroupware_official
1
0
Fork 0
mirror of https://github.com/EGroupware/egroupware.git synced 2024-12-23 15:18:58 +01:00
Code Issues Packages Projects Releases Wiki Activity

* Admin/PostgreSQL: shorten ACL labels used to limit admin rights to 16 char and fixed stalled 14.3 update for PostgreSQL

Browse Source
This commit is contained in:
Ralf Becker 2015-08-04 09:55:57 +00:00
parent 15e989f318
commit d43c2d0b54
8 changed files with 138 additions and 134 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
admin/inc/class.admin_accesslog.inc.php
View File

@ -142,7 +142,7 @@ class admin_accesslog
if (is_array($content)) $sessions_list = $content['nm']['session_list']; if (is_array($content)) $sessions_list = $content['nm']['session_list'];
// check if user has access to requested functionality // check if user has access to requested functionality
if ($GLOBALS['egw']->acl->check($sessions_list ? 'current_sessions_access' : 'access_log_access',1,'admin')) if ($GLOBALS['egw']->acl->check($sessions_list ? 'current_sessions' : 'access_log_acces',1,'admin'))
{ {
$GLOBALS['egw']->redirect_link('/index.php'); $GLOBALS['egw']->redirect_link('/index.php');
} }
@ -283,7 +283,7 @@ class admin_accesslog
{ {
unset($sessionid[$key]); // dont allow to kill own sessions unset($sessionid[$key]); // dont allow to kill own sessions
} }
if ($GLOBALS['egw']->acl->check('current_sessions_access',8,'admin')) if ($GLOBALS['egw']->acl->check('current_sessions',8,'admin'))
{ {
$failed ++; $failed ++;
} }

14
admin/inc/class.admin_categories.inc.php
View File

@ -57,7 +57,7 @@ class admin_categories
{ {
throw new egw_exception_no_permission_admin(); throw new egw_exception_no_permission_admin();
} }
if ($GLOBALS['egw']->acl->check('global_categories_access',1,'admin')) if ($GLOBALS['egw']->acl->check('global_categorie',1,'admin'))
{ {
$GLOBALS['egw']->redirect_link('/index.php'); $GLOBALS['egw']->redirect_link('/index.php');
} }
@ -71,12 +71,12 @@ class admin_categories
{ {
if (is_null(self::$acl_search)) if (is_null(self::$acl_search))
{ {
self::$acl_search = !$GLOBALS['egw']->acl->check('global_categories_access',2,'admin'); self::$acl_search = !$GLOBALS['egw']->acl->check('global_categorie',2,'admin');
self::$acl_add = !$GLOBALS['egw']->acl->check('global_categories_access',4,'admin'); self::$acl_add = !$GLOBALS['egw']->acl->check('global_categorie',4,'admin');
self::$acl_view = !$GLOBALS['egw']->acl->check('global_categories_access',8,'admin'); self::$acl_view = !$GLOBALS['egw']->acl->check('global_categorie',8,'admin');
self::$acl_edit = !$GLOBALS['egw']->acl->check('global_categories_access',16,'admin'); self::$acl_edit = !$GLOBALS['egw']->acl->check('global_categorie',16,'admin');
self::$acl_delete = !$GLOBALS['egw']->acl->check('global_categories_access',32,'admin'); self::$acl_delete = !$GLOBALS['egw']->acl->check('global_categorie',32,'admin');
self::$acl_add_sub= !$GLOBALS['egw']->acl->check('global_categories_access',64,'admin'); self::$acl_add_sub= !$GLOBALS['egw']->acl->check('global_categorie',64,'admin');
} }
} }

20
admin/inc/class.admin_hooks.inc.php
View File

@ -53,7 +53,7 @@ class admin_hooks
if ($GLOBALS['egw_info']['user']['apps']['admin']) if ($GLOBALS['egw_info']['user']['apps']['admin'])
{ {
if (! $GLOBALS['egw']->acl->check('site_config_access',1,'admin')) if (! $GLOBALS['egw']->acl->check('site_config_acce',1,'admin'))
{ {
$file['Site Configuration'] = egw::link('/index.php','menuaction=admin.uiconfig.index&appname=admin'); $file['Site Configuration'] = egw::link('/index.php','menuaction=admin.uiconfig.index&appname=admin');
} }
@ -80,26 +80,26 @@ class admin_hooks
); );
} }
if (! $GLOBALS['egw']->acl->check('applications_access',1,'admin')) if (! $GLOBALS['egw']->acl->check('applications_acc',1,'admin'))
{ {
$file['Applications'] = egw::link('/index.php','menuaction=admin.admin_applications.index'); $file['Applications'] = egw::link('/index.php','menuaction=admin.admin_applications.index');
} }
if (! $GLOBALS['egw']->acl->check('global_categories_access',1,'admin')) if (! $GLOBALS['egw']->acl->check('global_categorie',1,'admin'))
{ {
$file['Global Categories'] = egw::link('/index.php','menuaction=admin.admin_categories.index&appname=phpgw&ajax=true'); $file['Global Categories'] = egw::link('/index.php','menuaction=admin.admin_categories.index&appname=phpgw&ajax=true');
} }
if (!$GLOBALS['egw']->acl->check('mainscreen_message_access',1,'admin') || !$GLOBALS['egw']->acl->check('mainscreen_message_access',2,'admin')) if (!$GLOBALS['egw']->acl->check('mainscreen_messa',1,'admin') || !$GLOBALS['egw']->acl->check('mainscreen_messa',2,'admin'))
{ {
$file['Change Main Screen Message'] = egw::link('/index.php','menuaction=admin.uimainscreen.index'); $file['Change Main Screen Message'] = egw::link('/index.php','menuaction=admin.uimainscreen.index');
} }
if (! $GLOBALS['egw']->acl->check('current_sessions_access',1,'admin')) if (! $GLOBALS['egw']->acl->check('current_sessions',1,'admin'))
{ {
$file['View Sessions'] = egw::link('/index.php','menuaction=admin.admin_accesslog.sessions&ajax=true'); $file['View Sessions'] = egw::link('/index.php','menuaction=admin.admin_accesslog.sessions&ajax=true');
} }
if (! $GLOBALS['egw']->acl->check('access_log_access',1,'admin')) if (! $GLOBALS['egw']->acl->check('access_log_acces',1,'admin'))
{ {
$file['View Access Log'] = egw::link('/index.php','menuaction=admin.admin_accesslog.index&ajax=true'); $file['View Access Log'] = egw::link('/index.php','menuaction=admin.admin_accesslog.index&ajax=true');
} }
@ -110,12 +110,12 @@ class admin_hooks
$file['View Error Log'] = egw::link('/index.php','menuaction=admin.uilog.list_log'); $file['View Error Log'] = egw::link('/index.php','menuaction=admin.uilog.list_log');
}*/ }*/
if (! $GLOBALS['egw']->acl->check('applications_access',16,'admin')) if (! $GLOBALS['egw']->acl->check('applications_acc',16,'admin'))
{ {
$file['Clear cache and register hooks'] = egw::link('/index.php','menuaction=admin.admin_hooks.register_all_hooks'); $file['Clear cache and register hooks'] = egw::link('/index.php','menuaction=admin.admin_hooks.register_all_hooks');
} }
if (! $GLOBALS['egw']->acl->check('asyncservice_access',1,'admin')) if (! $GLOBALS['egw']->acl->check('asyncservice_acc',1,'admin'))
{ {
$file['Asynchronous timed services'] = egw::link('/index.php','menuaction=admin.uiasyncservice.index'); $file['Asynchronous timed services'] = egw::link('/index.php','menuaction=admin.uiasyncservice.index');
} }
@ -156,7 +156,7 @@ class admin_hooks
*/ */
function register_all_hooks() function register_all_hooks()
{ {
if ($GLOBALS['egw']->acl->check('applications_access',16,'admin')) if ($GLOBALS['egw']->acl->check('applications_acc',16,'admin'))
{ {
$GLOBALS['egw']->redirect_link('/index.php'); $GLOBALS['egw']->redirect_link('/index.php');
} }
@ -193,7 +193,7 @@ class admin_hooks
'icon' => 'lock', 'icon' => 'lock',
); );
if (!$GLOBALS['egw']->acl->check('current_sessions_access',1,'admin')) // no rights to view if (!$GLOBALS['egw']->acl->check('current_sessions',1,'admin')) // no rights to view
{ {
$actions[] = array( $actions[] = array(
'description' => 'Login History', 'description' => 'Login History',

2
admin/inc/class.uiasyncservice.inc.php
View File

@ -20,7 +20,7 @@ class uiasyncservice
function index() function index()
{ {
if ($GLOBALS['egw']->acl->check('asyncservice_access',1,'admin')) if ($GLOBALS['egw']->acl->check('asyncservice_acc',1,'admin'))
{ {
egw::redirect_link('/index.php'); egw::redirect_link('/index.php');
} }

6
admin/inc/class.uiconfig.inc.php
View File

@ -36,7 +36,7 @@ class uiconfig
//_debug_array($params); //_debug_array($params);
$_appname = $_GET['appname']; $_appname = $_GET['appname'];
} }
if ($GLOBALS['egw']->acl->check('site_config_access',1,'admin')) if ($GLOBALS['egw']->acl->check('site_config_acce',1,'admin'))
{ {
egw::redirect_link('/index.php'); egw::redirect_link('/index.php');
} }
@ -105,7 +105,7 @@ class uiconfig
$c = new config($config_appname); $c = new config($config_appname);
$c->read_repository(); $c->read_repository();
if ($_POST['cancel'] || ($_POST['submit'] || $_POST['save'] || $_POST['apply']) && $GLOBALS['egw']->acl->check('site_config_access',2,'admin')) if ($_POST['cancel'] || ($_POST['submit'] || $_POST['save'] || $_POST['apply']) && $GLOBALS['egw']->acl->check('site_config_acce',2,'admin'))
{ {
egw::redirect_link('/admin/index.php?ajax=true'); egw::redirect_link('/admin/index.php?ajax=true');
} }
@ -261,7 +261,7 @@ class uiconfig
} }
} }
$t->set_var('submit', '<div class="dialogFooterToolbar" style="text-align: left">'. $t->set_var('submit', '<div class="dialogFooterToolbar" style="text-align: left">'.
($GLOBALS['egw']->acl->check('site_config_access',2,'admin') ? '' : ($GLOBALS['egw']->acl->check('site_config_acce',2,'admin') ? '' :
html::submit_button('save', 'Save')."\n". html::submit_button('save', 'Save')."\n".
html::submit_button('apply', 'Apply'))); html::submit_button('apply', 'Apply')));
$t->set_var('cancel', html::submit_button('cancel', 'Cancel').'</div>'); $t->set_var('cancel', html::submit_button('cancel', 'Cancel').'</div>');

6
admin/inc/class.uimainscreen.inc.php
View File

@ -18,11 +18,11 @@ class uimainscreen
$select_lang = $_POST['select_lang']; $select_lang = $_POST['select_lang'];
$message = get_magic_quotes_gpc() ? stripslashes($_POST['message']) : $_POST['message']; $message = get_magic_quotes_gpc() ? stripslashes($_POST['message']) : $_POST['message'];
$acl_ok = array(); $acl_ok = array();
if (!$GLOBALS['egw']->acl->check('mainscreen_message_access',1,'admin')) if (!$GLOBALS['egw']->acl->check('mainscreen_messa',1,'admin'))
{ {
$acl_ok['mainscreen'] = True; $acl_ok['mainscreen'] = True;
} }
if (!$GLOBALS['egw']->acl->check('mainscreen_message_access',2,'admin')) if (!$GLOBALS['egw']->acl->check('mainscreen_messa',2,'admin'))
{ {
$acl_ok['loginscreen'] = True; $acl_ok['loginscreen'] = True;
} }
@ -80,7 +80,7 @@ class uimainscreen
$GLOBALS['egw']->template->fp('rows','row',True); $GLOBALS['egw']->template->fp('rows','row',True);
$select_section = '<select name="section">'."\n"; $select_section = '<select name="section">'."\n";
foreach($acl_ok as $key => $val) foreach(array_keys($acl_ok) as $key)
{ {
$select_section .= ' <option value="'.$key.'"'. $select_section .= ' <option value="'.$key.'"'.
($key == $_POST['section'] ? ' selected' : '') . '>' . ($key == $_POST['section'] ? ' selected' : '') . '>' .

213
admin/inc/hook_acl_manager.inc.php
View File

@ -1,125 +1,122 @@
<?php <?php
/**************************************************************************\ /**
* eGroupWare * * EGgroupware administration
* http://www.egroupware.org * *
* -------------------------------------------- * * @link http://www.egroupware.org
* This program is free software; you can redistribute it and/or modify it * * @package admin
* under the terms of the GNU General Public License as published by the * * @license http://opensource.org/licenses/gpl-license.php GPL - GNU General Public License
* Free Software Foundation; either version 2 of the License, or (at your * * @version $Id$
* option) any later version. * */
\**************************************************************************/
/* $Id$ */ $GLOBALS['acl_manager']['admin']['site_config_acce'] = array(
'name' => 'Deny access to site configuration',
'rights' => array(
'List config settings' => 1,
'Change config settings' => 2
)
); // added and working ralfbecker
$GLOBALS['acl_manager']['admin']['site_config_access'] = array( $GLOBALS['acl_manager']['admin']['account_access'] = array(
'name' => 'Deny access to site configuration', 'name' => 'Deny access to user accounts',
'rights' => array( 'rights' => array(
'List config settings' => 1, 'Account list' => 1,
'Change config settings' => 2 'Search accounts' => 2,
) 'Add account' => 4,
); // added and working ralfbecker 'View account' => 8,
'Edit account' => 16,
'Delete account' => 32,
'change ACL Rights' => 64
)
); // was already there and seems to work ralfbecker
$GLOBALS['acl_manager']['admin']['account_access'] = array( $GLOBALS['acl_manager']['admin']['group_access'] = array(
'name' => 'Deny access to user accounts', 'name' => 'Deny access to groups',
'rights' => array( 'rights' => array(
'Account list' => 1, 'Group list' => 1,
'Search accounts' => 2, 'Search groups' => 2,
'Add account' => 4, 'Add group' => 4,
'View account' => 8,
'Edit account' => 16,
'Delete account' => 32,
'change ACL Rights' => 64
)
); // was already there and seems to work ralfbecker
$GLOBALS['acl_manager']['admin']['group_access'] = array(
'name' => 'Deny access to groups',
'rights' => array(
'Group list' => 1,
'Search groups' => 2,
'Add group' => 4,
// 'View group' => 8, // Will be added in the future // 'View group' => 8, // Will be added in the future
'Edit group' => 16, 'Edit group' => 16,
'Delete group' => 32 'Delete group' => 32
) )
); // was already there and seems to work ralfbecker ); // was already there and seems to work ralfbecker
$GLOBALS['acl_manager']['admin']['applications_access'] = array( $GLOBALS['acl_manager']['admin']['applications_acc'] = array(
'name' => 'Deny access to applications', 'name' => 'Deny access to applications',
'rights' => array( 'rights' => array(
/* not usefull --> setup /* not usefull --> setup
'Applications list' => 1, 'Applications list' => 1,
'Add application' => 2, 'Add application' => 2,
'Edit application' => 4, 'Edit application' => 4,
'Delete application' => 8, 'Delete application' => 8,
*/ */
'Register application hooks' => 16 'Register application hooks' => 16
) )
); // added and working ralfbecker ); // added and working ralfbecker
$GLOBALS['acl_manager']['admin']['global_categories_access'] = array( $GLOBALS['acl_manager']['admin']['global_categorie'] = array(
'name' => 'Deny access to global categories', 'name' => 'Deny access to global categories',
'rights' => array( 'rights' => array(
'Categories list' => 1, 'Categories list' => 1,
'Search categories' => 2, 'Search categories' => 2,
'Add category' => 4, 'Add category' => 4,
'View category' => 8, 'View category' => 8,
'Edit category' => 16, 'Edit category' => 16,
'Delete category' => 32, 'Delete category' => 32,
'Add sub-category' => 64 'Add sub-category' => 64
) )
); // added and working ralfbecker ); // added and working ralfbecker
$GLOBALS['acl_manager']['admin']['mainscreen_message_access'] = array( $GLOBALS['acl_manager']['admin']['mainscreen_messa'] = array(
'name' => 'Deny access to mainscreen message', 'name' => 'Deny access to mainscreen message',
'rights' => array( 'rights' => array(
'Main screen message' => 1, 'Main screen message' => 1,
'Login message' => 2 'Login message' => 2
) )
); // added and working ralfbecker ); // added and working ralfbecker
$GLOBALS['acl_manager']['admin']['current_sessions_access'] = array( $GLOBALS['acl_manager']['admin']['current_sessions'] = array(
'name' => 'Deny access to current sessions', 'name' => 'Deny access to current sessions',
'rights' => array( 'rights' => array(
'List current sessions' => 1, 'List current sessions' => 1,
'Show current action' => 2, 'Show current action' => 2,
'Show session IP address' => 4, 'Show session IP address' => 4,
'Kill session' => 8 'Kill session' => 8
) )
); // checked and working ralfbecker ); // checked and working ralfbecker
$GLOBALS['acl_manager']['admin']['access_log_access'] = array( $GLOBALS['acl_manager']['admin']['access_log_acces'] = array(
'name' => 'Deny access to access log', 'name' => 'Deny access to access log',
'rights' => array( 'rights' => array(
'Show access log' => 1 'Show access log' => 1
) )
); // added and working ralfbecker ); // added and working ralfbecker
$GLOBALS['acl_manager']['admin']['error_log_access'] = array( $GLOBALS['acl_manager']['admin']['error_log_access'] = array(
'name' => 'Deny access to error log', 'name' => 'Deny access to error log',
'rights' => array( 'rights' => array(
'Show error log' => 1 'Show error log' => 1
) )
); // added and working ralfbecker ); // added and working ralfbecker
$GLOBALS['acl_manager']['admin']['asyncservice_access'] = array( $GLOBALS['acl_manager']['admin']['asyncservice_acc'] = array(
'name' => 'Deny access to asynchronous timed services', 'name' => 'Deny access to asynchronous timed services',
'rights' => array( 'rights' => array(
'Asynchronous timed services' => 1 'Asynchronous timed services' => 1
) )
); // added and working ralfbecker ); // added and working ralfbecker
$GLOBALS['acl_manager']['admin']['db_backup_access'] = array( $GLOBALS['acl_manager']['admin']['db_backup_access'] = array(
'name' => 'Deny access to DB backup and restore', 'name' => 'Deny access to DB backup and restore',
'rights' => array( 'rights' => array(
'DB backup and restore' => 1 'DB backup and restore' => 1
) )
); // added and working ralfbecker ); // added and working ralfbecker
$GLOBALS['acl_manager']['admin']['info_access'] = array( $GLOBALS['acl_manager']['admin']['info_access'] = array(
'name' => 'Deny access to phpinfo', 'name' => 'Deny access to phpinfo',
'rights' => array( 'rights' => array(
'Show phpinfo()' => 1 'Show phpinfo()' => 1
) )
); // added and working ralfbecker ); // added and working ralfbecker

7
phpgwapi/setup/tables_update.inc.php
View File

@ -158,6 +158,13 @@ function phpgwapi_upgrade14_2_004()
'type' => 'auto', 'type' => 'auto',
'nullable' => False 'nullable' => False
));*/ ));*/
// shorten all acl_location entries to 16 chars, to not stall update for PostgreSQL
$GLOBALS['egw_setup']->db->update('egw_acl', array(
'acl_location=SUBSTRING(acl_location FROM 1 FOR 16)',
'acl_appname=SUBSTRING(acl_appname FROM 1 FOR 16)',
), 'LENGTH(acl_location) > 16 OR LENGTH(acl_appname) > 16', __LINE__, __FILE__);
$GLOBALS['egw_setup']->oProc->RefreshTable('egw_acl',array( $GLOBALS['egw_setup']->oProc->RefreshTable('egw_acl',array(
'fd' => array( 'fd' => array(
'acl_appname' => array('type' => 'ascii','precision' => '16','nullable' => False), 'acl_appname' => array('type' => 'ascii','precision' => '16','nullable' => False),