Commit ce23413a authored by jan.koester's avatar jan.koester
Browse files

test acl

parent a43cd94b

data/admin.html

+10 −1
Changes for data/admin.html: 10 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -268,10 +268,14 @@ function submitEditUser(uid) { 
/* ---- Domains ---- */

function loadDomains() {

    currentView = loadDomains;

    ajaxGet("/settings/" + currentDomain + "/api/checkpermissions", function(perr, pdata) {

        var isSuperAdmin = (!perr && pdata && pdata.superadmin);

        ajaxGet("/settings/" + currentDomain + "/api/listdomains", function(err, data) {

            if (err) { showError(err); return; }

            var html = '<p>DomainList:</p><table class="admin-table domainlist">';

        html += '<tr><th>Name</th><th>Details</th><th>Actions</th></tr>';

            html += '<tr><th>Name</th><th>Details</th>';

            if (isSuperAdmin) html += '<th>Actions</th>';

            html += '</tr>';

            if (data.domains) {

                for (var i = 0; i < data.domains.length; i++) {

                    var d = data.domains[i];
@@ -282,14 +286,19 @@ function loadDomains() { 
                    html += '<li>Storagetype: ' + (d.storagetype || '') + '</li>';

                    html += '<li>Storageoptions: ' + (d.storageoptions || '') + '</li>';

                    html += '</ul></td>';

                    if (isSuperAdmin) {

                        html += '<td><a class="button" href="#" onclick="removeDomain(\'' + d.id + '\'); return false;">Remove</a></td>';

                    }

                    html += '</tr>';

                }

            }

            html += '</table>';

            if (isSuperAdmin) {

                html += '<ul class="domaintoolbar"><li><a class="button" href="#" onclick="createDomainForm(); return false;">CreateDomain</a></li></ul>';

            }

            setContent(html);

        });

    });

}



function createDomainForm() {

src/admin.cpp

+48 −4
Changes for src/admin.cpp: 48 added lines, 4 removed lines.
Original line number Diff line number Diff line
@@ -388,6 +388,44 @@ namespace authdb { 
            json_object_put(jobj);

        }



        /* ---- Helper: Check if session user is SuperAdmin from admin.local ---- */

        bool isSuperAdmin(const SessionData *sdat) {

            if (!sdat) return false;



            // Find "SuperAdmin" group in admin backend and check membership

            Group group;

            size_t rd = sizeof(authdb::AuthHeader), end = _AdminBackend.end();

            while (rd < end) {

                std::shared_ptr<authdb::AuthData::Record> cur = std::make_shared<authdb::AuthData::Record>();

                cur->type = EmptyData;

                _AdminBackend.setPos(rd);

                _AdminBackend.read((unsigned char*)cur.get(), sizeof(AuthData::Record));

                rd = _AdminBackend.getPos() + cur->datasize;



                if (cur->type == GroupData && strcmp(cur->fieldname, "groupname") == 0) {

                    class GroupData gdat(cur->ruid);

                    try {

                        size_t gpos = sizeof(authdb::AuthHeader);

                        group.info(_AdminBackend, gdat, gpos);

                        if (gdat.getName() == "SuperAdmin") {

                            return sdat->isMemberOf(uuid::uuid(cur->ruid));

                        }

                    } catch (AuthBackendError &e) {

                        std::cerr << e.what() << std::endl;

                    }

                }

            }

            return false;

        }



        /* ---- JSON API: Check Permissions ---- */

        void apiCheckPermissions(libhttppp::HttpRequest &curreq, const SessionData *sdat) {

            json_object *jobj = json_object_new_object();

            json_object_object_add(jobj, "superadmin", json_object_new_boolean(isSuperAdmin(sdat)));

            sendJson(curreq, jobj);

            json_object_put(jobj);

        }



        /* ---- JSON API: List Domains ---- */

        void apiListDomains(libhttppp::HttpRequest &curreq) {

            json_object *jobj = json_object_new_object();
@@ -426,7 +464,9 @@ namespace authdb { 
        }



        /* ---- JSON API: Create Domain ---- */

        void apiCreateDomain(libhttppp::HttpRequest &curreq) {

        void apiCreateDomain(libhttppp::HttpRequest &curreq, const SessionData *sdat) {

            if (!isSuperAdmin(sdat))

                throw AuthBackendError("createDomain: nur SuperAdmins von admin.local erlaubt!");

            std::vector<char> body;

            libhttppp::HttpForm curform;

            curform.parse(curreq);
@@ -513,7 +553,9 @@ namespace authdb { 
        }



        /* ---- JSON API: Remove Domain ---- */

        void apiRemoveDomain(libhttppp::HttpRequest &curreq, const char *cdid) {

        void apiRemoveDomain(libhttppp::HttpRequest &curreq, const char *cdid, const SessionData *sdat) {

            if (!isSuperAdmin(sdat))

                throw AuthBackendError("removeDomain: nur SuperAdmins von admin.local erlaubt!");

            Domain domain;

            uuid::uuid uuid;

            uuid.parse(cdid);
@@ -1349,10 +1391,12 @@ namespace authdb { 
                        apiEditUser(curreq, domain, param);

                    } else if (strcmp(apiurl, "listdomains") == 0) {

                        apiListDomains(curreq);

                    } else if (strcmp(apiurl, "checkpermissions") == 0) {

                        apiCheckPermissions(curreq, sdat);

                    } else if (strcmp(apiurl, "createdomain") == 0) {

                        apiCreateDomain(curreq);

                        apiCreateDomain(curreq, sdat);

                    } else if (strcmp(apiurl, "removedomain") == 0 && param[0]) {

                        apiRemoveDomain(curreq, param);

                        apiRemoveDomain(curreq, param, sdat);

                    } else if (strcmp(apiurl, "listgroups") == 0) {

                        apiListGroups(curreq, domain);

                    } else if (strcmp(apiurl, "getgroup") == 0 && param[0]) {