Add from-suspended class to the comment wrapper, so that it can be
targetted by CSS.
Patch by 900degrees.
X-Hg-Repo: dw-free
Subject: dw-free: http://bugs.dwscoalition.org/show_bug.cgi?id=2664
From: fu
changeset 6eea5d364d26 in /home/hg/repos/dw-free
details: http://hg.dwscoalition.org/dw-free?cmd=changeset;node=6eea5d364d26
description:
http://bugs.dwscoalition.org/show_bug.cgi?id=2664
Code modernization: use $u->can_manage and $u->can_manage_other,
instead of LJ::can_manage/_other.
Patch by kareila.
diffs (827 lines):
diff -r 28f93d764c8e -r 6eea5d364d26 bin/upgrading/s2layers/core2.s2
--- a/bin/upgrading/s2layers/core2.s2 Tue Jun 15 16:56:26 2010 +0800
+++ b/bin/upgrading/s2layers/core2.s2 Tue Jun 15 17:26:16 2010 +0800
@@ -4354,6 +4354,7 @@ function Comment::print_wrapper_start()
var string alternate = alternate ("comment-wrapper-odd",
"comment-wrapper-even");
var string screened = $this.screened ? "screened" : "visible";
var string deletedstate = $this.deleted ? "deleted" : "";
+ var string suspendedstate = $this.fromsuspended ? "from-suspended" : "";
var string frozen = $this.frozen ? "frozen" : "";
var string poster = defined $this.poster ? "poster-" +
$this.poster.username : "poster-anonymous";
var string full = $this.full ? "full" : "partial";
@@ -4362,7 +4363,7 @@ function Comment::print_wrapper_start()
if (not isnull $ep and defined $this.poster and $this.poster.username ==
$ep.entry.poster.username) {
$entryauthor = "entry-author";
}
- """<div class="comment-wrapper $alternate $screened $frozen $deletedstate
$poster $entryauthor $full $userpic">\n""";
+ """<div class="comment-wrapper $alternate $screened $frozen $deletedstate
$suspendedstate $poster $entryauthor $full $userpic">\n""";
"""<div class="separator separator-before"><div
class="inner"></div></div>\n""";
"""<div class="comment" id="comment-$this.dom_id">\n""";
"""<div class="inner">\n""";
diff -r 28f93d764c8e -r 6eea5d364d26
cgi-bin/Apache/LiveJournal/Interface/AtomAPI.pm
--- a/cgi-bin/Apache/LiveJournal/Interface/AtomAPI.pm Tue Jun 15 16:56:26
2010 +0800
+++ b/cgi-bin/Apache/LiveJournal/Interface/AtomAPI.pm Tue Jun 15 17:26:16
2010 +0800
@@ -566,8 +566,8 @@ sub handle {
# we've authenticated successfully and remote is set. But can remote
# manage the requested account?
my $remote = LJ::get_remote();
- unless (LJ::can_manage($remote, $u)) {
- return respond($r, 403, "User <b>$remote->{'user'}</b> has no
administrative access to account <b>$u->{user}</b>.");
+ unless ( $remote && $remote->can_manage( $u ) ) {
+ return respond( $r, 403, "User <b>$remote->{user}</b> has no
administrative access to account <b>$u->{user}</b>." );
}
# handle the requested action
diff -r 28f93d764c8e -r 6eea5d364d26 cgi-bin/Apache/LiveJournal/Interface/S2.pm
--- a/cgi-bin/Apache/LiveJournal/Interface/S2.pm Tue Jun 15 16:56:26
2010 +0800
+++ b/cgi-bin/Apache/LiveJournal/Interface/S2.pm Tue Jun 15 17:26:16
2010 +0800
@@ -60,7 +60,7 @@ sub handler {
if ($meth eq 'GET') {
return error($r, 403, "Forbidden", "You are not authorized to retrieve
this layer")
- unless $lu->{'user'} eq 'system' || LJ::can_manage($u, $lu);
+ unless $lu->user eq 'system' || $u->can_manage( $lu );
my $layerinfo = {};
LJ::S2::load_layer_info($layerinfo, [ $id ]);
@@ -81,7 +81,7 @@ sub handler {
elsif ($meth eq 'PUT') {
return error($r, 403, "Forbidden", "You are not authorized to edit
this layer")
- unless LJ::can_manage($u, $lu);
+ unless $u->can_manage( $lu );
return error($r, 403, "Forbidden", "Your account type is not allowed
to edit layers")
unless $u->can_create_s2_styles;
diff -r 28f93d764c8e -r 6eea5d364d26 cgi-bin/DW/User/ContentFilters/Filter.pm
--- a/cgi-bin/DW/User/ContentFilters/Filter.pm Tue Jun 15 16:56:26 2010 +0800
+++ b/cgi-bin/DW/User/ContentFilters/Filter.pm Tue Jun 15 17:26:16 2010 +0800
@@ -239,7 +239,7 @@ sub show_entry {
# step 1) community poster type
if ( $journalu->is_community && $opts->{postertype} && $opts->{postertype}
ne 'any' ) {
- my $is_admin = LJ::can_manage_other( $posteru, $journalu );
+ my $is_admin = $posteru->can_manage_other( $journalu );
my $is_moderator = $is_admin || LJ::check_rel( $journalu, $posteru,
'M' );
return $fail->( 'not_maintainer' )
diff -r 28f93d764c8e -r 6eea5d364d26 cgi-bin/LJ/Comment.pm
--- a/cgi-bin/LJ/Comment.pm Tue Jun 15 16:56:26 2010 +0800
+++ b/cgi-bin/LJ/Comment.pm Tue Jun 15 17:26:16 2010 +0800
@@ -925,15 +925,24 @@ sub visible_to {
sub visible_to {
my ($self, $u) = @_;
- return 0 unless $self->entry && $self->entry->visible_to($u);
+ return 0 unless LJ::isu( $u );
+ return 0 unless $self->entry && $self->entry->visible_to( $u );
+
+ my $posted_comment = $self->poster && $u->equals( $self->poster );
+ my $posted_entry = $self->entry->poster &&
+ $u->equals( $self->entry->poster );
+ my $posted_parent = $self->parent && $self->parent->poster &&
+ $u->equals( $self->parent->poster );
+ my $posted_by_admin = $self->poster &&
+ $self->poster->can_manage( $self->journal );
# screened comment
- return 0 if $self->is_screened &&
- !( LJ::can_manage( $u, $self->journal ) # owns the
journal
- || LJ::u_equals( $u, $self->poster ) # posted the
comment
- || LJ::u_equals( $u, $self->entry->poster ) # posted the
entry
- || ( $self->parent && LJ::u_equals( $u,
$self->parent->poster ) && LJ::can_manage( $self->poster, $self->journal ) ) );
- # person this is in reply to, as long as this comment
was by a moderator
+ return 0 if $self->is_screened && ! # allowed viewers:
+ ( $u->can_manage( $self->journal ) # owns the journal
+ || $posted_comment || $posted_entry # owns the content
+ || ( $posted_parent && $posted_by_admin ) );
+ # person this is in reply to,
+ # as long as this comment was by a moderator
# comments from suspended users aren't visible
return 0 if $self->poster && $self->poster->is_suspended;
@@ -1097,10 +1106,10 @@ sub info {
my $remote = LJ::get_remote() or return;
my %LJ_cmtinfo;
- $LJ_cmtinfo{'canAdmin'} = LJ::can_manage($remote, $self->journal);
- $LJ_cmtinfo{'canSpam'} = ! LJ::sysban_check( 'spamreport',
$self->journal->user );
- $LJ_cmtinfo{'journal'} = $self->journal->{user};
- $LJ_cmtinfo{'remote'} = $remote->{user};
+ $LJ_cmtinfo{canAdmin} = $remote->can_manage( $self->journal );
+ $LJ_cmtinfo{canSpam} = ! LJ::sysban_check( 'spamreport',
$self->journal->user );
+ $LJ_cmtinfo{journal} = $self->journal->user;
+ $LJ_cmtinfo{remote} = $remote->user;
return \%LJ_cmtinfo;
}
diff -r 28f93d764c8e -r 6eea5d364d26 cgi-bin/LJ/Console/Command/BanList.pm
--- a/cgi-bin/LJ/Console/Command/BanList.pm Tue Jun 15 16:56:26 2010 +0800
+++ b/cgi-bin/LJ/Console/Command/BanList.pm Tue Jun 15 17:26:16 2010 +0800
@@ -48,7 +48,8 @@ sub execute {
unless $journal;
return $self->error("You are not a maintainer of this account")
- unless LJ::can_manage( $remote, $journal ) || ( $remote &&
$remote->has_priv( "finduser" ) );
+ unless $remote && ( $remote->can_manage( $journal )
+ || $remote->has_priv( "finduser" ) );
}
my $banids = LJ::load_rel_user($journal, 'B') || [];
diff -r 28f93d764c8e -r 6eea5d364d26 cgi-bin/LJ/Console/Command/BanSet.pm
--- a/cgi-bin/LJ/Console/Command/BanSet.pm Tue Jun 15 16:56:26 2010 +0800
+++ b/cgi-bin/LJ/Console/Command/BanSet.pm Tue Jun 15 17:26:16 2010 +0800
@@ -48,7 +48,7 @@ sub execute {
unless $journal;
return $self->error("You are not a maintainer of this account")
- unless LJ::can_manage($remote, $journal);
+ unless $remote && $remote->can_manage( $journal );
}
my $banuser = LJ::load_user($user);
diff -r 28f93d764c8e -r 6eea5d364d26 cgi-bin/LJ/Console/Command/BanUnset.pm
--- a/cgi-bin/LJ/Console/Command/BanUnset.pm Tue Jun 15 16:56:26 2010 +0800
+++ b/cgi-bin/LJ/Console/Command/BanUnset.pm Tue Jun 15 17:26:16 2010 +0800
@@ -48,7 +48,7 @@ sub execute {
unless $journal;
return $self->error("You are not a maintainer of this account")
- unless LJ::can_manage($remote, $journal);
+ unless $remote && $remote->can_manage( $journal );
}
my $banuser = LJ::load_user($user);
diff -r 28f93d764c8e -r 6eea5d364d26 cgi-bin/LJ/Console/Command/Community.pm
--- a/cgi-bin/LJ/Console/Command/Community.pm Tue Jun 15 16:56:26 2010 +0800
+++ b/cgi-bin/LJ/Console/Command/Community.pm Tue Jun 15 17:26:16 2010 +0800
@@ -53,8 +53,9 @@ sub execute {
return $self->error("Unknown user: $user")
unless $target;
- my $can_add = LJ::can_manage( $remote, $comm ) || ( $remote &&
$remote->has_priv( "sharedjournal", "*" ) );
- my $can_remove = $can_add || LJ::u_equals($remote, $target);
+ my $can_add = $remote && ( $remote->can_manage( $comm ) ||
+ $remote->has_priv( "sharedjournal", "*" ) );
+ my $can_remove = $can_add || ( $remote && $remote->equals( $target ) );
return $self->error("You cannot add users to this community.")
if $action eq 'add' && !$can_add;
diff -r 28f93d764c8e -r 6eea5d364d26 cgi-bin/LJ/Console/Command/Set.pm
--- a/cgi-bin/LJ/Console/Command/Set.pm Tue Jun 15 16:56:26 2010 +0800
+++ b/cgi-bin/LJ/Console/Command/Set.pm Tue Jun 15 17:26:16 2010 +0800
@@ -52,7 +52,8 @@ sub execute {
return $self->error("Invalid account: $name")
unless $journal;
return $self->error("You are not permitted to change this journal's
settings.")
- unless LJ::can_manage( $remote, $journal ) || ( $remote &&
$remote->has_priv( "siteadmin", "propedit" ) );
+ unless $remote && ( $remote->can_manage( $journal ) ||
+ $remote->has_priv( "siteadmin", "propedit" ) );
}
my ($key, $value) = @args;
diff -r 28f93d764c8e -r 6eea5d364d26 cgi-bin/LJ/Console/Command/TagDisplay.pm
--- a/cgi-bin/LJ/Console/Command/TagDisplay.pm Tue Jun 15 16:56:26 2010 +0800
+++ b/cgi-bin/LJ/Console/Command/TagDisplay.pm Tue Jun 15 17:26:16 2010 +0800
@@ -53,7 +53,7 @@ sub execute {
unless $foru;
return $self->error("You cannot change tag display settings for
$args[1]")
- unless LJ::can_manage($remote, $foru);
+ unless $remote && $remote->can_manage( $foru );
($tag, $val) = ($args[2], $args[3]);
} else {
diff -r 28f93d764c8e -r 6eea5d364d26
cgi-bin/LJ/Console/Command/TagPermissions.pm
--- a/cgi-bin/LJ/Console/Command/TagPermissions.pm Tue Jun 15 16:56:26
2010 +0800
+++ b/cgi-bin/LJ/Console/Command/TagPermissions.pm Tue Jun 15 17:26:16
2010 +0800
@@ -53,7 +53,7 @@ sub execute {
unless $foru;
return $self->error("You cannot change tag permission settings for
$args[1]")
- unless LJ::can_manage($remote, $foru);
+ unless $remote && $remote->can_manage( $foru );
$add = $args[2] eq 'members' ? 'protected' : $args[2];
$control = $args[3] eq 'members' ? 'protected' : $args[3];
diff -r 28f93d764c8e -r 6eea5d364d26 cgi-bin/LJ/Entry.pm
--- a/cgi-bin/LJ/Entry.pm Tue Jun 15 16:56:26 2010 +0800
+++ b/cgi-bin/LJ/Entry.pm Tue Jun 15 17:26:16 2010 +0800
@@ -528,7 +528,8 @@ sub comment_info {
my $permalink = $self->url;
my $comments_enabled = ( $viewall ||
( $journal->{opt_showtalklinks} eq "Y" && !$self->comments_disabled )
) ? 1 : 0;
- my $has_screened = ( $self->props->{hasscreened} && $remote &&
LJ::can_manage( $remote, $journal ) ) ? 1 : 0;
+ my $has_screened = ( $self->props->{hasscreened} && $remote && $journal
+ && $remote->can_manage( $journal ) ) ? 1 : 0;
my $replycount = $self->reply_count;
my $nc = "";
$nc .= "nc=$replycount" if $replycount && $remote &&
$remote->{opt_nctalklinks};
@@ -773,7 +774,7 @@ sub comments_manageable_by {
return 0 unless $self->valid;
return 0 unless $remote;
my $u = $self->{u};
- return $remote->{userid} == $self->posterid || LJ::can_manage($remote, $u);
+ return $remote->userid == $self->posterid || $remote->can_manage( $u );
}
# instance method: returns bool, if remote user can view this entry
diff -r 28f93d764c8e -r 6eea5d364d26 cgi-bin/LJ/S2.pm
--- a/cgi-bin/LJ/S2.pm Tue Jun 15 16:56:26 2010 +0800
+++ b/cgi-bin/LJ/S2.pm Tue Jun 15 17:26:16 2010 +0800
@@ -3686,9 +3686,10 @@ sub _Entry__get_link
my $esnjournal = $journalu->is_community ? $journal : $poster;
if ($key eq "edit_entry") {
- return $null_link unless $remote && ($remote->{'user'} eq $journal ||
- $remote->{'user'} eq $poster ||
- LJ::can_manage($remote,
LJ::load_user($journal)));
+ return $null_link
+ unless $remote && ( $remote->user eq $journal ||
+ $remote->user eq $poster ||
+ $remote->can_manage( $journalu ) );
return
LJ::S2::Link("$LJ::SITEROOT/editjournal?journal=$journal&itemid=$this->{'itemid'}",
$ctx->[S2::PROPS]->{"text_edit_entry"},
LJ::S2::Image("$LJ::IMGPREFIX/silk/entry/edit.png", 16, 16));
diff -r 28f93d764c8e -r 6eea5d364d26 cgi-bin/LJ/S2/EntryPage.pm
--- a/cgi-bin/LJ/S2/EntryPage.pm Tue Jun 15 16:56:26 2010 +0800
+++ b/cgi-bin/LJ/S2/EntryPage.pm Tue Jun 15 17:26:16 2010 +0800
@@ -325,10 +325,10 @@ sub EntryPage
# add the poster_ip metadata if remote user has
# access to see it.
- $s2com->{'metadata'}->{'poster_ip'} =
$com->{'props'}->{'poster_ip'} if
- ($com->{'props'}->{'poster_ip'} && $remote &&
- ($remote->{'userid'} == $entry->posterid ||
- LJ::can_manage($remote, $u) || $viewall));
+ $s2com->{metadata}->{poster_ip} = $com->{props}->{poster_ip}
+ if $com->{props}->{poster_ip} && $remote &&
+ ( $remote->userid == $entry->posterid ||
+ $remote->can_manage( $u ) || $viewall );
$s2com->{metadata}->{imported_from} =
$com->{props}->{imported_from}
if $com->{props}->{imported_from};
@@ -347,7 +347,7 @@ sub EntryPage
# print comment info
{
- my $canAdmin = LJ::can_manage($remote, $u) ? 1 : 0;
+ my $canAdmin = $remote && $remote->can_manage( $u ) ? 1 : 0;
my $canSpam = LJ::sysban_check( 'spamreport', $u->user ) ? 0 : 1;
my $formauth = LJ::ejs(LJ::eurl(LJ::form_auth(1)));
diff -r 28f93d764c8e -r 6eea5d364d26 cgi-bin/LJ/Tags.pm
--- a/cgi-bin/LJ/Tags.pm Tue Jun 15 16:56:26 2010 +0800
+++ b/cgi-bin/LJ/Tags.pm Tue Jun 15 17:26:16 2010 +0800
@@ -290,9 +290,9 @@ sub get_usertags {
# now if they provided a remote, remove the ones they don't want to see;
note that
# remote may be undef so we have to check exists
- if (exists $opts->{remote}) {
+ if ( exists $opts->{remote} ) {
# never going to cull anything if you control it, so just return
- return $res if LJ::can_manage($opts->{remote}, $u);
+ return $res if $opts->{remote}->can_manage( $u );
# setup helper variables from u to remote
my ($trusted, $grpmask) = (0, 0);
@@ -541,7 +541,7 @@ sub _remote_satisfies_permission {
return undef unless $u && $remote && $perm;
# allow if they can manage it (own, or 'A' edge)
- return 1 if LJ::can_manage($remote, $u);
+ return 1 if $remote->can_manage( $u );
# permission checks
if ($perm eq 'public') {
@@ -551,7 +551,7 @@ sub _remote_satisfies_permission {
} elsif ( $perm eq 'protected' || $perm eq 'friends' ) { # 'friends' for
backwards compatibility
return $u->trusts_or_has_member( $remote );
} elsif ($perm eq 'private') {
- return LJ::can_manage($remote, $u);
+ return 0; # $remote->can_manage( $u ) already returned 1 above
} elsif ( $perm eq 'author_admin' ) {
# this tests whether the remote can add tags for this journal in
general
# when we don't have an entry object available to us (e.g., posting)
diff -r 28f93d764c8e -r 6eea5d364d26 cgi-bin/LJ/Talk.pm
--- a/cgi-bin/LJ/Talk.pm Tue Jun 15 16:56:26 2010 +0800
+++ b/cgi-bin/LJ/Talk.pm Tue Jun 15 17:26:16 2010 +0800
@@ -312,20 +312,19 @@ sub check_viewable
# specified by the other options.
# </LJFUNC>
sub can_delete {
- my ($remote, $u, $up, $userpost) = @_; # remote, journal, posting user,
commenting user
- return 0 unless $remote;
- return 1 if $remote->{'user'} eq $userpost ||
- $remote->{'user'} eq (ref $u ? $u->{'user'} : $u) ||
- $remote->{'user'} eq (ref $up ? $up->{'user'} : $up) ||
- LJ::can_manage($remote, $u);
+ my ( $remote, $u, $up, $userpost ) = @_; # remote, journal, posting user,
commenting user
+ return 0 unless LJ::isu( $remote );
+ return 1 if $remote->user eq $userpost ||
+ $remote->user eq ( ref $u ? $u->user : $u ) ||
+ LJ::Talk::can_screen( @_ );
return 0;
}
sub can_screen {
- my ($remote, $u, $up, $userpost) = @_;
- return 0 unless $remote;
- return 1 if $remote->{'user'} eq (ref $up ? $up->{'user'} : $up) ||
- LJ::can_manage($remote, $u);
+ my ( $remote, $u, $up, $userpost ) = @_; # remote, journal, posting user,
commenting user
+ return 0 unless LJ::isu( $remote );
+ return 1 if $remote->user eq ( ref $up ? $up->user : $up ) ||
+ $remote->can_manage( ref $u ? $u : LJ::load_user( $u ) );
return 0;
}
@@ -958,23 +957,24 @@ sub load_comments
# zero, we'll still show it if it has any children (but we won't
show content)
my $should_show = $post->{'state'} eq 'D' ? 0 : 1;
my $parenttalkid = $post->{parenttalkid};
- unless ($viewall) {
+ unless ( $viewall ) {
+ my $poster = LJ::load_userid( $post->{posterid} );
$should_show = 0 if
# can view if not screened, or if screened and some
conditions apply
$post->{state} eq "S" &&
- !( $remote &&
- ( $remote->{userid} == $uposterid || # made in
remote's journal
- $remote->{userid} == $post->{posterid} || # made
by remote
- LJ::can_manage( $remote, $u ) || # made in a
journal remote manages
- (
+ ! ( $remote &&
+ ( $remote->userid == $uposterid || # made in remote's
journal
+ $remote->userid == $post->{posterid} || # made by
remote
+ $remote->can_manage( $u ) || # made in a journal
remote manages
+ (
# remote authored the parent, and this comment
is by an admin
exists $posts->{$parenttalkid} &&
$posts->{$parenttalkid}->{posterid} &&
- $posts->{$parenttalkid}->{posterid} ==
$remote->{userid} &&
- LJ::can_manage( $post->{posterid}, $u )
- )
+ $posts->{$parenttalkid}->{posterid} ==
$remote->userid &&
+ $poster && $poster->can_manage( $u )
+ )
)
- );
+ );
}
$post->{'_show'} = $should_show;
$post_count += $should_show;
diff -r 28f93d764c8e -r 6eea5d364d26 cgi-bin/LJ/User.pm
--- a/cgi-bin/LJ/User.pm Tue Jun 15 16:56:26 2010 +0800
+++ b/cgi-bin/LJ/User.pm Tue Jun 15 17:26:16 2010 +0800
@@ -2022,8 +2022,9 @@ sub can_show_onlinestatus {
sub can_track_all_community_comments {
my ( $remote, $journal ) = @_;
- return 1 if $journal->is_community && ( LJ::can_manage_other( $remote,
$journal )
- || $journal->is_paid && $remote->member_of( $journal ) );
+ return 1 if LJ::isu( $journal ) && $journal->is_community
+ && ( $remote->can_manage_other( $journal )
+ || $journal->is_paid && $remote->member_of( $journal ) );
}
sub can_track_defriending {
@@ -3661,7 +3662,34 @@ sub num_comments_received {
=cut
sub can_manage {
- return LJ::can_manage( @_ );
+ # true if the first user is an admin for the target user.
+ my ( $u, $target ) = @_;
+ # backward compatibility: allow $target to be a userid
+ $target = LJ::want_user( $target ) or return undef;
+
+ # is same user?
+ return 1 if $u->equals( $target );
+
+ # people/syn/rename accounts can only be managed by the one account
+ return 0 if $target->journaltype =~ /^[PYR]$/;
+
+ # check for admin access
+ return 1 if LJ::check_rel( $target, $u, 'A' );
+
+ # failed checks, return false
+ return 0;
+}
+
+
+sub can_manage_other {
+ # true if the first user is an admin for the target user,
+ # UNLESS the two users are the same.
+ my ( $u, $target ) = @_;
+ # backward compatibility: allow $target to be a userid
+ $target = LJ::want_user( $target ) or return undef;
+
+ return 0 if $u->equals( $target );
+ return $u->can_manage( $target );
}
@@ -7791,55 +7819,6 @@ sub delete_all_comments {
=head2 Community-Related Functions and Authas (LJ)
=cut
-sub can_delete_journal_item {
- return LJ::can_manage(@_);
-}
-
-
-# <LJFUNC>
-# name: LJ::can_manage
-# des: Given a user and a target user, will determine if the first user is an
-# admin for the target user.
-# returns: bool: true if authorized, otherwise fail
-# args: remote, u
-# des-remote: user object or userid of user to try and authenticate
-# des-u: user object or userid of target user
-# </LJFUNC>
-sub can_manage {
- my $remote = LJ::want_user(shift);
- my $u = LJ::want_user(shift);
- return undef unless $remote && $u;
-
- # is same user?
- return 1 if LJ::u_equals($u, $remote);
-
- # people/syn/rename accounts can only be managed by the one account
- return undef if $u->journaltype =~ /^[PYR]$/;
-
- # check for admin access
- return undef unless LJ::check_rel($u, $remote, 'A');
-
- # passed checks, return true
- return 1;
-}
-
-
-# <LJFUNC>
-# name: LJ::can_manage_other
-# des: Given a user and a target user, will determine if the first user is an
-# admin for the target user, but not if the two are the same.
-# args: remote, u
-# des-remote: user object or userid of user to try and authenticate
-# des-u: user object or userid of target user
-# returns: bool: true if authorized, otherwise fail
-# </LJFUNC>
-sub can_manage_other {
- my ($remote, $u) = @_;
- return 0 if LJ::want_userid($remote) == LJ::want_userid($u);
- return LJ::can_manage($remote, $u);
-}
-
-
# <LJFUNC>
# name: LJ::get_authas_list
# des: Get a list of usernames a given user can authenticate as.
diff -r 28f93d764c8e -r 6eea5d364d26 cgi-bin/communitylib.pl
--- a/cgi-bin/communitylib.pl Tue Jun 15 16:56:26 2010 +0800
+++ b/cgi-bin/communitylib.pl Tue Jun 15 17:26:16 2010 +0800
@@ -636,15 +636,18 @@ sub get_comm_settings {
# Set membership and posting level settings for a community
sub set_comm_settings {
- my ($c, $u, $opts) = @_;
+ my ( $c, $u, $opts ) = @_;
+
+ die "Invalid users passed to set_comm_settings"
+ unless LJ::isu( $c ) && LJ::isu( $u );
die "User cannot modify this community"
- unless (LJ::can_manage_other($u, $c));
+ unless $u->can_manage_other( $c );
die "Membership and posting levels are not available"
- unless ($opts->{membership} && $opts->{postlevel});
+ unless $opts->{membership} && $opts->{postlevel};
- my $cid = $c->{userid};
+ my $cid = $c->userid;
my $dbh = LJ::get_db_writer();
$dbh->do("REPLACE INTO community (userid, membership, postlevel) VALUES
(?,?,?)" , undef, $cid, $opts->{membership}, $opts->{postlevel});
diff -r 28f93d764c8e -r 6eea5d364d26 cgi-bin/ljlib.pl
--- a/cgi-bin/ljlib.pl Tue Jun 15 16:56:26 2010 +0800
+++ b/cgi-bin/ljlib.pl Tue Jun 15 17:26:16 2010 +0800
@@ -609,15 +609,15 @@ sub get_authas_user {
return undef unless $remote;
# remote is already what they want?
- return $remote if $remote->{'user'} eq $user;
+ return $remote if $remote->user eq $user;
# load user and authenticate
my $u = LJ::load_user($user);
return undef unless $u;
return undef unless $u->{clusterid};
- # does $u have admin access?
- return undef unless LJ::can_manage($remote, $u);
+ # does $remote have admin access to $u?
+ return undef unless $remote->can_manage( $u );
# passed all checks, return $u
return $u;
diff -r 28f93d764c8e -r 6eea5d364d26 cgi-bin/ljprotocol.pl
--- a/cgi-bin/ljprotocol.pl Tue Jun 15 16:56:26 2010 +0800
+++ b/cgi-bin/ljprotocol.pl Tue Jun 15 17:26:16 2010 +0800
@@ -1736,7 +1736,7 @@ sub editevent
($ownerid == $u->{'userid'} ||
# community account can delete it (ick)
- LJ::can_manage_other($posterid, $ownerid)
+ $u->can_manage_other( $uowner )
# if user is a community maintainer they can delete
# it too (good)
));
diff -r 28f93d764c8e -r 6eea5d364d26 cgi-bin/weblib.pl
--- a/cgi-bin/weblib.pl Tue Jun 15 16:56:26 2010 +0800
+++ b/cgi-bin/weblib.pl Tue Jun 15 17:26:16 2010 +0800
@@ -2850,7 +2850,7 @@ sub control_strip
my $memberof = $remote->member_of( $journal );
my $haspostingaccess = LJ::check_rel($journal, $remote, 'P');
my $isclosedcommunity = $journal->is_closed_membership;
- if (LJ::can_manage_other($remote, $journal)) {
+ if ( $remote->can_manage_other( $journal ) ) {
$ret .= "$statustext{maintainer}<br />";
if ($haspostingaccess) {
$ret .= "$links{post_to_community} " unless
$remote->is_identity;
diff -r 28f93d764c8e -r 6eea5d364d26 htdocs/allpics.bml
--- a/htdocs/allpics.bml Tue Jun 15 16:56:26 2010 +0800
+++ b/htdocs/allpics.bml Tue Jun 15 17:26:16 2010 +0800
@@ -97,10 +97,11 @@ _c?>
if $renamedto;
}
- my ($can_manage, $getextra);
- if ($remote) {
- $can_manage = LJ::can_manage($remote, $u->{'userid'});
- $getextra = $can_manage && $remote->{'user'} ne $u->{'user'} ?
"?authas=$u->{'user'}" : '';
+ my ( $can_manage, $getextra );
+ if ( $remote ) {
+ $can_manage = $remote->can_manage( $u );
+ $getextra = $can_manage && ! $remote->equals( $u )
+ ? "?authas=" . $u->user : '';
}
#### show pictures
diff -r 28f93d764c8e -r 6eea5d364d26 htdocs/community/create.bml
--- a/htdocs/community/create.bml Tue Jun 15 16:56:26 2010 +0800
+++ b/htdocs/community/create.bml Tue Jun 15 17:26:16 2010 +0800
@@ -82,8 +82,8 @@ SUBMIT:
} elsif ($u) {
# community was created in the last 10 minutes?
my $recent_create = ($u->timecreate > (time() - (10*60))) ? 1 : 0;
- $second_submit = ($u->is_community && $recent_create
- && LJ::can_manage($remote, $u)) ? 1 : 0;
+ $second_submit = ( $u->is_community && $recent_create
+ && $remote->can_manage_other( $u ) ) ? 1 : 0;
$error = "$ML{'.error.username.inuse'}" if (!$second_submit);
}
diff -r 28f93d764c8e -r 6eea5d364d26 htdocs/community/members.bml
--- a/htdocs/community/members.bml Tue Jun 15 16:56:26 2010 +0800
+++ b/htdocs/community/members.bml Tue Jun 15 17:26:16 2010 +0800
@@ -60,9 +60,9 @@ body<=
return $ret;
}
- my $cid = $c->{'userid'};
+ my $cid = $c->userid;
# is $remote an admin?
- unless (LJ::can_manage_other($remote, $c)) {
+ unless ( $remote->can_manage_other( $c ) ) {
$ret .= "<?h1 $ML{'Error'} h1?><?p ";
$ret .= BML::ml( '.error.noaccess',
{ comm => LJ::ljuser( $cname, { type => 'C' } ) } );
diff -r 28f93d764c8e -r 6eea5d364d26 htdocs/community/pending.bml
--- a/htdocs/community/pending.bml Tue Jun 15 16:56:26 2010 +0800
+++ b/htdocs/community/pending.bml Tue Jun 15 17:26:16 2010 +0800
@@ -45,10 +45,10 @@ body<=
my $c = LJ::load_user($cname);
return $ret . "<?h1 $ML{'Error'} h1?><?p $ML{'.error.nocomm'} p?>"
unless $c;
- my $cid = $c->{'userid'};
+ my $cid = $c->userid;
# is $remote an admin?
- unless (LJ::can_manage($remote, $c)) {
+ unless ( $remote->can_manage_other( $c ) ) {
$ret .= "<?h1 $ML{'Error'} h1?><?p ";
$ret .= BML::ml('.error.noaccess',
{ comm => LJ::ljuser($cname, { type => 'C' }) });
diff -r 28f93d764c8e -r 6eea5d364d26 htdocs/community/sentinvites.bml
--- a/htdocs/community/sentinvites.bml Tue Jun 15 16:56:26 2010 +0800
+++ b/htdocs/community/sentinvites.bml Tue Jun 15 17:26:16 2010 +0800
@@ -61,9 +61,9 @@ body<=
return $ret;
}
- my $cid = $c->{'userid'};
+ my $cid = $c->userid;
# is $remote an admin?
- unless (LJ::can_manage_other($remote, $c)) {
+ unless ( $remote->can_manage_other( $c ) ) {
$ret .= "<?h1 $ML{'Error'} h1?><?p ";
$ret .= BML::ml('/community/members.bml.error.noaccess',
{ 'comm' => LJ::ljuser($cname, { 'type' => 'C' }) });
diff -r 28f93d764c8e -r 6eea5d364d26 htdocs/community/settings.bml
--- a/htdocs/community/settings.bml Tue Jun 15 16:56:26 2010 +0800
+++ b/htdocs/community/settings.bml Tue Jun 15 17:26:16 2010 +0800
@@ -85,8 +85,8 @@ body<=
}
# if we're changing rather than creating, check that we can
- if ($mode eq 'modify' && !LJ::can_manage_other($remote, $cu)) {
- $errors{'username'} = BML::ml('.error.noaccess', {'comm'=>$cuser});
+ if ( $mode eq 'modify' && ! $remote->can_manage_other( $cu ) ) {
+ $errors{'username'} = BML::ml( '.error.noaccess', { comm => $cuser
} );
}
# if we're creating, community password must match
diff -r 28f93d764c8e -r 6eea5d364d26 htdocs/community/transfer.bml
--- a/htdocs/community/transfer.bml Tue Jun 15 16:56:26 2010 +0800
+++ b/htdocs/community/transfer.bml Tue Jun 15 17:26:16 2010 +0800
@@ -43,7 +43,7 @@ _c?>
$errors{username} = $ML{'.error.badstatus'} unless %errors ||
$cu->is_visible || $cu->is_deleted;
# are they already a maintainer?
- $errors{username} = $ML{'.error.alreadyadmin'} if !%errors &&
LJ::can_manage($remote, $cu);
+ $errors{username} = $ML{'.error.alreadyadmin'} if !%errors &&
$remote->can_manage_other( $cu );
# check the password last
$errors{password} = $ML{'.error.nopassword'} if !%errors &&
!$POST{password};
diff -r 28f93d764c8e -r 6eea5d364d26 htdocs/customize/advanced/layerbrowse.bml
--- a/htdocs/customize/advanced/layerbrowse.bml Tue Jun 15 16:56:26 2010 +0800
+++ b/htdocs/customize/advanced/layerbrowse.bml Tue Jun 15 17:26:16 2010 +0800
@@ -132,12 +132,11 @@ _c?>
# do they have access?
my $isadmin = ! defined $pub->{$id} && $remote && $remote->has_priv(
'canview', 'styles' );
+ my $can_manage = $remote && $remote->can_manage( LJ::load_userid(
$layer->{userid} ) );
# public styles are pulled from the system account, so we don't
# want to check privileges in case they're private styles
return $err->($ML{'.error.cantviewlayer'})
- unless defined $pub->{$id} || $srcview == 1 ||
- LJ::can_manage($remote, $layer->{'userid'}) ||
- $isadmin;
+ unless defined $pub->{$id} || $srcview == 1 || $isadmin || $can_manage;
LJ::S2::load_layers($id);
my $s2info = S2::get_layer_all($id);
@@ -169,10 +168,8 @@ _c?>
if ($layer->{'b2lid'}) {
$body .= BML::ml('Actionlink', { 'link' => "<a
href=\"$LJ::SITEROOT/customize/advanced/layerbrowse?id=$layer->{'b2lid'}\">$ML{'.nav.parentlayer'}</a>"
}) . "\n";
}
- if (defined $pub->{$id} && (! defined $srcview || $srcview != 0) ||
- $srcview == 1 ||
- LJ::can_manage($remote, $layer->{'userid'}) ||
- $isadmin) {
+ if ( defined $pub->{$id} && (! defined $srcview || $srcview != 0) ||
+ $srcview == 1 || $can_manage || $isadmin ) {
$body .= BML::ml('Actionlink', { 'link' => "$ML{'.nav.viewsource'} <a
href=\"$LJ::SITEROOT/customize/advanced/layersource?id=$id\">$ML{'.nav.viewsource.raw'}</a>
| <a
href=\"$LJ::SITEROOT/customize/advanced/layersource?id=$id&fmt=html\">$ML{'.nav.viewsource.highlighted'}</a>"
}) . "\n";
}
diff -r 28f93d764c8e -r 6eea5d364d26 htdocs/customize/advanced/layeredit.bml
--- a/htdocs/customize/advanced/layeredit.bml Tue Jun 15 16:56:26 2010 +0800
+++ b/htdocs/customize/advanced/layeredit.bml Tue Jun 15 17:26:16 2010 +0800
@@ -50,12 +50,12 @@ _c?>
$lay->{b2lid} = $LJ::S2LID_REMAP{$b2lid};
}
+ # get u of user they are acting as
+ my $u = LJ::load_userid( $lay->{userid} );
+
# is authorized admin for this layer?
return $err->('You are not authorized to edit this layer.')
- unless LJ::can_manage($remote, $lay->{'userid'});
-
- # get u of user they are acting as
- my $u = $lay->{'userid'} == $remote->{'userid'} ? $remote :
LJ::load_userid($lay->{'userid'});
+ unless $u && $remote->can_manage( $u );
# check priv and ownership
return $err->("You are not authorized to edit styles.")
diff -r 28f93d764c8e -r 6eea5d364d26 htdocs/customize/advanced/layersource.bml
--- a/htdocs/customize/advanced/layersource.bml Tue Jun 15 16:56:26 2010 +0800
+++ b/htdocs/customize/advanced/layersource.bml Tue Jun 15 17:26:16 2010 +0800
@@ -45,9 +45,8 @@ _c?>
# want to check privileges in case they're private styles
return
$err->($ML{'/customize/advanced/layerbrowse.bml.error.cantviewlayer'})
unless defined $pub->{$id} && (! defined $srcview || $srcview != 0) ||
- $srcview == 1 ||
- LJ::can_manage($remote, $lay->{'userid'}) ||
- $isadmin;
+ $srcview == 1 || $isadmin || $remote &&
+ $remote->can_manage( LJ::load_userid( $lay->{userid} ) );
my $s2code = LJ::S2::load_layer_source($id);
diff -r 28f93d764c8e -r 6eea5d364d26 htdocs/delcomment.bml
--- a/htdocs/delcomment.bml Tue Jun 15 16:56:26 2010 +0800
+++ b/htdocs/delcomment.bml Tue Jun 15 17:26:16 2010 +0800
@@ -102,7 +102,7 @@ _info?><?_code
return $error->($err);
}
- my $can_manage = LJ::can_manage($remote, $u);
+ my $can_manage = $remote->can_manage( $u );
# can ban if can manage and the comment is by someone else and not anon
my $can_ban = $can_manage && $tp->{'posterid'}
diff -r 28f93d764c8e -r 6eea5d364d26 htdocs/editjournal.bml
--- a/htdocs/editjournal.bml Tue Jun 15 16:56:26 2010 +0800
+++ b/htdocs/editjournal.bml Tue Jun 15 17:26:16 2010 +0800
@@ -173,8 +173,8 @@ body<=
my $disabled_save = 0;
my $disabled_delete = 0;
my $disabled_spamdelete = 0;
- if ($usejournal && $res{'events_1_poster'} ne $u->{'user'}) {
- $disabled_delete = ! LJ::can_delete_journal_item($u,
$usejournal_u);
+ if ( $usejournal && $res{'events_1_poster'} ne $u->user ) {
+ $disabled_delete = ! $u->can_manage( $usejournal_u );
$disabled_save++;
}
$disabled_save++ if $usejournal && ! $u->can_post_to(
$usejournal_u );
diff -r 28f93d764c8e -r 6eea5d364d26 htdocs/talkread.bml
--- a/htdocs/talkread.bml Tue Jun 15 16:56:26 2010 +0800
+++ b/htdocs/talkread.bml Tue Jun 15 17:26:16 2010 +0800
@@ -229,7 +229,8 @@ body<=
));
}
- my $showmultiform = $remote && ( $remote->{'user'} eq $up->{'user'} ||
LJ::can_manage($remote, $u) );
+ my $showmultiform = $remote && ( ( $up && $remote->equals( $up) ) ||
+ $remote->can_manage( $u ) );
my $multiform_selects = 0; # are there select boxes? don't show form if
not.
my $event = $item->{'event'};
@@ -479,11 +480,11 @@ body<=
# Quick reply variables. Not always set.
my ($last_talkid, $last_jid) = LJ::get_lastcomment();
my %LJ_cmtinfo; # data structure to give to javascript for commentmanage
- $LJ_cmtinfo{'form_auth'} = LJ::form_auth(1);
- $LJ_cmtinfo{'journal'} = $u->{user};
- $LJ_cmtinfo{'canAdmin'} = LJ::can_manage($remote, $u) ? 1 : 0;
- $LJ_cmtinfo{'canSpam'} = LJ::sysban_check( 'spamreport', $u->user ) ? 0 :
1;
- $LJ_cmtinfo{'remote'} = $remote ? $remote->{user} : "";
+ $LJ_cmtinfo{form_auth} = LJ::form_auth(1);
+ $LJ_cmtinfo{journal} = $u->user;
+ $LJ_cmtinfo{canAdmin} = $remote && $remote->can_manage( $u ) ? 1 : 0;
+ $LJ_cmtinfo{canSpam} = LJ::sysban_check( 'spamreport', $u->user ) ? 0 : 1;
+ $LJ_cmtinfo{remote} = $remote ? $remote->user : "";
my $show_thread_expander = $u->show_thread_expander( $remote );
#
@@ -610,10 +611,9 @@ body<=
$ret .= "<br />$user\n";
$ret .= " " . BML::ml( '.from_external',
{site=>$post->{props}->{imported_from}} ) if $post->{props}->{imported_from};
$ret .= "<br /><span class='datepost'>$datepost</span>\n";
- if ($post->{'props'}->{'poster_ip'} && $remote &&
- ($remote->{'user'} eq $up->{'user'} ||
- LJ::can_manage($remote, $u) || $viewall))
- {
+ if ( $post->{'props'}->{'poster_ip'} && $remote &&
+ ( $viewall || $remote->equals( $up ) ||
+ $remote->can_manage( $u ) ) ) {
$ret .= BML::ml('.fromip',
{'ip'=>$post->{'props'}->{'poster_ip'}});
}
diff -r 28f93d764c8e -r 6eea5d364d26 htdocs/tools/memories.bml
--- a/htdocs/tools/memories.bml Tue Jun 15 16:56:26 2010 +0800
+++ b/htdocs/tools/memories.bml Tue Jun 15 17:26:16 2010 +0800
@@ -86,7 +86,7 @@ _c?>
# owner if you've authed as them or you administrate them
my $is_owner = $authasu && $user eq $authasu->{user} ||
- LJ::can_manage_other($remote, $u);
+ $remote && $remote->can_manage_other( $u );
my $userid = $u->{'userid'};
diff -r 28f93d764c8e -r 6eea5d364d26 t/console-changecommunityadmin.t
--- a/t/console-changecommunityadmin.t Tue Jun 15 16:56:26 2010 +0800
+++ b/t/console-changecommunityadmin.t Tue Jun 15 17:26:16 2010 +0800
@@ -24,7 +24,7 @@ my $run = sub {
LJ::clear_rel($comm, $u, 'A');
$refresh->();
-is(LJ::can_manage($u, $comm), undef, "Verified that user is not maintainer");
+ok( ! $u->can_manage( $comm ), "Verified that user is not maintainer" );
is($run->("change_community_admin " . $comm->user . " " . $u->user),
"error: You are not authorized to run this command.");
@@ -44,7 +44,7 @@ is($run->("change_community_admin " . $c
"success: Transferred maintainership of '" . $comm->user . "' to '" .
$u->user . "'.");
$refresh->();
-ok(LJ::can_manage($u, $comm), "Verified user is maintainer");
-ok($u->email_raw eq $comm->email_raw, "Addresses match");
+ok( $u->can_manage( $comm ), "Verified user is maintainer" );
+ok( $u->email_raw eq $comm->email_raw, "Addresses match" );
ok(!$comm->password, "Password cleared");
$u->revoke_priv("communityxfer");
_______________________________________________
dw-changelog mailing list
[email protected]
http://lists.dwscoalition.org/mailman/listinfo/dw-changelog
