List the valid arguments for granting privs.
Patch by kareila.
diffs (174 lines):
diff -r 9db8f0588507 -r a88e6f2d2793 cgi-bin/LJ/User.pm
--- a/cgi-bin/LJ/User.pm Mon Aug 23 11:38:44 2010 +0800
+++ b/cgi-bin/LJ/User.pm Mon Aug 23 12:42:16 2010 +0800
@@ -5397,6 +5397,11 @@ sub grant_priv {
return 1 if $u->has_priv( $priv, $arg );
+ if ( $arg && $arg ne '*' && $priv !~ /^support/ ) {
+ my $valid_args = LJ::list_valid_args( $priv );
+ return 0 if $valid_args and not $valid_args->{$arg};
+ }
+
my $privid = $dbh->selectrow_array("SELECT prlid FROM priv_list".
" WHERE privcode = ?", undef, $priv);
return 0 unless $privid;
diff -r 9db8f0588507 -r a88e6f2d2793 cgi-bin/ljlib.pl
--- a/cgi-bin/ljlib.pl Mon Aug 23 11:38:44 2010 +0800
+++ b/cgi-bin/ljlib.pl Mon Aug 23 12:42:16 2010 +0800
@@ -2359,6 +2359,140 @@ sub is_enabled {
return ! LJ::conf_test( $LJ::DISABLED{$conf}, @_ );
}
+# document valid arguments for certain privs
+sub list_valid_args {
+ my ( $priv ) = @_;
+ my $hr = {};
+
+ # valid admin privargs are the same as defined DB privs
+ if ( $priv eq 'admin' ) {
+ my $dbr = LJ::get_db_reader();
+ $hr = $dbr->selectall_hashref(
+ 'SELECT privcode, privname FROM priv_list', 'privcode' );
+ # unfold result
+ $hr->{$_} = $hr->{$_}->{privname} foreach keys %$hr;
+ # add subprivs for supporthelp
+ my $cats = LJ::Support::load_cats();
+ $hr->{"supporthelp/$_"} = "$hr->{supporthelp} for $_"
+ foreach map { $_->{catkey} } values %$cats;
+ }
+
+ # valid support* privargs are the same as support cats
+ if ( my ( $sup ) = ( $priv =~ /^support(.*)$/ ) ) {
+ my $cats = LJ::Support::load_cats();
+ my @catkeys = map { $_->{catkey} } values %$cats;
+ if ( $priv eq 'supportread' ) {
+ $hr->{"$_+"} = "Extended $sup privs for $_ category"
+ foreach @catkeys;
+ }
+ $sup = $priv eq 'supporthelp' ? 'All' : ucfirst $sup;
+ $hr->{$_} = "$sup privs for $_ category"
+ foreach @catkeys;
+ $hr->{''} = "$sup privs for public categories";
+ }
+
+ # valid faqadd/faqedit privargs are the same as faqcats
+ if ( $priv eq 'faqadd' or $priv eq 'faqedit' ) {
+ my $dbr = LJ::get_db_reader();
+ $hr = $dbr->selectall_hashref(
+ 'SELECT faqcat, faqcatname FROM faqcat', 'faqcat' );
+ # unfold result
+ $hr->{$_} = $hr->{$_}->{faqcatname} foreach keys %$hr;
+ }
+
+ # valid translate privargs are the same as defined languages
+ if ( $priv eq 'translate' ) {
+ my %langs = @{ LJ::Lang::get_lang_names() };
+ $hr->{$_} = "Can translate $langs{$_}" foreach keys %langs;
+ # plus a couple of extras
+ $hr->{'[itemdelete]'} = "Can delete translation strings";
+ $hr->{'[itemrename]'} = "Can rename translation strings";
+ }
+
+ # have to manually maintain the other lists
+ $hr = {
+ entryprops => "Access to /admin/entryprops",
+ sessions => "Access to admin mode on /manage/logins",
+ styles => "Access to private styles on /customize/advanced",
+ suspended => "Access to suspended journal content",
+ userlog => "Access to /admin/userlog",
+ userprops => "Access to /admin/propedit",
+ } if $priv eq 'canview';
+
+ $hr = {
+ codetrace => "Access to /admin/invites/codetrace",
+ infohistory => "Access to infohistory console command",
+ } if $priv eq 'finduser';
+
+ # extracted from grep -r statushistory_add
+ if ( $priv eq 'historyview' ) {
+ my @shtypes = qw/ account_level_change b2lid_remap capedit
+ change_journal_type comment_action communityxfer
+ create_from_invite create_from_promo
+ entry_action email_changed expunge_userpic
+ impersonate journal_status logout_user
+ mass_privacy paid_from_invite paidstatus
+ privadd privdel reset_email reset_password
+ s2lid_remap set_badpassword shop_points
+ suspend sysban_add sysban_mod synd_create
+ synd_edit synd_merge sysban_add sysban_modify
+ sysban_trig unsuspend vgifts viewall /;
+
+ $hr->{$_} = "Access to statushistory for $_ logs"
+ foreach @shtypes;
+ }
+
+ $hr = {
+ commentview => "Access to /admin/recent_comments",
+ emailqueue => "Access to /tools/recent_email",
+ entry_redirect => "Access to /misc/entry_redirect",
+ largefeedsize => "Overrides synsuck_max_size for a feed",
+ memcacheview => "Access to /admin/memcache",
+ mysqlstatus => "Access to /admin/mysql_status",
+ navtag => "Access to /admin/navtag",
+ propedit => "Allow to change userprops for other users",
+ qotd => "Access to /admin/qotd",
+ rename => "Access to rename_opts console command",
+ sitemessages => "Access to /admin/sitemessages",
+ spamreports => "Access to /admin/spamreports",
+ theschwartz => "Access to /admin/theschwartz",
+ usernames => "Bypasses is_protected_username check",
+ userpics => "Access to expunge_userpic console command",
+ users => "Access to change_journal_status console command",
+ vgifts => "Access to approval functions on /admin/vgifts",
+ } if $priv eq 'siteadmin';
+
+ $hr = {
+ openid => "Only allowed to suspend OpenID accounts",
+ } if $priv eq 'suspend';
+
+ # extracted from sysban_validate function in sysban.pl
+ $hr = {
+ email => "Can ban specific email addresses",
+ email_domain => "Can ban entire email domains",
+ invite_email => "Can ban invites for email addresses",
+ invite_user => "Can ban invites for users",
+ ip => "Can ban connections from specific IPs",
+ lostpassword => "Can ban requests for lost passwords",
+ noanon_ip => "Can ban anonymous comments from specific IPs",
+ pay_cc => "Can ban payments from specific credit cards",
+ pay_email => "Can ban payments from specific emails",
+ pay_uniq => "Can ban payments from specific sessions",
+ pay_user => "Can ban payments from specific users",
+ spamreport => "Can ban spam reports from specific users",
+ support_email => "Can ban support requests from emails",
+ support_uniq => "Can ban support requests from sessions",
+ support_user => "Can ban support requests from users",
+ talk_ip_test => "Can ban IPs from leaving comments",
+ uniq => "Can ban specific browser sessions",
+ user => "Can ban specific users",
+ } if $priv eq 'sysban';
+
+ return wantarray ? keys %$hr : $hr;
+}
+
+# END package LJ;
+
package LJ::Error::InvalidParameters;
sub opt_fields { qw(params) }
diff -r 9db8f0588507 -r a88e6f2d2793 htdocs/admin/sysban.bml
--- a/htdocs/admin/sysban.bml Mon Aug 23 11:38:44 2010 +0800
+++ b/htdocs/admin/sysban.bml Mon Aug 23 12:42:16 2010 +0800
@@ -45,10 +45,7 @@ body<=
return "<?h1 Error h1?><?p $_[0] p?><?p $main_return p?>";
};
my $priv = 'sysban';
- my @all_sb_args = qw( ip uniq email email_domain user pay_cc
- pay_user pay_email pay_uniq support_user
- support_uniq lostpassword talk_ip_test
- invite_user invite_email noanon_ip spamreport );
+ my @all_sb_args = LJ::list_valid_args( 'sysban' );
my $remote = LJ::get_remote();
return "<?needlogin?>" unless $remote;
_______________________________________________
dw-changelog mailing list
[email protected]
http://lists.dwscoalition.org/mailman/listinfo/dw-changelog
