cvs: pearweb /include pear-database.php /public_html/admin package-maintainers.php
| From: | Martin Jansen | Date: | Fri, 03 Sep 2004 21:02:30 +0000 |
| Subject: | cvs: pearweb /include pear-database.php /public_html/admin package-maintainers.php | ||
| Groups: | php.pear.cvs php.pear.core | ||
| Request: | Send a blank email to pear-cvs+get-23606@lists.php.net to get a copy of this message | ||
mj Fri Sep 3 17:02:30 2004 EDT
Modified files:
/pearweb/include pear-database.php
/pearweb/public_html/admin package-maintainers.php
Log:
* Added new method mayUpdate(int) to the maintainer class. This method
can be used to check if the current user is allowed to edit the
maintainership data for the given package. All security-checking places
in the maintainer section make use of this method.
http://cvs.php.net/diff.php/pearweb/include/pear-database.php?r1=1.237&r2=1.238&ty=u
Index: pearweb/include/pear-database.php
diff -u pearweb/include/pear-database.php:1.237 pearweb/include/pear-database.php:1.238
--- pearweb/include/pear-database.php:1.237 Fri Sep 3 09:47:34 2004
+++ pearweb/include/pear-database.php Fri Sep 3 17:02:30 2004
@@ -17,7 +17,7 @@
| Tomas V.V.Cox <cox@php.net> |
| Martin Jansen <mj@php.net> |
+----------------------------------------------------------------------+
- $Id: pear-database.php,v 1.237 2004/09/03 13:47:34 dufuz Exp $
+ $Id: pear-database.php,v 1.238 2004/09/03 21:02:30 mj Exp $
*/
require_once 'DB/storage.php';
@@ -1075,12 +1075,13 @@
{
require_once "Damblan/Log.php";
- // Only admins and leads can do this.
global $dbh, $auth_user;
+
$admin = $auth_user->isAdmin();
$qa = $auth_user->isQA();
- if (!$admin && !$qa && !user::maintains($auth_user->handle, $pkgid,
'lead')) {
+ // Only admins and leads can do this.
+ if (maintainer::mayUpdate($pkgid) == false) {
return PEAR::raiseError('maintainer::updateAll: insufficient privileges');
}
@@ -1160,6 +1161,30 @@
"WHERE package = ? AND handle = ?";
return $dbh->query($query, array($role, $active, $package, $user));
}
+
+ // {{{ NOEXPORT maintainer::mayUpdate(int)
+
+ /**
+ * Checks if the current user is allowed to update the maintainer data
+ *
+ * @access public
+ * @param int ID of the package
+ * @return boolean
+ */
+ function mayUpdate($package) {
+ global $auth_user;
+
+ $admin = $auth_user->isAdmin();
+ $qa = $auth_user->isQA();
+
+ if (!$admin && !$qa && !user::maintains($auth_user->handle, $package,
'lead')) {
+ return false;
+ }
+
+ return true;
+ }
+
+ // }}}
}
/**
http://cvs.php.net/diff.php/pearweb/public_html/admin/package-maintainers.php?r1=1.9&r2=1.10&ty=u
Index: pearweb/public_html/admin/package-maintainers.php
diff -u pearweb/public_html/admin/package-maintainers.php:1.9
pearweb/public_html/admin/package-maintainers.php:1.10
--- pearweb/public_html/admin/package-maintainers.php:1.9 Wed Sep 1 21:00:43 2004
+++ pearweb/public_html/admin/package-maintainers.php Fri Sep 3 17:02:30 2004
@@ -15,11 +15,13 @@
+----------------------------------------------------------------------+
| Authors: Martin Jansen <mj@php.net> |
+----------------------------------------------------------------------+
- $Id: package-maintainers.php,v 1.9 2004/09/02 01:00:43 danielc Exp $
+ $Id: package-maintainers.php,v 1.10 2004/09/03 21:02:30 mj Exp $
*/
require_once "HTML/Form.php";
+auth_require();
+
response_header("PEAR Administration - Package maintainers");
if (isset($_GET['pid'])) {
@@ -30,8 +32,6 @@
// Select package first
if (empty($id)) {
- auth_require(true);
-
$packages = package::listAll(true, false, true);
$values = array();
@@ -49,7 +49,7 @@
$bb->end();
} else if (!empty($_GET['update'])) {
- if (!isAllowed($id)) {
+ if (!maintainer::mayUpdate($id)) {
PEAR::raiseError("Only the lead maintainer of the package or PEAR
administrators can edit the maintainers.");
response_footer();
@@ -71,7 +71,7 @@
echo '<br /><b>Done</b><br />';
echo '<a href="' . $url . '">Back</a>';
} else {
- if (!isAllowed($id)) {
+ if (!maintainer::mayUpdate($id)) {
PEAR::raiseError("Only the lead maintainer of the package or PEAR
administrators can edit the maintainers.");
response_footer();
@@ -149,16 +149,6 @@
echo '</script>';
$bb->end();
-}
-
-function isAllowed($package)
-{
- auth_require();
- $lead = in_array($_COOKIE['PEAR_USER'], array_keys(maintainer::get($package, true)));
- $admin = user::isAdmin($_COOKIE['PEAR_USER']);
- $qa = user::isQA($_COOKIE['PEAR_USER']);
-
- return ($lead || $qa || $admin);
}
response_footer();