cvs: pearweb /include pear-database.php

ssb Wed Apr 24 20:38:24 2002 EDT Modified files: /pearweb/include pear-database.php Log: * upload authorization didn't work for non-admins Index: pearweb/include/pear-database.php diff -u pearweb/include/pear-database.php:1.84 pearweb/include/pear-database.php:1.85 --- pearweb/include/pear-database.php:1.84 Tue Apr 23 21:52:49 2002 +++ pearweb/include/pear-database.php Wed Apr 24 20:38:20 2002 @@ -17,7 +17,7 @@ | Tomas V.V.Cox <cox@php.net> | | Martin Jansen <mj@php.net> | +----------------------------------------------------------------------+ - $Id: pear-database.php,v 1.84 2002/04/24 01:52:49 ssb Exp $ + $Id: pear-database.php,v 1.85 2002/04/25 00:38:20 ssb Exp $ */ require_once 'DB/storage.php'; @@ -420,7 +420,7 @@ if (empty($auth_user->admin)) { $role = user::maintains($auth_user->handle, $package_id); if ($role != 'lead' && $role != 'developer') { - return PEAR::raiseError("Insufficient privileges"); + return PEAR::raiseError('package::updateInfo: insufficient privileges'); } } // XXX (cox) what about 'name'? @@ -522,8 +522,8 @@ { // Only admins and leads can do this. global $dbh, $auth_user; - if (empty($auth_user->admin) || !user::maintains($auth_user->handle, $pkgid, 'lead')) { - return PEAR::raiseError("Insufficient privileges"); + if (empty($auth_user->admin) && !user::maintains($auth_user->handle, $pkgid, 'lead')) { + return PEAR::raiseError('maintainer::updateAll: insufficient privileges'); } $sql = "SELECT handle, role FROM maintains WHERE package = ?"; $old = $dbh->getAssoc($sql, false, array($pkgid)); @@ -608,7 +608,7 @@ { global $auth_user; if (!user::maintains($auth_user->handle, $package, 'lead')) { - return PEAR::raiseError('Insufficient privileges'); + return PEAR::raiseError('release::upload: insufficient privileges'); } $ref = release::validateUpload($package, $version, $state, $relnotes, $tarball, $md5sum); if (PEAR::isError($ref)) { @@ -624,7 +624,7 @@ { global $dbh, $auth_user; if (!user::maintains($auth_user->handle, $package, 'lead')) { - return PEAR::raiseError('Insufficient privileges'); + return PEAR::raiseError('release::validateUpload: insufficient privileges'); } // (2) verify that package exists $package_id = package::info($package, 'id'); @@ -690,9 +690,6 @@ function confirmUpload($upload_ref) { global $dbh, $auth_user; - if (!user::maintains($auth_user->handle, $package, 'lead')) { - return PEAR::raiseError('Insufficient privileges'); - } $fp = @fopen($upload_ref, "r"); if (!is_resource($fp)) { return PEAR::raiseError("invalid upload reference: $upload_ref"); @@ -701,6 +698,10 @@ extract($info); @unlink($upload_ref); + if (!user::maintains($auth_user->handle, $package_id, 'lead')) { + return PEAR::raiseError('release::confirmUpload: insufficient privileges'); + } + // Update releases table $query = "INSERT INTO releases (id,package,version,state,doneby,". "releasedate,releasenotes) VALUES(?,?,?,?,?,?,?)"; @@ -930,7 +931,7 @@ global $dbh, $auth_user; if (!user::maintains($auth_user->handle, $package, 'lead')) { - return PEAR::raiseError('Insufficient privileges'); + return PEAR::raiseError('release::remove: insufficient privileges'); } $success = true;