Escaping username and group names.
[webmin.git] / useradmin / my_group_chooser.cgi
1 #!/usr/local/bin/perl
2 # my_group_chooser.cgi
3 # A modified version of group_chooser.cgi that uses the my_ functions
4
5 $trust_unknown_referers = 1;
6 require './user-lib.pl';
7 &init_config();
8 &ReadParse(undef, undef, 1);
9
10 # Build list of primary groups
11 &my_setpwent();
12 while(@uinfo = &my_getpwent()) {
13         push(@{$members{$uinfo[3]}}, $uinfo[0]);
14         }
15 &my_endpwent();
16
17 if ($in{'multi'}) {
18         # selecting multiple groups.
19         if ($in{'frame'} == 0) {
20                 # base frame
21                 &PrintHeader();
22                 print "<script>\n";
23                 @ul = split(/\s+/, $in{'group'});
24                 $len = @ul;
25                 print "sel = new Array($len);\n";
26                 print "selr = new Array($len);\n";
27                 for($i=0; $i<$len; $i++) {
28                         print "sel[$i] = \"".
29                               &quote_escape($ul[$i], '"')."\";\n";
30                         @ginfo = &my_getgrnam($ul[$i]);
31                         if (@ginfo) {
32                                 @mems = &unique( split(/ /, $ginfo[3]),
33                                                  @{$members{$ginfo[2]}} );
34                                 if (@mems > 3) { @mems = (@mems[0..1], "..."); }
35                                 print "selr[$i] = \"",
36                                   &quote_escape(join(' ', @mems), '"'),"\";\n";
37                                 }
38                         else { print "selr[$i] = \"???\";\n"; }
39                         }
40                 print "</script>\n";
41                 print "<title>$text{'groups_title1'}</title>\n";
42                 print "<frameset cols='50%,50%'>\n";
43                 print "<frame src=\"my_group_chooser.cgi?frame=1&multi=1\">\n";
44                 print "<frameset rows='*,50' frameborder=no>\n";
45                 print " <frame src=\"my_group_chooser.cgi?frame=2&multi=1\">\n";
46                 print " <frame src=\"my_group_chooser.cgi?frame=3&multi=1\" scrolling=no>\n";
47                 print "</frameset>\n";
48                 print "</frameset>\n";
49                 }
50         elsif ($in{'frame'} == 1) {
51                 # list of all groups to choose from
52                 &popup_header();
53                 print "<script>\n";
54                 print "function addgroup(u, r)\n";
55                 print "{\n";
56                 print "top.sel[top.sel.length] = u\n";
57                 print "top.selr[top.selr.length] = r\n";
58                 print "top.frames[1].location = top.frames[1].location\n";
59                 print "return false;\n";
60                 print "}\n";
61                 print "</script>\n";
62                 print "<font size=+1>$text{'groups_all'}</font>\n";
63                 print "<table width=100%>\n";
64                 foreach $u (&get_groups_list()) {
65                         if ($in{'group'} eq $u->[0]) { print "<tr $cb>\n"; }
66                         else { print "<tr>\n"; }
67                         print "<td width=20%><a href=\"\" onClick='return addgroup(\"$u->[0]\", \"$u->[3]\")'>$u->[0]</a></td>\n";
68                         print "<td>$u->[3]</td> </tr>\n";
69                         }
70                 print "</table>\n";
71                 &popup_footer();
72                 }
73         elsif ($in{'frame'} == 2) {
74                 # show chosen groups
75                 &popup_header();
76                 print "<font size=+1>$text{'groups_sel'}</font>\n";
77                 print <<'EOF';
78 <table width=100%>
79 <script>
80 function sub(j)
81 {
82 sel2 = new Array(); selr2 = new Array();
83 for(k=0,l=0; k<top.sel.length; k++) {
84         if (k != j) {
85                 sel2[l] = top.sel[k];
86                 selr2[l] = top.selr[k];
87                 l++;
88                 }
89         }
90 top.sel = sel2; top.selr = selr2;
91 location = location;
92 return false;
93 }
94 for(i=0; i<top.sel.length; i++) {
95         document.write("<tr>\n");
96         document.write("<td><a href=\"\" onClick='return sub("+i+")'>"+top.sel[i]+"</a></td>\n");
97         document.write("<td>"+top.selr[i]+"</td>\n");
98         }
99 </script>
100 </table>
101 EOF
102                 &popup_footer();
103                 }
104         elsif ($in{'frame'} == 3) {
105                 # output OK and Cancel buttons
106                 &popup_header();
107                 print "<script>\n";
108                 print "function qjoin(l)\n";
109                 print "{\n";
110                 print "rv = \"\";\n";
111                 print "for(i=0; i<l.length; i++) {\n";
112                 print "    if (rv != '') rv += ' ';\n";
113                 print "    if (l[i].indexOf(' ') < 0) rv += l[i];\n";
114                 print "    else rv += '\"'+l[i]+'\"'\n";
115                 print "    }\n";
116                 print "return rv;\n";
117                 print "}\n";
118                 print "</script>\n";
119                 print "<form>\n";
120                 print "<input type=button value=\"$text{'groups_ok'}\" ",
121                       " onClick='top.opener.ifield.value = qjoin(top.sel); ",
122                       "top.close()'>\n";
123                 print "<input type=button value=\"$text{'groups_cancel'}\" ",
124                       "onClick='top.close()'>\n";
125                 print "&nbsp;&nbsp;<input type=button value=\"$text{'groups_clear'}\" onClick='top.sel = new Array(); top.selr = new Array(); top.frames[1].location = top.frames[1].location'>\n";
126                 print "</form>\n";
127                 &popup_footer();
128                 }
129         }
130 else {
131         # selecting just one group .. display a list of all groups to choose from
132         &popup_header($text{'groups_title2'});
133         print "<script>\n";
134         print "function select(f)\n";
135         print "{\n";
136         print "top.opener.ifield.value = f;\n";
137         print "top.close();\n";
138         print "return false;\n";
139         print "}\n";
140         print "</script>\n";
141         print "<table width=100%>\n";
142         foreach $u (&get_groups_list()) {
143                 if ($in{'group'} eq $u->[0]) { print "<tr $cb>\n"; }
144                 else { print "<tr>\n"; }
145                 print "<td width=20%><a href=\"\" onClick='return select(\"$u->[0]\")'>".&html_escape($u->[0])."</a></td>\n";
146                 print "<td>".&html_escape($u->[3])."</td> </tr>\n";
147                 }
148         print "</table>\n";
149         &popup_footer();
150         }
151
152 sub get_groups_list
153 {
154 local(@ginfo, @groups, %gcan);
155 if ($access{'gedit_mode'} == 2 || $access{'gedit_mode'} == 3) {
156         map { $gcan{$_}++ } split(/\s+/, $access{'gedit'});
157         }
158 &my_setgrent();
159 while(@ginfo = &my_getgrent()) {
160         @mems = &unique( split(/ /, $ginfo[3]), @{$members{$ginfo[2]}} );
161         if (@mems > 3) { @mems = (@mems[0..1], "..."); }
162         $ginfo[3] = join(' ', @mems);
163         if ($access{'gedit_mode'} == 0 ||
164             $access{'gedit_mode'} == 2 && $gcan{$ginfo[0]} ||
165             $access{'gedit_mode'} == 3 && !$gcan{$ginfo[0]} ||
166             $access{'gedit_mode'} == 4 &&
167                 (!$access{'gedit'} || $ginfo[2] >= $access{'gedit'}) &&
168                 (!$access{'gedit2'} || $ginfo[2] <= $access{'gedit2'})) {
169                 push(@groups, [ @ginfo ]);
170                 }
171         }
172 &my_endgrent();
173 return sort { $a->[0] cmp $b->[0] } @groups;
174 }
175