Added option to not grant new permissions to users

diff --git a/acl_security.pl b/acl_security.pl
index 74e480d..16cbee5 100644 (file)
--- a/acl_security.pl
+++ b/acl_security.pl
@@ -10,109 +10,96 @@ sub acl_security_form
 local $o = $_[0];
 
 # Root directory for file browser
-print "<tr> <td><b>$text{'acl_root'}</b></td>\n";
-printf "<td><input type=radio name=root_def value=1 %s> %s\n",
-       $o->{'root'} ? '' : 'checked', $text{'acl_home'};
-printf "<input type=radio name=root_def value=0 %s>\n",
-       $o->{'root'} ? 'checked' : '';
-print "<input name=root size=40 value='$o->{'root'}'> ",
-      &file_chooser_button("root", 1),"</td> </tr>\n";
+print &ui_table_row($text{'acl_root'},
+       &ui_opt_textbox("root", $o->{'root'}, 40, $text{'acl_home'})." ".
+       &file_chooser_button("root", 1));
 
+# Other dirs to allow
 print &ui_table_row($text{'acl_otherdirs'},
        &ui_textarea("otherdirs", join("\n", split(/\t+/, $o->{'otherdirs'})),
                     5, 40), 3);
 
 # Can see dot files?
-print "<tr> <td><b>$text{'acl_nodot'}</b></td>\n";
-print "<td>",&ui_yesno_radio("nodot", int($o->{'nodot'})),"</td> </tr>\n";
+print &ui_table_row($text{'acl_nodot'},
+       &ui_yesno_radio("nodot", int($o->{'nodot'})));
 
 # Browse as Unix user
-print "<tr> <td><b>$text{'acl_fileunix'}</b></td>\n";
-print "<td>",&ui_opt_textbox("fileunix", $o->{'fileunix'}, 13,
-                            $text{'acl_sameunix'})." ".
-            &user_chooser_button("fileunix"),"</td> </tr>\n";
+print &ui_table_row($text{'acl_fileunix'},
+       &ui_opt_textbox("fileunix", $o->{'fileunix'}, 13,
+                       $text{'acl_sameunix'})." ".
+       &user_chooser_button("fileunix"));
 
-print "<tr> <td colspan=2><hr></td> </tr>\n";
+print &ui_hr();
 
 # Users visible in chooser
-print "<tr> <td valign=top><b>$text{'acl_uedit'}</b></td> <td colspan=3>\n";
-printf "<input type=radio name=uedit_mode value=0 %s> $text{'acl_uedit_all'}\n",
-       $o->{'uedit_mode'} == 0 ? "checked" : "";
-printf "<input type=radio name=uedit_mode value=1 %s> $text{'acl_uedit_none'}<br>\n",
-       $o->{'uedit_mode'} == 1 ? "checked" : "";
-printf "<input type=radio name=uedit_mode value=2 %s> $text{'acl_uedit_only'}\n",
-       $o->{'uedit_mode'} == 2 ? "checked" : "";
-printf "<input name=uedit_can size=40 value='%s'> %s<br>\n",
-       $o->{'uedit_mode'} == 2 ? $o->{'uedit'} : "",
-       &user_chooser_button("uedit_can", 1);
-printf "<input type=radio name=uedit_mode value=3 %s> $text{'acl_uedit_except'}\n",
-       $o->{'uedit_mode'} == 3 ? "checked" : "";
-printf "<input name=uedit_cannot size=40 value='%s'> %s<br>\n",
-       $o->{'uedit_mode'} == 3 ? $o->{'uedit'} : "",
-       &user_chooser_button("uedit_cannot", 1);
-printf "<input type=radio name=uedit_mode value=4 %s> $text{'acl_uedit_uid'}\n",
-       $o->{'uedit_mode'} == 4 ? "checked" : "";
-printf "<input name=uedit_uid size=6 value='%s'> - \n",
-       $o->{'uedit_mode'} == 4 ? $o->{'uedit'} : "";
-printf "<input name=uedit_uid2 size=6 value='%s'><br>\n",
-       $o->{'uedit_mode'} == 4 ? $o->{'uedit2'} : "";
-printf "<input type=radio name=uedit_mode value=5 %s> $text{'acl_uedit_group'}\n",
-       $o->{'uedit_mode'} == 5 ? "checked" : "";
-printf "<input name=uedit_group size=8 value='%s'> %s</td> </tr>\n",
-       $o->{'uedit_mode'} == 5 ? $dummy=getgrgid($o->{'uedit'}) : "",
-       &group_chooser_button("uedit_group", 0);
+print &ui_table_row($text{'acl_uedit'},
+  &ui_radio_table("uedit_mode", int($o->{'uedit_mode'}),
+       [ [ 0, $text{'acl_uedit_all'} ],
+         [ 1, $text{'acl_uedit_none'} ],
+         [ 2, $text{'acl_uedit_only'},
+              &ui_textbox("uedit_can",
+                          $o->{'uedit_mode'} == 2 ? $o->{'uedit'} : "", 40).
+              " ".&user_chooser_button("uedit_can", 1) ],
+         [ 3, $text{'acl_uedit_except'},
+              &ui_textbox("uedit_cannot",
+                          $o->{'uedit_mode'} == 3 ? $o->{'uedit'} : "", 40).
+              " ".&user_chooser_button("uedit_cannot", 1) ],
+         [ 4, $text{'acl_uedit_uid'},
+              &ui_textbox("uedit_uid",
+                          $o->{'uedit_mode'} == 4 ? $o->{'uedit'} : "", 6).
+              " - ".
+              &ui_textbox("uedit_uid2",
+                          $o->{'uedit_mode'} == 4 ? $o->{'uedit2'} : "", 6) ],
+         [ 5, $text{'acl_uedit_group'},
+              &ui_group_textbox("uedit_group",
+               $o->{'uedit_mode'} == 5 ? $dummy=getgrgid($o->{'uedit'}) : "")],
+       ]));
 
 # Groups visible in chooser
-print "<tr> <td valign=top><b>$text{'acl_gedit'}</b></td> <td colspan=3>\n";
-printf "<input type=radio name=gedit_mode value=0 %s> $text{'acl_gedit_all'}\n",
-       $o->{'gedit_mode'} == 0 ? "checked" : "";
-printf "<input type=radio name=gedit_mode value=1 %s> $text{'acl_gedit_none'}<br>\n",
-       $o->{'gedit_mode'} == 1 ? "checked" : "";
-printf "<input type=radio name=gedit_mode value=2 %s> $text{'acl_gedit_only'}\n",
-       $o->{'gedit_mode'} == 2 ? "checked" : "";
-printf "<input name=gedit_can size=40 value='%s'> %s<br>\n",
-       $o->{'gedit_mode'} == 2 ? $o->{'gedit'} : "",
-       &group_chooser_button("gedit_can", 1);
-printf "<input type=radio name=gedit_mode value=3 %s> $text{'acl_gedit_except'}\n",
-       $o->{'gedit_mode'} == 3 ? "checked" : "";
-printf "<input name=gedit_cannot size=40 value='%s'> %s<br>\n",
-       $o->{'gedit_mode'} == 3 ? $o->{'gedit'} : "",
-       &group_chooser_button("gedit_cannot", 1);
-printf "<input type=radio name=gedit_mode value=4 %s> $text{'acl_gedit_gid'}\n",
-       $o->{'gedit_mode'} == 4 ? "checked" : "";
-printf "<input name=gedit_gid size=6 value='%s'> -\n",
-       $o->{'gedit_mode'} == 4 ? $o->{'gedit'} : "";
-printf "<input name=gedit_gid2 size=6 value='%s'></td> </tr>\n",
-       $o->{'gedit_mode'} == 4 ? $o->{'gedit2'} : "";
-
-print "<tr> <td colspan=2><hr></td> </tr>\n";
+print &ui_table_row($text{'acl_gedit'},
+    &ui_radio_table("gedit_mode", int($o->{'gedit_mode'}),
+       [ [ 0, $text{'acl_gedit_all'} ],
+         [ 1, $text{'acl_gedit_none'} ],
+         [ 2, $text{'acl_gedit_only'},
+              &ui_textbox("gedit_can",
+                          $o->{'gedit_mode'} == 2 ? $o->{'gedit'} : "", 40).
+              " ".&group_chooser_button("gedit_can", 1) ],
+         [ 3, $text{'acl_gedit_except'},
+              &ui_textbox("gedit_cannot",
+                          $o->{'gedit_mode'} == 3 ? $o->{'gedit'} : "", 40).
+              " ".&group_chooser_button("gedit_cannot", 1) ],
+         [ 4, $text{'acl_gedit_gid'},
+              &ui_textbox("gedit_gid",
+                          $o->{'gedit_mode'} == 4 ? $o->{'gedit'} : "", 6).
+              " - ".
+              &ui_textbox("gedit_gid2",
+                          $o->{'gedit_mode'} == 4 ? $o->{'gedit2'} : "", 6) ],
+       ]));
+
+print &ui_table_hr();
 
 # Can submit feedback?
-print "<tr> <td><b>$text{'acl_feedback'}</b></td> <td>\n";
-printf "<input type=radio name=feedback value=2 %s> %s\n",
-       $o->{'feedback'} == 2 ? "checked" : "", $text{'acl_feedback2'};
-printf "<input type=radio name=feedback value=3 %s> %s\n",
-       $o->{'feedback'} == 3 ? "checked" : "", $text{'acl_feedback3'};
-printf "<input type=radio name=feedback value=1 %s> %s\n",
-       $o->{'feedback'} == 1 ? "checked" : "", $text{'acl_feedback1'};
-printf "<input type=radio name=feedback value=0 %s> %s</td> </tr>\n",
-       $o->{'feedback'} == 0 ? "checked" : "", $text{'acl_feedback0'};
+print &ui_table_row($text{'acl_feedback'},
+       &ui_radio("feedback", int($o->{'feedback'}),
+                 [ map { [ $_, $text{'acl_feedback'.$_} ] } (2,3,1,0) ]));
 
 # Can accept RPC calls?
-print "<tr> <td colspan=2><hr></td> </tr>\n";
-print "<tr> <td><b>$text{'acl_rpc'}</b></td> <td>\n";
-printf "<input type=radio name=rpc value=1 %s> %s\n",
-       $o->{'rpc'} == 1 ? "checked" : "", $text{'acl_rpc1'};
-if ($o->{'rpc'} == 2) {
-       printf "<input type=radio name=rpc value=2 %s> %s\n",
-               $o->{'rpc'} == 2 ? "checked" : "", $text{'acl_rpc2'};
-       }
-printf "<input type=radio name=rpc value=0 %s> %s</td> </tr>\n",
-       $o->{'rpc'} == 0 ? "checked" : "", $text{'acl_rpc0'};
+print &ui_table_row($text{'acl_rpc'},
+       &ui_radio("rpc", int($o->{'rpc'}),
+                 [ [ 1, $text{'acl_rpc1'} ],
+                   $o->{'rpc'} == 2 ? ( [ 2, $text{'acl_rpc2'} ] ) : ( ),
+                   [ 0, $text{'acl_rpc0'} ] ]));
+
+# Get new permissions?
+print &ui_table_row($text{'acl_negative'},
+       &ui_radio("negative", int($o->{'negative'}),
+                 [ [ 0, $text{'yes'} ], [ 1, $text{'no'} ] ]));
 
 # Readonly mode
-print "<tr> <td><b>$text{'acl_readonly'}</b></td>\n";
-print "<td>",&ui_yesno_radio("readonly", $o->{'readonly'}),"</td> </tr>\n";
+print &ui_table_row($text{'acl_readonly2'},
+       &ui_radio("readonly", int($o->{'readonly'}),
+                 [ [ 1, $text{'acl_readonlyyes'} ],
+                   [ 0, $text{'no'} ] ]));
 }
 
 # acl_security_save(&options)
@@ -137,6 +124,7 @@ $_[0]->{'gedit'} = $in{'gedit_mode'} == 2 ? $in{'gedit_can'} :
 $_[0]->{'gedit2'} = $in{'gedit_mode'} == 4 ? $in{'gedit_gid2'} : undef;
 $_[0]->{'feedback'} = $in{'feedback'};
 $_[0]->{'rpc'} = $in{'rpc'};
+$_[0]->{'negative'} = $in{'negative'};
 $_[0]->{'readonly'} = $in{'readonly'};
 $_[0]->{'fileunix'} = $in{'fileunix_def'} ? undef : $in{'fileunix'};
 }

diff --git a/sendmail/negativeacl b/sendmail/negativeacl
new file mode 100644 (file)
index 0000000..41174ca
--- /dev/null
+++ b/sendmail/negativeacl
@@ -0,0 +1 @@
+ports=0

diff --git a/web-lib-funcs.pl b/web-lib-funcs.pl
index 8db450b..caea89b 100755 (executable)
--- a/web-lib-funcs.pl
+++ b/web-lib-funcs.pl
@@ -2463,7 +2463,16 @@ local $u = defined($_[0]) ? $_[0] : $base_remote_user;
 local $m = defined($_[1]) ? $_[1] : $module_name;
 local $mdir = &module_root_directory($m);
 if (!$_[3]) {
+       # Read default ACL first, to be overridden by per-user settings
        &read_file_cached("$mdir/defaultacl", \%rv);
+
+       # If this isn't a master admin user, apply the negative permissions
+       # so that he doesn't un-expectedly gain access to new features
+       local %gacccess;
+       &read_file_cached("$config_directory/$u.acl", \%gaccess);
+       if ($gaccess{'negative'}) {
+               &read_file_cached("$mdir/negativeacl", \%rv);
+               }
        }
 local %usersacl;
 if (!$_[2] && &supports_rbac($m) && &use_rbac_module_acl($u, $m)) {