Cache manager passwords page

diff --git a/squid/CHANGELOG b/squid/CHANGELOG
index 66a8157..1b87ec8 100644 (file)
--- a/squid/CHANGELOG
+++ b/squid/CHANGELOG
@@ -26,3 +26,4 @@ Directives that refer to ACLs like http_access are no longer re-positioned in th
 ---- Changes since 1.400 ----
 Use the cache directive instead of no_cache for Squid 2.6.
 Allow request and reply headers access control rules to be configured separately in Squid 3.0.
+Added a page for editing cache manager passwords and the actions that they apply to.

diff --git a/squid/acl_security.pl b/squid/acl_security.pl
index 58721c8..fa4a5d2 100755 (executable)
--- a/squid/acl_security.pl
+++ b/squid/acl_security.pl
@@ -2,7 +2,7 @@
 require 'squid-lib.pl';
 @accopts = ('portsnets', 'othercaches', 'musage', 'logging', 'copts',
            'hprogs', 'actrl', 'admopts', 'proxyauth', 'miscopt', 'cms',
-           'rebuild', 'calamaris', 'delay', 'headeracc', 'refresh',
+           'rebuild', 'calamaris', 'delay', 'headeracc', 'refresh', 'cachemgr',
            'authparam', 'iptables');
 
 # acl_security_form(&options)

diff --git a/squid/defaultacl b/squid/defaultacl
index 4bebf63..53682e1 100644 (file)
--- a/squid/defaultacl
+++ b/squid/defaultacl
@@ -19,3 +19,4 @@ authparam=1
 headeracc=1
 refresh=1
 iptables=1
+cachemgr=1

diff --git a/squid/edit_cachemgr.cgi b/squid/edit_cachemgr.cgi
new file mode 100644 (file)
index 0000000..25c67ef
--- /dev/null
+++ b/squid/edit_cachemgr.cgi
@@ -0,0 +1,48 @@
+#!/usr/local/bin/perl
+# Show a list of per-function cache manager passwords
+
+require './squid-lib.pl';
+$access{'cachemgr'} || &error($text{'cachemgr_ecannot'});
+&ui_print_header(undef, $text{'cachemgr_title'}, "", "edit_cachemgr", 0, 0, 0,
+                &restart_button());
+
+# Find password directives
+$conf = &get_config();
+@cachemgr = &find_config("cachemgr_passwd", $conf);
+
+# Show them in a table
+print &ui_form_start("save_cachemgr.cgi", "post");
+print &ui_radio("cachemgr_def", @cachemgr ? 0 : 1,
+    [ [ 1, $text{'cachemgr_def1'} ], [ 0, $text{'cachemgr_def0'} ] ]),"<br>\n";
+print &ui_columns_start([ $text{'cachemgr_pass'},
+                         $text{'cachemsg_actions'} ], 100, 0);
+$i = 0;
+foreach $c (@cachemgr, { 'values' => [ 'none' ] }) {
+       @grid = ( );
+       ($p, @acts) = @{$c->{'values'}};
+       %acts = map { $_, 1 } @acts;
+       foreach my $a (&list_cachemgr_actions()) {
+               push(@grid, &ui_checkbox("action_$i", $a, $a, $acts{$a}));
+               delete($acts{$a});
+               }
+       @others = grep { $_ ne 'all' } keys %acts;
+       $pmode = $p eq "none" ? "none" : $p eq "disable" ? "disable" : undef;
+       print &ui_columns_row([
+               &ui_radio("pass_def_$i", $pmode,
+                         [ [ "none", $text{'cachemgr_none'}."<br>" ],
+                           [ "disable", $text{'cachemgr_disable'}."<br>" ],
+                           [ "", $text{'cachemgr_set'} ] ])." ".
+               &ui_textbox("pass_$i", $pmode ? "" : $p, 15),
+               &ui_checkbox("all_$i", 1, $text{'cachemgr_all'}, $acts{'all'}).
+               "<br>\n".
+               &ui_grid_table(\@grid, 6, 100).
+               (@others ? "<br>\n".$text{'cachemgr_others'}." ".
+                          &ui_textbox("others_$i", join(" ", @others), 40)
+                        : "")
+                ], [ "valign=top", "valign=top" ]);
+       $i++;
+       }
+print &ui_columns_end();
+print &ui_form_end([ [ undef, $text{'save'} ] ]);
+
+&ui_print_footer("", $text{'index_return'});

diff --git a/squid/help/edit_cachemgr.html b/squid/help/edit_cachemgr.html
new file mode 100644 (file)
index 0000000..e7a36ab
--- /dev/null
+++ b/squid/help/edit_cachemgr.html
@@ -0,0 +1,10 @@
+<header>Cache Manager Passwords</header>
+
+By default, Squid's cache manager web interface does not require authentication
+to access any of it's functions. This page allows you to defined one or more
+passwords that apply to some or all actions in the cache manager. <p>
+
+To specify a single password for all actions, just select <b>Passwords and actions specified below</b>, then in the <b>Password</b> column select<b>Set to</b> and enter your password in the adjacent box. Then check the <b>Use this password for all actions</b> box, and click <b>Save</b>. <p>
+
+<footer>
+

diff --git a/squid/images/edit_cachemgr.gif b/squid/images/edit_cachemgr.gif
new file mode 100644 (file)
index 0000000..e7a7a57
Binary files /dev/null and b/squid/images/edit_cachemgr.gif differ

diff --git a/squid/index.cgi b/squid/index.cgi
index 943b59a..a6fc35c 100755 (executable)
--- a/squid/index.cgi
+++ b/squid/index.cgi
@@ -116,7 +116,7 @@ $iptables = &foreign_check("firewall");
             'refresh',
             'miscopt',
             ( $iptables ? ( 'iptables' ) : ( ) ),
-            'cms', 'rebuild',
+            'cms', 'cachemgr', 'rebuild',
             ( $calamaris ? ( 'calamaris' ) : ( ) ) );
 @olinks =  ( "edit_ports.cgi", "edit_icp.cgi", "edit_mem.cgi",
             "edit_logs.cgi", "edit_cache.cgi", "edit_progs.cgi",
@@ -129,7 +129,7 @@ $iptables = &foreign_check("firewall");
             "list_refresh.cgi",
             "edit_misc.cgi",
             ( $iptables ? ( "edit_iptables.cgi" ) : ( ) ),
-            "cachemgr.cgi", "clear.cgi",
+            "cachemgr.cgi", "edit_cachemgr.cgi", "clear.cgi",
             ( $calamaris ? ( "calamaris.cgi" ) : ( ) ) );
 for($i=0; $i<@otitles; $i++) {
        if (!$access{$otitles[$i]}) {

diff --git a/squid/lang/en b/squid/lang/en
index 6ff2223..8642f95 100644 (file)
--- a/squid/lang/en
+++ b/squid/lang/en
@@ -25,6 +25,7 @@ index_delay=Delay Pools
 index_authparam=Authentication Programs
 index_headeracc=Header Access Control
 index_refresh=Refresh Rules
+index_cachemgr=Cache Manager Passwords
 index_return=index
 index_squidver=The command <tt>$1</tt> returned :
 index_version=Squid version $1
@@ -765,6 +766,7 @@ log_refresh_move=Moved refresh rule for $1
 log_refreshes_delete=Deleted $1 refresh rules
 log_iptables=Updated port redirection setup
 log_purge=Removed URL $1 from cache
+log_cachemgr=Changed cache manager passwords
 
 acl_root=Root directory for ACL files
 acl_sections=Allowed configuration pages
@@ -954,3 +956,17 @@ dhttp_enone=None selected
 
 dicp_err=Failed to delete ICP restrictions
 dicp_enone=None selected
+
+cachemgr_title=Cache Manager Passwords
+cachemgr_ecannot=You are not allowed to edit cache manager passwords
+cachemgr_def1=No passwords required
+cachemgr_def0=Passwords and actions specified below ..
+cachemgr_pass=Password
+cachemgr_none=None needed
+cachemgr_set=Set to
+cachemgr_disable=Actions disabled
+cachemsg_actions=Apply to actions
+cachemgr_all=Use this password for all actions
+cachemgr_others=Other actions:
+cachemgr_enone=None entered - you should select <i>No passwords required</i> instead
+cachemgr_err=Failed to save cache manager passwords

diff --git a/squid/save_cachemgr.cgi b/squid/save_cachemgr.cgi
new file mode 100644 (file)
index 0000000..124e7b4
--- /dev/null
+++ b/squid/save_cachemgr.cgi
@@ -0,0 +1,44 @@
+#!/usr/local/bin/perl
+# Save the list of per-function cache manager passwords
+
+require './squid-lib.pl';
+&error_setup($text{'cachemgr_err'});
+$access{'cachemgr'} || &error($text{'cachemgr_ecannot'});
+&ReadParse();
+
+# Validate and store inputs
+&lock_file($config{'squid_conf'});
+$conf = &get_config();
+
+if ($in{'cachemgr_def'}) {
+       # Clear them all
+       &save_directive($conf, "cachemgr_passwd", [ ]);
+       }
+else {
+       # Build up list and save
+       for($i=0; defined($pmode = $in{"pass_def_$i"}); $i++) {
+               $pass = $pmode || $in{"pass_$i"};
+               if ($in{"all_$i"}) {
+                       @actions = ( "all" );
+                       }
+               else {
+                       @actions = ( split(/\0/, $in{"action_$i"}),
+                                    split(/\s+/, $in{"others_$i"}) );
+                       }
+               if ($pass && @actions) {
+                       push(@rv, { 'name' => 'cachemgr_passwd',
+                                   'values' => [ $pass, @actions ] });
+                       }
+               }
+
+       @rv || &error($text{'cachemgr_enone'});
+       &save_directive($conf, "cachemgr_passwd", \@rv);
+       }
+
+# All done
+&flush_file_lines();
+&unlock_file($config{'squid_conf'});
+&webmin_log("cachemgr");
+&redirect("");
+
+

diff --git a/squid/squid-lib.pl b/squid/squid-lib.pl
index 086473e..d923996 100644 (file)
--- a/squid/squid-lib.pl
+++ b/squid/squid-lib.pl
@@ -551,5 +551,12 @@ else {
 return undef;
 }
 
+# list_cachemgr_actions()
+# Returns a list of actions for use in the cachemgr_passwd directive
+sub list_cachemgr_actions
+{
+return ("5min" ,"60min" ,"asndb" ,"authenticator" ,"cbdata" ,"client_list" ,"comm_incoming" ,"config" ,"counters" ,"delay" ,"digest_stats" ,"dns" ,"events" ,"filedescriptors" ,"fqdncache" ,"histograms" ,"http_headers" ,"info" ,"io" ,"ipcache" ,"mem" ,"menu" ,"netdb" ,"non_peers" ,"objects" ,"offline_toggle" ,"pconn" ,"peer_select" ,"redirector" ,"refresh" ,"server_list" ,"shutdown" ,"store_digest" ,"storedir" ,"utilization" ,"via_headers" ,"vm_objects");
+}
+
 1;