Index: openacs-4/packages/acs-subsite/catalog/acs-subsite.en_US.ISO-8859-1.xml =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-subsite/catalog/acs-subsite.en_US.ISO-8859-1.xml,v diff -u -r1.4 -r1.5 --- openacs-4/packages/acs-subsite/catalog/acs-subsite.en_US.ISO-8859-1.xml 19 Dec 2002 16:20:21 -0000 1.4 +++ openacs-4/packages/acs-subsite/catalog/acs-subsite.en_US.ISO-8859-1.xml 20 Jan 2003 22:35:20 -0000 1.5 @@ -1,5 +1,5 @@ - + About You @@ -216,6 +216,7 @@ restore your account to live status Unauthorized Access Unsubscribe + up to %context_name% Update update Update Password Index: openacs-4/packages/acs-subsite/www/permissions/one.adp =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-subsite/www/permissions/one.adp,v diff -u -r1.2 -r1.3 --- openacs-4/packages/acs-subsite/www/permissions/one.adp 16 Jan 2003 13:40:37 -0000 1.2 +++ openacs-4/packages/acs-subsite/www/permissions/one.adp 20 Jan 2003 22:35:34 -0000 1.3 @@ -1,8 +1,8 @@ - Permissions for @name@ + #acs-subsite.Permissions_for_name# @context@ -

Inherited Permissions

+

#acs-subsite.lt_Inherited_Permissions#

    @@ -11,9 +11,9 @@
-

No inherited permissions

+

#acs-subsite.none#

 -

Direct Permissions

+

#acs-subsite.Direct_Permissions#

@@ -24,15 +24,15 @@ -

None

+

#acs-subsite.none#

 - +
@controls@ -

Children

+

#acs-subsite.Children#

    @@ -42,13 +42,13 @@
-

No children

+

#acs-subsite.none#

 - @num_children@ Children Hidden [Show] + #acs-subsite.lt_num_children_Children# [#acs-subsite.Show#] - No children + #acs-subsite.none# -

[up to @context_name@]

 \ No newline at end of file +

[#acs-subsite.up_to_context_name#]

 Index: openacs-4/packages/acs-subsite/www/permissions/one.tcl =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-subsite/www/permissions/one.tcl,v diff -u -r1.3 -r1.4 --- openacs-4/packages/acs-subsite/www/permissions/one.tcl 7 Nov 2002 18:06:55 -0000 1.3 +++ openacs-4/packages/acs-subsite/www/permissions/one.tcl 20 Jan 2003 22:35:34 -0000 1.4 @@ -1,158 +1,50 @@ # packages/acs-core-ui/www/acs_object/permissions/index.tcl - ad_page_contract { + Display permissions and children for the given object_id - @author rhs@mit.edu - @creation-date 2000-08-20 - @cvs-id $Id$ + Templated + cross site scripting holes patched by davis@xarg.net + + @author rhs@mit.edu + @creation-date 2000-08-20 + @cvs-id $Id$ } { object_id:integer,notnull {children_p "f"} } +set user_id [ad_maybe_redirect_for_registration] ad_require_permission $object_id admin -set user_id [ad_maybe_redirect_for_registration] +set name [ad_quotehtml [db_string name {select acs_object.name(:object_id) from dual}]] -set name [db_string name {select acs_object.name(:object_id) from dual}] +set context [list [list "./" [_ acs-subsite.Permissions]] [_ acs-subsite.Permissions_for_name]] -doc_body_append "[ad_header [_ acs-subsite.Permissions_for_name]] - -

[_ acs-subsite.Permissions_for_name]

- -[ad_context_bar [list "./" [_ acs-subsite.Permissions]] [_ acs-subsite.Permissions_for_name]] -
- -

[_ acs-subsite.lt_Inherited_Permissions]

- -
    -" - -db_foreach inherited_permissions { - select grantee_id, grantee_name, privilege - from (select grantee_id, acs_object.name(grantee_id) as grantee_name, - privilege, 1 as counter - from acs_permissions_all - where object_id = :object_id - union all - select grantee_id, acs_object.name(grantee_id) as grantee_name, - privilege, -1 as counter - from acs_permissions - where object_id = :object_id) - group by grantee_id, grantee_name, privilege - having sum(counter) > 0 -} { - doc_body_append "
  • $grantee_name, $privilege
    • \n" -} if_no_rows { - doc_body_append "
  • ([_ acs-subsite.none])
    • \n" +db_multirow inherited inherited_permissions { *SQL* } { + set grantee_name [ad_quotehtml $grantee_name] } -doc_body_append " -
- -
- -[export_form_vars object_id] - -

[_ acs-subsite.Direct_Permissions]

- -
    -" - -db_foreach acl { - select grantee_id, acs_object.name(grantee_id) as grantee_name, - privilege - from acs_permissions - where object_id = :object_id -} { - doc_body_append "
  • $grantee_name, $privilege ()
    • \n" -} if_no_rows { - doc_body_append "
  • ([_ acs-subsite.none])
    • \n" +db_multirow acl acl { *SQL* } { + set grantee_name [ad_quotehtml $grantee_name] } set controls [list] lappend controls "[_ acs-subsite.Grant_Permission]" -set context [db_string context { - select acs_object.name(context_id) - from acs_objects - where object_id = :object_id -}] +db_1row context { *SQL* } -if {![empty_string_p $context]} { - db_1row security_inherit_p { - select security_inherit_p - from acs_objects - where object_id = :object_id - } - - - if {$security_inherit_p == "t"} { - lappend controls "[_ acs-subsite.lt_Dont_Inherit_Permissi]" - } else { - lappend controls "[_ acs-subsite.lt_Inherit_Permissions_f]" - } +if { $security_inherit_p == "t" && ![empty_string_p $context_id] } { + lappend controls "Don't Inherit Permissions from $context_name" +} else { + lappend controls "Inherit Permissions from $context_name" } -doc_body_append " -
+set controls "\[ [join $controls " | "] \]" -
- -\[ [join $controls " | "] \] - -
- - - -
" - -doc_body_append "

[_ acs-subsite.Children]

-
" - if [string equal $children_p "t"] { - - doc_body_append "
    " - - db_foreach children { - select object_id as c_object_id,acs_object.name(object_id) as c_name - from acs_objects o - where context_id = :object_id - and exists (select 1 - from acs_object_party_privilege_map - where object_id = o.object_id - and party_id = :user_id - and privilege = 'admin') - } { - doc_body_append "
  • $c_name
    • \n" - } if_no_rows { - doc_body_append " ([_ acs-subsite.none])\n" + db_multirow children children { *SQL* } { + set c_name [ad_quotehtml $c_name] } - - doc_body_append "
" - } else { - db_1row children_count { - select count(*) as num_children - from acs_objects o - where context_id = :object_id - and exists (select 1 - from acs_object_party_privilege_map - where object_id = o.object_id - and party_id = :user_id - and privilege = 'admin') - } - - set children_p "t" - doc_body_append "[_ acs-subsite.lt_num_children_Children] " - if {$num_children > 0} { - doc_body_append "\[[_ acs-subsite.Show]\] " - } + db_1row children_count { *SQL* } } - - -doc_body_append "
- - -[ad_footer]"