Index: openacs-4/packages/acs-subsite/www/permissions/index-oracle.xql =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-subsite/www/permissions/index-oracle.xql,v diff -u -r1.2 -r1.2.4.1 --- openacs-4/packages/acs-subsite/www/permissions/index-oracle.xql 28 Nov 2001 18:39:39 -0000 1.2 +++ openacs-4/packages/acs-subsite/www/permissions/index-oracle.xql 7 Dec 2002 16:06:29 -0000 1.2.4.1 @@ -5,15 +5,17 @@ - - select distinct o.object_id, acs_object.name(o.object_id) as name + select distinct o.object_id, acs_object.name(o.object_id) as name, context_id, object_type, + (case when o.object_id = :root then 0 else 1 end) as child from acs_objects o, all_object_party_privilege_map map where map.object_id = o.object_id and map.party_id = :user_id and map.privilege = 'admin' - + and (o.object_id = :root or o.context_id = :root) + order by child, object_type, name + Index: openacs-4/packages/acs-subsite/www/permissions/index-postgresql.xql =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-subsite/www/permissions/index-postgresql.xql,v diff -u -r1.4 -r1.4.4.1 --- openacs-4/packages/acs-subsite/www/permissions/index-postgresql.xql 13 Dec 2001 02:00:01 -0000 1.4 +++ openacs-4/packages/acs-subsite/www/permissions/index-postgresql.xql 7 Dec 2002 16:06:29 -0000 1.4.4.1 @@ -5,13 +5,14 @@ - - select distinct o.object_id, acs_object__name(o.object_id) as name - from acs_objects o, all_object_party_privilege_map map + select distinct o.object_id, acs_object__name(o.object_id) as name, context_id, object_type, + (case when o.object_id = :root then 0 else 1 end) as child + from acs_objects o, acs_permissions_all map where map.object_id = o.object_id - and map.party_id = :user_id + and map.grantee_id = :user_id and map.privilege = 'admin' - + and (o.object_id = :root or o.context_id = :root) + order by child, object_type, name Fisheye: Tag 1.1 refers to a dead (removed) revision in file `openacs-4/packages/acs-subsite/www/permissions/index.adp'. Fisheye: No comparison available. Pass `N' to diff? Index: openacs-4/packages/acs-subsite/www/permissions/index.tcl =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-subsite/www/permissions/index.tcl,v diff -u -r1.1.1.1 -r1.1.1.1.4.1 --- openacs-4/packages/acs-subsite/www/permissions/index.tcl 13 Mar 2001 22:59:26 -0000 1.1.1.1 +++ openacs-4/packages/acs-subsite/www/permissions/index.tcl 7 Dec 2002 16:06:29 -0000 1.1.1.1.4.1 @@ -1,46 +1,28 @@ # packages/acs-core-ui/www/permissions/index.tcl - ad_page_contract { - Display all objects that the user has admin on. - - @author rhs@mit.edu - @creation-date 2000-08-29 - @cvs-id $Id$ + Display all objects that the user has admin on. + + Templated and changed to browse heirarchy by davis@xarg.net + since all objects can be a *lot* of objects. + + @author rhs@mit.edu + @creation-date 2000-08-29 + @cvs-id $Id$ +} { + root:trim,integer,optional } set user_id [ad_maybe_redirect_for_registration] -doc_body_append "[ad_header "Permissions"] - -

Permissions

- -[ad_context_bar "Permissions"] -
- -
-Select an Object by Id: - -

- -You have admin on the following objects: - -

+db_multirow objects adminable_objects { *SQL* } -[ad_footer] -" +set context "Permissions" + +set security_context_root [acs_magic_object security_context_root] +set default_context [acs_magic_object default_context] +set admin_p [permission::permission_p -object_id $security_context_root -party_id $user_id -privilege admin] +set subsite [ad_conn package_id] Index: openacs-4/packages/acs-subsite/www/permissions/one-oracle.xql =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-subsite/www/permissions/one-oracle.xql,v diff -u -r1.3 -r1.3.4.1 --- openacs-4/packages/acs-subsite/www/permissions/one-oracle.xql 7 Dec 2001 22:45:41 -0000 1.3 +++ openacs-4/packages/acs-subsite/www/permissions/one-oracle.xql 7 Dec 2002 16:06:29 -0000 1.3.4.1 @@ -45,9 +45,9 @@ - select acs_object.name(context_id) - from acs_objects - where object_id = :object_id +SELECT acs_object.name(context_id) as context_name, context_id, security_inherit_p + FROM acs_objects + WHERE object_id = :object_id @@ -56,7 +56,7 @@ - select object_id as c_object_id,acs_object.name(object_id) as c_name + select object_id as c_object_id,acs_object.name(object_id) as c_name, object_type as c_type from acs_objects o where context_id = :object_id and exists (select 1 Index: openacs-4/packages/acs-subsite/www/permissions/one-postgresql.xql =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-subsite/www/permissions/one-postgresql.xql,v diff -u -r1.4 -r1.4.4.1 --- openacs-4/packages/acs-subsite/www/permissions/one-postgresql.xql 7 Dec 2001 22:46:40 -0000 1.4 +++ openacs-4/packages/acs-subsite/www/permissions/one-postgresql.xql 7 Dec 2002 16:06:29 -0000 1.4.4.1 @@ -44,27 +44,26 @@ - - select acs_object__name(context_id) - from acs_objects - where object_id = :object_id +SELECT acs_object__name(context_id) as context_name, context_id, security_inherit_p + FROM acs_objects + WHERE object_id = :object_id + - select object_id as c_object_id,acs_object__name(object_id) as c_name + select object_id as c_object_id,acs_object__name(object_id) as c_name, object_type as c_type from acs_objects o where context_id = :object_id and exists (select 1 - from all_object_party_privilege_map + from acs_object_party_privilege_map where object_id = o.object_id and party_id = :user_id and privilege = 'admin') - Fisheye: Tag 1.1 refers to a dead (removed) revision in file `openacs-4/packages/acs-subsite/www/permissions/one.adp'. Fisheye: No comparison available. Pass `N' to diff? Index: openacs-4/packages/acs-subsite/www/permissions/one.tcl =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-subsite/www/permissions/one.tcl,v diff -u -r1.2 -r1.2.2.1 --- openacs-4/packages/acs-subsite/www/permissions/one.tcl 6 Sep 2002 21:50:06 -0000 1.2 +++ openacs-4/packages/acs-subsite/www/permissions/one.tcl 7 Dec 2002 16:06:29 -0000 1.2.2.1 @@ -1,158 +1,51 @@ # packages/acs-core-ui/www/acs_object/permissions/index.tcl - ad_page_contract { + Display permissions and children for the given object_id - @author rhs@mit.edu - @creation-date 2000-08-20 - @cvs-id $Id$ + Templated + cross site scripting holes patched by davis@xarg.net + + @author rhs@mit.edu + @creation-date 2000-08-20 + @cvs-id $Id$ } { object_id:integer,notnull {children_p "f"} } +set user_id [ad_maybe_redirect_for_registration] ad_require_permission $object_id admin -set user_id [ad_maybe_redirect_for_registration] +set name [ad_quotehtml [db_string name {select acs_object.name(:object_id) from dual}]] -set name [db_string name {select acs_object.name(:object_id) from dual}] +set context [list [list "./" "Permissions"] "Permissions for $name"] -doc_body_append "[ad_header "Permissions for $name"] - -

Permissions for $name

- -[ad_context_bar [list "./" "Permissions"] "Permissions for $name"] -
- -

Inherited Permissions

- - - -
- -[export_form_vars object_id] - -

Direct Permissions

- -
    -" - -db_foreach acl { - select grantee_id, acs_object.name(grantee_id) as grantee_name, - privilege - from acs_permissions - where object_id = :object_id -} { - doc_body_append "
  • $grantee_name, $privilege ()
    • \n" -} if_no_rows { - doc_body_append "
  • (none)
    • \n" +db_multirow acl acl { *SQL* } { + set grantee_name [ad_quotehtml $grantee_name] } set controls [list] lappend controls "Grant Permission" -set context [db_string context { - select acs_object.name(context_id) - from acs_objects - where object_id = :object_id -}] +db_1row context { *SQL* } -if {![empty_string_p $context]} { - db_1row security_inherit_p { - select security_inherit_p - from acs_objects - where object_id = :object_id - } - - - if {$security_inherit_p == "t"} { - lappend controls "Don't Inherit Permissions from $context" - } else { - lappend controls "Inherit Permissions from $context" - } +if { $security_inherit_p == "t" && ![empty_string_p $context_id] } { + lappend controls "Don't Inherit Permissions from $context_name" +} else { + lappend controls "Inherit Permissions from $context_name" } -doc_body_append " -
+set controls "\[ [join $controls " | "] \]" -
-\[ [join $controls " | "] \] - -
- - - -
" - -doc_body_append "

Children

-
" - if [string equal $children_p "t"] { - - doc_body_append "
    " - - db_foreach children { - select object_id as c_object_id,acs_object.name(object_id) as c_name - from acs_objects o - where context_id = :object_id - and exists (select 1 - from acs_object_party_privilege_map - where object_id = o.object_id - and party_id = :user_id - and privilege = 'admin') - } { - doc_body_append "
  • $c_name
    • \n" - } if_no_rows { - doc_body_append " (none)\n" + db_multirow children children { *SQL* } { + set c_name [ad_quotehtml $c_name] } - - doc_body_append "
" - } else { - db_1row children_count { - select count(*) as num_children - from acs_objects o - where context_id = :object_id - and exists (select 1 - from acs_object_party_privilege_map - where object_id = o.object_id - and party_id = :user_id - and privilege = 'admin') - } - - set children_p "t" - doc_body_append "$num_children Children Hidden " - if {$num_children > 0} { - doc_body_append "\[Show\] " - } + db_1row children_count { *SQL* } } - - -doc_body_append "
- - -[ad_footer]"