Changeset 294

Timestamp:

02/09/10 12:08:42 (11 years ago)

Author:

sander

Message:

Fix access control errors with results that are part of public galleries

Location:

trunk/server/www/app

Files:

• controllers/galleries_controller.php (modified) (3 diffs)
• controllers/requests_controller.php (modified) (1 diff)
• controllers/results_controller.php (modified) (3 diffs)
• models/gallery.php (modified) (1 diff)
• models/request.php (modified) (2 diffs)
• models/result.php (modified) (2 diffs)
• models/testsuite.php (modified) (5 diffs)
• views/helpers/request_model.php (modified) (1 diff)

trunk/server/www/app/controllers/galleries_controller.php

@@ -140 +140 @@
                         'contain' => array(
                                 'Request',
-                                'Request.Validator',
+                                'Request.Validator' => array('order' => 'Validator.name ASC'),
                                 'Request.Job',
                                 'Request.Job.Application',
@@ -164 +164 @@
                                 $request['Validator'] = $this->Request->Validator->find('all', array(
                                         'conditions' => array('Validator.parent_id' => $request['id']),
+                                        'order'      => 'Validator.name ASC',
                                         'recursive'  => -1,
                                 ));
@@ -176 +177 @@
                                         ),
                                 ));
+
+                                // Fix array layout to match a regular query layout
+                                foreach ($request['Job'] as &$job) {
+                                        foreach ($job['Job'] as $attr => $value) {
+                                                $job[$attr] = $value;
+                                        }
+                                        unset($job['Job']);
+                                }
                         }
                 }

trunk/server/www/app/controllers/requests_controller.php

@@ -81 +81 @@
                         'Job.Result.Mimetype',
                         'Job.Result.Format',
-                        'Job.Result.Validator',
+                        'Job.Result.Validator' => array('order' => 'Validator.name ASC'),
                         'Gallery',
-                        'Validator',
+                        'Validator' => array('order' => 'Validator.name ASC'),
                 ));
 
                 $request = $this->Request->read(null, $id);
-                if (empty($request)) {
+                if (empty($request) || !$this->Request->checkAccess($this->AuthCert->user('id'), $type, $id)) {
                         $this->Session->setFlash(__('Invalid Request.', true));
                         $this->redirect(array('action'=>'add'));
                 }
 
-                if ($request['Request']['user_id'] == $this->AuthCert->user('id')) {
-                        return $request;
-                }
-
-                if ($type == 'read' && !empty($request['Gallery'])) {
-                        return $request;
-                }
-
-                $this->Session->setFlash(__('Invalid Request.', true));
-                $this->redirect(array('action'=>'add'));
+                return $request;
         }
 

trunk/server/www/app/controllers/results_controller.php

@@ -30 +30 @@
         public $components = array('AuthCert');
 
+        /** @var array Add Result and GalleriesRequest model */
+        public $uses = array('Result', 'GalleriesRequest');
+
         /**
          * Set the auth permissions for this controller
@@ -37 +40 @@
         {
                 parent::beforeFilter();
-                if (Configure::read('Auth.allowAnonymous')) {
-                        $this->AuthCert->allow('view', 'download');
-                }
+                $this->AuthCert->allow('view', 'download');
         }
 
@@ -58 +59 @@
                 
                 $result = $this->Result->read(null, $id);
-                if ($result['Job']['Request']['user_id'] != $this->AuthCert->user('id')) {
+                if (empty($result) || !$this->Result->checkAccess($this->AuthCert->user('id'), 'read', $id)) {
                         $this->Session->setFlash(__('Invalid Result.', true));
                         $this->redirect(array('controller' => 'requests', 'action'=>'add'));

trunk/server/www/app/models/gallery.php

@@ -41 +41 @@
                 'Tree',
         );
+
+        /**
+         * Check access control for this gallery
+         * @param string $user_id The user ID
+         * @param string $id The gallery ID
+         * @return boolean True or False
+         */
+        public function checkAccess($user_id, $id = false)
+        {
+                if ($id) {
+                        $id = $this->id;
+                }
+
+                if (!$id) {
+                        return false;
+                }
+
+                $gallery = $this->find('first', array(
+                        'conditions' => array('Gallery.id' => $id),
+                        'recursive' => -1,
+                ));
+
+                if (!$gallery) {
+                        return false;
+                }
+
+                if ($gallery['Gallery']['user_id'] == $user_id) {
+                        return true;
+                }
+
+                if ($this->User->Group->has_member($user_id, $gallery['Gallery']['group_id'])) {
+                        return true;
+                }
+
+                return false;
+        }
 
         /**

trunk/server/www/app/models/request.php

@@ -75 +75 @@
 
         /**
+         * Check access control for this request
+         * @param string $user_id The user ID
+         * @param string $type "read" or "write"
+         * @param string $id The request ID
+         * @return boolean True or False
+         */
+        public function checkAccess($user_id, $type = 'read', $id = false)
+        {
+                if (!$id) {
+                        $id = $this->id;
+                }
+
+                if (!$id) {
+                        return false;
+                }
+
+                $request = $this->find('first', array(
+                        'contain' => array('Gallery'),
+                        'conditions' => array('Request.id' => $id),
+                ));
+
+                if ($request['Request']['user_id'] == $user_id) {
+                        return true;
+                }
+
+                if (isset($request['Gallery']) && !empty($request['Gallery'])) {
+                        foreach ($request['Gallery'] as $gallery) {
+                                if ($this->Gallery->checkAccess($user_id, $gallery['id'])) {
+                                        return true;
+                                }
+                        }
+
+                        if ($type == 'read') {
+                                return true;
+                        }
+                }
+
+                if (Configure::read('Auth.allowAnonymous') && empty($request['Request']['user_id'])) {
+                        return true;
+                }
+
+                return false;
+        }
+
+        /**
          * Add an upload to the request
          *
@@ -162 +207 @@
         public function addValidators()
         {
+                // First remove any existing validators
+                $this->Validator->deleteAll(array(
+                        'Validator.parent_id' => $this->id,
+                ));
+
+                // Add new validators
                 $validators = Configure::read('Validator');
                 foreach ($validators as $validator_name => $validator_config) {

trunk/server/www/app/models/result.php

@@ -59 +59 @@
         );
 
+        /** @var string Use the filename as the distinguising name */
+        public $displayField = 'filename';
+
         /**
          * Constructor
@@ -73 +76 @@
         }
 
-        /** @var string Use the filename as the distinguising name */
-        public $displayField = 'filename';
+        /**
+         * Check access control for this result
+         * @param string $user_id The user ID
+         * @param string $type "read" or "write"
+         * @param string $id The result ID
+         * @return boolean True or False
+         */
+        public function checkAccess($user_id, $type = 'read', $id = false)
+        {
+                if (!$id) {
+                        $id = $this->id;
+                }
+
+                if (!$id) {
+                        return false;
+                }
+
+                $result = $this->find('first', array(
+                        'contain' => array('Job', 'Job.Request'),
+                        'conditions' => array('Result.id' => $id),
+                ));
+
+                if (!empty($result)) {
+                        return $this->Job->Request->checkAccess($user_id, $type, $result['Job']['Request']['id']);
+                }
+
+                return false;
+        }
 
         /**

trunk/server/www/app/models/testsuite.php

@@ -110 +110 @@
 
                         $gallery_name = basename($directory);
-                        $gallery = $this->Gallery->find('count', array(
+                        $gallery = $this->Gallery->find('first', array(
                                 'conditions' => array(
                                         'Gallery.parent_id' => $gallery_id,
@@ -167 +167 @@
                 $gallery = $this->Gallery->read(null, $gallery_id);
 
+                // Rename the Fellowship testDoc documents to something more sensible
+                $filename = basename($path);
+                if (strtolower(substr($filename, 0, 8)) == 'testdoc.') {
+                        $filename  = $gallery['Gallery']['name'];
+                        $filename .= strrchr($path, '.');
+                }
+
                 // See if a request exists for this file
                 $this->Gallery->Request->bindModel(array('hasOne' => array('GalleriesRequest')));
                 $request = $this->Gallery->Request->find('first', array(
                         'conditions' => array(
-                                'Request.filename' => basename($path),
+                                'Request.filename' => $filename,
                                 'GalleriesRequest.gallery_id' => $gallery_id,
                         ),
@@ -193 +200 @@
                         $this->Gallery->Request->save();
 
-                        // Rename the Fellowship testDoc documents to something more sensible
-                        $filename = basename($path);
-                        if (strtolower(substr($filename, 0, 8)) == 'testdoc.') {
-                                $filename  = $gallery['Gallery']['name'];
-                                $filename .= strrchr($path, '.');
-                        }
-
                         // Add the file to the request
                         if (!$this->Gallery->Request->setFile($path, $filename)) {
@@ -213 +213 @@
 
                         // Schedule the preprocessor for the request
-                        //if (!$this->Gallery->Request->defer('run', 'Preprocessor')) {
-                        //      $this->log('Failed to queue the preprocessor for request ' . $this->Gallery->Request->id);
-                        //}
+                        if (!$this->Gallery->Request->defer('run', 'Preprocessor')) {
+                                $this->log('Failed to queue the preprocessor for request ' . $this->Gallery->Request->id);
+                        }
                         
                         // Add the request to the gallery
@@ -230 +230 @@
                         $this->Gallery->Request->deleteJobs();
                         $this->Gallery->Request->setFile($path);
-                        $this->Gallery->Request->set('modified', $stamp);
+                        $this->Gallery->Request->set(array(
+                                'modified' => filemtime($path),
+                                'state' => Request::STATE_PREPROCESSOR_QUEUED,
+                        ));
                         $this->Gallery->Request->save();
+                        
+                        // Add Validators to the request
+                        $this->Gallery->Request->addValidators();
+
+                        // Schedule the preprocessor for the request
+                        if (!$this->Gallery->Request->defer('run', 'Preprocessor')) {
+                                $this->log('Failed to queue the preprocessor for request ' . $this->Gallery->Request->id);
+                        }
+                        
+                        $this->log(sprintf('Updated request %s "%s"', $request['Request']['id'], $filename), LOG_DEBUG);
                 }
         }

trunk/server/www/app/views/helpers/request_model.php

@@ -54 +54 @@
                         return $this->output(sprintf(__('Preprocessor failed with error "%s"', true), $request['Request']['state_info']));
                 case Request::STATE_QUEUED:
+                        if (!$request['Request']['expire']) {
+                                return $this->output(__('Queued. Never expires', true));
+                        }
                         return $this->output(sprintf(__('Queued. Expires in %s', true), $this->Time->relativeTime($request['Request']['expire'])));
                 case Request::STATE_FINISHED: