mirror of
https://github.com/webmin/webmin.git
synced 2026-10-27 21:50:40 +00:00
c23b6b5b48
This patch completes the ACL added in [17ba87cbc](https://github.com/webmin/webmin/commit/17ba87cbc).
That change protected only the edit and save pages.
Users without environment-variable access could still change variables through delete, bulk actions, and moves.
This applies the permission everywhere and hides blocked controls.
It also applies create and delete permissions to variables and prevents job and variable endpoints from being mixed.
103 lines
2.2 KiB
Perl
Executable File
103 lines
2.2 KiB
Perl
Executable File
#!/usr/local/bin/perl
|
|
# save_env.cgi
|
|
# Save an existing environment variable, or create a new one
|
|
|
|
require './cron-lib.pl';
|
|
&error_setup($text{'env_err'});
|
|
&ReadParse();
|
|
$access{'env'} || &error($text{'env_ecannot'});
|
|
|
|
@jobs = &list_cron_jobs();
|
|
if ($in{'new'}) {
|
|
$access{'create'} || &error($text{'save_ecannot2'});
|
|
$job = { };
|
|
}
|
|
else {
|
|
$oldjob = $jobs[$in{'idx'}];
|
|
$oldjob && $oldjob->{'name'} || &error($text{'env_egone'});
|
|
$job->{'file'} = $oldjob->{'file'};
|
|
$job->{'line'} = $oldjob->{'line'};
|
|
}
|
|
|
|
if ($in{'delete'}) {
|
|
# Just re-direct to delete CGI
|
|
&redirect("delete_env.cgi?idx=$in{'idx'}");
|
|
exit;
|
|
}
|
|
|
|
# Check if this user is allowed to execute cron jobs
|
|
&can_use_cron($in{'user'}) ||
|
|
&error(&text('save_eallow', $in{'user'}));
|
|
|
|
# Check module access control
|
|
&can_edit_user(\%access, $in{'user'}) ||
|
|
&error(&text('save_ecannot', $in{'user'}));
|
|
|
|
@files = &unique((map { $_->{'file'} } @jobs),
|
|
"$config{'cron_dir'}/$in{'user'}");
|
|
foreach $f (@files) { &lock_file($f); }
|
|
|
|
# Check and parse inputs
|
|
if ($in{'name'} !~ /^\S+$/) {
|
|
&error($text{'save_ename'});
|
|
}
|
|
if ($in{'value'} =~ /\r|\n/) {
|
|
&error($text{'save_evalue'});
|
|
}
|
|
if (!$in{'user'}) {
|
|
&error($text{'save_euser'});
|
|
}
|
|
if (!defined(getpwnam($in{'user'}))) {
|
|
&error(&text('save_euser2', $in{'user'}));
|
|
}
|
|
$job->{'active'} = $in{'active'};
|
|
$job->{'name'} = $in{'name'};
|
|
$job->{'value'} = $in{'value'};
|
|
$job->{'user'} = $in{'user'};
|
|
|
|
if (!$in{'new'}) {
|
|
# Editing an existing variable
|
|
&can_edit_user(\%access, $oldjob->{'user'}) ||
|
|
&error(&text('save_ecannot', $oldjob->{'user'}));
|
|
if ($job->{'user'} eq $oldjob->{'user'}) {
|
|
# Not changing user
|
|
if ($in{'where'}) {
|
|
&delete_cron_job($job);
|
|
&insert_cron_job($job);
|
|
}
|
|
else {
|
|
&change_cron_job($job);
|
|
}
|
|
}
|
|
else {
|
|
# Changing user
|
|
&delete_cron_job($oldjob);
|
|
if ($in{'where'}) {
|
|
&insert_cron_job($job);
|
|
}
|
|
else {
|
|
&create_cron_job($job);
|
|
}
|
|
}
|
|
}
|
|
else {
|
|
# Creating a new variable
|
|
if ($in{'where'}) {
|
|
&insert_cron_job($job);
|
|
}
|
|
else {
|
|
&create_cron_job($job);
|
|
}
|
|
}
|
|
|
|
foreach $f (@files) { &unlock_file($f); }
|
|
if ($in{'new'}) {
|
|
&webmin_log("create", "env", $in{'user'}, \%in);
|
|
}
|
|
else {
|
|
&webmin_log("modify", "env", $in{'user'}, \%in);
|
|
}
|
|
&redirect("");
|
|
|
|
|