All new accounts created on Gitlab now require administrator approval. If you invite any collaborators, please let Flux staff know so they can approve the accounts.

approveuser.php3 14.7 KB
Newer Older
1
<?php
Leigh B. Stoller's avatar
Leigh B. Stoller committed
2 3
#
# EMULAB-COPYRIGHT
4
# Copyright (c) 2000-2003, 2005, 2006, 2007 University of Utah and the Flux Group.
Leigh B. Stoller's avatar
Leigh B. Stoller committed
5 6
# All rights reserved.
#
7 8
include("defs.php3");

9 10 11 12 13
#
# Standard Testbed Header
#
PAGEHEADER("New Users Approved");

14
#
15
# Only known and logged in users.
16
#
17 18
$this_user = CheckLoginOrDie();
$uid       = $this_user->uid();
19

20 21 22 23 24 25
#
# The reason for this call is to make sure that globals are set properly.
#
$reqargs = RequiredPageArguments();

# Local used below.
26 27
$projectchecks = array();

28
# Hmm, is this needed?
29 30
ignore_user_abort(1);

31 32 33 34
#
# Walk the list of post variables, looking for the special post format.
# See approveuser_form.php3:
#
Leigh B. Stoller's avatar
Leigh B. Stoller committed
35
#             uid     menu     project/group
36 37
#	name=Uxxxx$$approval-testbed/testbed value=approved,denied,postpone
#	name=Uxxxx$$trust-testbed/testbed value=user,local_root
38 39 40 41 42
#
# We make two passes over the post vars. The first does a sanity check so
# that we can bail out without doing anything. This allows the user to
# back up and make changes without worrying about some stuff being done and
# other stuff not. 
Chad Barb's avatar
 
Chad Barb committed
43 44 45 46 47 48 49 50 51 52
#

#
# copy of HTTP_POST_VARS we use to do actual work.
# this is so I can insert an implicit default-group approval
# while iterating over HTTP_POST_VARS. 
# A bit kludgey, indeed.
#
$POST_VARS_COPY = array();
 
53 54
while (list ($header, $value) = each ($HTTP_POST_VARS)) {
    #echo "$header: $value<br>\n";
Chad Barb's avatar
 
Chad Barb committed
55
    $POST_VARS_COPY[$header] = $value; 
56 57 58 59 60 61

    $approval_string = strstr($header, "\$\$approval-");
    if (! $approval_string) {
	continue;
    }

62
    $user     = substr($header, 1, strpos($header, "\$\$", 0) - 1);
Leigh B. Stoller's avatar
Leigh B. Stoller committed
63 64 65
    $projgrp  = substr($approval_string, strlen("\$\$approval-"));
    $project  = substr($projgrp, 0, strpos($projgrp, "/", 0));
    $group    = substr($projgrp, strpos($projgrp, "/", 0) + 1);
66 67 68 69 70 71 72 73
    $approval = $value;

    if (!$user || strcmp($user, "") == 0) {
	TBERROR("Parse error finding user in approveuser.php3", 1);
    }
    if (!$project || strcmp($project, "") == 0) {
	TBERROR("Parse error finding project in approveuser.php3", 1);
    }
Leigh B. Stoller's avatar
Leigh B. Stoller committed
74 75 76
    if (!$group || strcmp($group, "") == 0) {
	TBERROR("Parse error finding group in approveuser.php3", 1);
    }
77 78 79 80 81 82 83 84
    if (!$approval || strcmp($approval, "") == 0) {
	TBERROR("Parse error finding approval in approveuser.php3", 1);
    }

    #
    # There should be a corresponding trust variable in the POST vars.
    # Note that we construct the variable name and indirect to it.
    #
85 86 87 88
    $foo      = "U${user}\$\$trust-$project/$group";
    #echo "$foo<br>\n";
    
    $newtrust = $HTTP_POST_VARS[$foo];
89 90 91
    if (!$newtrust || strcmp($newtrust, "") == 0) {
	TBERROR("Parse error finding trust in approveuser.php3", 1);
    }
Leigh B. Stoller's avatar
Leigh B. Stoller committed
92 93 94 95 96 97
    #echo "User $user, Project $project,
    #      Group $group, Approval $approval, Trust $newtrust<br>\n";
    
    if (strcmp($newtrust, "user") &&
	strcmp($newtrust, "local_root") &&
	strcmp($newtrust, "group_root")) {
98 99 100 101
	TBERROR("Invalid trust $newtrust for user $user approveuser.php3.", 1);
    }

    #
102
    # Verify an actual user that is being approved.
103
    #
104
    if (! ($target_user = User::Lookup($user))) {
105
	TBERROR("Trying to approve unknown user $user.", 1);
106
    }
107
    $target_uid = $target_user->uid();
108 109 110 111 112 113 114 115 116 117

    # Ditto the project.
    if (! ($target_project = Project::Lookup($project))) {
	TBERROR("Trying to approve user into unknown project $project.", 1);
    }

    # Ditto the group.
    if (! ($target_group = Group::LookupByPidGid($project, $group))) {
	TBERROR("Trying to approve user into unknown group $group", 1);
    }
118
    
119
    #
120 121
    # Check that the current uid has the necessary trust level
    # to approver users in the project/group. Also, only project leaders
Chad Barb's avatar
 
Chad Barb committed
122
    # can add someone to the default group as group_root.
123
    #
124
    if (! $target_group->AccessCheck($this_user, $TB_PROJECT_ADDUSER)) {
Leigh B. Stoller's avatar
Leigh B. Stoller committed
125 126
	USERERROR("You are not allowed to approve users in ".
		  "$project/$group!", 1);
127
    }
Chad Barb's avatar
 
Chad Barb committed
128

129 130 131 132 133
    if ($newtrust == "group_root" && $project == $group &&
	!$target_project->AccessCheck($this_user,
				      $TB_PROJECT_BESTOWGROUPROOT)) {
	USERERROR("You do not have permission to add new users with group ".
		  "root trust to the default group!", 1);
Chad Barb's avatar
 
Chad Barb committed
134
    }
Leigh B. Stoller's avatar
Leigh B. Stoller committed
135
    
136
    #
137 138
    # Check if already approved in the project/group. If already an
    # approved member, something went wrong.
139
    #
140
    $target_group->IsMember($target_user, $isapproved);
Leigh B. Stoller's avatar
Leigh B. Stoller committed
141
    if ($isapproved) {
142
	USERERROR("$target_uid is already an approved member of ".
143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166
		  "$project/$group!", 1);
    }

    #
    # Verify approval value. 
    #
    if (strcmp($approval, "postpone") &&
	strcmp($approval, "deny") &&
	strcmp($approval, "nuke") &&
	strcmp($approval, "approve")) {
	TBERROR("Invalid approval value $approval in approveuser.php3.", 1);
    }

    #
    # If denying project membership, then there must be equivalent denial
    # for all subgroups. We can either do it for the user, or require that the
    # user understand whats happening. I prefer the latter, so look for this
    # and spit back an error. Note that we cannot rely on the post vars for
    # this, but must look in the DB for the group set, and then check to make
    # sure there are post vars for *all* of them.
    #
    if (strcmp($project, $group) == 0 &&
	(strcmp($approval, "deny") == 0 ||
	 strcmp($approval, "nuke") == 0)) {
167 168 169 170 171 172

	# List of subgroup membership in this project.
	$grouplist = $target_project->GroupList($target_user);

	foreach ($grouplist as $subgroup) {
	    $gid = $subgroup->gid();
173 174 175 176 177 178 179 180 181 182

            #
            # Create and indirect through post var for subgroup approval value.
            #
	    $foo = "$user\$\$approval-$project/$gid";
	    $subgroup_approval = $$foo;

	    if (!$subgroup_approval ||
		(strcmp($subgroup_approval, "deny") &&
		 strcmp($subgroup_approval, "nuke"))) {
183 184 185 186
		USERERROR("If you wish to deny/nuke user $target_uid in ".
			  "project $project then you must deny/nuke in all ".
			  "of the subgroups $target_uid is attempting to ".
			  "join.", 1);
187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204
	    }
	}
    }

    if (strcmp($approval, "approve") == 0)
	$projectchecks[$user][] = array($project, $group, $newtrust);

    #
    # When operating on a user for a subgroup, the user must already be in the
    # default group, or there must be an appropriate default group operation
    # in the POST vars. In other words, we do not allow users to be
    # approved/denied/postponed to a subgroup without a default group
    # operation as well. At present, all users must be in the default group
    # in addition to subgroups.
    #
    if (strcmp($project, $group) == 0)
	continue;

205
    $target_project->IsMember($target_user, $isapproved);
206 207 208 209 210 211
    if ($isapproved)
	continue;

    #
    # Create and indirect through post var for project approval value.
    #
212 213 214
    $foo = "U${user}\$\$approval-$project/$project";
    $bar = "U${user}\$\$trust-$project/$project";
    $default_approval = $HTTP_POST_VARS[$foo];
215 216
    
    if (!$default_approval || strcmp($default_approval, "") == 0) {
Chad Barb's avatar
 
Chad Barb committed
217 218 219 220 221 222 223
	# Implicit group approval as user.
	# Short circuit all the perms-checking, and squeeze it in
	# all the appropriate places.
	
	# 1. For our benefit
	$$foo = $approval;
	
224
	# 2. For the strcmp below.
Chad Barb's avatar
 
Chad Barb committed
225 226 227 228 229 230 231 232
	$default_approval = $approval;

	# 3. For the sanity check
	$projectchecks[$user][] = array($project, $project, "user");	

	# 4. For the while loop which does the actual work
	$POST_VARS_COPY[ $foo ] = $approval;
	$$bar = "user";
233 234 235
    }
    if (strcmp($approval, "approve") == 0 &&
	strcmp($default_approval, "approve")) {
236
	USERERROR("You cannot approve $target_uid in $project/$group without ".
237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257
		  "approval in the default group ($project/$project)!", 1);
    }
}

#
# Sanity check. I hate this stuff.
# 
while (list ($user, $value) = each ($projectchecks)) {
    $projtrust   = array();
    $grouptrust  = array();
    $pidlist     = array();
    
    while (list ($a, $b) = each ($value)) {
	$pid   = $b[0];
	$gid   = $b[1];
	$trust = $b[2];
	$foo   = $projtrust[$pid];
	$bar   = $grouptrust[$pid];

	#echo "$user $pid $gid $trust $foo $bar<br>\n";

258 259 260 261 262 263 264
	if (! ($target_group = Group::LookupByPidGid($pid, $gid))) {
	    TBERROR("Could not find group object for $project/$group", 1);
	}

	if (! ($target_user = User::Lookup($user))) {
	    TBERROR("Could not find user object for $user", 1);
	}
265
	$target_uid = $target_user->uid();
266
	
267 268 269 270 271 272 273 274
	#
	# This looks for different trust levels in different subgroups
	# of the same project. We are only checking the form arguments
	# here; we will do a check against the DB below. 
	# 
	if (strcmp($pid, $gid)) {
	    if (isset($grouptrust[$pid]) &&
		strcmp($grouptrust[$pid], $trust)) {
275 276
		USERERROR("User $target_uid may not have different trust ".
			  "levels in different subgroups of $pid!", 1);
277 278 279 280 281 282 283 284 285 286 287
	    }
	    $grouptrust[$pid] = $trust;
	}
	else {
	    #
	    # Stash the project default group trust so that we can also
	    # do a consistency check against it.
	    #
	    $projtrust[$pid] = $trust;
	}
	$pidlist[$pid] = $pid;
Chad Barb's avatar
 
Chad Barb committed
288

289
	$target_group->CheckTrustConsistency($target_user, $trust, 1);
290 291 292 293 294 295 296 297 298 299
    }
    
    reset($value);
}

reset($HTTP_POST_VARS);

#
# Okay, all sanity tests passed for all post vars. Now do the actual work.
# 
Chad Barb's avatar
 
Chad Barb committed
300
while (list ($header, $value) = each ($POST_VARS_COPY)) {
301 302 303 304
    #echo "$header: $value<br>\n";

    $approval_string = strstr($header, "\$\$approval-");
    if (! $approval_string) {
Leigh B. Stoller's avatar
Leigh B. Stoller committed
305
	continue;
306 307
    }

308
    $user     = substr($header, 1, strpos($header, "\$\$", 0) - 1);
309 310 311 312 313
    $projgrp  = substr($approval_string, strlen("\$\$approval-"));
    $project  = substr($projgrp, 0, strpos($projgrp, "/", 0));
    $group    = substr($projgrp, strpos($projgrp, "/", 0) + 1);
    $approval = $value;

314
    #
315 316
    # Corresponding trust value.
    #
317 318
    $foo      = "U${user}\$\$trust-$project/$group";
    $newtrust = $HTTP_POST_VARS[$foo];
319 320 321 322 323 324 325 326

    #
    # Get the current status for the user, which we might need to change.
    #
    # We change the status only if this person is joining his first project.
    # In this case, the status will be either "newuser" or "unapproved",
    # and we will change it to "unapproved" or "active", respectively.
    # If the status is "active", we leave it alone. 
327
    #
328 329
    if (! ($target_user = User::Lookup($user))) {
	TBERROR("Trying to approve unknown user $user.", 1);
330
    }
331 332 333
    $curstatus  = $target_user->status();
    $user_email = $target_user->email();
    $user_name  = $target_user->name();
334
    $user_uid   = $target_user->uid();
335 336
    #echo "Status = $curstatus, Email = $user_email<br>\n";

337 338 339 340 341 342 343 344
    # Ditto the project and group
    if (! ($target_project = Project::Lookup($project))) {
	TBERROR("Trying to approve user into unknown project $project.", 1);
    }
    if (! ($target_group = Group::LookupByPidGid($project, $group))) {
	TBERROR("Trying to approve user into unknown group $group", 1);
    }

345 346
    #
    # Email info for current user.
347 348 349
    #
    $uid_name  = $this_user->name();
    $uid_email = $this_user->email();
350 351

    #
352
    # Email info for the proj/group leaders too.
353
    #
354
    $leaders = $target_group->LeaderMailList();
355
    
356 357 358 359 360
    #
    # Well, looks like everything is okay. Change the project membership
    # value appropriately.
    #
    if (strcmp($approval, "postpone") == 0) {
361
	echo "<p>
362
                  Membership status for user $user_uid in $project/$group was
363
                  <b>postponed</b> for later decision.\n";
364 365 366 367
        continue;
    }
    if (strcmp($approval, "deny") == 0) {
        #
Leigh B. Stoller's avatar
Leigh B. Stoller committed
368 369
        # Must delete the group_membership record since we require that the 
        # user reapply once denied. Send the luser email to let him know.
370
        #
371
	$target_group->DeleteMember($target_user);
Leigh B. Stoller's avatar
Leigh B. Stoller committed
372

373
        TBMAIL("$user_name '$user_uid' <$user_email>",
374
             "Membership Denied in '$project/$group'",
375 376
	     "\n".
             "This message is to notify you that you have been denied\n".
377
	     "membership in project/group $project/$group.\n".
378 379
             "\n\n".
             "Thanks,\n".
380
             "Testbed Operations\n",
381
             "From: $uid_name <$uid_email>\n".
382
             "Cc:  $leaders\n".
383
             "Bcc: $TBMAIL_AUDIT\n".
384 385
             "Errors-To: $TBMAIL_WWW");

386
	echo "<p>
387
                User $user_uid was <b>denied</b> membership in $project/$group.
388 389
                <br>
                The user will need to reapply again if this was in error.\n";
390 391 392

	continue;
    }
393 394
    if (strcmp($approval, "nuke") == 0) {
        #
Leigh B. Stoller's avatar
Leigh B. Stoller committed
395 396
        # Must delete the group_membership record since we require that the 
        # user reapply once denied. Send the luser email to let him know.
397
        #
398
	$target_group->DeleteMember($target_user);
399 400 401

	#
	# See if user is in any other projects (even unapproved).
Leigh B. Stoller's avatar
Leigh B. Stoller committed
402
	#
403
	$project_list = $target_user->ProjectMembershipList();
404 405 406 407

	#
	# If yes, then we cannot safely delete the user account.
	#
408
	if (count($project_list)) {
409
	    echo "<p>
410 411
                  User $user_uid was <b>denied</b> membership in
                  $project/$group.
412
                  <br>
413
                  Since the user is a member (or requesting membership)
414
		  in other projects, the account cannot be safely removed.\n";
415 416 417 418 419 420 421 422 423 424 425 426
	    
	    continue;
	}

	#
	# No other project membership. If the user is unapproved/newuser, 
	# it means he was never approved in any project, and so will
	# likely not be missed. He will be unapproved if he did his
	# verification.
	#
	if (strcmp($curstatus, "newuser") &&
	    strcmp($curstatus, "unapproved")) {
427
	    echo "<p>
428 429
                  User $user_uid was <b>denied</b> membership in
                  $project/$group.
430
                  <br>
431 432
                  Since the user has been approved by, or was active in other
		  projects in the past, the account cannot be safely removed.
433
                  \n";
434 435
	    continue;
	}
436
	SUEXEC($uid, $TBADMINGROUP, "webrmuser -n -p $project $user_uid", 1); 
437

438
	echo "<p>
439
                User $user_uid was <b>denied</b> membership in $project/$group.
440
                <br>
441
		The account has also been <b>terminated</b>!\n";
442 443 444

	continue;
    }
445 446 447 448 449 450
    if (strcmp($approval, "approve") == 0) {
        #
        # Change the status if necessary. This only happens for new
	# users being added to their first project. After this, the status is
        # going to be "active", and we just leave it that way.
	#
451 452 453
	if ($curstatus != TBDB_USERSTATUS_ACTIVE) {
	    if ($curstatus == TBDB_USERSTATUS_UNAPPROVED) {
		$target_user->SetStatus(TBDB_USERSTATUS_ACTIVE);
454
	    }
455
	    else {
456
	        TBERROR("Invalid $user status $curstatus", 1);
457
	    }
458 459
	    if (!($user_interface =
		  $target_project->default_user_interface())) {
460
		$user_interface = TBDB_USER_INTERFACE_EMULAB;
461
	    }
462
	    $target_user->SetUserInterface($user_interface);
463 464 465 466

            #
            # Create user account on control node.
            #
467
	    SUEXEC($uid, $TBADMINGROUP, "webtbacct add $user_uid", 1);
468
	}
469 470 471 472
        #
	# Only need to add new membership.
	# 
	SUEXEC($uid, $TBADMINGROUP,
473
	       "webmodgroups -a $project:$group:$newtrust $user_uid", 1);
474

475
	echo "<p>
476 477
                  User $user_uid was <b>granted</b> membership in
                  $project/$group with $newtrust permissions.\n";
478
		
479 480 481 482
	continue;
    }
}

483 484 485 486
#
# Standard Testbed Footer
# 
PAGEFOOTER();
487
?>