approveuser.php3 10.8 KB
Newer Older
1
2
3
<?php
include("defs.php3");

4
5
6
7
8
#
# Standard Testbed Header
#
PAGEHEADER("New Users Approved");

9
10
11
#
# Only known and logged in users can be verified.
#
12
$uid = GETLOGIN();
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
LOGGEDINORDIE($uid);

#
# Walk the list of post variables, looking for the special post format.
# See approveuser_form.php3:
#
#             uid     menu     project
#	name=stoller$$approval-testbed value=approved,denied,postpone
#	name=stoller$$trust-testbed value=user,local_root
# 
while (list ($header, $value) = each ($HTTP_POST_VARS)) {
    #echo "$header: $value<br>\n";

    $approval_string = strstr($header, "\$\$approval-");
    if (! $approval_string) {
	continue;
    }

    $user     = substr($header, 0, strpos($header, "\$\$", 0));
    $project  = substr($approval_string, strlen("\$\$approval-"));
    $approval = $value;

    if (!$user || strcmp($user, "") == 0) {
	TBERROR("Parse error finding user in approveuser.php3", 1);
    }
    if (!$project || strcmp($project, "") == 0) {
	TBERROR("Parse error finding project in approveuser.php3", 1);
    }
    if (!$approval || strcmp($approval, "") == 0) {
	TBERROR("Parse error finding approval in approveuser.php3", 1);
    }

    #
    # There should be a corresponding trust variable in the POST vars.
    # Note that we construct the variable name and indirect to it.
    #
    $foo      = "$user\$\$trust-$project";
    $newtrust = $$foo;
    if (!$newtrust || strcmp($newtrust, "") == 0) {
	TBERROR("Parse error finding trust in approveuser.php3", 1);
    }
    #echo "User $user,
    #      Project $project, Approval $approval, Trust $newtrust<br>\n";
    if (strcmp($newtrust, "user") && strcmp($newtrust, "local_root")) {
	TBERROR("Invalid trust $newtrust for user $user approveuser.php3.", 1);
    }

    #
    # Get the current status for the user, which we might need to change
    # anyway, and to verify that the user is a valid user. We also need
    # the email address to let user know what happened.
    #
    # We change the status only if this person is joining his first project.
    # In this case, the status will be either "newuser" or "unapproved",
    # and we will change it to "unapproved" or "active", respectively.
    # If the status is "active", we leave it alone. 
    #
    $query_result = mysql_db_query($TBDBNAME,
71
	"SELECT status,usr_email,usr_name from users where uid='$user'");
72
73
74
75
76
77
78
79
80
    if (! $query_result) {
	TBERROR("Database Error restrieving user status for $user", 1);
    }
    if (mysql_num_rows($query_result) == 0) {
	TBERROR("Unknown user $user", 1);
    }
    $row = mysql_fetch_row($query_result);
    $curstatus  = $row[0];
    $user_email = $row[1];
81
    $user_name  = $row[2];
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
    #echo "Status = $curstatus, Email = $user_email<br>\n";

    #
    # We need to check that the current uid has the necessary trust level
    # to add this user to the project.
    #
    $query_result = mysql_db_query($TBDBNAME,
	"SELECT trust from proj_memb where uid='$uid' and pid='$project'");
    if (! $query_result) {
	TBERROR("Database Error retrieving trust for $uid in $project", 1);
    }
    if (mysql_num_rows($query_result) == 0) {
	USERERROR("You are not allowed to add users to project $project.", 1);
    }
    $row = mysql_fetch_row($query_result);
    $uidtrust = $row[0];
    if (strcmp($uidtrust, "group_root")) {
	USERERROR("You are not allowed to add users to project $project.", 1);
    }

    #
    # Then we check that that user being added really wanted to be in that
    # project, and is not already there with a valid trust value.
    #
    $query_result = mysql_db_query($TBDBNAME,
	"SELECT trust from proj_memb where uid='$user' and pid='$project'");
    if (! $query_result) {
	TBERROR("Database Error retrieving trust for $user in $project", 1);
    }
    if (mysql_num_rows($query_result) == 0) {
	USERERROR("User $user is not a member of project $project.", 1);
    }
    $row = mysql_fetch_row($query_result);
    $usertrust = $row[0];
    if (strcmp($usertrust, "none")) {
	USERERROR("User $user is already a member of project $project.", 1);
    }

120
121
122
123
124
125
126
    #
    # Lets get the uid email for the mail messages below, so that we
    # can stick in a proper return address.
    #
    $query_result = mysql_db_query($TBDBNAME,
	"SELECT usr_email,usr_name from users where uid='$uid'");
    if (! $query_result) {
127
	TBERROR("Database Error retrieving user info for $uid", 1);
128
129
130
131
132
133
134
135
    }
    if (mysql_num_rows($query_result) == 0) {
	TBERROR("Unknown user $uid", 1);
    }
    $row = mysql_fetch_row($query_result);
    $uid_email = $row[0];
    $uid_name  = $row[1];

136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
    #
    # Lets get project head email, just in case the person doing the approval
    # is not the head of the project. This is polite to do.
    #
    $query_result = mysql_db_query($TBDBNAME,
	"SELECT usr_email,usr_name from users as u ".
	"left join projects as p on p.head_uid=u.uid where p.pid='$project'");
    if (! $query_result) {
	TBERROR("Database Error retrieving user info for project $project ".
		"leader", 1);
    }
    if (mysql_num_rows($query_result) == 0) {
	TBERROR("Retrieving user info for project $project leader", 1);
    }
    $row = mysql_fetch_row($query_result);
    $phead_email = $row[0];
    $phead_name  = $row[1];
   
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
    #
    # Well, looks like everything is okay. Change the project membership
    # value appropriately.
    #
    if (strcmp($approval, "postpone") == 0) {
	echo "<p><h3>
                  Membership status for user $user was postponed for
                  later decision.
              </h3>\n";
        continue;
    }
    if (strcmp($approval, "deny") == 0) {
        #
        # Must delete the proj_memb record since we require that the user
        # reapply once denied. Send the luser email to let him know.
        #
        $query_result = mysql_db_query($TBDBNAME,
	    "delete from proj_memb where uid='$user' and pid='$project'");
        if (! $query_result) {
	    TBERROR("Database Error removing $user from project membership ".
                    "after being denied.", 1);
        }
176
177
        mail("$user_name '$user' <$user_email>",
             "TESTBED: Project '$project' Membership Denied",
178
179
180
181
182
183
184
	     "\n".
             "This message is to notify you that you have been denied\n".
	     "membership in project $project\n".
             "\n\n".
             "Thanks,\n".
             "Testbed Ops\n".
             "Utah Network Testbed\n",
185
             "From: $uid_name <$uid_email>\n".
186
             "Cc:  $phead_name <$phead_email>\n".
187
             "Bcc: $TBMAIL_APPROVAL\n".
188
189
190
191
192
193
194
195
196
             "Errors-To: $TBMAIL_WWW");

	echo "<h3><p>
                  User $user was denied membership in project $project.
                  The user will need to reapply again if this was in error.
              </h3>\n";

	continue;
    }
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
    if (strcmp($approval, "nuke") == 0) {
        #
        # Delete the proj_memb record.
        #
        $query_result = mysql_db_query($TBDBNAME,
	    "delete from proj_memb where uid='$user' and pid='$project'");
        if (! $query_result) {
	    TBERROR("Database Error removing $user from project membership ".
                    "after being denied.", 1);
        }

	#
	# See if user is in any other projects (even unapproved).
	# 
        $query_result = mysql_db_query($TBDBNAME,
	    "select * from proj_memb where uid='$user'");
        if (! $query_result) {
	    TBERROR("Database Error getting $user from project membership ".
                    "after being nuked", 1);
        }

	#
	# If yes, then we cannot safely delete the user account.
	#
	if (mysql_num_rows($query_result)) {
	    echo "<h3><p>
                  User $user was denied membership in project $project.<br>
                  Since the user is a member (or requesting membership)
		  in other projects, the account cannot be safely removed.
              </h3>\n";
	    
	    continue;
	}

	#
	# No other project membership. If the user is unapproved/newuser, 
	# it means he was never approved in any project, and so will
	# likely not be missed. He will be unapproved if he did his
	# verification.
	#
	if (strcmp($curstatus, "newuser") &&
	    strcmp($curstatus, "unapproved")) {
	    echo "<h3><p>
                  User $user was denied membership in project $project.<br>
                  Since the user has been approved by, or was active in other
		  projects in the past, the account cannot be safely removed.
              </h3>\n";
	    continue;
	}
	
	$query_result = mysql_db_query($TBDBNAME,
		"delete FROM users where uid='$user'");
	if (! $query_result) {
	    TBERROR("Database Error removing $user from users table ".
                    "after being nuked", 1);
	}
	
	echo "<h3><p>
                  User $user was denied membership in project $project.<br>
Jay Lepreau's avatar
Jay Lepreau committed
256
		  The account has also been terminated with prejudice!
257
258
259
260
              </h3>\n";

	continue;
    }
261
262
263
264
    if (strcmp($approval, "approve") == 0) {
        #
        # Change the trust value in proj_memb accordingly.
        #
265
266
	$date_approved = date("Y:m:d", time());
	
267
        $query_result = mysql_db_query($TBDBNAME,
268
269
270
	    "UPDATE proj_memb set trust='$newtrust', ".
            "date_approved='$date_approved' ".
	    "WHERE uid='$user' and pid='$project'");
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
        if (! $query_result) {
	    TBERROR("Database Error adding $user to project $project.", 1);
        }

        #
        # Change the status if necessary. This only happens for new
	# users being added to their first project. After this, the status is
        # going to be "active", and we just leave it that way.
	#
        if (strcmp($curstatus, "active")) {
	    if (strcmp($curstatus, "newuser") == 0) {
		$newstatus = "unverified";
            }
	    elseif (strcmp($curstatus, "unapproved") == 0) {
		$newstatus = "active";
	    }
	    else {
	        TBERROR("Invalid $user status $curstatus in approveuser.php3",
                         1);
	    }
	    $query_result = mysql_db_query($TBDBNAME,
	        "UPDATE users set status='$newstatus' WHERE uid='$user'");
            if (! $query_result) {
	        TBERROR("Database Error changing $user status to $newstatus.",
                         1);
            }
	}

299
300
        mail("$user_name '$user' <$user_email>",
             "TESTBED: Project '$project' Membership Approval",
301
302
303
304
305
306
307
	     "\n".
	     "This message is to notify you that you have been approved\n".
	     "as a member of project $project with $newtrust permissions.\n".
             "\n\n".
             "Thanks,\n".
             "Testbed Ops\n".
             "Utah Network Testbed\n",
308
             "From: $uid_name <$uid_email>\n".
309
             "Cc:  $phead_name <$phead_email>\n".
310
             "Bcc: $TBMAIL_APPROVAL\n".
311
312
             "Errors-To: $TBMAIL_WWW");

313
314
315
	#
        # Create user account on control node.
        #
316
	SUEXEC($uid, "flux", "mkacct-ctrl $user", 0);
317

318
319
320
321
322
323
324
325
326
327
	echo "<h3><p>
                  User $user was granted membership in project $project
                  with $newtrust permissions.
              </h3>\n";

	continue;
    }
    TBERROR("Invalid approval value $approval in approveuser.php3.", 1);
}

328
329
330
331
#
# Standard Testbed Footer
# 
PAGEFOOTER();
332
?>