approveuser.php3 15 KB
Newer Older
1
<?php
Leigh B. Stoller's avatar
Leigh B. Stoller committed
2 3
#
# EMULAB-COPYRIGHT
4
# Copyright (c) 2000-2003, 2005, 2006 University of Utah and the Flux Group.
Leigh B. Stoller's avatar
Leigh B. Stoller committed
5 6
# All rights reserved.
#
7 8
include("defs.php3");

9 10 11 12 13
#
# Standard Testbed Header
#
PAGEHEADER("New Users Approved");

14
#
15
# Only known and logged in users.
16
#
17 18
$this_user = CheckLoginOrDie();
$uid       = $this_user->uid();
19

20 21 22 23
$projectchecks = array();

ignore_user_abort(1);

24 25 26 27
#
# Walk the list of post variables, looking for the special post format.
# See approveuser_form.php3:
#
Leigh B. Stoller's avatar
Leigh B. Stoller committed
28 29 30
#             uid     menu     project/group
#	name=stoller$$approval-testbed/testbed value=approved,denied,postpone
#	name=stoller$$trust-testbed/testbed value=user,local_root
31 32 33 34 35
#
# We make two passes over the post vars. The first does a sanity check so
# that we can bail out without doing anything. This allows the user to
# back up and make changes without worrying about some stuff being done and
# other stuff not. 
Chad Barb's avatar
 
Chad Barb committed
36 37 38 39 40 41 42 43 44 45
#

#
# copy of HTTP_POST_VARS we use to do actual work.
# this is so I can insert an implicit default-group approval
# while iterating over HTTP_POST_VARS. 
# A bit kludgey, indeed.
#
$POST_VARS_COPY = array();
 
46 47
while (list ($header, $value) = each ($HTTP_POST_VARS)) {
    #echo "$header: $value<br>\n";
Chad Barb's avatar
 
Chad Barb committed
48
    $POST_VARS_COPY[$header] = $value; 
49 50 51 52 53 54 55

    $approval_string = strstr($header, "\$\$approval-");
    if (! $approval_string) {
	continue;
    }

    $user     = substr($header, 0, strpos($header, "\$\$", 0));
Leigh B. Stoller's avatar
Leigh B. Stoller committed
56 57 58
    $projgrp  = substr($approval_string, strlen("\$\$approval-"));
    $project  = substr($projgrp, 0, strpos($projgrp, "/", 0));
    $group    = substr($projgrp, strpos($projgrp, "/", 0) + 1);
59 60 61 62 63 64 65 66
    $approval = $value;

    if (!$user || strcmp($user, "") == 0) {
	TBERROR("Parse error finding user in approveuser.php3", 1);
    }
    if (!$project || strcmp($project, "") == 0) {
	TBERROR("Parse error finding project in approveuser.php3", 1);
    }
Leigh B. Stoller's avatar
Leigh B. Stoller committed
67 68 69
    if (!$group || strcmp($group, "") == 0) {
	TBERROR("Parse error finding group in approveuser.php3", 1);
    }
70 71 72 73 74 75 76 77
    if (!$approval || strcmp($approval, "") == 0) {
	TBERROR("Parse error finding approval in approveuser.php3", 1);
    }

    #
    # There should be a corresponding trust variable in the POST vars.
    # Note that we construct the variable name and indirect to it.
    #
Leigh B. Stoller's avatar
Leigh B. Stoller committed
78
    $foo      = "$user\$\$trust-$project/$group";
79 80 81 82
    $newtrust = $$foo;
    if (!$newtrust || strcmp($newtrust, "") == 0) {
	TBERROR("Parse error finding trust in approveuser.php3", 1);
    }
Leigh B. Stoller's avatar
Leigh B. Stoller committed
83 84 85 86 87 88
    #echo "User $user, Project $project,
    #      Group $group, Approval $approval, Trust $newtrust<br>\n";
    
    if (strcmp($newtrust, "user") &&
	strcmp($newtrust, "local_root") &&
	strcmp($newtrust, "group_root")) {
89 90 91 92
	TBERROR("Invalid trust $newtrust for user $user approveuser.php3.", 1);
    }

    #
93
    # Verify an actual user that is being approved.
94
    #
95
    if (! ($target_user = User::Lookup($user))) {
96
	TBERROR("Trying to approve unknown user $user.", 1);
97
    }
98 99 100 101 102 103 104 105 106 107

    # Ditto the project.
    if (! ($target_project = Project::Lookup($project))) {
	TBERROR("Trying to approve user into unknown project $project.", 1);
    }

    # Ditto the group.
    if (! ($target_group = Group::LookupByPidGid($project, $group))) {
	TBERROR("Trying to approve user into unknown group $group", 1);
    }
108
    
109
    #
110 111
    # Check that the current uid has the necessary trust level
    # to approver users in the project/group. Also, only project leaders
Chad Barb's avatar
 
Chad Barb committed
112
    # can add someone to the default group as group_root.
113
    #
114
    if (! $target_group->AccessCheck($this_user, $TB_PROJECT_ADDUSER)) {
Leigh B. Stoller's avatar
Leigh B. Stoller committed
115 116
	USERERROR("You are not allowed to approve users in ".
		  "$project/$group!", 1);
117
    }
Chad Barb's avatar
 
Chad Barb committed
118

119 120 121 122 123
    if ($newtrust == "group_root" && $project == $group &&
	!$target_project->AccessCheck($this_user,
				      $TB_PROJECT_BESTOWGROUPROOT)) {
	USERERROR("You do not have permission to add new users with group ".
		  "root trust to the default group!", 1);
Chad Barb's avatar
 
Chad Barb committed
124
    }
Leigh B. Stoller's avatar
Leigh B. Stoller committed
125
    
126
    #
127 128
    # Check if already approved in the project/group. If already an
    # approved member, something went wrong.
129
    #
130
    $target_group->IsMember($target_user, $isapproved);
Leigh B. Stoller's avatar
Leigh B. Stoller committed
131
    if ($isapproved) {
132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156
	USERERROR("$user is already an approved member of ".
		  "$project/$group!", 1);
    }

    #
    # Verify approval value. 
    #
    if (strcmp($approval, "postpone") &&
	strcmp($approval, "deny") &&
	strcmp($approval, "nuke") &&
	strcmp($approval, "approve")) {
	TBERROR("Invalid approval value $approval in approveuser.php3.", 1);
    }

    #
    # If denying project membership, then there must be equivalent denial
    # for all subgroups. We can either do it for the user, or require that the
    # user understand whats happening. I prefer the latter, so look for this
    # and spit back an error. Note that we cannot rely on the post vars for
    # this, but must look in the DB for the group set, and then check to make
    # sure there are post vars for *all* of them.
    #
    if (strcmp($project, $group) == 0 &&
	(strcmp($approval, "deny") == 0 ||
	 strcmp($approval, "nuke") == 0)) {
157 158 159 160 161 162

	# List of subgroup membership in this project.
	$grouplist = $target_project->GroupList($target_user);

	foreach ($grouplist as $subgroup) {
	    $gid = $subgroup->gid();
163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193

            #
            # Create and indirect through post var for subgroup approval value.
            #
	    $foo = "$user\$\$approval-$project/$gid";
	    $subgroup_approval = $$foo;

	    if (!$subgroup_approval ||
		(strcmp($subgroup_approval, "deny") &&
		 strcmp($subgroup_approval, "nuke"))) {
		USERERROR("If you wish to deny/nuke user $user in project ".
			  "$project then you must deny/nuke in all of the ".
			  "subgroups $user is attempting to join.", 1);
	    }
	}
    }

    if (strcmp($approval, "approve") == 0)
	$projectchecks[$user][] = array($project, $group, $newtrust);

    #
    # When operating on a user for a subgroup, the user must already be in the
    # default group, or there must be an appropriate default group operation
    # in the POST vars. In other words, we do not allow users to be
    # approved/denied/postponed to a subgroup without a default group
    # operation as well. At present, all users must be in the default group
    # in addition to subgroups.
    #
    if (strcmp($project, $group) == 0)
	continue;

194
    $target_project->IsMember($target_user, $isapproved);
195 196 197 198 199 200 201
    if ($isapproved)
	continue;

    #
    # Create and indirect through post var for project approval value.
    #
    $foo = "$user\$\$approval-$project/$project";
Chad Barb's avatar
 
Chad Barb committed
202
    $bar = "$user\$\$trust-$project/$project";
203 204 205
    $default_approval = $$foo;
    
    if (!$default_approval || strcmp($default_approval, "") == 0) {
Chad Barb's avatar
 
Chad Barb committed
206 207 208 209 210 211 212
	# Implicit group approval as user.
	# Short circuit all the perms-checking, and squeeze it in
	# all the appropriate places.
	
	# 1. For our benefit
	$$foo = $approval;
	
213
	# 2. For the strcmp below.
Chad Barb's avatar
 
Chad Barb committed
214 215 216 217 218 219 220 221
	$default_approval = $approval;

	# 3. For the sanity check
	$projectchecks[$user][] = array($project, $project, "user");	

	# 4. For the while loop which does the actual work
	$POST_VARS_COPY[ $foo ] = $approval;
	$$bar = "user";
222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246
    }
    if (strcmp($approval, "approve") == 0 &&
	strcmp($default_approval, "approve")) {
	USERERROR("You cannot approve $user in $project/$group without ".
		  "approval in the default group ($project/$project)!", 1);
    }
}

#
# Sanity check. I hate this stuff.
# 
while (list ($user, $value) = each ($projectchecks)) {
    $projtrust   = array();
    $grouptrust  = array();
    $pidlist     = array();
    
    while (list ($a, $b) = each ($value)) {
	$pid   = $b[0];
	$gid   = $b[1];
	$trust = $b[2];
	$foo   = $projtrust[$pid];
	$bar   = $grouptrust[$pid];

	#echo "$user $pid $gid $trust $foo $bar<br>\n";

247 248 249 250 251 252 253 254
	if (! ($target_group = Group::LookupByPidGid($pid, $gid))) {
	    TBERROR("Could not find group object for $project/$group", 1);
	}

	if (! ($target_user = User::Lookup($user))) {
	    TBERROR("Could not find user object for $user", 1);
	}
	
255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275
	#
	# This looks for different trust levels in different subgroups
	# of the same project. We are only checking the form arguments
	# here; we will do a check against the DB below. 
	# 
	if (strcmp($pid, $gid)) {
	    if (isset($grouptrust[$pid]) &&
		strcmp($grouptrust[$pid], $trust)) {
		USERERROR("User $user may not have different trust levels in ".
			  "different subgroups of $pid!", 1);
	    }
	    $grouptrust[$pid] = $trust;
	}
	else {
	    #
	    # Stash the project default group trust so that we can also
	    # do a consistency check against it.
	    #
	    $projtrust[$pid] = $trust;
	}
	$pidlist[$pid] = $pid;
Chad Barb's avatar
 
Chad Barb committed
276

277
	$target_group->CheckTrustConsistency($target_user, $trust, 1);
278 279 280 281 282 283 284 285 286 287
    }
    
    reset($value);
}

reset($HTTP_POST_VARS);

#
# Okay, all sanity tests passed for all post vars. Now do the actual work.
# 
Chad Barb's avatar
 
Chad Barb committed
288
while (list ($header, $value) = each ($POST_VARS_COPY)) {
289 290 291 292
    #echo "$header: $value<br>\n";

    $approval_string = strstr($header, "\$\$approval-");
    if (! $approval_string) {
Leigh B. Stoller's avatar
Leigh B. Stoller committed
293
	continue;
294 295
    }

296 297 298 299 300 301
    $user     = substr($header, 0, strpos($header, "\$\$", 0));
    $projgrp  = substr($approval_string, strlen("\$\$approval-"));
    $project  = substr($projgrp, 0, strpos($projgrp, "/", 0));
    $group    = substr($projgrp, strpos($projgrp, "/", 0) + 1);
    $approval = $value;

302
    #
303 304 305 306 307 308 309 310 311 312 313 314
    # Corresponding trust value.
    #
    $foo      = "$user\$\$trust-$project/$group";
    $newtrust = $$foo;

    #
    # Get the current status for the user, which we might need to change.
    #
    # We change the status only if this person is joining his first project.
    # In this case, the status will be either "newuser" or "unapproved",
    # and we will change it to "unapproved" or "active", respectively.
    # If the status is "active", we leave it alone. 
315
    #
316 317
    if (! ($target_user = User::Lookup($user))) {
	TBERROR("Trying to approve unknown user $user.", 1);
318
    }
319 320 321
    $curstatus  = $target_user->status();
    $user_email = $target_user->email();
    $user_name  = $target_user->name();
322 323
    #echo "Status = $curstatus, Email = $user_email<br>\n";

324 325 326 327 328 329 330 331
    # Ditto the project and group
    if (! ($target_project = Project::Lookup($project))) {
	TBERROR("Trying to approve user into unknown project $project.", 1);
    }
    if (! ($target_group = Group::LookupByPidGid($project, $group))) {
	TBERROR("Trying to approve user into unknown group $group", 1);
    }

332 333
    #
    # Email info for current user.
334 335 336
    #
    $uid_name  = $this_user->name();
    $uid_email = $this_user->email();
337 338

    #
339
    # Email info for the proj/group leaders too.
340
    #
341
    $leaders = $target_group->LeaderMailList();
342
    
343 344 345 346 347
    #
    # Well, looks like everything is okay. Change the project membership
    # value appropriately.
    #
    if (strcmp($approval, "postpone") == 0) {
348 349 350
	echo "<p>
                  Membership status for user $user in $project/$group was
                  <b>postponed</b> for later decision.\n";
351 352 353 354
        continue;
    }
    if (strcmp($approval, "deny") == 0) {
        #
Leigh B. Stoller's avatar
Leigh B. Stoller committed
355 356
        # Must delete the group_membership record since we require that the 
        # user reapply once denied. Send the luser email to let him know.
357
        #
358
	$target_group->DeleteMember($target_user);
Leigh B. Stoller's avatar
Leigh B. Stoller committed
359

360 361
        TBMAIL("$user_name '$user' <$user_email>",
             "Membership Denied in '$project/$group'",
362 363
	     "\n".
             "This message is to notify you that you have been denied\n".
364
	     "membership in project/group $project/$group.\n".
365 366
             "\n\n".
             "Thanks,\n".
367
             "Testbed Operations\n",
368
             "From: $uid_name <$uid_email>\n".
369
             "Cc:  $leaders\n".
370
             "Bcc: $TBMAIL_AUDIT\n".
371 372
             "Errors-To: $TBMAIL_WWW");

373 374 375 376
	echo "<p>
                User $user was <b>denied</b> membership in $project/$group.
                <br>
                The user will need to reapply again if this was in error.\n";
377 378 379

	continue;
    }
380 381
    if (strcmp($approval, "nuke") == 0) {
        #
Leigh B. Stoller's avatar
Leigh B. Stoller committed
382 383
        # Must delete the group_membership record since we require that the 
        # user reapply once denied. Send the luser email to let him know.
384
        #
385
	$target_group->DeleteMember($target_user);
386 387 388

	#
	# See if user is in any other projects (even unapproved).
Leigh B. Stoller's avatar
Leigh B. Stoller committed
389
	#
390
	$project_list = $target_user->ProjectMembershipList();
391 392 393 394

	#
	# If yes, then we cannot safely delete the user account.
	#
395
	if (count($project_list)) {
396 397 398
	    echo "<p>
                  User $user was <b>denied</b> membership in $project/$group.
                  <br>
399
                  Since the user is a member (or requesting membership)
400
		  in other projects, the account cannot be safely removed.\n";
401 402 403 404 405 406 407 408 409 410 411 412
	    
	    continue;
	}

	#
	# No other project membership. If the user is unapproved/newuser, 
	# it means he was never approved in any project, and so will
	# likely not be missed. He will be unapproved if he did his
	# verification.
	#
	if (strcmp($curstatus, "newuser") &&
	    strcmp($curstatus, "unapproved")) {
413 414 415
	    echo "<p>
                  User $user was <b>denied</b> membership in $project/$group.
                  <br>
416 417
                  Since the user has been approved by, or was active in other
		  projects in the past, the account cannot be safely removed.
418
                  \n";
419 420
	    continue;
	}
421
	SUEXEC($uid, $TBADMINGROUP, "webrmuser -n -p $project $user", 1); 
422

423 424 425
	echo "<p>
                User $user was <b>denied</b> membership in $project/$group.
                <br>
426
		The account has also been <b>terminated</b>!\n";
427 428 429

	continue;
    }
430 431 432 433 434 435 436 437 438 439 440 441 442
    if (strcmp($approval, "approve") == 0) {
        #
        # Change the status if necessary. This only happens for new
	# users being added to their first project. After this, the status is
        # going to be "active", and we just leave it that way.
	#
        if (strcmp($curstatus, "active")) {
	    if (strcmp($curstatus, "newuser") == 0) {
		$newstatus = "unverified";
            }
	    elseif (strcmp($curstatus, "unapproved") == 0) {
		$newstatus = "active";
	    }
443 444 445
	    elseif (strcmp($curstatus, "unverified") == 0) {
		$newstatus = "unverified";
	    }
446 447 448 449
	    else {
	        TBERROR("Invalid $user status $curstatus in approveuser.php3",
                         1);
	    }
450 451
	    if (!($user_interface = TBGetDefaultProjectUserInterface($project)))
		$user_interface = TBDB_USER_INTERFACE_EMULAB;
452 453 454

	    $target_user->SetUserInterface($user_interface);
	    $target_user->SetStatus($newstatus);
455 456 457 458 459

            #
            # Create user account on control node.
            #
	    SUEXEC($uid, $TBADMINGROUP, "webtbacct add $user", 1);
460
	}
461 462 463 464 465
        #
	# Only need to add new membership.
	# 
	SUEXEC($uid, $TBADMINGROUP,
	       "webmodgroups -a $project:$group:$newtrust $user", 1);
466

467 468
        TBMAIL("$user_name '$user' <$user_email>",
             "Membership Approved in '$project/$group' ",
469 470
	     "\n".
	     "This message is to notify you that you have been approved\n".
471 472
	     "as a member of project/group $project/$group with\n".
	     "$newtrust permissions.\n".
473 474
             "\n\n".
             "Thanks,\n".
475
             "Testbed Operations\n",
476
             "From: $uid_name <$uid_email>\n".
477
             "Cc:  $leaders\n".
478
             "Bcc: $TBMAIL_AUDIT\n".
479 480
             "Errors-To: $TBMAIL_WWW");

481 482 483 484
	echo "<p>
                  User $user was <b>granted</b> membership in $project/$group
                  with $newtrust permissions.\n";
		
485 486 487 488
	continue;
    }
}

489 490 491 492
#
# Standard Testbed Footer
# 
PAGEFOOTER();
493
?>