diff --git a/www/loadimage.php3 b/www/loadimage.php3 index be757f654d052aa6cb79b9c751edc4d6aa311c44..d16882d464cad45e7af1611ffcf8067c2be26441 100644 --- a/www/loadimage.php3 +++ b/www/loadimage.php3 @@ -1,12 +1,19 @@ <?php # # EMULAB-COPYRIGHT -# Copyright (c) 2000-2004, 2006 University of Utah and the Flux Group. +# Copyright (c) 2000-2007 University of Utah and the Flux Group. # All rights reserved. # include("defs.php3"); include("showstuff.php3"); +# +# Only known and logged in users. +# +$this_user = CheckLoginOrDie(); +$uid = $this_user->uid(); +$isadmin = ISADMIN(); + # This will not return if its a sajax request. include("showlogfile_sup.php3"); @@ -15,13 +22,6 @@ include("showlogfile_sup.php3"); # PAGEHEADER("Snapshot Node Disk into Existing Image Descriptor"); -# -# Only known and logged in users. -# -$this_user = CheckLoginOrDie(); -$uid = $this_user->uid(); -$isadmin = ISADMIN(); - if (! isset($imageid)) { USERERROR("Must pass image name to page as 'imageid'.", 1 ); } diff --git a/www/showlogfile_sup.php3 b/www/showlogfile_sup.php3 index 8f74bccf72897631dfa63e9a32bfbd663ac80e8c..66a66c57dc649b359bec340a1f51b235680f0caa 100644 --- a/www/showlogfile_sup.php3 +++ b/www/showlogfile_sup.php3 @@ -1,7 +1,7 @@ <?php # # EMULAB-COPYRIGHT -# Copyright (c) 2005, 2006 University of Utah and the Flux Group. +# Copyright (c) 2005, 2006, 2007 University of Utah and the Flux Group. # All rights reserved. # require_once("Sajax.php"); @@ -16,7 +16,7 @@ if (sajax_client_request()) { } function CHECKPAGEARGS($pid, $eid) { - global $uid, $TB_EXPT_READINFO; + global $this_user, $TB_EXPT_READINFO; # # Verify page arguments. @@ -36,16 +36,25 @@ function CHECKPAGEARGS($pid, $eid) { PAGEARGERROR("Invalid experiment ID."); } + # + # If $this_user is not set, someone got confused. + # + if (!isset($this_user)) { + TBERROR("Current user is not defined in CHECKPAGEARGS()", 1); + } + # # Check to make sure this is a valid PID/EID tuple. # - if (! TBValidExperiment($pid, $eid)) { + $experiment = Experiment::LookupByPidEid($pid, $eid); + if (! $experiment) { USERERROR("The experiment $pid/$eid is not a valid experiment!", 1); } + # # Verify permission. # - if (! TBExptAccessCheck($uid, $pid, $eid, $TB_EXPT_READINFO)) { + if (! $experiment->AccessCheck($this_user, $TB_EXPT_READINFO)) { USERERROR("You do not have permission to view the log for $pid/$eid!", 1); } }