Mostly a big clean up, moving code out of the old sup file,

and into the js files associated with the code.

www/aptui/instantiate.php

@@ -56,6 +56,14 @@ $optargs = OptionalPageArguments("create",        PAGEARG_STRING,
 #
 if (isset($ajax_request)) {
     if ($ajax_method == "getprofile") {
+	#
+	# We require the UUID on this path, until proper permission
+	# checks are done; too easy to guess an index.
+	#
+	if (!IsValidUUID($ajax_argument)) {
+	    SPITAJAX_ERROR(1, "Not a valid UUID: $ajax_argument");
+	    exit();
+	}
 	$obj = Profile::Lookup($ajax_argument);
 	if (!$obj) {
 	    SPITAJAX_ERROR(1, "No such profile $ajax_argument");
@@ -80,25 +88,42 @@ $profile_array    = array();
 # add to the array now since it might not be public or belong to the user.
 #
 if (isset($profile)) {
-    if (preg_match("/^\w+\-\w+\-\w+\-\w+\-\w+$/", $profile)) {
-	$obj = Profile::Lookup($profile);
-	if (! $obj) {
-	    SPITHEADER(1);
-	    SPITUSERERROR("No such profile: $profile");
-	    echo "<script src='js/lib/require.js' data-main='js/null'>
-                  </script>\n";
-	    SPITFOOTER();
-	}
+    #
+    # Guest users must use the uuid, but logged in users may use the
+    # internal index.
+    #
+    if (! ($this_user || IsValidUUID($profile))) {
+	SPITUSERERROR("Illegal profile for guest user: $profile");
+	exit();
+    }
+    $obj = Profile::Lookup($profile);
+    if (! $obj) {
+	SPITUSERERROR("No such profile: $profile");
+	exit();
+    }
+    if (IsValidUUID($profile)) {
 	$profile_array[$profile] = $obj->name();
 	$profilename = $obj->name();
     }
     else {
-	$profilename = $profile;
+	#
+	# Must be public or belong to user. 
+	#
+	if (! ($obj->ispublic() ||
+	       $obj->creator_idx == $this_user->uid_idx())) {
+	    SPITUSERERROR("No permission to use profile: $profile");
+	    exit();
+	}
+	$profile = $obj->uuid();
+	$profile_array[$profile] = $obj->name();
+	$profilename = $obj->name();
     }
 }
 
 #
-# Still do this cause of non-secret URLs. This needs more work.
+# Find all the public and user profiles. We use the UUID instead of
+# indicies cause we do not want to leak internal DB state to guest
+# users.
 #
 $query_result =
     DBQueryFatal("select * from apt_profiles ".

www/aptui/js/instantiate.js

@@ -10,14 +10,14 @@ function ($, sup)
     function initialize()
     {
 	window.APT_OPTIONS.initialize(sup);
-        sup.UpdateProfileSelection($('#profile_name li[value = ' + window.PROFILE + ']'));
+
         $('#quickvm_topomodal').on('hidden.bs.modal', function() {
-            sup.ShowProfileList($('.current'))
+            ShowProfileList($('.current'))
         });
 
 	$('button#reset-form').click(function (event) {
 	    event.preventDefault();
-	    sup.resetForm($('#quickvm_form'));
+	    resetForm($('#quickvm_form'));
 	});
 	$('button#profile').click(function (event) {
 	    event.preventDefault();
@@ -25,13 +25,92 @@ function ($, sup)
 	});
 	$('li.profile-item').click(function (event) {
 	    event.preventDefault();
-	    sup.ShowProfileList(event.target);
+	    ShowProfileList(event.target);
 	});
 	$('button#showtopo_select').click(function (event) {
 	    event.preventDefault();
-	    sup.UpdateProfileSelection($('.selected'));
+	    UpdateProfileSelection($('.selected'));
 	    sup.HideModal('#quickvm_topomodal');
 	});
+
+        UpdateProfileSelection($('#profile_name li[value = ' +
+				 window.PROFILE + ']'));
+    }
+
+    function resetForm($form) {
+	$form.find('input:text, input:password, select, textarea').val('');
+    }
+    
+    function UpdateProfileSelection(selectedElement)
+    {
+	var profile_name = $(selectedElement).text();
+	var profile_value = $(selectedElement).attr('value');
+	$('#selected_profile').attr('value', profile_value);
+	$('#selected_profile_text').html("" + profile_name);
+
+	if (!$(selectedElement).hasClass('current')) {
+	    $('#profile_name li').each(function() {
+		$(this).removeClass('current');
+	    });
+	    $(selectedElement).addClass('current');
+	}
+	ShowProfileList(selectedElement);
+    }
+
+    function ShowProfileList(selectedElement)
+    {
+	var profile = $(selectedElement).attr('value');
+
+	if (!$(selectedElement).hasClass('selected')) {
+	    $('#profile_name li').each(function() {
+		$(this).removeClass('selected');
+	    });
+	    $(selectedElement).addClass('selected');
+	}
+
+	var callback = function(json) {
+	    console.info(json.value);
+
+	    if (json.code) {
+		alert("Could not get profile: " + json.value);
+		return;
+	    }
+	    
+	    var xmlDoc = $.parseXML(json.value.rspec);
+	    var xml    = $(xmlDoc);
+	    var topo   = sup.ConvertManifestToJSON(profile, xml);
+    
+	    $('#showtopo_title').html("<h3>" + json.value.name + "</h3>");
+
+	    /*
+	     * We now use the desciption from inside the rspec, unless there
+	     * is none, in which case look to see if the we got one in the
+	     * rpc reply, which we will until all profiles converted over to
+	     * new format rspecs.
+	     */
+	    var description = null;
+	    $(xml).find("rspec_tour").each(function() {
+		$(this).find("description").each(function() {
+		    description = $(this).text();
+		});
+	    });
+	    if (!description) {
+		if (json.value.description != "") {
+		    description = json.value.description;
+		}
+		else {
+		    description = "Hmm, no description for this profile";
+		}
+	    }
+	    $('#showtopo_description').html(description);
+	    $('#selected_profile_description').html(description);
+
+	    sup.maketopmap("#showtopo_div",
+			   ($("#showtopo_div").outerWidth()),
+			   300, topo, null);
+	}
+	var $xmlthing = sup.CallMethod("getprofile", null, 0, profile);
+	$xmlthing.done(callback);
     }
 
     $(document).ready(initialize);

www/aptui/js/manage_profile.js

@@ -39,7 +39,6 @@ function ($, sup)
 		    $('#profile_rspec_textarea').val(content);
 
 		    ExtractFromRspec(xml);
-		    //ShowRspecTopo(xml);
 		};
 		reader.readAsText(this.files[0]);
 	});
@@ -205,9 +204,10 @@ function ($, sup)
 		    removeLast: true
 		},
 		columns: [
-                    { name: 'Type', display: 'Type', type: 'text',
+                    { name: 'Type', display: 'Type', type: 'select',
 		      ctrlAttr: { maxlength: 100 },
-		      ctrlCss: { width: '80px'}
+		      ctrlCss: { width: '80px'},
+		      ctrlOptions: ["node", "link"],
 		    },
                     { name: 'ID', display: 'ID', type: 'text',
 		      ctrlAttr: { maxlength: 100,
@@ -221,6 +221,9 @@ function ($, sup)
 		initData: steps
 	    });
 	});
+	
+	// Show the steps area.
+	$('#profile_steps_div').removeClass("hidden");
     }
 
     //
@@ -376,7 +379,7 @@ function ($, sup)
 	// Subtract -2 cause of the border. 
 	sup.maketopmap("#showtopo_nopicker",
  		   ($("#showtopo_nopicker").outerWidth() - 2),
-		   300, topo);
+		       300, topo, null);
     }
 
     $(document).ready(initialize);

www/aptui/js/myprofiles.js

@@ -63,7 +63,7 @@ function ($, sup)
 	    // Subtract -2 cause of the border. 
 	    sup.maketopmap("#showtopo_nopicker",
  			   ($("#showtopo_nopicker").outerWidth() - 2),
-			   300, topo);
+			   300, topo, null);
 	};
 	var $xmlthing = sup.CallMethod("getprofile", null, 0, profile);
 	$xmlthing.done(callback);

www/aptui/js/signup.js

@@ -12,13 +12,17 @@ function ($, sup)
 	window.APT_OPTIONS.initialize(sup);
  	$('button#reset-form').click(function (event) {
 	    event.preventDefault();
-	    sup.resetForm($('#quickvm_signup_form'));
+	    resetForm($('#quickvm_signup_form'));
 	});
 	if (window.APT_OPTIONS.ShowVerifyModal)
 	{
 	    sup.ShowModal('#verify_modal');
 	}
     }
+    
+    function resetForm($form) {
+	$form.find('input:text, input:password, select, textarea').val('');
+    }
 
     $(document).ready(initialize);
 });

www/aptui/js/sshterm.js

-window.APT_OPTIONS.config();
-
-require(['jquery', 'js/quickvm_sup',
-	 // jQuery modules
-	 'bootstrap', 'formhelpers'],
-function ($, sup)
-{
-    'use strict';
-
-    function initialize()
-    {
-	window.APT_OPTIONS.initialize(sup);
-	sup.StartSSH('sshpanel', window.APT_OPTIONS.authObject);
-    }
-
-    $(document).ready(initialize);
-});

www/aptui/myexperiments.php

@@ -55,14 +55,10 @@ if (!isset($target_user)) {
 }
 if (!$this_user->SameUser($target_user)) {
     if (!ISADMIN()) {
-	SPITHEADER(1);
 	SPITUSERERROR("You do not have permission to view ".
 		      "target user's profiles");
-	echo "<script src='js/lib/require.js' data-main='js/null'>
-                  </script>\n";
-	SPITFOOTER();
+	exit();
     }
-    exit();
 }
 $target_idx  = $target_user->uid_idx();
 $target_uuid = $target_user->uuid();
@@ -78,15 +74,14 @@ $query_result =
 		  "order by creator" : "where creator_uuid='$target_uuid'"));
 
 if (mysql_num_rows($query_result) == 0) {
-    echo "<b>No experiments to show you. Maybe you want to ".
-	"<a href='instantiate.php'>start one?</a></b><br><br>\n";
-if (ISADMIN()) {
-    echo "<img src='/redball.gif'>
-          <a href='myexperiments.php?all=1'>Show all user Experiments</a>\n";
-}
-    echo "<script src='js/lib/require.js' data-main='js/null'>
-          </script>\n";
-    SPITFOOTER();
+    $message = "<b>No experiments to show you. Maybe you want to ".
+	"<a href='instantiate.php'>start one?</a></b><br><br>";
+
+    if (ISADMIN()) {
+	$message .= "<img src='/redball.gif'>".
+	    "<a href='myexperiments.php?all=1'>Show all user Experiments</a>";
+    }
+    SPITUSERERROR($message);
     exit();
 }
 echo "<div class='row'>

www/aptui/myprofiles.php

@@ -58,12 +58,8 @@ if (!$this_user->SameUser($target_user)) {
 	    SPITAJAX_ERROR(1, "You do not have permission to do this");
 	}
 	else {
-	    SPITHEADER(1);
 	    SPITUSERERROR("You do not have permission to view ".
 			  "target user's profiles");
-	    echo "<script src='js/lib/require.js' data-main='js/null'>
-                  </script>\n";
-	    SPITFOOTER();
 	}
 	exit();
     }
@@ -107,11 +103,14 @@ $query_result =
 		  "order by creator" : "where creator_idx='$target_idx'"));
 
 if (mysql_num_rows($query_result) == 0) {
-    echo "<b>No profiles to show you. Maybe you want to ".
-	"<a href='manage_profile.php'>create one?</a></b>\n";
-    echo "<script src='js/lib/require.js' data-main='js/null'>
-          </script>\n";
-    SPITFOOTER();
+    $message = "<b>No profiles to show you. Maybe you want to ".
+	"<a href='manage_profile.php'>create one?</a></b><br><br>";
+
+    if (ISADMIN()) {
+	$message .= "<img src='/redball.gif'>".
+	    "<a href='myprofiles.php?all=1'>Show all user Profile</a>";
+    }
+    SPITUSERERROR($message);
     exit();
 }
 echo "<div class='row'>

www/aptui/quickvm_sup.php

@@ -45,7 +45,7 @@ if ($TBMAINSITE && $_SERVER["SERVER_NAME"] == "www.aptlab.net") {
 }
 
 #
-# Redefine this so APT errors are styled properly.
+# Redefine this so APT errors are styled properly. Called by PAGEERROR();.
 #
 $PAGEERROR_HANDLER = function($msg, $status_code = 0) {
     global $drewheader;
@@ -481,6 +481,7 @@ function RedirectLoginPage()
     # pass in the URI for this page as an argument
     header("Location: login.php?referrer=".
 	   urlencode($_SERVER['REQUEST_URI']));
+    
 }
 
 function SpitAboutApt()

www/aptui/sshterm.php

-<?php
-#
-# Copyright (c) 2000-2013 University of Utah and the Flux Group.
-# 
-# {{{EMULAB-LICENSE
-# 
-# This file is part of the Emulab network testbed software.
-# 
-# This file is free software: you can redistribute it and/or modify it
-# under the terms of the GNU Affero General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or (at
-# your option) any later version.
-# 
-# This file is distributed in the hope that it will be useful, but WITHOUT
-# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public
-# License for more details.
-# 
-# You should have received a copy of the GNU Affero General Public License
-# along with this file.  If not, see <http://www.gnu.org/licenses/>.
-# 
-# }}}
-#
-chdir("..");
-include("defs.php3");
-chdir("apt");
-include("quickvm_sup.php");
-
-#$node_id     = "localhost";
-#$uid         = "stoller";
-#$auth_object = SSHAuthObject($uid, $node_id);
-
-SPITHEADER();
-
-echo "<div class='panel panel-default'>\n";
-echo "<div class='panel-body'>\n";
-
-echo "<ul class='nav nav-tabs'>
-      <li><a href='#home' data-toggle='tab'>Home</a></li>
-      <li><a href='#sshpanel' data-toggle='tab'>Profile</a></li>
-      <li><a href='#messages' data-toggle='tab'>Messages</a></li>
-      <li><a href='#settings' data-toggle='tab'>Settings</a></li>
-    </ul>
-   <div class='tab-content'>
-   <div class='tab-pane' id='home'>...</div>
-   <div class='tab-pane active' id='sshpanel'>...</div>
-   <div class='tab-pane' id='messages'>...</div>
-   <div class='tab-pane' id='settings'>...</div>
- </div>\n";
-
-echo "</div>\n";
-echo "</div>\n";
-
-echo "<script type='text/javascript'>\n";
-echo "window.APT_OPTIONS.authObject = '" . $auth_object . "';\n";
-echo "</script>\n";
-echo "<script src='js/lib/require.js' data-main='js/sshterm'></script>";
-
-SPITFOOTER();
-?>
-
-

www/aptui/status.php

@@ -403,10 +403,15 @@ echo "<!-- This is a modal -->
           <button type='button' class='close' data-dismiss='modal'
                    aria-hidden='true'>&times;</button>
           <div class='clearfix'></div>
-          <div class='row'>
-            <div class='col-lg-7 col-md-7'
-                 style='padding-right:20px; border-right: 1px solid #ccc;'>
-                <h4>Extend for 24 hours</h4>
+          <div class='row'>\n";
+if ($this_user) {
+    echo "   <div class='col-sm-12'>";
+}
+else {
+    echo "   <div class='col-lg-7 col-md-7' ".
+	"         style='padding-right:20px; border-right: 1px solid #ccc;'>";
+}
+echo "        <h4>Extend for 24 hours</h4>
                 If you want to extend this experiment so that it does
                 not self-terminate at the time shown, just tell us why
                 and we will extend it for another 24 hours.
@@ -425,8 +430,9 @@ echo "<!-- This is a modal -->
 	               id='request-extension'
                        type='submit' name='request'>Request Extension</button>
               </form>
-            </div>
-            <div class='col-lg-5 col-md-5'>
+            </div>\n";
+if (!$this_user) {
+    echo "  <div class='col-lg-5 col-md-5'>
                <h4>Extend for longer</h4>
                If you want to be able to use resources for more than 24
                    hours, you will need to <a href='signup.php'>sign up</a>
@@ -435,8 +441,9 @@ echo "<!-- This is a modal -->
                       href='#quickvm_login_modal'
                       data-target='#quickvm_login_modal'>log in</a> if you 
                       already have an acount at aptlab.net or emulab.net</a>
-            </div>
-            </div>
+            </div>\n";
+}
+echo "      </div>
             </div>
            </div>
         </div>