diff --git a/www/TODO b/www/TODO index 09b351bc62a32df6e29c862bcf6b3081a433f95e..c66320a01fa72036de1f48164f7fa446addb8301 100644 --- a/www/TODO +++ b/www/TODO @@ -8,9 +8,10 @@ importance should be obvious. Whoever does this work *will* program in the dominate style of the existing, newly written, 4500 lines of code! Now, if I could just figure out how to add a php mode to emacs ... -* Add password hint for the clueless users who forget their passwords. +* Add DB connect as authorized user so we can track whats going in + the DB log files. -* tbend should work from the database, not the .ir file. +* Add password hint for the clueless users who forget their passwords. * Put a limit on the number of new users/projects that can be unapproved (to prevent DOS attacks on the database). @@ -30,11 +31,7 @@ I could just figure out how to add a php mode to emacs ... include the uid in the existing cookie (the one I added to send back the hash key). -* Look at the 'suexec' program from the Apache distribution and use it - as the basis for the "run as a user" program. Instead of checking - the home directory, it'll check the database. - -* Fix the email list problem. Right now we add people people to the two +* Fix the email list problem. Right now we add people to the two email list files in /usr/testbed/www/maillist when they apply. We should either delay that until they are approved, or make sure they get taken back out when denied. @@ -54,19 +51,12 @@ I could just figure out how to add a php mode to emacs ... certificates. I'm not too crazy about this unless its easy to do all of it on my home machine (apache server). -* Continue to hook up the backend parts of the system, which right now is a - major unfinished piece of business. - * More linking of information in the forms. There are some obvious places where stuff should be presented as hypertext links so that navigation is easier. * Backup links in all the pages. -* Change to ?uid=stoller&pid=testbed style arguments in all the pages I - have not yet fixed (that is, get rid of that regex thing at the top of - the page to find the arguments). - * Admin page to remove a project. * Admin page to remove a user. @@ -82,8 +72,6 @@ I could just figure out how to add a php mode to emacs ... experiment name, downcase it. Mac was going to do this, but I don't know if he got to it. -* Get people to go use the pages (including modify user information!). - * Lastly, macrofy the entire thing and get rid the damn frames! I hate frames! diff --git a/www/addusr.php3 b/www/addusr.php3 index a98ec9643a8dc0e10a4a701d0b4ef83af4d5f443..978a60dffe5b46b938e7ae1a5b9bdd4ecb464f9f 100755 --- a/www/addusr.php3 +++ b/www/addusr.php3 @@ -3,20 +3,17 @@ include("defs.php3"); PAGEHEADER("New User"); -$uid = ""; -if ( ereg("php3\?([[:alnum:]]+)",$REQUEST_URI,$Vals) ) { - $uid=$Vals[1]; - addslashes($uid); -} else { - unset($uid); -} +# +# Get current user. +# +$uid = GETLOGIN(); # # If a uid came in, then we check to see if the login is valid. # If the login is not valid, then quit cause we don't want to display the # personal information for some random ?uid argument. # -if (isset($uid)) { +if ($uid) { if (CHECKLOGIN($uid) != 1) { USERERROR("You are not logged in. Please log in and try again.", 1); } diff --git a/www/approveproject.php3 b/www/approveproject.php3 index 51c6fbe2e4089b9a8231fbcc97d0cb8a06414c8c..996532b6bad90282e5c476832f17626d85426e9a 100644 --- a/www/approveproject.php3 +++ b/www/approveproject.php3 @@ -9,6 +9,7 @@ PAGEHEADER("New Project Approved"); # # Only known and logged in users can do this. # +$uid = GETLOGIN(); LOGGEDINORDIE($uid); # diff --git a/www/approveproject_form.php3 b/www/approveproject_form.php3 index 873d3d0e9cbe83c51725fa26a52c2a5fb6e7d7f4..a86ba0eaca7916f9c091b703b9cb3e7c57719ebf 100755 --- a/www/approveproject_form.php3 +++ b/www/approveproject_form.php3 @@ -9,6 +9,7 @@ PAGEHEADER("New Project Approval"); # # Only known and logged in users can do this. # +$uid = GETLOGIN(); LOGGEDINORDIE($uid); # @@ -19,6 +20,14 @@ if (! $isadmin) { USERERROR("You do not have admin privledges to approve projects!", 1); } +# +# Verify arguments. +# +if (!isset($pid) || + strcmp($pid, "") == 0) { + USERERROR("You must provide a project ID.", 1); +} + echo "