gosa-plugins/sudo/admin/sudo/class_sudoManagement.inc

   1 <?php
   2 /*
   3  * This code is part of GOsa (http://www.gosa-project.org)
   4  * Copyright (C) 2003-2008 GONICUS GmbH
   5  *
   6  * ID: $$Id: class_sudoManagement.inc 10099 2008-04-01 12:52:01Z hickert $$
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation; either version 2 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, write to the Free Software
  20  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  21  */
  22
  23 /*! \brief This is the sudo management class. \
  24            This class allows to add/remove/edit sudo roles with GOsa. \
  25            All roles will be listed by this plugin, the displayed objects \
  26             can also be filtered.
  27 */
  28 class sudoManagement extends plugin
  29 {
  30   /* Definitions */
  31   public $plHeadline     = "Sudo roles";
  32   public $plDescription  = "Manage sudo roles";
  33
  34   private $DivListSudo    = NULL;
  35   private $sudotabs       = NULL;
  36   private $base           = "";
  37
  38   private $start_pasting_copied_objects = FALSE;
  39
  40   public $acl_module = array("sudo");
  41
  42   /*! \brief */
  43   public function __construct(&$config, &$ui)
  44   {
  45     /* Save configuration for internal use */
  46     $this->config = &$config;
  47     $this->ui     = &$ui;
  48     $this->base   = sudo::get_sudoers_ou($this->config);
  49
  50     /* Copy & Paste enabled ?*/
  51     if((isset($this->config->data['MAIN']['ENABLECOPYPASTE']))&&(preg_match("/true/i",$this->config->data['MAIN']['ENABLECOPYPASTE']))){
  52       $this->CopyPasteHandler = new CopyPasteHandler($this->config);
  53     }
  54
  55     /* Create dialog object */
  56     $this->DivListSudo = new divListSudo($this->config,$this);
  57   }
  58
  59
  60   /*! \brief Generate && Display HTML content
  61    */
  62   public function execute()
  63   {
  64     /* Call parent execute */
  65     plugin::execute();
  66
  67     /********************
  68       Handle Posts
  69      ********************/
  70
  71     /* Store these posts if the current object is locked (used by somebody else)*/
  72     session::set('LOCK_VARS_TO_USE',array(
  73           "/^act$/","/^id$/","/^sudo_edit_/","/^cut_/","/^copy_/",
  74           "/^sudo_del_/","/^item_selected/","/menu_action/"));
  75
  76
  77     /* Get html posts */
  78     $s_action   = "";
  79     $s_entry    = "";
  80     foreach($_POST as $name => $value){
  81       if(preg_match("/^sudo_edit_/",$name)){
  82         $s_action = "edit_role";
  83         $s_entry  = preg_replace("/^sudo_edit_([0-9]*).*$/","\\1",$name);
  84       }
  85       if(preg_match("/^sudo_del_/",$name)){
  86         $s_action = "del_role";
  87         $s_entry  = preg_replace("/^sudo_del_([0-9]*).*$/","\\1",$name);
  88       }elseif(preg_match("/^editPaste.*/i",$name)){
  89         $s_action="editPaste";
  90       }elseif(preg_match("/^copy_.*/",$name)){
  91         $s_action="copy";
  92         $s_entry  = preg_replace("/^copy_([0-9]*).*$/i","\\1",$name);
  93 #      }elseif(preg_match("/^cut_.*/",$name)){
  94 #        $s_action="cut";
  95 #        $s_entry  = preg_replace("/^cut_([0-9]*).*$/i","\\1",$name);
  96       }
  97     }
  98
  99     if(isset($_GET['act']) && isset($_GET['id']) && $_GET['act'] == "edit_entry"){
 100       $id = trim($_GET['id']);
 101       if(isset($this->list[$id])){
 102         $s_action = "edit_role";
 103         $s_entry  = $id;
 104       }
 105     }
 106
 107     if(isset($_POST['menu_action']) && in_array($_POST['menu_action'],array("new_role","del_role","new_default","editPaste"))){
 108       $s_action = $_POST['menu_action'];
 109     }
 110
 111     /* handle C&P from layers menu */
 112     if(isset($_POST['menu_action']) && preg_match("/^multiple_copy_systems/",$_POST['menu_action'])){
 113       $s_action = "copy_multiple";
 114     }
 115
 116     $smarty= get_smarty();
 117
 118     /********************
 119       Copy & Paste Handling  ...
 120      ********************/
 121
 122     /* Display the copy & paste dialog, if it is currently open */
 123     $ret = $this->copyPasteHandling_from_queue($s_action,$s_entry);
 124     if($ret){
 125       return($ret);
 126     }
 127
 128
 129     /********************
 130       Create a new sudo  ...
 131      ********************/
 132
 133     /* New sudo? */
 134     if ($s_action=="new_role" || $s_action == "new_default"){
 135
 136       /* Check create permissions */
 137       $acl = $this->ui->get_permissions($this->base,"sudo/sudo");
 138       if(preg_match("/c/",$acl)){
 139
 140         /* By default we set 'dn' to 'new', all relevant plugins will
 141            react on this. */
 142         $this->dn= "new";
 143
 144         /* Create new sudotabs object */
 145         $this->sudotabs= new sudotabs($this->config, $this->config->data['TABS']['SUDOTABS'], $this->dn);
 146
 147         /* Set up the sudo ACL's for this 'dn' */
 148         $this->sudotabs->set_acl_base($this->base);
 149
 150         /* This entry will become the default entry */
 151         if($s_action == "new_default"){
 152           $this->sudotabs->set_default(TRUE);
 153         }
 154       }
 155     }
 156
 157
 158     /********************
 159       Save Sudo Tab/Object Changes
 160      ********************/
 161
 162     /* Save changes */
 163     if ((isset($_POST['edit_finish']) || isset($_POST['edit_apply'])) && is_object($this->sudotabs)){
 164
 165       /* Check tabs, will feed message array
 166          Save, or display error message? */
 167       $message= $this->sudotabs->check();
 168       if (count($message) == 0){
 169
 170         /* Save user data to ldap */
 171         $this->sudotabs->save();
 172
 173         if (!isset($_POST['edit_apply'])){
 174
 175           /* Sudo has been saved successfully, remove lock from LDAP. */
 176           if ($this->dn != "new"){
 177             $this->remove_lock();
 178           }
 179           unset ($this->sudotabs);
 180           $this->sudotabs= NULL;
 181           session::un_set('objectinfo');
 182         }else{
 183
 184           /* Reinitialize tab */
 185           if($this->sudotabs instanceof tabs){
 186             $this->sudotabs->re_init();
 187           }
 188         }
 189       } else {
 190         /* Ok. There seem to be errors regarding to the tab data,
 191            show message and continue as usual. */
 192         msg_dialog::displayChecks($message);
 193       }
 194     }
 195
 196
 197     /********************
 198       Edit existing role
 199      ********************/
 200
 201     /* User wants to edit data? */
 202     if (($s_action=="edit_role") &&  !is_object($this->sudotabs)){
 203
 204       /* Get 'dn' from posted 'uid', must be unique */
 205       $this->dn= $this->list[trim($s_entry)]['dn'];
 206
 207       /* Check locking & lock entry if required */
 208       $user = get_lock($this->dn);
 209       if ($user != ""){
 210         return(gen_locked_message ($user, $this->dn));
 211       }
 212       add_lock ($this->dn, $this->ui->dn);
 213
 214       /* Register sudotabs to trigger edit dialog */
 215       $this->sudotabs= new sudotabs($this->config,$this->config->data['TABS']['SUDOTABS'], $this->dn);
 216       $this->sudotabs->set_acl_base($this->base);
 217       session::set('objectinfo',$this->dn);
 218     }
 219
 220
 221     /********************
 222       Delete entries requested, display confirm dialog
 223      ********************/
 224
 225     if ($s_action=="del_role"){
 226       $ids = $this->list_get_selected_items();
 227       if(!count($ids) && $s_entry!=""){
 228         $ids = array($s_entry);
 229       }
 230
 231       $this->dns = array();
 232       if(count($ids)){
 233         $disallowed = array();
 234         foreach($ids as $id){
 235           $dn = $this->list[$id]['dn'];
 236           $acl = $this->ui->get_permissions($dn, "sudo/sudo");
 237           if(preg_match("/d/",$acl)){
 238             $this->dns[$id] = $dn;
 239           }else{
 240             $disallowed[] = $dn;
 241           }
 242         }
 243
 244         if(count($disallowed)){
 245           msg_dialog::display(_("Permission"),msgPool::permDelete($disallowed),INFO_DIALOG);
 246         }
 247
 248         if(count($this->dns)){
 249
 250           /* Check locking of entries */
 251           $users = get_multiple_locks($this->dns);
 252           if(count($users)){
 253             return(gen_locked_message($users,$this->dns));
 254           }
 255
 256           /* Add locks */
 257           add_lock($this->dns,$this->ui->dn);
 258
 259           /* Lock the current entry, so nobody will edit it during deletion */
 260           $smarty->assign("info", msgPool::deleteInfo($this->dns,_("Sudo role")));
 261           return($smarty->fetch(get_template_path('remove.tpl', TRUE)));
 262         }
 263       }
 264     }
 265
 266
 267     /********************
 268       Delete entries confirmed
 269      ********************/
 270
 271     /* Confirmation for deletion has been passed. Sudo should be deleted. */
 272     if (isset($_POST['delete_sudos_confirmed'])){
 273
 274       /* Remove user by user and check acls before removeing them */
 275       foreach($this->dns as $key => $dn){
 276
 277         /* Load permissions for selected 'dn' and check if
 278            we're allowed to remove this 'dn' */
 279         $acl = $this->ui->get_permissions($dn,"sudo/sudo");
 280         if(preg_match("/d/",$acl)){
 281
 282           /* Delete request is permitted, perform LDAP action */
 283           $this->sudotabs= new sudotabs($this->config,$this->config->data['TABS']['SUDOTABS'], $dn);
 284           $this->sudotabs->set_acl_base($dn);
 285           $this->sudotabs->delete ();
 286           unset ($this->sudotabs);
 287           $this->sudotabs= NULL;
 288
 289         } else {
 290
 291           /* Normally this shouldn't be reached, send some extra
 292              logs to notify the administrator */
 293           msg_dialog::display(_("Permission error"), msgPool::permDelete(), ERROR_DIALOG);
 294           new log("security","sudo/".get_class($this),$dn,array(),"Tried to trick deletion.");
 295         }
 296       }
 297
 298       /* Remove lock file after successfull deletion */
 299       $this->remove_lock();
 300       $this->dns = array();
 301     }
 302
 303
 304     /********************
 305       Delete entries Canceled
 306      ********************/
 307
 308     /* Remove lock */
 309     if(isset($_POST['delete_sudo_cancel'])){
 310       $this->remove_lock();
 311       $this->dns = array();
 312     }
 313
 314     /********************
 315       A dialog was canceled
 316      ********************/
 317
 318     /* Cancel dialogs */
 319     if (isset($_POST['edit_cancel']) && is_object($this->sudotabs)){
 320       $this->remove_lock();
 321       $this->sudotabs= NULL;
 322       session::un_set('objectinfo');
 323     }
 324
 325
 326     /********************
 327       If there is currently a dialog open, display it
 328      ********************/
 329
 330     /* Show tab dialog if object is present */
 331     if (is_object($this->sudotabs)){
 332       $display= $this->sudotabs->execute();
 333
 334       /* Don't show buttons if tab dialog requests this */
 335       if(isset($this->sudotabs->by_object)){
 336         if (!$this->sudotabs->by_object[$this->sudotabs->current]->dialog){
 337           $display.= "<p style=\"text-align:right\">\n";
 338           $display.= "<input type=submit name=\"edit_finish\" style=\"width:80px\" value=\"".msgPool::okButton()."\">\n";
 339           $display.= "&nbsp;\n";
 340           if ($this->dn != "new"){
 341             $display.= "<input type=submit name=\"edit_apply\" value=\"".msgPool::applyButton()."\">\n";
 342             $display.= "&nbsp;\n";
 343           }
 344           $display.= "<input type=submit name=\"edit_cancel\" value=\"".msgPool::cancelButton()."\">\n";
 345           $display.= "</p>";
 346         }
 347       }
 348       return ($display);
 349     }
 350
 351     /* Check if there is a snapshot dialog open */
 352     if($str = $this->showSnapshotDialog(sudo::get_sudoers_ou($this->config),$this->get_used_snapshot_bases(),$this)){
 353       return($str);
 354     }
 355
 356     /* Display dialog with sudo list */
 357     $this->DivListSudo->execute();
 358     $this->reload ();
 359     $this->DivListSudo->setEntries($this->list);
 360     return($this->DivListSudo->Draw());
 361   }
 362
 363
 364   /*! \brief  Return all selected elements from HTML list
 365       @return Array List of all selected list elements
 366     */
 367   private function list_get_selected_items()
 368   {
 369     $ids = array();
 370     foreach($_POST as $name => $value){
 371       if(preg_match("/^item_selected_[0-9]*$/",$name)){
 372         $id   = preg_replace("/^item_selected_/","",$name);
 373         $ids[$id] = $id;
 374       }
 375     }
 376     return($ids);
 377   }
 378
 379
 380   /*! \brief  Reload the list of sudo roles.
 381    */
 382   private function reload($CreatePosixsList=false)
 383   {
 384     $this->list             = array();
 385     $base                   = $this->base;
 386
 387     $Regex                  = trim($this->DivListSudo->Regex);
 388     $UserRegex              = trim($this->DivListSudo->UserRegex);
 389     $SubSearch              = $this->DivListSudo->SubSearch;
 390
 391     /********************
 392       Create filter depending on selected checkboxes
 393      ********************/
 394     $values = array("cn","description","sudoUser","sudoCommand","sudoOption");
 395     if($UserRegex == "*"){
 396       $ff     = "(&(|(cn=".$Regex.")(description=".$Regex."))(objectClass=sudoRole))";
 397     }else{
 398       $ff     = "(&(|(cn=".$Regex.")(description=".$Regex."))(sudoUser=".$UserRegex.")(objectClass=sudoRole))";
 399     }
 400     $res = get_list($ff, "sudo",$base,$values, GL_SIZELIMIT);
 401     $tmp = array();
 402     foreach($res as $attrs){
 403       $tmp[$attrs['cn'][0]] = $attrs;
 404     }
 405     uksort($tmp, 'strnatcasecmp');
 406     $this->list = array_values($tmp);
 407   }
 408
 409
 410   /*! \brief Save HTML post data to object
 411    */
 412   public function save_object()
 413   {
 414     $this->DivListSudo->save_object();
 415     if(is_object($this->CopyPasteHandler)){
 416       $this->CopyPasteHandler->save_object();
 417     }
 418   }
 419
 420
 421   /*! \brief Remove this account
 422    */
 423   public function remove_from_parent()
 424   {
 425     /* Optionally execute a command after we're done */
 426     $this->postremove();
 427   }
 428
 429
 430   /*! \brief Save to LDAP
 431    */
 432   public function save()
 433   {
 434     /* Optionally execute a command after we're done */
 435     $this->postcreate();
 436   }
 437
 438
 439   /*! \brief Remove lock from entry
 440    */
 441   public function remove_lock()
 442   {
 443     if (is_object($this->sudotabs) && $this->sudotabs->dn != "new"){
 444       del_lock ($this->sudotabs->dn);
 445     }
 446     if(isset($this->dns) && is_array($this->dns) && count($this->dns)){
 447       del_lock($this->dns);
 448     }
 449   }
 450
 451   function get_used_snapshot_bases()
 452   {
 453     return(array(sudo::get_sudoers_ou($this->config)));
 454   }
 455
 456
 457   function copyPasteHandling_from_queue($s_action,$s_entry)
 458   {
 459     /* Check if Copy & Paste is disabled */
 460     if(!is_object($this->CopyPasteHandler)){
 461       return("");
 462     }
 463
 464     $ui = get_userinfo();
 465
 466     /* Add a single entry to queue */
 467     if($s_action == "cut" || $s_action == "copy"){
 468
 469       /* Cleanup object queue */
 470       $this->CopyPasteHandler->cleanup_queue();
 471       $dn = $this->list[$s_entry]['dn'];
 472
 473       if($s_action == "copy" && $ui->is_copyable($dn,"sudo","sudo")){
 474         $this->CopyPasteHandler->add_to_queue($dn,$s_action,"sudotabs","SUDOTABS","sudo");
 475       }
 476 #      if($s_action == "cut" && $ui->is_cutable($dn,"sudo","sudo")){
 477 #        $this->CopyPasteHandler->add_to_queue($dn,$s_action,"sudotabs","SUDOTABS","sudo");
 478 #      }
 479     }
 480
 481     /* Add entries to queue */
 482     if($s_action == "copy_multiple" || $s_action == "cut_multiple"){
 483
 484       /* Cleanup object queue */
 485       $this->CopyPasteHandler->cleanup_queue();
 486
 487       /* Add new entries to CP queue */
 488       foreach($this->list_get_selected_items() as $id){
 489         $dn = $this->list[$id]['dn'];
 490
 491         if($s_action == "copy_multiple" && $ui->is_copyable($dn,"sudo","sudo")){
 492           $this->CopyPasteHandler->add_to_queue($dn,"copy","sudotabs","SUDOTABS","sudo");
 493         }
 494 #        if($s_action == "cut_multiple" && $ui->is_cutable($dn,"sudo","sudo")){
 495 #          $this->CopyPasteHandler->add_to_queue($dn,"cut","sudotabs","SUDOTABS","sudo");
 496 #        }
 497       }
 498     }
 499
 500     /* Start pasting entries */
 501     if($s_action == "editPaste"){
 502       $this->start_pasting_copied_objects = TRUE;
 503     }
 504
 505     /* Return C&P dialog */
 506     if($this->start_pasting_copied_objects && $this->CopyPasteHandler->entries_queued()){
 507
 508       /* Get dialog */
 509       $this->CopyPasteHandler->SetVar("base",$this->DivListSudo->selectedBase);
 510       $data = $this->CopyPasteHandler->execute();
 511
 512       /* Return dialog data */
 513       if(!empty($data)){
 514         return($data);
 515       }
 516     }
 517
 518     /* Automatically disable status for pasting */
 519     if(!$this->CopyPasteHandler->entries_queued()){
 520       $this->start_pasting_copied_objects = FALSE;
 521     }
 522     return("");
 523   }
 524 }
 525 // vim:tabstop=2:expandtab:shiftwidth=2:filetype=php:syntax:ruler:
 526 ?>