| Index: trunk/extensions/OpenStackManager/special/SpecialNovaInstance.php |
| — | — | @@ -16,14 +16,13 @@ |
| 17 | 17 | $this->notLoggedIn(); |
| 18 | 18 | return true; |
| 19 | 19 | } |
| 20 | | - $user = new OpenStackNovaUser(); |
| 21 | | - if ( ! $user->exists() ) { |
| | 20 | + $this->userLDAP = new OpenStackNovaUser(); |
| | 21 | + if ( ! $this->userLDAP->exists() ) { |
| 22 | 22 | $this->noCredentials(); |
| 23 | 23 | return true; |
| 24 | 24 | } |
| 25 | | - $this->userLDAP = new OpenStackNovaUser(); |
| 26 | 25 | $project = $wgRequest->getVal( 'project' ); |
| 27 | | - $userCredentials = $user->getCredentials( $project ); |
| | 26 | + $userCredentials = $this->userLDAP->getCredentials( $project ); |
| 28 | 27 | $this->userNova = new OpenStackNovaController( $userCredentials ); |
| 29 | 28 | $adminCredentials = $wgOpenStackManagerNovaAdminKeys; |
| 30 | 29 | $this->adminNova = new OpenStackNovaController( $adminCredentials ); |
| — | — | @@ -31,25 +30,25 @@ |
| 32 | 31 | $action = $wgRequest->getVal( 'action' ); |
| 33 | 32 | |
| 34 | 33 | if ( $action == "create" ) { |
| 35 | | - if ( ! $user->inProject( $project ) ) { |
| | 34 | + if ( ! $this->userLDAP->inProject( $project ) ) { |
| 36 | 35 | $this->notInProject(); |
| 37 | 36 | return true; |
| 38 | 37 | } |
| 39 | 38 | $this->createInstance(); |
| 40 | 39 | } else if ( $action == "delete" ) { |
| 41 | | - if ( ! $user->inProject( $project ) ) { |
| | 40 | + if ( ! $this->userLDAP->inProject( $project ) ) { |
| 42 | 41 | $this->notInProject(); |
| 43 | 42 | return true; |
| 44 | 43 | } |
| 45 | 44 | $this->deleteInstance(); |
| 46 | 45 | } else if ( $action == "rename" ) { |
| 47 | | - if ( ! $user->inProject( $project ) ) { |
| | 46 | + if ( ! $this->userLDAP->inProject( $project ) ) { |
| 48 | 47 | $this->notInProject(); |
| 49 | 48 | return true; |
| 50 | 49 | } |
| 51 | 50 | $this->renameInstance(); |
| 52 | 51 | } else if ( $action == "configure" ) { |
| 53 | | - if ( ! $user->inProject( $project ) ) { |
| | 52 | + if ( ! $this->userLDAP->inProject( $project ) ) { |
| 54 | 53 | $this->notInProject(); |
| 55 | 54 | return true; |
| 56 | 55 | } |
| Index: trunk/extensions/OpenStackManager/special/SpecialNovaProject.php |
| — | — | @@ -2,6 +2,7 @@ |
| 3 | 3 | class SpecialNovaProject extends SpecialNova { |
| 4 | 4 | |
| 5 | 5 | var $userNova, $adminNova; |
| | 6 | + var $userLDAP; |
| 6 | 7 | |
| 7 | 8 | function __construct() { |
| 8 | 9 | parent::__construct( 'NovaProject', 'manageproject' ); |
| — | — | @@ -16,16 +17,11 @@ |
| 17 | 18 | function execute( $par ) { |
| 18 | 19 | global $wgRequest, $wgUser; |
| 19 | 20 | |
| 20 | | - if ( !$this->userCanExecute( $wgUser ) ) { |
| 21 | | - $this->displayRestrictionError(); |
| 22 | | - return false; |
| 23 | | - } |
| 24 | | - |
| 25 | 21 | if ( ! $wgUser->isLoggedIn() ) { |
| 26 | 22 | $this->notLoggedIn(); |
| 27 | 23 | return false; |
| 28 | 24 | } |
| 29 | | - |
| | 25 | + $this->userLDAP = new OpenStackNovaUser(); |
| 30 | 26 | $action = $wgRequest->getVal( 'action' ); |
| 31 | 27 | if ( $action == "create" ) { |
| 32 | 28 | $this->createProject(); |
| — | — | @@ -45,8 +41,13 @@ |
| 46 | 42 | */ |
| 47 | 43 | function createProject() { |
| 48 | 44 | global $wgRequest, $wgOut; |
| | 45 | + global $wgUser; |
| 49 | 46 | |
| 50 | 47 | $this->setHeaders(); |
| | 48 | + if ( !$this->userCanExecute( $wgUser ) ) { |
| | 49 | + $this->displayRestrictionError(); |
| | 50 | + return false; |
| | 51 | + } |
| 51 | 52 | $wgOut->setPagetitle( wfMsg( 'openstackmanager-createproject' ) ); |
| 52 | 53 | |
| 53 | 54 | $projectInfo = array(); |
| — | — | @@ -76,11 +77,16 @@ |
| 77 | 78 | */ |
| 78 | 79 | function addMember() { |
| 79 | 80 | global $wgRequest, $wgOut; |
| | 81 | + global $wgUser; |
| 80 | 82 | |
| 81 | 83 | $this->setHeaders(); |
| 82 | 84 | $wgOut->setPagetitle( wfMsg( 'openstackmanager-addmember' ) ); |
| 83 | 85 | |
| 84 | 86 | $project = $wgRequest->getText( 'projectname' ); |
| | 87 | + if ( !$this->userCanExecute( $wgUser ) && !$this->userLDAP->inProject( $project ) ) { |
| | 88 | + $this->notInProject(); |
| | 89 | + return false; |
| | 90 | + } |
| 85 | 91 | $projectInfo = array(); |
| 86 | 92 | $projectInfo['member'] = array( |
| 87 | 93 | 'type' => 'text', |
| — | — | @@ -111,11 +117,16 @@ |
| 112 | 118 | */ |
| 113 | 119 | function deleteMember() { |
| 114 | 120 | global $wgRequest, $wgOut; |
| | 121 | + global $wgUser; |
| 115 | 122 | |
| 116 | 123 | $this->setHeaders(); |
| 117 | 124 | $wgOut->setPagetitle( wfMsg( 'openstackmanager-removemember' ) ); |
| 118 | 125 | |
| 119 | 126 | $projectname = $wgRequest->getText( 'projectname' ); |
| | 127 | + if ( !$this->userCanExecute( $wgUser ) && !$this->userLDAP->inProject( $projectname ) ) { |
| | 128 | + $this->notInProject(); |
| | 129 | + return false; |
| | 130 | + } |
| 120 | 131 | $project = OpenStackNovaProject::getProjectByName( $projectname ); |
| 121 | 132 | $projectmembers = $project->getMembers(); |
| 122 | 133 | $member_keys = array(); |
| — | — | @@ -152,8 +163,13 @@ |
| 153 | 164 | */ |
| 154 | 165 | function deleteProject() { |
| 155 | 166 | global $wgOut, $wgRequest; |
| | 167 | + global $wgUser; |
| 156 | 168 | |
| 157 | 169 | $this->setHeaders(); |
| | 170 | + if ( !$this->userCanExecute( $wgUser ) ) { |
| | 171 | + $this->displayRestrictionError(); |
| | 172 | + return false; |
| | 173 | + } |
| 158 | 174 | $wgOut->setPagetitle( wfMsg( 'openstackmanager-deleteproject' ) ); |
| 159 | 175 | |
| 160 | 176 | $project = $wgRequest->getText( 'projectname' ); |
| Index: trunk/extensions/OpenStackManager/OpenStackNovaUser.php |
| — | — | @@ -147,7 +147,7 @@ |
| 148 | 148 | |
| 149 | 149 | $this->connect(); |
| 150 | 150 | |
| 151 | | - $filter = "(&(cn=$project)(member=$this->userDN))"; |
| | 151 | + $filter = "(&(cn=$project)(member=$this->userDN)(owner=*))"; |
| 152 | 152 | wfSuppressWarnings(); |
| 153 | 153 | $result = ldap_search( $wgAuth->ldapconn, $wgOpenStackManagerLDAPProjectBaseDN, $filter ); |
| 154 | 154 | wfRestoreWarnings(); |