* Copyright (C) 1987 by the Massachusetts Institute of Technology
*
* $Log$
- * Revision 1.6 1987-08-04 01:30:54 wesommer
- * Mike's changes; checked in prior to working over messages.
+ * Revision 1.12 1987-09-12 20:42:11 wesommer
+ * Clean up after Gretzinger: cl->kname is not valid unless cl->clname is
+ * non-NULL.
*
+ * Revision 1.12 87/09/12 20:06:46 wesommer
+ * Fix security hole/null dereference bug: if clname is NULL, return
+ * permission denied in get_client.
+ *
+ * Revision 1.11 87/09/01 16:10:01 wesommer
+ * This change was made by Mike, who didn't feel like checking it in.
+ * Temp hack: ignore instances.
+ *
+ * Revision 1.10 87/08/28 14:57:51 mike
+ * Modified sms_query to not enclose RETRIEVE queries in begin/end transaction.
+ * This was necessary to allow get_all_poboxes and get_groups_of_all_users
+ * to temporarily change the Ingres lockmode.
+ *
+ * Revision 1.9 87/08/22 17:47:38 wesommer
+ * Cleanup (these changes were by Mike).
+ *
+ * Revision 1.8 87/08/10 16:22:26 mike
+ * wesommer modified error reporting.
+ *
+ * Revision 1.7 87/08/04 01:49:20 wesommer
+ * Rearranged messages.
+ *
+ * Revision 1.6 87/08/04 01:30:54 wesommer
+ * Mike's changes; checked in prior to working over messages.
+ *
* Revision 1.5 87/06/21 16:37:58 wesommer
* Changed include files, reindented things.
*
int *num;
{
ingres_errno = SMS_INGRES_ERR;
+ com_err(whoami, SMS_INGRES_ERR, " code %d\n", ingres_errno);
return *num;
}
struct query *get_query_by_name();
int access_user();
int access_pop();
+ int access_list();
q = get_query_by_name(name);
if (q == (struct query *)0) return(SMS_NO_HANDLE);
status = check_query_access(q, Argv, cl);
privileged = (status == SMS_SUCCESS) ? 1 : 0;
if (status != SMS_SUCCESS && !(v && (v->pre_rtn == access_user ||
- v->pre_rtn == access_pop)))
+ v->pre_rtn == access_pop ||
+ v->pre_rtn == access_list)))
return(status);
/* check argument count */
register struct validate *v;
int privileged;
char qual[256];
+ char sort[32];
char *pqual;
+ char *psort;
## char *table;
struct save_queue *sq;
struct query *get_query_by_name();
int sq_save_args();
struct save_queue *sq_create();
+ char *build_sort();
int access_user();
+ int access_pop();
+ int access_list();
/* copy the arguments into a local argv that we can modify */
for (i = 0; i < argc; i++)
/* check query access */
status = check_query_access(q, Argv, cl);
privileged = (status == SMS_SUCCESS) ? 1 : 0;
- if (status != SMS_SUCCESS && !(v && (v->pre_rtn == access_user)))
+ if (!privileged && !(status == SMS_PERM &&
+ (v && (v->pre_rtn == access_user ||
+ v->pre_rtn == access_pop ||
+ v->pre_rtn == access_list))))
return(status);
/* check argument count */
return(status);
}
-## begin transaction
+ if (q->type != RETRIEVE)
+## begin transaction
switch (q->type) {
case RETRIEVE:
pqual = 0;
}
+ /* build "sort" clause if needed */
+ if (v && v->valobj) {
+ psort = build_sort(v, sort);
+ } else {
+ psort = 0;
+ }
+
/* if there is a followup routine, then we must save the results */
/* of the first query for use by the followup routine */
- /* if q->rtable = NULL, perform post_rtn only */
- if (table = q->rtable) {
+ /* if q->rvar = NULL, perform post_rtn only */
+ if (q->rvar) {
if (v && v->post_rtn) {
sq = sq_create();
- status = do_retrieve(q, pqual, sq_save_args, sq);
+ status = do_retrieve(q, pqual, psort, sq_save_args, sq);
if (status != SMS_SUCCESS) {
sq_destroy(sq);
break;
status = (*v->post_rtn)(q, sq, v, action, actarg);
} else {
/* normal retrieve */
- status = do_retrieve(q, pqual, action, actarg);
+ status = do_retrieve(q, pqual, psort, action, actarg);
}
if (status != SMS_SUCCESS) break;
+ table = q->rtable;
## repeat replace tblstats (retrieves = tblstats.retrieves + 1)
## where tblstats.#table = @table
} else {
}
/* build "where" clause and perform update */
- /* if q->rtable = NULL, perform post_rtn only */
- if (table = q->rtable) {
+ /* if q->rvar = NULL, perform post_rtn only */
+ if (q->rvar) {
build_qual(q->qual, q->argc, Argv, qual);
status = do_update(q, &Argv[q->argc], qual, action, actarg);
if (status != SMS_SUCCESS) break;
+ table = q->rtable;
## repeat replace tblstats (updates = tblstats.updates + 1,
## modtime = "now")
## where tblstats.#table = @table
/* increment id number if necessary */
if (v->object_id) set_next_object_id(v->object_id);
+ /* build "where" clause if needed */
+ if (q->qual) {
+ build_qual(q->qual, q->argc, Argv, qual);
+ pqual = qual;
+ } else {
+ pqual = 0;
+ }
+
/* perform the append */
- /* if q->rtable = NULL, perform post_rtn only */
- if (table = q->rtable) {
- status = do_append(q, &Argv[q->argc], action, actarg);
+ /* if q->rvar = NULL, perform post_rtn only */
+ if (q->rvar) {
+ status = do_append(q, &Argv[q->argc], pqual, action, actarg);
if (status != SMS_SUCCESS) break;
+ table = q->rtable;
## repeat replace tblstats (appends = tblstats.appends + 1,
## modtime = "now")
## where tblstats.#table = @table
}
/* build "where" clause and perform delete */
- /* if q->rtable = NULL, perform post_rtn only */
- if (table = q->rtable) {
+ /* if q->rvar = NULL, perform post_rtn only */
+ if (q->rvar) {
build_qual(q->qual, q->argc, Argv, qual);
status = do_delete(q, qual, action, actarg);
if (status != SMS_SUCCESS) break;
+ table = q->rtable;
## repeat replace tblstats (deletes = tblstats.deletes + 1,
## modtime = "now")
## where tblstats.#table = @table
}
- if (status == SMS_SUCCESS)
-## end transaction
- else
-## abort
+ if (q->type != RETRIEVE) {
+ if (status == SMS_SUCCESS) {
+## end transaction
+ } else {
+## abort
+ }
+ }
- if (status != SMS_SUCCESS) com_err(whoami, status, " (Query failed)");
+ if (status != SMS_SUCCESS && log_flags & LOG_RES)
+ com_err(whoami, status, " (Query failed)");
return(status);
}
}
}
+char *
+build_sort(v, sort)
+ register struct validate *v;
+ char *sort;
+{
+ register struct valobj *vo;
+ register int n;
+ char elem[16];
+
+ n = v->objcnt;
+ vo = v->valobj;
+ *sort = 0;
+
+ while (--n >= 0) {
+ if (vo->type == V_SORT) {
+ sprintf(elem, "RET_VAR%d", vo->index + 1);
+ if (*sort) strcat(sort, ", ");
+ strcat(sort, elem);
+ }
+ vo++;
+ }
+
+ return ((*sort) ? sort : 0);
+}
+
check_query_access(q, argv, cl)
struct query *q;
char *argv[];
## int acl_id;
## int exists;
## int rowcount;
+## int errorno;
## static int def_uid;
int status;
int client_id;
/* get query access control list */
name = q->shortname;
## repeat retrieve (acl_id = capacls.list_id) where capacls.tag = @name
-## inquire_equel (rowcount = "rowcount")
+## inquire_equel (rowcount = "rowcount", errorno = "errorno")
+ if (errorno != 0) return(SMS_INGRES_ERR);
if (rowcount == 0) return(SMS_PERM);
/* initialize default uid */
## retrieve (def_uid = users.users_id) where users.login = "default"
}
- com_err(whoami, 0, "checking for default access");
/* check for default access */
## range of m is members
## repeat retrieve (exists = any(m.#member_id where m.list_id = @acl_id and
status = get_client(cl, &client_type, &client_id);
if (status != SMS_SUCCESS) return(status);
- com_err(whoami, 0, "checking for client in acl");
/* see if client is in the list (or any of its sub-lists) */
exists = find_member(acl_id, client_type, client_id, 0);
return ((exists) ? SMS_SUCCESS : SMS_PERM);
## char *name;
## int rowcount;
- /* for now accept only null instances */
+ if (cl->clname == NULL)
+ return SMS_PERM;
+
+ /* for now ignore instances */
krb = &cl->kname;
- if (krb->inst[0]) return(SMS_PERM);
/* if client is from local realm, get users_id */
if (!strcmp(krb->realm, krb_realm)) {
if (exists) return(1);
/* are there any sub-lists? */
- com_err(whoami, 0, "checking for sub-lists");
## repeat retrieve (exists = any(m.#member_id where m.#list_id = @list_id and
## m.#member_type = "LIST"))
if (!exists) return(0);
if (child) return;
- com_err(whoami, 0, "checking for client in sub-lists");
/* at top-level, check sub-lists for client (breadth-first search) */
while (sq_get_data(sq, &sublist)) {
exists = find_member(sublist, member_type, member_id, sq);
}
##}
-do_retrieve(q, qual, action, actarg)
+do_retrieve(q, pqual, psort, action, actarg)
register struct query *q;
- char *qual;
+ char *pqual;
+ char *psort;
int (*action)();
char *actarg;
##{
## char *rvar;
## char *rtable;
## char *cqual;
+## char *csort;
## int rowcount;
+## int errorno;
if (q->rvar) {
rvar = q->rvar;
## range of rvar is rtable
}
- if (qual) {
- cqual = qual;
-## retrieve unique (param (q->tlist, q->vaddr)) where cqual
-## {
- (*action)(q->vcnt, q->vaddr, actarg);
-## }
+ if (psort) {
+ csort = psort;
+ if (pqual) {
+ cqual = pqual;
+## retrieve unique (param (q->tlist, q->vaddr)) where cqual
+## sort by csort
+## {
+ (*action)(q->vcnt, q->vaddr, actarg);
+## }
+ } else {
+## retrieve unique (param (q->tlist, q->vaddr))
+## sort by csort
+## {
+ (*action)(q->vcnt, q->vaddr, actarg);
+## }
+ }
+
} else {
-## retrieve unique (param (q->tlist, q->vaddr))
-## {
- (*action)(q->vcnt, q->vaddr, actarg);
-## }
+ if (pqual) {
+ cqual = pqual;
+## retrieve unique (param (q->tlist, q->vaddr)) where cqual
+## {
+ (*action)(q->vcnt, q->vaddr, actarg);
+## }
+ } else {
+## retrieve unique (param (q->tlist, q->vaddr))
+## {
+ (*action)(q->vcnt, q->vaddr, actarg);
+## }
+ }
}
-## inquire_equel (rowcount = "rowcount")
-
+## inquire_equel (rowcount = "rowcount", errorno = "errorno")
+ if (errorno != 0) return(SMS_INGRES_ERR);
return ((rowcount == 0) ? SMS_NO_MATCH : SMS_SUCCESS);
##}
## char *rtable;
## char *cqual;
## int rowcount;
+## int errorno;
rvar = q->rvar;
rtable = q->rtable;
## replace rvar (param (q->tlist, argv))
## where cqual
+## inquire_equel (errorno = "errorno")
+ if (errorno != 0) return(SMS_INGRES_ERR);
return(SMS_SUCCESS);
##}
-do_append(q, argv, action, actarg)
+do_append(q, argv, pqual, action, actarg)
register struct query *q;
char *argv[];
+ char *pqual;
int (*action)();
char *actarg;
##{
## char *rvar;
## char *rtable;
## char *cqual;
+## int errorno;
rvar = q->rvar;
rtable = q->rtable;
## range of rvar is rtable
- if (q->qual) {
- cqual = q->qual;
+ if (pqual) {
+ cqual = pqual;
## append to rtable (param (q->tlist, argv)) where cqual
} else {
## append to rtable (param (q->tlist, argv))
}
+## inquire_equel (errorno = "errorno")
+ if (errorno != 0) return(SMS_INGRES_ERR);
return(SMS_SUCCESS);
##}
## char *rvar;
## char *rtable;
## char *cqual;
+## int errorno;
rvar = q->rvar;
rtable = q->rtable;
cqual = qual;
## delete rvar where cqual
+## inquire_equel (errorno = "errorno")
+ if (errorno != 0) return(SMS_INGRES_ERR);
return(SMS_SUCCESS);
##}
andersk / moira.git / blobdiff