Remove `delete_user_by_uid' since it's never been used in any logs we have,

[moira.git] / server / qaccess.pc

diff --git a/server/qaccess.pc b/server/qaccess.pc
index 8a7a0d97509175b5616c64b71078540f7769fb75..2f3c7a83e76e352a72be8eed68dc115026b57921 100644 (file)
--- a/server/qaccess.pc
+++ b/server/qaccess.pc
@@ -83,7 +83,10 @@ int access_login(q, argv, cl)
        WHERE u.unix_uid = :argv[0] AND u.users_id != 0;
     }
 
-    if (sqlca.sqlerrd[2] != 1 || id != cl->users_id)
+    if (sqlca.sqlcode == SQL_NO_MATCH)
+       return(MR_NO_MATCH); /* ought to be MR_USER, but this is what
+                               gual returns, so we have to be consistent */
+    else if (sqlca.sqlerrd[2] != 1 || id != cl->users_id)
        return(MR_PERM);
     else
        return(MR_SUCCESS);
@@ -110,11 +113,10 @@ int access_list(q, argv, cl)
      client *cl;
 {
     EXEC SQL BEGIN DECLARE SECTION;
-    int list_id, acl_id, flags, gid;
-    char acl_type[9];
+    int list_id, acl_id, flags, gid, users_id;
+    char acl_type[9], *newname;
     EXEC SQL END DECLARE SECTION;
-    char *client_type;
-    int client_id, status;
+    int status;
 
     list_id = *(int *)argv[0];
     EXEC SQL SELECT acl_id, acl_type, gid, publicflg
@@ -125,26 +127,30 @@ int access_list(q, argv, cl)
     if (sqlca.sqlerrd[2] != 1)
       return(MR_INTERNAL);
 
-    /* parse client structure */
-    if ((status = get_client(cl, &client_type, &client_id)) != MR_SUCCESS)
-       return(status);
-
     /* if amtl or dmfl and list is public allow client to add or delete self */
     if (((!strcmp("amtl", q->shortname) && flags) ||
-        (!strcmp("dmfl", q->shortname))) &&
-       (!strcmp("USER", argv[1]))) {
-       if (*(int *)argv[2] == client_id) return(MR_SUCCESS);
-    /* if update_list, don't allow them to change the GID */
+        (!strcmp("dmfl", q->shortname)))) {
+       if (!strcmp("USER", argv[1]) && *(int *)argv[2] == cl->users_id)
+           return(MR_SUCCESS);
+       if (!strcmp("KERBEROS", argv[1]) && *(int *)argv[2] == -cl->client_id)
+           return(MR_SUCCESS);
+    /* if update_list, don't allow them to change the GID or rename to
+       a username other than their own */
     } else if (!strcmp("ulis", q->shortname)) {
       if (!strcmp(argv[7], UNIQUE_GID)) {
        if(gid != -1) return MR_PERM;
       } else {
        if(gid != atoi(argv[7])) return MR_PERM;
       }
+      newname = argv[1];
+      EXEC SQL SELECT users_id INTO :users_id FROM users
+         WHERE login=:newname;
+      if ((sqlca.sqlcode != SQL_NO_MATCH) && (users_id != cl->users_id))
+         return MR_PERM;
     }
 
     /* check for client in access control list */
-    status = find_member(acl_type, acl_id, client_type, client_id);
+    status = find_member(acl_type, acl_id, cl);
     if (!status) return(MR_PERM);
 
     return(MR_SUCCESS);
@@ -167,8 +173,7 @@ int access_visible_list(q, argv, cl)
     int list_id, acl_id, flags ;
     char acl_type[9];
     EXEC SQL END DECLARE SECTION;
-    char *client_type;
-    int client_id, status;
+    int status;
 
     list_id = *(int *)argv[0];
     EXEC SQL SELECT hidden, acl_id, acl_type
@@ -180,12 +185,8 @@ int access_visible_list(q, argv, cl)
     if (!flags)
         return(MR_SUCCESS);
 
-    /* parse client structure */
-    if ((status = get_client(cl, &client_type, &client_id)) != MR_SUCCESS)
-       return(status);
-
     /* check for client in access control list */
-    status = find_member(acl_type, acl_id, client_type, client_id);
+    status = find_member(acl_type, acl_id, cl);
     if (!status)
        return(MR_PERM);
 
@@ -209,8 +210,7 @@ int access_vis_list_by_name(q, argv, cl)
     int acl_id, flags, rowcount;
     char acl_type[9], *listname;
     EXEC SQL END DECLARE SECTION;
-    char *client_type;
-    int client_id, status;
+    int status;
 
     listname = argv[0];
     EXEC SQL SELECT hidden, acl_id, acl_type INTO :flags, :acl_id, :acl_type
@@ -224,12 +224,8 @@ int access_vis_list_by_name(q, argv, cl)
     if (!flags)
        return(MR_SUCCESS);
 
-    /* parse client structure */
-    if ((status = get_client(cl, &client_type, &client_id)) != MR_SUCCESS)
-       return(status);
-
     /* check for client in access control list */
-    status = find_member(acl_type, acl_id, client_type, client_id);
+    status = find_member(acl_type, acl_id, cl);
     if (!status)
        return(MR_PERM);
 
@@ -238,7 +234,8 @@ int access_vis_list_by_name(q, argv, cl)
 
 
 /* access_member - allow user to access member of type "USER" and name matches
- * username, or to access member of type "LIST" and list is one that user is
+ * username, or to access member of type "KERBEROS" and the principal matches
+ * the user, or to access member of type "LIST" and list is one that user is
  * on the acl of, or the list is visible.
  */
 
@@ -255,8 +252,8 @@ int access_member(q, argv, cl)
          return(MR_SUCCESS);
     }
 
-    if (!strcmp(argv[0], "KERBEROS") || !strcmp(argv[0], "RKERBERO")) {
-        if (cl->client_id == *(int *)argv[1])
+    if (!strcmp(argv[0], "KERBEROS") || !strcmp(argv[0], "RKERBEROS")) {
+        if (cl->client_id == -*(int *)argv[1])
          return(MR_SUCCESS);
     }
 
@@ -292,8 +289,8 @@ int access_service(q, argv, cl)
     int acl_id;
     char *name, acl_type[9];
     EXEC SQL END DECLARE SECTION;
-    int client_id, status;
-    char *client_type, *c;
+    int status;
+    char *c;
 
     name = argv[0];
     for(c=name;*c;c++) if(islower(*c)) *c = toupper(*c);  /* uppercasify */
@@ -302,12 +299,8 @@ int access_service(q, argv, cl)
     if (sqlca.sqlerrd[2] > 1)
       return(MR_PERM);
 
-    /* parse client structure */
-    if ((status = get_client(cl, &client_type, &client_id)) != MR_SUCCESS)
-       return(status);
-
     /* check for client in access control list */
-    status = find_member(acl_type, acl_id, client_type, client_id);
+    status = find_member(acl_type, acl_id, cl);
     if (!status) return(MR_PERM);
 
     return(MR_SUCCESS);
@@ -327,8 +320,7 @@ int access_filesys(q, argv, cl)
     int users_id, list_id;
     char *name;
     EXEC SQL END DECLARE SECTION;
-    int status, client_id;
-    char *client_type;
+    int status;
 
     name = argv[0];
     EXEC SQL SELECT owner, owners INTO :users_id, :list_id FROM filesys
@@ -338,9 +330,7 @@ int access_filesys(q, argv, cl)
       return(MR_PERM);
     if (users_id == cl->users_id)
       return(MR_SUCCESS);
-    if ((status = get_client(cl, &client_type, &client_id)) != MR_SUCCESS)
-      return(status);
-    status = find_member("LIST", list_id, client_type, client_id);
+    status = find_member("LIST", list_id, cl);
     if (status)
       return(MR_SUCCESS);
     else
@@ -362,8 +352,7 @@ int access_host(q, argv, cl)
     int mid, sid, id;
     char mtype[9], stype[9];
     EXEC SQL END DECLARE SECTION;
-    int status, client_id;
-    char *client_type;
+    int status;
 
     if (q->type == APPEND) {
        id = *(int *)argv[8];
@@ -372,7 +361,11 @@ int access_host(q, argv, cl)
          WHERE s.snet_id=:id;
        mid =0;
     } else if (q->type == RETRIEVE) {
-       return(MR_SUCCESS);
+       if (strcmp(argv[0], "*") || strcmp(argv[1], "*") ||
+           strcmp(argv[2], "*") || strcmp(argv[3], "*"))
+           return(MR_SUCCESS);
+       else
+           return(MR_PERM);
     } else {
        id = *(int *)argv[0];
        EXEC SQL SELECT m.owner_type, m.owner_id, s.owner_type, s.owner_id
@@ -382,14 +375,12 @@ int access_host(q, argv, cl)
     if (sqlca.sqlerrd[2] != 1)
       return(MR_PERM);
 
-    if ((status = get_client(cl, &client_type, &client_id)) != MR_SUCCESS)
-      return(status);
-    status = find_member(stype, sid, client_type, client_id);
+    status = find_member(stype, sid, cl);
     if (status) {
        host_access_level = 1;
        return(MR_SUCCESS);
     }
-    status = find_member(mtype, mid, client_type, client_id);
+    status = find_member(mtype, mid, cl);
     if (status) {
        host_access_level = 2;
        return(MR_SUCCESS);
@@ -413,8 +404,7 @@ int access_ahal(q, argv, cl)
     int cnt, id, mid, sid;
     char mtype[256], stype[256];
     EXEC SQL END DECLARE SECTION;
-    char *client_type;
-    int status, client_id;
+    int status;
 
     if (q->type == RETRIEVE)
       return(MR_SUCCESS);
@@ -432,12 +422,10 @@ int access_ahal(q, argv, cl)
     EXEC SQL SELECT m.owner_type, m.owner_id, s.owner_type, s.owner_id
       INTO :mtype, :mid, :stype, :sid FROM machine m, subnet s
       WHERE m.mach_id=:id and s.snet_id=m.snet_id;
-    if ((status = get_client(cl, &client_type, &client_id)) != MR_SUCCESS)
-      return(status);
-    status = find_member(mtype, mid, client_type, client_id);
+    status = find_member(mtype, mid, cl);
     if (status)
       return(MR_SUCCESS);
-    status = find_member(stype, sid, client_type, client_id);
+    status = find_member(stype, sid, cl);
     if (status)
       return(MR_SUCCESS);
     else