From 073bc57fa6ff91883395f9cf3d74573ce3165e26 Mon Sep 17 00:00:00 2001
From: paulr <me@pjr.cc>
Date: Fri, 4 Nov 2011 03:07:43 +1100
Subject: [PATCH] added an auth component to allow permission checking and rejection for
 inclusion in permission-requiring pages and data.

---
 gwvplib/gwvpauth.php      |   10 +++++
 gwvplib/gwvpuseradmin.php |   91 ++++++++++++++++++++++++++++++++++++++++++---
 gwvplib/gwvpweb.php       |    2 +-
 3 files changed, 96 insertions(+), 7 deletions(-)

diff --git a/gwvplib/gwvpauth.php b/gwvplib/gwvpauth.php
index 09be32d..8aa0533 100644
--- a/gwvplib/gwvpauth.php
+++ b/gwvplib/gwvpauth.php
@@ -45,6 +45,16 @@ function gwvp_CheckAuthLevel($levels)
 	return false;
 }
 
+function gwvp_AuthNoPerms()
+{
+	gwvp_goMainPage("gwvp_AuthNoPermsBody");
+}
+
+function gwvp_AuthNoPermsBody()
+{
+	echo "You have no permissions for this page, do you need to login?";
+}
+
 function gwvp_AuthHandleLogout()
 {
 	global $BASE_URL;
diff --git a/gwvplib/gwvpuseradmin.php b/gwvplib/gwvpuseradmin.php
index 95b6a9c..268f0b4 100644
--- a/gwvplib/gwvpuseradmin.php
+++ b/gwvplib/gwvpuseradmin.php
@@ -11,22 +11,101 @@ function gwvp_UserAdminCallMe()
 {
 	if(isset($_REQUEST["q"])) {
 		$query = $_REQUEST["q"];
-		if($query == "admin/users") return "gwvp_UserAdminPage";
+		$qspl = explode("/", $query);
+		if(isset($qspl[0]) && isset($qspl[1])) {
+			if($qspl[0] == "admin" && $qspl[1] == "users") {
+				if(isset($qspl[2])) {
+					switch($qspl[2]) {
+						case "adduser":
+							return "gwvp_AddUserPage";
+							break;
+						case "addgroup":
+							return "gwvp_AddGroupPage";
+							break;
+						case "modify":
+							return "gwvp_ModifyUserPage";
+							break;
+						case "modifygroup":
+							return "gwvp_ModifyGroupPage";
+							break;
+						default:
+							return "gwvp_UserAdminPage";
+					}					
+				} else {
+					return "gwvp_UserAdminPage";
+				}
+			}
+		} 
 		else return false;
 	}
 	
 	return false;
 }
 
+function gwvp_AddUserPage()
+{
+	
+}
+
+function gwvp_AddGroupPage()
+{
+	
+}
+
 function gwvp_UserAdminPage()
 {
 	gwvp_goMainPage("gwvp_UserAdminPageBody");
 }
 
+function gwvp_ModifyUserPage()
+{
+	if(!gwvp_CheckAuthLevel("admin")) {
+		gwvp_AuthNoPerms();
+		return;
+	}
+	
+	gwvp_goMainPage("gwvp_ModifyUserPageBody");
+}
+
+function gwvp_ModifyGroupPage()
+{
+	gwvp_goMainPage("gwvp_ModifyGroupPageBody");
+}
+
+function gwvp_ModifyUserPageBody()
+{
+	error_log("modify user body - coming in");
+	if(!gwvp_CheckAuthLevel("admin")) {
+		gwvp_AuthNoPermsBody();
+		return;
+	}
+	
+	
+	$uid = -1;
+	if(isset($_REQUEST["q"])) {
+		$query = $_REQUEST["q"];
+		$qspl = explode("/", $query);
+		$uid = $qspl[3];
+	}
+	
+	echo "modify user $uid";
+}
+
+function gwvp_ModifyGroupPageBody()
+{
+	$gid = -1;
+	if(isset($_REQUEST["q"])) {
+		$query = $_REQUEST["q"];
+		$qspl = explode("/", $query);
+		$gid = $qspl[3];
+	}
+	
+	echo "modify group $gid";
+}
 
 function gwvp_UserAdminPageBody()
 {
-	global $LOGIN_TYPE;
+	global $LOGIN_TYPE, $BASE_URL;
 	
 	$groups = gwvp_getGroups();
 	$users = gwvp_getUsers();
@@ -65,7 +144,7 @@ function gwvp_UserAdminPageBody()
 		// create user bit
 		echo "<tr><td valign=\"top\">";
 		
-		echo "<form method=\"post\">";
+		echo "<form method=\"post\" action=\"$BASE_URL/admin/users/adduser\">";
 		echo "<table>";
 		echo "<tr><td>EMail</td><td><input type=\"text\" name=\"email\"></td>";
 		echo "<td>Full Name</td><td><input type=\"text\" name=\"fullname\"></td></tr>";
@@ -80,7 +159,7 @@ function gwvp_UserAdminPageBody()
 		echo "</td><td valign=\"top\">";
 		
 		// Create group
-		echo "<form method=\"post\">";
+		echo "<form method=\"post\" action=\"$BASE_URL/admin/users/addgroup\">";
 		echo "<table>";
 		echo "<tr><td>Group Name</td><td><input type=\"text\" name=\"groupname\"><td></tr>";
 		echo "<tr><td>Admin Group?</td><td><input type=\"checkbox\" name=\"admingroup\" class=\"mycheckbox\"></td></tr>";
@@ -178,7 +257,7 @@ function gwvp_UserAdminPageBody()
 				break;
 			case "admin":
 				echo "<tr><td>$email</td><td>$username</td><td>$fullname</td><td>$ugroups</td><td>$desc</td>";
-				echo "<td>$globaladmin</td><td>$status</td><td><a href=\"$BASE_URL/users/modify?id=$userid\">Modify</a></td></tr>";
+				echo "<td>$globaladmin</td><td>$status</td><td><a href=\"$BASE_URL/admin/users/modify/$userid\">Modify</a></td></tr>";
 				break;
 			case "user":
 				echo "<tr><td>$username</td><td>$ugroups</td><td>$desc</td></tr>";
@@ -228,7 +307,7 @@ function gwvp_UserAdminPageBody()
 				echo "<tr><td>$gname</td><td>$owner</td></tr>";
 				break;
 			case "admin":
-				echo "<tr><td>$gname</td><td>$owner</td><td>$gadmin</td><td><a href=\"$BASE_URL/users/modifygroup?groupid=$gid\">Modify</a></td></tr>";
+				echo "<tr><td>$gname</td><td>$owner</td><td>$gadmin</td><td><a href=\"$BASE_URL/admin/users/modifygroup/$gid\">Modify</a></td></tr>";
 				break;
 			case "user":
 				echo "<tr><td>$gname</td><td>$owner</td><td>$gadmin</td></tr>";
diff --git a/gwvplib/gwvpweb.php b/gwvplib/gwvpweb.php
index 8607e07..9c08a3c 100644
--- a/gwvplib/gwvpweb.php
+++ b/gwvplib/gwvpweb.php
@@ -109,7 +109,7 @@ function gwvp_goMainPage($bodyFunction = null)
 		if(function_exists($bodyFunction)) {
 			$bodyFunction();
 		} else {
-			error_log("Got called with non-existant body function");
+			error_log("Got called with non-existant body function, $bodyFunction");
 			gwvp_BodyBuilder();
 		}
 	}
-- 
1.7.0.4