Enhancements to Security settings

diff --git a/portal.mlt b/portal.mlt
index 0528e2f..015def3 100644 (file)
--- a/portal.mlt
+++ b/portal.mlt
@@ -16,6 +16,7 @@ val bal = Balance.lookupBalance (#bal you);
 
 <a href="pref">Preferences</a><br>
 <a href="money">Financial</a><br>
+<a href="sec">Security settings</a><br>
 <a href="contact">Contact information</a><br>
 <a href="location">Your geographic locations</a><br>
 <a href="link">Public URL directory</a><br>

diff --git a/sec.mlt b/sec.mlt
index c8bdfba..b8c863c 100644 (file)
--- a/sec.mlt
+++ b/sec.mlt
@@ -7,6 +7,7 @@ val uname = case $"uname" of
 
 val socks = Sec.socketPerms uname;
 val tpe = Sec.isTpe uname;
+val cron = Sec.cronAllowed uname;
 
 ref showNormal = true;
 
@@ -36,6 +37,60 @@ elseif $"cmd" = "tpe2" then
        end
        %><h3><b>Request added</b></h3><%
 
+elseif $"cmd" = "cron" then
+       showNormal := false;
+       val cron = iff $"cron" = "yes" then "enabled" else "disabled";
+       %>Are you sure you want to request that <tt>cron</tt> permissions for <b><% Web.html uname %></b> be <b><% cron %></b>?<br>
+       <a href="sec?cmd=cron2&uname=<% Web.urlEncode uname %>&cron=<% cron %>&msg=<% Web.urlEncode ($"msg") %>">Yes, place the request!</a><%
+elseif $"cmd" = "cron2" then
+       val cron = iff $"cron" = "enabled" then "enable" else "disable";
+       val id = Sec.Req.add (you, String.concat [uname, ": ", cron, " cron access"], $"msg");
+       if not (Sec.Req.notifyNew id) then
+               %><h3><b>Error sending e-mail notification</b></h3><%
+       end
+       %><h3><b>Request added</b></h3><%
+
+elseif $"cmd" = "rule" then
+       showNormal := false;
+       val rule = $"rule";
+       %>Are you sure you want to request the firewall rule <b><% Web.html uname %>&nbsp;<% Web.html rule %></b>?<br>
+       <a href="sec?cmd=rule2&uname=<% Web.urlEncode uname %>&rule=<% Web.urlEncode rule %>&msg=<% Web.urlEncode ($"msg") %>">Yes, place the request!</a><%
+elseif $"cmd" = "rule2" then
+       val id = Sec.Req.add (you, String.concat ["Add firewall rule \"", uname, " ", $"rule", "\""], $"msg");
+       if not (Sec.Req.notifyNew id) then
+               %><h3><b>Error sending e-mail notification</b></h3><%
+       end
+       %><h3><b>Request added</b></h3><%
+
+elseif $"modRule" <> "" then
+       showNormal := false;
+       val oldRule = $"modRule";
+       val rule = $"rule"
+       if oldRule = rule then
+               %>You didn't modify the textbox for this rule before clicking the button, so there is no request to be made.<%
+       else
+               %>Are you sure you want to request that firewall rule <b><% Web.html uname %>&nbsp;<% Web.html oldRule %></b> be replaced by <b><% Web.html uname %>&nbsp;<% Web.html rule %></b>?<br>
+               <a href="sec?uname=<% Web.urlEncode uname %>&modRule2=<% Web.urlEncode oldRule %>&rule=<% Web.urlEncode rule %>&msg=<% Web.urlEncode ($"msg") %>">Yes, place the request!</a><%
+       end
+elseif $"modRule2" <> "" then
+       val id = Sec.Req.add (you, String.concat ["Change firewall rule \"", uname, " ", $"modRule2", "\" to \"", uname, " ", $"rule", "\""], $"msg");
+       if not (Sec.Req.notifyNew id) then
+               %><h3><b>Error sending e-mail notification</b></h3><%
+       end
+       %><h3><b>Request added</b></h3><%
+
+elseif $"delRule" <> "" then
+       showNormal := false;
+       val oldRule = $"delRule";
+       %>Are you sure you want to request that firewall rule <b><% Web.html uname %>&nbsp;<% Web.html oldRule %></b> be <b>deleted</b>?<br>
+       <a href="sec?uname=<% Web.urlEncode uname %>&delRule2=<% Web.urlEncode oldRule %>&msg=<% Web.urlEncode ($"msg") %>">Yes, place the request!</a><%
+elseif $"delRule2" <> "" then
+       val id = Sec.Req.add (you, String.concat ["Delete firewall rule \"", uname, " ", $"delRule2", "\""], $"msg");
+       if not (Sec.Req.notifyNew id) then
+               %><h3><b>Error sending e-mail notification</b></h3><%
+       end
+       %><h3><b>Request added</b></h3><%
+
 elseif $"cmd" = "open" then
        showNormal := false;
        Group.requireGroupName "server";
@@ -176,6 +231,51 @@ if showNormal then %>
 </table>
 </form>
 
+<h3><b>Request change to your <tt>cron</tt> permissions</b></h3>
+
+<form action="sec" method="post">
+<input type="hidden" name="uname" value="<% uname %>">
+<input type="hidden" name="cmd" value="cron">
+<table>
+<tr> <td align="right"><b>Allowed to use cron?</b></td> <td><select name="cron">
+       <option value="no"<% if not cron then %> selected<% end %>>No</option>
+       <option value="yes"<% if cron then %> selected<% end %>>Yes</option>
+</select></td> </tr>
+<tr> <td align="right" valign="top"><b>Reason:</b></td> <td><textarea name="msg" wrap="soft" rows="3" cols="80"></textarea></td> </tr>
+<tr> <td><input type="submit" value="Request"></td> </tr>
+</table>
+</form>
+
+<% val rules = Sec.findFirewallRules uname;
+switch rules of
+  _::_ => %>
+<h3><b>Your firewall rules</b></h3>
+
+<% foreach rule in rules do %>
+<form action="sec" method="post">
+<input type="hidden" name="uname" value="<% uname %>">
+<input type="hidden" name="modRule" value="<% Web.html rule %>">
+<input name="rule" value="<% Web.html rule %>">
+<a href="sec?delRule=<% Web.urlEncode rule %>">[Request deletion]</a>
+<input type="submit" value="Request change">
+</form><br>
+<% end
+end%>
+
+<h3><b>Request a new firewall rule</b></h3>
+
+<p>You can find a description of rule formats <a href="http://wiki.hcoop.net/wiki/FirewallRules">on our wiki</a>. Enter here the rule you want, without the initial <tt>user</tt> portion.</p>
+
+<form action="sec" method="post">
+<input type="hidden" name="uname" value="<% uname %>">
+<input type="hidden" name="cmd" value="rule">
+<table>
+<tr> <td align="right"><b>Rule</b></td> <td><input name="rule" size="80"></td> </tr>
+<tr> <td align="right" valign="top"><b>Reason:</b></td> <td><textarea name="msg" wrap="soft" rows="3" cols="80"></textarea></td> </tr>
+<tr> <td><input type="submit" value="Request"></td> </tr>
+</table>
+</form>
+
 <% end %>
 
 <% @footer[] %>
\ No newline at end of file

diff --git a/sec.sig b/sec.sig
index 947e601..494e5d7 100644 (file)
--- a/sec.sig
+++ b/sec.sig
@@ -12,4 +12,7 @@ signature SEC = sig
     val inGroup : string * string -> bool
     val socketPerms : string -> socket_perms
     val isTpe : string -> bool
+    val cronAllowed : string -> bool
+
+    val findFirewallRules : string -> string list
 end

diff --git a/sec.sml b/sec.sml
index 5974bc2..cfa6d69 100644 (file)
--- a/sec.sml
+++ b/sec.sml
@@ -77,4 +77,40 @@ fun socketPerms uname =
 
 fun isTpe uname = inGroup (uname, "only-tpe")
 
+fun findFirewallRules uname =
+    let
+       val inf = TextIO.openIn "/etc/firewall/users.rules"
+
+       fun loop rules =
+           case TextIO.inputLine inf of
+               NONE => List.rev rules
+             | SOME line =>
+               if String.sub (line, 0) = #"#" then
+                   loop rules
+               else case String.tokens Char.isSpace line of
+                   uname'::rest =>
+                   if uname = uname' then
+                       loop (String.concatWith " " rest :: rules)
+                   else
+                       loop rules
+                 | _ => loop rules
+    in
+       loop []
+       before TextIO.closeIn inf
+    end
+
+fun cronAllowed uname =
+    let
+       val inf = TextIO.openIn "/etc/cron.allow"
+       val uname' = uname ^ "\n"
+
+       fun loop () =
+           case TextIO.inputLine inf of
+               NONE => false
+             | SOME line => line = uname' orelse loop ()
+    in
+       loop ()
+       before TextIO.closeIn inf
+    end
+
 end