Changeset 2032

Timestamp:

01/19/05 09:49:41 (19 years ago)

Author:

jalet

Message:

Now dumpykota.cgi behaves like printquota.cgi wrt the REMOTE_USER environment
variables if the script is username+password protected.
Small fix in printquota.cgi wrt ldap auth with Apache : the workaround was
not used everywhere.

Location:

pykota/trunk

Files:

• cgi-bin/dumpykota.cgi (modified) (3 diffs)
• cgi-bin/printquota.cgi (modified) (4 diffs)
• cgi-bin/README (modified) (1 diff)
• NEWS (modified) (1 diff)
• pykota/dumper.py (modified) (2 diffs)
• pykota/version.py (modified) (1 diff)

pykota/trunk/cgi-bin/dumpykota.cgi

@@ -24 +24 @@
 #
 # $Log$
+# Revision 1.5  2005/01/19 08:49:41  jalet
+# Now dumpykota.cgi behaves like printquota.cgi wrt the REMOTE_USER environment
+# variables if the script is username+password protected.
+# Small fix in printquota.cgi wrt ldap auth with Apache : the workaround was
+# not used everywhere.
+#
 # Revision 1.4  2005/01/17 08:44:24  jalet
 # Modified copyright years
@@ -149 +155 @@
                     self.arguments = self.form["filter"].value.split()
                     
+                # when no authentication is done, or when the remote username    
+                # is 'root' (even if not run as root of course), then unrestricted
+                # dump is allowed.
+                remuser = os.environ.get("REMOTE_USER", "root")    
+                # special hack to accomodate mod_auth_ldap Apache module
+                try :
+                    remuser = remuser.split("=")[1].split(",")[0]
+                except IndexError :    
+                    pass
+                if remuser != "root" :
+                    # non-'root' users when the script is password protected
+                    # can not dump any data as they like, we restrict them
+                    # to their own datas.
+                    if self.options["data"] not in ["printers", "pmembers", "groups", "gpquotas"] :
+                        self.arguments.append("username=%s" % remuser)
+                    
                 if self.options["format"] in ("csv", "ssv") :
-                    #ctype = "application/vnd.sun.xml.calc"
+                    #ctype = "application/vnd.sun.xml.calc"     # OpenOffice.org
                     ctype = "text/comma-separated-values"
                     fname = "dump.csv"
                 elif self.options["format"] == "tsv" :
-                    #ctype = "application/vnd.sun.xml.calc"
+                    #ctype = "application/vnd.sun.xml.calc"     # OpenOffice.org
                     ctype = "text/tab-separated-values"
                     fname = "dump.tsv"
@@ -167 +189 @@
                 print
                 try :
-                    self.main(self.arguments, self.options)
+                    self.main(self.arguments, self.options, restricted=0)
                 except PyKotaToolError, msg :    
                     print msg

pykota/trunk/cgi-bin/printquota.cgi

@@ -24 +24 @@
 #
 # $Log$
+# Revision 1.44  2005/01/19 08:49:41  jalet
+# Now dumpykota.cgi behaves like printquota.cgi wrt the REMOTE_USER environment
+# variables if the script is username+password protected.
+# Small fix in printquota.cgi wrt ldap auth with Apache : the workaround was
+# not used everywhere.
+#
 # Revision 1.43  2005/01/17 08:44:24  jalet
 # Modified copyright years
@@ -255 +261 @@
         """Main function"""
         printers = ugmask = isgroup = None
+        remuser = os.environ.get("REMOTE_USER", "root")    
+        # special hack to accomodate mod_auth_ldap Apache module
+        try :
+            remuser = remuser.split("=")[1].split(",")[0]
+        except IndexError :    
+            pass
         self.body = "<p>%s</p>\n" % _("Please click on the above button")
         if self.form.has_key("report") :
@@ -264 +276 @@
             else :    
                 printers = self.storage.getMatchingPrinters("*")
-            remuser = os.environ.get("REMOTE_USER", "root")    
-            
-            # special hack to accomodate mod_auth_ldap Apache module
-            try :
-                remuser = remuser.split("=")[1].split(",")[0]
-            except IndexError :    
-                pass
-            
             if remuser == "root" :
                 if self.form.has_key("ugmask") :     
@@ -300 +304 @@
                 self.body += "%s" % self.reportingtool.generateReport()
         else :        
-            remuser = os.environ.get("REMOTE_USER", "root")    
             if remuser != "root" :
                 username = remuser

pykota/trunk/cgi-bin/README

@@ -25 +25 @@
 Be sure to restrict access to these CGI scripts as necessary.
 
-If you protect access to printquota.cgi with user+password
-authentication, the REMOTE_USER CGI environment variable
-is honored, so an user can only see his own quota report, but
-not other users' quota.
+If you protect access to printquota.cgi or dumpykota.cgi with 
+username+password authentication, the REMOTE_USER CGI environment variable
+is honored, so an user can only see his own datas, but not
+other users' datas. However, the special REMOTE_USER value 'root'
+is allowed an unrestricted access.
 
-To make dumpykota.cgi work, you have to ensure that your web server 
-runs it as a PyKota administrator. This means that dumpykota.cgi 
-when run must be able to read the pykotadmin.conf file. There are 
-several ways to do so, one of them is to put the user your web 
-server normally runs as into the pykota group (which must be allowed 
-to read pykotadmin.conf), then restart your web server :
-            
-            $ adduser www-data pykota
-            $ /etc/init.d/apache restart
-            
-This is probably not the safest way though, so you may want to            
-restrict access further with an username and password, or use
-Apache's suExec mechanism to directly run this particular 
-script as the pykota system user. Please refer to your web
-server's documentation for details.
-        
+If no username+password authentication takes place, then access
+is completely unrestricted.
+
+You must ensure that the user your web server runs as can read
+PyKota's pykota.conf configuration file. No read access to
+PyKota's pykotadmin.conf configuration file is necessary though.
+
 The web server doesn't need to be a print server nor a PyKota 
 Storage Backend server, but it must contain a correctly configured 

pykota/trunk/NEWS

@@ -22 +22 @@
 PyKota NEWS :
 
+    - 1.21alpha21 :
+    
+        - dumpykota.cgi can now be run as a normal user as opposed to 
+          a PyKota administrator. No read access to pykotadmin.conf is
+          necessary anymore. This CGI scripts now honors the REMOTE_USER
+          environment variable just like printquota.cgi does, see 
+          the file cgi-bin/README for details.
+          The command line tool dumpykota must still be run by a PyKota 
+          administrator.
+          
+        - Fix exception's name error due to a change in recent versions 
+          of PygreSQL.   
+          
     - 1.21alpha20 :
-    
-        - Big bug fix wrt the datelimit field which was never
-          reset.
+          
+        - Big bug fix wrt the datelimit field which was never reset.
           
     - 1.21alpha19 :

pykota/trunk/pykota/dumper.py

@@ -21 +21 @@
 #
 # $Log$
+# Revision 1.2  2005/01/19 08:49:41  jalet
+# Now dumpykota.cgi behaves like printquota.cgi wrt the REMOTE_USER environment
+# variables if the script is username+password protected.
+# Small fix in printquota.cgi wrt ldap auth with Apache : the workaround was
+# not used everywhere.
+#
 # Revision 1.1  2005/01/08 17:03:07  jalet
 # "--format cups" output more resembling CUPS' page_log.
@@ -69 +75 @@
                         "pgroupname",
                       ]
-    def main(self, arguments, options) :
+    def main(self, arguments, options, restricted=1) :
         """Print Quota Data Dumper."""
-        if not self.config.isAdmin :
+        if restricted and not self.config.isAdmin :
             raise PyKotaToolError, "%s : %s" % (pwd.getpwuid(os.geteuid())[0], _("You're not allowed to use this command."))
             

pykota/trunk/pykota/version.py

@@ -22 +22 @@
 #
 
-__version__ = "1.21alpha20_unofficial"
+__version__ = "1.21alpha21_unofficial"
 
 __doc__ = """PyKota : a complete Printing Quota Solution for CUPS and LPRng."""