Changeset 2032 for pykota/trunk/cgi-bin

Timestamp:

01/19/05 09:49:41 (20 years ago)

Author:

jalet

Message:

Now dumpykota.cgi behaves like printquota.cgi wrt the REMOTE_USER environment
variables if the script is username+password protected.
Small fix in printquota.cgi wrt ldap auth with Apache : the workaround was
not used everywhere.

Location:

pykota/trunk/cgi-bin

Files:

• dumpykota.cgi (modified) (3 diffs)
• printquota.cgi (modified) (4 diffs)
• README (modified) (1 diff)

pykota/trunk/cgi-bin/dumpykota.cgi

@@ -24 +24 @@
 #
 # $Log$
+# Revision 1.5  2005/01/19 08:49:41  jalet
+# Now dumpykota.cgi behaves like printquota.cgi wrt the REMOTE_USER environment
+# variables if the script is username+password protected.
+# Small fix in printquota.cgi wrt ldap auth with Apache : the workaround was
+# not used everywhere.
+#
 # Revision 1.4  2005/01/17 08:44:24  jalet
 # Modified copyright years
@@ -149 +155 @@
                     self.arguments = self.form["filter"].value.split()
                     
+                # when no authentication is done, or when the remote username    
+                # is 'root' (even if not run as root of course), then unrestricted
+                # dump is allowed.
+                remuser = os.environ.get("REMOTE_USER", "root")    
+                # special hack to accomodate mod_auth_ldap Apache module
+                try :
+                    remuser = remuser.split("=")[1].split(",")[0]
+                except IndexError :    
+                    pass
+                if remuser != "root" :
+                    # non-'root' users when the script is password protected
+                    # can not dump any data as they like, we restrict them
+                    # to their own datas.
+                    if self.options["data"] not in ["printers", "pmembers", "groups", "gpquotas"] :
+                        self.arguments.append("username=%s" % remuser)
+                    
                 if self.options["format"] in ("csv", "ssv") :
-                    #ctype = "application/vnd.sun.xml.calc"
+                    #ctype = "application/vnd.sun.xml.calc"     # OpenOffice.org
                     ctype = "text/comma-separated-values"
                     fname = "dump.csv"
                 elif self.options["format"] == "tsv" :
-                    #ctype = "application/vnd.sun.xml.calc"
+                    #ctype = "application/vnd.sun.xml.calc"     # OpenOffice.org
                     ctype = "text/tab-separated-values"
                     fname = "dump.tsv"
@@ -167 +189 @@
                 print
                 try :
-                    self.main(self.arguments, self.options)
+                    self.main(self.arguments, self.options, restricted=0)
                 except PyKotaToolError, msg :    
                     print msg

pykota/trunk/cgi-bin/printquota.cgi

@@ -24 +24 @@
 #
 # $Log$
+# Revision 1.44  2005/01/19 08:49:41  jalet
+# Now dumpykota.cgi behaves like printquota.cgi wrt the REMOTE_USER environment
+# variables if the script is username+password protected.
+# Small fix in printquota.cgi wrt ldap auth with Apache : the workaround was
+# not used everywhere.
+#
 # Revision 1.43  2005/01/17 08:44:24  jalet
 # Modified copyright years
@@ -255 +261 @@
         """Main function"""
         printers = ugmask = isgroup = None
+        remuser = os.environ.get("REMOTE_USER", "root")    
+        # special hack to accomodate mod_auth_ldap Apache module
+        try :
+            remuser = remuser.split("=")[1].split(",")[0]
+        except IndexError :    
+            pass
         self.body = "<p>%s</p>\n" % _("Please click on the above button")
         if self.form.has_key("report") :
@@ -264 +276 @@
             else :    
                 printers = self.storage.getMatchingPrinters("*")
-            remuser = os.environ.get("REMOTE_USER", "root")    
-            
-            # special hack to accomodate mod_auth_ldap Apache module
-            try :
-                remuser = remuser.split("=")[1].split(",")[0]
-            except IndexError :    
-                pass
-            
             if remuser == "root" :
                 if self.form.has_key("ugmask") :     
@@ -300 +304 @@
                 self.body += "%s" % self.reportingtool.generateReport()
         else :        
-            remuser = os.environ.get("REMOTE_USER", "root")    
             if remuser != "root" :
                 username = remuser

pykota/trunk/cgi-bin/README

@@ -25 +25 @@
 Be sure to restrict access to these CGI scripts as necessary.
 
-If you protect access to printquota.cgi with user+password
-authentication, the REMOTE_USER CGI environment variable
-is honored, so an user can only see his own quota report, but
-not other users' quota.
+If you protect access to printquota.cgi or dumpykota.cgi with 
+username+password authentication, the REMOTE_USER CGI environment variable
+is honored, so an user can only see his own datas, but not
+other users' datas. However, the special REMOTE_USER value 'root'
+is allowed an unrestricted access.
 
-To make dumpykota.cgi work, you have to ensure that your web server 
-runs it as a PyKota administrator. This means that dumpykota.cgi 
-when run must be able to read the pykotadmin.conf file. There are 
-several ways to do so, one of them is to put the user your web 
-server normally runs as into the pykota group (which must be allowed 
-to read pykotadmin.conf), then restart your web server :
-            
-            $ adduser www-data pykota
-            $ /etc/init.d/apache restart
-            
-This is probably not the safest way though, so you may want to            
-restrict access further with an username and password, or use
-Apache's suExec mechanism to directly run this particular 
-script as the pykota system user. Please refer to your web
-server's documentation for details.
-        
+If no username+password authentication takes place, then access
+is completely unrestricted.
+
+You must ensure that the user your web server runs as can read
+PyKota's pykota.conf configuration file. No read access to
+PyKota's pykotadmin.conf configuration file is necessary though.
+
 The web server doesn't need to be a print server nor a PyKota 
 Storage Backend server, but it must contain a correctly configured