[WTF CVS] wtf/lib/WTF/Apache Authen.pm, 1.1.1.1, 1.2 Authz.pm, 1.1.1.1, 1.2

[Gryphon S. <gry...@us...>]

Update of /cvsroot/wtf-tracker/wtf/lib/WTF/Apache
In directory sc8-pr-cvs9.sourceforge.net:/tmp/cvs-serv2283/lib/WTF/Apache

Modified Files:
	Authen.pm Authz.pm 
Log Message:
Changes to support the creation of 'login as' functionality; managers with this new authz can login as one of their employees

Index: Authen.pm
===================================================================
RCS file: /cvsroot/wtf-tracker/wtf/lib/WTF/Apache/Authen.pm,v
retrieving revision 1.1.1.1
retrieving revision 1.2
diff -C2 -d -r1.1.1.1 -r1.2
*** Authen.pm	18 Oct 2006 16:52:50 -0000	1.1.1.1
--- Authen.pm	27 Oct 2006 22:34:51 -0000	1.2
***************
*** 4,10 ****
--- 4,13 ----
  use warnings;
  use Apache2::Const -compile => qw( OK AUTH_REQUIRED DECLINED );
+ use Apache2::Cookie;
  use WTF::DBH;
  use WTF::SQL;
  
+ use constant ROOT_URL => WTF::Config->get( 'links', 'root_url' );
+ 
  # setup database and SQL statement handles
  my $dbh = WTF::DBH->connect();
***************
*** 27,30 ****
--- 30,35 ----
  		$sth->{'authen'}->finish();
  
+ 		$r->pnotes( 'username' => $r->user() );
+ 
  		# use simple crypt() encryption to test password
  		if (
***************
*** 32,39 ****
  			( crypt( $passwd_auth, substr( $passwd_db, 0, 2 ) ) eq $passwd_db || '' )
  		) {
! 			$sth->{'last_login'}->execute($id) or die $dbh->errstr();
  			$r->pnotes( 'user_id'   => $id        );
  			$r->pnotes( 'user_name' => $user_name );
  			$r->pnotes( 'is_admin'  => $is_admin  );
  			return Apache2::Const::OK;
  		}
--- 37,89 ----
  			( crypt( $passwd_auth, substr( $passwd_db, 0, 2 ) ) eq $passwd_db || '' )
  		) {
! 
! 			# setup cookie jar
! 			my $jar = Apache2::Cookie::Jar->new($r);
! 
! 			# if this is an initial request and we haven't logged in, set
! 			# authen cookie and update last login
! 			unless ( $jar->cookies('authen') and $jar->cookies('authen')->value() ) {
! 				Apache2::Cookie->new(
! 					$r,
! 					'-name'  => 'authen',
! 					'-value' => 1,
! 					'-path'  => ROOT_URL,
! 				)->bake($r);
! 				$sth->{'last_login'}->execute($id) or die $dbh->errstr();
! 			}
! 
! 			# if we're trying to login as someone else, verify that we can
! 			# login as this particular user by checking if that user is in
! 			# our extended team
! 			if (
! 				$jar->cookies('login_as') and 
! 				$jar->cookies('login_as')->value() > 0 and
! 				(
! 					grep { $jar->cookies('login_as')->value() == $_ } 
! 					@{ WTF::Data::get_team_employee_ids($id) } 
! 				)
! 			) {
! 
! 				# verify current user has authorization to login as other user
! 				$sth->{'authz'}->execute($id) or die $dbh->errstr();
! 				if ( grep { $_->[0] eq 'login_as' } @{ $sth->{'authz'}->fetchall_arrayref() } ) {
! 
! 					$r->pnotes( 'real_user_id' => $id );
! 
! 					$sth->{'employee_by_id'}->execute( $jar->cookies('login_as')->value() );
! 					$r->pnotes( 'username' => $sth->{'employee_by_id'}->fetchrow_array() );
! 					$sth->{'employee_by_id'}->finish();
! 
! 					$sth->{'authen'}->execute( $r->pnotes('username') ) or die $dbh->errstr();
! 					( $id, $passwd_db, $user_name, $is_admin ) = $sth->{'authen'}->fetchrow_array();
! 					$sth->{'authen'}->finish();
! 				}
! 				$sth->{'authz'}->finish();
! 			}
! 
  			$r->pnotes( 'user_id'   => $id        );
  			$r->pnotes( 'user_name' => $user_name );
  			$r->pnotes( 'is_admin'  => $is_admin  );
+ 
  			return Apache2::Const::OK;
  		}

Index: Authz.pm
===================================================================
RCS file: /cvsroot/wtf-tracker/wtf/lib/WTF/Apache/Authz.pm,v
retrieving revision 1.1.1.1
retrieving revision 1.2
diff -C2 -d -r1.1.1.1 -r1.2
*** Authz.pm	18 Oct 2006 16:52:50 -0000	1.1.1.1
--- Authz.pm	27 Oct 2006 22:34:51 -0000	1.2
***************
*** 31,34 ****
--- 31,35 ----
  		( $section eq 'admin/newauthzs'  and not $r->pnotes('authz')->{'admin_authz'}  ) or
  		( $section eq 'admin/update'     and not $r->pnotes('authz')->{'update'}       ) or
+ 		( $section eq 'admin/loginas'    and not $r->pnotes('authz')->{'login_as'}     ) or
  
  		# pages and actions only administrators can view or do