From e37b26e0685d2dd6a4b7807097808f5dec648993 Mon Sep 17 00:00:00 2001 From: Badlop Date: Thu, 25 Jun 2009 17:04:03 +0000 Subject: [PATCH] Improvements in the WebAdmin browsing menus. SVN Revision: 2336 --- src/web/ejabberd_web_admin.erl | 284 +++++++++++++++++++++++---------- 1 file changed, 202 insertions(+), 82 deletions(-) diff --git a/src/web/ejabberd_web_admin.erl b/src/web/ejabberd_web_admin.erl index 35934d94d..209cc76d3 100644 --- a/src/web/ejabberd_web_admin.erl +++ b/src/web/ejabberd_web_admin.erl @@ -47,6 +47,95 @@ ?XMLATTR('name', Name), ?XMLATTR('value', Value)])). +%%%================================== +%%%% get_acl_access + +%% @spec (Path::[string()]) -> {HostOfRule, AccessRule} + +%% All accounts can access those URLs +get_acl_rule([]) -> {"localhost", all}; +get_acl_rule(["style.css"]) -> {"localhost", all}; +get_acl_rule(["logo.png"]) -> {"localhost", all}; +get_acl_rule(["logo-fill.png"]) -> {"localhost", all}; +get_acl_rule(["favicon.ico"]) -> {"localhost", all}; +get_acl_rule(["additions.js"]) -> {"localhost", all}; +%% This page only displays vhosts that the user is admin: +get_acl_rule(["vhosts"]) -> {"localhost", all}; + +%% The pages of a vhost are only accesible if the user is admin of that vhost: +get_acl_rule(["server", VHost | _RPath]) -> {VHost, configure}; + +%% Default rule: only global admins can access any other random page +get_acl_rule(_RPath) -> {global, configure}. + +%%%================================== +%%%% Menu Items Access + +get_jid(Auth, HostHTTP) -> + case get_auth_admin(Auth, HostHTTP, []) of + {ok, {User, Server}} -> + exmpp_jid:make(User, Server, ""); + {unauthorized, Error} -> + ?ERROR_MSG("Unauthorized ~p: ~p", [Auth, Error]), + throw({unauthorized, Auth}) + end. + +get_menu_items(global, cluster, Lang, JID) -> + {Base, _, Items} = make_server_menu([], [], Lang, JID), + lists:map( + fun({URI, Name}) -> + {Base++URI++"/", Name}; + ({URI, Name, _SubMenu}) -> + {Base++URI++"/", Name} + end, + Items + ); +get_menu_items(Host, cluster, Lang, JID) -> + {Base, _, Items} = make_host_menu(Host, [], Lang, JID), + lists:map( + fun({URI, Name}) -> + {Base++URI++"/", Name}; + ({URI, Name, _SubMenu}) -> + {Base++URI++"/", Name} + end, + Items + ); +get_menu_items(Host, Node, Lang, JID) -> + {Base, _, Items} = make_host_node_menu(Host, Node, Lang, JID), + lists:map( + fun({URI, Name}) -> + {Base++URI++"/", Name}; + ({URI, Name, _SubMenu}) -> + {Base++URI++"/", Name} + end, + Items + ). + +is_allowed_path(BasePath, {Path, _}, JID) -> + is_allowed_path(BasePath ++ [Path], JID); +is_allowed_path(BasePath, {Path, _, _}, JID) -> + is_allowed_path(BasePath ++ [Path], JID). + +is_allowed_path(["admin" | Path], JID) -> + is_allowed_path(Path, JID); +is_allowed_path(Path, JID) -> + {HostOfRule, AccessRule} = get_acl_rule(Path), + allow == acl:match_rule(HostOfRule, AccessRule, JID). + +%% @spec(Path) -> URL +%% where Path = [string()] +%% URL = string() +%% Convert ["admin", "user", "tom"] -> "/admin/user/tom/" +%%path_to_url(Path) -> +%% "/" ++ string:join(Path, "/") ++ "/". + +%% @spec(URL) -> Path +%% where Path = [string()] +%% URL = string() +%% Convert "admin/user/tom" -> ["admin", "user", "tom"] +url_to_path(URL) -> + string:tokens(URL, "/"). + %%%================================== %%%% process/2 @@ -74,13 +163,15 @@ process(["doc", LocalFile], _Request) -> end end; -process(["server", SHost | RPath], #request{auth = Auth, lang = Lang, host = HostHTTP} = Request) -> +process(["server", SHost | RPath] = Path, #request{auth = Auth, lang = Lang, host = HostHTTP} = Request) -> Host = exmpp_stringprep:nameprep(SHost), case lists:member(Host, ?MYHOSTS) of true -> - case get_auth_admin(Auth, Host, HostHTTP) of + case get_auth_admin(Auth, HostHTTP, Path) of {ok, {User, Server}} -> + AJID = get_jid(Auth, HostHTTP), process_admin(Host, Request#request{path = RPath, + auth = {auth_jid, Auth, AJID}, us = {User, Server}}); {unauthorized, "no-auth-provided"} -> {401, @@ -99,9 +190,11 @@ process(["server", SHost | RPath], #request{auth = Auth, lang = Lang, host = Hos end; process(RPath, #request{auth = Auth, lang = Lang, host = HostHTTP} = Request) -> - case get_auth_admin(Auth, global, HostHTTP) of + case get_auth_admin(Auth, HostHTTP, RPath) of {ok, {User, Server}} -> + AJID = get_jid(Auth, HostHTTP), process_admin(global, Request#request{path = RPath, + auth = {auth_jid, Auth, AJID}, us = {User, Server}}); {unauthorized, "no-auth-provided"} -> {401, @@ -116,19 +209,20 @@ process(RPath, #request{auth = Auth, lang = Lang, host = HostHTTP} = Request) -> ejabberd_web:make_xhtml([?XCT('h1', "Unauthorized")])} end. -get_auth_admin(Auth, Host, HostHTTP) -> +get_auth_admin(Auth, HostHTTP, RPath) -> case Auth of {SJID, Pass} -> try + {HostOfRule, AccessRule} = get_acl_rule(RPath), JID = exmpp_jid:parse(SJID), User = exmpp_jid:node_as_list(JID), Server = exmpp_jid:domain_as_list(JID), case User == undefined of true -> %% If only specified username, not username@server - get_auth_account(Host, Server, HostHTTP, Pass); + get_auth_account(HostOfRule, AccessRule, User, HostHTTP, Pass); false -> - get_auth_account(Host, User, Server, Pass) + get_auth_account(HostOfRule, AccessRule, User, Server, Pass) end catch _ -> @@ -138,10 +232,10 @@ get_auth_admin(Auth, Host, HostHTTP) -> {unauthorized, "no-auth-provided"} end. -get_auth_account(Host, User, Server, Pass) -> +get_auth_account(HostOfRule, AccessRule, User, Server, Pass) -> case ejabberd_auth:check_password(User, Server, Pass) of true -> - case acl:match_rule(Host, configure, + case acl:match_rule(HostOfRule, AccessRule, exmpp_jid:make(User, Server)) of deny -> {unauthorized, "unprivileged-account"}; @@ -160,15 +254,16 @@ get_auth_account(Host, User, Server, Pass) -> %%%================================== %%%% make_xhtml -make_xhtml(Els, Host, Lang) -> - make_xhtml(Els, Host, cluster, Lang). +make_xhtml(Els, Host, Lang, JID) -> + make_xhtml(Els, Host, cluster, Lang, JID). -%% @spec (Els, Host, Node, Lang) -> {200, [html], xmlelement()} +%% @spec (Els, Host, Node, Lang, JID) -> {200, [html], xmlelement()} %% where Host = global | string() %% Node = cluster | atom() -make_xhtml(Els, Host, Node, Lang) -> +%% JID = jid() +make_xhtml(Els, Host, Node, Lang, JID) -> Base = get_base_path(Host, cluster), %% Enforcing 'cluster' on purpose here - MenuItems = make_navigation(Host, Node, Lang), + MenuItems = make_navigation(Host, Node, Lang, JID), {200, [html], #xmlel{ns = ?NS_XHTML, name = 'html', attrs = [ exmpp_xml:attribute(?NS_XML, 'lang', Lang), @@ -661,41 +756,25 @@ logo_fill() -> process_admin(global, #request{path = [], + auth = {_, _, AJID}, lang = Lang}) -> - Base = get_base_path(global, cluster), - MenuItems2 = make_menu_items(global, cluster, Base, Lang), + %%Base = get_base_path(global, cluster), make_xhtml(?H1GL(?T("Administration"), "toc", "Contents") ++ [?XE('ul', - [?LI([?ACT("/admin/acls/", "Access Control Lists"), ?C(" "), - ?ACT("/admin/acls-raw/", "(Raw)")]), - ?LI([?ACT("/admin/access/", "Access Rules"), ?C(" "), - ?ACT("/admin/access-raw/", "(Raw)")]), - ?LI([?ACT("/admin/vhosts/", "Virtual Hosts")]), - ?LI([?ACT("/admin/nodes/", "Nodes")]), - ?LI([?ACT("/admin/stats/", "Statistics")]) - ] ++ MenuItems2 + [?LI([?ACT(MIU, MIN)]) || {MIU, MIN} <- get_menu_items(global, cluster, Lang, AJID)] ) - ], global, Lang); + ], global, Lang, AJID); process_admin(Host, #request{path = [], + auth = {_, _Auth, AJID}, lang = Lang}) -> - Base = get_base_path(Host, cluster), - MenuItems2 = make_menu_items(Host, cluster, Base, Lang), + %%Base = get_base_path(Host, cluster), make_xhtml([?XCT('h1', "Administration"), ?XE('ul', - [?LI([?ACT(Base ++ "acls/", "Access Control Lists"), ?C(" "), - ?ACT(Base ++ "acls-raw/", "(Raw)")]), - ?LI([?ACT(Base ++ "access/", "Access Rules"), ?C(" "), - ?ACT(Base ++ "access-raw/", "(Raw)")]), - ?LI([?ACT(Base ++ "users/", "Users")]), - ?LI([?ACT(Base ++ "online-users/", "Online Users")]), - ?LI([?ACT(Base ++ "last-activity/", "Last Activity")]), - ?LI([?ACT(Base ++ "nodes/", "Nodes")]), - ?LI([?ACT(Base ++ "stats/", "Statistics")]) - ] ++ MenuItems2 + [?LI([?ACT(MIU, MIN)]) || {MIU, MIN} <- get_menu_items(Host, cluster, Lang, AJID)] ) - ], Host, Lang); + ], Host, Lang, AJID); process_admin(Host, #request{path = ["style.css"]}) -> {200, [{"Content-Type", "text/css"}, last_modified(), cache_control_public()], css(Host)}; @@ -715,6 +794,7 @@ process_admin(_Host, #request{path = ["additions.js"]}) -> process_admin(Host, #request{path = ["acls-raw"], q = Query, + auth = {_, _Auth, AJID}, lang = Lang}) -> Res = case lists:keysearch("acls", 1, Query) of @@ -752,11 +832,12 @@ process_admin(Host, ?BR, ?INPUTT("submit", "submit", "Submit") ]) - ], Host, Lang); + ], Host, Lang, AJID); process_admin(Host, #request{method = Method, path = ["acls"], + auth = {_, _Auth, AJID}, q = Query, lang = Lang}) -> ?DEBUG("query: ~p", [Query]), @@ -795,10 +876,11 @@ process_admin(Host, ?C(" "), ?INPUTT("submit", "submit", "Submit") ]) - ], Host, Lang); + ], Host, Lang, AJID); process_admin(Host, #request{path = ["access-raw"], + auth = {_, _Auth, AJID}, q = Query, lang = Lang}) -> SetAccess = @@ -859,12 +941,13 @@ process_admin(Host, ?BR, ?INPUTT("submit", "submit", "Submit") ]) - ], Host, Lang); + ], Host, Lang, AJID); process_admin(Host, #request{method = Method, path = ["access"], q = Query, + auth = {_, _Auth, AJID}, lang = Lang}) -> ?DEBUG("query: ~p", [Query]), Res = case Method of @@ -895,11 +978,12 @@ process_admin(Host, ?BR, ?INPUTT("submit", "delete", "Delete Selected") ]) - ], Host, Lang); + ], Host, Lang, AJID); process_admin(Host, #request{path = ["access", SName], q = Query, + auth = {_, _Auth, AJID}, lang = Lang}) -> ?DEBUG("query: ~p", [Query]), Name = list_to_atom(SName), @@ -934,36 +1018,41 @@ process_admin(Host, ?BR, ?INPUTT("submit", "submit", "Submit") ]) - ], Host, Lang); + ], Host, Lang, AJID); process_admin(global, #request{path = ["vhosts"], + auth = {_, _Auth, AJID}, lang = Lang}) -> - Res = list_vhosts(Lang), - make_xhtml(?H1GL(?T("ejabberd virtual hosts"), "virtualhost", "Virtual Hosting") ++ Res, global, Lang); + Res = list_vhosts(Lang, AJID), + make_xhtml(?H1GL(?T("ejabberd virtual hosts"), "virtualhost", "Virtual Hosting") ++ Res, global, Lang, AJID); process_admin(Host, #request{path = ["users"], q = Query, + auth = {_, _Auth, AJID}, lang = Lang}) when is_list(Host) -> Res = list_users(Host, Query, Lang, fun url_func/1), - make_xhtml([?XCT('h1', "Users")] ++ Res, Host, Lang); + make_xhtml([?XCT('h1', "Users")] ++ Res, Host, Lang, AJID); process_admin(Host, #request{path = ["users", Diap], + auth = {_, _Auth, AJID}, lang = Lang}) when is_list(Host) -> Res = list_users_in_diapason(Host, Diap, Lang, fun url_func/1), - make_xhtml([?XCT('h1', "Users")] ++ Res, Host, Lang); + make_xhtml([?XCT('h1', "Users")] ++ Res, Host, Lang, AJID); process_admin(Host, #request{ path = ["online-users"], + auth = {_, _Auth, AJID}, lang = Lang}) when is_list(Host) -> Res = list_online_users(Host, Lang), - make_xhtml([?XCT('h1', "Online Users")] ++ Res, Host, Lang); + make_xhtml([?XCT('h1', "Online Users")] ++ Res, Host, Lang, AJID); process_admin(Host, #request{path = ["last-activity"], + auth = {_, _Auth, AJID}, q = Query, lang = Lang}) when is_list(Host) -> ?DEBUG("query: ~p", [Query]), @@ -999,55 +1088,61 @@ process_admin(Host, ?C(" "), ?INPUTT("submit", "integral", "Show Integral Table") ])] ++ - Res, Host, Lang); + Res, Host, Lang, AJID); process_admin(Host, #request{path = ["stats"], + auth = {_, _Auth, AJID}, lang = Lang}) -> Res = get_stats(Host, Lang), - make_xhtml([?XCT('h1', "Statistics")] ++ Res, Host, Lang); + make_xhtml([?XCT('h1', "Statistics")] ++ Res, Host, Lang, AJID); process_admin(Host, #request{path = ["user", U], + auth = {_, _Auth, AJID}, q = Query, lang = Lang}) -> case ejabberd_auth:is_user_exists(U, Host) of true -> Res = user_info(U, Host, Query, Lang), - make_xhtml(Res, Host, Lang); + make_xhtml(Res, Host, Lang, AJID); false -> - make_xhtml([?XCT('h1', "Not Found")], Host, Lang) + make_xhtml([?XCT('h1', "Not Found")], Host, Lang, AJID) end; process_admin(Host, #request{path = ["nodes"], + auth = {_, _Auth, AJID}, lang = Lang}) -> Res = get_nodes(Lang), - make_xhtml(Res, Host, Lang); + make_xhtml(Res, Host, Lang, AJID); process_admin(Host, #request{path = ["node", SNode | NPath], + auth = {_, _Auth, AJID}, q = Query, lang = Lang}) -> case search_running_node(SNode) of false -> - make_xhtml([?XCT('h1', "Node not found")], Host, Lang); + make_xhtml([?XCT('h1', "Node not found")], Host, Lang, AJID); Node -> Res = get_node(Host, Node, NPath, Query, Lang), - make_xhtml(Res, Host, Node, Lang) + make_xhtml(Res, Host, Node, Lang, AJID) end; %%%================================== %%%% process_admin default case -process_admin(Host, #request{lang = Lang} = Request) -> +process_admin(Host, #request{lang = Lang, + auth = {_, _Auth, AJID} + } = Request) -> {Hook, Opts} = case Host of global -> {webadmin_page_main, [Request]}; Host -> {webadmin_page_host, [Host, Request]} end, case ejabberd_hooks:run_fold(Hook, list_to_binary(Host), [], Opts) of - [] -> setelement(1, make_xhtml([?XC('h1', "Not Found")], Host, Lang), 404); - Res -> make_xhtml(Res, Host, Lang) + [] -> setelement(1, make_xhtml([?XC('h1', "Not Found")], Host, Lang, AJID), 404); + Res -> make_xhtml(Res, Host, Lang, AJID) end. %%%================================== @@ -1350,8 +1445,17 @@ parse_access_rule(Text) -> %%%================================== %%%% list_vhosts -list_vhosts(Lang) -> +list_vhosts(Lang, JID) -> Hosts = ?MYHOSTS, + HostsAllowed = lists:filter( + fun(Host) -> + allow == acl:match_rule(Host, configure, JID) + end, + Hosts + ), + list_vhosts2(Lang, HostsAllowed). + +list_vhosts2(Lang, Hosts) -> SHosts = lists:sort(Hosts), [?XE('table', [?XE('thead', @@ -2449,14 +2553,24 @@ pretty_string_int(String) when is_list(String) -> %%%================================== %%%% navigation menu -%% @spec (Host, Node, Lang) -> [LI] -make_navigation(Host, Node, Lang) -> - HostNodeMenu = make_host_node_menu(Host, Node, Lang), - HostMenu = make_host_menu(Host, HostNodeMenu, Lang), - NodeMenu = make_node_menu(Host, Node, Lang), - Menu = make_server_menu(HostMenu, NodeMenu, Lang), +%% @spec (Host, Node, Lang, JID::jid()) -> [LI] +make_navigation(Host, Node, Lang, JID) -> + Menu = make_navigation_menu(Host, Node, Lang, JID), make_menu_items(Lang, Menu). +%% @spec (Host, Node, Lang, JID::jid()) -> Menu +%% where Host = global | string() +%% Node = cluster | string() +%% Lang = string() +%% Menu = {URL, Title} | {URL, Title, [Menu]} +%% URL = string() +%% Title = string() +make_navigation_menu(Host, Node, Lang, JID) -> + HostNodeMenu = make_host_node_menu(Host, Node, Lang, JID), + HostMenu = make_host_menu(Host, HostNodeMenu, Lang, JID), + NodeMenu = make_node_menu(Host, Node, Lang), + make_server_menu(HostMenu, NodeMenu, Lang, JID). + %% @spec (Host, Node, Base, Lang) -> [LI] make_menu_items(global, cluster, Base, Lang) -> HookItems = get_menu_items_hook(server, Lang), @@ -2475,19 +2589,21 @@ make_menu_items(Host, Node, Base, Lang) -> make_menu_items(Lang, {Base, "", HookItems}). -make_host_node_menu(global, _, _Lang) -> +make_host_node_menu(global, _, _Lang, _JID) -> {"", "", []}; -make_host_node_menu(_, cluster, _Lang) -> +make_host_node_menu(_, cluster, _Lang, _JID) -> {"", "", []}; -make_host_node_menu(Host, Node, Lang) -> +make_host_node_menu(Host, Node, Lang, JID) -> HostNodeBase = get_base_path(Host, Node), - HostNodeFixed = [{"modules/", "Modules"}], - HostNodeHook = get_menu_items_hook({hostnode, Host, Node}, Lang), - {HostNodeBase, atom_to_list(Node), HostNodeFixed ++ HostNodeHook}. + HostNodeFixed = [{"modules/", "Modules"}] + ++ get_menu_items_hook({hostnode, Host, Node}, Lang), + HostNodeBasePath = url_to_path(HostNodeBase), + HostNodeFixed2 = [Tuple || Tuple <- HostNodeFixed, is_allowed_path(HostNodeBasePath, Tuple, JID)], + {HostNodeBase, atom_to_list(Node), HostNodeFixed2}. -make_host_menu(global, _HostNodeMenu, _Lang) -> +make_host_menu(global, _HostNodeMenu, _Lang, _JID) -> {"", "", []}; -make_host_menu(Host, HostNodeMenu, Lang) -> +make_host_menu(Host, HostNodeMenu, Lang, JID) -> HostBase = get_base_path(Host, cluster), HostFixed = [{"acls", "Access Control Lists"}, {"access", "Access Rules"}, @@ -2495,9 +2611,11 @@ make_host_menu(Host, HostNodeMenu, Lang) -> {"online-users", "Online Users"}, {"last-activity", "Last Activity"}, {"nodes", "Nodes", HostNodeMenu}, - {"stats", "Statistics"}], - HostHook = get_menu_items_hook({host, Host}, Lang), - {HostBase, Host, HostFixed ++ HostHook}. + {"stats", "Statistics"}] + ++ get_menu_items_hook({host, Host}, Lang), + HostBasePath = url_to_path(HostBase), + HostFixed2 = [Tuple || Tuple <- HostFixed, is_allowed_path(HostBasePath, Tuple, JID)], + {HostBase, Host, HostFixed2}. make_node_menu(_Host, cluster, _Lang) -> {"", "", []}; @@ -2507,21 +2625,23 @@ make_node_menu(global, Node, Lang) -> {"backup/", "Backup"}, {"ports/", "Listened Ports"}, {"stats/", "Statistics"}, - {"update/", "Update"}], - NodeHook = get_menu_items_hook({node, Node}, Lang), - {NodeBase, atom_to_list(Node), NodeFixed ++ NodeHook}; + {"update/", "Update"}] + ++ get_menu_items_hook({node, Node}, Lang), + {NodeBase, atom_to_list(Node), NodeFixed}; make_node_menu(_Host, _Node, _Lang) -> {"", "", []}. -make_server_menu(HostMenu, NodeMenu, Lang) -> +make_server_menu(HostMenu, NodeMenu, Lang, JID) -> Base = get_base_path(global, cluster), Fixed = [{"acls", "Access Control Lists"}, {"access", "Access Rules"}, {"vhosts", "Virtual Hosts", HostMenu}, {"nodes", "Nodes", NodeMenu}, - {"stats", "Statistics"}], - Hook = get_menu_items_hook(server, Lang), - {Base, "ejabberd", Fixed ++ Hook}. + {"stats", "Statistics"}] + ++ get_menu_items_hook(server, Lang), + BasePath = url_to_path(Base), + Fixed2 = [Tuple || Tuple <- Fixed, is_allowed_path(BasePath, Tuple, JID)], + {Base, "ejabberd", Fixed2}. get_menu_items_hook({hostnode, Host, Node}, Lang) ->