From: Steinar H. Gunderson Date: Tue, 14 May 2013 22:50:35 +0000 (+0200) Subject: Add the bare minimum of what is required for the web interface to work (but be butt... X-Git-Url: https://git.sesse.net/?p=itkacl;a=commitdiff_plain;h=e7130e30ca2a76082de68a72fb2a52b4510f7bf1 Add the bare minimum of what is required for the web interface to work (but be butt-ugly) and not leak passwords. --- diff --git a/itkacl-web-1.0/README b/itkacl-web-1.0/README new file mode 100644 index 0000000..a79b9c2 --- /dev/null +++ b/itkacl-web-1.0/README @@ -0,0 +1,42 @@ +How to set up the web admin interface: + +1. Install required Perl modules, e.g. on Debian/Ubuntu: + + aptitude install libdbi-perl libapache-session-perl libdbd-pg-perl + +2. Create the Postgres ITKACL database, using itkacl.sql from the + core distribution: + + createdb itkacl + psql itkacl < itkacl.sql + +3. Roots must be added manually, e.g.: + + echo "INSERT INTO objects (name, description) VALUES ('web', 'WWW-based systems');" | psql itkacl + +4. Create a separate database for holding the sessions + (see perldoc Apache::Session::Store::Postgres): + + createdb itkacl-sessions + echo 'CREATE TABLE sessions ( id char(32) not null primary key, a_session text )' | psql itkacl-sessions + +5. Create a user for itkacl-web and give it full access: + + createuser --pwprompt itkacl-web + echo 'GRANT SELECT, INSERT, UPDATE, DELETE ON objects TO "itkacl-web";' | psql itkacl + echo 'GRANT SELECT, INSERT, UPDATE, DELETE ON aclentries TO "itkacl-web";' | psql itkacl + echo 'GRANT SELECT, INSERT, UPDATE, DELETE ON sessions TO "itkacl-web";' | psql itkacl-sessions + + You could use a separate session username if you wish, although there's + probably not point. + +6. Set up an include/config.local.pm file. It will probably look very much like + include/config.pm, except without the eval part, and with your own values + for password etc. filled in. Remember to chmod so that it is only readable + by the web server. + +7. Make a vhost in Apache (or any other web server supporting CGI), with the web/ + directory as the DocumentRoot, index.pl as the DocumentIndex, and .pl enabled + as CGI scripts. + +8. Go to your vhost, and administer to your heart's content. diff --git a/itkacl-web-1.0/README.icons b/itkacl-web-1.0/README.icons new file mode 100644 index 0000000..c7d4fe4 --- /dev/null +++ b/itkacl-web-1.0/README.icons @@ -0,0 +1,6 @@ +The icons used used in this web interface are modified versions of the +Silk icon set, licensed under CC-BY-SA 3.0. See + + http://www.famfamfam.com/lab/icons/silk/ + +for more information. diff --git a/itkacl-web-1.0/include/config.local.pm b/itkacl-web-1.0/include/config.local.pm new file mode 100644 index 0000000..93dc9fd --- /dev/null +++ b/itkacl-web-1.0/include/config.local.pm @@ -0,0 +1,13 @@ +package itkaclconfig; + +our $db_host = "localhost"; +our $db_name = "itkacl"; +our $db_user = "itkacl-web"; +our $db_pass = "aoiexrjwr"; + +our $sessiondb_host = "localhost"; +our $sessiondb_name = "itkacl-sessions"; +our $sessiondb_user = "itkacl-web"; +our $sessiondb_pass = "aoiexrjwr"; + +1; diff --git a/itkacl-web-1.0/include/config.pm b/itkacl-web-1.0/include/config.pm new file mode 100644 index 0000000..7922930 --- /dev/null +++ b/itkacl-web-1.0/include/config.pm @@ -0,0 +1,36 @@ +#! /usr/bin/perl + +# +# ITKACL web interface: Default configuration file. +# Set your local configuration in config.local.pm instead of editing this file. +# + +use strict; +use warnings; + +package itkaclconfig; + +# Header/footer-files, for skinning. +our $header = "header.html"; +our $footer = "footer.html"; + +# Quote script. If you don't want quote-replacement, don't set it. +our $quotescript = undef; + +# Database information. You will need to supply this yourself. +our $db_host = "localhost"; +our $db_name = "itkacl"; +our $db_user = "itkacl-web"; +our $db_pass = undef; + +our $sessiondb_host = "localhost"; +our $sessiondb_name = "itkacl-sessions"; +our $sessiondb_user = "itkacl-web"; +our $sessiondb_pass = undef; + +# Local configuration overrides defaults. +eval { + require 'config.local.pm'; +}; + +1; diff --git a/itkacl-web-1.0/include/itkaclcommon.pm b/itkacl-web-1.0/include/itkaclcommon.pm new file mode 100644 index 0000000..36eb890 --- /dev/null +++ b/itkacl-web-1.0/include/itkaclcommon.pm @@ -0,0 +1,211 @@ +#! /usr/bin/perl +use strict; +use warnings; +use CGI; +use DBI; +use Apache::Session::Postgres; +use Encode; +use HTML::Entities; +use locale; +use utf8; + +require 'config.pm'; + +package itkaclcommon; + +our $cgi; +our $dbh; +our $last_modified = '$Date: 2011-11-19 11:08:01 $'; +our %session; + +sub init { + $cgi = new CGI; + $dbh = DBI->connect("dbi:Pg:dbname=$itkaclconfig::db_name;host=$itkaclconfig::db_host", + $itkaclconfig::db_user, $itkaclconfig::db_pass) + or die "Couldn't connect to database"; + $dbh->{pg_enable_utf8} = 1; + $last_modified = '$Date: 2011-11-19 11:08:01 $'; + %session = (); +} + +sub print_header { + init(); + + # Find the cookie, if any + my $session_id = $cgi->cookie('itkaclsession'); + tie %session, 'Apache::Session::Postgres', $session_id, { + DataSource => "dbi:Pg:dbname=$itkaclconfig::sessiondb_name;host=$itkaclconfig::sessiondb_host", + UserName => $itkaclconfig::sessiondb_user, + Password => $itkaclconfig::sessiondb_pass, + Commit => 1 + }; + + # Update with open/close + my $open = $cgi->param('open'); + my $close = $cgi->param('close'); + if (defined($open)) { + $session{$open} = 1; + } elsif (defined($close)) { + undef $session{$close}; + } + + my $cookie = $cgi->cookie(-name=>'itkaclsession', + -value=>$session{_session_id}, + -expires=>'+1h'); + + binmode STDOUT, ":utf8"; + print $cgi->header(-type=>'application/xhtml+xml; charset=utf-8', cookie=>$cookie, -expires=>'now'); + + open HEADER, "<", $itkaclconfig::header + or die "Couldn't open $itkaclconfig::header: $!"; + + # Find out if we're using SSO. + my $sso = ""; + if (defined($ENV{'AUTH_TYPE'}) && $ENV{'AUTH_TYPE'} eq 'Negotiate') { + $sso = 'Samfundet single sign-on'; + } + + # Set secure path. + local @ENV; + delete @ENV{qw(IFS CDPATH ENV BASH_ENV PATH)}; + + my $quote; + if (defined($itkaclconfig::quotescript)) { + # Hent inn quotes. Stygt, jodal! =) + $quote = `$itkaclconfig::quotescript`; + $quote = Encode::decode_utf8($quote); + } + + while (
) { + s/\%QUOTES\%/$quote/ if defined($quote); + s/\%SSO\%/$sso/; + s/\%META\%//; + s/\%TITLE\%/ITKACL-tre/; + s/"http:\/\/([^"]*\.(css|png))"/"https:\/\/$1"/; + print; + } + + close HEADER; +} + +sub print_footer { + untie %session; + + # Print footer + open FOOTER, "<", $itkaclconfig::footer + or die "Couldn't open $itkaclconfig::footer: $!"; + + # Strip RCS stuff from $::last_modified + (my $lm = $last_modified) =~ s/^\$[D]ate: (.*) \$$/$1/; + + while (