diff --git a/ChangeLog b/ChangeLog index d5e0e74d9..ac7004ae9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,32 @@ +2007-11-27 Wolfgang Sourdeau + + * SoObjects/SOGo/SOGoContentObject.m ([SOGoContentObject + -aclsForUser:uid]): copy all the roles from the container. If the + object is new, make sure the roles contain "ObjectEditor" if and + only if "ObjectCreator" is present. + + * SoObjects/SOGo/SOGoGCSFolder.m ([SOGoGCSFolder + -aclsForUser:uid]): no longer take the "ObjectReader" role into + account. + + * UI/Common/UIxFolderActions.m ([UIxFolderActions + -canAccessContentAction]): always return HTTP status 204. We want + this because we are relying on the SOPE access control manager to + grant access to this method. This requires a fine-tuned access + control in SOGo itself... + + * UI/Contacts/UIxContactsUserRightsEditor.m ([-userCanReadObjects]) + ([-setUserCanReadObjects:userCanReadObjects]): removed methods. + + * UI/MailerUI/UIxMailUserRightsEditor.m ([UIxMailUserRightsEditor + -updateRights]): no longer take the "ObjectReader" role into account. + ([-userCanReadMails], [-setUserCanReadMails:userCanReadMails]): + removed methods. + + * SoObjects/Appointments/SOGoFreeBusyObject.m ([SOGoFreeBusyObject + -fetchFreeBusyInfosFrom:_startDateto:_endDate]): specify context + when looking up the Calendar folder. + 2007-11-26 Wolfgang Sourdeau * UI/Scheduler/UIxTaskEditor.m ([UIxTaskEditor -todo]): same as below. diff --git a/SOPE/GDLContentStore/ChangeLog b/SOPE/GDLContentStore/ChangeLog index a76a21ab2..058a7edb5 100644 --- a/SOPE/GDLContentStore/ChangeLog +++ b/SOPE/GDLContentStore/ChangeLog @@ -1,3 +1,9 @@ +2007-11-27 Wolfgang Sourdeau + + * GCSFolder.m ([GCSFolder -versionOfContentWithName:], [GCSFolder + -fetchContentWithName:]): ignore records marked as deleted. + ([GCSFolder -deletionOfContentWithName:]): don't. + 2007-11-04 Wolfgang Sourdeau * GCSFolder.m ([GCSFolder -writeContent:toName:baseVersion:]): the diff --git a/SOPE/GDLContentStore/GCSFolder.m b/SOPE/GDLContentStore/GCSFolder.m index ac0495fd0..e6ec63c7c 100644 --- a/SOPE/GDLContentStore/GCSFolder.m +++ b/SOPE/GDLContentStore/GCSFolder.m @@ -251,13 +251,16 @@ static GCSStringFormatter *stringFormatter = nil; recursive:YES]; } -- (id)_fetchValueOfColumn:(NSString *)_col inContentWithName:(NSString *)_name{ +- (id) _fetchValueOfColumn: (NSString *)_col + inContentWithName: (NSString *)_name + ignoreDeleted: (BOOL) ignoreDeleted +{ EOAdaptorChannel *channel; NSException *error; NSDictionary *row; NSArray *attrs; NSString *result; - NSString *sql; + NSMutableString *sql; if ((channel = [self acquireStoreChannel]) == nil) { [self errorWithFormat:@"could not open storage channel!"]; @@ -265,20 +268,18 @@ static GCSStringFormatter *stringFormatter = nil; } /* generate SQL */ - - sql = @"SELECT "; - sql = [sql stringByAppendingString:_col]; - sql = [sql stringByAppendingString:@" FROM "]; - sql = [sql stringByAppendingString:[self storeTableName]]; - sql = [sql stringByAppendingString:@" WHERE c_name = '"]; - sql = [sql stringByAppendingString:_name]; - sql = [sql stringByAppendingString:@"'"]; - + sql = [NSMutableString stringWithFormat: @"SELECT %@" + @" FROM %@" + @" WHERE c_name = '%@'", + _col, [self storeTableName], _name]; + if (ignoreDeleted) + [sql appendString: @" AND (c_deleted != 1 OR c_deleted IS NULL)"]; + /* run SQL */ if ((error = [channel evaluateExpressionX:sql]) != nil) { [self errorWithFormat:@"%s: cannot execute SQL '%@': %@", - __PRETTY_FUNCTION__, sql, error]; + __PRETTY_FUNCTION__, sql, error]; [self releaseChannel:channel]; return nil; } @@ -300,15 +301,18 @@ static GCSStringFormatter *stringFormatter = nil; } - (NSNumber *)versionOfContentWithName:(NSString *)_name { - return [self _fetchValueOfColumn:@"c_version" inContentWithName:_name]; + return [self _fetchValueOfColumn:@"c_version" inContentWithName:_name + ignoreDeleted: YES]; } - (NSNumber *)deletionOfContentWithName:(NSString *)_name { - return [self _fetchValueOfColumn:@"c_deleted" inContentWithName:_name]; + return [self _fetchValueOfColumn:@"c_deleted" inContentWithName:_name + ignoreDeleted: NO]; } - (NSString *)fetchContentWithName:(NSString *)_name { - return [self _fetchValueOfColumn:@"c_content" inContentWithName:_name]; + return [self _fetchValueOfColumn:@"c_content" inContentWithName:_name + ignoreDeleted: YES]; } - (NSDictionary *)fetchContentsOfAllFiles { diff --git a/SoObjects/Appointments/SOGoFreeBusyObject.m b/SoObjects/Appointments/SOGoFreeBusyObject.m index 80390a733..4aa053f35 100644 --- a/SoObjects/Appointments/SOGoFreeBusyObject.m +++ b/SoObjects/Appointments/SOGoFreeBusyObject.m @@ -80,8 +80,8 @@ // SoSecurityManager *sm; NSArray *infos; - calFolder = [[container lookupName: @"Calendar" inContext: nil acquire: NO] - lookupName: @"personal" inContext: nil acquire: NO]; + calFolder = [[container lookupName: @"Calendar" inContext: context acquire: NO] + lookupName: @"personal" inContext: context acquire: NO]; // sm = [SoSecurityManager sharedSecurityManager]; // if (![sm validatePermission: SOGoPerm_FreeBusyLookup // onObject: calFolder diff --git a/SoObjects/Mailer/SOGoMailFolder.m b/SoObjects/Mailer/SOGoMailFolder.m index 96be31613..a0cff9ecf 100644 --- a/SoObjects/Mailer/SOGoMailFolder.m +++ b/SoObjects/Mailer/SOGoMailFolder.m @@ -454,10 +454,8 @@ static NSString *defaultUserID = @"anyone"; switch ([imapAcls characterAtIndex: count]) { case 'l': - [SOGoAcls addObjectUniquely: SOGoRole_ObjectViewer]; - break; case 'r': - [SOGoAcls addObjectUniquely: SOGoRole_ObjectReader]; + [SOGoAcls addObjectUniquely: SOGoRole_ObjectViewer]; break; case 's': [SOGoAcls addObjectUniquely: SOGoMailRole_SeenKeeper]; @@ -505,9 +503,10 @@ static NSString *defaultUserID = @"anyone"; while (currentAcl) { if ([currentAcl isEqualToString: SOGoRole_ObjectViewer]) - character = 'l'; - else if ([currentAcl isEqualToString: SOGoRole_ObjectReader]) - character = 'r'; + { + [imapAcls appendFormat: @"lr"]; + character = 0; + } else if ([currentAcl isEqualToString: SOGoMailRole_SeenKeeper]) character = 's'; else if ([currentAcl isEqualToString: SOGoMailRole_Writer]) diff --git a/SoObjects/Mailer/product.plist b/SoObjects/Mailer/product.plist index 2a93d2b7a..238a62294 100644 --- a/SoObjects/Mailer/product.plist +++ b/SoObjects/Mailer/product.plist @@ -42,7 +42,7 @@ superclass = "SOGoMailBaseObject"; defaultRoles = { "View" = ( "Owner", "ObjectViewer" ); - "Access Contents Information" = ( "Owner", "ObjectReader" ); + "Access Contents Information" = ( "Owner", "ObjectViewer" ); "Add Documents, Images, and Files" = ( "Owner", "ObjectCreator" ); "Delete Objects" = ( "Owner", "ObjectEraser" ); "WebDAV Access" = ( "Owner", "ObjectViewer" ); diff --git a/SoObjects/SOGo/SOGoContentObject.m b/SoObjects/SOGo/SOGoContentObject.m index e45b458f7..1e1d0f795 100644 --- a/SoObjects/SOGo/SOGoContentObject.m +++ b/SoObjects/SOGo/SOGoContentObject.m @@ -374,16 +374,14 @@ containerAcls = [container aclsForUser: uid]; if ([containerAcls count] > 0) { - if ([containerAcls containsObject: SOGoRole_ObjectCreator]) + [acls addObjectsFromArray: containerAcls]; + if (isNew) { - [acls addObject: SOGoRole_ObjectCreator]; - if (isNew) + if ([containerAcls containsObject: SOGoRole_ObjectCreator]) [acls addObject: SOGoRole_ObjectEditor]; + else + [acls removeObject: SOGoRole_ObjectEditor]; } - if ([containerAcls containsObject: SOGoRole_ObjectReader]) - [acls addObject: SOGoRole_ObjectViewer]; - if ([containerAcls containsObject: SOGoRole_ObjectEditor]) - [acls addObject: SOGoRole_ObjectEditor]; } return acls; diff --git a/SoObjects/SOGo/SOGoGCSFolder.m b/SoObjects/SOGo/SOGoGCSFolder.m index 728d3c303..8eb59067e 100644 --- a/SoObjects/SOGo/SOGoGCSFolder.m +++ b/SoObjects/SOGo/SOGoGCSFolder.m @@ -596,8 +596,6 @@ static NSString *defaultUserID = @""; containerAcls = [container aclsForUser: uid]; if ([containerAcls count] > 0) { - if ([containerAcls containsObject: SOGoRole_ObjectReader]) - [acls addObject: SOGoRole_ObjectViewer]; #warning this should be checked if ([containerAcls containsObject: SOGoRole_ObjectEraser]) [acls addObject: SOGoRole_ObjectEraser]; diff --git a/SoObjects/SOGo/SOGoPermissions.m b/SoObjects/SOGo/SOGoPermissions.m index 0e9769151..d6c25f3a9 100644 --- a/SoObjects/SOGo/SOGoPermissions.m +++ b/SoObjects/SOGo/SOGoPermissions.m @@ -26,7 +26,6 @@ NSString *SOGoRole_ObjectCreator = @"ObjectCreator"; NSString *SOGoRole_ObjectEraser = @"ObjectEraser"; NSString *SOGoRole_ObjectViewer = @"ObjectViewer"; -NSString *SOGoRole_ObjectReader = @"ObjectReader"; NSString *SOGoRole_ObjectEditor = @"ObjectEditor"; NSString *SOGoRole_FolderCreator = @"FolderCreator"; diff --git a/UI/Common/UIxFolderActions.m b/UI/Common/UIxFolderActions.m index 44d21f6d3..d8c659685 100644 --- a/UI/Common/UIxFolderActions.m +++ b/UI/Common/UIxFolderActions.m @@ -147,34 +147,39 @@ - (WOResponse *) canAccessContentAction { -#warning IMPROVEMENTS REQUIRED! - NSArray *acls; -// NSEnumerator *userAcls; -// NSString *currentAcl; + /* We want this action to be authorized managed by the SOPE's internal acl + handling. */ + return [self responseWith204]; +// #warning IMPROVEMENTS REQUIRED! +// NSArray *acls; +// // NSEnumerator *userAcls; +// // NSString *currentAcl; - [self _setupContext]; +// [self _setupContext]; -// NSLog(@"canAccessContentAction %@, owner %@", subscriptionPointer, owner); +// // NSLog(@"canAccessContentAction %@, owner %@", subscriptionPointer, owner); - if ([login isEqualToString: owner] || [owner isEqualToString: @"nobody"]) { - return [self responseWith204]; - } - else { - acls = [clientObject aclsForUser: login]; -// userAcls = [acls objectEnumerator]; -// currentAcl = [userAcls nextObject]; -// while (currentAcl) { -// NSLog(@"ACL login %@, owner %@, folder %@: %@", -// login, owner, baseFolder, currentAcl); -// currentAcl = [userAcls nextObject]; -// } - if (([[clientObject folderType] isEqualToString: @"Contact"] && [acls containsObject: SOGoRole_ObjectReader]) || - ([[clientObject folderType] isEqualToString: @"Appointment"] && [acls containsObject: SOGoRole_AuthorizedSubscriber])) { - return [self responseWith204]; - } - } +// if ([login isEqualToString: owner] || [owner isEqualToString: @"nobody"]) { +// return [self responseWith204]; +// } +// else { +// acls = [clientObject aclsForUser: login]; +// // userAcls = [acls objectEnumerator]; +// // currentAcl = [userAcls nextObject]; +// // while (currentAcl) { +// // NSLog(@"ACL login %@, owner %@, folder %@: %@", +// // login, owner, baseFolder, currentAcl); +// // currentAcl = [userAcls nextObject]; +// // } +// if (([[clientObject folderType] isEqualToString: @"Contact"] +// && [acls containsObject: SOGoRole_ObjectViewer]) || +// ([[clientObject folderType] isEqualToString: @"Appointment"] +// && [acls containsObject: SOGoRole_AuthorizedSubscriber])) { +// return [self responseWith204]; +// } +// } - return [self responseWithStatus: 403]; +// return [self responseWithStatus: 403]; } - (WOResponse *) _realFolderActivation: (BOOL) makeActive diff --git a/UI/Common/product.plist b/UI/Common/product.plist index ea75a393f..16cf11bf6 100644 --- a/UI/Common/product.plist +++ b/UI/Common/product.plist @@ -84,7 +84,7 @@ actionName = "unsubscribe"; }; canAccessContent = { - protectedBy = ""; + protectedBy = "Access Object"; actionClass = "UIxFolderActions"; actionName = "canAccessContent"; }; diff --git a/UI/Contacts/UIxContactFoldersView.m b/UI/Contacts/UIxContactFoldersView.m index a4f7b1a44..9d1f87a1a 100644 --- a/UI/Contacts/UIxContactFoldersView.m +++ b/UI/Contacts/UIxContactFoldersView.m @@ -199,8 +199,7 @@ [folders autorelease]; subfolders = [[parentFolder subFolders] objectEnumerator]; - currentFolder = [subfolders nextObject]; - while (currentFolder) + while ((currentFolder = [subfolders nextObject])) { if (![securityManager validatePermission: SOGoPerm_AccessObject onObject: currentFolder inContext: context]) @@ -217,7 +216,6 @@ forKey: @"type"]; [folders addObject: currentDictionary]; } - currentFolder = [subfolders nextObject]; } return folders; diff --git a/UI/Contacts/UIxContactsUserRightsEditor.m b/UI/Contacts/UIxContactsUserRightsEditor.m index 65cb1d118..a6d43ee01 100644 --- a/UI/Contacts/UIxContactsUserRightsEditor.m +++ b/UI/Contacts/UIxContactsUserRightsEditor.m @@ -81,19 +81,6 @@ return [userRights containsObject: SOGoRole_ObjectViewer]; } -- (void) setUserCanReadObjects: (BOOL) userCanReadObjects -{ - if (userCanReadObjects) - [self appendRight: SOGoRole_ObjectReader]; - else - [self removeRight: SOGoRole_ObjectReader]; -} - -- (BOOL) userCanReadObjects -{ - return [userRights containsObject: SOGoRole_ObjectReader]; -} - - (void) updateRights { WORequest *request; @@ -115,11 +102,6 @@ else [self removeRight: SOGoRole_ObjectViewer]; - if ([[request formValueForKey: @"ObjectReader"] length] > 0) - [self appendRight: SOGoRole_ObjectReader]; - else - [self removeRight: SOGoRole_ObjectReader]; - if ([[request formValueForKey: @"ObjectEraser"] length] > 0) [self appendRight: SOGoRole_ObjectEraser]; else diff --git a/UI/MailerUI/UIxMailUserRightsEditor.m b/UI/MailerUI/UIxMailUserRightsEditor.m index 08942a3ef..c9d3853cb 100644 --- a/UI/MailerUI/UIxMailUserRightsEditor.m +++ b/UI/MailerUI/UIxMailUserRightsEditor.m @@ -42,19 +42,6 @@ return [userRights containsObject: SOGoRole_ObjectViewer]; } -- (void) setUserCanReadMails: (BOOL) userCanReadMails -{ - if (userCanReadMails) - [self appendRight: SOGoRole_ObjectReader]; - else - [self removeRight: SOGoRole_ObjectReader]; -} - -- (BOOL) userCanReadMails -{ - return [userRights containsObject: SOGoRole_ObjectReader]; -} - - (void) setUserCanMarkMailsRead: (BOOL) userCanMarkMailsRead { if (userCanMarkMailsRead) @@ -183,11 +170,6 @@ else [self removeRight: SOGoRole_ObjectViewer]; - if ([[request formValueForKey: SOGoRole_ObjectReader] length] > 0) - [self appendRight: SOGoRole_ObjectReader]; - else - [self removeRight: SOGoRole_ObjectReader]; - if ([[request formValueForKey: SOGoMailRole_SeenKeeper] length] > 0) [self appendRight: SOGoMailRole_SeenKeeper]; else diff --git a/UI/MainUI/SOGoUserHomePage.m b/UI/MainUI/SOGoUserHomePage.m index 8134af2c0..c5f56913e 100644 --- a/UI/MainUI/SOGoUserHomePage.m +++ b/UI/MainUI/SOGoUserHomePage.m @@ -95,8 +95,7 @@ static NSString *defaultModule = nil; NSNumber *status; NSCalendarDate *currentDate; - record = [records nextObject]; - while (record) + while ((record = [records nextObject])) { status = [record objectForKey: @"c_status"]; @@ -117,8 +116,6 @@ static NSString *defaultModule = nil; for (count = startInterval; count < endInterval; count++) [items replaceObjectAtIndex: count withObject: status]; - - record = [records nextObject]; } } diff --git a/UI/MainUI/product.plist b/UI/MainUI/product.plist index 3eb0a70d5..05ffd1464 100644 --- a/UI/MainUI/product.plist +++ b/UI/MainUI/product.plist @@ -21,31 +21,44 @@ defaultRoles = { "View" = ( "Owner", "ObjectViewer" ); "Change Images And Files" = ( "Owner", "ObjectEditor" ); - "Access Contents Information" = ( "Owner", "ObjectReader" ); + "Access Object" = ( "Owner", "ObjectViewer", "ObjectEditor", "ObjectCreator", "ObjectEraser" ); + "Access Contents Information" = ( "Owner", "ObjectViewer" ); "Add Documents, Images, and Files" = ( "Owner", "ObjectCreator" ); "Add Folders" = ( "Owner", "FolderCreator" ); "ReadAcls" = ( "Owner" ); "SaveAcls" = ( "Owner" ); "Delete Objects" = ( "Owner", "ObjectEraser" ); + "WebDAV Access" = ( "Owner", "ObjectViewer", "ObjectEditor", "ObjectCreator", "ObjectEraser" ); }; }; SOGoContentObject = { superclass = "SOGoObject"; + defaultAccess = "Access Contents Information"; protectedBy = "Access Object"; defaultRoles = { - "Access Object" = ( "Owner", "ObjectViewer" ); - "Access Contents Information" = ( "Owner", "ObjectViewer" ); - "Change Images And Files" = ( "Owner", "ObjectEditor" ); + "Access Contents Information" = ( "Owner", "ObjectViewer", "ObjectEditor" ); + "Change Images And Files" = ( "Owner", "ObjectEditor" ); + }; + methods = { + DELETE = { + protectedBy = "Delete Objects"; + }; + GET = { + protectedBy = "Access Contents Information"; + }; + PUT = { + protectedBy = "Change Images And Files"; + }; }; }; + SOGoFolder = { superclass = "SOGoObject"; protectedBy = "Access Object"; defaultRoles = { "Change Images And Files" = ( "Owner", "ObjectEditor" ); - "WebDAV Access" = ( "Owner", "AuthorizedSubscriber" ); - "Access Object" = ( "Owner", "ObjectViewer" ); - "Access Contents Information" = ( "Owner", "ObjectViewer" ); + "View" = ( "Owner", "ObjectViewer", "ObjectEditor" ); + "Access Contents Information" = ( "Owner", "ObjectViewer", "ObjectEditor" ); }; }; SOGoParentFolder = { diff --git a/UI/Templates/ContactsUI/UIxContactsUserRightsEditor.wox b/UI/Templates/ContactsUI/UIxContactsUserRightsEditor.wox index 620cfd20a..5ed6a6b19 100644 --- a/UI/Templates/ContactsUI/UIxContactsUserRightsEditor.wox +++ b/UI/Templates/ContactsUI/UIxContactsUserRightsEditor.wox @@ -27,21 +27,16 @@ var:checked="userCanCreateObjects"/>
+ +

- -
- -