function testGeneralAffiliation(&$login, &$affilid) { if (preg_match('/^([^@]+)@([^@\\.]*)$/', $login, $matches)) { $login = $matches[1]; $affilid = getAffiliationID($matches[2]); if (is_null($affilid)) { return -1; } return 1; } return 0; }
function validateAPIgroupInput($items, $exists) { # initialMaxTime if (array_key_exists('initialMaxTime', $items)) { if (!is_numeric($items['initialMaxTime']) || $items['initialMaxTime'] < 1 || $items['initialMaxTime'] > 65535) { return array('status' => 'error', 'errorcode' => 21, 'errormsg' => 'submitted initialMaxTime is invalid'); } } # totalMaxTime if (array_key_exists('totalMaxTime', $items)) { if (!is_numeric($items['totalMaxTime']) || $items['totalMaxTime'] < 1 || $items['totalMaxTime'] > 65535) { return array('status' => 'error', 'errorcode' => 22, 'errormsg' => 'submitted totalMaxTime is invalid'); } } # maxExtendTime if (array_key_exists('maxExtendTime', $items)) { if (!is_numeric($items['maxExtendTime']) || $items['maxExtendTime'] < 1 || $items['maxExtendTime'] > 65535) { return array('status' => 'error', 'errorcode' => 23, 'errormsg' => 'submitted maxExtendTime is invalid'); } } # affiliation if (array_key_exists('affiliation', $items)) { $esc_affiliation = mysql_escape_string($items['affiliation']); $affilid = getAffiliationID($esc_affiliation); if (is_null($affilid)) { return array('status' => 'error', 'errorcode' => 17, 'errormsg' => 'unknown affiliation'); } $items['affiliationid'] = $affilid; } # name if (array_key_exists('name', $items)) { if (!ereg('^[-a-zA-Z0-9_\\.: ]{3,30}$', $items['name'])) { return array('status' => 'error', 'errorcode' => 19, 'errormsg' => 'Name must be between 3 and 30 characters ' . 'and can only contain letters, numbers, and ' . 'these characters: - _ . :'); } $esc_name = mysql_escape_string($items['name']); $doesexist = checkForGroupName($esc_name, 'user', '', $affilid); if ($exists && !$doesexist) { return array('status' => 'error', 'errorcode' => 18, 'errormsg' => 'user group with submitted name and affiliation does not exist'); } elseif (!$exists && $doesexist) { return array('status' => 'error', 'errorcode' => 27, 'errormsg' => 'existing user group with submitted name and affiliation'); } elseif ($exists && $doesexist) { $items['id'] = getUserGroupID($esc_name, $affilid); } } # owner if (array_key_exists('owner', $items)) { if (!validateUserid(mysql_escape_string($items['owner']))) { return array('status' => 'error', 'errorcode' => 20, 'errormsg' => 'submitted owner is invalid'); } } # managingGroup if (array_key_exists('managingGroup', $items)) { $parts = explode('@', $items['managingGroup']); if (count($parts) != 2) { return array('status' => 'error', 'errorcode' => 24, 'errormsg' => 'submitted managingGroup is invalid'); } $esc_mgName = mysql_escape_string($parts[0]); $esc_mgAffil = mysql_escape_string($parts[1]); $mgaffilid = getAffiliationID($esc_mgAffil); if (!checkForGroupName($esc_mgName, 'user', '', $mgaffilid)) { return array('status' => 'error', 'errorcode' => 25, 'errormsg' => 'submitted managingGroup does not exist'); } $items['managingGroupID'] = getUserGroupID($esc_mgName, $mgaffilid); $items['managingGroupName'] = $parts[0]; $items['managingGroupAffilid'] = $mgaffilid; } $items['status'] = 'success'; return $items; }
} $affil = $row['name']; # create VCL userid $userid = "{$username}@{$affil}"; if ($row['shibonly']) { $userdata = updateShibUser($userid); updateShibGroups($userdata['id'], $_SERVER['affiliation']); $usernid = $userdata['id']; } else { $usernid = getUserlistID($userid, 1); if (is_null($usernid)) { $tmp = updateShibUser($userid); $usernid = $tmp['id']; } } $affilid = getAffiliationID($affil); addLoginLog($userid, 'shibboleth', $affilid, 1); # uncomment the following and change EXAMPLE1 to match your needs to add all # users from a specific affiliation to a particular user group /*if($affil == 'EXAMPLE1') { $gid = getUserGroupID('All EXAMPLE1 Users', $affilid); $query = "INSERT IGNORE INTO usergroupmembers " . "(userid, usergroupid) " . "VALUES ($usernid, $gid)"; doQuery($query, 307); }*/ if (array_key_exists('Shib-logouturl', $_SERVER)) { $logouturl = $_SERVER['Shib-logouturl']; } else { $logouturl = ''; }
function AJdeleteAffiliationSetting() { if (!checkUserHasPerm('Site Configuration (global)')) { $arr = array('status' => 'noaccess', 'msg' => i('You do not have access to delete the submitted setting.')); sendJSON($arr); return; } $key = processInputVar('key', ARG_STRING); $origvals = getContinuationVar('origvals'); if (!array_key_exists($key, $origvals)) { $arr = array('status' => 'failed', 'msgid' => "{$this->domidbase}msg", 'msg' => i('Invalid data submitted.')); sendJSON($arr); return; } $tmp = explode('|', $origvals[$key]['key']); $affil = $tmp[1]; $affilid = getAffiliationID($affil); deleteVariable($origvals[$key]['key']); # recreate update continuation $data = getVariablesRegex("^{$this->key}.*"); $origvals = array(); $origvals[$this->key] = array('key' => $this->key, 'val' => $data[$this->key]); foreach ($data as $prekey => $val) { $okey = str_replace('|', '_', $prekey); $origvals[$okey] = array('key' => $prekey, 'val' => $val); } $cdata = $this->basecdata; $cdata['origvals'] = $origvals; $savecont = addContinuationsEntry('AJupdateAllSettings', $cdata); $arr = array('status' => 'success', 'msgid' => "{$this->domidbase}msg", 'delid' => $key, 'affil' => $affil, 'affilid' => $affilid, 'savecont' => $savecont, 'extrafunc' => "{$this->jsname}.deleteAffiliationSettingCBextra", 'msg' => sprintf($this->delmsg, $affil)); sendJSON($arr); }
function testITECSAffiliation(&$login, &$affilid) { if (preg_match('/^([^@]*@[^@]*\\.[^@]*)@ITECS$/', $login, $matches) || preg_match('/^([^@]*@[^@]*\\.[^@]*)$/', $login, $matches)) { $login = $matches[1]; $affilid = getAffiliationID('ITECS'); return 1; } return 0; }
function XMLRPCdeployServer($imageid, $start, $end, $admingroup = '', $logingroup = '', $ipaddr = '', $macaddr = '', $monitored = 0, $foruser = '', $name = '', $userdata = '') { global $user, $remoteIP; if (!in_array("serverCheckOut", $user["privileges"])) { return array('status' => 'error', 'errorcode' => 60, 'errormsg' => "access denied to deploy server"); } $imageid = processInputData($imageid, ARG_NUMERIC); $resources = getUserResources(array("imageAdmin", "imageCheckOut")); $images = removeNoCheckout($resources["image"]); $extraimages = getServerProfileImages($user['id']); if (!array_key_exists($imageid, $images) && !array_key_exists($imageid, $extraimages)) { return array('status' => 'error', 'errorcode' => 3, 'errormsg' => "access denied to {$imageid}"); } if ($admingroup != '') { $admingroup = processInputData($admingroup, ARG_STRING); if (get_magic_quotes_gpc()) { $admingroup = stripslashes($admingroup); } if (preg_match('/@/', $admingroup)) { $tmp = explode('@', $admingroup); $escadmingroup = mysql_real_escape_string($tmp[0]); $affilid = getAffiliationID($tmp[1]); if (is_null($affilid)) { return array('status' => 'error', 'errorcode' => 51, 'errormsg' => "unknown affiliation for admin user group: {$tmp[1]}"); } } else { $escadmingroup = mysql_real_escape_string($admingroup); $affilid = DEFAULT_AFFILID; } $admingroupid = getUserGroupID($escadmingroup, $affilid, 1); if (is_null($admingroupid)) { return array('status' => 'error', 'errorcode' => 52, 'errormsg' => "unknown admin user group: {$admingroup}"); } } else { $admingroupid = ''; } if ($logingroup != '') { $logingroup = processInputData($logingroup, ARG_STRING); if (get_magic_quotes_gpc()) { $logingroup = stripslashes($logingroup); } if (preg_match('/@/', $logingroup)) { $tmp = explode('@', $logingroup); $esclogingroup = mysql_real_escape_string($tmp[0]); $affilid = getAffiliationID($tmp[1]); if (is_null($affilid)) { return array('status' => 'error', 'errorcode' => 54, 'errormsg' => "unknown affiliation for login user group: {$tmp[1]}"); } } else { $esclogingroup = mysql_real_escape_string($logingroup); $affilid = DEFAULT_AFFILID; } $logingroupid = getUserGroupID($esclogingroup, $affilid, 1); if (is_null($logingroupid)) { return array('status' => 'error', 'errorcode' => 55, 'errormsg' => "unknown login user group: {$logingroup}"); } } else { $logingroupid = ''; } $ipaddr = processInputData($ipaddr, ARG_STRING); $ipaddrArr = explode('.', $ipaddr); if ($ipaddr != '' && (!preg_match('/^(([0-9]){1,3}\\.){3}([0-9]){1,3}$/', $ipaddr) || $ipaddrArr[0] < 1 || $ipaddrArr[0] > 255 || $ipaddrArr[1] < 0 || $ipaddrArr[1] > 255 || $ipaddrArr[2] < 0 || $ipaddrArr[2] > 255 || $ipaddrArr[3] < 0 || $ipaddrArr[3] > 255)) { return array('status' => 'error', 'errorcode' => 57, 'errormsg' => "Invalid IP address. Must be w.x.y.z with each of " . "w, x, y, and z being between 1 and 255 (inclusive)"); } $macaddr = processInputData($macaddr, ARG_STRING); if ($macaddr != '' && !preg_match('/^(([A-Fa-f0-9]){2}:){5}([A-Fa-f0-9]){2}$/', $macaddr)) { return array('status' => 'error', 'errorcode' => 58, 'errormsg' => "Invalid MAC address. Must be XX:XX:XX:XX:XX:XX " . "with each pair of XX being from 00 to FF (inclusive)"); } $monitored = processInputData($monitored, ARG_NUMERIC); if ($monitored != 0 && $monitored != 1) { $monitored = 0; } $start = processInputData($start, ARG_STRING, 1); $end = processInputData($end, ARG_STRING, 1); #$foruser = processInputData($foruser, ARG_STRING, 1); $name = processInputData($name, ARG_STRING); if (get_magic_quotes_gpc()) { $name = stripslashes($name); } if (!preg_match('/^([-a-zA-Z0-9_\\. ]){0,255}$/', $name)) { return array('status' => 'error', 'errorcode' => 58, 'errormsg' => "Invalid name. Can only contain letters, numbers, " . "spaces, dashes(-), underscores(_), and periods(.) " . "and be up to 255 characters long"); } $name = mysql_real_escape_string($name); # validate $start if ($start != 'now' && !is_numeric($start)) { return array('status' => 'error', 'errorcode' => 4, 'errormsg' => "received invalid input for start"); } # validate $end if ($end != 'indefinite' && !is_numeric($end)) { return array('status' => 'error', 'errorcode' => 59, 'errormsg' => "received invalid input for end"); } $nowfuture = 'future'; if ($start == 'now') { $start = unixFloor15(time()); $nowfuture = 'now'; } else { if ($start < time() - 30) { return array('status' => 'error', 'errorcode' => 5, 'errormsg' => "start time is in the past"); } } if ($end == 'indefinite') { $end = datetimeToUnix("2038-01-01 00:00:00"); } elseif ($end % (15 * 60)) { $end = unixFloor15($end) + 15 * 60; } elseif ($end < $start + 900) { return array('status' => 'error', 'errorcode' => 88, 'errormsg' => "end time must be at least 15 minutes after start time"); } $max = getMaxOverlap($user['id']); if (checkOverlap($start, $end, $max)) { return array('status' => 'error', 'errorcode' => 7, 'errormsg' => "reservation overlaps with another one you " . "have, and you are allowed {$max} " . "overlapping reservations at a time"); } $images = getImages(); $revisionid = getProductionRevisionid($imageid); $rc = isAvailable($images, $imageid, $revisionid, $start, $end, 1, 0, 0, 0, 0, $ipaddr, $macaddr); if ($rc < 1) { addLogEntry($nowfuture, unixToDatetime($start), unixToDatetime($end), 0, $imageid); return array('status' => 'notavailable'); } $return['requestid'] = addRequest(); $query = "UPDATE reservation " . "SET remoteIP = '{$remoteIP}' " . "WHERE requestid = {$return['requestid']}"; doQuery($query); if ($userdata != '') { if (get_magic_quotes_gpc()) { $userdata = stripslashes($userdata); } $esc_userdata = mysql_real_escape_string($userdata); $query = "INSERT INTO variable " . "(name, " . "serialization, " . "value, " . "setby, " . "timestamp) " . "SELECT CONCAT('userdata|', id), " . "'none', " . "'{$esc_userdata}', " . "'webcode', " . "NOW() " . "FROM reservation " . "WHERE requestid = {$return['requestid']}"; doQuery($query); } $fields = array('requestid'); $values = array($return['requestid']); if ($name != '') { $fields[] = 'name'; $values[] = "'{$name}'"; } if ($ipaddr != '') { $fields[] = 'fixedIP'; $values[] = "'{$ipaddr}'"; } if ($macaddr != '') { $fields[] = 'fixedMAC'; $values[] = "'{$macaddr}'"; } if ($admingroupid != 0) { $fields[] = 'admingroupid'; $values[] = $admingroupid; } if ($logingroupid != 0) { $fields[] = 'logingroupid'; $values[] = $logingroupid; } if ($monitored != 0) { $fields[] = 'monitored'; $values[] = 1; } $allfields = implode(',', $fields); $allvalues = implode(',', $values); $query = "INSERT INTO serverrequest ({$allfields}) VALUES ({$allvalues})"; doQuery($query, 101); $return['status'] = 'success'; return $return; }