ns_register_proc GET $todomgr_root/keywords todomgr_keywords ns_register_proc POST $todomgr_root/keywords todomgr_keywords proc todomgr_keywords {conn ignore} { set form [ns_conn form $conn] if {$form == ""} { set form [ns_set create] } global todomgr_pool set db [ns_db gethandle $todomgr_pool] See Checking authuser set process [ns_set get $form process] if [string compare "" $process] { See Setting/creating keywords for a process. return } set userid [ns_set get $form user] set keyword [ns_set get $form keyword] if [string compare "" $userid] { See Setting permissions for a user return } if [string compare "" $keyword] { See Inspecting a keyword return } See Listing keywords } |
First, let's get our status with regard to the process, then we'll worry about what we're doing with the keywords. If the current user is the owner, then things are very simple.
if {[catch {set prow [ns_db select $db "select * from process where id='[sql_safe_string $process]'"]} result] || \ ![ns_db getrow $db $prow]} { set tags(title) "Unknown process" set tags(body) "The process you specified (<code>$process</code>) cannot be found in the database." return [todomgr_pageout $conn message.html] } if [string compare $user [ns_set get $prow owner]] { if {[catch {set perm [ns_db select $db "select * from permission where process='[sql_safe_string $process]' and userid='[sql_safe_string $user]'"]} result] \ || ![ns_db getrow $db $perm] || ![string match *p* [ns_set get $perm flags]]} { set tags(title) "Insufficient privilege" set tags(body) "You have not been granted the right to assign keywords to the project you specified." return [todomgr_pageout $conn message.html] } } |
set keywords [list] if [string compare "" [ns_set get $form newkeyword]] { set row [ns_db select $db "select count(*) as ct from keyword where keyword='[sql_safe_string [ns_set get $form newkeyword]]'"] ns_db getrow $db $row if {[ns_set get $row ct] == 0} { lappend keywords [ns_set get $form newkeyword] ns_db dml $db "insert into permission (keyword, userid, flags) values ('[sql_safe_string [ns_set get $form newkeyword]]', '[sql_safe_string $user]', 'pmrt')" } } |
set size [ns_set size $form] for {set i 0} {$i < $size} {incr i} { if ![string compare "keyword" [string tolower [ns_set key $form $i]]] { lappend keywords [ns_set value $form $i] } } |
Deletion is simple for the owner case. It's not so simple for the non-owner case -- in fact, I can't figure out a way to do it in SQL straight, so instead I'm loading the list of keywords I can see and building a big old WHERE clause. Ugly but it works.
if ![string compare $user [ns_set get $prow owner]] { set query "delete from keyword where process='[sql_safe_string $process]'" catch {ns_db dml $db $query} result } else { set deletes [list] set query "select keyword.keyword as k from keyword, permission where keyword.keyword=permission.keyword and keyword.process='[sql_safe_string $process]' and permission.userid='[sql_safe_string $user]'" if ![catch {set row [ns_db select $db $query]} result] { while {[ns_db getrow $db $row]} { lappend deletes "'[sql_safe_string [ns_set get $row k]]'" } } if {[llength $deletes] > 0} { set query "delete from keyword where process='[sql_safe_string $process]' and (keyword=" append query [join $deletes " or keyword="] append query ")" ns_db dml $db $query } } |
foreach word $keywords { ns_db dml $db "insert into keyword (keyword, process) values ('[sql_safe_string $word]', '[sql_safe_string $process]')" } |
ns_returnredirect $conn show?process=$process |
$userid
contains the
user we're granting privileges to; $user
contains the current user.
What we want to do is: (1) check the current user's privilege level to make sure we're allowed to do this, (2) delete the named user's current permission record, if any, and (3) insert a new record with the given privilege.
Let's check our privilege first.
set query "select * from permission where keyword='[sql_safe_string $keyword]' and userid='[sql_safe_string $user]'" if {[catch {set row [ns_db select $db $query]} result] \ || ![ns_db getrow $db $row] \ || ![string match *p* [ns_set get $row flags]]} { set tags(title) "Insufficient privilege" set tags(body) "Sorry, you don't have sufficient privilege to grant permissions to this keyword." return [todomgr_pageout $conn message.html] } |
set flags "" foreach field {p r m t} { if [string compare "" [ns_set get $form $field]] { append flags $field } } |
set query "delete from permission where keyword='[sql_safe_string $keyword]' and userid='[sql_safe_string $userid]'" ns_db dml $db $query set query "insert into permission (keyword, userid, flags) values ('[sql_safe_string $keyword]', '[sql_safe_string $userid]', '$flags')" ns_db dml $db $query |
ns_returnredirect $conn keywords?keyword=$keyword |
set query "select * from permission where userid='[sql_safe_string $user]' and keyword='[sql_safe_string $keyword]' and flags like '%p%'" if {[catch {set row [ns_db select $db $query]} result] || ![ns_db getrow $db $row]} { set tags(title) "Keyword not found" set tags(body) "The keyword you entered (<code>$keyword</code>) couldn't be found or you don't have administrative privileges to it." return [todomgr_pageout $conn message.html] } set tags(keyword) $keyword |
set query "select * from keyword, process where keyword.process=process.id and keyword='[sql_safe_string $keyword]'" set tags(processlist) "" if [catch {set row [ns_db select $db $query]} result] { set tags(processlist) "<i>No processes attached</i>" } else { while {[ns_db getrow $db $row]} { append tags(processlist) "<a href=show?process=[ns_set get $row id]>" append tags(processlist) "[ns_set get $row title]</a><br>\n" } if {$tags(processlist) == ""} { set tags(processlist) "<i>No processes attached</i>" } } |
set tags(userlist) "" set userlist [list] set query "select * from users, permission where permission.userid=users.userid and keyword='[sql_safe_string $keyword]' order by name" if [catch {set row [ns_db select $db $query]} result] { set tags(userlist) "<i>No users attached</i>" } else { while {[ns_db getrow $db $row]} { lappend userlist [ns_set get $row userid] foreach perm {p r m t} { set check$perm "" if [string match "*$perm*" [ns_set get $row flags]] { set check$perm " checked" } } append tags(userlist) "<form action=keywords method=post>" append tags(userlist) "<input type=hidden name=user value=\"[ns_set get $row userid]\">" append tags(userlist) "<input type=hidden name=keyword value=\"$keyword\">" append tags(userlist) "[ns_set get $row name] ([ns_set get $row userid]) |
set tags(newuserlist) "" set query "select * from users where permlevel > 0 order by name" if ![catch {set row [ns_db select $db $query]} result] { while {[ns_db getrow $db $row]} { if {[lsearch $userlist [ns_set get $row userid]] > -1} { continue } append tags(newuserlist) "<option value=\"[ns_set get $row userid]\">" append tags(newuserlist) "[ns_set get $row name] ([ns_set get $row userid])\n" } } |
todomgr_pageout $conn keyword.html |
set query "select * from permission where userid='[sql_safe_string $user]' and flags like '%p%'" set tags(title) "Keyword list" set tags(body) "" if ![catch {set row [ns_db select $db $query]} result] { while {[ns_db getrow $db $row]} { append tags(body) "<li><a href=keywords?keyword=[ns_set get $row keyword]>" append tags(body) "[ns_set get $row keyword]</a>\n" } } if [string compare $tags(body) ""] { set tags(body) "Click on a keyword to go to its management screen:<ul>$tags(body)</ul>" } else { set tags(body) "You appear to have admin access to no keywords." } todomgr_pageout $conn message.html |
This code and documentation are released under the terms of the GNU license. They are additionally copyright (c) 2000, Vivtek. All rights reserved except those explicitly granted under the terms of the GNU license. |