Fossil SCM

Do not allow people to subscribe to notifications for which they do not have read permission.

drh 2018-07-14 00:54 trunk
Commit 6e6e3c8b254b745ed97e12e41685c38b488af31a6b66da018503d213f5d30a37
Parent 83b171bcd10a713…
2 files changed +47 -23 +1 -2
~ src/email.c ~ src/main.c
M src/email.c
+47 -23
--- src/email.c
+++ src/email.c
@@ -1172,13 +1172,14 @@
11721172
 int nsub = 0;
11731173
 const char *suname = PT("suname");
11741174
 if( suname==0 && needCaptcha==0 && !g.perm.Admin ) suname = g.zLogin;
11751175
 if( suname && suname[0]==0 ) suname = 0;
11761176
 if( PB("sa") ) ssub[nsub++] = 'a';
1177
- if( PB("sc") ) ssub[nsub++] = 'c';
1178
- if( PB("st") ) ssub[nsub++] = 't';
1179
- if( PB("sw") ) ssub[nsub++] = 'w';
1177
+ if( g.perm.Read && PB("sc") ) ssub[nsub++] = 'c';
1178
+ if( g.perm.RdForum && PB("sf") ) ssub[nsub++] = 'f';
1179
+ if( g.perm.RdTkt && PB("st") ) ssub[nsub++] = 't';
1180
+ if( g.perm.RdWiki && PB("sw") ) ssub[nsub++] = 'w';
11801181
 ssub[nsub] = 0;
11811182
 db_multi_exec(
11821183
 "INSERT INTO subscriber(semail,suname,"
11831184
 " sverified,sdonotcall,sdigest,ssub,sctime,mtime,smip)"
11841185
 "VALUES(%Q,%Q,%d,0,%d,%Q,now(),now(),%Q)",
@@ -1232,13 +1233,14 @@
12321233
 if( P("submit")==0 ){
12331234
 /* If this is the first visit to this page (if this HTTP request did not
12341235
 ** come from a prior Submit of the form) then default all of the
12351236
 ** subscription options to "on" */
12361237
 cgi_set_parameter_nocopy("sa","1",1);
1237
- cgi_set_parameter_nocopy("sc","1",1);
1238
- cgi_set_parameter_nocopy("st","1",1);
1239
- cgi_set_parameter_nocopy("sw","1",1);
1238
+ if( g.perm.Read ) cgi_set_parameter_nocopy("sc","1",1);
1239
+ if( g.perm.RdForum ) cgi_set_parameter_nocopy("sf","1",1);
1240
+ if( g.perm.RdTkt ) cgi_set_parameter_nocopy("st","1",1);
1241
+ if( g.perm.RdWiki ) cgi_set_parameter_nocopy("sw","1",1);
12401242
 }
12411243
 @ <p>To receive email notifications for changes to this
12421244
 @ repository, fill out the form below and press "Submit" button.</p>
12431245
 form_begin(0, "%R/subscribe");
12441246
 @ <table class="subscribe">
@@ -1274,16 +1276,26 @@
12741276
 }
12751277
 @ <tr>
12761278
 @ <td class="form_label">Options:</td>
12771279
 @ <td><label><input type="checkbox" name="sa" %s(PCK("sa"))> \
12781280
 @ Announcements</label><br>
1279
- @ <label><input type="checkbox" name="sc" %s(PCK("sc"))> \
1280
- @ Check-ins</label><br>
1281
- @ <label><input type="checkbox" name="st" %s(PCK("st"))> \
1282
- @ Ticket changes</label><br>
1283
- @ <label><input type="checkbox" name="sw" %s(PCK("sw"))> \
1284
- @ Wiki</label><br>
1281
+ if( g.perm.Read ){
1282
+ @ <label><input type="checkbox" name="sc" %s(PCK("sc"))> \
1283
+ @ Check-ins</label><br>
1284
+ }
1285
+ if( g.perm.RdForum ){
1286
+ @ <label><input type="checkbox" name="sf" %s(PCK("sf"))> \
1287
+ @ Forum Posts</label><br>
1288
+ }
1289
+ if( g.perm.RdTkt ){
1290
+ @ <label><input type="checkbox" name="st" %s(PCK("st"))> \
1291
+ @ Ticket changes</label><br>
1292
+ }
1293
+ if( g.perm.RdWiki ){
1294
+ @ <label><input type="checkbox" name="sw" %s(PCK("sw"))> \
1295
+ @ Wiki</label><br>
1296
+ }
12851297
 @ <label><input type="checkbox" name="di" %s(PCK("di"))> \
12861298
 @ Daily digest only</label><br>
12871299
 if( g.perm.Admin ){
12881300
 @ <label><input type="checkbox" name="vi" %s(PCK("vi"))> \
12891301
 @ Verified</label><br>
@@ -1354,11 +1366,11 @@
13541366
 ** to know the subscriber code.
13551367
 */
13561368
 void alerts_page(void){
13571369
 const char *zName = P("name");
13581370
 Stmt q;
1359
- int sa, sc, st, sw;
1371
+ int sa, sc, sf, st, sw;
13601372
 int sdigest, sdonotcall, sverified;
13611373
 const char *ssub;
13621374
 const char *semail;
13631375
 const char *smip;
13641376
 const char *suname;
@@ -1381,14 +1393,15 @@
13811393
 if( P("submit")!=0 && cgi_csrf_safe(1) ){
13821394
 int sdonotcall = PB("sdonotcall");
13831395
 int sdigest = PB("sdigest");
13841396
 char ssub[10];
13851397
 int nsub = 0;
1386
- if( PB("sa") ) ssub[nsub++] = 'a';
1387
- if( PB("sc") ) ssub[nsub++] = 'c';
1388
- if( PB("st") ) ssub[nsub++] = 't';
1389
- if( PB("sw") ) ssub[nsub++] = 'w';
1398
+ if( PB("sa") ) ssub[nsub++] = 'a';
1399
+ if( g.perm.Read && PB("sc") ) ssub[nsub++] = 'c';
1400
+ if( g.perm.RdForum && PB("sf") ) ssub[nsub++] = 'f';
1401
+ if( g.perm.RdTkt && PB("st") ) ssub[nsub++] = 't';
1402
+ if( g.perm.RdWiki && PB("sw") ) ssub[nsub++] = 'w';
13901403
 ssub[nsub] = 0;
13911404
 if( g.perm.Admin ){
13921405
 const char *suname = PT("suname");
13931406
 int sverified = PB("sverified");
13941407
 if( suname && suname[0]==0 ) suname = 0;
@@ -1460,10 +1473,11 @@
14601473
 sdonotcall = db_column_int(&q, 2);
14611474
 sdigest = db_column_int(&q, 3);
14621475
 ssub = db_column_text(&q, 4);
14631476
 sa = strchr(ssub,'a')!=0;
14641477
 sc = strchr(ssub,'c')!=0;
1478
+ sf = strchr(ssub,'f')!=0;
14651479
 st = strchr(ssub,'t')!=0;
14661480
 sw = strchr(ssub,'w')!=0;
14671481
 smip = db_column_text(&q, 5);
14681482
 suname = db_column_text(&q, 6);
14691483
 mtime = db_column_text(&q, 7);
@@ -1508,16 +1522,26 @@
15081522
 }
15091523
 @ <tr>
15101524
 @ <td class="form_label">Options:</td>
15111525
 @ <td><label><input type="checkbox" name="sa" %s(sa?"checked":"")>\
15121526
 @ Announcements</label><br>
1513
- @ <label><input type="checkbox" name="sc" %s(sc?"checked":"")>\
1514
- @ Check-ins</label><br>
1515
- @ <label><input type="checkbox" name="st" %s(st?"checked":"")>\
1516
- @ Ticket changes</label><br>
1517
- @ <label><input type="checkbox" name="sw" %s(sw?"checked":"")>\
1518
- @ Wiki</label><br>
1527
+ if( g.perm.Read ){
1528
+ @ <label><input type="checkbox" name="sc" %s(sc?"checked":"")>\
1529
+ @ Check-ins</label><br>
1530
+ }
1531
+ if( g.perm.RdForum ){
1532
+ @ <label><input type="checkbox" name="sf" %s(sf?"checked":"")>\
1533
+ @ Forum Posts</label><br>
1534
+ }
1535
+ if( g.perm.RdTkt ){
1536
+ @ <label><input type="checkbox" name="st" %s(st?"checked":"")>\
1537
+ @ Ticket changes</label><br>
1538
+ }
1539
+ if( g.perm.RdWiki ){
1540
+ @ <label><input type="checkbox" name="sw" %s(sw?"checked":"")>\
1541
+ @ Wiki</label><br>
1542
+ }
15191543
 @ <label><input type="checkbox" name="sdigest" %s(sdigest?"checked":"")>\
15201544
 @ Daily digest only</label><br>
15211545
 if( g.perm.Admin ){
15221546
 @ <label><input type="checkbox" name="sdonotcall" \
15231547
 @ %s(sdonotcall?"checked":"")> Do not call</label><br>
15241548
--- src/email.c
+++ src/email.c
@@ -1172,13 +1172,14 @@
1172 int nsub = 0;
1173 const char *suname = PT("suname");
1174 if( suname==0 && needCaptcha==0 && !g.perm.Admin ) suname = g.zLogin;
1175 if( suname && suname[0]==0 ) suname = 0;
1176 if( PB("sa") ) ssub[nsub++] = 'a';
1177 if( PB("sc") ) ssub[nsub++] = 'c';
1178 if( PB("st") ) ssub[nsub++] = 't';
1179 if( PB("sw") ) ssub[nsub++] = 'w';
 
1180 ssub[nsub] = 0;
1181 db_multi_exec(
1182 "INSERT INTO subscriber(semail,suname,"
1183 " sverified,sdonotcall,sdigest,ssub,sctime,mtime,smip)"
1184 "VALUES(%Q,%Q,%d,0,%d,%Q,now(),now(),%Q)",
@@ -1232,13 +1233,14 @@
1232 if( P("submit")==0 ){
1233 /* If this is the first visit to this page (if this HTTP request did not
1234 ** come from a prior Submit of the form) then default all of the
1235 ** subscription options to "on" */
1236 cgi_set_parameter_nocopy("sa","1",1);
1237 cgi_set_parameter_nocopy("sc","1",1);
1238 cgi_set_parameter_nocopy("st","1",1);
1239 cgi_set_parameter_nocopy("sw","1",1);
 
1240 }
1241 @ <p>To receive email notifications for changes to this
1242 @ repository, fill out the form below and press "Submit" button.</p>
1243 form_begin(0, "%R/subscribe");
1244 @ <table class="subscribe">
@@ -1274,16 +1276,26 @@
1274 }
1275 @ <tr>
1276 @ <td class="form_label">Options:</td>
1277 @ <td><label><input type="checkbox" name="sa" %s(PCK("sa"))> \
1278 @ Announcements</label><br>
1279 @ <label><input type="checkbox" name="sc" %s(PCK("sc"))> \
1280 @ Check-ins</label><br>
1281 @ <label><input type="checkbox" name="st" %s(PCK("st"))> \
1282 @ Ticket changes</label><br>
1283 @ <label><input type="checkbox" name="sw" %s(PCK("sw"))> \
1284 @ Wiki</label><br>
 
 
 
 
 
 
 
 
 
 
1285 @ <label><input type="checkbox" name="di" %s(PCK("di"))> \
1286 @ Daily digest only</label><br>
1287 if( g.perm.Admin ){
1288 @ <label><input type="checkbox" name="vi" %s(PCK("vi"))> \
1289 @ Verified</label><br>
@@ -1354,11 +1366,11 @@
1354 ** to know the subscriber code.
1355 */
1356 void alerts_page(void){
1357 const char *zName = P("name");
1358 Stmt q;
1359 int sa, sc, st, sw;
1360 int sdigest, sdonotcall, sverified;
1361 const char *ssub;
1362 const char *semail;
1363 const char *smip;
1364 const char *suname;
@@ -1381,14 +1393,15 @@
1381 if( P("submit")!=0 && cgi_csrf_safe(1) ){
1382 int sdonotcall = PB("sdonotcall");
1383 int sdigest = PB("sdigest");
1384 char ssub[10];
1385 int nsub = 0;
1386 if( PB("sa") ) ssub[nsub++] = 'a';
1387 if( PB("sc") ) ssub[nsub++] = 'c';
1388 if( PB("st") ) ssub[nsub++] = 't';
1389 if( PB("sw") ) ssub[nsub++] = 'w';
 
1390 ssub[nsub] = 0;
1391 if( g.perm.Admin ){
1392 const char *suname = PT("suname");
1393 int sverified = PB("sverified");
1394 if( suname && suname[0]==0 ) suname = 0;
@@ -1460,10 +1473,11 @@
1460 sdonotcall = db_column_int(&q, 2);
1461 sdigest = db_column_int(&q, 3);
1462 ssub = db_column_text(&q, 4);
1463 sa = strchr(ssub,'a')!=0;
1464 sc = strchr(ssub,'c')!=0;
 
1465 st = strchr(ssub,'t')!=0;
1466 sw = strchr(ssub,'w')!=0;
1467 smip = db_column_text(&q, 5);
1468 suname = db_column_text(&q, 6);
1469 mtime = db_column_text(&q, 7);
@@ -1508,16 +1522,26 @@
1508 }
1509 @ <tr>
1510 @ <td class="form_label">Options:</td>
1511 @ <td><label><input type="checkbox" name="sa" %s(sa?"checked":"")>\
1512 @ Announcements</label><br>
1513 @ <label><input type="checkbox" name="sc" %s(sc?"checked":"")>\
1514 @ Check-ins</label><br>
1515 @ <label><input type="checkbox" name="st" %s(st?"checked":"")>\
1516 @ Ticket changes</label><br>
1517 @ <label><input type="checkbox" name="sw" %s(sw?"checked":"")>\
1518 @ Wiki</label><br>
 
 
 
 
 
 
 
 
 
 
1519 @ <label><input type="checkbox" name="sdigest" %s(sdigest?"checked":"")>\
1520 @ Daily digest only</label><br>
1521 if( g.perm.Admin ){
1522 @ <label><input type="checkbox" name="sdonotcall" \
1523 @ %s(sdonotcall?"checked":"")> Do not call</label><br>
1524
--- src/email.c
+++ src/email.c
@@ -1172,13 +1172,14 @@
1172 int nsub = 0;
1173 const char *suname = PT("suname");
1174 if( suname==0 && needCaptcha==0 && !g.perm.Admin ) suname = g.zLogin;
1175 if( suname && suname[0]==0 ) suname = 0;
1176 if( PB("sa") ) ssub[nsub++] = 'a';
1177 if( g.perm.Read && PB("sc") ) ssub[nsub++] = 'c';
1178 if( g.perm.RdForum && PB("sf") ) ssub[nsub++] = 'f';
1179 if( g.perm.RdTkt && PB("st") ) ssub[nsub++] = 't';
1180 if( g.perm.RdWiki && PB("sw") ) ssub[nsub++] = 'w';
1181 ssub[nsub] = 0;
1182 db_multi_exec(
1183 "INSERT INTO subscriber(semail,suname,"
1184 " sverified,sdonotcall,sdigest,ssub,sctime,mtime,smip)"
1185 "VALUES(%Q,%Q,%d,0,%d,%Q,now(),now(),%Q)",
@@ -1232,13 +1233,14 @@
1233 if( P("submit")==0 ){
1234 /* If this is the first visit to this page (if this HTTP request did not
1235 ** come from a prior Submit of the form) then default all of the
1236 ** subscription options to "on" */
1237 cgi_set_parameter_nocopy("sa","1",1);
1238 if( g.perm.Read ) cgi_set_parameter_nocopy("sc","1",1);
1239 if( g.perm.RdForum ) cgi_set_parameter_nocopy("sf","1",1);
1240 if( g.perm.RdTkt ) cgi_set_parameter_nocopy("st","1",1);
1241 if( g.perm.RdWiki ) cgi_set_parameter_nocopy("sw","1",1);
1242 }
1243 @ <p>To receive email notifications for changes to this
1244 @ repository, fill out the form below and press "Submit" button.</p>
1245 form_begin(0, "%R/subscribe");
1246 @ <table class="subscribe">
@@ -1274,16 +1276,26 @@
1276 }
1277 @ <tr>
1278 @ <td class="form_label">Options:</td>
1279 @ <td><label><input type="checkbox" name="sa" %s(PCK("sa"))> \
1280 @ Announcements</label><br>
1281 if( g.perm.Read ){
1282 @ <label><input type="checkbox" name="sc" %s(PCK("sc"))> \
1283 @ Check-ins</label><br>
1284 }
1285 if( g.perm.RdForum ){
1286 @ <label><input type="checkbox" name="sf" %s(PCK("sf"))> \
1287 @ Forum Posts</label><br>
1288 }
1289 if( g.perm.RdTkt ){
1290 @ <label><input type="checkbox" name="st" %s(PCK("st"))> \
1291 @ Ticket changes</label><br>
1292 }
1293 if( g.perm.RdWiki ){
1294 @ <label><input type="checkbox" name="sw" %s(PCK("sw"))> \
1295 @ Wiki</label><br>
1296 }
1297 @ <label><input type="checkbox" name="di" %s(PCK("di"))> \
1298 @ Daily digest only</label><br>
1299 if( g.perm.Admin ){
1300 @ <label><input type="checkbox" name="vi" %s(PCK("vi"))> \
1301 @ Verified</label><br>
@@ -1354,11 +1366,11 @@
1366 ** to know the subscriber code.
1367 */
1368 void alerts_page(void){
1369 const char *zName = P("name");
1370 Stmt q;
1371 int sa, sc, sf, st, sw;
1372 int sdigest, sdonotcall, sverified;
1373 const char *ssub;
1374 const char *semail;
1375 const char *smip;
1376 const char *suname;
@@ -1381,14 +1393,15 @@
1393 if( P("submit")!=0 && cgi_csrf_safe(1) ){
1394 int sdonotcall = PB("sdonotcall");
1395 int sdigest = PB("sdigest");
1396 char ssub[10];
1397 int nsub = 0;
1398 if( PB("sa") ) ssub[nsub++] = 'a';
1399 if( g.perm.Read && PB("sc") ) ssub[nsub++] = 'c';
1400 if( g.perm.RdForum && PB("sf") ) ssub[nsub++] = 'f';
1401 if( g.perm.RdTkt && PB("st") ) ssub[nsub++] = 't';
1402 if( g.perm.RdWiki && PB("sw") ) ssub[nsub++] = 'w';
1403 ssub[nsub] = 0;
1404 if( g.perm.Admin ){
1405 const char *suname = PT("suname");
1406 int sverified = PB("sverified");
1407 if( suname && suname[0]==0 ) suname = 0;
@@ -1460,10 +1473,11 @@
1473 sdonotcall = db_column_int(&q, 2);
1474 sdigest = db_column_int(&q, 3);
1475 ssub = db_column_text(&q, 4);
1476 sa = strchr(ssub,'a')!=0;
1477 sc = strchr(ssub,'c')!=0;
1478 sf = strchr(ssub,'f')!=0;
1479 st = strchr(ssub,'t')!=0;
1480 sw = strchr(ssub,'w')!=0;
1481 smip = db_column_text(&q, 5);
1482 suname = db_column_text(&q, 6);
1483 mtime = db_column_text(&q, 7);
@@ -1508,16 +1522,26 @@
1522 }
1523 @ <tr>
1524 @ <td class="form_label">Options:</td>
1525 @ <td><label><input type="checkbox" name="sa" %s(sa?"checked":"")>\
1526 @ Announcements</label><br>
1527 if( g.perm.Read ){
1528 @ <label><input type="checkbox" name="sc" %s(sc?"checked":"")>\
1529 @ Check-ins</label><br>
1530 }
1531 if( g.perm.RdForum ){
1532 @ <label><input type="checkbox" name="sf" %s(sf?"checked":"")>\
1533 @ Forum Posts</label><br>
1534 }
1535 if( g.perm.RdTkt ){
1536 @ <label><input type="checkbox" name="st" %s(st?"checked":"")>\
1537 @ Ticket changes</label><br>
1538 }
1539 if( g.perm.RdWiki ){
1540 @ <label><input type="checkbox" name="sw" %s(sw?"checked":"")>\
1541 @ Wiki</label><br>
1542 }
1543 @ <label><input type="checkbox" name="sdigest" %s(sdigest?"checked":"")>\
1544 @ Daily digest only</label><br>
1545 if( g.perm.Admin ){
1546 @ <label><input type="checkbox" name="sdonotcall" \
1547 @ %s(sdonotcall?"checked":"")> Do not call</label><br>
1548
M src/main.c
+1 -2
--- src/main.c
+++ src/main.c
@@ -1426,11 +1426,11 @@
14261426
 ** webbrowser opens a connection but never sends the HTTP request
14271427
 */
14281428
 void sigpipe_handler(int x){
14291429
 #ifndef _WIN32
14301430
 if( g.fAnyTrace ){
1431
- fprintf(stderr, "-- sigpipe received by subprocess %d --\n", getpid());
1431
+ fprintf(stderr,"/**** sigpipe received by subprocess %d ****\n", getpid());
14321432
 }
14331433
 #endif
14341434
 fossil_exit(1);
14351435
 }
14361436
@@ -2550,11 +2550,10 @@
25502550
 zStopperFile = find_option("stopper", 0, 1);
25512551
 #endif
25522552
25532553
 if( g.zErrlog==0 ){
25542554
 g.zErrlog = "-";
2555
- g.fAnyTrace = 1;
25562555
 }
25572556
 zFileGlob = find_option("files-urlenc",0,1);
25582557
 if( zFileGlob ){
25592558
 char *z = mprintf("%s", zFileGlob);
25602559
 dehttpize(z);
25612560
--- src/main.c
+++ src/main.c
@@ -1426,11 +1426,11 @@
1426 ** webbrowser opens a connection but never sends the HTTP request
1427 */
1428 void sigpipe_handler(int x){
1429 #ifndef _WIN32
1430 if( g.fAnyTrace ){
1431 fprintf(stderr, "-- sigpipe received by subprocess %d --\n", getpid());
1432 }
1433 #endif
1434 fossil_exit(1);
1435 }
1436
@@ -2550,11 +2550,10 @@
2550 zStopperFile = find_option("stopper", 0, 1);
2551 #endif
2552
2553 if( g.zErrlog==0 ){
2554 g.zErrlog = "-";
2555 g.fAnyTrace = 1;
2556 }
2557 zFileGlob = find_option("files-urlenc",0,1);
2558 if( zFileGlob ){
2559 char *z = mprintf("%s", zFileGlob);
2560 dehttpize(z);
2561
--- src/main.c
+++ src/main.c
@@ -1426,11 +1426,11 @@
1426 ** webbrowser opens a connection but never sends the HTTP request
1427 */
1428 void sigpipe_handler(int x){
1429 #ifndef _WIN32
1430 if( g.fAnyTrace ){
1431 fprintf(stderr,"/**** sigpipe received by subprocess %d ****\n", getpid());
1432 }
1433 #endif
1434 fossil_exit(1);
1435 }
1436
@@ -2550,11 +2550,10 @@
2550 zStopperFile = find_option("stopper", 0, 1);
2551 #endif
2552
2553 if( g.zErrlog==0 ){
2554 g.zErrlog = "-";
 
2555 }
2556 zFileGlob = find_option("files-urlenc",0,1);
2557 if( zFileGlob ){
2558 char *z = mprintf("%s", zFileGlob);
2559 dehttpize(z);
2560

Keyboard Shortcuts

Open search /
Next entry (timeline) j
Previous entry (timeline) k
Open focused entry Enter
Show this help ?
Toggle theme Top nav button