rescue_from ActionController::RoutingError, :with => :no_puppetclass_documentation_handler

before_filter :authorize, :except => :login

# Authorize the user for the requested action

def authorize(ctrl = params[:controller], action = params[:action])

return true if request.xhr?

allowed = User.current.allowed_to?({:controller => ctrl, :action => action})

allowed ? true : deny_access

end

def deny_access

User.current.logged? ? render_403 : require_login

end

# Sets User.current to the logged in user, or to admin if logins are not used

unless session[:user] and User.current = User.find(session[:user])

User.current = authenticate_or_request_with_http_basic { |u, p| User.try_to_login(u, p) }

return !User.current.nil?

unless User.current = User.find_by_login("admin")

User.current = User.current = User.create_admin

session[:user] = User.current.id unless request_json?

User.current

return true if params[:tab_name].empty? or params[:action] != "index"

if params[:tab_name] == "Reset"

def require_admin

unless User.current.admin?

render_403

return false

end

true

end

def render_403

respond_to do |format|

format.html { render :template => "common/403", :layout => (request.xhr? ? false : 'standard'), :status => 403 }

format.atom { head 403 }

format.yaml { head 403 }

format.yml { head 403 }

format.xml { head 403 }

format.json { head 403 }

end

return false

end

# this has to be in the application controller, as the new request (for puppetdoc) url is not controller specific.

def no_puppetclass_documentation_handler(exception)

if exception.message =~ /No route matches "\/puppet\/rdoc\/([^\/]+)\/classes\/(.+?)\.html/

render :template => "puppetclasses/no_route", :locals => {:environment => $1, :name => $2.gsub("/","::")}, :layout => false

else

local_request? ? rescue_action_locally(exception) : rescue_action_in_public(exception)

end

end

skip_before_filter :require_ssl, :only => :create

skip_before_filter :require_login, :only => :create

skip_before_filter :authorize, :only => :create

before_filter :authorize

# restrict allowed hosts list based on the user permissions

@search = User.current.admin? ? Host.search(params[:search]) : Host.my_hosts.search(params[:search])

# You can see a host if you can CRUD it

@hosts = @search.paginate :page => params[:page], :include => [:hostgroup, :domain, :operatingsystem, :environment, :model, :fact_values]

missed_hosts = hosts.map(&:name).join('<br/>')

flash[:foreman_notice] = hosts.empty? ? "Destroyed selected hosts" : "The following hosts were not deleted: #{missed_hosts}"

missed_hosts = hosts.map(&:name).join('<br/>')

flash[:foreman_notice] = @hosts.empty? ? "#{action.capitalize} selected hosts" : "The following hosts were not #{action}: #{missed_hosts}"

@hosts = @search.paginate :page => params[:page], :include => [:hostgroup, :domain, :operatingsystem, :environment, :model, :fact_values]

if @model.destroy

skip_before_filter :authorize, :only => :destroy

@notice.destroy_notice

skip_before_filter :require_login, :only => :create

skip_before_filter :require_ssl, :only => :create

skip_before_filter :authorize, :only => :create

# redMine - project management software

# Copyright (C) 2006 Jean-Philippe Lang

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.

class RolesController < ApplicationController

before_filter :require_admin

def index

@search = Role.search(params[:search])

@roles = @search.paginate(:page => params[:page], :order => "builtin ASC, name ASC")

end

def new

# Prefills the form with 'default user' role permissions

@role = Role.new({:permissions => Role.default_user.permissions})

@permissions = @role.setable_permissions

end

def create

@role = Role.new(params[:role])

@permissions = @role.setable_permissions

if @role.save

flash[:foreman_notice] = "#{@role.name} succcessfully created"

redirect_to roles_url

else

render :action => 'new'

end

end

def edit

@role = Role.find(params[:id])

@permissions = @role.setable_permissions

end

def update

@role = Role.find(params[:id])

if @role.update_attributes(params[:role])

flash[:foreman_notice] = "#{@role.name} successfully updated"

redirect_to roles_url

else

render :action => 'edit'

end

end

def destroy

@role = Role.find(params[:id])

if @role.destroy

flash[:foreman_notice] = "Successfully destroyed role."

else

flash[:foreman_error] = @role.errors.full_messages.join("<br/>")

end

redirect_to roles_url

end

def report

@roles = Role.all(:order => 'builtin, name')

@permissions = Foreman::AccessControl.permissions.select { |p| !p.public? }

if request.post?

@roles.each do |role|

role.permissions = params[:permissions][role.id.to_s]

role.save

end

flash[:foreman_notice] = "All non public permissions successfuly updated"

redirect_to roles_url

end

end

end

@usergroups = Usergroup.all(:order => "name")

skip_before_filter :authorize, :only => [:login, :logout]

@user.roles = Role.name_is("Anonymous")

if @user.user_facts.count == 0

user_fact = @user.user_facts.build :operator => "==", :andor => "or"

user_fact.fact_name_id = Puppet::Rails::FactName.first.id if Puppet::Rails::FactName.first

true

end

# Remove keys for resticted variables when the user is granted minimal access only to their own account

if @minimal_edit

for key in params[:user].keys

params[:user].delete key unless %w{password_confirmation password mail firstname lastname}.include? key

end

end

# Only an admin can update admin attribute of another use

# this is required, as the admin field is blacklisted above

@user.update_attribute(:admin, admin) if User.current.admin

if user == User.current

session[:user] = @user = User.current = nil

session.clear

private

def authorize(ctrl = params[:controller], action = params[:action])

# Minimal edit is true when the user is granted access to just their

# own account details

@minimal_edit = false

return true if User.current.allowed_to?({:controller => ctrl, :action => action})

if action =~ /edit|update/ and params[:id] == User.current.id.to_s

return @minimal_edit=true

else

deny_access and return

end

end

# Methods added to this helper will be available to all templates in the application

def contract model

model.to_s

end

render :partial => 'common/edit_habtm', :locals =>{ :klass => klass, :associations => association.all.sort.delete_if{|e| e == klass}}

# Creates a link to a javascript function that creates field entries for the association on the web page

# +name+ : String containing links's text

# +f+ : FormBuiler object

# +association : The field are created to allow entry into this association

# +partial+ : String containing an optional partial into which we render

def check_all_links(form_name)

link_to_function("Check all", "checkAll('#{form_name}', true)") +

" | " +

link_to_function("Uncheck all", "checkAll('#{form_name}', false)")

end

# Return true if user is authorized for controller/action, otherwise false

# +controller+ : String or symbol for the controller

# +action+ : String or symbol for the action

def authorized_for(controller, action)

User.current.allowed_to?({:controller => controller, :action => action}) rescue false

end

# Display a link if user is authorized, otherwise a string

# +name+ : String to be displayed

# +options+ : Hash containing

# :enable_link : Boolean indicating whether the link is to be displayed

# :controlller : String or Symbol representing the controller

# :auth_action : String or Symbol representing the action to be used for authorization checks

# +html_options+ : Hash containing html options for the link or span

def link_to_if_authorized(name, options = {}, html_options = {})

enable_link = options.has_key?(:enable_link) ? options.delete(:enable_link) : true

auth_action = options.delete :auth_action

if enable_link

link_to_if authorized_for(options[:controller] || params[:controller], auth_action || options[:action]), name, options, html_options

else

content_tag(:span, name, {:class => "entry"}.merge(html_options))

end

end

# Display a link if user is authorized, otherwise nothing

# +name+ : String to be displayed

# +options+ : Hash containing

# :controlller : String or Symbol representing the controller

# :auth_action : String or Symbol representing the action to be used for authorization checks

# +html_options+ : Hash containing html options for the link or span

def display_link_if_authorized(name, options = {}, html_options = nil)

auth_action = options.delete :auth_action

link_to(name, options, html_options) if authorized_for(options[:controller] || params[:controller], auth_action || options[:action])

end

def authorized_edit_habtm klass, association

return edit_habtm(klass, association) if authorized_for params[:controller], params[:action]

show_habtm klass.send(association.name.pluralize.downcase)

end

# Return true if user is authorized for controller/action OR controller/action@type, otherwise false

def authorized_via_my_scope(controller, action)

return true if authorized_for(controller, action)

operation = "#{action}_my_#{controller.singularize}".to_sym

User.current.allowed_to?(operation) and User.current.send(controller).include?(eval("@#{controller.singularize}"))

end

include CommonParametersHelper

include CommonParametersHelper

include CommonParametersHelper

include CommonParametersHelper

link_to_if_authorized(time, hash_for_report_path(:id => @last_reports[record.id], :enable_link => @last_reports[record.id])

)

include Authorization

include Authorization

# Returns : user's attributes OR nil

# Loads the LDAP info for a user and authenticates the user with their password

# Returns : Array of Strings.

# Either the users's DN or the user's full details OR nil

module Authorization

def self.included(base)

base.class_eval do

before_save :enforce_edit_permissions

before_destroy :enforce_destroy_permissions

before_create :enforce_create_permissions

end

end

# We must enforce the security model

def enforce_edit_permissions

enforce_permissions("edit") if enforce?

end

def enforce_destroy_permissions

enforce_permissions("destroy") if enforce?

end

def enforce_create_permissions

enforce_permissions("create") if enforce?

end

def enforce_permissions operation

# We get called again with the operation being set to create

return true if operation == "edit" and new_record?

klass = self.class.name.downcase

klass.gsub!(/authsource.*/, "authenticator")

klass.gsub!(/commonparameter.*/, "global_variable")

klasses = klass.pluralize

return true if User.current.allowed_to?("#{operation}_#{klasses}".to_sym)

errors.add_to_base "You do not have permission to #{operation} this #{klass}"

false

end

private

def enforce?

not (defined?(Rake) or User.current.admin?)

end

end

include Authorization

has_and_belongs_to_many :users, :join_table => "user_domains"

def enforce_permissions operation

# We get called again with the operation being set to create

return true if operation == "edit" and new_record?

current = User.current

if current.allowed_to?("#{operation}_domains".to_sym)

# If you can create domains then you can create them anywhere

return true if operation == "create"

# However if you are editing or destroying and you have a domain list then you are contrained

if current.domains.empty? or current.domains.map(&:id).include? self.id

return true

end

end

errors.add_to_base "You do not have permission to #{operation} this domain"

false

end

private

def enforce_permissions operation

# We get called again with the operation being set to create

return true if operation == "edit" and new_record?

current = User.current

if current.allowed_to?("#{operation}_domains".to_sym)

if current.domains.empty? or current.domains.include? domain

return true

end

end

errors.add_to_base "You do not have permission to #{operation} this domain parameter"

false

end

private

def enforce_permissions operation

# We get called again with the operation being set to create

return true if operation == "edit" and new_record?

current = User.current

if current.allowed_to?("#{operation}_hostgroups".to_sym)

if current.hostgroups.empty? or current.hostgroups.include? hostgroup

return true

end

end

errors.add_to_base "You do not have permission to #{operation} this group parameter"

false

end

include Authorization

named_scope :my_hosts, lambda {

user = User.current

owner_conditions = sanitize_sql_for_conditions(["((hosts.owner_id in (?) AND hosts.owner_type = 'Usergroup') OR (hosts.owner_id = ? AND hosts.owner_type = 'User'))", user.my_usergroups.map(&:id), user.id])

domain_conditions = sanitize_sql_for_conditions([" (hosts.domain_id in (?))",dms = (user.domains).map(&:id)])

hostgroup_conditions = sanitize_sql_for_conditions([" (hosts.hostgroup_id in (?))",(hgs = user.hostgroups).map(&:id)])

fact_conditions = ""

for user_fact in (ufs = user.user_facts)

fact_conditions += sanitize_sql_for_conditions ["(hosts.id = fact_values.host_id and fact_values.fact_name_id = ? and fact_values.value #{user_fact.operator} ?)", user_fact.fact_name_id, user_fact.criteria]

fact_conditions = user_fact.andor == "and" ? "(#{fact_conditions}) and " : "#{fact_conditions} or "

end

if match = fact_conditions.match(/^(.*).....$/)

fact_conditions = "(#{match[1]})"

end

conditions = ""

if user.filtering?

conditions = "#{owner_conditions}" if user.filter_on_owner

(conditions = (user.domains_andor == "and") ? "(#{conditions}) and #{domain_conditions} " : "#{conditions} or #{domain_conditions} ") unless dms.empty?

(conditions = (user.hostgroups_andor == "and") ? "(#{conditions}) and #{hostgroup_conditions} " : "#{conditions} or #{hostgroup_conditions} ") unless hgs.empty?

(conditions = (user.facts_andor == "and") ? "(#{conditions}) and #{fact_conditions} " : "#{conditions} or #{fact_conditions} ") unless ufs.empty?

conditions.sub!(/\s*\(\)\s*/, "")

conditions.sub!(/^(?:\(\))?\s?(?:and|or)\s*/, "")

conditions.sub!(/\(\s*(?:or|and)\s*\(/, "((")

end

{:conditions => conditions}

}

validates_format_of :mac, :with => (/([a-f0-9]{1,2}:){5}[a-f0-9]{1,2}/)

validates_format_of :ip, :with => (/(\d{1,3}\.){3}\d{1,3}/)

:if => Proc.new { |host| host.disk.empty? and not defined?(Rake) }

oid = User.find(selection.to_i) if selection =~ (/-Users$/)

oid = Usergroup.find(selection.to_i) if selection =~ (/-Usergroups$/)

return all_puppetclasses.collect {|c| c.name}

return hostgroup.nil? ? puppetclasses : (hostgroup.puppetclasses + puppetclasses).uniq

:conditions => "fact_names.name = '#{name}'")

klasses = resources.find(:all, :conditions => {:restype => "Class"}, :select => :title, :order => :title)

klasses.map!(&:title).delete(:main)

return klasses

def enforce_permissions operation

if operation == "edit" and new_record?

return true # We get called again with the operation being set to create

end

current = User.current

if (operation == "edit") or operation == "destroy"

if current.allowed_to?("#{operation}_hosts".to_sym)

return true if Host.my_hosts(current).include? self

end

else # create

if current.allowed_to?(:create_hosts)

# We are unconstrained

return true if current.domains.empty? and current.hostgroups.empty?

# We are contrained and the constraint is matched

return true if (!current.domains.empty? and current.domains.include?(domain)) or

(!current.hostgroups.empty? and current.hostgroups.include?(hostgroup))

end

end

errors.add_to_base "You do not have permission to #{operation} this host"

false

end

"#{host.id ? host.name : "unassociated"}: #{name} = #{value}"

private

def enforce_permissions operation

# We get called again with the operation being set to create

return true if operation == "edit" and new_record?

self.host.enforce_permissions operation

end

include Authorization

has_and_belongs_to_many :users, :join_table => "user_hostgroups"

#TODO: add a method that returns the valid os for a hostgroup

def all_puppetclasses

puppetclasses

end

def hostgroup

self

end

include Authorization

include Authorization

def destroy_notice

if global

destroy

else

users.delete(User.current)

destroy unless users.any?

end

end

include Authorization

include Authorization

include Authorization

include Authorization

include Authorization

case metric

def enforce_permissions operation

# No one can edit a report

return false if operation == "edit"

# Anyone can create a report

return true if operation == "create"

return true if operation == "destroy" and User.current.allowed_to?(:destroy_reports)

errors.add_to_base "You do not have permission to #{operation} this report"

false

end

# redMine - project management software

# Copyright (C) 2006 Jean-Philippe Lang

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.

class Role < ActiveRecord::Base

# Built-in roles

BUILTIN_DEFAULT_USER = 1

BUILTIN_ANONYMOUS = 2

named_scope :givable, { :conditions => "builtin = 0", :order => 'name' }

named_scope :builtin, lambda { |*args|

compare = 'not' if args.first == true

{ :conditions => "#{compare} builtin = 0" }

}

before_destroy :check_deletable

has_many :user_roles, :dependent => :destroy

has_many :users, :through => :user_roles

serialize :permissions, Array

attr_protected :builtin

validates_presence_of :name

validates_uniqueness_of :name

validates_length_of :name, :maximum => 30

validates_format_of :name, :with => /^\w[\w\s\'\-]*\w$/i

validates_inclusion_of :builtin, :in => 0..2

def initialize *args

super *args

self.builtin = 0

end

def permissions

read_attribute(:permissions) || []

end

def permissions=(perms)

perms = perms.collect {|p| p.to_sym unless p.blank? }.compact.uniq if perms

write_attribute(:permissions, perms)

end

def add_permission!(*perms)

self.permissions = [] unless permissions.is_a?(Array)

permissions_will_change!

perms.each do |p|

p = p.to_sym

permissions << p unless permissions.include?(p)

end

save!

end

def remove_permission!(*perms)

return unless permissions.is_a?(Array)

permissions_will_change!

perms.each { |p| permissions.delete(p.to_sym) }

save!

end

# Returns true if the role has the given permission

def has_permission?(perm)

!permissions.nil? && permissions.include?(perm.to_sym)

end

# Return true if the role is a builtin role

def builtin?

self.builtin != 0

end

# Return true if the role is a user role

def user?

!self.builtin?

end

# Return true if role is allowed to do the specified action

# action can be:

# * a parameter-like Hash (eg. :controller => 'projects', :action => 'edit')

# * a permission Symbol (eg. :edit_project)

def allowed_to?(action)

if action.is_a? Hash

allowed_actions.include? "#{action[:controller]}/#{action[:action]}"

else

allowed_permissions.include? action

end

end

# Return all the permissions that can be given to the role

def setable_permissions

setable_permissions = Foreman::AccessControl.permissions - Foreman::AccessControl.public_permissions

setable_permissions -= Foreman::AccessControl.loggedin_only_permissions if self.builtin == BUILTIN_ANONYMOUS

setable_permissions

end

# Find all the roles that can be given to a user

def self.find_all_givable

find(:all, :conditions => {:builtin => 0}, :order => 'name')

end

# Return the builtin 'default user' role. If the role doesn't exist,

# it will be created on the fly.

def self.default_user

default_user_role = find(:first, :conditions => {:builtin => BUILTIN_DEFAULT_USER})

if default_user_role.nil?

default_user_role = create(:name => 'Default user') do |role|

role.builtin = BUILTIN_DEFAULT_USER

end

raise 'Unable to create the default user role.' if default_user_role.new_record?

end

default_user_role

end

# Return the builtin 'anonymous' role. If the role doesn't exist,

# it will be created on the fly.

def self.anonymous

anonymous_role = find(:first, :conditions => {:builtin => BUILTIN_ANONYMOUS})

if anonymous_role.nil?

anonymous_role = create(:name => 'Anonymous') do |role|

role.builtin = BUILTIN_ANONYMOUS

end

raise "Unable to create the anonymous role." if anonymous_role.new_record?

end

anonymous_role

end

private

def allowed_permissions

@allowed_permissions ||= permissions + Foreman::AccessControl.public_permissions.collect {|p| p.name}

end

def allowed_actions

@actions_allowed ||= allowed_permissions.inject([]) { |actions, permission| actions += Foreman::AccessControl.allowed_actions(permission) }.flatten

end

def check_deletable

errors.add_to_base "Role is in use" if users.any?

errors.add_to_base "Can't delete builtin role" if builtin?

errors.empty?

end

end

include Authorization

#has_many :sps, :through => :hosts

before_destroy Ensure_not_used_by.new(:hosts) #, :sps)

include Authorization

has_many :user_roles

has_many :roles, :through => :user_roles

has_and_belongs_to_many :domains, :join_table => "user_domains"

has_and_belongs_to_many :hostgroups, :join_table => "user_hostgroups"

has_many :user_facts, :dependent => :destroy

has_many :facts, :through => :user_facts, :source => :fact_name

accepts_nested_attributes_for :user_facts, :reject_if => lambda { |a| a[:criteria].blank? }, :allow_destroy => true

after_destroy Proc.new {|user| user.domains.clear; user.hostgroups.clear}

cattr_accessor :current

self.name.downcase <=> other.name.downcase

:mail => email, :auth_source => AuthSourceInternal.first, :password => "changeme")

# Tries to find the user in the DB and then authenticate against their authentication source

# If the user is not in the DB then try to login the user on each available athentication source

# If this succeeds then copy the user's details from the authentication source into the User table

# Returns : User object OR nil

if user = find_by_login(login)

if user.auth_source and user.auth_source.authenticate(login, password)

# user has an authentication method and the authentication was successful

User.current = user

user.update_attribute(:last_login_on, Time.now.utc)

else

user = nil

# The default user must be given :create_users permissions for on-the-fly to work.

User.current = user

user.update_attribute(:last_login_on, Time.now.utc)

user = nil

anonymous = Role.find_by_name("Anonymous")

User.current.roles << anonymous unless user.nil? or User.current.roles.include?(anonymous)

def my_usergroups

all_groups.uniq

end

def indirect_hosts

my_usergroups.map{|g| g.hosts}.flatten.uniq

# Return true if the user is allowed to do the specified action

# action can be:

# * a parameter-like Hash (eg. :controller => 'projects', :action => 'edit')

# * a permission Symbol (eg. :edit_project)

def allowed_to?(action, options={})

return true if admin?

return false if roles.empty?

roles.detect {|role| role.allowed_to?(action)}

end

def logged?

true

end

# Indicates whether the user has host filtering enabled

# Returns : Boolean

def filtering?

filter_on_owner or

domains.any? or

hostgroups.any? or

facts.any?

end

protected

errors.add_to_base "Can't delete internal admin account"

logger.warn "Unable to delete internal admin account"

class UserFact < ActiveRecord::Base

belongs_to :user

belongs_to :fact_name, :class_name => "Puppet::Rails::FactName"

validates_inclusion_of :andor, :in => %w{and or}

validates_inclusion_of :operator, :in => %w{= != > >= < <= }

validates_presence_of :fact_name

validates_presence_of :criteria

validates_presence_of :user

def initialize *args

super *args

operator = "=" if operator.empty?

andor = "or" if andor.empty?

end

def to_s

n = user.try(:name) || "Unknown user"

fn = fact_name.try(:name) || "Unknown fact"

"#{n}:#{fn}:#{criteria.empty? ? "Empty" : criteria}:#{operator}:#{andor}"

end

end

# Redmine - project management software

# Copyright (C) 2006-2009 Jean-Philippe Lang

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software