diff options
Diffstat (limited to 'modules-available/permissionmanager/install.inc.php')
| -rw-r--r-- | modules-available/permissionmanager/install.inc.php | 32 |
1 files changed, 21 insertions, 11 deletions
diff --git a/modules-available/permissionmanager/install.inc.php b/modules-available/permissionmanager/install.inc.php index 68f01899..5d1f60da 100644 --- a/modules-available/permissionmanager/install.inc.php +++ b/modules-available/permissionmanager/install.inc.php @@ -5,6 +5,7 @@ $res = array(); $res[] = tableCreate('role', " roleid int(10) unsigned NOT NULL AUTO_INCREMENT, rolename varchar(200) NOT NULL, + builtin bool NOT NULL DEFAULT '0', roledescription TEXT, PRIMARY KEY (roleid) "); @@ -100,20 +101,27 @@ if (!tableHasColumn('role', 'roledescription')) { $res[] = UPDATE_DONE; } -if (!tableHasColumn('role', 'roledescription')) { - finalResponse(UPDATE_RETRY, 'Try again later'); +// 2020-01-09 flag for builtin roles that can't be edited +if (!tableHasColumn('role', 'builtin')) { + $alter = Database::exec("ALTER TABLE role ADD builtin bool NOT NULL DEFAULT '0' AFTER rolename"); + if ($alter === false) + finalResponse(UPDATE_FAILED, 'Cannot add builtin field to table role: ' . Database::lastError()); + $res[] = UPDATE_DONE; } -if (Database::exec("INSERT INTO `role` VALUES - (1,'Super-Admin', 'Hat keinerlei Zugriffsbeschränkungen'), - (2,'Admin', 'Alles bis auf Rechte-/Nutzerverwaltung'), - (3,'Prüfungsadmin', 'Kann E-Prüfungen verwalten, Prüfungsmodus einschalten, etc.'), - (4,'Lesezugriff', 'Kann auf die meisten Seiten zugreifen, jedoch keine Änderungen vornehmen')") !== false) { - // Success, there probably were no roles before, keep going +if (Database::exec("INSERT INTO `role` (roleid, rolename, builtin, roledescription) VALUES + (1,'Super-Admin', 1, 'Hat keinerlei Zugriffsbeschränkungen'), + (2,'Admin', 1, 'Alles bis auf Rechte-/Nutzerverwaltung'), + (3,'Prüfungsadmin', 1, 'Kann E-Prüfungen verwalten, Prüfungsmodus einschalten, etc.'), + (4,'Lesezugriff', 1, 'Kann auf die meisten Seiten zugreifen, jedoch keine Änderungen vornehmen') + ON DUPLICATE KEY UPDATE rolename = VALUES(rolename), builtin = 1, roledescription = VALUES(roledescription)") !== false) { + // Old ruleset accidentally gave write permissions to the read-only role + Database::exec("DELETE FROM role_x_permission WHERE roleid = 4 AND permissionid = 'news.*'"); // Assign roles to location (all) + Database::exec("DELETE FROM role_x_location WHERE roleid IN (1,2,3,4)"); Database::exec("INSERT INTO `role_x_location` VALUES (1,NULL),(2,NULL),(3,NULL),(4,NULL)"); // Assign permissions to roles - Database::exec("INSERT INTO `role_x_permission` VALUES + Database::exec("INSERT IGNORE INTO `role_x_permission` VALUES (3,'exams.exams.*'), (3,'rebootcontrol.action.*'), (3,'statistics.hardware.projectors.view'), @@ -138,7 +146,7 @@ if (Database::exec("INSERT INTO `role` VALUES (4,'locationinfo.panel.list'), (4,'locations.location.view'), (4,'minilinux.view'), - (4,'news.*'), + (4,'news.access-page'), (4,'permissionmanager.locations.view'), (4,'permissionmanager.roles.view'), (4,'permissionmanager.users.view'), @@ -159,6 +167,8 @@ if (Database::exec("INSERT INTO `role` VALUES (4,'systemstatus.show.overview.*'), (4,'systemstatus.tab.*'), (4,'webinterface.access-page'), + (4,'rebootcontrol.subnet.view'), + (4,'rebootcontrol.jumphost.view'), (2,'adduser.user.view-list'), (2,'backup.*'), @@ -186,7 +196,7 @@ if (Database::exec("INSERT INTO `role` VALUES (2,'vmstore.edit'), (2,'webinterface.*')"); // Assign the first user to the superadmin role (if one exists) - Database::exec("INSERT INTO `role_x_user` VALUES (1,1)"); + Database::exec("INSERT IGNORE INTO `role_x_user` VALUES (1,1)"); $res[] = UPDATE_DONE; } |