fu: Close-up of Fu, bringing a scoop of water to her mouth (Default)
fu ([personal profile] fu) wrote in [site community profile] changelog2011-05-24 08:25 am
  • Add Memory
  • Share This Entry

[dw-free] Index for /security/

[commit: http://hg.dwscoalition.org/dw-free/rev/aad8d272cb59]

http://bugs.dwscoalition.org/show_bug.cgi?id=1581

Landing page for exampleusername.dreamwidth.org/security/...

Patch by [personal profile] fu.

Files modified:
  • bin/upgrading/en.dat
  • cgi-bin/Apache/LiveJournal.pm
  • cgi-bin/LJ/User.pm
  • views/journal/security.tt
  • views/journal/security.tt.text
--------------------------------------------------------------------------------
diff -r a250438f2f6e -r aad8d272cb59 bin/upgrading/en.dat
--- a/bin/upgrading/en.dat	Tue May 24 15:17:51 2011 +0800
+++ b/bin/upgrading/en.dat	Tue May 24 16:25:27 2011 +0800
@@ -942,7 +942,7 @@
 
 error.security.invalid=You have specified an invalid security setting, the access group you specified does not exist, or you are not a member of that group.
 
-error.security.name=Security Error
+error.security.name2=Security Filter Error
 
 error.security.noarg=You must provide a security level to filter by.
 
diff -r a250438f2f6e -r aad8d272cb59 cgi-bin/Apache/LiveJournal.pm
--- a/cgi-bin/Apache/LiveJournal.pm	Tue May 24 15:17:51 2011 +0800
+++ b/cgi-bin/Apache/LiveJournal.pm	Tue May 24 16:25:27 2011 +0800
@@ -735,16 +735,12 @@
             } elsif ($mode eq 'security') {
                 # tailing slash on here to prevent a second redirect after this one
                 return redir($r, LJ::journal_base($user) . "$uri/") unless $pe;
-                if ($pe eq '/') {
-                    # do a 404 for now
-                    return 404;
-                } else {
-                    # filtered lastn page
-                    $mode = 'lastn';
+                # filtered lastn page
+                $mode = 'lastn';
 
-                    # prepend /security so that lastn knows to do security filtering
-                    $pe = "/security$pe";
-                }
+                # prepend /security so that lastn knows to do security filtering
+                $pe = "/security$pe";
+
             }
         } elsif (($vhost eq "users" || $vhost =~ /^other:/) &&
                  $uuri eq "/robots.txt") {
diff -r a250438f2f6e -r aad8d272cb59 cgi-bin/LJ/User.pm
--- a/cgi-bin/LJ/User.pm	Tue May 24 15:17:51 2011 +0800
+++ b/cgi-bin/LJ/User.pm	Tue May 24 16:25:27 2011 +0800
@@ -44,6 +44,7 @@
 use DW::User::Edges;
 use DW::InviteCodes::Promo;
 use DW::SiteScheme;
+use DW::Template;
 
 use LJ::Community;
 use LJ::Subscription;
@@ -8693,7 +8694,7 @@
     }
 
     # do the same for security filtering
-    elsif ( ( $view eq 'lastn' || $view eq 'read' ) && $opts->{pathextra} && $opts->{pathextra} =~ /^\/security\/(.+)$/ ) {
+    elsif ( ( $view eq 'lastn' || $view eq 'read' ) && $opts->{pathextra} && $opts->{pathextra} =~ /^\/security\/(.*)$/ ) {
         $opts->{getargs}->{security} = LJ::durl($1);
         $opts->{pathextra} = undef;
     }
@@ -8858,18 +8859,71 @@
     # validate the security filter
     if (exists $opts->{getargs}->{security}) {
         my $securityfilter = $opts->{getargs}->{security};
-        return $error->( BML::ml( 'error.security.noarg' ), "404 Not Found", BML::ml( 'error.security.name' ) )
+
+        my $r = DW::Request->get;
+        my $security_err = sub {
+            my ( $args, %opts ) = @_;
+            $args->{header} ||= "error.security.name2";
+
+            my $status = $opts{status} || $r->NOT_FOUND;
+
+            my @levels;
+            my @groups;
+            # error message is an appropriate type to show the list
+            if ( $opts{show_list}
+                # viewing recent entries
+                && ( $view eq "lastn"
+                    # or your own read page (can't see locked entries on others' read page anyway)
+                    || ( $view eq "read" && $u->equals( $remote ) ) ) ) {
+
+                my $path = $view eq "read" ? "/read/security" : "/security";
+                @levels  = ( { link => LJ::create_url( "$path/public", viewing_style => 1 ),
+                                    name => LJ::Lang::ml( "label.security.public" ) } );
+
+                if ( $u->is_comm ) {
+                    push @levels, { link => LJ::create_url( "$path/access", viewing_style => 1 ),
+                                    name => LJ::Lang::ml( "label.security.members" ) }
+                                if $remote && $remote->member_of( $u );
+
+                    push @levels, { link => LJ::create_url( "$path/private", viewing_style => 1 ),
+                                    name => LJ::Lang::ml( "label.security.maintainers" ) }
+                                if $remote && $remote->can_manage_other( $u );
+                } else {
+                    push @levels, { link => LJ::create_url( "$path/access", viewing_style => 1 ),
+                                    name => LJ::Lang::ml( "label.security.accesslist" ) }
+                                if $u->trusts( $remote );
+
+                    push @levels, { link => LJ::create_url( "$path/private", viewing_style => 1 ),
+                                    name => LJ::Lang::ml( "label.security.accesslist" ) }
+                                if $u->equals( $remote );
+                }
+
+                $args->{levels} = \@levels;
+
+                @groups = map { { link => LJ::create_url( "$path/group:" . $_->{groupname} ), name => $_->{groupname} } } $remote->trust_groups if $u->equals( $remote );
+                $args->{groups} = \@groups;
+            }
+
+            ${$opts->{handle_with_siteviews_ref}} = 1;
+            return DW::Template->template_string( "journal/security.tt",
+                $args,
+                {
+                    status => $status,
+                }
+            );
+        };
+
+        return $security_err->( { message => undef, header => "/journal/security.tt.header" }, show_list => 1 )
             unless $securityfilter;
 
-        return $error->( BML::ml( 'error.security.nocap' ), "403 Forbidden", BML::ml( 'error.security.name' ) )
-            unless LJ::get_cap($remote, "security_filter") || LJ::get_cap($u, "security_filter");
-
-        # error if disabled
-        return $error->( BML::ml( 'error.security.disabled' ), "404 Not Found", BML::ml( 'error.security.name' ) )
-            unless LJ::is_enabled("security_filter");
+        return $security_err->( { message => "error.security.nocap" }, status => $r->FORBIDDEN )
+            unless LJ::get_cap( $remote, "security_filter" ) || LJ::get_cap( $u, "security_filter" );
+
+        return $security_err->( { message => "error.security.disabled" } )
+            unless LJ::is_enabled( "security_filter" );
 
         # throw an error if we're rendering in S1, but not for renamed accounts
-        return $error->( BML::ml( 'error.security.s1' ), "404 Not Found", BML::ml( 'error.security.name' ) )
+        return $security_err->( { message => "error.security.s1" } )
             if $stylesys == 1 && $view ne 'data' && ! $u->is_redirect;
 
         # check the filter itself
@@ -8888,9 +8942,8 @@
             }
         }
 
-        return $error->( BML::ml( 'error.security.invalid' ), "404 Not Found", BML::ml( 'error.security.name' ) )
+        return $security_err->( { message => "error.security.invalid" }, show_list => 1 )
             unless defined $opts->{securityfilter};
-
     }
 
     unless ( $geta->{'viewall'} && $remote && $remote->has_priv( "canview", "suspended" ) ||
diff -r a250438f2f6e -r aad8d272cb59 views/journal/security.tt
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/views/journal/security.tt	Tue May 24 16:25:27 2011 +0800
@@ -0,0 +1,20 @@
+[% IF header %]<h1>[% header | ml %]</h1>[% END %]
+[% IF message %]<p>[% message | ml %]</p> [% END %]
+
+[% IF levels.size > 0 %]
+<p>[% ".filter.levels" | ml %]</p>
+<ul>
+    [% FOREACH level IN levels %]
+        <li><a href="[%level.link%]">[%level.name%]</a></li>
+    [% END %]
+</ul>
+[% END %]
+
+[% IF groups.size > 0 %]
+<p>[% ".filter.custom" | ml %]</p>
+<ul>
+    [% FOREACH group IN groups %]
+    <li><a href="[%group.link%]">[%group.name%]</a></li>
+    [% END %]
+</ul>
+[% END %]
diff -r a250438f2f6e -r aad8d272cb59 views/journal/security.tt.text
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/views/journal/security.tt.text	Tue May 24 16:25:27 2011 +0800
@@ -0,0 +1,5 @@
+.filter.custom=You can also filter by your custom access groups:
+
+.filter.levels=You can filter entries by the following security level:
+
+.header=Filter by security
--------------------------------------------------------------------------------
  • Add Memory
  • Share This Entry
(0 comments)

Post a comment in response:

This account has disabled anonymous posting.
If you don't have an account you can create one now.
HTML doesn't work in the subject.
More info about formatting

If you are unable to use this captcha for any reason, please contact us by email at support@dreamwidth.org

 
Notice: This account is set to log the IP addresses of everyone who comments.
Links will be displayed as unclickable URLs to help prevent spam.