path: root/editgroups.cgi

#!/usr/bin/perl -wT
# -*- Mode: perl; indent-tabs-mode: nil -*-
#
# The contents of this file are subject to the Mozilla Public
# License Version 1.1 (the "License"); you may not use this file
# except in compliance with the License. You may obtain a copy of
# the License at http://www.mozilla.org/MPL/
#
# Software distributed under the License is distributed on an "AS
# IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
# implied. See the License for the specific language governing
# rights and limitations under the License.
#
# The Original Code is the Bugzilla Bug Tracking System.
#
# The Initial Developer of the Original Code is Netscape Communications
# Corporation. Portions created by Netscape are
# Copyright (C) 1998 Netscape Communications Corporation. All
# Rights Reserved.
#
# Contributor(s): Dave Miller <justdave@syndicomm.com>
#                 Joel Peshkin <bugreport@peshkin.net>
#                 Jacob Steenhagen <jake@bugzilla.org>
#                 Vlad Dascalu <jocuri@softhome.net>
#                 Frédéric Buclin <LpSolit@gmail.com>

use strict;
use lib ".";

use Bugzilla;
use Bugzilla::Constants;
use Bugzilla::Config qw(:admin);
use Bugzilla::Util;
use Bugzilla::Error;
use Bugzilla::Group;
use Bugzilla::Product;
use Bugzilla::User;
use Bugzilla::Token;

use constant SPECIAL_GROUPS => ('chartgroup', 'insidergroup',
                                'timetrackinggroup', 'querysharegroup');

my $cgi = Bugzilla->cgi;
my $dbh = Bugzilla->dbh;
my $template = Bugzilla->template;
my $vars = {};

my $user = Bugzilla->login(LOGIN_REQUIRED);

print $cgi->header();

$user->in_group('creategroups')
  || ThrowUserError("auth_failure", {group  => "creategroups",
                                     action => "edit",
                                     object => "groups"});

my $action = trim($cgi->param('action') || '');
my $token  = $cgi->param('token');

# Add missing entries in bug_group_map for bugs created while
# a mandatory group was disabled and which is now enabled again.
sub fix_bug_permissions {
    my $gid = shift;
    my $dbh = Bugzilla->dbh;

    detaint_natural($gid);
    return unless $gid;

    my $bug_ids =
      $dbh->selectcol_arrayref('SELECT bugs.bug_id
                                  FROM bugs
                            INNER JOIN group_control_map
                                    ON group_control_map.product_id = bugs.product_id
                             LEFT JOIN bug_group_map
                                    ON bug_group_map.bug_id = bugs.bug_id
                                   AND bug_group_map.group_id = group_control_map.group_id
                                 WHERE group_control_map.group_id = ?
                                   AND group_control_map.membercontrol = ?
                                   AND bug_group_map.group_id IS NULL',
                                 undef, ($gid, CONTROLMAPMANDATORY));

    my $sth = $dbh->prepare('INSERT INTO bug_group_map (bug_id, group_id) VALUES (?, ?)');
    foreach my $bug_id (@$bug_ids) {
        $sth->execute($bug_id, $gid);
    }
}

# CheckGroupID checks that a positive integer is given and is
# actually a valid group ID. If all tests are successful, the
# trimmed group ID is returned.

sub CheckGroupID {
    my ($group_id) = @_;
    $group_id = trim($group_id || 0);
    ThrowUserError("group_not_specified") unless $group_id;
    (detaint_natural($group_id)
      && Bugzilla->dbh->selectrow_array("SELECT id FROM groups WHERE id = ?",
                                        undef, $group_id))
      || ThrowUserError("invalid_group_ID");
    return $group_id;
}

# This subroutine is called when:
# - a new group is created. CheckGroupName checks that its name
#   is not empty and is not already used by any existing group.
# - an existing group is edited. CheckGroupName checks that its
#   name has not been deleted or renamed to another existing
#   group name (whose group ID is different from $group_id).
# In both cases, an error message is returned to the user if any
# test fails! Else, the trimmed group name is returned.

sub CheckGroupName {
    my ($name, $group_id) = @_;
    $name = trim($name || '');
    trick_taint($name);
    ThrowUserError("empty_group_name") unless $name;
    my $excludeself = (defined $group_id) ? " AND id != $group_id" : "";
    my $name_exists = Bugzilla->dbh->selectrow_array("SELECT name FROM groups " .
                                                     "WHERE name = ? $excludeself",
                                                     undef, $name);
    if ($name_exists) {
        ThrowUserError("group_exists", { name => $name });
    }
    return $name;
}

# CheckGroupDesc checks that a non empty description is given. The
# trimmed description is returned.

sub CheckGroupDesc {
    my ($desc) = @_;
    $desc = trim($desc || '');
    trick_taint($desc);
    ThrowUserError("empty_group_description") unless $desc;
    return $desc;
}

# CheckGroupRegexp checks that the regular expression is valid
# (the regular expression being optional, the test is successful
# if none is given, as expected). The trimmed regular expression
# is returned.

sub CheckGroupRegexp {
    my ($regexp) = @_;
    $regexp = trim($regexp || '');
    trick_taint($regexp);
    ThrowUserError("invalid_regexp") unless (eval {qr/$regexp/});
    return $regexp;
}

# If no action is specified, get a list of all groups available.

unless ($action) {
    my @groups = Bugzilla::Group->get_all;
    $vars->{'groups'} = \@groups;
    
    print $cgi->header();
    $template->process("admin/groups/list.html.tmpl", $vars)
      || ThrowTemplateError($template->error());
    exit;
}

#
# action='changeform' -> present form for altering an existing group
#
# (next action will be 'postchanges')
#

if ($action eq 'changeform') {
    # Check that an existing group ID is given
    my $group_id = CheckGroupID($cgi->param('group'));
    my ($name, $description, $regexp, $isactive, $isbuggroup) =
        $dbh->selectrow_array("SELECT name, description, userregexp, " .
                              "isactive, isbuggroup " .
                              "FROM groups WHERE id = ?", undef, $group_id);

    # For each group, we use left joins to establish the existence of
    # a record making that group a member of this group
    # and the existence of a record permitting that group to bless
    # this one

    my @groups;
    my $group_list =
      $dbh->selectall_arrayref('SELECT groups.id, groups.name, groups.description,
                                       CASE WHEN group_group_map.member_id IS NOT NULL
                                            THEN 1 ELSE 0 END,
                                       CASE WHEN B.member_id IS NOT NULL
                                            THEN 1 ELSE 0 END,
                                       CASE WHEN C.member_id IS NOT NULL
                                            THEN 1 ELSE 0 END
                                  FROM groups
                                  LEFT JOIN group_group_map
                                    ON group_group_map.member_id = groups.id
                                   AND group_group_map.grantor_id = ?
                                   AND group_group_map.grant_type = ?
                                  LEFT JOIN group_group_map as B
                                    ON B.member_id = groups.id
                                   AND B.grantor_id = ?
                                   AND B.grant_type = ?
                                  LEFT JOIN group_group_map as C
                                    ON C.member_id = groups.id
                                   AND C.grantor_id = ?
                                   AND C.grant_type = ?
                                 ORDER by name',
                                undef, ($group_id, GROUP_MEMBERSHIP,
                                        $group_id, GROUP_BLESS,
                                        $group_id, GROUP_VISIBLE));

    foreach (@$group_list) {
        my ($grpid, $grpnam, $grpdesc, $grpmember, $blessmember, $membercansee) = @$_;
        my $group = {};
        $group->{'grpid'}       = $grpid;
        $group->{'grpnam'}      = $grpnam;
        $group->{'grpdesc'}     = $grpdesc;
        $group->{'grpmember'}   = $grpmember;
        $group->{'blessmember'} = $blessmember;
        $group->{'membercansee'}= $membercansee;
        push(@groups, $group);
    }

    $vars->{'group_id'}    = $group_id;
    $vars->{'name'}        = $name;
    $vars->{'description'} = $description;
    $vars->{'regexp'}      = $regexp;
    $vars->{'isactive'}    = $isactive;
    $vars->{'isbuggroup'}  = $isbuggroup;
    $vars->{'groups'}      = \@groups;
    $vars->{'token'}       = issue_session_token('edit_group');

    print $cgi->header();
    $template->process("admin/groups/edit.html.tmpl", $vars)
      || ThrowTemplateError($template->error());

    exit;
}

#
# action='add' -> present form for parameters for new group
#
# (next action will be 'new')
#

if ($action eq 'add') {
    $vars->{'token'} = issue_session_token('add_group');
    print $cgi->header();
    $template->process("admin/groups/create.html.tmpl", $vars)
      || ThrowTemplateError($template->error());
    
    exit;
}



#
# action='new' -> add group entered in the 'action=add' screen
#

if ($action eq 'new') {
    check_token_data($token, 'add_group');
    # Check that a not already used group name is given, that
    # a description is also given and check if the regular
    # expression is valid (if any).
    my $name = CheckGroupName($cgi->param('name'));
    my $desc = CheckGroupDesc($cgi->param('desc'));
    my $regexp = CheckGroupRegexp($cgi->param('regexp'));
    my $isactive = $cgi->param('isactive') ? 1 : 0;

    # Add the new group
    $dbh->do('INSERT INTO groups
              (name, description, isbuggroup, userregexp, isactive)
              VALUES (?, ?, 1, ?, ?)',
              undef, ($name, $desc, $regexp, $isactive));

    my $gid = $dbh->bz_last_key('groups', 'id');
    my $admin = Bugzilla::Group->new({name => 'admin'})->id();
    # Since we created a new group, give the "admin" group all privileges
    # initially.
    my $sth = $dbh->prepare('INSERT INTO group_group_map
                             (member_id, grantor_id, grant_type)
                             VALUES (?, ?, ?)');

    $sth->execute($admin, $gid, GROUP_MEMBERSHIP);
    $sth->execute($admin, $gid, GROUP_BLESS);
    $sth->execute($admin, $gid, GROUP_VISIBLE);

    # Permit all existing products to use the new group if makeproductgroups.
    if ($cgi->param('insertnew')) {
        $dbh->do('INSERT INTO group_control_map
                  (group_id, product_id, entry, membercontrol,
                   othercontrol, canedit)
                  SELECT ?, products.id, 0, ?, ?, 0 FROM products',
                  undef, ($gid, CONTROLMAPSHOWN, CONTROLMAPNA));
    }
    Bugzilla::Group::RederiveRegexp($regexp, $gid);
    delete_token($token);

    print $cgi->header();
    $template->process("admin/groups/created.html.tmpl", $vars)
      || ThrowTemplateError($template->error());
    exit;
}

#
# action='del' -> ask if user really wants to delete
#
# (next action would be 'delete')
#

if ($action eq 'del') {
    # Check that an existing group ID is given
    my $gid = CheckGroupID($cgi->param('group'));
    my ($name, $desc, $isbuggroup) =
        $dbh->selectrow_array("SELECT name, description, isbuggroup " .
                              "FROM groups WHERE id = ?", undef, $gid);

    # System groups cannot be deleted!
    if (!$isbuggroup) {
        ThrowUserError("system_group_not_deletable", { name => $name });
    }
    # Groups having a special role cannot be deleted.
    my @special_groups;
    foreach my $special_group (SPECIAL_GROUPS) {
        if ($name eq Bugzilla->params->{$special_group}) {
            push(@special_groups, $special_group);
        }
    }
    if (scalar(@special_groups)) {
        ThrowUserError('group_has_special_role', {'name'  => $name,
                                                  'groups' => \@special_groups});
    }

    # Group inheritance no longer appears in user_group_map.
    my $grouplist = join(',', @{Bugzilla::User->flatten_group_membership($gid)});
    my $hasusers =
        $dbh->selectrow_array("SELECT 1 FROM user_group_map
                               WHERE group_id IN ($grouplist) AND isbless = 0 " .
                               $dbh->sql_limit(1)) || 0;

    my ($shared_queries) =
        $dbh->selectrow_array('SELECT COUNT(*)
                                 FROM namedquery_group_map
                                WHERE group_id = ?',
                              undef, $gid);

    my $bug_ids = $dbh->selectcol_arrayref('SELECT bug_id FROM bug_group_map
                                            WHERE group_id = ?', undef, $gid);

    my $hasbugs = scalar(@$bug_ids) ? 1 : 0;
    my $buglist = join(',', @$bug_ids);

    my $hasproduct = Bugzilla::Product->new({'name' => $name}) ? 1 : 0;

    my $hasflags = $dbh->selectrow_array('SELECT 1 FROM flagtypes 
                                           WHERE grant_group_id = ?
                                              OR request_group_id = ? ' .
                                          $dbh->sql_limit(1),
                                          undef, ($gid, $gid)) || 0;

    $vars->{'gid'}            = $gid;
    $vars->{'name'}           = $name;
    $vars->{'description'}    = $desc;
    $vars->{'hasusers'}       = $hasusers;
    $vars->{'hasbugs'}        = $hasbugs;
    $vars->{'hasproduct'}     = $hasproduct;
    $vars->{'hasflags'}       = $hasflags;
    $vars->{'shared_queries'} = $shared_queries;
    $vars->{'buglist'}        = $buglist;
    $vars->{'token'}          = issue_session_token('delete_group');

    print $cgi->header();
    $template->process("admin/groups/delete.html.tmpl", $vars)
      || ThrowTemplateError($template->error());
    
    exit;
}

#
# action='delete' -> really delete the group
#

if ($action eq 'delete') {
    check_token_data($token, 'delete_group');
    # Check that an existing group ID is given
    my $gid = CheckGroupID($cgi->param('group'));
    my ($name, $isbuggroup) =
        $dbh->selectrow_array("SELECT name, isbuggroup FROM groups " .
                              "WHERE id = ?", undef, $gid);

    # System groups cannot be deleted!
    if (!$isbuggroup) {
        ThrowUserError("system_group_not_deletable", { name => $name });
    }
    # Groups having a special role cannot be deleted.
    my @special_groups;
    foreach my $special_group (SPECIAL_GROUPS) {
        if ($name eq Bugzilla->params->{$special_group}) {
            push(@special_groups, $special_group);
        }
    }
    if (scalar(@special_groups)) {
        ThrowUserError('group_has_special_role', {'name'  => $name,
                                                  'groups' => \@special_groups});
    }

    my $cantdelete = 0;

    # Group inheritance no longer appears in user_group_map.
    my $grouplist = join(',', @{Bugzilla::User->flatten_group_membership($gid)});
    my $hasusers =
        $dbh->selectrow_array("SELECT 1 FROM user_group_map
                               WHERE group_id IN ($grouplist) AND isbless = 0 " .
                               $dbh->sql_limit(1)) || 0;

    if ($hasusers && !defined $cgi->param('removeusers')) {
        $cantdelete = 1;
    }

    my $hasbugs = $dbh->selectrow_array('SELECT 1 FROM bug_group_map
                                         WHERE group_id = ? ' .
                                         $dbh->sql_limit(1),
                                         undef, $gid) || 0;
    if ($hasbugs && !defined $cgi->param('removebugs')) {
        $cantdelete = 1;
    }

    if (Bugzilla::Product->new({'name' => $name})
        && !defined $cgi->param('unbind'))
    {
        $cantdelete = 1;
    }

    my $hasflags = $dbh->selectrow_array('SELECT 1 FROM flagtypes 
                                           WHERE grant_group_id = ?
                                              OR request_group_id = ? ' .
                                          $dbh->sql_limit(1),
                                          undef, ($gid, $gid)) || 0;
    if ($hasflags && !defined $cgi->param('removeflags')) {
        $cantdelete = 1;
    }

    $vars->{'gid'}        = $gid;
    $vars->{'name'}       = $name;

    ThrowUserError('group_cannot_delete', $vars) if $cantdelete;

    $dbh->do('UPDATE flagtypes SET grant_group_id = ?
               WHERE grant_group_id = ?',
              undef, (undef, $gid));
    $dbh->do('UPDATE flagtypes SET request_group_id = ?
               WHERE request_group_id = ?',
              undef, (undef, $gid));
    $dbh->do('DELETE FROM namedquery_group_map WHERE group_id = ?',
              undef, $gid);
    $dbh->do('DELETE FROM user_group_map WHERE group_id = ?',
              undef, $gid);
    $dbh->do('DELETE FROM group_group_map 
               WHERE grantor_id = ? OR member_id = ?',
              undef, ($gid, $gid));
    $dbh->do('DELETE FROM bug_group_map WHERE group_id = ?',
              undef, $gid);
    $dbh->do('DELETE FROM group_control_map WHERE group_id = ?',
              undef, $gid);
    $dbh->do('DELETE FROM whine_schedules
               WHERE mailto_type = ? AND mailto = ?',
              undef, (MAILTO_GROUP, $gid));
    $dbh->do('DELETE FROM groups WHERE id = ?',
              undef, $gid);

    delete_token($token);

    print $cgi->header();
    $template->process("admin/groups/deleted.html.tmpl", $vars)
      || ThrowTemplateError($template->error());

    exit;
}

#
# action='postchanges' -> update the groups
#

if ($action eq 'postchanges') {
    check_token_data($token, 'edit_group');
    # ZLL: Bug 181589: we need to have something to remove explicitly listed users from
    # groups in order for the conversion to 2.18 groups to work
    my $action;

    if ($cgi->param('remove_explicit_members')) {
        $action = 1;
    } elsif ($cgi->param('remove_explicit_members_regexp')) {
        $action = 2;
    } else {
        $action = 3;
    }
    
    my ($gid, $chgs, $name, $regexp) = doGroupChanges();
    
    $vars->{'action'}  = $action;
    $vars->{'changes'} = $chgs;
    $vars->{'gid'}     = $gid;
    $vars->{'name'}    = $name;
    if ($action == 2) {
        $vars->{'regexp'} = $regexp;
    }
    delete_token($token);

    print $cgi->header();
    $template->process("admin/groups/change.html.tmpl", $vars)
      || ThrowTemplateError($template->error());
    exit;
}

if (($action eq 'remove_all_regexp') || ($action eq 'remove_all')) {
    # remove all explicit users from the group with
    # gid = $cgi->param('group') that match the regular expression
    # stored in the DB for that group or all of them period

    my $gid = CheckGroupID($cgi->param('group'));

    my ($name, $regexp) =
      $dbh->selectrow_array('SELECT name, userregexp FROM groups
                             WHERE id = ?', undef, $gid);

    $dbh->bz_lock_tables('groups WRITE', 'profiles READ',
                         'user_group_map WRITE');

    my $sth = $dbh->prepare("SELECT user_group_map.user_id, profiles.login_name
                               FROM user_group_map
                         INNER JOIN profiles
                                 ON user_group_map.user_id = profiles.userid
                              WHERE user_group_map.group_id = ?
                                AND grant_type = ?
                                AND isbless = 0");
    $sth->execute($gid, GRANT_DIRECT);

    my @users;
    my $sth2 = $dbh->prepare("DELETE FROM user_group_map
                              WHERE user_id = ?
                              AND isbless = 0
                              AND group_id = ?");

    while ( my ($userid, $userlogin) = $sth->fetchrow_array() ) {
        if ((($regexp =~ /\S/) && ($userlogin =~ m/$regexp/i))
            || ($action eq 'remove_all'))
        {
            $sth2->execute($userid, $gid);

            my $user = {};
            $user->{'login'} = $userlogin;
            push(@users, $user);
        }
    }
    $dbh->bz_unlock_tables();

    $vars->{'users'}      = \@users;
    $vars->{'name'}       = $name;
    $vars->{'regexp'}     = $regexp;
    $vars->{'remove_all'} = ($action eq 'remove_all');
    $vars->{'gid'}        = $gid;
    
    print $cgi->header();
    $template->process("admin/groups/remove.html.tmpl", $vars)
      || ThrowTemplateError($template->error());

    exit;
}


#
# No valid action found
#

ThrowCodeError("action_unrecognized", $vars);


# Helper sub to handle the making of changes to a group
sub doGroupChanges {
    my $cgi = Bugzilla->cgi;
    my $dbh = Bugzilla->dbh;

    $dbh->bz_lock_tables('groups WRITE', 'group_group_map WRITE',
                         'bug_group_map WRITE', 'user_group_map WRITE',
                         'group_control_map READ', 'bugs READ', 'profiles READ',
                         # Due to the way Bugzilla::Config::BugFields::get_param_list()
                         # works, we need to lock these tables too.
                         'priority READ', 'bug_severity READ', 'rep_platform READ',
                         'op_sys READ');

    # Check that the given group ID and regular expression are valid.
    # If tests are successful, trimmed values are returned by CheckGroup*.
    my $gid = CheckGroupID($cgi->param('group'));
    my $regexp = CheckGroupRegexp($cgi->param('regexp'));

    # The name and the description of system groups cannot be edited.
    # We then need to know if the group being edited is a system group.
    my $isbuggroup = $dbh->selectrow_array('SELECT isbuggroup FROM groups
                                            WHERE id = ?', undef, $gid);
    my $name;
    my $desc;
    my $isactive;
    my $chgs = 0;

    # We trust old values given by the template. If they are hacked
    # in a way that some of the tests below become negative, the
    # corresponding attributes are not updated in the DB, which does
    # not hurt.
    if ($isbuggroup) {
        # Check that the group name and its description are valid
        # and return trimmed values if tests are successful.
        $name = CheckGroupName($cgi->param('name'), $gid);
        $desc = CheckGroupDesc($cgi->param('desc'));
        $isactive = $cgi->param('isactive') ? 1 : 0;

        if ($name ne $cgi->param('oldname')) {
            $chgs = 1;
            $dbh->do('UPDATE groups SET name = ? WHERE id = ?',
                      undef, ($name, $gid));
            # If the group is used by some parameters, we have to update
            # these parameters too.
            my $update_params = 0;
            foreach my $group (SPECIAL_GROUPS) {
                if ($cgi->param('oldname') eq Bugzilla->params->{$group}) {
                    SetParam($group, $name);
                    $update_params = 1;
                }
            }
            write_params() if $update_params;
        }
        if ($desc ne $cgi->param('olddesc')) {
            $chgs = 1;
            $dbh->do('UPDATE groups SET description = ? WHERE id = ?',
                      undef, ($desc, $gid));
        }
        if ($isactive ne $cgi->param('oldisactive')) {
            $chgs = 1;
            $dbh->do('UPDATE groups SET isactive = ? WHERE id = ?',
                      undef, ($isactive, $gid));
            # If the group was mandatory for some products before
            # we deactivated it and we now activate this group again,
            # we have to add all bugs created while this group was
            # disabled in bug_group_map to correctly protect them.
            if ($isactive) { fix_bug_permissions($gid); }
        }
    }
    if ($regexp ne $cgi->param('oldregexp')) {
        $chgs = 1;
        $dbh->do('UPDATE groups SET userregexp = ? WHERE id = ?',
                  undef, ($regexp, $gid));
        Bugzilla::Group::RederiveRegexp($regexp, $gid);
    }

    my $sthInsert = $dbh->prepare('INSERT INTO group_group_map
                                   (member_id, grantor_id, grant_type)
                                   VALUES (?, ?, ?)');

    my $sthDelete = $dbh->prepare('DELETE FROM group_group_map
                                    WHERE member_id = ?
                                      AND grantor_id = ?
                                      AND grant_type = ?');

    foreach my $b (grep {/^oldgrp-\d*$/} $cgi->param()) {
        if (defined($cgi->param($b))) {
            $b =~ /^oldgrp-(\d+)$/;
            my $v = $1;
            my $grp = $cgi->param("grp-$v") || 0;
            if (($v != $gid) && ($cgi->param("oldgrp-$v") != $grp)) {
                $chgs = 1;
                if ($grp != 0) {
                    $sthInsert->execute($v, $gid, GROUP_MEMBERSHIP);
                } else {
                    $sthDelete->execute($v, $gid, GROUP_MEMBERSHIP);
                }
            }

            my $bless = $cgi->param("bless-$v") || 0;
            my $oldbless = $cgi->param("oldbless-$v");
            if ((defined $oldbless) and ($oldbless != $bless)) {
                $chgs = 1;
                if ($bless != 0) {
                    $sthInsert->execute($v, $gid, GROUP_BLESS);
                } else {
                    $sthDelete->execute($v, $gid, GROUP_BLESS);
                }
            }

            my $cansee = $cgi->param("cansee-$v") || 0;
            if (Bugzilla->params->{"usevisibilitygroups"} 
               && ($cgi->param("oldcansee-$v") != $cansee)) {
                $chgs = 1;
                if ($cansee != 0) {
                    $sthInsert->execute($v, $gid, GROUP_VISIBLE);
                } else {
                    $sthDelete->execute($v, $gid, GROUP_VISIBLE);
                }
            }

        }
    }
    $dbh->bz_unlock_tables();
    return $gid, $chgs, $name, $regexp;
}