From e5909a62870fc3a9d39a7ffe63a5264f9666ea79 Mon Sep 17 00:00:00 2001 From: Joshua Tauberer Date: Sun, 22 Aug 2021 16:40:07 -0400 Subject: [PATCH] Allow non-admin login to the control panel and show/hide menu items depending on the login state * When logged out, no menu items are shown. * When logged in, Log Out is shown. * When logged in as an admin, the remaining menu items are also shown. * When logged in as a non-admin, the mail and contacts/calendar instruction pages are shown. Fixes #1987 --- management/templates/index.html | 46 +++++++++++++++++++++------------ management/templates/login.html | 28 +++++++++++++++++--- management/templates/users.html | 6 ++--- 3 files changed, 57 insertions(+), 23 deletions(-) diff --git a/management/templates/index.html b/management/templates/index.html index 492a953b..081d527f 100644 --- a/management/templates/index.html +++ b/management/templates/index.html @@ -62,6 +62,9 @@ ol li { margin-bottom: 1em; } + + .if-logged-in { display: none; } + .if-logged-in-admin { display: none; } @@ -83,7 +86,7 @@
@@ -302,7 +306,7 @@ function ajax_with_indicator(options) { return false; // handy when called from onclick } -var api_credentials = ["", ""]; +var api_credentials = null; function api(url, method, data, callback, callback_error, headers) { // from http://www.webtoolkit.info/javascript-base64.html function base64encode(input) { @@ -350,9 +354,10 @@ function api(url, method, data, callback, callback_error, headers) { // We don't store user credentials in a cookie to avoid the hassle of CSRF // attacks. The Authorization header only gets set in our AJAX calls triggered // by user actions. - xhr.setRequestHeader( - 'Authorization', - 'Basic ' + base64encode(api_credentials[0] + ':' + api_credentials[1])); + if (api_credentials) + xhr.setRequestHeader( + 'Authorization', + 'Basic ' + base64encode(api_credentials.username + ':' + api_credentials.session_key)); }, success: callback, error: callback_error || default_error, @@ -375,7 +380,7 @@ function do_logout() { api("/logout", "POST"); // Forget the token. - api_credentials = ["", ""]; + api_credentials = null; if (typeof localStorage != 'undefined') localStorage.removeItem("miab-cp-credentials"); if (typeof sessionStorage != 'undefined') @@ -383,6 +388,9 @@ function do_logout() { // Return to the start. show_panel('login'); + + // Reset menus. + show_hide_menus(); } function show_panel(panelid) { @@ -405,15 +413,21 @@ function show_panel(panelid) { $(function() { // Recall saved user credentials. - if (typeof sessionStorage != 'undefined' && sessionStorage.getItem("miab-cp-credentials")) - api_credentials = sessionStorage.getItem("miab-cp-credentials").split(":"); - else if (typeof localStorage != 'undefined' && localStorage.getItem("miab-cp-credentials")) - api_credentials = localStorage.getItem("miab-cp-credentials").split(":"); + try { + if (typeof sessionStorage != 'undefined' && sessionStorage.getItem("miab-cp-credentials")) + api_credentials = JSON.parse(sessionStorage.getItem("miab-cp-credentials")); + else if (typeof localStorage != 'undefined' && localStorage.getItem("miab-cp-credentials")) + api_credentials = JSON.parse(localStorage.getItem("miab-cp-credentials")); + } catch (_) { + } + + // Toggle menu state. + show_hide_menus(); // Recall what the user was last looking at. - if (typeof localStorage != 'undefined' && localStorage.getItem("miab-cp-lastpanel")) { + if (api_credentials != null && typeof localStorage != 'undefined' && localStorage.getItem("miab-cp-lastpanel")) { show_panel(localStorage.getItem("miab-cp-lastpanel")); - } else if (api_credentials[0] != "") { + } else if (api_credentials != null) { show_panel('welcome'); } else { show_panel('login'); diff --git a/management/templates/login.html b/management/templates/login.html index 8ae79857..421c8845 100644 --- a/management/templates/login.html +++ b/management/templates/login.html @@ -102,7 +102,7 @@ function do_login() { } // Exchange the email address & password for an API key. - api_credentials = [$('#loginEmail').val(), $('#loginPassword').val()] + api_credentials = { username: $('#loginEmail').val(), session_key: $('#loginPassword').val() } api( "/login", @@ -141,7 +141,9 @@ function do_login() { // Login succeeded. // Save the new credentials. - api_credentials = [response.email, response.api_key]; + api_credentials = { username: response.email, + session_key: response.api_key, + privileges: response.privileges }; // Try to wipe the username/password information. $('#loginEmail').val(''); @@ -152,14 +154,17 @@ function do_login() { // Remember the credentials. if (typeof localStorage != 'undefined' && typeof sessionStorage != 'undefined') { if ($('#loginRemember').val()) { - localStorage.setItem("miab-cp-credentials", api_credentials.join(":")); + localStorage.setItem("miab-cp-credentials", JSON.stringify(api_credentials)); sessionStorage.removeItem("miab-cp-credentials"); } else { localStorage.removeItem("miab-cp-credentials"); - sessionStorage.setItem("miab-cp-credentials", api_credentials.join(":")); + sessionStorage.setItem("miab-cp-credentials", JSON.stringify(api_credentials)); } } + // Toggle menus. + show_hide_menus(); + // Open the next panel the user wants to go to. Do this after the XHR response // is over so that we don't start a new XHR request while this one is finishing, // which confuses the loading indicator. @@ -183,4 +188,19 @@ function show_login() { } }); } + +function show_hide_menus() { + var is_logged_in = (api_credentials != null); + var privs = api_credentials ? api_credentials.privileges : []; + $('.if-logged-in').toggle(is_logged_in); + $('.if-logged-in-admin, .if-logged-in-not-admin').toggle(false); + if (is_logged_in) { + $('.if-logged-in-not-admin').toggle(true); + privs.forEach(function(priv) { + $('.if-logged-in-' + priv).toggle(true); + $('.if-logged-in-not-' + priv).toggle(false); + }); + } + $('.if-not-logged-in').toggle(!is_logged_in); +} diff --git a/management/templates/users.html b/management/templates/users.html index 24adf4a1..2ad5ebdb 100644 --- a/management/templates/users.html +++ b/management/templates/users.html @@ -203,7 +203,7 @@ function users_set_password(elem) { var email = $(elem).parents('tr').attr('data-email'); var yourpw = ""; - if (api_credentials != null && email == api_credentials[0]) + if (api_credentials != null && email == api_credentials.username) yourpw = "

If you change your own password, you will be logged out of this control panel and will need to log in again.

"; show_modal_confirm( @@ -232,7 +232,7 @@ function users_remove(elem) { var email = $(elem).parents('tr').attr('data-email'); // can't remove yourself - if (api_credentials != null && email == api_credentials[0]) { + if (api_credentials != null && email == api_credentials.username) { show_modal_error("Archive User", "You cannot archive your own account."); return; } @@ -264,7 +264,7 @@ function mod_priv(elem, add_remove) { var priv = $(elem).parents('td').find('.name').text(); // can't remove your own admin access - if (priv == "admin" && add_remove == "remove" && api_credentials != null && email == api_credentials[0]) { + if (priv == "admin" && add_remove == "remove" && api_credentials != null && email == api_credentials.username) { show_modal_error("Modify Privileges", "You cannot remove the admin privilege from yourself."); return; }